From de14d3aa3cd2845b621faf32b599766a66e158cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Jul 2023 16:51:50 +0000
Subject: [PATCH 001/373] Bump external/libbtf from `e532c3f` to `1b467a9`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `e532c3f` to `1b467a9`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/e532c3f53bdc4a99d506052abdedafdf14e7ebcd...1b467a9e22f9b812abb0593a2d20458fe05e7951)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index e532c3f53..1b467a9e2 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit e532c3f53bdc4a99d506052abdedafdf14e7ebcd
+Subproject commit 1b467a9e22f9b812abb0593a2d20458fe05e7951

From 63bf8e13494216be1ecb4f081aeffc961e350bcf Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Thu, 3 Aug 2023 12:36:35 -0700
Subject: [PATCH 002/373] Add test case to verify
 ebpf-samples/build/prog_array.o

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 ebpf-samples             | 2 +-
 external/libbtf          | 2 +-
 src/test/test_verify.cpp | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ebpf-samples b/ebpf-samples
index ac3262d7f..e6486118e 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit ac3262d7f3e02e5fa377a7e9984965cb57d8ae7c
+Subproject commit e6486118e4997a9780a30fd4bfeedcefd1567c8b
diff --git a/external/libbtf b/external/libbtf
index 1b467a9e2..f5fab5a0b 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 1b467a9e22f9b812abb0593a2d20458fe05e7951
+Subproject commit f5fab5a0b36869c104fa45a6ffb6c87295a22888
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 8fb5f1c72..450a2acbb 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -469,6 +469,7 @@ TEST_SECTION("build", "map_in_map_legacy.o", ".text")
 TEST_SECTION("build", "twomaps.o", ".text");
 TEST_SECTION("build", "twostackvars.o", ".text");
 TEST_SECTION("build", "twotypes.o", ".text");
+TEST_SECTION("build", "prog_array.o", ".text");
 
 // Test some programs that ought to fail verification.
 TEST_SECTION_REJECT("build", "badhelpercall.o", ".text")

From d51166fad872644860807e2d24bc67d77e6839c6 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Thu, 3 Aug 2023 15:09:32 -0700
Subject: [PATCH 003/373] Update ebpf-samples

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index e6486118e..e052151f8 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit e6486118e4997a9780a30fd4bfeedcefd1567c8b
+Subproject commit e052151f8cf3b3d65bfaade6255318a566457fbb

From fe238de2a0dbd9548c2b8ae6959822ce8c47fdd8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 2 Sep 2023 16:54:28 +0000
Subject: [PATCH 004/373] Bump external/ELFIO from `8ae6cec` to `73a2410`

Bumps [external/ELFIO](https://github.com/serge1/ELFIO) from `8ae6cec` to `73a2410`.
- [Release notes](https://github.com/serge1/ELFIO/releases)
- [Commits](https://github.com/serge1/ELFIO/compare/8ae6cec5d60495822ecd57d736f66149da9b1830...73a241079a040710481e9b840248ec0425e46c7c)

---
updated-dependencies:
- dependency-name: external/ELFIO
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/ELFIO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/ELFIO b/external/ELFIO
index 8ae6cec5d..73a241079 160000
--- a/external/ELFIO
+++ b/external/ELFIO
@@ -1 +1 @@
-Subproject commit 8ae6cec5d60495822ecd57d736f66149da9b1830
+Subproject commit 73a241079a040710481e9b840248ec0425e46c7c

From 3300cea59b977682e2e51bedf493a85120dad4bd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 9 Sep 2023 16:17:37 +0000
Subject: [PATCH 005/373] Bump actions/checkout from 3 to 4

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yml           | 4 ++--
 .github/workflows/codeql-analysis.yml | 2 +-
 .github/workflows/coverage.yml        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6d16a8ebe..b4b3f8e6c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,7 +28,7 @@ jobs:
         run: |
           sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev valgrind
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
 
@@ -57,7 +57,7 @@ jobs:
       BUILD_CONFIGURATION: ${{matrix.configurations}}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index bf4de1354..f33915f9b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         submodules: 'recursive'
 
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index a715139f5..5874a3ae1 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -26,7 +26,7 @@ jobs:
           sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev lcov
           pip install gcovr
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
 

From fd85b8a6ac2c0cb5621d9c1f38368089d616b8b9 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sat, 23 Sep 2023 19:23:51 +0300
Subject: [PATCH 006/373] Address linter / compiler warnings (#519)

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 CMakeLists.txt                  |  4 +--
 src/asm_files.cpp               | 14 ++++------
 src/asm_unmarshal.cpp           | 14 ----------
 src/assertions.cpp              |  1 -
 src/config.cpp                  |  1 -
 src/crab/array_domain.cpp       |  1 -
 src/crab/ebpf_domain.cpp        | 48 ++++++++++++--------------------
 src/crab/ebpf_domain.hpp        | 49 +++++++++++++++++----------------
 src/crab_utils/adapt_sgraph.hpp | 17 ++++++------
 src/ebpf_vm_isa.hpp             |  6 +---
 src/spec_type_descriptors.hpp   | 43 +++++++++++++++--------------
 src/string_constraints.hpp      |  2 +-
 12 files changed, 83 insertions(+), 117 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d7cf25631..2f1c82543 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -37,7 +37,7 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
   if (NOT NUGET)
     message("ERROR: You must first install nuget.exe from https://www.nuget.org/downloads")
   else ()
-    exec_program(${NUGET} ARGS install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
+    execute_process(COMMAND ${NUGET} ARGS install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
     set(BOOST_VERSION 1.81.0)
   endif()
   set(Boost_INCLUDE_DIRS ${CMAKE_BINARY_DIR}/packages/boost/lib/native/include)
@@ -93,7 +93,7 @@ if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
     "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
   set(COMMON_FLAGS -Wall -Wfatal-errors -DSIZEOF_VOID_P=8 -DSIZEOF_LONG=8)
 
-  set(RELEASE_FLAGS -O2 -flto -ffat-lto-objects)
+  set(RELEASE_FLAGS -O2 -flto=auto -ffat-lto-objects)
 
   set(DEBUG_FLAGS -O0 -g3 -fno-omit-frame-pointer)
 
diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 9bae2c1e7..b05928991 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -1,23 +1,21 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include <cassert>
 #include <iostream>
 #include <map>
+#include <set>
 #include <string>
 #include <vector>
-#include <set>
-#include <map>
 #include <sys/stat.h>
 
-#include "asm_files.hpp"
 #include "libbtf/btf.h"
 #include "libbtf/btf_json.h"
 #include "libbtf/btf_map.h"
 #include "libbtf/btf_parse.h"
-#include "platform.hpp"
-
 #include "elfio/elfio.hpp"
 
+#include "asm_files.hpp"
+#include "platform.hpp"
+
 using std::cout;
 using std::string;
 using std::vector;
@@ -183,7 +181,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                 .key_size = map.key_size,
                 .value_size = map.value_size,
                 .max_entries = map.max_entries,
-                .inner_map_fd = map.inner_map_type_id != 0 ? map.inner_map_type_id : -1,
+                .inner_map_fd = map.inner_map_type_id != 0 ? map.inner_map_type_id : DEFAULT_MAP_FD,
             });
         }
         map_record_size_or_map_offsets = map_offsets;
@@ -203,7 +201,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         // Replace the typeids with the pseudo-fds.
         for (auto &map_descriptor : info.map_descriptors) {
             map_descriptor.original_fd = type_id_to_fd_map[map_descriptor.original_fd];
-            if (map_descriptor.inner_map_fd != -1) {
+            if (map_descriptor.inner_map_fd != DEFAULT_MAP_FD) {
                 map_descriptor.inner_map_fd = type_id_to_fd_map[map_descriptor.inner_map_fd];
             }
         }
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 3536136f1..4a9609d46 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -1,7 +1,6 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 #include <cassert>
-#include <cstring> // memcmp
 #include <iostream>
 #include <string>
 #include <vector>
@@ -429,19 +428,6 @@ struct Unmarshaller {
                 break;
             }
             }
-            /*
-            vector<ebpf_inst> marshalled = marshal(new_ins[0], pc);
-            ebpf_inst actual = marshalled[0];
-            if (std::memcmp(&actual, &inst, sizeof(inst))) {
-                std::cerr << "new: " << new_ins[0] << "\n";
-                compare("opcode", actual.opcode, inst.opcode);
-                compare("dst", actual.dst, inst.dst);
-                compare("src", actual.src, inst.src);
-                compare("offset", actual.offset, inst.offset);
-                compare("imm", actual.imm, inst.imm);
-                std::cerr << "\n";
-            }
-            */
             if (pc == insts.size() - 1 && fallthrough)
                 note("fallthrough in last instruction");
 
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 7a74218bb..e3c55ae9d 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -6,7 +6,6 @@
 #include <vector>
 
 #include "asm_syntax.hpp"
-#include "ebpf_vm_isa.hpp"
 #include "platform.hpp"
 #include "crab/cfg.hpp"
 
diff --git a/src/config.cpp b/src/config.cpp
index 342e4ebd3..3849162c5 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -1,7 +1,6 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 #include "config.hpp"
-#include "platform.hpp"
 
 const ebpf_verifier_options_t ebpf_verifier_default_options = {
     .check_termination = false,
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 31a56668f..ec5be435d 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #include <algorithm>
-#include <bitset>
 #include <optional>
 #include <set>
 #include <unordered_map>
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 157822d37..d49d23977 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -4,7 +4,6 @@
 // This file is eBPF-specific, not derived from CRAB.
 
 #include <bitset>
-#include <functional>
 #include <optional>
 #include <utility>
 #include <vector>
@@ -12,8 +11,6 @@
 #include "boost/endian/conversion.hpp"
 #include "boost/range/algorithm/set_algorithm.hpp"
 
-#include "crab_utils/stats.hpp"
-
 #include "crab/array_domain.hpp"
 #include "crab/ebpf_domain.hpp"
 
@@ -289,10 +286,6 @@ assume_signed_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    auto rlb = right_interval.lb();
-    auto lnub = left_interval_negative.truncate_to_sint(true).ub();
-    auto lnlb = left_interval_negative.truncate_to_sint(true).lb();
-
     if (right_interval <= interval_t::negative_int(true)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1].
         return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue), number_t{0} <= left_uvalue,
@@ -316,9 +309,6 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    auto rlb = right_interval.lb();
-    auto lpub = left_interval_positive.truncate_to_sint(false).ub();
-
     if (right_interval <= interval_t::negative_int(false)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
@@ -327,7 +317,8 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative_int(false) &&
                right_interval <= interval_t::nonnegative_int(false)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX]
+        auto lpub = left_interval_positive.truncate_to_sint(false).ub();
         return {left_svalue >= 0,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue,
                 left_svalue <= left_uvalue,
@@ -384,9 +375,6 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    auto rlb = right_interval.lb();
-    auto lpub = left_interval_positive.truncate_to_sint(false).ub();
-
     if (right_interval <= interval_t::nonnegative_int(false)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         auto lpub = left_interval_positive.truncate_to_sint(false).ub();
@@ -1271,24 +1259,24 @@ bool ebpf_domain_t::TypeDomain::implies_type(const NumAbsDomain& inv, const line
     return inv.when(a).entail(b);
 }
 
-bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& m_inv, const Reg& r, TypeGroup group) const {
+bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const {
     using namespace crab::dsl_syntax;
     variable_t t = reg_pack(r).type;
     switch (group) {
-    case TypeGroup::number: return m_inv.entail(t == T_NUM);
-    case TypeGroup::map_fd: return m_inv.entail(t == T_MAP);
-    case TypeGroup::map_fd_programs: return m_inv.entail(t == T_MAP_PROGRAMS);
-    case TypeGroup::ctx: return m_inv.entail(t == T_CTX);
-    case TypeGroup::packet: return m_inv.entail(t == T_PACKET);
-    case TypeGroup::stack: return m_inv.entail(t == T_STACK);
-    case TypeGroup::shared: return m_inv.entail(t == T_SHARED);
-    case TypeGroup::non_map_fd: return m_inv.entail(t >= T_NUM);
-    case TypeGroup::mem: return m_inv.entail(t >= T_PACKET);
-    case TypeGroup::mem_or_num: return m_inv.entail(t >= T_NUM) && m_inv.entail(t != T_CTX);
-    case TypeGroup::pointer: return m_inv.entail(t >= T_CTX);
-    case TypeGroup::ptr_or_num: return m_inv.entail(t >= T_NUM);
-    case TypeGroup::stack_or_packet: return m_inv.entail(t >= T_PACKET) && m_inv.entail(t <= T_STACK);
-    case TypeGroup::singleton_ptr: return m_inv.entail(t >= T_CTX) && m_inv.entail(t <= T_STACK);
+    case TypeGroup::number: return inv.entail(t == T_NUM);
+    case TypeGroup::map_fd: return inv.entail(t == T_MAP);
+    case TypeGroup::map_fd_programs: return inv.entail(t == T_MAP_PROGRAMS);
+    case TypeGroup::ctx: return inv.entail(t == T_CTX);
+    case TypeGroup::packet: return inv.entail(t == T_PACKET);
+    case TypeGroup::stack: return inv.entail(t == T_STACK);
+    case TypeGroup::shared: return inv.entail(t == T_SHARED);
+    case TypeGroup::non_map_fd: return inv.entail(t >= T_NUM);
+    case TypeGroup::mem: return inv.entail(t >= T_PACKET);
+    case TypeGroup::mem_or_num: return inv.entail(t >= T_NUM) && inv.entail(t != T_CTX);
+    case TypeGroup::pointer: return inv.entail(t >= T_CTX);
+    case TypeGroup::ptr_or_num: return inv.entail(t >= T_NUM);
+    case TypeGroup::stack_or_packet: return inv.entail(t >= T_PACKET) && inv.entail(t <= T_STACK);
+    case TypeGroup::singleton_ptr: return inv.entail(t >= T_CTX) && inv.entail(t <= T_STACK);
     }
     assert(false);
     return false;
@@ -2581,7 +2569,6 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             break;
         case Bin::Op::LSH:
             if (m_inv.entail(type_is_number(src_reg))) {
-                auto src = reg_pack(src_reg);
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
                     uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
@@ -2600,7 +2587,6 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             break;
         case Bin::Op::RSH:
             if (m_inv.entail(type_is_number(src_reg))) {
-                auto src = reg_pack(src_reg);
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
                     uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 4b5c890c4..4e4aa3710 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -31,8 +31,8 @@ class ebpf_domain_t final {
     static ebpf_domain_t bottom();
     void set_to_top();
     void set_to_bottom();
-    bool is_bottom() const;
-    bool is_top() const;
+    [[nodiscard]] bool is_bottom() const;
+    [[nodiscard]] bool is_top() const;
     bool operator<=(const ebpf_domain_t& other);
     bool operator==(const ebpf_domain_t& other) const;
     void operator|=(ebpf_domain_t&& other);
@@ -102,7 +102,7 @@ class ebpf_domain_t final {
     void apply_signed(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
                       variable_t z, int finite_width);
     void apply_unsigned(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                      variable_t z, int finite_width);
+                        variable_t z, int finite_width);
 
     void add(const Reg& reg, int imm, int finite_width);
     void add(variable_t lhs, variable_t op2);
@@ -147,15 +147,15 @@ class ebpf_domain_t final {
     void havoc_offsets(NumAbsDomain& inv, const Reg& reg);
 
     static std::optional<variable_t> get_type_offset_variable(const Reg& reg, int type);
-    std::optional<variable_t> get_type_offset_variable(const Reg& reg, const NumAbsDomain& inv) const;
-    std::optional<variable_t> get_type_offset_variable(const Reg& reg) const;
+    [[nodiscard]] std::optional<variable_t> get_type_offset_variable(const Reg& reg, const NumAbsDomain& inv) const;
+    [[nodiscard]] std::optional<variable_t> get_type_offset_variable(const Reg& reg) const;
 
     void scratch_caller_saved_registers();
-    std::optional<uint32_t> get_map_type(const Reg& map_fd_reg) const;
-    std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
-    crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
-    crab::interval_t get_map_value_size(const Reg& map_fd_reg) const;
-    crab::interval_t get_map_max_entries(const Reg& map_fd_reg) const;
+    [[nodiscard]] std::optional<uint32_t> get_map_type(const Reg& map_fd_reg) const;
+    [[nodiscard]] std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
+    [[nodiscard]] crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
+    [[nodiscard]] crab::interval_t get_map_value_size(const Reg& map_fd_reg) const;
+    [[nodiscard]] crab::interval_t get_map_max_entries(const Reg& map_fd_reg) const;
     void forget_packet_pointers();
     void havoc_register(NumAbsDomain& inv, const Reg& reg);
     void do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null);
@@ -178,14 +178,15 @@ class ebpf_domain_t final {
 
     void recompute_stack_numeric_size(NumAbsDomain& inv, const Reg& reg);
     void recompute_stack_numeric_size(NumAbsDomain& inv, variable_t type_variable);
-    void do_load_stack(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr, int width, const Reg& src_reg);
+    void do_load_stack(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr, int width,
+                       const Reg& src_reg);
     void do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr_vague, int width);
     void do_load_packet_or_shared(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr, int width);
     void do_load(const Mem& b, const Reg& target_reg);
 
     template <typename X, typename Y, typename Z>
-    void do_store_stack(crab::domains::NumAbsDomain& inv, const number_t& width, const linear_expression_t& addr, X val_type, Y val_svalue, Z val_uvalue,
-                        const std::optional<reg_pack_t>& opt_val_reg);
+    void do_store_stack(crab::domains::NumAbsDomain& inv, const number_t& width, const linear_expression_t& addr,
+                        X val_type, Y val_svalue, Z val_uvalue, const std::optional<reg_pack_t>& opt_val_reg);
 
     template <typename Type, typename SValue, typename UValue>
     void do_mem_store(const Mem& b, Type val_type, SValue val_svalue, UValue val_uvalue,
@@ -195,7 +196,6 @@ class ebpf_domain_t final {
 
     static void initialize_packet(ebpf_domain_t& inv);
 
-
   private:
     /// Mapping from variables (including registers, types, offsets,
     /// memory locations, etc.) to numeric intervals or relationships
@@ -228,16 +228,17 @@ class ebpf_domain_t final {
         [[nodiscard]] bool has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const;
 
         [[nodiscard]] bool same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const;
-        [[nodiscard]] bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a, const linear_constraint_t& b) const;
-
-        NumAbsDomain join_over_types(const NumAbsDomain& inv, const Reg& reg,
-                                     const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
-        NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
-                                     const std::function<void(NumAbsDomain&)>& if_true,
-                                     const std::function<void(NumAbsDomain&)>& if_false) const;
+        [[nodiscard]] bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a,
+                                        const linear_constraint_t& b) const;
+
+        [[nodiscard]] NumAbsDomain
+        join_over_types(const NumAbsDomain& inv, const Reg& reg,
+                        const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
+        [[nodiscard]] NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
+                                                   const std::function<void(NumAbsDomain&)>& if_true,
+                                                   const std::function<void(NumAbsDomain&)>& if_false) const;
         void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const;
-        void add_extra_invariant(NumAbsDomain& dst,
-                                 std::map<crab::variable_t, crab::interval_t>& extra_invariants,
+        void add_extra_invariant(NumAbsDomain& dst, std::map<crab::variable_t, crab::interval_t>& extra_invariants,
                                  variable_t type_variable, type_encoding_t type, crab::data_kind_t kind,
                                  const NumAbsDomain& other) const;
 
@@ -248,4 +249,4 @@ class ebpf_domain_t final {
     std::string current_assertion;
 }; // end ebpf_domain_t
 
-}
+} // namespace crab
diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index 23741a770..c24ae935c 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -22,7 +22,6 @@ class TreeSMap final {
     col map;
 
   public:
-    using elt_t = std::pair<key_t, val_t>;
     using elt_iter_t = col::const_iterator;
     [[nodiscard]] size_t size() const { return map.size(); }
 
@@ -142,7 +141,7 @@ class AdaptGraph final {
     }
 
     struct vert_const_iterator {
-        vert_id v;
+        vert_id v{};
         const std::vector<int>& is_free;
 
         vert_id operator*() const { return v; }
@@ -401,14 +400,14 @@ class AdaptGraph final {
 
     // Ick. This'll have another indirection on every operation.
     // We'll see what the performance costs are like.
-    std::vector<smap_t> _preds;
-    std::vector<smap_t> _succs;
-    std::vector<Weight> _ws;
+    std::vector<smap_t> _preds{};
+    std::vector<smap_t> _succs{};
+    std::vector<Weight> _ws{};
 
-    size_t edge_count;
+    size_t edge_count{};
 
-    std::vector<int> is_free;
-    std::vector<vert_id> free_id;
-    std::vector<size_t> free_widx;
+    std::vector<int> is_free{};
+    std::vector<vert_id> free_id{};
+    std::vector<size_t> free_widx{};
 };
 } // namespace crab
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index c9716ec1c..0f1f0974c 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -57,9 +57,7 @@ enum {
     INST_OP_JA = (INST_CLS_JMP | 0x00),
     INST_OP_CALL = (INST_CLS_JMP | 0x80),
     INST_OP_EXIT = (INST_CLS_JMP | 0x90),
-};
 
-enum {
     INST_ALU_OP_ADD  = 0x00,
     INST_ALU_OP_SUB  = 0x10,
     INST_ALU_OP_MUL  = 0x20,
@@ -74,10 +72,8 @@ enum {
     INST_ALU_OP_MOV  = 0xb0,
     INST_ALU_OP_ARSH = 0xc0,
     INST_ALU_OP_END  = 0xd0,
-    INST_ALU_OP_MASK = 0xf0
-};
+    INST_ALU_OP_MASK = 0xf0,
 
-enum {
     R0_RETURN_VALUE = 0,
     R1_ARG = 1,
     R2_ARG = 2,
diff --git a/src/spec_type_descriptors.hpp b/src/spec_type_descriptors.hpp
index 437f0a02f..cad589fa7 100644
--- a/src/spec_type_descriptors.hpp
+++ b/src/spec_type_descriptors.hpp
@@ -32,13 +32,16 @@ struct EbpfMapDescriptor {
     unsigned int inner_map_fd;
 };
 
+constexpr unsigned int DEFAULT_MAP_FD = 0xffffffff;
+
 struct EbpfProgramType {
-    std::string name; // For ease of display, not used by the verifier.
-    const ebpf_context_descriptor_t* context_descriptor {};
-    uint64_t platform_specific_data {}; // E.g., integer program type.
-    std::vector<std::string> section_prefixes;
-    bool is_privileged {};
+    std::string name{}; // For ease of display, not used by the verifier.
+    const ebpf_context_descriptor_t* context_descriptor{};
+    uint64_t platform_specific_data{}; // E.g., integer program type.
+    std::vector<std::string> section_prefixes{};
+    bool is_privileged{};
 };
+
 void print_map_descriptors(const std::vector<EbpfMapDescriptor>& descriptors, std::ostream& o);
 
 using EquivalenceKey = std::tuple<
@@ -48,25 +51,25 @@ using EquivalenceKey = std::tuple<
     uint32_t /* max_entries */>;
 
 struct program_info {
-    const struct ebpf_platform_t* platform = nullptr;
-    std::vector<EbpfMapDescriptor> map_descriptors;
-    EbpfProgramType type;
-    std::map<EquivalenceKey, int> cache;
+    const struct ebpf_platform_t* platform{};
+    std::vector<EbpfMapDescriptor> map_descriptors{};
+    EbpfProgramType type{};
+    std::map<EquivalenceKey, int> cache{};
 };
 
-typedef struct _btf_line_info {
-    std::string file_name;
-    std::string source_line;
-    uint32_t line_number;
-    uint32_t column_number;
-} btf_line_info_t;
+struct btf_line_info_t {
+    std::string file_name{};
+    std::string source_line{};
+    uint32_t line_number{};
+    uint32_t column_number{};
+};
 
 struct raw_program {
-    std::string filename;
-    std::string section;
-    std::vector<ebpf_inst> prog;
-    program_info info;
-    std::vector<btf_line_info_t> line_info;
+    std::string filename{};
+    std::string section{};
+    std::vector<ebpf_inst> prog{};
+    program_info info{};
+    std::vector<btf_line_info_t> line_info{};
 };
 
 extern thread_local crab::lazy_allocator<program_info> global_program_info;
diff --git a/src/string_constraints.hpp b/src/string_constraints.hpp
index ead071c34..278c8f414 100644
--- a/src/string_constraints.hpp
+++ b/src/string_constraints.hpp
@@ -26,7 +26,7 @@ enum type_encoding_t {
 };
 
 struct string_invariant {
-    std::optional<std::set<std::string>> maybe_inv;
+    std::optional<std::set<std::string>> maybe_inv{};
 
     string_invariant() = default;
 

From ef234a6f25b7ca2c551b5792cd0ec4039b9457a7 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 16 Oct 2023 18:38:18 +0300
Subject: [PATCH 007/373] narrow to constant bounds once (#479)

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 CMakeLists.txt                |   2 -
 src/asm_marshal.cpp           |   4 +
 src/asm_ostream.cpp           |   3 +
 src/asm_ostream.hpp           |   1 +
 src/asm_syntax.hpp            |   7 +-
 src/assertions.cpp            |   2 +
 src/crab/ebpf_domain.cpp      |  67 ++++++---
 src/crab/ebpf_domain.hpp      |   9 +-
 src/crab/fwd_analyzer.cpp     |  84 ++++++-----
 src/crab/fwd_analyzer.hpp     |   3 +-
 src/crab/var_factory.cpp      |  10 +-
 src/crab/variable.hpp         |   4 +-
 src/crab_verifier.cpp         | 119 ++++++---------
 src/ebpf_yaml.cpp             |   9 +-
 src/ebpf_yaml.hpp             |   2 +-
 src/test/test_loop.cpp        |  33 -----
 src/test/test_termination.cpp |  69 ---------
 src/test/test_yaml.cpp        |   1 +
 test-data/assign.yaml         |   2 +-
 test-data/loop.yaml           | 268 ++++++++++++++++++++++++++++++++++
 20 files changed, 446 insertions(+), 253 deletions(-)
 delete mode 100644 src/test/test_loop.cpp
 delete mode 100644 src/test/test_termination.cpp
 create mode 100644 test-data/loop.yaml

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2f1c82543..26d9ae3bf 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -80,10 +80,8 @@ file(GLOB LIB_SRC
 file(GLOB ALL_TEST
         "./src/test/test.cpp"
         "./src/test/test_conformance.cpp"
-        "./src/test/test_loop.cpp"
         "./src/test/test_marshal.cpp"
         "./src/test/test_print.cpp"
-        "./src/test/test_termination.cpp"
         "./src/test/test_verify.cpp"
         "./src/test/test_wto.cpp"
         "./src/test/test_yaml.cpp"
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 82e4bc207..36bbe783e 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -229,6 +229,10 @@ struct MarshalVisitor {
             .offset = static_cast<int16_t>(b.access.offset),
             .imm = 0}};
     }
+
+    vector<ebpf_inst> operator()(IncrementLoopCounter const& ins) {
+        return {};
+    }
 };
 
 vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc) { return std::visit(MarshalVisitor{label_to_offset(pc)}, ins); }
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 1abf83fd9..2ecdda978 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -329,6 +329,9 @@ struct InstructionPrinterVisitor {
         os_ << "assert " << a.cst;
     }
 
+    void operator()(IncrementLoopCounter const& a) {
+        os_ << crab::variable_t::instruction_count(to_string(a.name)) << "++";
+    }
 };
 
 string to_string(label_t const& label) {
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index 2766c16bf..7ab2c059e 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -48,5 +48,6 @@ inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << (
 inline std::ostream& operator<<(std::ostream& os, LockAdd const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << (Instruction)a; }
+inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) { return os << (Instruction)a; }
 std::ostream& operator<<(std::ostream& os, AssertionConstraint const& a);
 std::string to_string(AssertionConstraint const& constraint);
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 0e4ba3a2a..09da5b6a4 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -309,7 +309,11 @@ struct Assert {
     Assert(AssertionConstraint cst): cst(cst) { }
 };
 
-using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert>;
+struct IncrementLoopCounter {
+    label_t name;
+};
+
+using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert, IncrementLoopCounter>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
@@ -382,6 +386,7 @@ DECLARE_EQ5(ValidAccess, reg, offset, width, or_null, access_type)
 DECLARE_EQ3(ValidMapKeyValue, access_reg, map_fd_reg, key)
 DECLARE_EQ1(ZeroCtxOffset, reg)
 DECLARE_EQ1(Assert, cst)
+DECLARE_EQ1(IncrementLoopCounter, name)
 
 }
 
diff --git a/src/assertions.cpp b/src/assertions.cpp
index e3c55ae9d..a76d5906d 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -38,6 +38,8 @@ class AssertExtractor {
 
     vector<Assert> operator()(Assert const& ins) const { assert(false); return {}; }
 
+    vector<Assert> operator()(IncrementLoopCounter ins) const { assert(false); return {}; }
+
     vector<Assert> operator()(LoadMapFd const& ins) const { return {}; }
 
     /// Packet access implicitly uses R6, so verify that R6 still has a pointer to the context.
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index d49d23977..072ffad67 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -909,8 +909,39 @@ ebpf_domain_t ebpf_domain_t::operator&(const ebpf_domain_t& other) const {
     return ebpf_domain_t(m_inv & other.m_inv, stack & other.stack);
 }
 
-ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other) {
-    return ebpf_domain_t(m_inv.widen(other.m_inv), stack | other.stack);
+ebpf_domain_t ebpf_domain_t::calculate_constant_limits() {
+    ebpf_domain_t inv;
+    using namespace crab::dsl_syntax;
+    for (int i : {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}) {
+        auto r = reg_pack(i);
+        inv += r.svalue <= std::numeric_limits<int32_t>::max();
+        inv += r.svalue >= std::numeric_limits<int32_t>::min();
+        inv += r.uvalue <= std::numeric_limits<uint32_t>::max();
+        inv += r.uvalue >= 0;
+        inv += r.stack_offset <= EBPF_STACK_SIZE;
+        inv += r.stack_offset >= 0;
+        inv += r.shared_offset <= r.shared_region_size;
+        inv += r.shared_offset >= 0;
+        inv += r.packet_offset <= variable_t::packet_size();
+        inv += r.packet_offset >= 0;
+        if (thread_local_options.check_termination) {
+            for (variable_t counter : variable_t::get_instruction_counters()) {
+                inv += counter <= std::numeric_limits<int32_t>::max();
+                inv += counter >= 0;
+                inv += counter <= r.svalue;
+            }
+        }
+    }
+    return inv;
+}
+
+static const ebpf_domain_t constant_limits = ebpf_domain_t::calculate_constant_limits();
+
+ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, bool to_constants) {
+    ebpf_domain_t res{m_inv.widen(other.m_inv), stack | other.stack};
+    if (to_constants)
+        return res & constant_limits;
+    return res;
 }
 
 ebpf_domain_t ebpf_domain_t::narrow(const ebpf_domain_t& other) {
@@ -1333,19 +1364,10 @@ void ebpf_domain_t::overflow_unsigned(NumAbsDomain& inv, variable_t lhs, int fin
     overflow_bounds(inv, lhs, span, finite_width, false);
 }
 
-void ebpf_domain_t::operator()(const basic_block_t& bb, bool check_termination) {
+void ebpf_domain_t::operator()(const basic_block_t& bb) {
     for (const Instruction& statement : bb) {
         std::visit(*this, statement);
     }
-    if (check_termination) {
-        // +1 to avoid being tricked by empty loops
-        add(variable_t::instruction_count(), crab::number_t((unsigned)bb.size() + 1));
-    }
-}
-
-bound_t ebpf_domain_t::get_instruction_count_upper_bound() {
-    const auto& ub = m_inv[variable_t::instruction_count()].ub();
-    return ub;
 }
 
 void ebpf_domain_t::check_access_stack(NumAbsDomain& inv, const linear_expression_t& lb,
@@ -2681,7 +2703,7 @@ void ebpf_domain_t::initialize_packet(ebpf_domain_t& inv) {
 ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& constraints, bool setup_constraints) {
     ebpf_domain_t inv;
     if (setup_constraints) {
-        inv = ebpf_domain_t::setup_entry(false, false);
+        inv = ebpf_domain_t::setup_entry(false);
     }
     auto numeric_ranges = std::vector<crab::interval_t>();
     for (const auto& cst : parse_linear_constraints(constraints, numeric_ranges)) {
@@ -2696,7 +2718,7 @@ ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& const
     return inv;
 }
 
-ebpf_domain_t ebpf_domain_t::setup_entry(bool check_termination, bool init_r1) {
+ebpf_domain_t ebpf_domain_t::setup_entry(bool init_r1) {
     using namespace crab::dsl_syntax;
 
     ebpf_domain_t inv;
@@ -2719,10 +2741,21 @@ ebpf_domain_t ebpf_domain_t::setup_entry(bool check_termination, bool init_r1) {
     }
 
     initialize_packet(inv);
-    if (check_termination) {
-        inv.assign(variable_t::instruction_count(), 0);
-    }
     return inv;
 }
 
+void ebpf_domain_t::initialize_instruction_count(const label_t label) {
+    m_inv.assign(variable_t::instruction_count(to_string(label)), 0);
+}
+
+bound_t ebpf_domain_t::get_instruction_count_upper_bound() {
+    crab::bound_t ub{number_t{0}};
+    for (variable_t counter : variable_t::get_instruction_counters())
+        ub += std::max(ub, m_inv[counter].ub());
+    return ub;
+}
+
+void ebpf_domain_t::operator()(const IncrementLoopCounter& ins) {
+    this->add(variable_t::instruction_count(to_string(ins.name)), 1);
+}
 } // namespace crab
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 4e4aa3710..c8bba9197 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -41,20 +41,20 @@ class ebpf_domain_t final {
     ebpf_domain_t operator|(const ebpf_domain_t& other) const&;
     ebpf_domain_t operator|(const ebpf_domain_t& other) &&;
     ebpf_domain_t operator&(const ebpf_domain_t& other) const;
-    ebpf_domain_t widen(const ebpf_domain_t& other);
+    ebpf_domain_t widen(const ebpf_domain_t& other, bool to_constants);
     ebpf_domain_t widening_thresholds(const ebpf_domain_t& other, const crab::iterators::thresholds_t& ts);
     ebpf_domain_t narrow(const ebpf_domain_t& other);
 
     typedef bool check_require_func_t(NumAbsDomain&, const linear_constraint_t&, std::string);
     void set_require_check(std::function<check_require_func_t> f);
     bound_t get_instruction_count_upper_bound();
-    static ebpf_domain_t setup_entry(bool check_termination, bool init_r1);
+    static ebpf_domain_t setup_entry(bool init_r1);
 
     static ebpf_domain_t from_constraints(const std::set<std::string>& constraints, bool setup_constraints);
     string_invariant to_set();
 
     // abstract transformers
-    void operator()(const basic_block_t& bb, bool check_termination);
+    void operator()(const basic_block_t& bb);
 
     void operator()(const Addable&);
     void operator()(const Assert&);
@@ -77,7 +77,10 @@ class ebpf_domain_t final {
     void operator()(const ValidSize&);
     void operator()(const ValidStore&);
     void operator()(const ZeroCtxOffset&);
+    void operator()(const IncrementLoopCounter&);
 
+    void initialize_instruction_count(label_t label);
+    static ebpf_domain_t calculate_constant_limits();
   private:
     // private generic domain functions
     void operator+=(const linear_constraint_t& cst);
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index f79e86135..5a760bae4 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -48,44 +48,37 @@ class interleaved_fwd_fixpoint_iterator_t final {
     wto_t _wto;
     invariant_table_t _pre, _post;
 
-    /// number of iterations until triggering widening
-    const unsigned int _widening_delay{1};
-
     /// number of narrowing iterations. If the narrowing operator is
     /// indeed a narrowing operator this parameter is not
     /// needed. However, there are abstract domains for which an actual
     /// narrowing operation is not available so we must enforce
     /// termination.
-    const unsigned int _descending_iterations;
+    static constexpr unsigned int _descending_iterations = 2000000;
 
     /// Used to skip the analysis until _entry is found
     bool _skip{true};
 
-    /// Whether the domain tracks instruction count; the invariants are somewhat easier to read without it
-    /// Generally corresponds to the check_termination flag in ebpf_verifier_options_t
-    const bool check_termination;
-
   private:
-    inline void set_pre(const label_t& label, const ebpf_domain_t& v) { _pre[label] = v; }
+    void set_pre(const label_t& label, const ebpf_domain_t& v) { _pre[label] = v; }
 
-    inline void transform_to_post(const label_t& label, ebpf_domain_t pre) {
+    void transform_to_post(const label_t& label, ebpf_domain_t pre) {
         basic_block_t& bb = _cfg.get_node(label);
-        pre(bb, check_termination);
+        pre(bb);
         _post[label] = std::move(pre);
     }
 
-    [[nodiscard]]
-    ebpf_domain_t extrapolate(const label_t& node, unsigned int iteration, ebpf_domain_t before,
-                              const ebpf_domain_t& after) const {
-        if (iteration <= _widening_delay) {
+    [[nodiscard]] static ebpf_domain_t extrapolate(ebpf_domain_t before, const ebpf_domain_t& after,
+                                                   unsigned int iteration) {
+        /// number of iterations until triggering widening
+        constexpr auto _widening_delay = 2;
+
+        if (iteration < _widening_delay) {
             return before | after;
-        } else {
-            return before.widen(after);
         }
+        return before.widen(after, iteration == _widening_delay);
     }
 
-    static ebpf_domain_t refine(const label_t& node, unsigned int iteration, ebpf_domain_t before,
-                                const ebpf_domain_t& after) {
+    static ebpf_domain_t refine(ebpf_domain_t before, const ebpf_domain_t& after, unsigned int iteration) {
         if (iteration == 1) {
             return before & after;
         } else {
@@ -102,8 +95,7 @@ class interleaved_fwd_fixpoint_iterator_t final {
     }
 
   public:
-    explicit interleaved_fwd_fixpoint_iterator_t(cfg_t& cfg, unsigned int descending_iterations, bool check_termination)
-        : _cfg(cfg), _wto(cfg), _descending_iterations(descending_iterations), check_termination(check_termination) {
+    explicit interleaved_fwd_fixpoint_iterator_t(cfg_t& cfg) : _cfg(cfg), _wto(cfg) {
         for (const auto& label : _cfg.labels()) {
             _pre.emplace(label, ebpf_domain_t::bottom());
             _post.emplace(label, ebpf_domain_t::bottom());
@@ -114,17 +106,28 @@ class interleaved_fwd_fixpoint_iterator_t final {
 
     ebpf_domain_t get_post(const label_t& node) { return _post.at(node); }
 
-    void operator()(const label_t& vertex);
+    void operator()(const label_t& node);
 
     void operator()(std::shared_ptr<wto_cycle_t>& cycle);
 
-    friend std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, const ebpf_domain_t& entry_inv, bool check_termination);
+    friend std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv);
 };
 
-std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, const ebpf_domain_t& entry_inv, bool check_termination) {
+std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv) {
     // Go over the CFG in weak topological order (accounting for loops).
-    constexpr unsigned int descending_iterations = 2000000;
-    interleaved_fwd_fixpoint_iterator_t analyzer(cfg, descending_iterations, check_termination);
+    interleaved_fwd_fixpoint_iterator_t analyzer(cfg);
+    if (thread_local_options.check_termination) {
+        std::vector<label_t> cycle_heads;
+        for (auto& component : analyzer._wto) {
+            if (std::holds_alternative<std::shared_ptr<wto_cycle_t>>(*component)) {
+                cycle_heads.push_back(std::get<std::shared_ptr<wto_cycle_t>>(*component)->head());
+            }
+        }
+        for (const label_t& label : cycle_heads) {
+            entry_inv.initialize_instruction_count(label);
+            cfg.get_node(label).insert(IncrementLoopCounter{label});
+        }
+    }
     analyzer.set_pre(cfg.entry_label(), entry_inv);
     for (auto& component : analyzer._wto) {
         std::visit(analyzer, *component);
@@ -164,46 +167,41 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
         }
     }
 
-    ebpf_domain_t pre = ebpf_domain_t::bottom();
+    ebpf_domain_t invariant = ebpf_domain_t::bottom();
     if (entry_in_this_cycle) {
-        pre = get_pre(_cfg.entry_label());
+        invariant = get_pre(_cfg.entry_label());
     } else {
         wto_nesting_t cycle_nesting = _wto.nesting(head);
         for (const label_t& prev : _cfg.prev_nodes(head)) {
             if (!(_wto.nesting(prev) > cycle_nesting)) {
-                pre |= get_post(prev);
+                invariant |= get_post(prev);
             }
         }
     }
 
     for (unsigned int iteration = 1;; ++iteration) {
         // Increasing iteration sequence with widening
-        set_pre(head, pre);
-        transform_to_post(head, pre);
+        set_pre(head, invariant);
+        transform_to_post(head, invariant);
         for (auto& component : *cycle) {
             wto_component_t c = *component;
             if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head))
                 std::visit(*this, *component);
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
-        if (new_pre <= pre) {
+        if (new_pre <= invariant) {
             // Post-fixpoint reached
             set_pre(head, new_pre);
-            pre = std::move(new_pre);
+            invariant = std::move(new_pre);
             break;
         } else {
-            pre = extrapolate(head, iteration, pre, new_pre);
+            invariant = extrapolate(invariant, new_pre, iteration);
         }
     }
 
-    if (this->_descending_iterations == 0) {
-        // no narrowing
-        return;
-    }
-
     for (unsigned int iteration = 1;; ++iteration) {
         // Decreasing iteration sequence with narrowing
-        transform_to_post(head, pre);
+        transform_to_post(head, invariant);
 
         for (auto& component : *cycle) {
             wto_component_t c = *component;
@@ -211,14 +209,14 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
                 std::visit(*this, *component);
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
-        if (pre <= new_pre) {
+        if (invariant <= new_pre) {
             // No more refinement possible(pre == new_pre)
             break;
         } else {
             if (iteration > _descending_iterations)
                 break;
-            pre = refine(head, iteration, pre, new_pre);
-            set_pre(head, pre);
+            invariant = refine(invariant, new_pre, iteration);
+            set_pre(head, invariant);
         }
     }
 }
diff --git a/src/crab/fwd_analyzer.hpp b/src/crab/fwd_analyzer.hpp
index 4f01c3841..a6e35e476 100644
--- a/src/crab/fwd_analyzer.hpp
+++ b/src/crab/fwd_analyzer.hpp
@@ -13,7 +13,6 @@ namespace crab {
 
 using invariant_table_t = std::map<label_t, ebpf_domain_t>;
 
-std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, const ebpf_domain_t& entry_inv,
-                                                                     bool check_termination);
+std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv);
 
 } // namespace crab
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index 94d55d5d3..2418a0b96 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -88,7 +88,7 @@ variable_t variable_t::kind_var(data_kind_t kind, variable_t type_variable) {
 
 variable_t variable_t::meta_offset() { return make("meta_offset"); }
 variable_t variable_t::packet_size() { return make("packet_size"); }
-variable_t variable_t::instruction_count() { return make("instruction_count"); }
+variable_t variable_t::instruction_count(const std::string& label) { return make("pc[" + label + "]"); }
 
 static bool ends_with(const std::string& str, const std::string& suffix)
 {
@@ -108,4 +108,12 @@ bool variable_t::is_in_stack() const {
     return this->name()[0] == 's';
 }
 
+std::vector<variable_t> variable_t::get_instruction_counters() {
+    std::vector<variable_t> res;
+    for (const std::string& name: *names) {
+        if (name.find("pc") == 0)
+            res.push_back(make(name));
+    }
+    return res;
+}
 } // end namespace crab
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 12dd13671..f51055c42 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -75,8 +75,8 @@ class variable_t final {
     static variable_t kind_var(data_kind_t kind, variable_t type_variable);
     static variable_t meta_offset();
     static variable_t packet_size();
-    static variable_t instruction_count();
-
+    static std::vector<variable_t> get_instruction_counters();
+    static variable_t instruction_count(const std::string& label);
     [[nodiscard]] bool is_in_stack() const;
 
     struct Hasher {
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index f4702869b..7904415cd 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -4,10 +4,7 @@
  *  This module is about selecting the numerical and memory domains, initiating
  *  the verification process and returning the results.
  **/
-#include <cinttypes>
 
-#include <ctime>
-#include <functional>
 #include <iostream>
 #include <map>
 #include <string>
@@ -23,8 +20,8 @@
 #include "crab_verifier.hpp"
 #include "string_constraints.hpp"
 
-using std::string;
 using crab::ebpf_domain_t;
+using std::string;
 
 thread_local crab::lazy_allocator<program_info> global_program_info;
 thread_local ebpf_verifier_options_t thread_local_options;
@@ -34,12 +31,9 @@ struct checks_db final {
     std::map<label_t, std::vector<std::string>> m_db{};
     int total_warnings{};
     int total_unreachable{};
-    crab::bound_t max_instruction_count{crab::number_t{0}};;
-    std::set<label_t> maybe_nonterminating;
+    crab::bound_t max_instruction_count{crab::number_t{0}};
 
-    void add(const label_t& label, const std::string& msg) {
-        m_db[label].emplace_back(msg);
-    }
+    void add(const label_t& label, const std::string& msg) { m_db[label].emplace_back(msg); }
 
     void add_warning(const label_t& label, const std::string& msg) {
         add(label, msg);
@@ -51,11 +45,6 @@ struct checks_db final {
         total_unreachable++;
     }
 
-    void add_nontermination(const label_t& label) {
-        maybe_nonterminating.insert(label);
-        total_warnings++;
-    }
-
     [[nodiscard]] int get_max_instruction_count() const {
         auto m = this->max_instruction_count.number();
         if (m && m->fits_sint32())
@@ -66,60 +55,47 @@ struct checks_db final {
     checks_db() = default;
 };
 
-static checks_db generate_report(cfg_t& cfg,
-                                 crab::invariant_table_t& pre_invariants,
+static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invariants,
                                  crab::invariant_table_t& post_invariants) {
     checks_db m_db;
     for (const label_t& label : cfg.sorted_labels()) {
         basic_block_t& bb = cfg.get_node(label);
         ebpf_domain_t from_inv(pre_invariants.at(label));
-        from_inv.set_require_check([&m_db, label](auto& inv, const crab::linear_constraint_t& cst,
-                                                     const std::string& s) {
-            if (inv.is_bottom())
-                return true;
-            if (cst.is_contradiction()) {
-                m_db.add_warning(label, s);
-                return false;
-            }
-
-            if (inv.entail(cst)) {
-                // add_redundant(s);
-                return true;
-            } else if (inv.intersect(cst)) {
-                // TODO: add_error() if imply negation
-                m_db.add_warning(label, s);
-                return false;
-            } else {
-                m_db.add_warning(label, s);
-                return false;
-            }
-        });
-
-        if (thread_local_options.check_termination) {
-            // Pinpoint the places where divergence might occur.
-            crab::bound_t min_instruction_count_upper_bound{crab::bound_t::plus_infinity()};
-            for (const label_t& prev_label : bb.prev_blocks_set()) {
-                crab::bound_t instruction_count = pre_invariants.at(prev_label).get_instruction_count_upper_bound();
-                min_instruction_count_upper_bound = std::min(min_instruction_count_upper_bound, instruction_count);
-            }
-
-            crab::bound_t max_instructions{100000};
-            crab::bound_t instruction_count_upper_bound = from_inv.get_instruction_count_upper_bound();
-            if ((min_instruction_count_upper_bound < max_instructions) &&
-                (instruction_count_upper_bound >= max_instructions))
-                m_db.add_nontermination(label);
-
-            m_db.max_instruction_count = std::max(m_db.max_instruction_count, instruction_count_upper_bound);
-        }
+        from_inv.set_require_check(
+            [&m_db, label](auto& inv, const crab::linear_constraint_t& cst, const std::string& s) {
+                if (inv.is_bottom())
+                    return true;
+                if (cst.is_contradiction()) {
+                    m_db.add_warning(label, s);
+                    return false;
+                }
+
+                if (inv.entail(cst)) {
+                    // add_redundant(s);
+                    return true;
+                } else if (inv.intersect(cst)) {
+                    // TODO: add_error() if imply negation
+                    m_db.add_warning(label, s);
+                    return false;
+                } else {
+                    m_db.add_warning(label, s);
+                    return false;
+                }
+            });
 
         bool pre_bot = from_inv.is_bottom();
 
-        from_inv(bb, thread_local_options.check_termination);
+        from_inv(bb);
 
         if (!pre_bot && from_inv.is_bottom()) {
             m_db.add_unreachable(label, std::string("Code is unreachable after ") + to_string(bb.label()));
         }
     }
+
+    if (thread_local_options.check_termination) {
+        auto last_inv = post_invariants.at(cfg.exit_label());
+        m_db.max_instruction_count = last_inv.get_instruction_count_upper_bound();
+    }
     return m_db;
 }
 
@@ -146,12 +122,9 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
         }
     }
     os << "\n";
-    if (!db.maybe_nonterminating.empty()) {
-        os << "Could not prove termination on join into: ";
-        for (const label_t& label : db.maybe_nonterminating) {
-            os << label << ", ";
-        }
-        os << "\n";
+    crab::number_t max_instructions{100000};
+    if (db.max_instruction_count > max_instructions) {
+        os << "Could not prove termination.\n";
     }
 }
 
@@ -178,9 +151,8 @@ static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
 
     try {
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
-        ebpf_domain_t entry_dom = ebpf_domain_t::setup_entry(options->check_termination, true);
-        auto [pre_invariants, post_invariants] =
-            crab::run_forward_analyzer(cfg, std::move(entry_dom), options->check_termination);
+        ebpf_domain_t entry_dom = ebpf_domain_t::setup_entry(true);
+        auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_dom));
         return get_analysis_report(s, cfg, pre_invariants, post_invariants);
     } catch (std::runtime_error& e) {
         // Convert verifier runtime_error exceptions to failure.
@@ -206,15 +178,19 @@ bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, co
 
 static string_invariant_map to_string_invariant_map(crab::invariant_table_t& inv_table) {
     string_invariant_map res;
-    for (auto& [label, inv]: inv_table) {
+    for (auto& [label, inv] : inv_table) {
         res.insert_or_assign(label, inv.to_set());
     }
     return res;
 }
 
-std::tuple<string_invariant, bool>
-ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog, const string_invariant& entry_invariant,
-                              const program_info& info, const ebpf_verifier_options_t& options) {
+std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog,
+                                                                 const string_invariant& entry_invariant,
+                                                                 const program_info& info,
+                                                                 const ebpf_verifier_options_t& options) {
+    crab::domains::clear_global_state();
+    crab::variable_t::clear_thread_local_state();
+
     thread_local_options = options;
     global_program_info = info;
     assert(!entry_invariant.is_bottom());
@@ -222,16 +198,13 @@ ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog, cons
     if (entry_inv.is_bottom())
         throw std::runtime_error("Entry invariant is inconsistent");
     cfg_t cfg = prepare_cfg(prog, info, !options.no_simplify, false);
-    auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, entry_inv, options.check_termination);
+    auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
     checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
     print_report(os, report, prog, false);
 
     auto pre_invariant_map = to_string_invariant_map(pre_invariants);
 
-    return {
-        pre_invariant_map.at(label_t::exit),
-        (report.total_warnings == 0)
-    };
+    return {pre_invariant_map.at(label_t::exit), (report.total_warnings == 0)};
 }
 
 /// Returned value is true if the program passes verification.
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 28d8a2fa9..25b27a006 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -29,11 +29,11 @@ static EbpfMapType ebpf_get_map_type(uint32_t platform_specific_type) {
 
 static EbpfHelperPrototype ebpf_get_helper_prototype(int32_t n) {
     return {};
-};
+}
 
 static bool ebpf_is_helper_usable(int32_t n){
     return false;
-};
+}
 
 static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>& map_descriptors, const char* data, size_t map_record_size, int map_count,
                                     const struct ebpf_platform_t* platform, ebpf_verifier_options_t options) {
@@ -225,15 +225,14 @@ static Diff<T> make_diff(const T& actual, const T& expected) {
     };
 }
 
-std::optional<Failure> run_yaml_test_case(const TestCase& _test_case, bool debug) {
-    TestCase test_case = _test_case;
+std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
     if (debug) {
         test_case.options.print_failures = true;
         test_case.options.print_invariants = true;
         test_case.options.no_simplify = true;
     }
 
-    ebpf_context_descriptor_t context_descriptor{64, 0, 8, -1};
+    ebpf_context_descriptor_t context_descriptor{64, 0, 4, -1};
     EbpfProgramType program_type = make_program_type(test_case.name, &context_descriptor);
 
     program_info info{&g_platform_test, {}, program_type};
diff --git a/src/ebpf_yaml.hpp b/src/ebpf_yaml.hpp
index af45ce642..183ea3daa 100644
--- a/src/ebpf_yaml.hpp
+++ b/src/ebpf_yaml.hpp
@@ -32,7 +32,7 @@ struct Failure {
 
 void print_failure(const Failure& failure, std::ostream& out);
 
-std::optional<Failure> run_yaml_test_case(const TestCase& test_case, bool debug = false);
+std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug = false);
 
 struct ConformanceTestResult {
     bool success{};
diff --git a/src/test/test_loop.cpp b/src/test/test_loop.cpp
deleted file mode 100644
index e265baa4a..000000000
--- a/src/test/test_loop.cpp
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#include <catch2/catch_all.hpp>
-
-#include "ebpf_verifier.hpp"
-
-using namespace crab;
-
-TEST_CASE("Trivial loop: middle", "[sanity][loop]") {
-    cfg_t cfg;
-
-    basic_block_t& entry = cfg.insert(label_t(0));
-    basic_block_t& middle = cfg.insert(label_t(1));
-    basic_block_t& exit = cfg.get_node(cfg.exit_label());
-
-    entry.insert(Bin{.op = Bin::Op::MOV, .dst = Reg{0}, .v = Imm{0}, .is64 = true});
-    middle.insert(Bin{.op = Bin::Op::ADD, .dst = Reg{0}, .v = Imm{1}, .is64 = true});
-
-    cfg.get_node(cfg.entry_label()) >> entry;
-    entry >> middle;
-    middle >> middle;
-    middle >> exit;
-
-    ebpf_verifier_options_t options{
-        .check_termination=false
-    };
-    program_info info{
-        .platform = &g_ebpf_platform_linux,
-        .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")
-    };
-    bool pass = run_ebpf_analysis(std::cout, cfg, info, &options, nullptr);
-    REQUIRE(pass);
-}
diff --git a/src/test/test_termination.cpp b/src/test/test_termination.cpp
deleted file mode 100644
index 6188b08a7..000000000
--- a/src/test/test_termination.cpp
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#include <catch2/catch_all.hpp>
-
-#include "crab/cfg.hpp"
-#include "crab_verifier.hpp"
-#include "config.hpp"
-#include "platform.hpp"
-
-using namespace crab;
-
-TEST_CASE("Trivial infinite loop", "[loop][termination]") {
-    cfg_t cfg;
-
-    basic_block_t& entry = cfg.get_node(cfg.entry_label());
-    basic_block_t& middle = cfg.insert(label_t(0));
-    basic_block_t& exit = cfg.get_node(cfg.exit_label());
-
-    entry >> middle;
-    middle >> middle;
-    middle >> exit;
-
-    ebpf_verifier_options_t options{
-        .check_termination = true,
-    };
-    program_info info{
-        .platform = &g_ebpf_platform_linux,
-        .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")
-    };
-    ebpf_verifier_stats_t stats;
-    bool pass = run_ebpf_analysis(std::cout, cfg, info, &options, &stats);
-    REQUIRE_FALSE(pass);
-    REQUIRE(stats.max_instruction_count == INT_MAX);
-    REQUIRE(stats.total_unreachable == 0);
-    REQUIRE(stats.total_warnings == 1);
-}
-
-TEST_CASE("Trivial finite loop", "[loop][termination]") {
-    cfg_t cfg;
-
-    basic_block_t& entry = cfg.get_node(cfg.entry_label());
-    basic_block_t& start = cfg.insert(label_t(0));
-    basic_block_t& middle = cfg.insert(label_t(1));
-    basic_block_t& exit = cfg.get_node(cfg.exit_label());
-
-    Reg r{0};
-    start.insert(Bin{.op = Bin::Op::MOV, .dst = r, .v = Imm{0}, .is64 = true});
-    middle.insert(Assume{{.op=Condition::Op::GT, .left=r, .right=Imm{10}, .is64=true}});
-    middle.insert(Bin{.op = Bin::Op::ADD, .dst = r, .v = Imm{1}, .is64 = true});
-
-    entry >> start;
-    start >> middle;
-    middle >> middle;
-    middle >> exit;
-
-    ebpf_verifier_options_t options{
-        .check_termination = true,
-    };
-    program_info info{
-        .platform = &g_ebpf_platform_linux,
-        .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")
-    };
-    ebpf_verifier_stats_t stats;
-    bool pass = run_ebpf_analysis(std::cout, cfg, info, &options, &stats);
-    REQUIRE(pass);
-    REQUIRE(stats.max_instruction_count == 3);
-    REQUIRE(stats.total_unreachable == 1);
-    REQUIRE(stats.total_warnings == 0);
-}
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 86f572c37..e77f0ed05 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -26,6 +26,7 @@ YAML_CASE("test-data/call.yaml")
 YAML_CASE("test-data/divmod.yaml")
 YAML_CASE("test-data/full64.yaml")
 YAML_CASE("test-data/jump.yaml")
+YAML_CASE("test-data/loop.yaml")
 YAML_CASE("test-data/packet.yaml")
 YAML_CASE("test-data/parse.yaml")
 YAML_CASE("test-data/shift.yaml")
diff --git a/test-data/assign.yaml b/test-data/assign.yaml
index 918102ae0..4385c0ceb 100644
--- a/test-data/assign.yaml
+++ b/test-data/assign.yaml
@@ -219,7 +219,7 @@ pre: ["r1.ctx_offset=0", "r1.type=ctx", "r1.svalue=[1, 2147418112]", "r1.uvalue=
 
 code:
   <start>: |
-    r2 = *(u32 *)(r1 + 8)
+    r2 = *(u32 *)(r1 + 4)
 
 post:
   - packet_size=r2.packet_offset
diff --git a/test-data/loop.yaml b/test-data/loop.yaml
new file mode 100644
index 000000000..643cb4b16
--- /dev/null
+++ b/test-data/loop.yaml
@@ -0,0 +1,268 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: while loop, unsigned gte
+options: ["termination"]
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    if r0 >= 4 goto <out>
+    r0 += 1
+    goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=4"
+  - "r0.uvalue=4"
+  - "r0.svalue=r0.uvalue"
+  - "pc[1]=5"
+  - "pc[1]=r0.svalue+1"
+  - "pc[1]=r0.uvalue+1"
+---
+test-case: until loop, unsigned leq
+options: ["termination"]
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    r0 += 1
+    if r0 <= 3 goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=4"
+  - "r0.uvalue=4"
+  - "r0.svalue=r0.uvalue"
+  - "pc[1]=4"
+  - "pc[1]=r0.svalue"
+  - "pc[1]=r0.uvalue"
+---
+test-case: while loop, signed gte
+options: ["termination"]
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    if r0 s>= 4 goto <out>
+    r0 += 1
+    goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=4"
+  - "r0.uvalue=4"
+  - "r0.svalue=r0.uvalue"
+  - "pc[1]=5"
+  - "pc[1]=r0.svalue+1"
+  - "pc[1]=r0.uvalue+1"
+---
+test-case: until loop, signed leq
+options: ["termination"]
+
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    r0 += 1
+    if r0 s<= 3 goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=4"
+  - "r0.uvalue=4"
+  - "r0.svalue=r0.uvalue"
+  - "pc[1]=4"
+  - "pc[1]=r0.svalue"
+  - "pc[1]=r0.uvalue"
+---
+test-case: loop with data dependence, unsigned leq
+options: ["termination"]
+
+pre: ["r1.type=number", "r2.type=number", "r3.type=number"]
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    r0 += 1
+    r1 += r2
+    if r1 > r3 goto <out>
+    if r0 <= 3 goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=[1, 4]"
+  - "r0.uvalue=[1, 4]"
+  - "r0.svalue=r0.uvalue"
+  - "r1.type=number"
+  - "r2.type=number"
+  - "r3.type=number"
+  - "pc[1]=[1, 4]"
+  - "pc[1]=r0.svalue"
+  - "pc[1]=r0.uvalue"
+---
+test-case: while loop, eq
+#options: ["termination"]
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    if r0 == 4 goto <out>
+    r0 += 1
+    goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=4"
+  - "r0.uvalue=4"
+#  - "r0.svalue=r0.uvalue"
+#  - "pc[1]=4"
+#  - "pc[1]=r0.value"
+---
+test-case: until loop, neq
+#options: ["termination"]
+
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    r0 += 1
+    if r0 != 9 goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=9"
+  - "r0.uvalue=9"
+#  - "r0.svalue=r0.uvalue"
+#  - "pc[1]=9"
+#  - "pc[1]=r0.value"
+---
+test-case: simple infinite loop, neq
+options: ["termination"]
+
+pre: []
+
+code:
+  <start>: |
+    r0 = 0
+  <loop>: |
+    r0 += 2
+    if r0 != 9 goto <loop>
+  <out>: |
+    exit
+
+post:
+  - "r0.type=number"
+  - "r0.svalue=9"
+  - "r0.uvalue=9"
+#  - "r0.svalue=r0.uvalue"
+  - "pc[1]=[1, +oo]"
+
+messages:
+  - "Could not prove termination."
+
+---
+test-case: realistic forward loop
+options: ["termination"]
+
+pre: [
+  "meta_offset=[-4098, 0]",
+  "packet_size=[0, 65534]",
+  "r1.ctx_offset=0", "r1.svalue=[1, 2147418112]", "r1.type=ctx",
+]
+
+code:
+  <start>: |
+    r0 = 0
+    r2 = *(u32 *)(r1 + 4)
+    r1 = *(u32 *)(r1 + 0)
+    assume r2 != r1
+    r2 -= r1
+    r3 = 0
+    r0 = 0
+#    r2 <<= 32; this fails with "11: Upper bound must be at most packet_size (valid_access(r4.offset, width=1) for read)"
+#    r2 >>= 32
+  <loop>: |
+    r4 = r1
+    r4 += r3
+    r4 = *(u8 *)(r4 + 0)
+    r0 += r4
+    r3 += 1
+    if r4 == r3 goto <exit>
+    assume r2 > r3
+    goto <loop>
+  <exit>: |
+    exit
+
+post:
+  - meta_offset=[-oo, 0]
+  - packet_size=[1, 65534]
+  - packet_size=r2.svalue
+  - packet_size=r2.uvalue
+  - pc[7]-packet_size<=0
+  - pc[7]-r2.svalue<=0
+  - pc[7]-r2.uvalue<=0
+  - pc[7]=[1, 255]
+  - pc[7]=r3.svalue
+  - pc[7]=r3.uvalue
+  - pc[7]=r4.svalue
+  - pc[7]=r4.uvalue
+  - r0.type=number
+  - r1.packet_offset=0
+  - r1.svalue=[4098, 2147418112]
+  - r1.type=packet
+  - r2.svalue=[1, 65534]
+  - r2.svalue=r2.uvalue
+  - r2.type=number
+  - r2.uvalue=[1, 65534]
+  - r3.svalue-packet_size<=0
+  - r3.svalue-r2.svalue<=0
+  - r3.svalue-r2.uvalue<=0
+  - r3.svalue=[1, 255]
+  - r3.svalue=r3.uvalue
+  - r3.svalue=r4.svalue
+  - r3.svalue=r4.uvalue
+  - r3.type=number
+  - r3.uvalue-packet_size<=0
+  - r3.uvalue-r2.svalue<=0
+  - r3.uvalue-r2.uvalue<=0
+  - r3.uvalue=[1, 255]
+  - r3.uvalue=r4.svalue
+  - r3.uvalue=r4.uvalue
+  - r4.svalue-packet_size<=0
+  - r4.svalue-r2.svalue<=0
+  - r4.svalue-r2.uvalue<=0
+  - r4.svalue=[1, 255]
+  - r4.svalue=r4.uvalue
+  - r4.type=number
+  - r4.uvalue-packet_size<=0
+  - r4.uvalue-r2.svalue<=0
+  - r4.uvalue-r2.uvalue<=0
+  - r4.uvalue=[1, 255]

From 59244394ae38e1b3241e945c28d0a122ec0714ef Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler@microsoft.com>
Date: Mon, 20 Nov 2023 10:36:44 -0800
Subject: [PATCH 008/373] Add support for signed division and modulo
 instructions

Fixes #523

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_ostream.cpp                     |   2 +
 src/asm_parse.cpp                       |   1 +
 src/asm_syntax.hpp                      |   5 +-
 src/asm_unmarshal.cpp                   |  14 +-
 src/assertions.cpp                      |   5 +-
 src/crab/ebpf_domain.cpp                |  20 +-
 src/crab/interval.cpp                   |  51 ++-
 src/crab/interval.hpp                   |  10 +-
 src/crab/split_dbm.cpp                  |   4 +-
 src/test/test_yaml.cpp                  |   3 +-
 test-data/sdivmod.yaml                  | 571 ++++++++++++++++++++++++
 test-data/{divmod.yaml => udivmod.yaml} |   0
 12 files changed, 668 insertions(+), 18 deletions(-)
 create mode 100644 test-data/sdivmod.yaml
 rename test-data/{divmod.yaml => udivmod.yaml} (100%)

diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 2ecdda978..43ff6491e 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -60,7 +60,9 @@ std::ostream& operator<<(std::ostream& os, Bin::Op op) {
     case Op::SUB: return os << "-";
     case Op::MUL: return os << "*";
     case Op::UDIV: return os << "/";
+    case Op::SDIV: return os << "s/";
     case Op::UMOD: return os << "%";
+    case Op::SMOD: return os << "s%";
     case Op::OR: return os << "|";
     case Op::AND: return os << "&";
     case Op::LSH: return os << "<<";
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 50d98f802..7ce6428ed 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -58,6 +58,7 @@ static const std::map<std::string, Bin::Op> str_to_binop = {
     {"", Bin::Op::MOV},   {"+", Bin::Op::ADD},  {"-", Bin::Op::SUB},    {"*", Bin::Op::MUL},
     {"/", Bin::Op::UDIV}, {"%", Bin::Op::UMOD}, {"|", Bin::Op::OR},     {"&", Bin::Op::AND},
     {"<<", Bin::Op::LSH}, {">>", Bin::Op::RSH}, {"s>>", Bin::Op::ARSH}, {"^", Bin::Op::XOR},
+    {"s/", Bin::Op::SDIV}, {"s%", Bin::Op::SMOD},
 };
 
 static const std::map<std::string, Un::Op> str_to_unop = {
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 09da5b6a4..4121bc9e0 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -85,6 +85,8 @@ struct Bin {
         RSH,
         ARSH,
         XOR,
+        SDIV,
+        SMOD,
     };
 
     Op op;
@@ -262,6 +264,7 @@ struct Addable {
 // Condition check whether a register contains a non-zero number.
 struct ValidDivisor {
     Reg reg;
+    bool is_signed{};
 };
 
 enum class AccessType {
@@ -380,7 +383,7 @@ DECLARE_EQ2(TypeConstraint, reg, types)
 DECLARE_EQ2(ValidSize, reg, can_be_zero)
 DECLARE_EQ2(Comparable, r1, r2)
 DECLARE_EQ2(Addable, ptr, num)
-DECLARE_EQ1(ValidDivisor, reg)
+DECLARE_EQ2(ValidDivisor, reg, is_signed)
 DECLARE_EQ2(ValidStore, mem, val)
 DECLARE_EQ5(ValidAccess, reg, offset, width, or_null, access_type)
 DECLARE_EQ3(ValidMapKeyValue, access_reg, map_fd_reg, key)
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 4a9609d46..5cd3fdc99 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -91,13 +91,23 @@ struct Unmarshaller {
         case INST_ALU_OP_ADD: return Bin::Op::ADD;
         case INST_ALU_OP_SUB: return Bin::Op::SUB;
         case INST_ALU_OP_MUL: return Bin::Op::MUL;
-        case INST_ALU_OP_DIV: return Bin::Op::UDIV;
+        case INST_ALU_OP_DIV:
+            switch (inst.offset) {
+            case 0: return Bin::Op::UDIV;
+            case 1: return Bin::Op::SDIV;
+            default: throw InvalidInstruction{pc, "invalid ALU op 0x30"};
+            }
         case INST_ALU_OP_OR: return Bin::Op::OR;
         case INST_ALU_OP_AND: return Bin::Op::AND;
         case INST_ALU_OP_LSH: return Bin::Op::LSH;
         case INST_ALU_OP_RSH: return Bin::Op::RSH;
         case INST_ALU_OP_NEG: return Un::Op::NEG;
-        case INST_ALU_OP_MOD: return Bin::Op::UMOD;
+        case INST_ALU_OP_MOD:
+            switch (inst.offset) {
+            case 0: return Bin::Op::UMOD;
+            case 1: return Bin::Op::SMOD;
+            default: throw InvalidInstruction{pc, "invalid ALU op 0x90"};
+            }
         case INST_ALU_OP_XOR: return Bin::Op::XOR;
         case INST_ALU_OP_MOV: return Bin::Op::MOV;
         case INST_ALU_OP_ARSH:
diff --git a/src/assertions.cpp b/src/assertions.cpp
index a76d5906d..4dd791470 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -209,9 +209,12 @@ class AssertExtractor {
             }
         case Bin::Op::UDIV:
         case Bin::Op::UMOD:
+        case Bin::Op::SDIV:
+        case Bin::Op::SMOD:
             if (std::holds_alternative<Reg>(ins.v)) {
                 auto src = reg(ins.v);
-                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}, Assert{ValidDivisor{src}}};
+                bool is_signed = (ins.op == Bin::Op::SDIV || ins.op == Bin::Op::SMOD);
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}, Assert{ValidDivisor{src, is_signed}}};
             } else {
                 return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
             }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 072ffad67..62667c88e 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1527,8 +1527,8 @@ void ebpf_domain_t::operator()(const ValidDivisor& s) {
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be used as divisors");
     if (!thread_local_options.allow_division_by_zero) {
-        // Division is an unsigned operation. There are no eBPF instructions for signed division.
-        require(m_inv, reg.uvalue != 0, "Possible division by zero");
+        auto v = s.is_signed ? reg.svalue : reg.uvalue;
+        require(m_inv, v != 0, "Possible division by zero");
     }
 }
 
@@ -2435,6 +2435,14 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             urem(dst.svalue, dst.uvalue, imm, finite_width);
             havoc_offsets(bin.dst);
             break;
+        case Bin::Op::SDIV:
+            sdiv(dst.svalue, dst.uvalue, imm, finite_width);
+            havoc_offsets(bin.dst);
+            break;
+        case Bin::Op::SMOD:
+            srem(dst.svalue, dst.uvalue, imm, finite_width);
+            havoc_offsets(bin.dst);
+            break;
         case Bin::Op::OR:
             bitwise_or(dst.svalue, dst.uvalue, imm);
             havoc_offsets(bin.dst);
@@ -2581,6 +2589,14 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             urem(dst.svalue, dst.uvalue, src.uvalue, finite_width);
             havoc_offsets(bin.dst);
             break;
+        case Bin::Op::SDIV:
+            sdiv(dst.svalue, dst.uvalue, src.svalue, finite_width);
+            havoc_offsets(bin.dst);
+            break;
+        case Bin::Op::SMOD:
+            srem(dst.svalue, dst.uvalue, src.svalue, finite_width);
+            havoc_offsets(bin.dst);
+            break;
         case Bin::Op::OR:
             bitwise_or(dst.svalue, dst.uvalue, src.uvalue, finite_width);
             havoc_offsets(bin.dst);
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index dd197e9ba..5aa333004 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -51,7 +51,54 @@ interval_t interval_t::operator/(const interval_t& x) const {
     }
 }
 
-// Unsigned division
+// Signed division.
+interval_t interval_t::SDiv(const interval_t& x) const {
+    if (is_bottom() || x.is_bottom()) {
+        return bottom();
+    } else {
+        // Divisor is a singleton:
+        //   the linear interval solver can perform many divisions where
+        //   the divisor is a singleton interval. We optimize for this case.
+        std::optional<number_t> n = x.singleton();
+        if (n && n->fits_cast_to_int64()) {
+            number_t c{n->cast_to_sint64()};
+            if (c == 1) {
+                return *this;
+            } else if (c != 0) {
+                return interval_t(_lb / bound_t{c}, _ub / bound_t{c});
+            } else {
+                // The eBPF ISA defines division by 0 as resulting in 0.
+                return interval_t(number_t(0));
+            }
+        }
+        // Divisor is not a singleton
+        using z_interval = interval_t;
+        if (x[0]) {
+            // The divisor contains 0.
+            z_interval l(x._lb, z_bound(-1));
+            z_interval u(z_bound(1), x._ub);
+            return (SDiv(l) | SDiv(u) | z_interval(number_t(0)));
+        } else if (operator[](0)) {
+            // The dividend contains 0.
+            z_interval l(_lb, z_bound(-1));
+            z_interval u(z_bound(1), _ub);
+            return (l.SDiv(x) | u.SDiv(x) | z_interval(number_t(0)));
+        } else {
+            // Neither the dividend nor the divisor contains 0
+            z_interval a =
+                (_ub < number_t{0})
+                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
+                    : *this;
+            bound_t ll = a._lb / x._lb;
+            bound_t lu = a._lb / x._ub;
+            bound_t ul = a._ub / x._lb;
+            bound_t uu = a._ub / x._ub;
+            return interval_t(bound_t::min(ll, lu, ul, uu), bound_t::max(ll, lu, ul, uu));
+        }
+    }
+}
+
+// Unsigned division.
 interval_t interval_t::UDiv(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
@@ -97,7 +144,7 @@ interval_t interval_t::UDiv(const interval_t& x) const {
     }
 }
 
-// Signed remainder (modulo). eBPF has no instruction for this.
+// Signed remainder (modulo).
 interval_t interval_t::SRem(const interval_t& x) const {
     // note that the sign of the divisor does not matter
 
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 5596d8d17..bf28cd2f5 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -121,13 +121,7 @@ class bound_t final {
         } else if (is_finite() && x.is_finite()) {
             return bound_t(false, _n / x._n);
         } else if (is_finite() && x.is_infinite()) {
-            if (_n > 0) {
-                return x;
-            } else if (_n == 0) {
-                return *this;
-            } else {
-                return x.operator-();
-            }
+            return number_t{0};
         } else if (is_infinite() && x.is_finite()) {
             if (x._n > 0) {
                 return *this;
@@ -423,6 +417,8 @@ class interval_t final {
 
     // division and remainder operations
 
+    [[nodiscard]] interval_t SDiv(const interval_t& x) const;
+
     [[nodiscard]] interval_t UDiv(const interval_t& x) const;
 
     [[nodiscard]] interval_t SRem(const interval_t& x) const;
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index e6cce3021..8336ba40e 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -951,7 +951,7 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, variable_t z,
     case arith_binop_t::SUB: assign(x, linear_expression_t(y).subtract(z)); break;
     // For the rest of operations, we fall back on intervals.
     case arith_binop_t::MUL: set(x, get_interval(y, finite_width) * get_interval(z, finite_width)); break;
-    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width) / get_interval(z, finite_width)); break;
+    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(get_interval(z, finite_width))); break;
     case arith_binop_t::UDIV: set(x, get_interval(y, finite_width).UDiv(get_interval(z, finite_width))); break;
     case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(get_interval(z, finite_width))); break;
     case arith_binop_t::UREM: set(x, get_interval(y, finite_width).URem(get_interval(z, finite_width))); break;
@@ -969,7 +969,7 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, const number_
     case arith_binop_t::SUB: assign(x, linear_expression_t(y).subtract(k)); break;
     case arith_binop_t::MUL: assign(x, linear_expression_t(k, y)); break;
     // For the rest of operations, we fall back on intervals.
-    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width) / interval_t(k)); break;
+    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(interval_t(k))); break;
     case arith_binop_t::UDIV: set(x, get_interval(y, finite_width).UDiv(interval_t(k))); break;
     case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(interval_t(k))); break;
     case arith_binop_t::UREM: set(x, get_interval(y, finite_width).URem(interval_t(k))); break;
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index e77f0ed05..44c89156f 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -23,7 +23,8 @@ YAML_CASE("test-data/add.yaml")
 YAML_CASE("test-data/assign.yaml")
 YAML_CASE("test-data/bitop.yaml")
 YAML_CASE("test-data/call.yaml")
-YAML_CASE("test-data/divmod.yaml")
+YAML_CASE("test-data/udivmod.yaml")
+YAML_CASE("test-data/sdivmod.yaml")
 YAML_CASE("test-data/full64.yaml")
 YAML_CASE("test-data/jump.yaml")
 YAML_CASE("test-data/loop.yaml")
diff --git a/test-data/sdivmod.yaml b/test-data/sdivmod.yaml
new file mode 100644
index 000000000..8da36fb5b
--- /dev/null
+++ b/test-data/sdivmod.yaml
@@ -0,0 +1,571 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: integer divided by non-integer
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.svalue=1", "r2.uvalue=1"]
+
+code:
+  <start>: |
+    r1 s/= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=6
+  - r1.uvalue=6
+  - r2.svalue=1
+  - r2.uvalue=1
+
+messages:
+  - "0: Only numbers can be used as divisors (r2 != 0)"
+---
+test-case: non-zero divided by zero immediate
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6"]
+
+code:
+  <start>: |
+    r1 s/= 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+---
+test-case: zero divided by zero immediate
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s/= 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+---
+test-case: non-zero divided by zero register
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+options: ["!allow_division_by_zero"]
+
+code:
+  <start>: |
+    r1 s/= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero divided by zero register without warning
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s/= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+---
+test-case: zero divided by zero register
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+options: ["!allow_division_by_zero"]
+
+code:
+  <start>: |
+    r1 s/= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero divided by possibly zero register
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[-5, 5]"]
+
+options: ["!allow_division_by_zero"]
+
+code:
+  <start>: |
+    r1 s/= r2  ; this could divide by 0
+
+post:
+  - r1.type=number
+  - r1.svalue=[-6, 6]
+  - r2.type=number
+  - r2.svalue=[-5, 5]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero divided by possibly zero register
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=[-5, 5]"]
+
+options: ["!allow_division_by_zero"]
+
+code:
+  <start>: |
+    r1 s/= r2 ; this could divide by 0 but ok to set to 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=[-5, 5]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero divided by possibly zero register 2
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[0, 5]", "r2.uvalue=[0, 5]", "r2.svalue=r2.uvalue"]
+
+options: ["!allow_division_by_zero"]
+
+code:
+  <start>: |
+    r1 s/= r2  ; this could divide by 0
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 6]
+  - r1.uvalue=[0, 6]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[0, 5]
+  - r2.uvalue=[0, 5]
+  - r2.svalue=r2.uvalue
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero divided by possibly zero register 2
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=[-5, 0]"]
+
+code:
+  <start>: |
+    r1 s/= r2 ; this could divide by 0 but ok to set to 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=[-5, 0]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero divided by undefined value register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number"]
+
+code:
+  <start>: |
+    r1 s/= r2  ; this could divide by 0
+
+post:
+  - r1.type=number
+  - r1.svalue=[-6, 6]
+  - r2.type=number
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero divided by undefined value register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number"]
+
+code:
+  <start>: |
+    r1 s/= r2  ; this could divide by 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: undefined value register divided by signed non-zero range
+
+pre: ["r1.type=number", "r1.svalue=[-9223372036854775808, -1]",
+      "r2.type=number"]
+
+code:
+  <start>: |
+    r2 s/= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[-9223372036854775808, -1]
+  - r2.type=number
+---
+test-case: non-zero modulo zero immediate
+
+pre: ["r1.type=number", "r1.svalue=-6", "r1.uvalue=18446744073709551610"]
+
+code:
+  <start>: |
+    r1 s%= 0
+
+post:
+  - r1.type=number
+  - r1.svalue=-6
+  - r1.uvalue=18446744073709551610
+---
+test-case: zero modulo zero immediate
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s%= 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+---
+test-case: non-zero modulo zero register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=-6", "r1.uvalue=18446744073709551610",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=-6
+  - r1.uvalue=18446744073709551610
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero modulo zero register without warning
+
+pre: ["r1.type=number", "r1.svalue=-6", "r1.uvalue=18446744073709551610",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=-6
+  - r1.uvalue=18446744073709551610
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+---
+test-case: zero modulo zero register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=0", "r2.uvalue=0"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=0
+  - r2.uvalue=0
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero modulo possibly zero register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[-5, 5]"]
+
+code:
+  <start>: |
+    r1 s%= r2 ; this could do modulo 0 so could set r1 = r2
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 6]
+  - r1.uvalue=[0, 6]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[-5, 5]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero modulo possibly zero register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=[-5, 5]"]
+
+code:
+  <start>: |
+    r1 s%= r2 ; this could do modulo 0 so could set r1 = r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=[-5, 5]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero modulo possibly zero register 2
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[0, 5]", "r2.uvalue=[0, 5]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    r1 s%= r2 ; this could do modulo 0 so could set r1 = r2
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 6]
+  - r1.uvalue=[0, 6]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[0, 5]
+  - r2.uvalue=[0, 5]
+  - r2.svalue=r2.uvalue
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero modulo possibly zero register 2
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number", "r2.svalue=[-5, 0]"]
+
+code:
+  <start>: |
+    r1 s%= r2 ; this could do modulo 0 so could set r1 = r2
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+  - r2.svalue=[-5, 0]
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: non-zero modulo undefined value register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number"]
+
+code:
+  <start>: |
+    r1 s%= r2  ; this could be modulo 0
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 6]
+  - r1.uvalue=[0, 6]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: zero modulo undefined value register
+
+options: ["!allow_division_by_zero"]
+
+pre: ["r1.type=number", "r1.svalue=0", "r1.uvalue=0",
+      "r2.type=number"]
+
+code:
+  <start>: |
+    r1 s%= r2  ; this could be modulo 0
+
+post:
+  - r1.type=number
+  - r1.svalue=0
+  - r1.uvalue=0
+  - r2.type=number
+
+messages:
+  - "0: Possible division by zero (r2 != 0)"
+---
+test-case: positive modulo positive range
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[1, 5]", "r2.uvalue=[1, 5]"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 4]
+  - r1.uvalue=[0, 4]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[1, 5]
+  - r2.uvalue=[1, 5]
+---
+test-case: negative modulo positive
+
+pre: ["r1.type=number", "r1.svalue=-13", "r1.uvalue=18446744073709551603"]
+
+code:
+  <start>: |
+    r1 s%= 4
+
+post:
+  - r1.type=number
+  - r1.svalue=-1
+  - r1.uvalue=18446744073709551615
+---
+test-case: positive modulo negative
+
+pre: ["r1.type=number", "r1.svalue=13", "r1.uvalue=13"]
+
+code:
+  <start>: |
+    r1 s%= -3
+
+post:
+  - r1.type=number
+  - r1.svalue=1
+  - r1.uvalue=1
+---
+test-case: positive modulo negative range
+
+pre: ["r1.type=number", "r1.svalue=13", "r1.uvalue=13",
+      "r2.type=number", "r2.svalue=[-3, -2]", "r2.uvalue=[18446744073709551613, 18446744073709551614]"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 2]
+  - r1.uvalue=[0, 2]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[-3, -2]
+  - r2.uvalue=[18446744073709551613, 18446744073709551614]
+---
+test-case: negative modulo negative
+
+pre: ["r1.type=number", "r1.svalue=-13", "r1.uvalue=18446744073709551603"]
+
+code:
+  <start>: |
+    r1 s%= -3
+
+post:
+  - r1.type=number
+  - r1.svalue=-1
+  - r1.uvalue=18446744073709551615
+---
+test-case: negative modulo negative range
+
+pre: ["r1.type=number", "r1.svalue=-13", "r1.uvalue=18446744073709551603",
+      "r2.type=number", "r2.svalue=[-3, -2]", "r2.uvalue=[18446744073709551613, 18446744073709551614]"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=[-2, 0]
+  - r2.type=number
+  - r2.svalue=[-3, -2]
+  - r2.uvalue=[18446744073709551613, 18446744073709551614]
+---
+test-case: smaller modulo larger
+
+pre: ["r1.type=number", "r1.svalue=6", "r1.uvalue=6",
+      "r2.type=number", "r2.svalue=[7, 10]", "r2.uvalue=[7, 10]"]
+
+code:
+  <start>: |
+    r1 s%= r2
+
+post:
+  - r1.type=number
+  - r1.svalue=6
+  - r1.uvalue=6
+  - r2.type=number
+  - r2.svalue=[7, 10]
+  - r2.uvalue=[7, 10]
diff --git a/test-data/divmod.yaml b/test-data/udivmod.yaml
similarity index 100%
rename from test-data/divmod.yaml
rename to test-data/udivmod.yaml

From fbe8d16e7c00552212fbff5001c8b4c950b99d14 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 28 Oct 2023 16:22:25 +0000
Subject: [PATCH 009/373] Bump external/ELFIO from `73a2410` to `eb68829`

Bumps [external/ELFIO](https://github.com/serge1/ELFIO) from `73a2410` to `eb68829`.
- [Release notes](https://github.com/serge1/ELFIO/releases)
- [Commits](https://github.com/serge1/ELFIO/compare/73a241079a040710481e9b840248ec0425e46c7c...eb6882952c86e28e9fc0ee5a668d2180ddcefbb4)

---
updated-dependencies:
- dependency-name: external/ELFIO
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/ELFIO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/ELFIO b/external/ELFIO
index 73a241079..eb6882952 160000
--- a/external/ELFIO
+++ b/external/ELFIO
@@ -1 +1 @@
-Subproject commit 73a241079a040710481e9b840248ec0425e46c7c
+Subproject commit eb6882952c86e28e9fc0ee5a668d2180ddcefbb4

From e89dc2ecc9a3fff4df7e606c699e801dcfce6f2e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 25 Nov 2023 16:11:08 +0000
Subject: [PATCH 010/373] Bump external/ELFIO from `eb68829` to `4bc17b6`

Bumps [external/ELFIO](https://github.com/serge1/ELFIO) from `eb68829` to `4bc17b6`.
- [Release notes](https://github.com/serge1/ELFIO/releases)
- [Commits](https://github.com/serge1/ELFIO/compare/eb6882952c86e28e9fc0ee5a668d2180ddcefbb4...4bc17b6b81e4348a9428beac64a7bb5931c88a88)

---
updated-dependencies:
- dependency-name: external/ELFIO
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/ELFIO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/ELFIO b/external/ELFIO
index eb6882952..4bc17b6b8 160000
--- a/external/ELFIO
+++ b/external/ELFIO
@@ -1 +1 @@
-Subproject commit eb6882952c86e28e9fc0ee5a668d2180ddcefbb4
+Subproject commit 4bc17b6b81e4348a9428beac64a7bb5931c88a88

From 40f20b679f759c6acb108993c4f7367c4587ea16 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 16 Dec 2023 16:10:59 +0000
Subject: [PATCH 011/373] Bump github/codeql-action from 2 to 3

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-analysis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index f33915f9b..0522fc057 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -41,7 +41,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,4 +70,4 @@ jobs:
         cmake --build build -j $(nproc)
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

From 86e82a7ff57708ada439dbbc8438006144100fba Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 16 Dec 2023 16:58:04 +0000
Subject: [PATCH 012/373] Bump external/ELFIO from `4bc17b6` to `c5e56b8`

Bumps [external/ELFIO](https://github.com/serge1/ELFIO) from `4bc17b6` to `c5e56b8`.
- [Release notes](https://github.com/serge1/ELFIO/releases)
- [Commits](https://github.com/serge1/ELFIO/compare/4bc17b6b81e4348a9428beac64a7bb5931c88a88...c5e56b8c505b084153971f64dfd2640a41f60b49)

---
updated-dependencies:
- dependency-name: external/ELFIO
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/ELFIO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/ELFIO b/external/ELFIO
index 4bc17b6b8..c5e56b8c5 160000
--- a/external/ELFIO
+++ b/external/ELFIO
@@ -1 +1 @@
-Subproject commit 4bc17b6b81e4348a9428beac64a7bb5931c88a88
+Subproject commit c5e56b8c505b084153971f64dfd2640a41f60b49

From 0169e06066bec10ac372ee9e8514424b2a02de4b Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sat, 23 Dec 2023 14:15:06 -0800
Subject: [PATCH 013/373] Make ALU operations check for invalid register values

makeMemOp() already had a check but makeAluOp() didn't.

Fixes #505

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp     | 2 ++
 src/test/test_marshal.cpp | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 5cd3fdc99..e85885857 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -249,6 +249,8 @@ struct Unmarshaller {
     auto makeAluOp(size_t pc, ebpf_inst inst) -> Instruction {
         if (inst.dst == R10_STACK_POINTER)
             throw InvalidInstruction(pc, "Invalid target r10");
+        if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
+            throw InvalidInstruction(pc, "Bad register");
         return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64}; },
                                      [&](Bin::Op op) -> Instruction {
                                          Bin res{
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index abf58f2bd..8be56961e 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -208,6 +208,12 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
 TEST_CASE("fail unmarshal", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 11, .imm = 8},
                          "0: Bad register\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 1, .src = 11},
+                         "0: Bad register\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = (INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU), .dst = 11, .imm = 8},
+                         "0: Bad register\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = (INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU), .dst = 1, .src = 11},
+                         "0: Bad register\n");
     check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_W | INST_CLS_LD)},
                          "0: plain LD\n");
     check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .dst = 1, .imm = 8}, "0: invalid endian immediate\n");

From 28f6f6984c5e23caca868f738f9ca3348a889ae6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 23 Dec 2023 16:45:58 +0000
Subject: [PATCH 014/373] Bump external/ELFIO from `c5e56b8` to `2b457dd`

Bumps [external/ELFIO](https://github.com/serge1/ELFIO) from `c5e56b8` to `2b457dd`.
- [Release notes](https://github.com/serge1/ELFIO/releases)
- [Commits](https://github.com/serge1/ELFIO/compare/c5e56b8c505b084153971f64dfd2640a41f60b49...2b457dd5d90018172a4de12a67cc6869c51a2c0a)

---
updated-dependencies:
- dependency-name: external/ELFIO
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/ELFIO | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/ELFIO b/external/ELFIO
index c5e56b8c5..2b457dd5d 160000
--- a/external/ELFIO
+++ b/external/ELFIO
@@ -1 +1 @@
-Subproject commit c5e56b8c505b084153971f64dfd2640a41f60b49
+Subproject commit 2b457dd5d90018172a4de12a67cc6869c51a2c0a

From e1d7afc859f1582c10b056ac1140683ec15cc2f8 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Fri, 22 Dec 2023 08:36:57 -0800
Subject: [PATCH 015/373] Add support for MOVSX* instructions

Per https://www.ietf.org/archive/id/draft-ietf-bpf-isa-00.html#section-3.1

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_cfg.cpp          |  10 +-
 src/asm_marshal.cpp      |  21 ++-
 src/asm_ostream.cpp      |   3 +
 src/asm_parse.cpp        |   3 +-
 src/asm_syntax.hpp       |   3 +
 src/asm_unmarshal.cpp    |   9 +-
 src/assertions.cpp       |   8 +
 src/crab/ebpf_domain.cpp |  56 +++++++
 src/crab/ebpf_domain.hpp |   1 +
 src/test/test_yaml.cpp   |   1 +
 test-data/movsx.yaml     | 330 +++++++++++++++++++++++++++++++++++++++
 11 files changed, 438 insertions(+), 7 deletions(-)
 create mode 100644 test-data/movsx.yaml

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 0d4724435..3787507fc 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -181,9 +181,13 @@ static std::string instype(Instruction ins) {
     } else if (std::holds_alternative<Packet>(ins)) {
         return "packet_access";
     } else if (std::holds_alternative<Bin>(ins)) {
-        if (std::get<Bin>(ins).op == Bin::Op::MOV)
-            return "assign";
-        return "arith";
+        switch (std::get<Bin>(ins).op) {
+        case Bin::Op::MOV:
+        case Bin::Op::MOVSX8:
+        case Bin::Op::MOVSX16:
+        case Bin::Op::MOVSX32: return "assign";
+        default: return "arith";
+        }
     } else if (std::holds_alternative<Un>(ins)) {
         return "arith";
     } else if (std::holds_alternative<LoadMapFd>(ins)) {
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 36bbe783e..fd7a74902 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -36,20 +36,37 @@ static uint8_t op(Bin::Op op) {
     case Op::ADD: return 0x0;
     case Op::SUB: return 0x1;
     case Op::MUL: return 0x2;
+    case Op::SDIV:
     case Op::UDIV: return 0x3;
     case Op::OR: return 0x4;
     case Op::AND: return 0x5;
     case Op::LSH: return 0x6;
     case Op::RSH: return 0x7;
+    case Op::SMOD:
     case Op::UMOD: return 0x9;
     case Op::XOR: return 0xa;
-    case Op::MOV: return 0xb;
+    case Op::MOV:
+    case Op::MOVSX8:
+    case Op::MOVSX16:
+    case Op::MOVSX32: return 0xb;
     case Op::ARSH: return 0xc;
     }
     assert(false);
     return {};
 }
 
+static int16_t offset(Bin::Op op) {
+    using Op = Bin::Op;
+    switch (op) {
+    case Op::SDIV:
+    case Op::SMOD: return 1;
+    case Op::MOVSX8: return 8;
+    case Op::MOVSX16: return 16;
+    case Op::MOVSX32: return 32;
+    }
+    return 0;
+}
+
 static uint8_t imm(Un::Op op) {
     using Op = Un::Op;
     switch (op) {
@@ -96,7 +113,7 @@ struct MarshalVisitor {
         ebpf_inst res{.opcode = static_cast<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | (op(b.op) << 4)),
                       .dst = b.dst.v,
                       .src = 0,
-                      .offset = 0,
+                      .offset = offset(b.op),
                       .imm = 0};
         std::visit(overloaded{[&](Reg right) {
                                   res.opcode |= INST_SRC_REG;
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 43ff6491e..9f8c12254 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -56,6 +56,9 @@ std::ostream& operator<<(std::ostream& os, Bin::Op op) {
     using Op = Bin::Op;
     switch (op) {
     case Op::MOV: return os;
+    case Op::MOVSX8: return os << "s8";
+    case Op::MOVSX16: return os << "s16";
+    case Op::MOVSX32: return os << "s32";
     case Op::ADD: return os << "+";
     case Op::SUB: return os << "-";
     case Op::MUL: return os << "*";
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 7ce6428ed..9f4e42c1c 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -58,7 +58,8 @@ static const std::map<std::string, Bin::Op> str_to_binop = {
     {"", Bin::Op::MOV},   {"+", Bin::Op::ADD},  {"-", Bin::Op::SUB},    {"*", Bin::Op::MUL},
     {"/", Bin::Op::UDIV}, {"%", Bin::Op::UMOD}, {"|", Bin::Op::OR},     {"&", Bin::Op::AND},
     {"<<", Bin::Op::LSH}, {">>", Bin::Op::RSH}, {"s>>", Bin::Op::ARSH}, {"^", Bin::Op::XOR},
-    {"s/", Bin::Op::SDIV}, {"s%", Bin::Op::SMOD},
+    {"s/", Bin::Op::SDIV}, {"s%", Bin::Op::SMOD}, {"s8", Bin::Op::MOVSX8}, {"s16", Bin::Op::MOVSX16},
+    {"s32", Bin::Op::MOVSX32},
 };
 
 static const std::map<std::string, Un::Op> str_to_unop = {
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 4121bc9e0..5490bb933 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -87,6 +87,9 @@ struct Bin {
         XOR,
         SDIV,
         SMOD,
+        MOVSX8,
+        MOVSX16,
+        MOVSX32,
     };
 
     Op op;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index e85885857..d2e100e14 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -109,7 +109,14 @@ struct Unmarshaller {
             default: throw InvalidInstruction{pc, "invalid ALU op 0x90"};
             }
         case INST_ALU_OP_XOR: return Bin::Op::XOR;
-        case INST_ALU_OP_MOV: return Bin::Op::MOV;
+        case INST_ALU_OP_MOV:
+            switch (inst.offset) {
+            case 0: return Bin::Op::MOV;
+            case 8: return Bin::Op::MOVSX8;
+            case 16: return Bin::Op::MOVSX16;
+            case 32: return Bin::Op::MOVSX32;
+            default: throw InvalidInstruction{pc, "invalid ALU op 0xb0"};
+            }
         case INST_ALU_OP_ARSH:
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU)
                 note("arsh32 is not allowed");
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 4dd791470..f99a67d6f 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -180,6 +180,14 @@ class AssertExtractor {
     vector<Assert> operator()(Bin ins) const {
         switch (ins.op) {
         case Bin::Op::MOV: return {};
+        case Bin::Op::MOVSX8:
+        case Bin::Op::MOVSX16:
+        case Bin::Op::MOVSX32:
+            if (std::holds_alternative<Reg>(ins.v)) {
+                auto src = reg(ins.v);
+                return {Assert{TypeConstraint{src, TypeGroup::number}}};
+            }
+            return {};
         case Bin::Op::ADD:
             if (std::holds_alternative<Reg>(ins.v)) {
                 auto src = reg(ins.v);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 62667c88e..b511de0a7 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2342,6 +2342,46 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
     havoc_offsets(dst_reg);
 }
 
+void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width,
+                                Bin::Op op) {
+    using namespace crab;
+
+    int bits;
+    switch (op) {
+    case Bin::Op::MOVSX8: bits = 8; break;
+    case Bin::Op::MOVSX16: bits = 16; break;
+    case Bin::Op::MOVSX32: bits = 32; break;
+    default: throw std::exception();
+    }
+
+    reg_pack_t dst = reg_pack(dst_reg);
+    interval_t right_interval = m_inv.eval_interval(right_svalue);
+    type_inv.assign_type(m_inv, dst_reg, T_NUM);
+    havoc_offsets(dst_reg);
+    int64_t span = 1ULL << bits;
+    if (right_interval.ub() - right_interval.lb() >= number_t{span}) {
+        // Interval covers the full space.
+        havoc(dst.svalue);
+        return;
+    }
+    int64_t mask = 1ULL << (bits - 1);
+
+    // Sign extend each bound.
+    int64_t lb = right_interval.lb().number().value().cast_to_sint64();
+    lb &= (span - 1);
+    lb = (lb ^ mask) - mask;
+    int64_t ub = right_interval.ub().number().value().cast_to_sint64();
+    ub &= (span - 1);
+    ub = (ub ^ mask) - mask;
+    m_inv.set(dst.svalue, crab::interval_t{number_t{lb}, number_t{ub}});
+
+    if (finite_width) {
+        m_inv.assign(dst.uvalue, dst.svalue);
+        overflow_signed(m_inv, dst.svalue, finite_width);
+        overflow_unsigned(m_inv, dst.uvalue, finite_width);
+    }
+}
+
 void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width) {
     using namespace crab;
 
@@ -2413,6 +2453,11 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             type_inv.assign_type(m_inv, bin.dst, T_NUM);
             havoc_offsets(bin.dst);
             break;
+        case Bin::Op::MOVSX8:
+        case Bin::Op::MOVSX16:
+        case Bin::Op::MOVSX32:
+            sign_extend(bin.dst, number_t{(int32_t)imm}, finite_width, bin.op);
+            break;
         case Bin::Op::ADD:
             if (imm == 0)
                 return;
@@ -2655,6 +2700,17 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             bitwise_xor(dst.svalue, dst.uvalue, src.uvalue, finite_width);
             havoc_offsets(bin.dst);
             break;
+        case Bin::Op::MOVSX8:
+        case Bin::Op::MOVSX16:
+        case Bin::Op::MOVSX32:
+            if (m_inv.entail(type_is_number(src_reg))) {
+                sign_extend(bin.dst, src.svalue, finite_width, bin.op);
+                break;
+            }
+            havoc(dst.svalue);
+            havoc(dst.uvalue);
+            havoc_offsets(bin.dst);
+            break;
         case Bin::Op::MOV:
             assign(dst.svalue, src.svalue);
             assign(dst.uvalue, src.uvalue);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index c8bba9197..0fbb1992a 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -139,6 +139,7 @@ class ebpf_domain_t final {
     void shl_overflow(variable_t lhss, variable_t lhsu, const number_t& op2);
     void lshr(const Reg& reg, int imm, int finite_width);
     void ashr(const Reg& reg, const linear_expression_t& right_svalue, int finite_width);
+    void sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width, Bin::Op op);
 
     void assume(const linear_constraint_t& cst);
 
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 44c89156f..2456bfe3f 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -28,6 +28,7 @@ YAML_CASE("test-data/sdivmod.yaml")
 YAML_CASE("test-data/full64.yaml")
 YAML_CASE("test-data/jump.yaml")
 YAML_CASE("test-data/loop.yaml")
+YAML_CASE("test-data/movsx.yaml")
 YAML_CASE("test-data/packet.yaml")
 YAML_CASE("test-data/parse.yaml")
 YAML_CASE("test-data/shift.yaml")
diff --git a/test-data/movsx.yaml b/test-data/movsx.yaml
new file mode 100644
index 000000000..7aa3d0f54
--- /dev/null
+++ b/test-data/movsx.yaml
@@ -0,0 +1,330 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: movsx8 immediate to 32 bits
+
+pre: []
+
+code:
+  <start>: |
+    w1 s8= 384 ; 0x180 -> 0xFFFFFF80
+
+post:
+  - r1.type=number
+  - r1.svalue=4294967168
+  - r1.uvalue=4294967168
+---
+test-case: movsx16 immediate to 32 bits
+
+pre: []
+
+code:
+  <start>: |
+    w1 s16= 98304 ; 0x18000 -> 0xFFFF8000
+
+post:
+  - r1.type=number
+  - r1.svalue=4294934528
+  - r1.uvalue=4294934528
+---
+test-case: movsx8 immediate to 64 bits
+
+pre: []
+
+code:
+  <start>: |
+    r1 s8= 384 ; 0x180 -> 0xFFFFFFFFFFFFFF80
+
+post:
+  - r1.type=number
+  - r1.svalue=-128
+  - r1.uvalue=18446744073709551488
+---
+test-case: movsx16 immediate to 64 bits
+
+pre: []
+
+code:
+  <start>: |
+    r1 s16= 98304 ; 0x18000 -> 0xFFFFFFFFFFFF8000
+
+post:
+  - r1.type=number
+  - r1.svalue=-32768
+  - r1.uvalue=18446744073709518848
+---
+test-case: movsx32 immediate to 64 bits
+
+pre: []
+
+code:
+  <start>: |
+    r1 s32= 2147483648 ; 0x80000000 -> 0xFFFFFFFF80000000
+
+post:
+  - r1.type=number
+  - r1.svalue=-2147483648
+  - r1.uvalue=18446744071562067968
+---
+test-case: movsx8 register to 32 bits
+
+pre: ["r1.svalue=384", "r1.uvalue=384", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=384
+  - r1.uvalue=384
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=4294967168
+  - r2.uvalue=4294967168
+---
+test-case: movsx16 register to 32 bits
+
+pre: ["r1.svalue=98304", "r1.uvalue=98304", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=98304
+  - r1.uvalue=98304
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=4294934528
+  - r2.uvalue=4294934528
+---
+test-case: movsx8 register to 64 bits
+
+pre: ["r1.svalue=384", "r1.uvalue=384", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=384
+  - r1.uvalue=384
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=-128
+  - r2.uvalue=18446744073709551488
+---
+test-case: movsx16 register to 64 bits
+
+pre: ["r1.svalue=98304", "r1.uvalue=98304", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=98304
+  - r1.uvalue=98304
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=-32768
+  - r2.uvalue=18446744073709518848
+---
+test-case: movsx32 register to 64 bits
+
+pre: ["r1.svalue=2147483648", "r1.uvalue=2147483648", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s32= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=2147483648
+  - r1.uvalue=2147483648
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=-2147483648
+  - r2.uvalue=18446744071562067968
+---
+test-case: movsx32 register with a non-number
+
+pre: []
+
+code:
+  <start>: |
+    r2 s32= r1
+
+post: []
+
+messages:
+  - "0:  (r1.type == number)"
+---
+test-case: movsx8 register range to 32 bits without wrap
+
+pre: ["r1.svalue=[128, 130]", "r1.uvalue=[128, 130]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[128, 130]
+  - r1.uvalue=[128, 130]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[4294967168, 4294967170]
+  - r2.uvalue=[4294967168, 4294967170]
+  - r2.svalue=r2.uvalue
+---
+test-case: movsx8 register range to 32 bits with wrap
+
+pre: ["r1.svalue=[255, 257]", "r1.uvalue=[255, 257]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[255, 257]
+  - r1.uvalue=[255, 257]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[0, 4294967295]
+  - r2.uvalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue
+---
+test-case: movsx16 register range to 32 bits without wrap
+
+pre: ["r1.svalue=[32768, 32770]", "r1.uvalue=[32768, 32770]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[32768, 32770]
+  - r1.uvalue=[32768, 32770]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[4294934528, 4294934530]
+  - r2.uvalue=[4294934528, 4294934530]
+  - r2.svalue=r2.uvalue
+---
+test-case: movsx16 register range to 32 bits with wrap
+
+pre: ["r1.svalue=[65535, 65537]", "r1.uvalue=[65535, 65537]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    w2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[65535, 65537]
+  - r1.uvalue=[65535, 65537]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[0, 4294967295]
+  - r2.uvalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue
+---
+test-case: movsx8 register range to 64 bits
+
+pre: ["r1.svalue=[255, 257]", "r1.uvalue=[255, 257]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[255, 257]
+  - r1.uvalue=[255, 257]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[-1, 1]
+---
+test-case: movsx8 register full range to 64 bits
+
+pre: ["r1.svalue=[255, 511]", "r1.uvalue=[255, 511]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s8= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[255, 511]
+  - r1.uvalue=[255, 511]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+---
+test-case: movsx16 register range to 64 bits
+
+pre: ["r1.svalue=[65535, 65537]", "r1.uvalue=[65535, 65537]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[65535, 65537]
+  - r1.uvalue=[65535, 65537]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[-1, 1]
+---
+test-case: movsx16 register full range to 64 bits
+
+pre: ["r1.svalue=[65535, 131071]", "r1.uvalue=[65535, 131071]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s16= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[65535, 131071]
+  - r1.uvalue=[65535, 131071]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+---
+test-case: movsx32 register range to 64 bits
+
+pre: ["r1.svalue=[4294967295, 4294967297]", "r1.uvalue=[4294967295, 4294967297]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s32= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[4294967295, 4294967297]
+  - r1.uvalue=[4294967295, 4294967297]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[-1, 1]
+---
+test-case: movsx32 register full range to 64 bits
+
+pre: ["r1.svalue=[4294967295, 8589934591]", "r1.uvalue=[4294967295, 8589934591]", "r1.type=number", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r2 s32= r1
+
+post:
+  - r1.type=number
+  - r1.svalue=[4294967295, 8589934591]
+  - r1.uvalue=[4294967295, 8589934591]
+  - r1.svalue=r1.uvalue
+  - r2.type=number

From 38ebf365a17128ab8773a8c780307f63770332a9 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Mon, 25 Dec 2023 10:06:44 -0800
Subject: [PATCH 016/373] Update bpf_conformance to latest

This PR combines #543 and #544
Also removes a redundant inclusion of the elfio library

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 .gitmodules              | 3 ---
 CMakeLists.txt           | 5 +++--
 external/ELFIO           | 1 -
 external/bpf_conformance | 2 +-
 4 files changed, 4 insertions(+), 7 deletions(-)
 delete mode 160000 external/ELFIO

diff --git a/.gitmodules b/.gitmodules
index 808fbd701..f12802369 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,9 +4,6 @@
 [submodule "external/radix_tree"]
 	path = external/radix_tree
 	url = https://github.com/ytakano/radix_tree
-[submodule "external/ELFIO"]
-	path = external/ELFIO
-	url = https://github.com/serge1/ELFIO.git
 [submodule "external/bpf_conformance"]
 	path = external/bpf_conformance
 	url = https://github.com/Alan-Jowett/bpf_conformance.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 26d9ae3bf..d4c795491 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -37,7 +37,7 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
   if (NOT NUGET)
     message("ERROR: You must first install nuget.exe from https://www.nuget.org/downloads")
   else ()
-    execute_process(COMMAND ${NUGET} ARGS install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
+    execute_process(COMMAND ${NUGET} install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
     set(BOOST_VERSION 1.81.0)
   endif()
   set(Boost_INCLUDE_DIRS ${CMAKE_BINARY_DIR}/packages/boost/lib/native/include)
@@ -62,7 +62,7 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
 endif ()
 
 include_directories(./external)
-include_directories(./external/ELFIO)
+include_directories(./external/bpf_conformance/external/elfio)
 include_directories(./src)
 include_directories(./external/libbtf)
 include_directories(${Boost_INCLUDE_DIRS})
@@ -130,6 +130,7 @@ target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:DEBUG>:${DEBUG_FLAGS}>")
 target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:RELEASE>:${RELEASE_FLAGS}>")
 target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:SANITIZE>:${SANITIZE_FLAGS}>")
 
+add_subdirectory("external/bpf_conformance/external/elfio")
 add_subdirectory("external/bpf_conformance/src")
 add_subdirectory("external/libbtf")
 
diff --git a/external/ELFIO b/external/ELFIO
deleted file mode 160000
index 2b457dd5d..000000000
--- a/external/ELFIO
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 2b457dd5d90018172a4de12a67cc6869c51a2c0a
diff --git a/external/bpf_conformance b/external/bpf_conformance
index 78df87a6e..ab3409499 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 78df87a6e85d4051d6bc1c92b1b6c05d7195cf05
+Subproject commit ab3409499613e005cf8098bb8249efd71fa4c43e

From 81a834d64edeb59b5045b1ecd955f25d1116a157 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Wed, 27 Dec 2023 12:37:01 -0800
Subject: [PATCH 017/373] Add 32-bit unconditional jump instruction

This instruction is part of the cpu=v4 set of instructions
recently added, and specified in
https://www.ietf.org/archive/id/draft-ietf-bpf-isa-00.html#jump-instructions

Fixes #532

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_marshal.cpp       | 15 +++++++++++----
 src/asm_ostream.hpp       | 17 +++++++++++++++--
 src/asm_syntax.hpp        |  3 ++-
 src/asm_unmarshal.cpp     | 11 +++++++----
 src/ebpf_vm_isa.hpp       |  3 ++-
 src/test/test_marshal.cpp | 28 +++++++++++++++++++++++++++-
 6 files changed, 64 insertions(+), 13 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index fd7a74902..764077299 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -94,7 +94,8 @@ struct MarshalVisitor {
     }
 
   public:
-    std::function<auto(label_t)->int16_t> label_to_offset;
+    std::function<auto(label_t)->int16_t> label_to_offset16;
+    std::function<auto(label_t)->int32_t> label_to_offset32;
 
     vector<ebpf_inst> operator()(Undefined const& a) {
         assert(false);
@@ -179,7 +180,7 @@ struct MarshalVisitor {
                 .opcode = static_cast<uint8_t>(INST_CLS_JMP | (op(b.cond->op) << 4)),
                 .dst = b.cond->left.v,
                 .src = 0,
-                .offset = label_to_offset(b.target),
+                .offset = label_to_offset16(b.target),
             };
             visit(overloaded{[&](Reg right) {
                                  res.opcode |= INST_SRC_REG;
@@ -189,7 +190,11 @@ struct MarshalVisitor {
                   b.cond->right);
             return {res};
         } else {
-            return {ebpf_inst{.opcode = INST_OP_JA, .dst = 0, .src = 0, .offset = label_to_offset(b.target), .imm = 0}};
+            int32_t imm = label_to_offset32(b.target);
+            if (imm != 0)
+                return {ebpf_inst{.opcode = INST_OP_JA32, .imm = imm}};
+            else
+                return {ebpf_inst{.opcode = INST_OP_JA16, .offset = label_to_offset16(b.target)}};
         }
     }
 
@@ -252,7 +257,9 @@ struct MarshalVisitor {
     }
 };
 
-vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc) { return std::visit(MarshalVisitor{label_to_offset(pc)}, ins); }
+vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc) {
+    return std::visit(MarshalVisitor{label_to_offset16(pc), label_to_offset32(pc)}, ins);
+}
 
 vector<ebpf_inst> marshal(const vector<Instruction>& insts) {
     vector<ebpf_inst> res;
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index 7ab2c059e..e36f25fa6 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -11,8 +11,21 @@
 
 #include "asm_syntax.hpp"
 
-inline std::function<int16_t(label_t)> label_to_offset(pc_t pc) {
-    return [=](const label_t& label) { return label.from - pc - 1; };
+// We use a 16-bit offset whenever it fits in 16 bits.
+inline std::function<int16_t(label_t)> label_to_offset16(pc_t pc) {
+    return [=](const label_t& label) {
+        int64_t offset = label.from - (int64_t)pc - 1;
+        return (offset >= INT16_MIN && offset <= INT16_MAX) ? (int16_t)offset : 0;
+    };
+}
+
+// We use the JA32 opcode with the offset in 'imm' when the offset
+// of an unconditional jump doesn't fit in a int16_t.
+inline std::function<int32_t(label_t)> label_to_offset32(pc_t pc) {
+    return [=](const label_t& label) {
+        int64_t offset = label.from - (int64_t)pc - 1;
+        return (offset >= INT16_MIN && offset <= INT16_MAX) ? 0 : (int32_t)offset;
+    };
 }
 
 std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info);
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 5490bb933..55c0b082b 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -336,7 +336,8 @@ using InstructionSeq = std::vector<LabeledInstruction>;
 #define DECLARE_EQ1(T, f1) \
     inline bool operator==(T const& a, T const& b) { return a.f1 == b.f1; }
 
-using pc_t = uint16_t;
+// cpu=v4 supports 32-bit PC offsets so we need a large enough type.
+using pc_t = size_t;
 
 // Helpers:
 
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index d2e100e14..8b63f5a97 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -381,16 +381,19 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, "Bad instruction");
             return Exit{};
         case 0x0:
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP &&
+                (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32)
                 throw InvalidInstruction(pc, "Bad instruction");
         default: {
-            pc_t new_pc = pc + 1 + inst.offset;
+            int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
+            pc_t new_pc = pc + 1 + offset;
             if (new_pc >= insts.size())
                 throw InvalidInstruction(pc, "jump out of bounds");
             else if (insts[new_pc].opcode == 0)
                 throw InvalidInstruction(pc, "jump to middle of lddw");
 
-            auto cond = inst.opcode == INST_OP_JA ? std::optional<Condition>{}
+            auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
+                                                  ? std::optional<Condition>{}
                                                   : Condition{
                                                         .op = getJmpOp(pc, inst.opcode),
                                                         .left = Reg{inst.dst},
@@ -400,7 +403,7 @@ struct Unmarshaller {
                                                     };
             return Jmp{
                 .cond = cond,
-                .target = label_t{new_pc},
+                .target = label_t{(int)new_pc},
             };
         }
         }
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 0f1f0974c..654e34525 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -54,7 +54,8 @@ enum {
 
     INST_OP_LDDW_IMM = (INST_CLS_LD | INST_SRC_IMM | INST_SIZE_DW), // Special
 
-    INST_OP_JA = (INST_CLS_JMP | 0x00),
+    INST_OP_JA32 = (INST_CLS_JMP32 | 0x00),
+    INST_OP_JA16 = (INST_CLS_JMP | 0x00),
     INST_OP_CALL = (INST_CLS_JMP | 0x80),
     INST_OP_EXIT = (INST_CLS_JMP | 0x90),
 
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 8be56961e..083d5e3fa 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -6,6 +6,25 @@
 #include "asm_marshal.hpp"
 #include "asm_unmarshal.hpp"
 
+// Verify that if we unmarshal an instruction and then re-marshal it,
+// we get what we expect.
+static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result) {
+    program_info info{.platform = &g_ebpf_platform_linux,
+                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
+    REQUIRE(parsed.size() == 3);
+    auto [_, single, _2] = parsed.front();
+    (void)_;  // unused
+    (void)_2; // unused
+    std::vector<ebpf_inst> marshaled = marshal(single, 0);
+    REQUIRE(marshaled.size() == 1);
+    ebpf_inst result = marshaled.back();
+    REQUIRE(memcmp(&expected_result, &result, sizeof(result)) == 0);
+}
+
+// Verify that if we marshal an instruction and then unmarshal it,
+// we get the original.
 static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false) {
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
@@ -81,6 +100,13 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
             // Condition::Op::NSET, does not exist in ebpf
                     Condition::Op::NE, Condition::Op::SGT, Condition::Op::SGE, Condition::Op::LT, Condition::Op::LE,
                     Condition::Op::SLT, Condition::Op::SLE};
+        SECTION("goto offset") {
+            ebpf_inst jmp_offset{.opcode = INST_OP_JA16, .offset = 1};
+            compare_unmarshal_marshal(jmp_offset, jmp_offset);
+
+            // JA32 +1 is equivalent to JA16 +1 since the offset fits in 16 bits.
+            compare_unmarshal_marshal(ebpf_inst{.opcode = INST_OP_JA32, .imm = 1}, jmp_offset);
+        }
         SECTION("Reg right") {
             for (auto op : ops) {
                 Condition cond{.op = op, .left = Reg{1}, .right = Reg{2}};
@@ -241,7 +267,7 @@ TEST_CASE("fail unmarshal", "[disasm][marshal]") {
                          "0: Bad instruction\n");
     check_unmarshal_fail(ebpf_inst{.opcode = (INST_MEM_UNUSED << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
                          "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_JMP32}, "0: Bad instruction\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x90 | INST_CLS_JMP32}, "0: Bad instruction\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
 }

From 10d47ff0b4fef8e3d1b6f94ee58a4310e978ef38 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 28 Dec 2023 14:26:35 -0800
Subject: [PATCH 018/373] Byteswap fixes

* Add byteswap test cases
* Fix asm_parse.cpp to allow le* operations

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_parse.cpp         |  2 +-
 src/asm_unmarshal.cpp     | 13 ++++---
 src/test/test_marshal.cpp |  6 ++-
 test-data/unop.yaml       | 80 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 93 insertions(+), 8 deletions(-)

diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 9f4e42c1c..d6c95cfdd 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -33,7 +33,7 @@ using crab::linear_expression_t;
 #define OPASSIGN R"_(\s*(\S*)=\s*)_"
 #define ASSIGN R"_(\s*=\s*)_"
 #define LONGLONG R"_(\s*(ll|)\s*)_"
-#define UNOP R"_((-|be16|be32|be64))_"
+#define UNOP R"_((-|be16|be32|be64|le16|le32|le64))_"
 
 #define PLUSMINUS R"_((\s*[+-])\s*)_"
 #define LPAREN R"_(\s*\(\s*)_"
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 8b63f5a97..cacd76a43 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -122,14 +122,15 @@ struct Unmarshaller {
                 note("arsh32 is not allowed");
             return Bin::Op::ARSH;
         case INST_ALU_OP_END:
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64) {
+                std::string error_message =
+                    "invalid endian immediate " + std::to_string(inst.imm) + " for 64 bit instruction";
+                throw InvalidInstruction(pc, error_message.c_str());
+            }
             switch (inst.imm) {
             case 16: return (inst.opcode & INST_END_BE) ? Un::Op::BE16 : Un::Op::LE16;
-            case 32:
-                if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64)
-                    throw InvalidInstruction(pc, "invalid endian immediate 32 for 64 bit instruction");
-                return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
-            case 64:
-                return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
+            case 32: return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
+            case 64: return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
             default:
                 throw InvalidInstruction(pc, "invalid endian immediate");
             }
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 083d5e3fa..05984a7ab 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -47,7 +47,9 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
-    std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", insns, info}));
+    auto result = unmarshal(raw_program{"", "", insns, info});
+    REQUIRE(std::holds_alternative<std::string>(result));
+    std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
 }
 
@@ -270,4 +272,6 @@ TEST_CASE("fail unmarshal", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x90 | INST_CLS_JMP32}, "0: Bad instruction\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 0}, "0: invalid endian immediate 0 for 64 bit instruction\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 16}, "0: invalid endian immediate 16 for 64 bit instruction\n");
 }
diff --git a/test-data/unop.yaml b/test-data/unop.yaml
index 2c23f914f..6c3f3033d 100644
--- a/test-data/unop.yaml
+++ b/test-data/unop.yaml
@@ -40,3 +40,83 @@ code:
     r1 = -r1
 
 post: ["r1.type=number", "r1.svalue=[-5, 5]"]
+---
+test-case: be16 singleton
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
+---
+test-case: be32 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = be32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
+---
+test-case: be64 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = be64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
+---
+test-case: le16 singleton
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; 0x654321 -> 0x4321
+
+post: ["r1.type=number", "r1.svalue=17185", "r1.uvalue=17185"]
+---
+test-case: le32 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = le32 r1 ; 0x0987654321 -> 0x87654321
+
+post: ["r1.type=number", "r1.svalue=2271560481", "r1.uvalue=2271560481"]
+---
+test-case: le64 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = le64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+---
+test-case: le16 range
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; this could preserve the range but we don't support that yet
+
+post: ["r1.type=number"]
+---
+test-case: be16 range
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1.type=number"]

From 3321c602fc6c61f6238f5230fe386edc870be4a1 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 28 Dec 2023 14:55:37 -0800
Subject: [PATCH 019/373] Add bswap instructions

Fixes #531

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_marshal.cpp       | 19 ++++++++++++++---
 src/asm_ostream.cpp       |  3 +++
 src/asm_parse.cpp         |  5 ++++-
 src/asm_syntax.hpp        |  3 +++
 src/asm_unmarshal.cpp     | 11 +++++++---
 src/crab/ebpf_domain.cpp  | 12 +++++++++++
 src/test/test_marshal.cpp |  4 ++--
 test-data/unop.yaml       | 44 +++++++++++++++++++++++++++++++++++++--
 8 files changed, 90 insertions(+), 11 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 764077299..1a308bc93 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -72,11 +72,14 @@ static uint8_t imm(Un::Op op) {
     switch (op) {
     case Op::NEG: return 0;
     case Op::BE16:
-    case Op::LE16: return 16;
+    case Op::LE16:
+    case Op::SWAP16: return 16;
     case Op::BE32:
-    case Op::LE32: return 32;
+    case Op::LE32:
+    case Op::SWAP32: return 32;
     case Op::BE64:
-    case Op::LE64: return 64;
+    case Op::LE64:
+    case Op::SWAP64: return 64;
     }
     assert(false);
     return {};
@@ -156,6 +159,16 @@ struct MarshalVisitor {
                 .offset = 0,
                 .imm = imm(b.op),
             }};
+        case Un::Op::SWAP16:
+        case Un::Op::SWAP32:
+        case Un::Op::SWAP64:
+            return {ebpf_inst{
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU64 | (0xd << 4)),
+                .dst = b.dst.v,
+                .src = 0,
+                .offset = 0,
+                .imm = imm(b.op),
+            }};
         }
         assert(false);
         return {};
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 9f8c12254..3c8693954 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -224,6 +224,9 @@ struct InstructionPrinterVisitor {
         case Un::Op::LE16: os_ << "le16 "; break;
         case Un::Op::LE32: os_ << "le32 "; break;
         case Un::Op::LE64: os_ << "le64 "; break;
+        case Un::Op::SWAP16: os_ << "swap16 "; break;
+        case Un::Op::SWAP32: os_ << "swap32 "; break;
+        case Un::Op::SWAP64: os_ << "swap64 "; break;
         case Un::Op::NEG: os_ << "-"; break;
         }
         os_ << b.dst;
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index d6c95cfdd..a60fe6395 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -33,7 +33,7 @@ using crab::linear_expression_t;
 #define OPASSIGN R"_(\s*(\S*)=\s*)_"
 #define ASSIGN R"_(\s*=\s*)_"
 #define LONGLONG R"_(\s*(ll|)\s*)_"
-#define UNOP R"_((-|be16|be32|be64|le16|le32|le64))_"
+#define UNOP R"_((-|be16|be32|be64|le16|le32|le64|swap16|swap32|swap64))_"
 
 #define PLUSMINUS R"_((\s*[+-])\s*)_"
 #define LPAREN R"_(\s*\(\s*)_"
@@ -69,6 +69,9 @@ static const std::map<std::string, Un::Op> str_to_unop = {
     {"le16", Un::Op::LE16},
     {"le32", Un::Op::LE32},
     {"le64", Un::Op::LE64},
+    {"swap16", Un::Op::SWAP16},
+    {"swap32", Un::Op::SWAP32},
+    {"swap64", Un::Op::SWAP64},
     {"-", Un::Op::NEG},
 };
 
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 55c0b082b..c8e621161 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -108,6 +108,9 @@ struct Un {
         LE16, // dst = htole16(dst)
         LE32, // dst = htole32(dst)
         LE64, // dst = htole64(dst)
+        SWAP16, // dst = bswap16(dst)
+        SWAP32, // dst = bswap32(dst)
+        SWAP64, // dst = bswap64(dst)
         NEG,  // dst = -dst
     };
 
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index cacd76a43..102f1fa80 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -123,9 +123,14 @@ struct Unmarshaller {
             return Bin::Op::ARSH;
         case INST_ALU_OP_END:
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64) {
-                std::string error_message =
-                    "invalid endian immediate " + std::to_string(inst.imm) + " for 64 bit instruction";
-                throw InvalidInstruction(pc, error_message.c_str());
+                if (inst.opcode & INST_END_BE)
+                    throw InvalidInstruction(pc, "invalid endian immediate");
+                switch (inst.imm) {
+                case 16: return Un::Op::SWAP16;
+                case 32: return Un::Op::SWAP32;
+                case 64: return Un::Op::SWAP64;
+                default: throw InvalidInstruction(pc, "invalid endian immediate");
+                }
             }
             switch (inst.imm) {
             case 16: return (inst.opcode & INST_END_BE) ? Un::Op::BE16 : Un::Op::LE16;
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index b511de0a7..bce79438e 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1484,6 +1484,18 @@ void ebpf_domain_t::operator()(const Un& stmt) {
         swap_endianness(dst.svalue, int64_t(0), boost::endian::native_to_little<int64_t>);
         swap_endianness(dst.svalue, uint64_t(0), boost::endian::native_to_little<uint64_t>);
         break;
+    case Un::Op::SWAP16:
+        swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+        swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+        break;
+    case Un::Op::SWAP32:
+        swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+        swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+        break;
+    case Un::Op::SWAP64:
+        swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
+        swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+        break;
     case Un::Op::NEG:
         neg(dst.svalue, dst.uvalue, stmt.is64 ? 64 : 32);
         havoc_offsets(stmt.dst);
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 05984a7ab..33773791f 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -272,6 +272,6 @@ TEST_CASE("fail unmarshal", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x90 | INST_CLS_JMP32}, "0: Bad instruction\n");
     check_unmarshal_fail(ebpf_inst{.opcode = 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 0}, "0: invalid endian immediate 0 for 64 bit instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 16}, "0: invalid endian immediate 16 for 64 bit instruction\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU, .imm = 0}, "0: invalid endian immediate\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 0}, "0: invalid endian immediate\n");
 }
diff --git a/test-data/unop.yaml b/test-data/unop.yaml
index 6c3f3033d..180ff41ca 100644
--- a/test-data/unop.yaml
+++ b/test-data/unop.yaml
@@ -71,6 +71,16 @@ code:
 
 post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
 ---
+test-case: be16 range
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1.type=number"]
+---
 test-case: le16 singleton
 
 pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
@@ -111,12 +121,42 @@ code:
 
 post: ["r1.type=number"]
 ---
-test-case: be16 range
+test-case: swap16 singleton
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
+---
+test-case: swap32 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = swap32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
+---
+test-case: swap64 singleton
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+code:
+  <start>: |
+    r1 = swap64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
+---
+test-case: swap16 range
 
 pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
 
 code:
   <start>: |
-    r1 = be16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+    r1 = swap16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
 
 post: ["r1.type=number"]

From d239aa395daf8d1ab86bbd9b55ef45b01109cd13 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 30 Dec 2023 16:41:56 +0000
Subject: [PATCH 020/373] Bump external/bpf_conformance from `ab34094` to
 `9b6abdf`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `ab34094` to `9b6abdf`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/ab3409499613e005cf8098bb8249efd71fa4c43e...9b6abdf38db28dcaf8da33e504c89039b931b6ab)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index ab3409499..9b6abdf38 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit ab3409499613e005cf8098bb8249efd71fa4c43e
+Subproject commit 9b6abdf38db28dcaf8da33e504c89039b931b6ab

From 68951ab23493196f8a1c0d184cae59bdd5943c28 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 31 Dec 2023 12:01:50 -0800
Subject: [PATCH 021/373] Fix misleading instruction_count message

Since PR #479, PREVAIL now computes a loop iteration count,
not an instruction_count, so update messages and symbols names
accordingly.

Fixes #542

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_ostream.cpp       |  2 +-
 src/config.hpp            |  2 +-
 src/crab/ebpf_domain.cpp  | 14 +++++++-------
 src/crab/ebpf_domain.hpp  |  4 ++--
 src/crab/fwd_analyzer.cpp |  2 +-
 src/crab/var_factory.cpp  |  4 ++--
 src/crab/variable.hpp     |  4 ++--
 src/crab_verifier.cpp     | 16 ++++++++--------
 src/main/check.cpp        |  4 ++--
 9 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 3c8693954..0285d6a27 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -338,7 +338,7 @@ struct InstructionPrinterVisitor {
     }
 
     void operator()(IncrementLoopCounter const& a) {
-        os_ << crab::variable_t::instruction_count(to_string(a.name)) << "++";
+        os_ << crab::variable_t::loop_counter(to_string(a.name)) << "++";
     }
 };
 
diff --git a/src/config.hpp b/src/config.hpp
index 00fcd4ea1..cf3065fd9 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -25,7 +25,7 @@ struct ebpf_verifier_options_t {
 struct ebpf_verifier_stats_t {
     int total_unreachable;
     int total_warnings;
-    int max_instruction_count;
+    int max_loop_count;
 };
 
 extern const ebpf_verifier_options_t ebpf_verifier_default_options;
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index bce79438e..90e920a17 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -925,7 +925,7 @@ ebpf_domain_t ebpf_domain_t::calculate_constant_limits() {
         inv += r.packet_offset <= variable_t::packet_size();
         inv += r.packet_offset >= 0;
         if (thread_local_options.check_termination) {
-            for (variable_t counter : variable_t::get_instruction_counters()) {
+            for (variable_t counter : variable_t::get_loop_counters()) {
                 inv += counter <= std::numeric_limits<int32_t>::max();
                 inv += counter >= 0;
                 inv += counter <= r.svalue;
@@ -2828,18 +2828,18 @@ ebpf_domain_t ebpf_domain_t::setup_entry(bool init_r1) {
     return inv;
 }
 
-void ebpf_domain_t::initialize_instruction_count(const label_t label) {
-    m_inv.assign(variable_t::instruction_count(to_string(label)), 0);
+void ebpf_domain_t::initialize_loop_counter(const label_t label) {
+    m_inv.assign(variable_t::loop_counter(to_string(label)), 0);
 }
 
-bound_t ebpf_domain_t::get_instruction_count_upper_bound() {
+bound_t ebpf_domain_t::get_loop_count_upper_bound() {
     crab::bound_t ub{number_t{0}};
-    for (variable_t counter : variable_t::get_instruction_counters())
-        ub += std::max(ub, m_inv[counter].ub());
+    for (variable_t counter : variable_t::get_loop_counters())
+        ub = std::max(ub, m_inv[counter].ub());
     return ub;
 }
 
 void ebpf_domain_t::operator()(const IncrementLoopCounter& ins) {
-    this->add(variable_t::instruction_count(to_string(ins.name)), 1);
+    this->add(variable_t::loop_counter(to_string(ins.name)), 1);
 }
 } // namespace crab
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 0fbb1992a..fb3ef276a 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -47,7 +47,7 @@ class ebpf_domain_t final {
 
     typedef bool check_require_func_t(NumAbsDomain&, const linear_constraint_t&, std::string);
     void set_require_check(std::function<check_require_func_t> f);
-    bound_t get_instruction_count_upper_bound();
+    bound_t get_loop_count_upper_bound();
     static ebpf_domain_t setup_entry(bool init_r1);
 
     static ebpf_domain_t from_constraints(const std::set<std::string>& constraints, bool setup_constraints);
@@ -79,7 +79,7 @@ class ebpf_domain_t final {
     void operator()(const ZeroCtxOffset&);
     void operator()(const IncrementLoopCounter&);
 
-    void initialize_instruction_count(label_t label);
+    void initialize_loop_counter(label_t label);
     static ebpf_domain_t calculate_constant_limits();
   private:
     // private generic domain functions
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index 5a760bae4..d08f515d3 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -124,7 +124,7 @@ std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg,
             }
         }
         for (const label_t& label : cycle_heads) {
-            entry_inv.initialize_instruction_count(label);
+            entry_inv.initialize_loop_counter(label);
             cfg.get_node(label).insert(IncrementLoopCounter{label});
         }
     }
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index 2418a0b96..e03371e32 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -88,7 +88,7 @@ variable_t variable_t::kind_var(data_kind_t kind, variable_t type_variable) {
 
 variable_t variable_t::meta_offset() { return make("meta_offset"); }
 variable_t variable_t::packet_size() { return make("packet_size"); }
-variable_t variable_t::instruction_count(const std::string& label) { return make("pc[" + label + "]"); }
+variable_t variable_t::loop_counter(const std::string& label) { return make("pc[" + label + "]"); }
 
 static bool ends_with(const std::string& str, const std::string& suffix)
 {
@@ -108,7 +108,7 @@ bool variable_t::is_in_stack() const {
     return this->name()[0] == 's';
 }
 
-std::vector<variable_t> variable_t::get_instruction_counters() {
+std::vector<variable_t> variable_t::get_loop_counters() {
     std::vector<variable_t> res;
     for (const std::string& name: *names) {
         if (name.find("pc") == 0)
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index f51055c42..4b83effbe 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -75,8 +75,8 @@ class variable_t final {
     static variable_t kind_var(data_kind_t kind, variable_t type_variable);
     static variable_t meta_offset();
     static variable_t packet_size();
-    static std::vector<variable_t> get_instruction_counters();
-    static variable_t instruction_count(const std::string& label);
+    static std::vector<variable_t> get_loop_counters();
+    static variable_t loop_counter(const std::string& label);
     [[nodiscard]] bool is_in_stack() const;
 
     struct Hasher {
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 7904415cd..3d5d33f31 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -31,7 +31,7 @@ struct checks_db final {
     std::map<label_t, std::vector<std::string>> m_db{};
     int total_warnings{};
     int total_unreachable{};
-    crab::bound_t max_instruction_count{crab::number_t{0}};
+    crab::bound_t max_loop_count{crab::number_t{0}};
 
     void add(const label_t& label, const std::string& msg) { m_db[label].emplace_back(msg); }
 
@@ -45,8 +45,8 @@ struct checks_db final {
         total_unreachable++;
     }
 
-    [[nodiscard]] int get_max_instruction_count() const {
-        auto m = this->max_instruction_count.number();
+    [[nodiscard]] int get_max_loop_count() const {
+        auto m = this->max_loop_count.number();
         if (m && m->fits_sint32())
             return m->cast_to_sint32();
         else
@@ -94,7 +94,7 @@ static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invari
 
     if (thread_local_options.check_termination) {
         auto last_inv = post_invariants.at(cfg.exit_label());
-        m_db.max_instruction_count = last_inv.get_instruction_count_upper_bound();
+        m_db.max_loop_count = last_inv.get_loop_count_upper_bound();
     }
     return m_db;
 }
@@ -122,8 +122,8 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
         }
     }
     os << "\n";
-    crab::number_t max_instructions{100000};
-    if (db.max_instruction_count > max_instructions) {
+    crab::number_t max_loop_count{100000};
+    if (db.max_loop_count > max_loop_count) {
         os << "Could not prove termination.\n";
     }
 }
@@ -171,7 +171,7 @@ bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, co
     if (stats) {
         stats->total_unreachable = report.total_unreachable;
         stats->total_warnings = report.total_warnings;
-        stats->max_instruction_count = report.get_max_instruction_count();
+        stats->max_loop_count = report.get_max_loop_count();
     }
     return (report.total_warnings == 0);
 }
@@ -224,7 +224,7 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
     if (stats) {
         stats->total_unreachable = report.total_unreachable;
         stats->total_warnings = report.total_warnings;
-        stats->max_instruction_count = report.get_max_instruction_count();
+        stats->max_loop_count = report.get_max_loop_count();
     }
     return (report.total_warnings == 0);
 }
diff --git a/src/main/check.cpp b/src/main/check.cpp
index c039807f6..8b91d6d03 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -161,8 +161,8 @@ int main(int argc, char** argv) {
         const auto [res, seconds] = timed_execution([&] {
             return ebpf_verify_program(std::cout, prog, raw_prog.info, &ebpf_verifier_options, &verifier_stats);
         });
-        if (ebpf_verifier_options.check_termination && (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
-            std::cout << "Program terminates within " << verifier_stats.max_instruction_count << " instructions\n";
+        if (res && ebpf_verifier_options.check_termination && (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
+            std::cout << "Program terminates within " << verifier_stats.max_loop_count << " loop iterations\n";
         }
         std::cout << res << "," << seconds << "," << resident_set_size_kb() << "\n";
         return !res;

From 90ce44a666f21e7caa5c7adb9abbcc87a14aee7b Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Mon, 1 Jan 2024 18:47:00 -0800
Subject: [PATCH 022/373] Fix checking of bad call parameter

Prior to this change, if the caller didn't pass enough registers,
the verifier would throw an exception instead of gracefully failing
verification.

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/crab/ebpf_domain.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 90e920a17..d1ac9678d 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2144,7 +2144,12 @@ void ebpf_domain_t::operator()(const Call& call) {
 
         case ArgPair::Kind::PTR_TO_WRITABLE_MEM: {
             bool store_numbers = true;
-            variable_t addr = get_type_offset_variable(param.mem).value();
+            auto variable = get_type_offset_variable(param.mem);
+            if (!variable.has_value()) {
+                require(m_inv, linear_constraint_t::FALSE(), "Argument must be a pointer to writable memory");
+                return;
+            }
+            variable_t addr = variable.value();
             variable_t width = reg_pack(param.size).svalue;
 
             m_inv = type_inv.join_over_types(m_inv, param.mem, [&](NumAbsDomain& inv, type_encoding_t type) {

From c5f2b92cbfc5de435c8da34360ae99a2e3818df6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 6 Jan 2024 16:07:24 +0000
Subject: [PATCH 023/373] Bump external/bpf_conformance from `9b6abdf` to
 `fe414a7`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `9b6abdf` to `fe414a7`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/9b6abdf38db28dcaf8da33e504c89039b931b6ab...fe414a7f063dc68d506c6368e4e0c31ffb1f2584)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 9b6abdf38..fe414a7f0 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 9b6abdf38db28dcaf8da33e504c89039b931b6ab
+Subproject commit fe414a7f063dc68d506c6368e4e0c31ffb1f2584

From 757e3fab10d165b85f75d9c3982e0c1695cc3466 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 11 Jan 2024 10:37:28 -0800
Subject: [PATCH 024/373] Update to latest bpf_conformance suite

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 external/bpf_conformance      |  2 +-
 src/asm_unmarshal.cpp         | 28 +++++++++++++++++-----------
 src/test/test_conformance.cpp | 25 ++++++++++++++++++++-----
 3 files changed, 38 insertions(+), 17 deletions(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index fe414a7f0..13de786ef 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit fe414a7f063dc68d506c6368e4e0c31ffb1f2584
+Subproject commit 13de786efe55fb9c456561cf3ca1de4f51f590de
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 102f1fa80..f11697bef 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -87,28 +87,20 @@ struct Unmarshaller {
     explicit Unmarshaller(vector<vector<string>>& notes, const program_info& info) : notes{notes}, info{info} { note_next_pc(); }
 
     auto getAluOp(size_t pc, ebpf_inst inst) -> std::variant<Bin::Op, Un::Op> {
+        // First handle instructions that support a non-zero offset.
         switch (inst.opcode & INST_ALU_OP_MASK) {
-        case INST_ALU_OP_ADD: return Bin::Op::ADD;
-        case INST_ALU_OP_SUB: return Bin::Op::SUB;
-        case INST_ALU_OP_MUL: return Bin::Op::MUL;
         case INST_ALU_OP_DIV:
             switch (inst.offset) {
             case 0: return Bin::Op::UDIV;
             case 1: return Bin::Op::SDIV;
             default: throw InvalidInstruction{pc, "invalid ALU op 0x30"};
             }
-        case INST_ALU_OP_OR: return Bin::Op::OR;
-        case INST_ALU_OP_AND: return Bin::Op::AND;
-        case INST_ALU_OP_LSH: return Bin::Op::LSH;
-        case INST_ALU_OP_RSH: return Bin::Op::RSH;
-        case INST_ALU_OP_NEG: return Un::Op::NEG;
         case INST_ALU_OP_MOD:
             switch (inst.offset) {
             case 0: return Bin::Op::UMOD;
             case 1: return Bin::Op::SMOD;
             default: throw InvalidInstruction{pc, "invalid ALU op 0x90"};
             }
-        case INST_ALU_OP_XOR: return Bin::Op::XOR;
         case INST_ALU_OP_MOV:
             switch (inst.offset) {
             case 0: return Bin::Op::MOV;
@@ -117,6 +109,22 @@ struct Unmarshaller {
             case 32: return Bin::Op::MOVSX32;
             default: throw InvalidInstruction{pc, "invalid ALU op 0xb0"};
             }
+        }
+
+        // All the rest require a zero offset.
+        if (inst.offset != 0)
+            throw InvalidInstruction{pc, "nonzero offset for register alu op"};
+
+        switch (inst.opcode & INST_ALU_OP_MASK) {
+        case INST_ALU_OP_ADD: return Bin::Op::ADD;
+        case INST_ALU_OP_SUB: return Bin::Op::SUB;
+        case INST_ALU_OP_MUL: return Bin::Op::MUL;
+        case INST_ALU_OP_OR: return Bin::Op::OR;
+        case INST_ALU_OP_AND: return Bin::Op::AND;
+        case INST_ALU_OP_LSH: return Bin::Op::LSH;
+        case INST_ALU_OP_RSH: return Bin::Op::RSH;
+        case INST_ALU_OP_NEG: return Un::Op::NEG;
+        case INST_ALU_OP_XOR: return Bin::Op::XOR;
         case INST_ALU_OP_ARSH:
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU)
                 note("arsh32 is not allowed");
@@ -150,8 +158,6 @@ struct Unmarshaller {
     uint64_t zero_extend(int32_t imm) { return (uint64_t)(uint32_t)imm; }
 
     auto getBinValue(pc_t pc, ebpf_inst inst) -> Value {
-        if (inst.offset != 0)
-            throw InvalidInstruction{pc, "nonzero offset for register alu op"};
         if (inst.opcode & INST_SRC_REG) {
             if (inst.imm != 0)
                 throw InvalidInstruction{pc, "nonzero imm for register alu op"};
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index 73d3e6c5c..c7a681cfb 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -13,7 +13,7 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
     std::filesystem::path plugin_path =
         test_path.remove_filename().append("conformance_check" + extension.string()).string();
     std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result =
-        bpf_conformance(test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v3,
+        bpf_conformance(test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
                         bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
     for (auto file : test_files) {
         auto& [file_result, reason] = result[file];
@@ -34,21 +34,21 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
 // legitimate programs from being usable.
 #define TEST_CONFORMANCE_VERIFICATION_FAILED(filename) \
     TEST_CASE("conformance_check " filename, "[conformance]") { \
-        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_FAIL, "Verification failed"); \
+        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "Verification failed"); \
     }
 
 // Any tests that return top are safe, but are not as precise as they
 // could be and so may prevent legitimate programs from being usable.
 #define TEST_CONFORMANCE_TOP(filename) \
     TEST_CASE("conformance_check " filename, "[conformance]") { \
-        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_FAIL, "Couldn't determine r0 value"); \
+        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "Couldn't determine r0 value"); \
     }
 
 // Any tests that return a range are safe, but are not as precise as they
 // could be and so may prevent legitimate programs from being usable.
 #define TEST_CONFORMANCE_RANGE(filename, range)                                                                  \
     TEST_CASE("conformance_check " filename, "[conformance]") {                                                  \
-        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_FAIL, "r0 value is range " range); \
+        test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "r0 value is range " range); \
     }
 
 TEST_CONFORMANCE("add.data")
@@ -74,8 +74,9 @@ TEST_CONFORMANCE("be16.data")
 TEST_CONFORMANCE("be32-high.data")
 TEST_CONFORMANCE("be32.data")
 TEST_CONFORMANCE("be64.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("call_local.data")
 TEST_CONFORMANCE("call_unwind_fail.data")
-TEST_CONFORMANCE("div-by-zero-reg.data")
+TEST_CONFORMANCE("div32-by-zero-reg.data")
 TEST_CONFORMANCE("div32-high-divisor.data")
 TEST_CONFORMANCE("div32-imm.data")
 TEST_CONFORMANCE("div32-reg.data")
@@ -149,6 +150,14 @@ TEST_CONFORMANCE_VERIFICATION_FAILED("lock_and.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_and32.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_cmpxchg.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_cmpxchg32.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_add.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_add32.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_and.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_and32.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_or.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_or32.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_xor.data")
+TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_xor32.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_or.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_or32.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("lock_xchg.data")
@@ -195,6 +204,12 @@ TEST_CONFORMANCE("rsh64-imm-neg.data")
 TEST_CONFORMANCE("rsh64-reg.data")
 TEST_CONFORMANCE("rsh64-reg-high.data")
 TEST_CONFORMANCE("rsh64-reg-neg.data")
+TEST_CONFORMANCE("sdiv32-by-zero-reg.data")
+TEST_CONFORMANCE("sdiv32-imm.data")
+TEST_CONFORMANCE("sdiv32-reg.data")
+TEST_CONFORMANCE("sdiv64-by-zero-reg.data")
+TEST_CONFORMANCE("sdiv64-imm.data")
+TEST_CONFORMANCE("sdiv64-reg.data")
 TEST_CONFORMANCE("stack.data")
 TEST_CONFORMANCE("stb.data")
 TEST_CONFORMANCE("stdw.data")

From 75fd8c9eae91cf03014d0b32ed0acf045df045a1 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sat, 13 Jan 2024 09:35:42 -0800
Subject: [PATCH 025/373] Try apt-get update in CI/CD

To see if it fixes the build issue

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 .github/workflows/build.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b4b3f8e6c..85fb55f56 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,6 +26,7 @@ jobs:
     steps:
       - name: Install dependencies
         run: |
+          sudo apt-get update
           sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev valgrind
 
       - uses: actions/checkout@v4

From 112eb88ffa4b3fe6e7554c2b5db9c4096b308e20 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 13 Jan 2024 22:58:18 +0000
Subject: [PATCH 026/373] Bump ebpf-samples from `e052151` to `29574d4`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `e052151` to `29574d4`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/e052151f8cf3b3d65bfaade6255318a566457fbb...29574d49653bc07543379d66a46752cbd09debcf)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index e052151f8..29574d496 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit e052151f8cf3b3d65bfaade6255318a566457fbb
+Subproject commit 29574d49653bc07543379d66a46752cbd09debcf

From 7311c35212c67bf328d8516505ffad5070351431 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 13 Jan 2024 22:59:06 +0000
Subject: [PATCH 027/373] Bump external/libbtf from `f5fab5a` to `fdb1bc9`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `f5fab5a` to `fdb1bc9`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/f5fab5a0b36869c104fa45a6ffb6c87295a22888...fdb1bc97410cd784f230257aa1d07c63ed926d2b)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index f5fab5a0b..fdb1bc974 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit f5fab5a0b36869c104fa45a6ffb6c87295a22888
+Subproject commit fdb1bc97410cd784f230257aa1d07c63ed926d2b

From cfc0fe8c25669b2268de525c83a6796ea0ffc2e8 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Fri, 12 Jan 2024 10:31:07 -0800
Subject: [PATCH 028/373] Pickup update libbtf that supports anonymous inner
 maps

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/test/test_verify.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 450a2acbb..f1c546fb0 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -465,6 +465,7 @@ TEST_SECTION("build", "packet_start_ok.o", "xdp")
 TEST_SECTION("build", "packet_access.o", "xdp")
 TEST_SECTION("build", "tail_call.o", "xdp_prog")
 TEST_SECTION("build", "map_in_map.o", ".text")
+TEST_SECTION("build", "map_in_map_anonymous.o", ".text")
 TEST_SECTION("build", "map_in_map_legacy.o", ".text")
 TEST_SECTION("build", "twomaps.o", ".text");
 TEST_SECTION("build", "twostackvars.o", ".text");

From 7cfa6a56c8eb7ab24bcc63cb6543c002a1db87be Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Tue, 16 Jan 2024 09:50:17 -0800
Subject: [PATCH 029/373] Update to latest bpf_conformance

And add new ja32.data test

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 external/bpf_conformance      |  2 +-
 src/test/test_conformance.cpp | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 13de786ef..a309ef6d3 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 13de786efe55fb9c456561cf3ca1de4f51f590de
+Subproject commit a309ef6d384e4395e5315e19c17b47b94fa96672
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index c7a681cfb..b453685c9 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -87,6 +87,7 @@ TEST_CONFORMANCE("div64-negative-reg.data")
 TEST_CONFORMANCE("div64-reg.data")
 TEST_CONFORMANCE("exit-not-last.data")
 TEST_CONFORMANCE("exit.data")
+TEST_CONFORMANCE("ja32.data")
 TEST_CONFORMANCE("jeq-imm.data")
 TEST_CONFORMANCE("jeq-reg.data")
 TEST_CONFORMANCE("jeq32-imm.data")
@@ -184,6 +185,16 @@ TEST_CONFORMANCE("mod64-by-zero-reg.data")
 TEST_CONFORMANCE("mod64.data")
 TEST_CONFORMANCE("mov.data")
 TEST_CONFORMANCE("mov64-sign-extend.data")
+TEST_CONFORMANCE("movsx1632-imm.data")
+TEST_CONFORMANCE("movsx1632-reg.data")
+TEST_CONFORMANCE("movsx1664-imm.data")
+TEST_CONFORMANCE("movsx1664-reg.data")
+TEST_CONFORMANCE("movsx3264-imm.data")
+TEST_CONFORMANCE("movsx3264-reg.data")
+TEST_CONFORMANCE("movsx832-imm.data")
+TEST_CONFORMANCE("movsx832-reg.data")
+TEST_CONFORMANCE("movsx864-imm.data")
+TEST_CONFORMANCE("movsx864-reg.data")
 TEST_CONFORMANCE("mul32-imm.data")
 TEST_CONFORMANCE("mul32-reg-overflow.data")
 TEST_CONFORMANCE("mul32-reg.data")
@@ -222,4 +233,7 @@ TEST_CONFORMANCE("stxb.data")
 TEST_CONFORMANCE("stxdw.data")
 TEST_CONFORMANCE("stxh.data")
 TEST_CONFORMANCE("stxw.data")
+TEST_CONFORMANCE("swap16.data")
+TEST_CONFORMANCE("swap32.data")
+TEST_CONFORMANCE("swap64.data")
 TEST_CONFORMANCE("subnet.data")

From 28bcbbb36fd099f3468351d57bf4eb3c6c68a65d Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Tue, 16 Jan 2024 15:32:40 -0800
Subject: [PATCH 030/373] Add smod conformance tests

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/test/test_conformance.cpp | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index b453685c9..ac7a308c3 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -215,12 +215,30 @@ TEST_CONFORMANCE("rsh64-imm-neg.data")
 TEST_CONFORMANCE("rsh64-reg.data")
 TEST_CONFORMANCE("rsh64-reg-high.data")
 TEST_CONFORMANCE("rsh64-reg-neg.data")
+TEST_CONFORMANCE("sdiv32-by-zero-imm.data")
 TEST_CONFORMANCE("sdiv32-by-zero-reg.data")
 TEST_CONFORMANCE("sdiv32-imm.data")
 TEST_CONFORMANCE("sdiv32-reg.data")
+TEST_CONFORMANCE("sdiv64-by-zero-imm.data")
 TEST_CONFORMANCE("sdiv64-by-zero-reg.data")
 TEST_CONFORMANCE("sdiv64-imm.data")
 TEST_CONFORMANCE("sdiv64-reg.data")
+TEST_CONFORMANCE("smod32-neg-by-neg-imm.data")
+TEST_CONFORMANCE("smod32-neg-by-neg-reg.data")
+TEST_CONFORMANCE("smod32-neg-by-pos-imm.data")
+TEST_CONFORMANCE("smod32-neg-by-pos-reg.data")
+TEST_CONFORMANCE("smod32-neg-by-zero-imm.data")
+TEST_CONFORMANCE("smod32-neg-by-zero-reg.data")
+TEST_CONFORMANCE("smod32-pos-by-neg-imm.data")
+TEST_CONFORMANCE("smod32-pos-by-neg-reg.data")
+TEST_CONFORMANCE("smod64-neg-by-neg-imm.data")
+TEST_CONFORMANCE("smod64-neg-by-neg-reg.data")
+TEST_CONFORMANCE("smod64-neg-by-pos-imm.data")
+TEST_CONFORMANCE("smod64-neg-by-pos-reg.data")
+TEST_CONFORMANCE("smod64-neg-by-zero-imm.data")
+TEST_CONFORMANCE("smod64-neg-by-zero-reg.data")
+TEST_CONFORMANCE("smod64-pos-by-neg-imm.data")
+TEST_CONFORMANCE("smod64-pos-by-neg-reg.data")
 TEST_CONFORMANCE("stack.data")
 TEST_CONFORMANCE("stb.data")
 TEST_CONFORMANCE("stdw.data")

From 93ac334ae36cb78c75fc056dd3fe34c9d50b9337 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Jan 2024 16:42:20 +0000
Subject: [PATCH 031/373] Bump external/libbtf from `fdb1bc9` to `d0938e0`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `fdb1bc9` to `d0938e0`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/fdb1bc97410cd784f230257aa1d07c63ed926d2b...d0938e01fe143b632a13bce712605eba33e2169d)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index fdb1bc974..d0938e01f 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit fdb1bc97410cd784f230257aa1d07c63ed926d2b
+Subproject commit d0938e01fe143b632a13bce712605eba33e2169d

From 8b0c660ee4201067787b2177e5d727c16632220d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Jan 2024 16:42:23 +0000
Subject: [PATCH 032/373] Bump ebpf-samples from `29574d4` to `ce6d479`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `29574d4` to `ce6d479`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/29574d49653bc07543379d66a46752cbd09debcf...ce6d4793d8b851683a86c6af675a02e39f91f0db)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 29574d496..ce6d4793d 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 29574d49653bc07543379d66a46752cbd09debcf
+Subproject commit ce6d4793d8b851683a86c6af675a02e39f91f0db

From 47d78f4d26ce6d0d9ddb64184986cddb83b6a03d Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 25 Jan 2024 02:01:34 -0800
Subject: [PATCH 033/373] Add more negative unmarshaling tests (#576)

* Add more negative unmarshaling test cases
* Bug fixes
* Test invalid opcodes and src0 opcodes
* Test invalid imm0 opcodes
* Test invalid off0 opcodes

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_marshal.cpp       |   8 +--
 src/asm_unmarshal.cpp     |  88 ++++++++++++++++++++++--------
 src/ebpf_vm_isa.hpp       |  12 +++--
 src/test/test_marshal.cpp | 111 +++++++++++++++++++++++++-------------
 4 files changed, 152 insertions(+), 67 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 1a308bc93..5b42c5914 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -133,7 +133,7 @@ struct MarshalVisitor {
         case Un::Op::NEG:
             return {ebpf_inst{
                 // FIX: should be INST_CLS_ALU / INST_CLS_ALU64
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | 0x3 | (0x8 << 4)),
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU | 0x3 | INST_ALU_OP_NEG),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -143,7 +143,7 @@ struct MarshalVisitor {
         case Un::Op::LE32:
         case Un::Op::LE64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | (0xd << 4)),
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -153,7 +153,7 @@ struct MarshalVisitor {
         case Un::Op::BE32:
         case Un::Op::BE64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | 0x8 | (0xd << 4)),
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_END_BE | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -163,7 +163,7 @@ struct MarshalVisitor {
         case Un::Op::SWAP32:
         case Un::Op::SWAP64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU64 | (0xd << 4)),
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU64 | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index f11697bef..9560d0320 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -40,9 +40,17 @@ void compare(const string& field, T actual, T expected) {
         std::cerr << field << ": (actual) " << std::hex << (int)actual << " != " << (int)expected << " (expected)\n";
 }
 
+static std::string make_opcode_message(const char* msg, uint8_t opcode) {
+    std::ostringstream oss;
+    oss << msg << " op 0x" << std::hex << (int)opcode;
+    return oss.str();
+}
+
 struct InvalidInstruction : std::invalid_argument {
     size_t pc;
     explicit InvalidInstruction(size_t pc, const char* what) : std::invalid_argument{what}, pc{pc} {}
+    InvalidInstruction(size_t pc, std::string what) : std::invalid_argument{what}, pc{pc} {}
+    InvalidInstruction(size_t pc, uint8_t opcode) : std::invalid_argument{make_opcode_message("Bad instruction", opcode)}, pc{pc} {}
 };
 
 struct UnsupportedMemoryMode : std::invalid_argument {
@@ -113,7 +121,7 @@ struct Unmarshaller {
 
         // All the rest require a zero offset.
         if (inst.offset != 0)
-            throw InvalidInstruction{pc, "nonzero offset for register alu op"};
+            throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
 
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_ADD: return Bin::Op::ADD;
@@ -123,16 +131,26 @@ struct Unmarshaller {
         case INST_ALU_OP_AND: return Bin::Op::AND;
         case INST_ALU_OP_LSH: return Bin::Op::LSH;
         case INST_ALU_OP_RSH: return Bin::Op::RSH;
-        case INST_ALU_OP_NEG: return Un::Op::NEG;
+        case INST_ALU_OP_NEG:
+            // Negation is a unary operation. The SRC bit, src, and imm must be all 0.
+            if (inst.opcode & INST_SRC_REG)
+                throw InvalidInstruction{pc, inst.opcode};
+            if (inst.src != 0)
+                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
+            if (inst.imm != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            return Un::Op::NEG;
         case INST_ALU_OP_XOR: return Bin::Op::XOR;
         case INST_ALU_OP_ARSH:
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU)
                 note("arsh32 is not allowed");
             return Bin::Op::ARSH;
         case INST_ALU_OP_END:
+            if (inst.src != 0)
+                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64) {
                 if (inst.opcode & INST_END_BE)
-                    throw InvalidInstruction(pc, "invalid endian immediate");
+                    throw InvalidInstruction(pc, inst.opcode);
                 switch (inst.imm) {
                 case 16: return Un::Op::SWAP16;
                 case 32: return Un::Op::SWAP32;
@@ -147,8 +165,8 @@ struct Unmarshaller {
             default:
                 throw InvalidInstruction(pc, "invalid endian immediate");
             }
-        case 0xe0: throw InvalidInstruction{pc, "invalid ALU op 0xe0"};
-        case 0xf0: throw InvalidInstruction{pc, "invalid ALU op 0xf0"};
+        case 0xe0: throw InvalidInstruction{pc, inst.opcode};
+        case 0xf0: throw InvalidInstruction{pc, inst.opcode};
         }
         return {};
     }
@@ -160,11 +178,11 @@ struct Unmarshaller {
     auto getBinValue(pc_t pc, ebpf_inst inst) -> Value {
         if (inst.opcode & INST_SRC_REG) {
             if (inst.imm != 0)
-                throw InvalidInstruction{pc, "nonzero imm for register alu op"};
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             return Reg{inst.src};
         } else {
             if (inst.src != 0)
-                throw InvalidInstruction{pc, "nonzero src for register alu op"};
+                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
             // Imm is a signed 32-bit number.  Sign extend it to 64-bits for storage.
             return Imm{sign_extend(inst.imm)};
         }
@@ -187,7 +205,8 @@ struct Unmarshaller {
         case 0xb: return Op::LE;
         case 0xc: return Op::SLT;
         case 0xd: return Op::SLE;
-        case 0xe: throw InvalidInstruction(pc, "invalid JMP op 0xe");
+        case 0xe: throw InvalidInstruction(pc, opcode);
+        case 0xf: throw InvalidInstruction(pc, opcode);
         }
         return {};
     }
@@ -199,8 +218,7 @@ struct Unmarshaller {
         int width = getMemWidth(inst.opcode);
         bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
         switch ((inst.opcode & INST_MODE_MASK) >> 5) {
-        case 0:
-            throw InvalidInstruction(pc, "Bad instruction");
+        case 0: throw InvalidInstruction(pc, inst.opcode);
         case INST_ABS:
             if (!isLD)
                 throw InvalidInstruction(pc, "ABS but not LD");
@@ -217,11 +235,15 @@ struct Unmarshaller {
 
         case INST_MEM: {
             if (isLD)
-                throw InvalidInstruction(pc, "plain LD");
+                throw InvalidInstruction(pc, inst.opcode);
             bool isLoad = getMemIsLoad(inst.opcode);
             if (isLoad && inst.dst == R10_STACK_POINTER)
                 throw InvalidInstruction(pc, "Cannot modify r10");
             bool isImm = !(inst.opcode & 1);
+            if (isImm && inst.src != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+            if (!isImm && inst.imm != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
 
             assert(!(isLoad && isImm));
             uint8_t basereg = isLoad ? inst.src : inst.dst;
@@ -247,7 +269,7 @@ struct Unmarshaller {
             if (((inst.opcode & INST_CLS_MASK) != INST_CLS_STX) ||
                 ((inst.opcode & INST_SIZE_MASK) != INST_SIZE_W &&
                  (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW))
-                throw InvalidInstruction(pc, "Bad instruction");
+                throw InvalidInstruction(pc, inst.opcode);
             if (inst.imm != 0)
                 throw InvalidInstruction(pc, "Unsupported atomic instruction");
             return LockAdd{
@@ -259,8 +281,7 @@ struct Unmarshaller {
                     },
                 .valreg = Reg{inst.src},
             };
-        default:
-            throw InvalidInstruction(pc, "Bad instruction");
+        default: throw InvalidInstruction(pc, inst.opcode);
         }
         return {};
     }
@@ -382,21 +403,44 @@ struct Unmarshaller {
 
     auto makeJmp(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
         switch ((inst.opcode >> 4) & 0xF) {
-        case 0x8:
+        case INST_CALL:
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
+                throw InvalidInstruction(pc, inst.opcode);
             if (inst.opcode & INST_SRC_REG)
-                throw InvalidInstruction(pc, "Bad instruction");
+                throw InvalidInstruction(pc, inst.opcode);
+            if (inst.offset != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             if (!info.platform->is_helper_usable(inst.imm))
                 throw InvalidInstruction(pc, "invalid helper function id");
             return makeCall(inst.imm);
-        case 0x9:
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
-                throw InvalidInstruction(pc, "Bad instruction");
+        case INST_EXIT:
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG))
+                throw InvalidInstruction(pc, inst.opcode);
+            if (inst.src != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+            if (inst.imm != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            if (inst.offset != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Exit{};
-        case 0x0:
+        case INST_JA:
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP &&
                 (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32)
-                throw InvalidInstruction(pc, "Bad instruction");
+                throw InvalidInstruction(pc, inst.opcode);
+            if (inst.opcode & INST_SRC_REG)
+                throw InvalidInstruction(pc, inst.opcode);
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP && (inst.imm != 0))
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP32 && (inst.offset != 0))
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
         default: {
+            // First validate the opcode, src, and imm.
+            auto op = getJmpOp(pc, inst.opcode);
+            if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0))
+                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+            if ((inst.opcode & INST_SRC_REG) && (inst.imm != 0))
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+
             int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
             pc_t new_pc = pc + 1 + offset;
             if (new_pc >= insts.size())
@@ -407,7 +451,7 @@ struct Unmarshaller {
             auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
                                                   ? std::optional<Condition>{}
                                                   : Condition{
-                                                        .op = getJmpOp(pc, inst.opcode),
+                                                        .op = op,
                                                         .left = Reg{inst.dst},
                                                         .right = (inst.opcode & INST_SRC_REG) ? (Value)Reg{inst.src}
                                                                                               : Imm{sign_extend(inst.imm)},
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 654e34525..ad308b9af 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -54,10 +54,14 @@ enum {
 
     INST_OP_LDDW_IMM = (INST_CLS_LD | INST_SRC_IMM | INST_SIZE_DW), // Special
 
-    INST_OP_JA32 = (INST_CLS_JMP32 | 0x00),
-    INST_OP_JA16 = (INST_CLS_JMP | 0x00),
-    INST_OP_CALL = (INST_CLS_JMP | 0x80),
-    INST_OP_EXIT = (INST_CLS_JMP | 0x90),
+    INST_JA = 0x0,
+    INST_CALL = 0x8,
+    INST_EXIT = 0x9,
+
+    INST_OP_JA32 = ((INST_JA << 4) | INST_CLS_JMP32),
+    INST_OP_JA16 = ((INST_JA << 4) | INST_CLS_JMP),
+    INST_OP_CALL = ((INST_CALL << 4) | INST_CLS_JMP),
+    INST_OP_EXIT = ((INST_EXIT << 4) | INST_CLS_JMP),
 
     INST_ALU_OP_ADD  = 0x00,
     INST_ALU_OP_SUB  = 0x10,
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 33773791f..20700855f 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -233,45 +233,82 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
     }
 }
 
-TEST_CASE("fail unmarshal", "[disasm][marshal]") {
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 11, .imm = 8},
+TEST_CASE("fail unmarshal invalid opcodes", "[disasm][marshal]") {
+    // The following opcodes are undefined and should generate bad instruction errors.
+    uint8_t bad_opcodes[] = {
+        0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0x0d, 0x0e, 0x10, 0x11, 0x12, 0x13, 0x19, 0x1a, 0x1b, 0x60,
+        0x68, 0x70, 0x78, 0x80, 0x81, 0x82, 0x83, 0x86, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91,
+        0x92, 0x93, 0x96, 0x98, 0x99, 0x9a, 0x9b, 0x9d, 0x9e, 0xa0, 0xa1, 0xa2, 0xa3, 0xa8, 0xa9, 0xaa, 0xab, 0xb0,
+        0xb1, 0xb2, 0xb3, 0xb8, 0xb9, 0xba, 0xbb, 0xc0, 0xc1, 0xc2, 0xc8, 0xc9, 0xca, 0xcb, 0xd0, 0xd1, 0xd2, 0xd3,
+        0xd8, 0xd9, 0xda, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed,
+        0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff};
+    for (int i = 0; i < sizeof(bad_opcodes); i++) {
+        std::ostringstream oss;
+        oss << "0: Bad instruction op 0x" << std::hex << (int)bad_opcodes[i] << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = bad_opcodes[i]}, oss.str().c_str());
+    }
+}
+
+TEST_CASE("fail unmarshal src0 opcodes", "[disasm][marshal]") {
+    // The following opcodes are only defined for src = 0.
+    uint8_t src0_opcodes[] = {0x04, 0x05, 0x06, 0x07, 0x14, 0x15, 0x16, 0x17, 0x24, 0x25, 0x26, 0x27, 0x34, 0x35, 0x36,
+                              0x37, 0x44, 0x45, 0x46, 0x47, 0x54, 0x55, 0x56, 0x57, 0x62, 0x64, 0x65, 0x66, 0x67, 0x6a,
+                              0x72, 0x74, 0x75, 0x76, 0x77, 0x7a, 0x84, 0x87, 0x94, 0x95, 0x97, 0xa4, 0xa5, 0xa6, 0xa7,
+                              0xb4, 0xb5, 0xb6, 0xb7, 0xc4, 0xc5, 0xc6, 0xc7, 0xd4, 0xd5, 0xd6, 0xd7, 0xdc};
+    for (int i = 0; i < sizeof(src0_opcodes); i++) {
+        std::ostringstream oss;
+        oss << "0: nonzero src for register op 0x" << std::hex << (int)src0_opcodes[i] << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = src0_opcodes[i], .src = 1}, oss.str().c_str());
+    }
+}
+
+TEST_CASE("fail unmarshal imm0 opcodes", "[disasm][marshal]") {
+    // The following opcodes are only defined for imm = 0.
+    uint8_t imm0_opcodes[] = {0x05, 0x0c, 0x0f, 0x1c, 0x1d, 0x1e, 0x1f, 0x2c, 0x2d, 0x2e, 0x2f, 0x3d, 0x3e, 0x3f, 0x4c,
+                              0x4d, 0x4e, 0x4f, 0x5c, 0x5d, 0x5e, 0x5f, 0x61, 0x63, 0x69, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
+                              0x71, 0x73, 0x79, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x84, 0x87, 0x95, 0x9c, 0x9f, 0xac, 0xad,
+                              0xae, 0xaf, 0xbc, 0xbd, 0xbe, 0xbf, 0xcc, 0xcd, 0xce, 0xcf, 0xdd, 0xde};
+    for (int i = 0; i < sizeof(imm0_opcodes); i++) {
+        std::ostringstream oss;
+        oss << "0: nonzero imm for op 0x" << std::hex << (int)imm0_opcodes[i] << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = imm0_opcodes[i], .imm = 1}, oss.str().c_str());
+    }
+}
+
+TEST_CASE("fail unmarshal off0 opcodes", "[disasm][marshal]") {
+    // The following opcodes are only defined for offset = 0.
+    uint8_t off0_opcodes[] = {0x04, 0x06, 0x07, 0x0c, 0x0f, 0x14, 0x17, 0x1c, 0x1f, 0x24, 0x27, 0x2c, 0x2f, 0x44, 0x47,
+                              0x4c, 0x4f, 0x54, 0x57, 0x5c, 0x5f, 0x64, 0x67, 0x6c, 0x6f, 0x74, 0x77, 0x7c, 0x7f, 0x84,
+                              0x85, 0x87, 0x95, 0xa4, 0xa7, 0xac, 0xaf, 0xc4, 0xc7, 0xcc, 0xcf, 0xd4, 0xd7, 0xdc};
+    for (int i = 0; i < sizeof(off0_opcodes); i++) {
+        std::ostringstream oss;
+        oss << "0: nonzero offset for op 0x" << std::hex << (int)off0_opcodes[i] << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = off0_opcodes[i], .offset = 1}, oss.str().c_str());
+    }
+}
+
+TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x06 */ INST_CLS_JMP32}, "0: jump out of bounds\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x16 */ 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM}, "0: incomplete LDDW\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x21 */ (INST_ABS << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
+                         "0: ABS but not LD\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x41 */ (INST_IND << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
+                         "0: IND but not LD\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 11, .imm = 8},
                          "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 1, .src = 11},
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 1, .src = 11},
                          "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU), .dst = 11, .imm = 8},
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xb4 */ (INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU), .dst = 11, .imm = 8},
                          "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU), .dst = 1, .src = 11},
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xbc */ (INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU), .dst = 1, .src = 11},
                          "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_MEM << 5) | INST_SIZE_W | INST_CLS_LD)},
-                         "0: plain LD\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .dst = 1, .imm = 8}, "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_END_BE | INST_CLS_ALU, .dst = 1, .imm = 8}, "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_LDX}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_XADD << 5) | INST_CLS_ST)}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_XADD << 5) | INST_SIZE_B | INST_CLS_STX)}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = ((INST_XADD << 5) | INST_SIZE_H | INST_CLS_STX)}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_OP_CALL | INST_SRC_REG}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_OP_LDDW_IMM}, "0: incomplete LDDW\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_ADD | INST_SRC_IMM | INST_CLS_ALU64, .offset = 8},
-                         "0: nonzero offset for register alu op\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_ADD | INST_SRC_IMM | INST_CLS_ALU64, .src = 8},
-                         "0: nonzero src for register alu op\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_ADD | INST_SRC_REG | INST_CLS_ALU64, .imm = 8},
-                         "0: nonzero imm for register alu op\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_ABS << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: ABS but not LD\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_IND << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: IND but not LD\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_LEN << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_MSH << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = (INST_MEM_UNUSED << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = 0x90 | INST_CLS_JMP32}, "0: Bad instruction\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU, .imm = 0}, "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = INST_ALU_OP_END | INST_CLS_ALU64, .imm = 0}, "0: invalid endian immediate\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd4 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .dst = 1, .imm = 8},
+                         "0: invalid endian immediate\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd4 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .imm = 0},
+                         "0: invalid endian immediate\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd7 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU64, .imm = 0},
+                         "0: invalid endian immediate\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xdc */ INST_ALU_OP_END | INST_END_BE | INST_CLS_ALU, .dst = 1, .imm = 8},
+                         "0: invalid endian immediate\n");
 }

From e8047ca06d16c844ef7f6863bc12a457b8884288 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Mon, 22 Jan 2024 17:30:28 -0800
Subject: [PATCH 034/373] Add failing test for dependent read

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 ebpf-samples             | 2 +-
 src/test/test_verify.cpp | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index ce6d4793d..9057f7de2 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit ce6d4793d8b851683a86c6af675a02e39f91f0db
+Subproject commit 9057f7de29fb9bd8eaf6144f7bbf0b2d6e545e0e
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index f1c546fb0..023d780cf 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -476,6 +476,7 @@ TEST_SECTION("build", "prog_array.o", ".text");
 TEST_SECTION_REJECT("build", "badhelpercall.o", ".text")
 TEST_SECTION_REJECT("build", "ctxoffset.o", "sockops")
 TEST_SECTION_REJECT("build", "badmapptr.o", "test")
+TEST_SECTION_FAIL("build", "dependent_read.o", "xdp")
 TEST_SECTION_REJECT("build", "exposeptr.o", ".text")
 TEST_SECTION_REJECT("build", "exposeptr2.o", ".text")
 TEST_SECTION_REJECT("build", "mapvalue-overrun.o", ".text")

From f3964ef83f5cabf031f0647333a06551372af627 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 25 Jan 2024 07:30:02 -0800
Subject: [PATCH 035/373] Update conformance suite to latest (#574)

* Update bpf_conformance to latest
* Remove movsx imm tests since movsx is only defined for register operands per latest mailing list discussion
* Run new test cases added to conformance suite
* Fix conformance bug
---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 external/bpf_conformance      | 2 +-
 src/crab/ebpf_domain.cpp      | 6 +++++-
 src/test/test_conformance.cpp | 6 +-----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index a309ef6d3..583758eee 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit a309ef6d384e4395e5315e19c17b47b94fa96672
+Subproject commit 583758eee4907dd3a356a0f73939751415d46bf7
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index d1ac9678d..dc90c2df6 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2751,7 +2751,11 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                 default: break;
                 }
             });
-            havoc(dst.type);
+            if ((bin.dst.v != std::get<Reg>(bin.v).v) || (type_inv.get_type(m_inv, dst.type) == T_UNINIT)) {
+                // Only forget the destination type if we're copying from a different register,
+                // or from the same uninitialized register.
+                havoc(dst.type);
+            }
             type_inv.assign_type(m_inv, bin.dst, std::get<Reg>(bin.v));
             break;
         }
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index ac7a308c3..ff9340c78 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -93,6 +93,7 @@ TEST_CONFORMANCE("jeq-reg.data")
 TEST_CONFORMANCE("jeq32-imm.data")
 TEST_CONFORMANCE("jeq32-reg.data")
 TEST_CONFORMANCE("jge-imm.data")
+TEST_CONFORMANCE("jge-reg.data")
 TEST_CONFORMANCE("jge32-imm.data")
 TEST_CONFORMANCE("jge32-reg.data")
 TEST_CONFORMANCE("jgt-imm.data")
@@ -185,15 +186,10 @@ TEST_CONFORMANCE("mod64-by-zero-reg.data")
 TEST_CONFORMANCE("mod64.data")
 TEST_CONFORMANCE("mov.data")
 TEST_CONFORMANCE("mov64-sign-extend.data")
-TEST_CONFORMANCE("movsx1632-imm.data")
 TEST_CONFORMANCE("movsx1632-reg.data")
-TEST_CONFORMANCE("movsx1664-imm.data")
 TEST_CONFORMANCE("movsx1664-reg.data")
-TEST_CONFORMANCE("movsx3264-imm.data")
 TEST_CONFORMANCE("movsx3264-reg.data")
-TEST_CONFORMANCE("movsx832-imm.data")
 TEST_CONFORMANCE("movsx832-reg.data")
-TEST_CONFORMANCE("movsx864-imm.data")
 TEST_CONFORMANCE("movsx864-reg.data")
 TEST_CONFORMANCE("mul32-imm.data")
 TEST_CONFORMANCE("mul32-reg-overflow.data")

From a90ab20eb90e952538b9984539af795332e231fc Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 28 Jan 2024 11:07:13 -0800
Subject: [PATCH 036/373] More marshaling tests

* Add negative tests for bad offset for instructions that vary by
  offset value
* Add marshaling tests for unconditional byteswap
* Add marshaling tests for signed division and modulo
* Add marshaling tests for sign extension

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp     |  6 +++---
 src/test/test_marshal.cpp | 16 +++++++++++++++-
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 9560d0320..4a6af8308 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -101,13 +101,13 @@ struct Unmarshaller {
             switch (inst.offset) {
             case 0: return Bin::Op::UDIV;
             case 1: return Bin::Op::SDIV;
-            default: throw InvalidInstruction{pc, "invalid ALU op 0x30"};
+            default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         case INST_ALU_OP_MOD:
             switch (inst.offset) {
             case 0: return Bin::Op::UMOD;
             case 1: return Bin::Op::SMOD;
-            default: throw InvalidInstruction{pc, "invalid ALU op 0x90"};
+            default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         case INST_ALU_OP_MOV:
             switch (inst.offset) {
@@ -115,7 +115,7 @@ struct Unmarshaller {
             case 8: return Bin::Op::MOVSX8;
             case 16: return Bin::Op::MOVSX16;
             case 32: return Bin::Op::MOVSX32;
-            default: throw InvalidInstruction{pc, "invalid ALU op 0xb0"};
+            default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         }
 
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 20700855f..ffe0c8d02 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -58,7 +58,8 @@ static const auto ws = {1, 2, 4, 8};
 TEST_CASE("disasm_marshal", "[disasm][marshal]") {
     SECTION("Bin") {
         auto ops = {Bin::Op::MOV, Bin::Op::ADD, Bin::Op::SUB, Bin::Op::MUL, Bin::Op::UDIV,  Bin::Op::UMOD,
-                    Bin::Op::OR,  Bin::Op::AND, Bin::Op::LSH, Bin::Op::RSH, Bin::Op::ARSH, Bin::Op::XOR};
+                    Bin::Op::OR,  Bin::Op::AND, Bin::Op::LSH, Bin::Op::RSH, Bin::Op::ARSH, Bin::Op::XOR,
+                    Bin::Op::SDIV, Bin::Op::SMOD, Bin::Op::MOVSX8, Bin::Op::MOVSX16, Bin::Op::MOVSX32};
         SECTION("Reg src") {
             for (auto op : ops) {
                 compare_marshal_unmarshal(Bin{.op = op, .dst = Reg{1}, .v = Reg{2}, .is64 = true});
@@ -90,6 +91,9 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
             Un::Op::LE32,
             Un::Op::LE64,
             Un::Op::NEG,
+            Un::Op::SWAP16,
+            Un::Op::SWAP32,
+            Un::Op::SWAP64
         };
         for (auto op : ops)
             compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}});
@@ -287,6 +291,16 @@ TEST_CASE("fail unmarshal off0 opcodes", "[disasm][marshal]") {
     }
 }
 
+TEST_CASE("fail unmarshal offset opcodes", "[disasm][marshal]") {
+    // The following opcodes are defined for multiple other offset values, but not offset = 2 for example.
+    uint8_t off2_opcodes[] = {0x34, 0x37, 0x3c, 0x3f, 0x94, 0x97, 0x9c, 0x9f, 0xb4, 0xb7, 0xbc, 0xbf};
+    for (int i = 0; i < sizeof(off2_opcodes); i++) {
+        std::ostringstream oss;
+        oss << "0: invalid offset for op 0x" << std::hex << (int)off2_opcodes[i] << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = off2_opcodes[i], .offset = 2}, oss.str().c_str());
+    }
+}
+
 TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x06 */ INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x16 */ 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");

From 96f433309c694ea6c9918dc11d16217d8a1ec1f3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 27 Jan 2024 16:42:27 +0000
Subject: [PATCH 037/373] Bump ebpf-samples from `9057f7d` to `ce6d479`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `9057f7d` to `ce6d479`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/9057f7de29fb9bd8eaf6144f7bbf0b2d6e545e0e...ce6d4793d8b851683a86c6af675a02e39f91f0db)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 9057f7de2..ce6d4793d 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 9057f7de29fb9bd8eaf6144f7bbf0b2d6e545e0e
+Subproject commit ce6d4793d8b851683a86c6af675a02e39f91f0db

From 55478db33c7cbaef64bf1c69802b64f54b65cd84 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 25 Jan 2024 17:13:36 -0800
Subject: [PATCH 038/373] Add unmarshaling tests for 64-bit immediate
 instructions

Blocked on answer to
https://github.com/ietf-wg-bpf/ebpf-docs/issues/75

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp     | 10 +++---
 src/test/test_marshal.cpp | 64 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 69 insertions(+), 5 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 4a6af8308..c5041b434 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -310,19 +310,21 @@ struct Unmarshaller {
     auto makeLddw(ebpf_inst inst, int32_t next_imm, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
         if (pc >= insts.size() - 1)
             throw InvalidInstruction(pc, "incomplete LDDW");
+        ebpf_inst next = insts[pc + 1];
+        if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0)
+            throw InvalidInstruction(pc, "invalid LDDW");
         if (inst.src > 1 || inst.dst > R10_STACK_POINTER || inst.offset != 0)
             throw InvalidInstruction(pc, "LDDW uses reserved fields");
 
         if (inst.src == 1) {
             // magic number, meaning we're a per-process file descriptor defining the map.
             // (for details, look for BPF_PSEUDO_MAP_FD in the kernel)
-
+            if (next.imm != 0) {
+                throw InvalidInstruction(pc, "LDDW uses reserved fields");
+            }
             return LoadMapFd{.dst = Reg{inst.dst}, .mapfd = inst.imm};
         }
 
-        ebpf_inst next = insts[pc + 1];
-        if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0)
-            throw InvalidInstruction(pc, "invalid LDDW");
         return Bin{
             .op = Bin::Op::MOV,
             .dst = Reg{inst.dst},
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index ffe0c8d02..45291304c 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -23,6 +23,26 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& exp
     REQUIRE(memcmp(&expected_result, &result, sizeof(result)) == 0);
 }
 
+// Verify that if we unmarshal a 64-bit immediate instruction and then re-marshal it,
+// we get what we expect.
+static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& ins2, const ebpf_inst& expected_result1,
+                                      const ebpf_inst& expected_result2) {
+    program_info info{.platform = &g_ebpf_platform_linux,
+                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins1, ins2, exit, exit}, info}));
+    REQUIRE(parsed.size() == 3);
+    auto [_, single, _2] = parsed.front();
+    (void)_;  // unused
+    (void)_2; // unused
+    std::vector<ebpf_inst> marshaled = marshal(single, 0);
+    REQUIRE(marshaled.size() == 2);
+    ebpf_inst result1 = marshaled.front();
+    REQUIRE(memcmp(&expected_result1, &result1, sizeof(result1)) == 0);
+    ebpf_inst result2 = marshaled.back();
+    REQUIRE(memcmp(&expected_result2, &result2, sizeof(result2)) == 0);
+}
+
 // Verify that if we marshal an instruction and then unmarshal it,
 // we get the original.
 static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false) {
@@ -53,6 +73,17 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     REQUIRE(error_message == expected_error_message);
 }
 
+// Check that unmarshaling a 64-bit immediate instruction fails.
+static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message) {
+    program_info info{.platform = &g_ebpf_platform_linux,
+                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+    std::vector<ebpf_inst> insns = {inst1, inst2};
+    auto result = unmarshal(raw_program{"", "", insns, info});
+    REQUIRE(std::holds_alternative<std::string>(result));
+    std::string error_message = std::get<std::string>(result);
+    REQUIRE(error_message == expected_error_message);
+}
+
 static const auto ws = {1, 2, 4, 8};
 
 TEST_CASE("disasm_marshal", "[disasm][marshal]") {
@@ -301,10 +332,41 @@ TEST_CASE("fail unmarshal offset opcodes", "[disasm][marshal]") {
     }
 }
 
+TEST_CASE("unmarshal 64bit immediate", "[disasm][marshal]") {
+    compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2},
+                              ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2});
+    compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{},
+                              ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{});
+
+    for (uint8_t src = 0; src <= 7; src++) {
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, "0: incomplete LDDW\n");
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src},
+                             ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM}, "0: invalid LDDW\n");
+    }
+
+    // No supported src values use the offset field.
+    for (uint8_t src = 0; src <= 1; src++) {
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src, .offset = 1}, ebpf_inst{},
+                             "0: LDDW uses reserved fields\n");
+    }
+
+    // Verify that unsupported src values fail.
+    // TODO: support src = 2 through 6.
+    for (uint8_t src = 2; src <= 7; src++) {
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, ebpf_inst{},
+                             "0: LDDW uses reserved fields\n");
+    }
+
+    // When src = {1, 3, 4, 5}, next_imm must be 0.
+    for (uint8_t src : {1, 3, 4, 5}) {
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, ebpf_inst{.imm = 1},
+                             "0: LDDW uses reserved fields\n");
+    }
+}
+
 TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x06 */ INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x16 */ 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM}, "0: incomplete LDDW\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x21 */ (INST_ABS << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
                          "0: ABS but not LD\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x41 */ (INST_IND << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},

From 342996d27ab05d11eefdfc64f211eaaa1a6ccadc Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 21 Jan 2024 08:38:27 -0800
Subject: [PATCH 039/373] Remove MOVSX immediate support

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp     |  2 ++
 src/test/test_marshal.cpp | 12 ++++++--
 test-data/movsx.yaml      | 65 ---------------------------------------
 3 files changed, 11 insertions(+), 68 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index c5041b434..4c5eceb95 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -110,6 +110,8 @@ struct Unmarshaller {
             default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         case INST_ALU_OP_MOV:
+            if (inst.offset > 0 && !(inst.opcode & INST_SRC_REG))
+                throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             switch (inst.offset) {
             case 0: return Bin::Op::MOV;
             case 8: return Bin::Op::MOVSX8;
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 45291304c..1c5f66184 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -88,16 +88,20 @@ static const auto ws = {1, 2, 4, 8};
 
 TEST_CASE("disasm_marshal", "[disasm][marshal]") {
     SECTION("Bin") {
-        auto ops = {Bin::Op::MOV, Bin::Op::ADD, Bin::Op::SUB, Bin::Op::MUL, Bin::Op::UDIV,  Bin::Op::UMOD,
-                    Bin::Op::OR,  Bin::Op::AND, Bin::Op::LSH, Bin::Op::RSH, Bin::Op::ARSH, Bin::Op::XOR,
-                    Bin::Op::SDIV, Bin::Op::SMOD, Bin::Op::MOVSX8, Bin::Op::MOVSX16, Bin::Op::MOVSX32};
         SECTION("Reg src") {
+            auto ops = {Bin::Op::MOV,  Bin::Op::ADD,  Bin::Op::SUB,    Bin::Op::MUL,     Bin::Op::UDIV,   Bin::Op::UMOD,
+                        Bin::Op::OR,   Bin::Op::AND,  Bin::Op::LSH,    Bin::Op::RSH,     Bin::Op::ARSH,   Bin::Op::XOR,
+                        Bin::Op::SDIV, Bin::Op::SMOD, Bin::Op::MOVSX8, Bin::Op::MOVSX16, Bin::Op::MOVSX32};
             for (auto op : ops) {
                 compare_marshal_unmarshal(Bin{.op = op, .dst = Reg{1}, .v = Reg{2}, .is64 = true});
                 compare_marshal_unmarshal(Bin{.op = op, .dst = Reg{1}, .v = Reg{2}, .is64 = false});
             }
         }
         SECTION("Imm src") {
+            // MOVSX* instructions are not defined for Imm, only Reg.
+            auto ops = {Bin::Op::MOV,  Bin::Op::ADD, Bin::Op::SUB,  Bin::Op::MUL, Bin::Op::UDIV,
+                        Bin::Op::UMOD, Bin::Op::OR,  Bin::Op::AND,  Bin::Op::LSH, Bin::Op::RSH,
+                        Bin::Op::ARSH, Bin::Op::XOR, Bin::Op::SDIV, Bin::Op::SMOD};
             for (auto op : ops) {
                 compare_marshal_unmarshal(Bin{.op = op, .dst = Reg{1}, .v = Imm{2}, .is64 = false});
                 compare_marshal_unmarshal(Bin{.op = op, .dst = Reg{1}, .v = Imm{2}, .is64 = true});
@@ -377,6 +381,8 @@ TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
                          "0: Bad register\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0xb4 */ (INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU), .dst = 11, .imm = 8},
                          "0: Bad register\n");
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xb4 */ INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU, .offset = 8},
+                         "0: invalid offset for op 0xb4\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0xbc */ (INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU), .dst = 1, .src = 11},
                          "0: Bad register\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd4 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .dst = 1, .imm = 8},
diff --git a/test-data/movsx.yaml b/test-data/movsx.yaml
index 7aa3d0f54..ef1fe399c 100644
--- a/test-data/movsx.yaml
+++ b/test-data/movsx.yaml
@@ -1,71 +1,6 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
 ---
-test-case: movsx8 immediate to 32 bits
-
-pre: []
-
-code:
-  <start>: |
-    w1 s8= 384 ; 0x180 -> 0xFFFFFF80
-
-post:
-  - r1.type=number
-  - r1.svalue=4294967168
-  - r1.uvalue=4294967168
----
-test-case: movsx16 immediate to 32 bits
-
-pre: []
-
-code:
-  <start>: |
-    w1 s16= 98304 ; 0x18000 -> 0xFFFF8000
-
-post:
-  - r1.type=number
-  - r1.svalue=4294934528
-  - r1.uvalue=4294934528
----
-test-case: movsx8 immediate to 64 bits
-
-pre: []
-
-code:
-  <start>: |
-    r1 s8= 384 ; 0x180 -> 0xFFFFFFFFFFFFFF80
-
-post:
-  - r1.type=number
-  - r1.svalue=-128
-  - r1.uvalue=18446744073709551488
----
-test-case: movsx16 immediate to 64 bits
-
-pre: []
-
-code:
-  <start>: |
-    r1 s16= 98304 ; 0x18000 -> 0xFFFFFFFFFFFF8000
-
-post:
-  - r1.type=number
-  - r1.svalue=-32768
-  - r1.uvalue=18446744073709518848
----
-test-case: movsx32 immediate to 64 bits
-
-pre: []
-
-code:
-  <start>: |
-    r1 s32= 2147483648 ; 0x80000000 -> 0xFFFFFFFF80000000
-
-post:
-  - r1.type=number
-  - r1.svalue=-2147483648
-  - r1.uvalue=18446744071562067968
----
 test-case: movsx8 register to 32 bits
 
 pre: ["r1.svalue=384", "r1.uvalue=384", "r1.type=number", "r1.svalue=r1.uvalue"]

From b62f8f10d543560b9e4a0952a9acc91e48584621 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 11 Feb 2024 12:52:58 -0800
Subject: [PATCH 040/373] Only set type to pointer if the width is correct
 (#581)

* Only set type to packet if the width is correct
* Fix and test move operations
* Correct variable name to be offset_width

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_parse.cpp        |   2 +-
 src/crab/ebpf_domain.cpp |  81 +++++++++++-----
 src/crab/split_dbm.cpp   |   2 +-
 test-data/assign.yaml    | 193 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 255 insertions(+), 23 deletions(-)

diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index a60fe6395..56069ee0c 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -52,7 +52,7 @@ using crab::linear_expression_t;
 #define ARRAY_RANGE R"_(\s*\[([-+]?\d+)\.\.\.\s*([-+]?\d+)\]?\s*)_"
 
 #define DOT "[.]"
-#define TYPE R"_(\s*(shared|number|packet|stack|ctx|map_fd|map_fd_program)\s*)_"
+#define TYPE R"_(\s*(shared|number|packet|stack|ctx|map_fd|map_fd_programs)\s*)_"
 
 static const std::map<std::string, Bin::Op> str_to_binop = {
     {"", Bin::Op::MOV},   {"+", Bin::Op::ADD},  {"-", Bin::Op::SUB},    {"*", Bin::Op::MUL},
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index dc90c2df6..5741e7051 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -64,6 +64,13 @@ static linear_constraint_t neq(variable_t a, variable_t b) {
 }
 
 constexpr int MAX_PACKET_SIZE = 0xffff;
+
+// Pointers in the BPF VM are defined to be 64 bits.  Some contexts, like
+// data, data_end, and meta in Linux's struct xdp_md are only 32 bit offsets
+// from a base address not exposed to the program, but when a program is loaded,
+// the offsets get replaced with 64-bit address pointers.  However, we currently
+// need to do pointer arithmetic on 64-bit numbers so for now we cap the interval
+// to 32 bits.
 constexpr int64_t PTR_MAX = std::numeric_limits<int32_t>::max() - MAX_PACKET_SIZE;
 
 /** Linear constraint for a pointer comparison.
@@ -1906,12 +1913,20 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
 
     number_t addr = *maybe_addr;
 
+    // We use offsets for packet data, data_end, and meta during verification,
+    // but at runtime they will be 64-bit pointers.  We can use the offset values
+    // for verification like we use map_fd's as a proxy for maps which
+    // at runtime are actually 64-bit memory pointers.
+    int offset_width = desc->end - desc->data;
     if (addr == desc->data) {
-        inv.assign(target.packet_offset, 0);
+        if (width == offset_width)
+            inv.assign(target.packet_offset, 0);
     } else if (addr == desc->end) {
-        inv.assign(target.packet_offset, variable_t::packet_size());
+        if (width == offset_width)
+            inv.assign(target.packet_offset, variable_t::packet_size());
     } else if (addr == desc->meta) {
-        inv.assign(target.packet_offset, variable_t::meta_offset());
+        if (width == offset_width)
+            inv.assign(target.packet_offset, variable_t::meta_offset());
     } else {
         if (may_touch_ptr)
             type_inv.havoc_type(inv, target_reg);
@@ -1919,9 +1934,11 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
             type_inv.assign_type(inv, target_reg, T_NUM);
         return;
     }
-    type_inv.assign_type(inv, target_reg, T_PACKET);
-    inv += 4098 <= target.svalue;
-    inv += target.svalue <= PTR_MAX;
+    if (width == offset_width) {
+        type_inv.assign_type(inv, target_reg, T_PACKET);
+        inv += 4098 <= target.svalue;
+        inv += target.svalue <= PTR_MAX;
+    }
 }
 
 void ebpf_domain_t::do_load_packet_or_shared(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr,
@@ -2733,30 +2750,52 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             assign(dst.uvalue, src.uvalue);
             havoc_offsets(bin.dst);
             m_inv = type_inv.join_over_types(m_inv, src_reg, [&](NumAbsDomain& inv, type_encoding_t type) {
-                inv.assign(dst.type, type);
-
                 switch (type) {
-                case T_CTX: inv.assign(dst.ctx_offset, src.ctx_offset); break;
+                case T_CTX:
+                    if (bin.is64) {
+                        inv.assign(dst.type, type);
+                        inv.assign(dst.ctx_offset, src.ctx_offset);
+                    }
+                    break;
                 case T_MAP:
-                case T_MAP_PROGRAMS: inv.assign(dst.map_fd, src.map_fd); break;
-                case T_PACKET: inv.assign(dst.packet_offset, src.packet_offset); break;
+                case T_MAP_PROGRAMS:
+                    if (bin.is64) {
+                        inv.assign(dst.type, type);
+                        inv.assign(dst.map_fd, src.map_fd);
+                    }
+                    break;
+                case T_PACKET:
+                    if (bin.is64) {
+                        inv.assign(dst.type, type);
+                        inv.assign(dst.packet_offset, src.packet_offset);
+                    }
+                    break;
                 case T_SHARED:
-                    inv.assign(dst.shared_region_size, src.shared_region_size);
-                    inv.assign(dst.shared_offset, src.shared_offset);
+                    if (bin.is64) {
+                        inv.assign(dst.type, type);
+                        inv.assign(dst.shared_region_size, src.shared_region_size);
+                        inv.assign(dst.shared_offset, src.shared_offset);
+                    }
                     break;
                 case T_STACK:
-                    inv.assign(dst.stack_offset, src.stack_offset);
-                    inv.assign(dst.stack_numeric_size, src.stack_numeric_size);
+                    if (bin.is64) {
+                        inv.assign(dst.type, type);
+                        inv.assign(dst.stack_offset, src.stack_offset);
+                        inv.assign(dst.stack_numeric_size, src.stack_numeric_size);
+                    }
                     break;
-                default: break;
+                default: inv.assign(dst.type, type); break;
                 }
             });
-            if ((bin.dst.v != std::get<Reg>(bin.v).v) || (type_inv.get_type(m_inv, dst.type) == T_UNINIT)) {
-                // Only forget the destination type if we're copying from a different register,
-                // or from the same uninitialized register.
-                havoc(dst.type);
+            if (bin.is64) {
+                // Add dst.type=src.type invariant.
+                if ((bin.dst.v != std::get<Reg>(bin.v).v) || (type_inv.get_type(m_inv, dst.type) == T_UNINIT)) {
+                    // Only forget the destination type if we're copying from a different register,
+                    // or from the same uninitialized register.
+                    havoc(dst.type);
+                }
+                type_inv.assign_type(m_inv, bin.dst, std::get<Reg>(bin.v));
             }
-            type_inv.assign_type(m_inv, bin.dst, std::get<Reg>(bin.v));
             break;
         }
     }
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 8336ba40e..af07d54d5 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1052,7 +1052,7 @@ static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Param
 }
 
 static const std::vector<std::string> type_string = {
-    "shared", "stack", "packet", "ctx", "number", "map_fd", "map_fd_program", "uninitialized"
+    "shared", "stack", "packet", "ctx", "number", "map_fd", "map_fd_programs", "uninitialized"
 };
 
 string_invariant SplitDBM::to_set() const {
diff --git a/test-data/assign.yaml b/test-data/assign.yaml
index 4385c0ceb..22a765b0f 100644
--- a/test-data/assign.yaml
+++ b/test-data/assign.yaml
@@ -172,6 +172,21 @@ post:
   - r1.uvalue=r2.uvalue
   - r1.stack_numeric_size=r2.stack_numeric_size
 ---
+test-case: 32-bit assign register stack value
+
+pre: ["r10.type=stack", "r10.stack_offset=512"]
+
+code:
+  <start>: |
+    w2 = r10
+
+post:
+  - r2.svalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue
+  - r2.uvalue=[0, 4294967295]
+  - r10.type=stack
+  - r10.stack_offset=512
+---
 test-case: assign register shared value
 
 pre: ["r1.type=shared", "r1.shared_offset=0", "r1.shared_region_size=16"]
@@ -190,6 +205,22 @@ post:
   - r1.svalue=r2.svalue
   - r1.uvalue=r2.uvalue
 ---
+test-case: 32-bit assign register shared value
+
+pre: ["r1.type=shared", "r1.shared_offset=0", "r1.shared_region_size=16"]
+
+code:
+  <start>: |
+    w2 = r1
+
+post:
+  - r1.type=shared
+  - r1.shared_offset=0
+  - r1.shared_region_size=16
+  - r2.svalue=[0, 4294967295]
+  - r2.uvalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue
+---
 test-case: assign register combination value
 
 pre: ["r1.type=[-1,0]", "r1.shared_offset=0", "r1.shared_region_size=16", "r1.stack_offset=500", "r1.stack_numeric_size=16"]
@@ -229,3 +260,165 @@ post:
   - r1.uvalue=[1, 2147418112]
   - r2.type=packet
   - r2.svalue=[4098, 2147418112]
+---
+test-case: 16-bit indirect assignment from context
+
+pre: ["r1.ctx_offset=0", "r1.type=ctx", "r1.svalue=[1, 2147418112]", "r1.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    r2 = *(u16 *)(r1 + 4)
+
+post:
+  - r1.ctx_offset=0
+  - r1.type=ctx
+  - r1.svalue=[1, 2147418112]
+  - r1.uvalue=[1, 2147418112]
+---
+test-case: 64-bit indirect assignment from context
+
+pre: ["r1.ctx_offset=0", "r1.type=ctx", "r1.svalue=[1, 2147418112]", "r1.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    r2 = *(u64 *)(r1 + 4)
+
+post:
+  - r1.ctx_offset=0
+  - r1.type=ctx
+  - r1.svalue=[1, 2147418112]
+  - r1.uvalue=[1, 2147418112]
+---
+test-case: assign register packet value
+
+pre: ["packet_size=r2.packet_offset", "r2.type=packet", "r2.svalue=[4098, 2147418112]"]
+
+code:
+  <start>: |
+    r1 = r2
+
+post:
+  - packet_size=r1.packet_offset
+  - r1.type=packet
+  - r1.svalue=[4098, 2147418112]
+  - packet_size=r2.packet_offset
+  - r2.type=packet
+  - r2.svalue=[4098, 2147418112]
+  - r1.packet_offset=r2.packet_offset
+  - r1.svalue=r2.svalue
+  - r1.uvalue=r2.uvalue
+---
+test-case: 32-bit assign register packet value
+
+pre: ["packet_size=r2.packet_offset", "r2.type=packet", "r2.svalue=[4098, 2147418112]"]
+
+code:
+  <start>: |
+    w1 = r2
+
+post:
+  - r1.svalue=[0, 4294967295]
+  - r1.uvalue=[0, 4294967295]
+  - r1.svalue=r1.uvalue
+  - packet_size=r2.packet_offset
+  - r2.type=packet
+  - r2.svalue=[4098, 2147418112]
+---
+test-case: assign register context value
+
+pre: ["r1.ctx_offset=0", "r1.type=ctx", "r1.svalue=[1, 2147418112]", "r1.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post:
+  - r1.ctx_offset=0
+  - r1.type=ctx
+  - r1.svalue=[1, 2147418112]
+  - r1.uvalue=[1, 2147418112]
+  - r2.ctx_offset=0
+  - r2.type=ctx
+  - r2.svalue=[1, 2147418112]
+  - r2.uvalue=[1, 2147418112]
+  - r1.svalue=r2.svalue
+  - r1.uvalue=r2.uvalue
+---
+test-case: 32-bit assign register context value
+
+pre: ["r1.ctx_offset=0", "r1.type=ctx", "r1.svalue=[1, 2147418112]", "r1.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    w2 = r1
+
+post:
+  - r1.ctx_offset=0
+  - r1.type=ctx
+  - r1.svalue=[1, 2147418112]
+  - r1.uvalue=[1, 2147418112]
+  - r2.svalue=[1, 2147418112]
+  - r2.uvalue=[1, 2147418112]
+  - r2.svalue=r2.uvalue
+---
+test-case: assign register map value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post:
+  - r1.map_fd=1
+  - r1.type=map_fd
+  - r2.map_fd=1
+  - r2.type=map_fd
+  - r1.svalue=r2.svalue
+  - r1.uvalue=r2.uvalue
+---
+test-case: 32-bit assign register map value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1"]
+
+code:
+  <start>: |
+    w2 = r1
+
+post:
+  - r1.map_fd=1
+  - r1.type=map_fd
+  - r2.svalue=[0, 4294967295]
+  - r2.uvalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue
+---
+test-case: assign register map programs value
+
+pre: ["r1.type=map_fd_programs", "r1.map_fd=1"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post:
+  - r1.map_fd=1
+  - r1.type=map_fd_programs
+  - r2.map_fd=1
+  - r2.type=map_fd_programs
+  - r1.svalue=r2.svalue
+  - r1.uvalue=r2.uvalue
+---
+test-case: 32-bit assign register map programs value
+
+pre: ["r1.type=map_fd_programs", "r1.map_fd=1"]
+
+code:
+  <start>: |
+    w2 = r1
+
+post:
+  - r1.map_fd=1
+  - r1.type=map_fd_programs
+  - r2.svalue=[0, 4294967295]
+  - r2.uvalue=[0, 4294967295]
+  - r2.svalue=r2.uvalue

From f2f284f4ab536959d9d95cfc90764e7a63949f70 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Mon, 12 Feb 2024 10:57:50 -0800
Subject: [PATCH 041/373] adjust_head statistic is not cross-platform safe

Replace with a stat counting calls that reallocate packet,
in a cross-platform way similar to the map_in_map stat.

Fixes #583

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_cfg.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 3787507fc..508f603ba 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -203,7 +203,7 @@ std::vector<std::string> stats_headers() {
     return {
         "basic_blocks", "joins",       "other",      "jumps",         "assign",  "arith",
         "load",         "store",       "load_store", "packet_access", "call_1",  "call_mem",
-        "call_nomem",   "adjust_head", "map_in_map", "arith64",       "arith32",
+        "call_nomem",   "reallocate",  "map_in_map", "arith64",       "arith32",
     };
 }
 
@@ -224,8 +224,8 @@ std::map<std::string, int> collect_stats(const cfg_t& cfg) {
             }
             if (std::holds_alternative<Call>(ins)) {
                 auto call = std::get<Call>(ins);
-                if (call.func == 43 || call.func == 44)
-                    res["adjust_head"] = 1;
+                if (call.reallocate_packet)
+                    res["reallocate"] = 1;
             }
             if (std::holds_alternative<Bin>(ins)) {
                 auto const& bin = std::get<Bin>(ins);

From 5ea9ec7aa703b04738cc3d480dbac27418722be2 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Fri, 22 Sep 2023 15:03:12 +0300
Subject: [PATCH 042/373] zero-extension and sign-extension

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp     | 37 +++++++++++++++++---
 src/crab/ebpf_domain.cpp  | 38 +++++++++++++--------
 src/crab/interval.hpp     | 13 ++++---
 src/test/test_marshal.cpp | 33 +++++++++++++++++-
 src/test/test_yaml.cpp    |  1 +
 test-data/movsx.yaml      |  3 ++
 test-data/sext.yaml       | 72 +++++++++++++++++++++++++++++++++++++++
 7 files changed, 172 insertions(+), 25 deletions(-)
 create mode 100644 test-data/sext.yaml

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 4c5eceb95..4e12356c3 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -87,6 +87,10 @@ static auto getMemWidth(uint8_t opcode) -> int {
 //     return {};
 // }
 
+static Instruction shift32(Reg dst, Bin::Op op) {
+    return (Instruction)Bin{.op=op,.dst = dst, .v = Imm{32}, .is64=true, .lddw=false};
+}
+
 struct Unmarshaller {
     vector<vector<string>>& notes;
     const program_info& info;
@@ -478,14 +482,14 @@ struct Unmarshaller {
         for (size_t pc = 0; pc < insts.size();) {
             ebpf_inst inst = insts[pc];
             Instruction new_ins;
-            bool lddw = false;
+            bool skip_instruction = false;
             bool fallthrough = true;
             switch (inst.opcode & INST_CLS_MASK) {
             case INST_CLS_LD:
                 if (inst.opcode == INST_OP_LDDW_IMM) {
                     int32_t next_imm = pc < insts.size() - 1 ? insts[pc + 1].imm : 0;
                     new_ins = makeLddw(inst, next_imm, insts, static_cast<pc_t>(pc));
-                    lddw = true;
+                    skip_instruction = true;
                     break;
                 }
                 // fallthrough
@@ -494,7 +498,32 @@ struct Unmarshaller {
             case INST_CLS_STX: new_ins = makeMemOp(pc, inst); break;
 
             case INST_CLS_ALU:
-            case INST_CLS_ALU64: new_ins = makeAluOp(pc, inst); break;
+            case INST_CLS_ALU64: {
+                new_ins = makeAluOp(pc, inst);
+
+                // Merge (rX <<= 32; rX >>>= 32) into wX = rX
+                //       (rX <<= 32; rX >>= 32)  into rX s32= rX
+                if (pc >= insts.size() - 1)
+                    break;
+                ebpf_inst next = insts[pc + 1];
+                auto dst = Reg{inst.dst};
+
+                if (new_ins != shift32(dst, Bin::Op::LSH))
+                    break;
+
+                if ((next.opcode & INST_CLS_MASK) != INST_CLS_ALU64)
+                    break;
+                auto next_ins = makeAluOp(pc+1, next);
+                if (next_ins == shift32(dst, Bin::Op::RSH)) {
+                    new_ins = Bin{.op = Bin::Op::MOV, .dst = dst, .v = dst, .is64 = false};
+                    skip_instruction = true;
+                } else if (next_ins == shift32(dst, Bin::Op::ARSH)) {
+                    new_ins = Bin{.op = Bin::Op::MOVSX32, .dst = dst, .v = dst, .is64 = true};
+                    skip_instruction = true;
+                }
+
+                break;
+            }
 
             case INST_CLS_JMP32:
             case INST_CLS_JMP: {
@@ -522,7 +551,7 @@ struct Unmarshaller {
 
             pc++;
             note_next_pc();
-            if (lddw) {
+            if (skip_instruction) {
                 pc++;
                 note_next_pc();
             }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 5741e7051..67e74fd2b 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2376,18 +2376,20 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
     havoc_offsets(dst_reg);
 }
 
-void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width,
-                                Bin::Op op) {
-    using namespace crab;
-
-    int bits;
+static inline int _movsx_bits(Bin::Op op) {
     switch (op) {
-    case Bin::Op::MOVSX8: bits = 8; break;
-    case Bin::Op::MOVSX16: bits = 16; break;
-    case Bin::Op::MOVSX32: bits = 32; break;
+    case Bin::Op::MOVSX8: return 8;
+    case Bin::Op::MOVSX16: return 16;
+    case Bin::Op::MOVSX32: return 32;
     default: throw std::exception();
     }
+}
 
+void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width,
+                                Bin::Op op) {
+    using namespace crab;
+
+    int bits = _movsx_bits(op);
     reg_pack_t dst = reg_pack(dst_reg);
     interval_t right_interval = m_inv.eval_interval(right_svalue);
     type_inv.assign_type(m_inv, dst_reg, T_NUM);
@@ -2395,8 +2397,11 @@ void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& r
     int64_t span = 1ULL << bits;
     if (right_interval.ub() - right_interval.lb() >= number_t{span}) {
         // Interval covers the full space.
-        havoc(dst.svalue);
-        return;
+        if (bits == 64) {
+            havoc(dst.svalue);
+            return;
+        }
+        right_interval = interval_t::signed_int(bits);
     }
     int64_t mask = 1ULL << (bits - 1);
 
@@ -2487,11 +2492,6 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             type_inv.assign_type(m_inv, bin.dst, T_NUM);
             havoc_offsets(bin.dst);
             break;
-        case Bin::Op::MOVSX8:
-        case Bin::Op::MOVSX16:
-        case Bin::Op::MOVSX32:
-            sign_extend(bin.dst, number_t{(int32_t)imm}, finite_width, bin.op);
-            break;
         case Bin::Op::ADD:
             if (imm == 0)
                 return;
@@ -2737,6 +2737,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::MOVSX8:
         case Bin::Op::MOVSX16:
         case Bin::Op::MOVSX32:
+            // Keep relational information if operation is a no-op.
+            if ((dst.svalue == src.svalue) && (m_inv.eval_interval(dst.svalue) <= interval_t::signed_int(_movsx_bits(bin.op)))) {
+                return;
+            }
             if (m_inv.entail(type_is_number(src_reg))) {
                 sign_extend(bin.dst, src.svalue, finite_width, bin.op);
                 break;
@@ -2746,6 +2750,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             havoc_offsets(bin.dst);
             break;
         case Bin::Op::MOV:
+            // Keep relational information if operation is a no-op.
+            if ((dst.svalue == src.svalue) && (m_inv.eval_interval(dst.uvalue) <= interval_t::unsigned_int(bin.is64))) {
+                return;
+            }
             assign(dst.svalue, src.svalue);
             assign(dst.uvalue, src.uvalue);
             havoc_offsets(bin.dst);
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index bf28cd2f5..47878de00 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -497,13 +497,16 @@ class interval_t final {
     }
     // Return an interval in the range [INT_MIN, INT_MAX] which can only
     // be represented as an svalue.
-    static interval_t signed_int(bool is64) {
-        if (is64) {
-            return {number_t{std::numeric_limits<int64_t>::min()}, number_t{std::numeric_limits<int64_t>::max()}};
-        } else {
-            return {number_t{std::numeric_limits<int32_t>::min()}, number_t{std::numeric_limits<int32_t>::max()}};
+    static interval_t signed_int(int bits) {
+        switch (bits) {
+        case 64: return {number_t{std::numeric_limits<int64_t>::min()}, number_t{std::numeric_limits<int64_t>::max()}};
+        case 32: return {number_t{std::numeric_limits<int32_t>::min()}, number_t{std::numeric_limits<int32_t>::max()}};
+        case 16: return {number_t{std::numeric_limits<int16_t>::min()}, number_t{std::numeric_limits<int16_t>::max()}};
+        case 8: return {number_t{std::numeric_limits<int8_t>::min()}, number_t{std::numeric_limits<int8_t>::max()}};
+        default: throw std::exception();
         }
     }
+    static interval_t signed_int(bool is64) { return signed_int(is64 ? 64 : 32); }
     // Return an interval in the range [0, UINT_MAX] which can only be
     // represented as a uvalue.
     static interval_t unsigned_int(bool is64) {
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 1c5f66184..05eef0bb2 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -23,6 +23,23 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& exp
     REQUIRE(memcmp(&expected_result, &result, sizeof(result)) == 0);
 }
 
+// Verify that if we unmarshal two instructions and then re-marshal it,
+// we get what we expect.
+static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& ins2, const ebpf_inst& expected_result) {
+    program_info info{.platform = &g_ebpf_platform_linux,
+                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins1, ins2, exit, exit}, info}));
+    REQUIRE(parsed.size() == 3);
+    auto [_, single, _2] = parsed.front();
+    (void)_;  // unused
+    (void)_2; // unused
+    std::vector<ebpf_inst> marshaled = marshal(single, 0);
+    REQUIRE(marshaled.size() == 1);
+    ebpf_inst result = marshaled.back();
+    REQUIRE(memcmp(&expected_result, &result, sizeof(result)) == 0);
+}
+
 // Verify that if we unmarshal a 64-bit immediate instruction and then re-marshal it,
 // we get what we expect.
 static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& ins2, const ebpf_inst& expected_result1,
@@ -131,7 +148,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
             Un::Op::SWAP64
         };
         for (auto op : ops)
-            compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}});
+            compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = true});
     }
 
     SECTION("LoadMapFd") { compare_marshal_unmarshal(LoadMapFd{.dst = Reg{1}, .mapfd = 1}, true); }
@@ -272,6 +289,20 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
     }
 }
 
+TEST_CASE("unmarshal extension opcodes", "[disasm][marshal]") {
+    // Merge (rX <<= 32; rX >>>= 32) into wX = rX.
+    compare_unmarshal_marshal(
+        ebpf_inst{.opcode = INST_ALU_OP_LSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+        ebpf_inst{.opcode = INST_ALU_OP_RSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+        ebpf_inst{.opcode = INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU, .dst = 1, .src = 1});
+
+    // Merge (rX <<= 32; rX >>= 32)  into rX s32= rX.
+    compare_unmarshal_marshal(
+        ebpf_inst{.opcode = INST_ALU_OP_LSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+        ebpf_inst{.opcode = INST_ALU_OP_ARSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+        ebpf_inst{.opcode = INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU64, .dst = 1, .src = 1, .offset = 32});
+}
+
 TEST_CASE("fail unmarshal invalid opcodes", "[disasm][marshal]") {
     // The following opcodes are undefined and should generate bad instruction errors.
     uint8_t bad_opcodes[] = {
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 2456bfe3f..8e95638ad 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -31,6 +31,7 @@ YAML_CASE("test-data/loop.yaml")
 YAML_CASE("test-data/movsx.yaml")
 YAML_CASE("test-data/packet.yaml")
 YAML_CASE("test-data/parse.yaml")
+YAML_CASE("test-data/sext.yaml")
 YAML_CASE("test-data/shift.yaml")
 YAML_CASE("test-data/stack.yaml")
 YAML_CASE("test-data/subtract.yaml")
diff --git a/test-data/movsx.yaml b/test-data/movsx.yaml
index ef1fe399c..2645dddd8 100644
--- a/test-data/movsx.yaml
+++ b/test-data/movsx.yaml
@@ -201,6 +201,7 @@ post:
   - r1.uvalue=[255, 511]
   - r1.svalue=r1.uvalue
   - r2.type=number
+  - r2.svalue=[-128, 127]
 ---
 test-case: movsx16 register range to 64 bits
 
@@ -232,6 +233,7 @@ post:
   - r1.uvalue=[65535, 131071]
   - r1.svalue=r1.uvalue
   - r2.type=number
+  - r2.svalue=[-32768, 32767]
 ---
 test-case: movsx32 register range to 64 bits
 
@@ -263,3 +265,4 @@ post:
   - r1.uvalue=[4294967295, 8589934591]
   - r1.svalue=r1.uvalue
   - r2.type=number
+  - r2.svalue=[-2147483648, 2147483647]
diff --git a/test-data/sext.yaml b/test-data/sext.yaml
new file mode 100644
index 000000000..0846b4f0e
--- /dev/null
+++ b/test-data/sext.yaml
@@ -0,0 +1,72 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+
+# Tests for signed/unsigned extension
+---
+test-case: small zext relational nop
+
+pre: ["r1.type=number", "r1.uvalue=[0, 5]",
+      "r2.type=number", "r2.uvalue=[0, 5]",
+      "r1.uvalue=r2.uvalue"]
+
+code:
+  <start>: |
+    w1 = r1 ; nop
+
+post:
+  - r1.type=number
+  - r1.uvalue=[0, 5]
+  - r2.type=number
+  - r2.uvalue=[0, 5]
+  - r1.uvalue=r2.uvalue
+---
+test-case: small sext relational nop
+
+pre: ["r1.type=number", "r1.svalue=[-5, 5]",
+      "r2.type=number", "r2.svalue=[-5, 5]",
+      "r1.svalue=r2.svalue"]
+
+code:
+  <start>: |
+    r1 s32= r1 ; nop
+
+post:
+  - r1.type=number
+  - r1.svalue=[-5, 5]
+  - r2.type=number
+  - r2.svalue=[-5, 5]
+  - r1.svalue=r2.svalue
+---
+test-case: large zext relational is two shifts
+
+pre: ["r1.type=number", "r1.uvalue=[0, 4294967299]",
+      "r2.type=number", "r2.uvalue=[0, 4294967299]",
+      "r1.uvalue=r2.uvalue"]
+
+code:
+  <start>: |
+    w1 = r1 ; not a nop
+
+post:
+  - r1.type=number
+  - r1.svalue=[0, 4294967295]
+  - r1.svalue=r1.uvalue
+  - r1.uvalue=[0, 4294967295]
+  - r2.type=number
+  - r2.uvalue=[0, 4294967299]
+---
+test-case: large sext relational is two shifts
+
+pre: ["r1.type=number", "r1.svalue=[-5, 4294967299]",
+      "r2.type=number", "r2.svalue=[-5, 4294967299]",
+      "r1.svalue=r2.svalue"]
+
+code:
+  <start>: |
+    r1 s32= r1 ; not a nop
+
+post:
+  - r1.type=number
+  - r1.svalue=[-2147483648, 2147483647]
+  - r2.type=number
+  - r2.svalue=[-5, 4294967299]

From 2567b30c92859b9029783921017d4e8409b8d29c Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 15 Feb 2024 15:47:55 +0200
Subject: [PATCH 043/373] bump Catch2 to v3.5.2

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d4c795491..3b0f1a6ac 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -7,7 +7,7 @@ include(FetchContent)
 FetchContent_Declare(
   Catch2
   GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-  GIT_TAG        ac93f1943762f6fc92f0dc5bac0d720a33a27530
+  GIT_TAG        05e10dfccc28c7f973727c54f850237d07d5e10f # v3.5.2
 )
 FetchContent_MakeAvailable(Catch2)
 

From 1056586f13b5f95f0f16b897197f3fd8bd1fe409 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 18 Feb 2024 04:15:27 -0800
Subject: [PATCH 044/373] Deprecate legacy packet access instructions (#577)

The BPF ISA specification does not define them, and just says
"these instructions are deprecated and should no longer be used".
To comply with that, this PR disables support for legacy packet access
instructions by default.

If some other project depends on them, options.legacy can be
set to true.

* Deprecate legacy packet access instructions
* Add YAML tests for packet access instructions

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_syntax.hpp           |   2 +-
 src/asm_unmarshal.cpp        |  12 ++---
 src/asm_unmarshal.hpp        |   2 +-
 src/ebpf_vm_isa.hpp          |   4 +-
 src/ebpf_yaml.cpp            |   3 +-
 src/linux/linux_platform.cpp |   3 +-
 src/main/check.cpp           |   9 ++--
 src/platform.hpp             |   3 ++
 src/test/test_marshal.cpp    |  68 ++++++++++++++++-------
 src/test/test_verify.cpp     |  68 +++++++++++++----------
 test-data/packet.yaml        | 102 +++++++++++++++++++++++++++++++++++
 11 files changed, 213 insertions(+), 63 deletions(-)

diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index c8e621161..eff038ba0 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -202,7 +202,7 @@ struct Mem {
     bool is_load{};
 };
 
-/// A special instruction for checked access to packets; it is actually a
+/// A deprecated instruction for checked access to packets; it is actually a
 /// function call, and analyzed as one, e.g., by scratching caller-saved
 /// registers after it is performed.
 struct Packet {
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 4e12356c3..8c2cffded 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -226,17 +226,13 @@ struct Unmarshaller {
         switch ((inst.opcode & INST_MODE_MASK) >> 5) {
         case 0: throw InvalidInstruction(pc, inst.opcode);
         case INST_ABS:
-            if (!isLD)
-                throw InvalidInstruction(pc, "ABS but not LD");
-            if (width == 8)
-                note("invalid opcode LDABSDW");
+            if (!info.platform->legacy || !isLD || (width == 8))
+                throw InvalidInstruction(pc, inst.opcode);
             return Packet{.width = width, .offset = inst.imm, .regoffset = {}};
 
         case INST_IND:
-            if (!isLD)
-                throw InvalidInstruction(pc, "IND but not LD");
-            if (width == 8)
-                note("invalid opcode LDINDDW");
+            if (!info.platform->legacy || !isLD || (width == 8))
+                throw InvalidInstruction(pc, inst.opcode);
             return Packet{.width = width, .offset = inst.imm, .regoffset = Reg{inst.src}};
 
         case INST_MEM: {
diff --git a/src/asm_unmarshal.hpp b/src/asm_unmarshal.hpp
index 1089d1eb0..f5d2ce85f 100644
--- a/src/asm_unmarshal.hpp
+++ b/src/asm_unmarshal.hpp
@@ -16,7 +16,7 @@
  *  of Instructions.
  *
  *  \param raw_prog is the input program to parse.
- *  \param notes is where errors and warnings are written to.
+ *  \param[out] notes is a vector for storing errors and warnings.
  *  \return a sequence of instruction if successful, an error string otherwise.
  */
 std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog, std::vector<std::vector<std::string>>& notes);
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index ad308b9af..d734352ff 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -44,8 +44,8 @@ enum {
 
     INST_MODE_MASK = 0xe0,
 
-    INST_ABS = 1,
-    INST_IND = 2,
+    INST_ABS = 1, // Deprecated
+    INST_IND = 2, // Deprecated
     INST_MEM = 3,
     INST_LEN = 4,
     INST_MSH = 5,
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 25b27a006..f728d6c88 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -57,7 +57,8 @@ ebpf_platform_t g_platform_test = {
     .map_record_size = 0,
     .parse_maps_section = ebpf_parse_maps_section,
     .get_map_descriptor = ebpf_get_map_descriptor,
-    .get_map_type = ebpf_get_map_type
+    .get_map_type = ebpf_get_map_type,
+    .legacy = true,
 };
 
 static EbpfProgramType make_program_type(const string& name, ebpf_context_descriptor_t* context_descriptor) {
diff --git a/src/linux/linux_platform.cpp b/src/linux/linux_platform.cpp
index 85fb568af..1ae825cdc 100644
--- a/src/linux/linux_platform.cpp
+++ b/src/linux/linux_platform.cpp
@@ -254,5 +254,6 @@ const ebpf_platform_t g_ebpf_platform_linux = {
     parse_maps_section_linux,
     get_map_descriptor_linux,
     get_map_type_linux,
-    resolve_inner_map_references_linux
+    resolve_inner_map_references_linux,
+    true // Legacy packet access instructions
 };
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 8b91d6d03..bf832fc73 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -66,6 +66,8 @@ int main(int argc, char** argv) {
     app.add_flag("-f", ebpf_verifier_options.print_failures, "Print verifier's failure logs");
     app.add_flag("-s", ebpf_verifier_options.strict, "Apply additional checks that would cause runtime failures");
     app.add_flag("-v", verbose, "Print both invariants and failures");
+    bool legacy = false;
+    app.add_flag("--legacy", legacy, "Allow deprecated packet access instructions");
     bool no_division_by_zero = false;
     app.add_flag("--no-division-by-zero", no_division_by_zero, "Do not allow division by zero");
     app.add_flag("--no-simplify", ebpf_verifier_options.no_simplify, "Do not simplify");
@@ -111,12 +113,13 @@ int main(int argc, char** argv) {
 
     if (domain == "linux")
         ebpf_verifier_options.mock_map_fds = false;
-    const ebpf_platform_t* platform = &g_ebpf_platform_linux;
+    ebpf_platform_t platform = g_ebpf_platform_linux;
+    platform.legacy = legacy;
 
     // Read a set of raw program sections from an ELF file.
     vector<raw_program> raw_progs;
     try {
-        raw_progs = read_elf(filename, desired_section, &ebpf_verifier_options, platform);
+        raw_progs = read_elf(filename, desired_section, &ebpf_verifier_options, &platform);
     } catch (std::runtime_error& e) {
         std::cerr << "error: " << e.what() << std::endl;
         return 1;
@@ -130,7 +133,7 @@ int main(int argc, char** argv) {
         if (!desired_section.empty() && raw_progs.empty()) {
             // We could not find the desired section, so get the full list
             // of possibilities.
-            raw_progs = read_elf(filename, string(), &ebpf_verifier_options, platform);
+            raw_progs = read_elf(filename, string(), &ebpf_verifier_options, &platform);
         }
         for (const raw_program& raw_prog : raw_progs) {
             std::cout << raw_prog.section << " ";
diff --git a/src/platform.hpp b/src/platform.hpp
index 0816479ab..bc50b9601 100644
--- a/src/platform.hpp
+++ b/src/platform.hpp
@@ -42,6 +42,9 @@ struct ebpf_platform_t {
     ebpf_get_map_descriptor_fn get_map_descriptor;
     ebpf_get_map_type_fn get_map_type;
     ebpf_resolve_inner_map_references_fn resolve_inner_map_references;
+
+    // Option indicating support for various deprecated instructions.
+    bool legacy;
 };
 
 extern const ebpf_platform_t g_ebpf_platform_linux;
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 05eef0bb2..d3a25829e 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -8,9 +8,9 @@
 
 // Verify that if we unmarshal an instruction and then re-marshal it,
 // we get what we expect.
-static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
+    program_info info{.platform = platform,
+                      .type = platform->get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
@@ -62,9 +62,9 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 
 // Verify that if we marshal an instruction and then unmarshal it,
 // we get the original.
-static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
+    program_info info{.platform = platform,
+                      .type = platform->get_program_type("unspec", "unspec")};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
     auto [_, single, _2] = parsed.back();
@@ -73,16 +73,16 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
     REQUIRE(single == ins);
 }
 
-static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
+    program_info info{.platform = platform,
+                      .type = platform->get_program_type("unspec", "unspec")};
     std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
-static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
+    program_info info{.platform = platform,
+                      .type = platform->get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
     auto result = unmarshal(raw_program{"", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
@@ -194,8 +194,10 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
 
     SECTION("Packet") {
         for (int w : ws) {
-            compare_marshal_unmarshal(Packet{.width = w, .offset = 7, .regoffset = {}});
-            compare_marshal_unmarshal(Packet{.width = w, .offset = 7, .regoffset = Reg{2}});
+            if (w != 8) {
+                compare_marshal_unmarshal(Packet{.width = w, .offset = 7, .regoffset = {}});
+                compare_marshal_unmarshal(Packet{.width = w, .offset = 7, .regoffset = Reg{2}});
+            }
         }
     }
 
@@ -367,6 +369,39 @@ TEST_CASE("fail unmarshal offset opcodes", "[disasm][marshal]") {
     }
 }
 
+TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
+    // The following opcodes are deprecated and should no longer be used.
+    static uint8_t supported_legacy_opcodes[] = {0x20, 0x28, 0x30, 0x40, 0x48, 0x50};
+    static uint8_t unsupported_legacy_opcodes[] = {0x21, 0x22, 0x23, 0x29, 0x2a, 0x2b, 0x31, 0x32, 0x33,
+                                                   0x38, 0x39, 0x3a, 0x3b, 0x41, 0x42, 0x43, 0x49, 0x4a,
+                                                   0x4b, 0x51, 0x52, 0x53, 0x58, 0x59, 0x5a, 0x5b};
+
+    for (uint8_t opcode : unsupported_legacy_opcodes) {
+        std::ostringstream oss;
+        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str());
+    }
+
+    for (uint8_t opcode : supported_legacy_opcodes) {
+        compare_unmarshal_marshal(ebpf_inst{.opcode = opcode}, ebpf_inst{.opcode = opcode});
+    }
+
+    // Disable legacy support.
+    ebpf_platform_t platform = g_ebpf_platform_linux;
+    platform.legacy = false;
+
+    for (uint8_t opcode : unsupported_legacy_opcodes) {
+        std::ostringstream oss;
+        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str(), &platform);
+    }
+    for (uint8_t opcode : supported_legacy_opcodes) {
+        std::ostringstream oss;
+        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str(), &platform);
+    }
+}
+
 TEST_CASE("unmarshal 64bit immediate", "[disasm][marshal]") {
     compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2},
                               ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2});
@@ -399,13 +434,10 @@ TEST_CASE("unmarshal 64bit immediate", "[disasm][marshal]") {
     }
 }
 
+
 TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x06 */ INST_CLS_JMP32}, "0: jump out of bounds\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x16 */ 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x21 */ (INST_ABS << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: ABS but not LD\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x41 */ (INST_IND << 5) | INST_SIZE_W | INST_CLS_LDX, .imm = 8},
-                         "0: IND but not LD\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 11, .imm = 8},
                          "0: Bad register\n");
     check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 1, .src = 11},
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 023d780cf..bca93d05b 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -20,7 +20,7 @@ FAIL_LOAD_ELF("build", "badrelo.o", ".text")
 FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
 
 #define FAIL_UNMARSHAL(dirname, filename, sectionname) \
-    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename, "[unmarshal]") { \
+    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
         REQUIRE(raw_progs.size() == 1); \
         raw_program raw_prog = raw_progs.back(); \
@@ -32,9 +32,9 @@ FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
 FAIL_UNMARSHAL("build", "wronghelper.o", "xdp")
 FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
 
-#define VERIFY_SECTION(dirname, filename, sectionname, options, pass) \
+#define VERIFY_SECTION(dirname, filename, sectionname, options, platform, pass) \
     do { \
-        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
+        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, platform); \
         REQUIRE(raw_progs.size() == 1); \
         raw_program raw_prog = raw_progs.back(); \
         std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
@@ -49,30 +49,42 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
 
 #define TEST_SECTION(project, filename, section) \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, true); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
     }
 
 #define TEST_SECTION_REJECT(project, filename, section) \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, false); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
     }
 
 #define TEST_SECTION_REJECT_IF_STRICT(project, filename, section) \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
         ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        VERIFY_SECTION(project, filename, section, &options, true); \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
         options.strict = true; \
-        VERIFY_SECTION(project, filename, section, &options, false); \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
     }
 
 #define TEST_SECTION_FAIL(project, filename, section) \
     TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, true); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
     }
 
 #define TEST_SECTION_REJECT_FAIL(project, filename, section) \
     TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, false); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
+    }
+
+#define TEST_SECTION_LEGACY(dirname, filename, sectionname) \
+    TEST_SECTION(dirname, filename, sectionname) \
+    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
+        ebpf_platform_t platform = g_ebpf_platform_linux; \
+        platform.legacy = false; \
+        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &platform); \
+        REQUIRE(raw_progs.size() == 1); \
+        raw_program raw_prog = raw_progs.back(); \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
+        REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
     }
 
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "1/0xdc06")
@@ -82,7 +94,7 @@ TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/4")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/5")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/6")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/10")
+TEST_SECTION_LEGACY("bpf_cilium_test", "bpf_lxc_jit.o", "2/10")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "from-container")
 
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "1/0x1010")
@@ -93,7 +105,7 @@ TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/4")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/5")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/6")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "from-container")
+TEST_SECTION_LEGACY("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "from-container")
 
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "1/0x1010")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/1")
@@ -111,7 +123,7 @@ TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/3")
 TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/4")
 TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/5")
 TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "from-netdev")
+TEST_SECTION_LEGACY("bpf_cilium_test", "bpf_netdev.o", "from-netdev")
 
 TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/1")
 TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/2")
@@ -120,7 +132,7 @@ TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/4")
 TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/5")
 TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/7")
 TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "3/2")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "from-overlay")
+TEST_SECTION_LEGACY("bpf_cilium_test", "bpf_overlay.o", "from-overlay")
 
 TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/1")
 TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/2")
@@ -146,7 +158,7 @@ TEST_SECTION("cilium", "bpf_lxc.o", "2/6")
 TEST_SECTION("cilium", "bpf_lxc.o", "2/7")
 TEST_SECTION("cilium", "bpf_lxc.o", "2/8")
 TEST_SECTION("cilium", "bpf_lxc.o", "2/9")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/10")
+TEST_SECTION_LEGACY("cilium", "bpf_lxc.o", "2/10")
 TEST_SECTION("cilium", "bpf_lxc.o", "2/11")
 TEST_SECTION("cilium", "bpf_lxc.o", "2/12")
 TEST_SECTION("cilium", "bpf_lxc.o", "from-container")
@@ -156,14 +168,14 @@ TEST_SECTION("cilium", "bpf_netdev.o", "2/3")
 TEST_SECTION("cilium", "bpf_netdev.o", "2/4")
 TEST_SECTION("cilium", "bpf_netdev.o", "2/5")
 TEST_SECTION("cilium", "bpf_netdev.o", "2/7")
-TEST_SECTION("cilium", "bpf_netdev.o", "from-netdev")
+TEST_SECTION_LEGACY("cilium", "bpf_netdev.o", "from-netdev")
 
 TEST_SECTION("cilium", "bpf_overlay.o", "2/1")
 TEST_SECTION("cilium", "bpf_overlay.o", "2/3")
 TEST_SECTION("cilium", "bpf_overlay.o", "2/4")
 TEST_SECTION("cilium", "bpf_overlay.o", "2/5")
 TEST_SECTION("cilium", "bpf_overlay.o", "2/7")
-TEST_SECTION("cilium", "bpf_overlay.o", "from-overlay")
+TEST_SECTION_LEGACY("cilium", "bpf_overlay.o", "from-overlay")
 
 TEST_SECTION("cilium", "bpf_xdp.o", "from-netdev")
 
@@ -191,13 +203,13 @@ TEST_SECTION("linux", "offwaketime_kern.o", "tracepoint/sched/sched_switch")
 TEST_SECTION("linux", "sampleip_kern.o", "perf_event")
 TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock1")
 TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock2")
-TEST_SECTION("linux", "sockex1_kern.o", "socket1")
-TEST_SECTION("linux", "sockex2_kern.o", "socket2")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/3")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/4")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/1")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/2")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/0")
+TEST_SECTION_LEGACY("linux", "sockex1_kern.o", "socket1")
+TEST_SECTION_LEGACY("linux", "sockex2_kern.o", "socket2")
+TEST_SECTION_LEGACY("linux", "sockex3_kern.o", "socket/3")
+TEST_SECTION_LEGACY("linux", "sockex3_kern.o", "socket/4")
+TEST_SECTION_LEGACY("linux", "sockex3_kern.o", "socket/1")
+TEST_SECTION_LEGACY("linux", "sockex3_kern.o", "socket/2")
+TEST_SECTION_LEGACY("linux", "sockex3_kern.o", "socket/0")
 TEST_SECTION("linux", "spintest_kern.o", "kprobe/__htab_percpu_map_update_elem")
 TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock")
 TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_bh")
@@ -227,7 +239,7 @@ TEST_SECTION("linux", "tcp_basertt_kern.o", "sockops")
 TEST_SECTION("linux", "tcp_bufs_kern.o", "sockops")
 TEST_SECTION("linux", "tcp_cong_kern.o", "sockops")
 TEST_SECTION("linux", "tcp_iw_kern.o", "sockops")
-TEST_SECTION("linux", "tcbpf1_kern.o", "classifier")
+TEST_SECTION_LEGACY("linux", "tcbpf1_kern.o", "classifier")
 TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_recv")
 TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_xmit")
 TEST_SECTION("linux", "tcbpf1_kern.o", "redirect_recv")
@@ -335,7 +347,7 @@ TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_remove_outer2")
 TEST_SECTION("ovs", "datapath.o", "tail-0")
 TEST_SECTION("ovs", "datapath.o", "tail-1")
 TEST_SECTION("ovs", "datapath.o", "tail-2")
-TEST_SECTION("ovs", "datapath.o", "tail-3")
+TEST_SECTION_LEGACY("ovs", "datapath.o", "tail-3")
 TEST_SECTION("ovs", "datapath.o", "tail-4")
 TEST_SECTION("ovs", "datapath.o", "tail-5")
 TEST_SECTION("ovs", "datapath.o", "tail-7")
@@ -343,7 +355,7 @@ TEST_SECTION("ovs", "datapath.o", "tail-8")
 TEST_SECTION("ovs", "datapath.o", "tail-11")
 TEST_SECTION("ovs", "datapath.o", "tail-12")
 TEST_SECTION("ovs", "datapath.o", "tail-13")
-TEST_SECTION("ovs", "datapath.o", "tail-32")
+TEST_SECTION_LEGACY("ovs", "datapath.o", "tail-32")
 TEST_SECTION("ovs", "datapath.o", "tail-33")
 TEST_SECTION("ovs", "datapath.o", "tail-35")
 TEST_SECTION("ovs", "datapath.o", "af_xdp")
@@ -352,8 +364,8 @@ TEST_SECTION("ovs", "datapath.o", "egress")
 TEST_SECTION("ovs", "datapath.o", "ingress")
 TEST_SECTION("ovs", "datapath.o", "xdp")
 
-TEST_SECTION("suricata", "bypass_filter.o", "filter")
-TEST_SECTION("suricata", "lb.o", "loadbalancer")
+TEST_SECTION_LEGACY("suricata", "bypass_filter.o", "filter")
+TEST_SECTION_LEGACY("suricata", "lb.o", "loadbalancer")
 TEST_SECTION("suricata", "filter.o", "filter")
 TEST_SECTION("suricata", "vlan_filter.o", "filter")
 TEST_SECTION("suricata", "xdp_filter.o", "xdp")
diff --git a/test-data/packet.yaml b/test-data/packet.yaml
index 4de7f6745..57c31c203 100644
--- a/test-data/packet.yaml
+++ b/test-data/packet.yaml
@@ -106,3 +106,105 @@ post: [
     "r3.svalue=r3.uvalue",
     "r2.packet_offset-r3.packet_offset<=65526", "r3.packet_offset-r2.packet_offset<=8"
 ]
+---
+test-case: legacy 1 byte packet access imm
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+
+code:
+  <start>: |
+    r0 = *(u8 *)skb[23]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+---
+test-case: legacy 2 byte packet access imm
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+
+code:
+  <start>: |
+    r0 = *(u16 *)skb[23]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+---
+test-case: legacy 4 byte packet access imm
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+
+code:
+  <start>: |
+    r0 = *(u32 *)skb[23]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0"
+]
+---
+test-case: legacy 1 byte packet access reg
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]
+
+code:
+  <start>: |
+    r0 = *(u8 *)skb[r7]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]
+---
+test-case: legacy 2 byte packet access reg
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]
+
+code:
+  <start>: |
+    r0 = *(u16 *)skb[r7]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]
+---
+test-case: legacy 4 byte packet access reg
+
+pre: [
+    "r1.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]
+
+code:
+  <start>: |
+    r0 = *(u32 *)skb[r7]
+
+post: [
+    "r0.type=number",
+    "r6.type=ctx", "r6.ctx_offset=0",
+    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
+]

From 3db1b62c4c878ed6e64f9bef0b6aefa8cfc29a19 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 21 Feb 2024 20:21:52 +0200
Subject: [PATCH 045/373] Use default equality for asm_syntax structs (#592)

* Use default equality for asm_syntax structs
* Add test for NEG where .id64=true

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
Co-authored-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_marshal.cpp       |  17 +++---
 src/asm_syntax.hpp        | 109 +++++++++++++-------------------------
 src/asm_unmarshal.cpp     |   5 +-
 src/test/test_marshal.cpp |  47 +++++++++-------
 4 files changed, 76 insertions(+), 102 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 5b42c5914..114baed19 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -67,10 +67,10 @@ static int16_t offset(Bin::Op op) {
     return 0;
 }
 
-static uint8_t imm(Un::Op op) {
+static uint8_t imm_endian(Un::Op op) {
     using Op = Un::Op;
     switch (op) {
-    case Op::NEG: return 0;
+    case Op::NEG: assert(false); return 0;
     case Op::BE16:
     case Op::LE16:
     case Op::SWAP16: return 16;
@@ -132,22 +132,21 @@ struct MarshalVisitor {
         switch (b.op) {
         case Un::Op::NEG:
             return {ebpf_inst{
-                // FIX: should be INST_CLS_ALU / INST_CLS_ALU64
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | 0x3 | INST_ALU_OP_NEG),
+                .opcode = static_cast<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | INST_ALU_OP_NEG),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
-                .imm = imm(b.op),
+                .imm = 0,
             }};
         case Un::Op::LE16:
         case Un::Op::LE32:
         case Un::Op::LE64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_ALU_OP_END),
+                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_END_LE | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
-                .imm = imm(b.op),
+                .imm = imm_endian(b.op),
             }};
         case Un::Op::BE16:
         case Un::Op::BE32:
@@ -157,7 +156,7 @@ struct MarshalVisitor {
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
-                .imm = imm(b.op),
+                .imm = imm_endian(b.op),
             }};
         case Un::Op::SWAP16:
         case Un::Op::SWAP32:
@@ -167,7 +166,7 @@ struct MarshalVisitor {
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
-                .imm = imm(b.op),
+                .imm = imm_endian(b.op),
             }};
         }
         assert(false);
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index eff038ba0..b05574cb6 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -22,8 +22,8 @@ struct label_t {
         return label_t{src_label.from, target_label.from};
     }
 
-    constexpr bool operator==(const label_t& other) const { return from == other.from && to == other.to; }
-    constexpr bool operator!=(const label_t& other) const { return !(*this == other); }
+    constexpr bool operator==(const label_t&) const = default;
+
     constexpr bool operator<(const label_t& other) const {
         if (this == &other) return false;
         if (*this == label_t::exit) return false;
@@ -61,11 +61,13 @@ namespace asm_syntax {
 /// Immediate argument.
 struct Imm {
     uint64_t v{};
+    constexpr bool operator==(const Imm&) const = default;
 };
 
 /// Register argument.
 struct Reg {
     uint8_t v{};
+    constexpr bool operator==(const Reg&) const = default;
 };
 
 using Value = std::variant<Imm, Reg>;
@@ -97,6 +99,7 @@ struct Bin {
     Value v;
     bool is64{};
     bool lddw{};
+    constexpr bool operator==(const Bin&) const = default;
 };
 
 /// Unary operation.
@@ -117,6 +120,7 @@ struct Un {
     Op op;
     Reg dst;
     bool is64{};
+    constexpr bool operator==(const Un&) const = default;
 };
 
 /// This instruction is encoded similarly to LDDW.
@@ -124,6 +128,7 @@ struct Un {
 struct LoadMapFd {
     Reg dst;
     int32_t mapfd{};
+    constexpr bool operator==(const LoadMapFd&) const = default;
 };
 
 struct Condition {
@@ -146,11 +151,13 @@ struct Condition {
     Reg left;
     Value right;
     bool is64{};
+    constexpr bool operator==(const Condition&) const = default;
 };
 
 struct Jmp {
     std::optional<Condition> cond;
     label_t target;
+    constexpr bool operator==(const Jmp&) const = default;
 };
 
 struct ArgSingle {
@@ -164,6 +171,7 @@ struct ArgSingle {
         ANYTHING,
     } kind{};
     Reg reg;
+    constexpr bool operator==(const ArgSingle&) const = default;
 };
 
 /// Pair of arguments to a function for pointer and size.
@@ -176,10 +184,16 @@ struct ArgPair {
     Reg mem;            ///< Pointer.
     Reg size;           ///< Size of space pointed to.
     bool can_be_zero{};
+    constexpr bool operator==(const ArgPair&) const = default;
 };
 
 struct Call {
     int32_t func{};
+    constexpr bool operator==(const Call& other) const {
+        return func == other.func;
+    }
+
+    // TODO: move name and signature information somewhere else
     std::string name;
     bool is_map_lookup{};
     bool reallocate_packet{};
@@ -187,12 +201,15 @@ struct Call {
     std::vector<ArgPair> pairs;
 };
 
-struct Exit {};
+struct Exit {
+    constexpr bool operator==(const Exit&) const = default;
+};
 
 struct Deref {
     int32_t width{};
     Reg basereg;
     int32_t offset{};
+    constexpr bool operator==(const Deref&) const = default;
 };
 
 /// Load/store instruction.
@@ -200,6 +217,7 @@ struct Mem {
     Deref access;
     Value value;
     bool is_load{};
+    constexpr bool operator==(const Mem&) const = default;
 };
 
 /// A deprecated instruction for checked access to packets; it is actually a
@@ -209,17 +227,20 @@ struct Packet {
     int32_t width{};
     int32_t offset{};
     std::optional<Reg> regoffset;
+    constexpr bool operator==(const Packet&) const = default;
 };
 
 /// Special instruction for incrementing values inside shared memory.
 struct LockAdd {
     Deref access;
     Reg valreg;
+    constexpr bool operator==(const LockAdd&) const = default;
 };
 
 /// Not an instruction, just used for failure cases.
 struct Undefined {
     int opcode{};
+    constexpr bool operator==(const Undefined&) const = default;
 };
 
 /// When a CFG is translated to its nondeterministic form, Conditional Jump
@@ -227,6 +248,7 @@ struct Undefined {
 /// the branch and before each jump target.
 struct Assume {
     Condition cond;
+    constexpr bool operator==(const Assume&) const = default;
 };
 
 enum class TypeGroup {
@@ -250,6 +272,7 @@ enum class TypeGroup {
 struct ValidSize {
     Reg reg;
     bool can_be_zero{};
+    constexpr bool operator==(const ValidSize&) const = default;
 };
 
 /// Condition check whether two registers can be compared with each other.
@@ -259,18 +282,21 @@ struct Comparable {
     Reg r1;
     Reg r2;
     bool or_r2_is_number{}; ///< true for subtraction, false for comparison
+    constexpr bool operator==(const Comparable&) const = default;
 };
 
 // ptr: ptr -> num : num
 struct Addable {
     Reg ptr;
     Reg num;
+    constexpr bool operator==(const Addable&) const = default;
 };
 
 // Condition check whether a register contains a non-zero number.
 struct ValidDivisor {
     Reg reg;
     bool is_signed{};
+    constexpr bool operator==(const ValidDivisor&) const = default;
 };
 
 enum class AccessType {
@@ -285,6 +311,7 @@ struct ValidAccess {
     Value width{Imm{0}};
     bool or_null{};
     AccessType access_type{};
+    constexpr bool operator==(const ValidAccess&) const = default;
 };
 
 /// Condition check whether something is a valid key value.
@@ -292,22 +319,26 @@ struct ValidMapKeyValue {
     Reg access_reg;
     Reg map_fd_reg;
     bool key{};
+    constexpr bool operator==(const ValidMapKeyValue&) const = default;
 };
 
 // "if mem is not stack, val is num"
 struct ValidStore {
     Reg mem;
     Reg val;
+    constexpr bool operator==(const ValidStore&) const = default;
 };
 
 struct TypeConstraint {
     Reg reg;
     TypeGroup types;
+    constexpr bool operator==(const TypeConstraint&) const = default;
 };
 
 /// Condition check whether something is a valid size.
 struct ZeroCtxOffset {
     Reg reg;
+    constexpr bool operator==(const ZeroCtxOffset&) const = default;
 };
 
 using AssertionConstraint =
@@ -316,10 +347,12 @@ using AssertionConstraint =
 struct Assert {
     AssertionConstraint cst;
     Assert(AssertionConstraint cst): cst(cst) { }
+    constexpr bool operator==(const Assert&) const = default;
 };
 
 struct IncrementLoopCounter {
     label_t name;
+    constexpr bool operator==(const IncrementLoopCounter&) const = default;
 };
 
 using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert, IncrementLoopCounter>;
@@ -327,77 +360,9 @@ using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Exit, Jmp,
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
 
-
-#define DECLARE_EQ5(T, f1, f2, f3, f4, f5)                                                   \
-    inline bool operator==(T const& a, T const& b) {                                         \
-        return a.f1 == b.f1 && a.f2 == b.f2 && a.f3 == b.f3 && a.f4 == b.f4 && a.f5 == b.f5; \
-    }
-#define DECLARE_EQ3(T, f1, f2, f3) \
-    inline bool operator==(T const& a, T const& b) { return a.f1 == b.f1 && a.f2 == b.f2 && a.f3 == b.f3; }
-#define DECLARE_EQ2(T, f1, f2) \
-    inline bool operator==(T const& a, T const& b) { return a.f1 == b.f1 && a.f2 == b.f2; }
-#define DECLARE_EQ1(T, f1) \
-    inline bool operator==(T const& a, T const& b) { return a.f1 == b.f1; }
-
 // cpu=v4 supports 32-bit PC offsets so we need a large enough type.
 using pc_t = size_t;
 
-// Helpers:
-
-struct InstructionVisitorPrototype {
-    void operator()(Undefined const& a);
-    void operator()(LoadMapFd const& a);
-    void operator()(Bin const& a);
-    void operator()(Un const& a);
-    void operator()(Call const& a);
-    void operator()(Exit const& a);
-    void operator()(Jmp const& a);
-    void operator()(Assume const& a);
-    void operator()(Assert const& a);
-    void operator()(Packet const& a);
-    void operator()(Mem const& a);
-    void operator()(LockAdd const& a);
-};
-
-inline bool operator==(Imm const& a, Imm const& b) { return a.v == b.v; }
-inline bool operator==(Reg const& a, Reg const& b) { return a.v == b.v; }
-inline bool operator==(Deref const& a, Deref const& b) {
-    return a.basereg == b.basereg && a.offset == b.offset && a.width == b.width;
-}
-inline bool operator==(Condition const& a, Condition const& b) {
-    return a.left == b.left && a.op == b.op && a.right == b.right;
-}
-inline bool operator==(Undefined const& a, Undefined const& b) { return a.opcode == b.opcode; }
-inline bool operator==(LoadMapFd const& a, LoadMapFd const& b) { return a.dst == b.dst && a.mapfd == b.mapfd; }
-inline bool operator==(Bin const& a, Bin const& b) {
-    return a.op == b.op && a.dst == b.dst && a.is64 == b.is64 && a.v == b.v && a.lddw == b.lddw;
-}
-inline bool operator==(Un const& a, Un const& b) { return a.op == b.op && a.dst == b.dst; }
-inline bool operator==(Call const& a, Call const& b) { return a.func == b.func; }
-inline bool operator==(Exit const& a, Exit const& b) { return true; }
-inline bool operator==(Jmp const& a, Jmp const& b) { return a.cond == b.cond && a.target == b.target; }
-inline bool operator==(Packet const& a, Packet const& b) {
-    return a.offset == b.offset && a.regoffset == b.regoffset && a.width == b.width;
-}
-inline bool operator==(Mem const& a, Mem const& b) {
-    return a.access == b.access && a.value == b.value && a.is_load == b.is_load;
-}
-inline bool operator==(LockAdd const& a, LockAdd const& b) { return a.access == b.access && a.valreg == b.valreg; }
-inline bool operator==(Assume const& a, Assume const& b) { return a.cond == b.cond; }
-bool operator==(Assert const& a, Assert const& b);
-
-DECLARE_EQ2(TypeConstraint, reg, types)
-DECLARE_EQ2(ValidSize, reg, can_be_zero)
-DECLARE_EQ2(Comparable, r1, r2)
-DECLARE_EQ2(Addable, ptr, num)
-DECLARE_EQ2(ValidDivisor, reg, is_signed)
-DECLARE_EQ2(ValidStore, mem, val)
-DECLARE_EQ5(ValidAccess, reg, offset, width, or_null, access_type)
-DECLARE_EQ3(ValidMapKeyValue, access_reg, map_fd_reg, key)
-DECLARE_EQ1(ZeroCtxOffset, reg)
-DECLARE_EQ1(Assert, cst)
-DECLARE_EQ1(IncrementLoopCounter, name)
-
 }
 
 using namespace asm_syntax;
@@ -406,5 +371,3 @@ template <class... Ts>
 struct overloaded : Ts... {
     using Ts::operator()...;
 };
-template <class... Ts>
-overloaded(Ts...)->overloaded<Ts...>;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 8c2cffded..22d0dfff8 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -293,13 +293,14 @@ struct Unmarshaller {
             throw InvalidInstruction(pc, "Invalid target r10");
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
             throw InvalidInstruction(pc, "Bad register");
-        return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64}; },
+        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
+        return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
                                      [&](Bin::Op op) -> Instruction {
                                          Bin res{
                                              .op = op,
                                              .dst = Reg{inst.dst},
                                              .v = getBinValue(pc, inst),
-                                             .is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64,
+                                             .is64 = is64,
                                          };
                                          if (!thread_local_options.allow_division_by_zero && (op == Bin::Op::UDIV || op == Bin::Op::UMOD))
                                              if (std::holds_alternative<Imm>(res.v) && std::get<Imm>(res.v).v == 0)
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index d3a25829e..a92161bbe 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -133,22 +133,33 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
             }
         }
     }
-
-    SECTION("Un") {
-        auto ops = {
-            Un::Op::BE16,
-            Un::Op::BE32,
-            Un::Op::BE64,
-            Un::Op::LE16,
-            Un::Op::LE32,
-            Un::Op::LE64,
-            Un::Op::NEG,
-            Un::Op::SWAP16,
-            Un::Op::SWAP32,
-            Un::Op::SWAP64
-        };
-        for (auto op : ops)
-            compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = true});
+    SECTION("Neg") {
+        compare_marshal_unmarshal(Un{.op = Un::Op::NEG, .dst = Reg{1}, .is64 = false});
+        compare_marshal_unmarshal(Un{.op = Un::Op::NEG, .dst = Reg{1}, .is64 = true});
+    }
+    SECTION("Endian") {
+        // FIX: `.is64` comes from the instruction class (BPF_ALU or BPF_ALU64) but is unused since it can be derived from `.op`.
+        {
+            auto ops = {
+                Un::Op::BE16,
+                Un::Op::BE32,
+                Un::Op::BE64,
+                Un::Op::LE16,
+                Un::Op::LE32,
+                Un::Op::LE64,
+            };
+            for (auto op : ops)
+                compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = false});
+        }
+        {
+            auto ops = {
+                Un::Op::SWAP16,
+                Un::Op::SWAP32,
+                Un::Op::SWAP64,
+            };
+            for (auto op : ops)
+                compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = true});
+        }
     }
 
     SECTION("LoadMapFd") { compare_marshal_unmarshal(LoadMapFd{.dst = Reg{1}, .mapfd = 1}, true); }
@@ -167,7 +178,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
         }
         SECTION("Reg right") {
             for (auto op : ops) {
-                Condition cond{.op = op, .left = Reg{1}, .right = Reg{2}};
+                Condition cond{.op = op, .left = Reg{1}, .right = Reg{2}, .is64 = true};
                 compare_marshal_unmarshal(Jmp{.cond = cond, .target = label_t(0)});
 
                 // The following should fail unmarshalling since it jumps past the end of the instruction set.
@@ -176,7 +187,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
         }
         SECTION("Imm right") {
             for (auto op : ops) {
-                Condition cond{.op = op, .left = Reg{1}, .right = Imm{2}};
+                Condition cond{.op = op, .left = Reg{1}, .right = Imm{2}, .is64 = true};
                 compare_marshal_unmarshal(Jmp{.cond = cond, .target = label_t(0)});
 
                 // The following should fail unmarshalling since it jumps past the end of the instruction set.

From ec074dfcd5202253bfcff6542b33efc998eefa2b Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Tue, 27 Feb 2024 11:51:40 -0800
Subject: [PATCH 046/373] Bump external/bpf_conformance from 583758e to f61ccaf
  (#594)

* Bump external/bpf_conformance from `583758e` to `f61ccaf`
* Update per bpf_conformance API change
* Include div32-by-zero-reg-2.data conformacne test

---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 external/bpf_conformance      | 2 +-
 src/test/test_conformance.cpp | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 583758eee..642b1b0f5 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 583758eee4907dd3a356a0f73939751415d46bf7
+Subproject commit 642b1b0f585ef394420dcd47fead2b8291ddfd72
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index ff9340c78..ca04dd11b 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -12,9 +12,9 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
     boost::filesystem::path extension = test_path.extension();
     std::filesystem::path plugin_path =
         test_path.remove_filename().append("conformance_check" + extension.string()).string();
-    std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result =
-        bpf_conformance(test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
-                        bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
+    std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result = bpf_conformance(
+        test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
+        _bpf_conformance_groups::default_groups, bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
     for (auto file : test_files) {
         auto& [file_result, reason] = result[file];
         REQUIRE(file_result == expected_result);
@@ -77,6 +77,7 @@ TEST_CONFORMANCE("be64.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("call_local.data")
 TEST_CONFORMANCE("call_unwind_fail.data")
 TEST_CONFORMANCE("div32-by-zero-reg.data")
+TEST_CONFORMANCE("div32-by-zero-reg-2.data")
 TEST_CONFORMANCE("div32-high-divisor.data")
 TEST_CONFORMANCE("div32-imm.data")
 TEST_CONFORMANCE("div32-reg.data")

From e0c25fc9544b1eb8dfa21ee568a21c13eab72eee Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Wed, 28 Feb 2024 09:30:22 -0800
Subject: [PATCH 047/373] Add more negative unmarshaling tests (#591)

* Add more negative unmarshaling tests
* table based tests
* Lower case unmarshaling errors for consistency
* Simplify c_str uses
---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp         |  66 +++--
 src/ebpf_vm_isa.hpp           |   1 +
 src/test/test_conformance.cpp |   2 +-
 src/test/test_marshal.cpp     | 453 +++++++++++++++++++++++++---------
 4 files changed, 385 insertions(+), 137 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 22d0dfff8..351493355 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -50,7 +50,7 @@ struct InvalidInstruction : std::invalid_argument {
     size_t pc;
     explicit InvalidInstruction(size_t pc, const char* what) : std::invalid_argument{what}, pc{pc} {}
     InvalidInstruction(size_t pc, std::string what) : std::invalid_argument{what}, pc{pc} {}
-    InvalidInstruction(size_t pc, uint8_t opcode) : std::invalid_argument{make_opcode_message("Bad instruction", opcode)}, pc{pc} {}
+    InvalidInstruction(size_t pc, uint8_t opcode) : std::invalid_argument{make_opcode_message("bad instruction", opcode)}, pc{pc} {}
 };
 
 struct UnsupportedMemoryMode : std::invalid_argument {
@@ -115,7 +115,7 @@ struct Unmarshaller {
             }
         case INST_ALU_OP_MOV:
             if (inst.offset > 0 && !(inst.opcode & INST_SRC_REG))
-                throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             switch (inst.offset) {
             case 0: return Bin::Op::MOV;
             case 8: return Bin::Op::MOVSX8;
@@ -142,7 +142,7 @@ struct Unmarshaller {
             if (inst.opcode & INST_SRC_REG)
                 throw InvalidInstruction{pc, inst.opcode};
             if (inst.src != 0)
-                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
+                throw InvalidInstruction{pc, inst.opcode};
             if (inst.imm != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             return Un::Op::NEG;
@@ -153,7 +153,7 @@ struct Unmarshaller {
             return Bin::Op::ARSH;
         case INST_ALU_OP_END:
             if (inst.src != 0)
-                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
+                throw InvalidInstruction{pc, inst.opcode};
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64) {
                 if (inst.opcode & INST_END_BE)
                     throw InvalidInstruction(pc, inst.opcode);
@@ -161,7 +161,7 @@ struct Unmarshaller {
                 case 16: return Un::Op::SWAP16;
                 case 32: return Un::Op::SWAP32;
                 case 64: return Un::Op::SWAP64;
-                default: throw InvalidInstruction(pc, "invalid endian immediate");
+                default: throw InvalidInstruction(pc, "unsupported immediate");
                 }
             }
             switch (inst.imm) {
@@ -169,7 +169,7 @@ struct Unmarshaller {
             case 32: return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
             case 64: return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
             default:
-                throw InvalidInstruction(pc, "invalid endian immediate");
+                throw InvalidInstruction(pc, "unsupported immediate");
             }
         case 0xe0: throw InvalidInstruction{pc, inst.opcode};
         case 0xf0: throw InvalidInstruction{pc, inst.opcode};
@@ -188,7 +188,7 @@ struct Unmarshaller {
             return Reg{inst.src};
         } else {
             if (inst.src != 0)
-                throw InvalidInstruction{pc, make_opcode_message("nonzero src for register", inst.opcode)};
+                throw InvalidInstruction{pc, inst.opcode};
             // Imm is a signed 32-bit number.  Sign extend it to 64-bits for storage.
             return Imm{sign_extend(inst.imm)};
         }
@@ -219,7 +219,7 @@ struct Unmarshaller {
 
     auto makeMemOp(pc_t pc, ebpf_inst inst) -> Instruction {
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
-            throw InvalidInstruction(pc, "Bad register");
+            throw InvalidInstruction(pc, "bad register");
 
         int width = getMemWidth(inst.opcode);
         bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
@@ -228,11 +228,23 @@ struct Unmarshaller {
         case INST_ABS:
             if (!info.platform->legacy || !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
+            if (inst.dst != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
+            if (inst.src > 0)
+                throw InvalidInstruction(pc, make_opcode_message("bad instruction", inst.opcode));
+            if (inst.offset != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Packet{.width = width, .offset = inst.imm, .regoffset = {}};
 
         case INST_IND:
             if (!info.platform->legacy || !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
+            if (inst.dst != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
+            if (inst.src > R10_STACK_POINTER)
+                throw InvalidInstruction(pc, "bad register");
+            if (inst.offset != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Packet{.width = width, .offset = inst.imm, .regoffset = Reg{inst.src}};
 
         case INST_MEM: {
@@ -243,7 +255,7 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, "Cannot modify r10");
             bool isImm = !(inst.opcode & 1);
             if (isImm && inst.src != 0)
-                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+                throw InvalidInstruction(pc, inst.opcode);
             if (!isImm && inst.imm != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
 
@@ -273,7 +285,7 @@ struct Unmarshaller {
                  (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.imm != 0)
-                throw InvalidInstruction(pc, "Unsupported atomic instruction");
+                throw InvalidInstruction(pc, "unsupported immediate");
             return LockAdd{
                 .access =
                     Deref{
@@ -292,7 +304,7 @@ struct Unmarshaller {
         if (inst.dst == R10_STACK_POINTER)
             throw InvalidInstruction(pc, "Invalid target r10");
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
-            throw InvalidInstruction(pc, "Bad register");
+            throw InvalidInstruction(pc, "bad register");
         bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
         return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
                                      [&](Bin::Op op) -> Instruction {
@@ -312,18 +324,22 @@ struct Unmarshaller {
 
     auto makeLddw(ebpf_inst inst, int32_t next_imm, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
         if (pc >= insts.size() - 1)
-            throw InvalidInstruction(pc, "incomplete LDDW");
+            throw InvalidInstruction(pc, "incomplete lddw");
         ebpf_inst next = insts[pc + 1];
         if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0)
-            throw InvalidInstruction(pc, "invalid LDDW");
-        if (inst.src > 1 || inst.dst > R10_STACK_POINTER || inst.offset != 0)
-            throw InvalidInstruction(pc, "LDDW uses reserved fields");
+            throw InvalidInstruction(pc, "invalid lddw");
+        if (inst.src > 1)
+            throw InvalidInstruction(pc, make_opcode_message("bad instruction", inst.opcode));
+        if (inst.offset != 0)
+            throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+        if (inst.dst > R10_STACK_POINTER)
+            throw InvalidInstruction(pc, "bad register");
 
         if (inst.src == 1) {
             // magic number, meaning we're a per-process file descriptor defining the map.
             // (for details, look for BPF_PSEUDO_MAP_FD in the kernel)
             if (next.imm != 0) {
-                throw InvalidInstruction(pc, "LDDW uses reserved fields");
+                throw InvalidInstruction(pc, "lddw uses reserved fields");
             }
             return LoadMapFd{.dst = Reg{inst.dst}, .mapfd = inst.imm};
         }
@@ -413,8 +429,12 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.opcode & INST_SRC_REG)
                 throw InvalidInstruction(pc, inst.opcode);
+            if (inst.src > 0)
+                throw InvalidInstruction(pc, inst.opcode);
             if (inst.offset != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            if (inst.dst != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
             if (!info.platform->is_helper_usable(inst.imm))
                 throw InvalidInstruction(pc, "invalid helper function id");
             return makeCall(inst.imm);
@@ -422,7 +442,9 @@ struct Unmarshaller {
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.src != 0)
-                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+                throw InvalidInstruction(pc, inst.opcode);
+            if (inst.dst != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
             if (inst.imm != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             if (inst.offset != 0)
@@ -438,11 +460,13 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP32 && (inst.offset != 0))
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            if (inst.dst != 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
         default: {
             // First validate the opcode, src, and imm.
             auto op = getJmpOp(pc, inst.opcode);
             if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0))
-                throw InvalidInstruction(pc, make_opcode_message("nonzero src for register", inst.opcode));
+                throw InvalidInstruction(pc, inst.opcode);
             if ((inst.opcode & INST_SRC_REG) && (inst.imm != 0))
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
 
@@ -452,6 +476,12 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, "jump out of bounds");
             else if (insts[new_pc].opcode == 0)
                 throw InvalidInstruction(pc, "jump to middle of lddw");
+            if (inst.opcode != INST_OP_JA16 && inst.opcode != INST_OP_JA32) {
+                if (inst.dst > R10_STACK_POINTER)
+                    throw InvalidInstruction(pc, "bad register");
+                if ((inst.opcode & INST_SRC_REG) && (inst.src > R10_STACK_POINTER))
+                    throw InvalidInstruction(pc, "bad register");
+            }
 
             auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
                                                   ? std::optional<Condition>{}
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index d734352ff..9941bfeeb 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -15,6 +15,7 @@ struct ebpf_inst {
     std::uint8_t src : 4; //< Source register
     std::int16_t offset;
     std::int32_t imm;     //< Immediate constant
+    constexpr bool operator==(const ebpf_inst&) const = default;
 };
 
 enum {
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index ca04dd11b..abb00e63f 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -14,7 +14,7 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
         test_path.remove_filename().append("conformance_check" + extension.string()).string();
     std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result = bpf_conformance(
         test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
-        _bpf_conformance_groups::default_groups, bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
+        bpf_conformance_groups_t::default_groups, bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
     for (auto file : test_files) {
         auto& [file_result, reason] = result[file];
         REQUIRE(file_result == expected_result);
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index a92161bbe..55d02fa98 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -6,6 +6,196 @@
 #include "asm_marshal.hpp"
 #include "asm_unmarshal.hpp"
 
+// Below we define a tample of instruction templates that specify
+// what values each field are allowed to contain.  We first define
+// a set of sentinel values that mean certain types of wildcards.
+// For example, MEM_OFFSET and JMP_OFFSET are different wildcards
+// for the 'offset' field of an instruction.  Any non-sentinel values
+// in an instruction template are treated as literals.
+
+constexpr int MEM_OFFSET = 3; // Any valid memory offset value.
+constexpr int JMP_OFFSET = 5; // Any valid jump offset value.
+constexpr int DST = 7; // Any destination register number.
+constexpr int SRC = 9; // Any source register number.
+constexpr int IMM = -1; // Any imm value.
+constexpr int INVALID_REGISTER = R10_STACK_POINTER + 1; // Not a valid register.
+
+// The following table is derived from the table in the Appendix of the
+// BPF ISA specification (https://datatracker.ietf.org/doc/draft-ietf-bpf-isa/).
+static const ebpf_inst instruction_template[] = {
+    // opcode, dst, src, offset, imm.
+    {0x04, DST, 0, 0, IMM},
+    {0x05, 0, 0, JMP_OFFSET, 0},
+    {0x06, 0, 0, 0, JMP_OFFSET},
+    {0x07, DST, 0, 0, IMM},
+    {0x0c, DST, SRC, 0, 0},
+    {0x0f, DST, SRC, 0, 0},
+    {0x14, DST, 0, 0, IMM},
+    {0x15, DST, 0, JMP_OFFSET, IMM},
+    {0x16, DST, 0, JMP_OFFSET, IMM},
+    {0x17, DST, 0, 0, IMM},
+    {0x18, DST, 0, 0, IMM},
+    {0x18, DST, 1, 0, IMM},
+    // TODO(issue #533): add support for LDDW with src_reg > 1.
+    // {0x18, DST, 2, 0, IMM},
+    // {0x18, DST, 3, 0, IMM},
+    // {0x18, DST, 4, 0, IMM},
+    // {0x18, DST, 5, 0, IMM},
+    // {0x18, DST, 6, 0, IMM},
+    {0x1c, DST, SRC, 0, 0},
+    {0x1d, DST, SRC, JMP_OFFSET, 0},
+    {0x1e, DST, SRC, JMP_OFFSET, 0},
+    {0x1f, DST, SRC, 0, 0},
+    {0x20, 0, 0, 0, IMM},
+    {0x24, DST, 0, 0, IMM},
+    {0x25, DST, 0, JMP_OFFSET, IMM},
+    {0x26, DST, 0, JMP_OFFSET, IMM},
+    {0x27, DST, 0, 0, IMM},
+    {0x28, 0, 0, 0, IMM},
+    {0x2c, DST, SRC, 0, 0},
+    {0x2d, DST, SRC, JMP_OFFSET, 0},
+    {0x2e, DST, SRC, JMP_OFFSET, 0},
+    {0x2f, DST, SRC, 0, 0},
+    {0x30, 0, 0, 0, IMM},
+    {0x34, DST, 0, 0, IMM},
+    {0x34, DST, 0, 1, IMM},
+    {0x35, DST, 0, JMP_OFFSET, IMM},
+    {0x36, DST, 0, JMP_OFFSET, IMM},
+    {0x37, DST, 0, 0, IMM},
+    {0x37, DST, 0, 1, IMM},
+    {0x3c, DST, SRC, 0, 0},
+    {0x3c, DST, SRC, 1, 0},
+    {0x3d, DST, SRC, JMP_OFFSET, 0},
+    {0x3e, DST, SRC, JMP_OFFSET, 0},
+    {0x3f, DST, SRC, 0, 0},
+    {0x3f, DST, SRC, 1, 0},
+    {0x40, 0, SRC, 0, IMM},
+    {0x44, DST, 0, 0, IMM},
+    {0x45, DST, 0, JMP_OFFSET, IMM},
+    {0x46, DST, 0, JMP_OFFSET, IMM},
+    {0x47, DST, 0, 0, IMM},
+    {0x48, 0, SRC, 0, IMM},
+    {0x4c, DST, SRC, 0, 0},
+    {0x4d, DST, SRC, JMP_OFFSET, 0},
+    {0x4e, DST, SRC, JMP_OFFSET, 0},
+    {0x4f, DST, SRC, 0, 0},
+    {0x50, 0, SRC, 0, IMM},
+    {0x54, DST, 0, 0, IMM},
+    {0x55, DST, 0, JMP_OFFSET, IMM},
+    {0x56, DST, 0, JMP_OFFSET, IMM},
+    {0x57, DST, 0, 0, IMM},
+    {0x5c, DST, SRC, 0, 0},
+    {0x5d, DST, SRC, JMP_OFFSET, 0},
+    {0x5e, DST, SRC, JMP_OFFSET, 0},
+    {0x5f, DST, SRC, 0, 0},
+    {0x61, DST, SRC, MEM_OFFSET, 0},
+    {0x62, DST, 0, MEM_OFFSET, IMM},
+    {0x63, DST, SRC, MEM_OFFSET, 0},
+    {0x64, DST, 0, 0, IMM},
+    {0x65, DST, 0, JMP_OFFSET, IMM},
+    {0x66, DST, 0, JMP_OFFSET, IMM},
+    {0x67, DST, 0, 0, IMM},
+    {0x69, DST, SRC, MEM_OFFSET, 0},
+    {0x6a, DST, 0, MEM_OFFSET, IMM},
+    {0x6b, DST, SRC, MEM_OFFSET, 0},
+    {0x6c, DST, SRC, 0, 0},
+    {0x6d, DST, SRC, JMP_OFFSET, 0},
+    {0x6e, DST, SRC, JMP_OFFSET, 0},
+    {0x6f, DST, SRC, 0, 0},
+    {0x71, DST, SRC, MEM_OFFSET, 0},
+    {0x72, DST, 0, MEM_OFFSET, IMM},
+    {0x73, DST, SRC, MEM_OFFSET, 0},
+    {0x74, DST, 0, 0, IMM},
+    {0x75, DST, 0, JMP_OFFSET, IMM},
+    {0x76, DST, 0, JMP_OFFSET, IMM},
+    {0x77, DST, 0, 0, IMM},
+    {0x79, DST, SRC, MEM_OFFSET, 0},
+    {0x7a, DST, 0, MEM_OFFSET, IMM},
+    {0x7b, DST, SRC, MEM_OFFSET, 0},
+    {0x7c, DST, SRC, 0, 0},
+    {0x7d, DST, SRC, JMP_OFFSET, 0},
+    {0x7e, DST, SRC, JMP_OFFSET, 0},
+    {0x7f, DST, SRC, 0, 0},
+    {0x84, DST, 0, 0, 0},
+    {0x85, 0, 0, 0, IMM},
+    // TODO(issue #582): Add support for subprograms (call_local).
+    // {0x85, 0, 1, 0, IMM},
+    // TODO(issue #590): Add support for calling a helper function by BTF ID.
+    // {0x85, 0, 2, 0, IMM},
+    {0x87, DST, 0, 0, 0},
+    {0x94, DST, 0, 0, IMM},
+    {0x94, DST, 0, 1, IMM},
+    {0x95, 0, 0, 0, 0},
+    {0x97, DST, 0, 0, IMM},
+    {0x97, DST, 0, 1, IMM},
+    {0x9c, DST, SRC, 0, 0},
+    {0x9c, DST, SRC, 1, 0},
+    {0x9f, DST, SRC, 0, 0},
+    {0x9f, DST, SRC, 1, 0},
+    {0xa4, DST, 0, 0, IMM},
+    {0xa5, DST, 0, JMP_OFFSET, IMM},
+    {0xa6, DST, 0, JMP_OFFSET, IMM},
+    {0xa7, DST, 0, 0, IMM},
+    {0xac, DST, SRC, 0, 0},
+    {0xad, DST, SRC, JMP_OFFSET, 0},
+    {0xae, DST, SRC, JMP_OFFSET, 0},
+    {0xaf, DST, SRC, 0, 0},
+    {0xb4, DST, 0, 0, IMM},
+    {0xb5, DST, 0, JMP_OFFSET, IMM},
+    {0xb6, DST, 0, JMP_OFFSET, IMM},
+    {0xb7, DST, 0, 0, IMM},
+    {0xbc, DST, SRC, 0, 0},
+    {0xbc, DST, SRC, 8, 0},
+    {0xbc, DST, SRC, 16, 0},
+    {0xbd, DST, SRC, JMP_OFFSET, 0},
+    {0xbe, DST, SRC, JMP_OFFSET, 0},
+    {0xbf, DST, SRC, 0, 0},
+    {0xbf, DST, SRC, 8, 0},
+    {0xbf, DST, SRC, 16, 0},
+    {0xbf, DST, SRC, 32, 0},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x00},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x01},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x40},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x41},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x50},
+    {0xc3, DST, SRC, MEM_OFFSET, 0x51},
+    {0xc3, DST, SRC, MEM_OFFSET, 0xa0},
+    {0xc3, DST, SRC, MEM_OFFSET, 0xa1},
+    {0xc3, DST, SRC, MEM_OFFSET, 0xe1},
+    {0xc3, DST, SRC, MEM_OFFSET, 0xf1},
+    {0xc4, DST, 0, 0, IMM},
+    {0xc5, DST, 0, JMP_OFFSET, IMM},
+    {0xc6, DST, 0, JMP_OFFSET, IMM},
+    {0xc7, DST, 0, 0, IMM},
+    {0xcc, DST, SRC, 0, 0},
+    {0xcd, DST, SRC, JMP_OFFSET, 0},
+    {0xce, DST, SRC, JMP_OFFSET, 0},
+    {0xcf, DST, SRC, 0, 0},
+    {0xd4, DST, 0, 0, 0x10},
+    {0xd4, DST, 0, 0, 0x20},
+    {0xd4, DST, 0, 0, 0x40},
+    {0xd5, DST, 0, JMP_OFFSET, IMM},
+    {0xd6, DST, 0, JMP_OFFSET, IMM},
+    {0xd7, DST, 0, 0, 0x10},
+    {0xd7, DST, 0, 0, 0x20},
+    {0xd7, DST, 0, 0, 0x40},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x00},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x01},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x40},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x41},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x50},
+    {0xdb, DST, SRC, MEM_OFFSET, 0x51},
+    {0xdb, DST, SRC, MEM_OFFSET, 0xa0},
+    {0xdb, DST, SRC, MEM_OFFSET, 0xa1},
+    {0xdb, DST, SRC, MEM_OFFSET, 0xe1},
+    {0xdb, DST, SRC, MEM_OFFSET, 0xf1},
+    {0xdc, DST, 0, 0, 0x10},
+    {0xdc, DST, 0, 0, 0x20},
+    {0xdc, DST, 0, 0, 0x40},
+    {0xdd, DST, SRC, JMP_OFFSET, 0},
+    {0xde, DST, SRC, JMP_OFFSET, 0},
+};
+
 // Verify that if we unmarshal an instruction and then re-marshal it,
 // we get what we expect.
 static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
@@ -62,9 +252,9 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 
 // Verify that if we marshal an instruction and then unmarshal it,
 // we get the original.
-static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
-    program_info info{.platform = platform,
-                      .type = platform->get_program_type("unspec", "unspec")};
+static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform,
+                      .type = platform.get_program_type("unspec", "unspec")};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
     auto [_, single, _2] = parsed.back();
@@ -73,16 +263,16 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
     REQUIRE(single == ins);
 }
 
-static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
-    program_info info{.platform = platform,
-                      .type = platform->get_program_type("unspec", "unspec")};
+static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform,
+                      .type = platform.get_program_type("unspec", "unspec")};
     std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
-static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
-    program_info info{.platform = platform,
-                      .type = platform->get_program_type("unspec", "unspec")};
+static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform,
+                      .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
     auto result = unmarshal(raw_program{"", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
@@ -90,6 +280,17 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     REQUIRE(error_message == expected_error_message);
 }
 
+static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message) {
+    program_info info{.platform = &g_ebpf_platform_linux,
+                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    std::vector<ebpf_inst> insns{inst, exit, exit};
+    auto result = unmarshal(raw_program{"", "", insns, info});
+    REQUIRE(std::holds_alternative<std::string>(result));
+    std::string error_message = std::get<std::string>(result);
+    REQUIRE(error_message == expected_error_message);
+}
+
 // Check that unmarshaling a 64-bit immediate instruction fails.
 static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message) {
     program_info info{.platform = &g_ebpf_platform_linux,
@@ -316,83 +517,143 @@ TEST_CASE("unmarshal extension opcodes", "[disasm][marshal]") {
         ebpf_inst{.opcode = INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU64, .dst = 1, .src = 1, .offset = 32});
 }
 
-TEST_CASE("fail unmarshal invalid opcodes", "[disasm][marshal]") {
-    // The following opcodes are undefined and should generate bad instruction errors.
-    uint8_t bad_opcodes[] = {
-        0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0x0d, 0x0e, 0x10, 0x11, 0x12, 0x13, 0x19, 0x1a, 0x1b, 0x60,
-        0x68, 0x70, 0x78, 0x80, 0x81, 0x82, 0x83, 0x86, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f, 0x90, 0x91,
-        0x92, 0x93, 0x96, 0x98, 0x99, 0x9a, 0x9b, 0x9d, 0x9e, 0xa0, 0xa1, 0xa2, 0xa3, 0xa8, 0xa9, 0xaa, 0xab, 0xb0,
-        0xb1, 0xb2, 0xb3, 0xb8, 0xb9, 0xba, 0xbb, 0xc0, 0xc1, 0xc2, 0xc8, 0xc9, 0xca, 0xcb, 0xd0, 0xd1, 0xd2, 0xd3,
-        0xd8, 0xd9, 0xda, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed,
-        0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff};
-    for (int i = 0; i < sizeof(bad_opcodes); i++) {
-        std::ostringstream oss;
-        oss << "0: Bad instruction op 0x" << std::hex << (int)bad_opcodes[i] << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = bad_opcodes[i]}, oss.str().c_str());
+// Check that unmarshaling an invalid instruction fails with a given message.
+static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string& message) {
+    if (inst.offset == JMP_OFFSET) {
+        inst.offset = 1;
+        check_unmarshal_fail_goto(inst, message);
+    } else if (inst.opcode == INST_OP_LDDW_IMM)
+        check_unmarshal_fail(inst, ebpf_inst{}, message);
+    else
+        check_unmarshal_fail(inst, message);
+}
+
+// Check that various 'dst' variations between two valid instruction templates fail.
+static void check_instruction_dst_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
+    ebpf_inst inst = previous_template;
+    if (inst.dst == DST) {
+        inst.dst = INVALID_REGISTER;
+        check_unmarshal_instruction_fail(inst, "0: bad register\n");
+    } else {
+        // This instruction doesn't put a register number in the 'dst' field.
+        // Just try the next value unless that's what the next template has.
+        inst.dst++;
+        if (inst != next_template) {
+            std::ostringstream oss;
+            if (inst.dst == 1)
+                oss << "0: nonzero dst for register op 0x" << std::hex << (int)inst.opcode << std::endl;
+            else
+                oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
+            check_unmarshal_instruction_fail(inst, oss.str());
+        }
     }
 }
 
-TEST_CASE("fail unmarshal src0 opcodes", "[disasm][marshal]") {
-    // The following opcodes are only defined for src = 0.
-    uint8_t src0_opcodes[] = {0x04, 0x05, 0x06, 0x07, 0x14, 0x15, 0x16, 0x17, 0x24, 0x25, 0x26, 0x27, 0x34, 0x35, 0x36,
-                              0x37, 0x44, 0x45, 0x46, 0x47, 0x54, 0x55, 0x56, 0x57, 0x62, 0x64, 0x65, 0x66, 0x67, 0x6a,
-                              0x72, 0x74, 0x75, 0x76, 0x77, 0x7a, 0x84, 0x87, 0x94, 0x95, 0x97, 0xa4, 0xa5, 0xa6, 0xa7,
-                              0xb4, 0xb5, 0xb6, 0xb7, 0xc4, 0xc5, 0xc6, 0xc7, 0xd4, 0xd5, 0xd6, 0xd7, 0xdc};
-    for (int i = 0; i < sizeof(src0_opcodes); i++) {
-        std::ostringstream oss;
-        oss << "0: nonzero src for register op 0x" << std::hex << (int)src0_opcodes[i] << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = src0_opcodes[i], .src = 1}, oss.str().c_str());
+// Check that various 'src' variations between two valid instruction templates fail.
+static void check_instruction_src_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
+    ebpf_inst inst = previous_template;
+    if (inst.src == SRC) {
+        inst.src = INVALID_REGISTER;
+        check_unmarshal_instruction_fail(inst, "0: bad register\n");
+    } else {
+        // This instruction doesn't put a register number in the 'src' field.
+        // Just try the next value unless that's what the next template has.
+        inst.src++;
+        if (inst != next_template) {
+            std::ostringstream oss;
+            oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
+            check_unmarshal_instruction_fail(inst, oss.str());
+        }
     }
 }
 
-TEST_CASE("fail unmarshal imm0 opcodes", "[disasm][marshal]") {
-    // The following opcodes are only defined for imm = 0.
-    uint8_t imm0_opcodes[] = {0x05, 0x0c, 0x0f, 0x1c, 0x1d, 0x1e, 0x1f, 0x2c, 0x2d, 0x2e, 0x2f, 0x3d, 0x3e, 0x3f, 0x4c,
-                              0x4d, 0x4e, 0x4f, 0x5c, 0x5d, 0x5e, 0x5f, 0x61, 0x63, 0x69, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
-                              0x71, 0x73, 0x79, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x84, 0x87, 0x95, 0x9c, 0x9f, 0xac, 0xad,
-                              0xae, 0xaf, 0xbc, 0xbd, 0xbe, 0xbf, 0xcc, 0xcd, 0xce, 0xcf, 0xdd, 0xde};
-    for (int i = 0; i < sizeof(imm0_opcodes); i++) {
-        std::ostringstream oss;
-        oss << "0: nonzero imm for op 0x" << std::hex << (int)imm0_opcodes[i] << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = imm0_opcodes[i], .imm = 1}, oss.str().c_str());
+// Check that various 'offset' variations between two valid instruction templates fail.
+static void check_instruction_offset_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
+    ebpf_inst inst = previous_template;
+    if (inst.offset == JMP_OFFSET) {
+        inst.offset = 0; // Not a valid jump offset.
+        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n");
+    } else if (inst.offset != MEM_OFFSET) {
+        // This instruction limits what can appear in the 'offset' field.
+        // Just try the next value unless that's what the next template has.
+        inst.offset++;
+        if (inst != next_template) {
+            std::ostringstream oss;
+            if (inst.offset == 1 &&
+                (!next_template || next_template->opcode != inst.opcode || next_template->offset == 0))
+                oss << "0: nonzero offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
+            else
+                oss << "0: invalid offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
+            check_unmarshal_instruction_fail(inst, oss.str());
+        }
     }
 }
 
-TEST_CASE("fail unmarshal off0 opcodes", "[disasm][marshal]") {
-    // The following opcodes are only defined for offset = 0.
-    uint8_t off0_opcodes[] = {0x04, 0x06, 0x07, 0x0c, 0x0f, 0x14, 0x17, 0x1c, 0x1f, 0x24, 0x27, 0x2c, 0x2f, 0x44, 0x47,
-                              0x4c, 0x4f, 0x54, 0x57, 0x5c, 0x5f, 0x64, 0x67, 0x6c, 0x6f, 0x74, 0x77, 0x7c, 0x7f, 0x84,
-                              0x85, 0x87, 0x95, 0xa4, 0xa7, 0xac, 0xaf, 0xc4, 0xc7, 0xcc, 0xcf, 0xd4, 0xd7, 0xdc};
-    for (int i = 0; i < sizeof(off0_opcodes); i++) {
-        std::ostringstream oss;
-        oss << "0: nonzero offset for op 0x" << std::hex << (int)off0_opcodes[i] << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = off0_opcodes[i], .offset = 1}, oss.str().c_str());
+// Check that various 'imm' variations between two valid instruction templates fail.
+static void check_instruction_imm_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
+    ebpf_inst inst = previous_template;
+    if (inst.imm == JMP_OFFSET) {
+        inst.imm = 0; // Not a valid jump offset.
+        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n");
+    } else if (inst.imm != IMM) {
+        // This instruction limits what can appear in the 'imm' field.
+        // Just try the next value unless that's what the next template has.
+        inst.imm++;
+        if (inst != next_template) {
+            std::ostringstream oss;
+            if (inst.imm == 1)
+                oss << "0: nonzero imm for op 0x" << std::hex << (int)inst.opcode << std::endl;
+            else
+                oss << "0: unsupported immediate" << std::endl;
+            check_unmarshal_instruction_fail(inst, oss.str());
+        }
+    }
+
+    // Some instructions only permit non-zero imm values.
+    // If the next template is for one of those, check the zero value now.
+    if (next_template && (previous_template.opcode != next_template->opcode) && (next_template->imm > 0) && (next_template->imm != JMP_OFFSET)) {
+        inst = *next_template;
+        inst.imm = 0;
+        check_unmarshal_instruction_fail(inst, "0: unsupported immediate\n");
     }
 }
 
-TEST_CASE("fail unmarshal offset opcodes", "[disasm][marshal]") {
-    // The following opcodes are defined for multiple other offset values, but not offset = 2 for example.
-    uint8_t off2_opcodes[] = {0x34, 0x37, 0x3c, 0x3f, 0x94, 0x97, 0x9c, 0x9f, 0xb4, 0xb7, 0xbc, 0xbf};
-    for (int i = 0; i < sizeof(off2_opcodes); i++) {
+// Check that various variations between two valid instruction templates fail.
+static void check_instruction_variations(std::optional<const ebpf_inst> previous_template, std::optional<const ebpf_inst> next_template) {
+    if (previous_template) {
+        check_instruction_dst_variations(*previous_template, next_template);
+        check_instruction_src_variations(*previous_template, next_template);
+        check_instruction_offset_variations(*previous_template, next_template);
+        check_instruction_imm_variations(*previous_template, next_template);
+    }
+
+    // Check any invalid opcodes in between the previous and next templates.
+    int previous_opcode = previous_template ? previous_template->opcode : -1;
+    int next_opcode = next_template ? next_template->opcode : 0x100;
+    for (int opcode = previous_opcode + 1; opcode < next_opcode; opcode++) {
+        ebpf_inst inst{.opcode = (uint8_t)opcode};
         std::ostringstream oss;
-        oss << "0: invalid offset for op 0x" << std::hex << (int)off2_opcodes[i] << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = off2_opcodes[i], .offset = 2}, oss.str().c_str());
+        oss << "0: bad instruction op 0x" << std::hex << opcode << std::endl;
+        check_unmarshal_fail(inst, oss.str());
     }
 }
 
+TEST_CASE("fail unmarshal bad instructions", "[disasm][marshal]") {
+    size_t template_count = std::size(instruction_template);
+
+    // Check any variations before the first template.
+    check_instruction_variations({}, instruction_template[0]);
+
+    for (int index = 1; index < template_count; index++)
+        check_instruction_variations(instruction_template[index - 1], instruction_template[index]);
+
+    // Check any remaining variations after the last template.
+    check_instruction_variations(instruction_template[template_count - 1], {});
+}
+
 TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
     // The following opcodes are deprecated and should no longer be used.
     static uint8_t supported_legacy_opcodes[] = {0x20, 0x28, 0x30, 0x40, 0x48, 0x50};
-    static uint8_t unsupported_legacy_opcodes[] = {0x21, 0x22, 0x23, 0x29, 0x2a, 0x2b, 0x31, 0x32, 0x33,
-                                                   0x38, 0x39, 0x3a, 0x3b, 0x41, 0x42, 0x43, 0x49, 0x4a,
-                                                   0x4b, 0x51, 0x52, 0x53, 0x58, 0x59, 0x5a, 0x5b};
-
-    for (uint8_t opcode : unsupported_legacy_opcodes) {
-        std::ostringstream oss;
-        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str());
-    }
-
     for (uint8_t opcode : supported_legacy_opcodes) {
         compare_unmarshal_marshal(ebpf_inst{.opcode = opcode}, ebpf_inst{.opcode = opcode});
     }
@@ -400,16 +661,10 @@ TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
     // Disable legacy support.
     ebpf_platform_t platform = g_ebpf_platform_linux;
     platform.legacy = false;
-
-    for (uint8_t opcode : unsupported_legacy_opcodes) {
-        std::ostringstream oss;
-        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str(), &platform);
-    }
     for (uint8_t opcode : supported_legacy_opcodes) {
         std::ostringstream oss;
-        oss << "0: Bad instruction op 0x" << std::hex << (int)opcode << std::endl;
-        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str().c_str(), &platform);
+        oss << "0: bad instruction op 0x" << std::hex << (int)opcode << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str(), platform);
     }
 }
 
@@ -420,51 +675,13 @@ TEST_CASE("unmarshal 64bit immediate", "[disasm][marshal]") {
                               ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{});
 
     for (uint8_t src = 0; src <= 7; src++) {
-        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, "0: incomplete LDDW\n");
+        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, "0: incomplete lddw\n");
         check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src},
-                             ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM}, "0: invalid LDDW\n");
-    }
-
-    // No supported src values use the offset field.
-    for (uint8_t src = 0; src <= 1; src++) {
-        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src, .offset = 1}, ebpf_inst{},
-                             "0: LDDW uses reserved fields\n");
-    }
-
-    // Verify that unsupported src values fail.
-    // TODO: support src = 2 through 6.
-    for (uint8_t src = 2; src <= 7; src++) {
-        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, ebpf_inst{},
-                             "0: LDDW uses reserved fields\n");
+                             ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM}, "0: invalid lddw\n");
     }
 
     // When src = {1, 3, 4, 5}, next_imm must be 0.
-    for (uint8_t src : {1, 3, 4, 5}) {
-        check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = src}, ebpf_inst{.imm = 1},
-                             "0: LDDW uses reserved fields\n");
-    }
-}
-
-
-TEST_CASE("fail unmarshal misc", "[disasm][marshal]") {
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x06 */ INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x16 */ 0x10 | INST_CLS_JMP32}, "0: jump out of bounds\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 11, .imm = 8},
-                         "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x71 */ ((INST_MEM << 5) | INST_SIZE_B | INST_CLS_LDX), .dst = 1, .src = 11},
-                         "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xb4 */ (INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU), .dst = 11, .imm = 8},
-                         "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xb4 */ INST_ALU_OP_MOV | INST_SRC_IMM | INST_CLS_ALU, .offset = 8},
-                         "0: invalid offset for op 0xb4\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xbc */ (INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU), .dst = 1, .src = 11},
-                         "0: Bad register\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd4 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .dst = 1, .imm = 8},
-                         "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd4 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU, .imm = 0},
-                         "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xd7 */ INST_ALU_OP_END | INST_END_LE | INST_CLS_ALU64, .imm = 0},
-                         "0: invalid endian immediate\n");
-    check_unmarshal_fail(ebpf_inst{.opcode = /* 0xdc */ INST_ALU_OP_END | INST_END_BE | INST_CLS_ALU, .dst = 1, .imm = 8},
-                         "0: invalid endian immediate\n");
+    // TODO(issue #533): add support for LDDW with src_reg > 1.
+    check_unmarshal_fail(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 1}, ebpf_inst{.imm = 1},
+                         "0: lddw uses reserved fields\n");
 }

From 4203e990be112629ef3319e31ed55316bd3559eb Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 29 Feb 2024 09:46:09 -0800
Subject: [PATCH 048/373] Implement callx instruction (#584)

* Implement callx instruction

These instructions are generated by both clang (under -O0 or -O1)
and gcc (if the experimental -mxbpf option is passed to the compiler),
but are not supported by Linux.

Per mailing list discussion at
https://mailarchive.ietf.org/arch/msg/bpf/CDQjTO8R8gdPdfeKVnoxWco8_Lw/
the intent is to support them eventually, and with this PR,
ebpf-for-windows can support them now.  This will also unblock
the ability to use versions of clang later than clang-11 by using -O1
instead of -O2 (which generates correlated branches PREVAIL can't
deal with).

The mailing list discussion at
https://mailarchive.ietf.org/arch/msg/bpf/Vx1H3ViPUWoGKNssCO22lOIjyXU/
agreed that inst.dst is where to put the register to use going forward
and clang v.19 will do so but earlier versions of clang used inst.imm.


---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 external/bpf_conformance          |   2 +-
 src/asm_cfg.cpp                   |   2 +
 src/asm_marshal.cpp               |   8 +-
 src/asm_ostream.cpp               |   6 +
 src/asm_ostream.hpp               |   1 +
 src/asm_parse.cpp                 |   3 +
 src/asm_syntax.hpp                |  14 +-
 src/asm_unmarshal.cpp             |  29 +++-
 src/assertions.cpp                |  13 +-
 src/crab/cfg.hpp                  |   1 +
 src/crab/ebpf_domain.cpp          |  51 +++++-
 src/crab/ebpf_domain.hpp          |   2 +
 src/ebpf_vm_isa.hpp               |   3 +-
 src/ebpf_yaml.cpp                 |  20 ++-
 src/linux/gpl/spec_prototypes.cpp |   1 +
 src/linux/linux_platform.cpp      |   3 +-
 src/main/check.cpp                |   3 +
 src/platform.hpp                  |   3 +-
 src/test/test_conformance.cpp     |   4 +-
 src/test/test_marshal.cpp         | 127 ++++++++------
 src/test/test_yaml.cpp            |   1 +
 test-data/call.yaml               |   6 +-
 test-data/callx.yaml              | 266 ++++++++++++++++++++++++++++++
 test-data/jump.yaml               |   2 +-
 test-data/movsx.yaml              |   2 +-
 25 files changed, 497 insertions(+), 76 deletions(-)
 create mode 100644 test-data/callx.yaml

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 642b1b0f5..cfec46b36 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 642b1b0f585ef394420dcd47fead2b8291ddfd72
+Subproject commit cfec46b36fae802c2534285229927bef351ad7a7
diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 508f603ba..1b37a4328 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -174,6 +174,8 @@ static std::string instype(Instruction ins) {
             }
         }
         return "call_mem";
+    } else if (std::holds_alternative<Callx>(ins)) {
+        return "callx";
     } else if (std::holds_alternative<Mem>(ins)) {
         return std::get<Mem>(ins).is_load ? "load" : "store";
     } else if (std::holds_alternative<LockAdd>(ins)) {
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 114baed19..a80f20345 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -175,7 +175,13 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Call const& b) {
         return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL), .dst = 0, .src = 0, .offset = 0, .imm = b.func}};
+            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL | INST_SRC_IMM), .dst = 0, .src = 0, .offset = 0, .imm = b.func}};
+    }
+
+    vector<ebpf_inst> operator()(Callx const& b) {
+        // callx is defined to have the register in 'dst' not in 'src'.
+        return {
+            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL | INST_SRC_REG), .dst = b.func.v, .src = 0, .offset = 0}};
     }
 
     vector<ebpf_inst> operator()(Exit const& b) {
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 0285d6a27..66e8f1991 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -189,6 +189,10 @@ std::ostream& operator<<(std::ostream& os, TypeConstraint const& tc) {
     return os << typereg(tc.reg) << " " << cmp_op << " " << tc.types;
 }
 
+std::ostream& operator<<(std::ostream& os, FuncConstraint const& fc) {
+    return os << typereg(fc.reg) << " is helper";
+}
+
 std::ostream& operator<<(std::ostream& os, AssertionConstraint const& a) {
     return std::visit([&](const auto& a) -> std::ostream& { return os << a; }, a);
 }
@@ -262,6 +266,8 @@ struct InstructionPrinterVisitor {
         os_ << ")";
     }
 
+    void operator()(Callx const& callx) { os_ << "callx " << callx.func; }
+
     void operator()(Exit const& b) { os_ << "exit"; }
 
     void operator()(Jmp const& b) {
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index e36f25fa6..31af5d63c 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -54,6 +54,7 @@ inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return o
 inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << (Instruction)a; }
+inline std::ostream& operator<<(std::ostream& os, Callx const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << (Instruction)a; }
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 56069ee0c..a6e00d89b 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -148,6 +148,9 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         int func = boost::lexical_cast<int>(m[1]);
         return make_call(func, g_ebpf_platform_linux);
     }
+    if (regex_match(text, m, regex("callx " REG))) {
+        return Callx{reg(m[1])};
+    }
     if (regex_match(text, m, regex(WREG OPASSIGN REG))) {
         std::string r = m[1];
         return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = reg(m[3]), .is64 = r.at(0) != 'w', .lddw = false};
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index b05574cb6..f37f141bd 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -205,6 +205,11 @@ struct Exit {
     constexpr bool operator==(const Exit&) const = default;
 };
 
+struct Callx {
+    Reg func;
+    constexpr bool operator==(const Callx&) const = default;
+};
+
 struct Deref {
     int32_t width{};
     Reg basereg;
@@ -335,6 +340,11 @@ struct TypeConstraint {
     constexpr bool operator==(const TypeConstraint&) const = default;
 };
 
+struct FuncConstraint {
+    Reg reg;
+    constexpr bool operator==(const FuncConstraint&) const = default;
+};
+
 /// Condition check whether something is a valid size.
 struct ZeroCtxOffset {
     Reg reg;
@@ -342,7 +352,7 @@ struct ZeroCtxOffset {
 };
 
 using AssertionConstraint =
-    std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize, ValidMapKeyValue, TypeConstraint, ZeroCtxOffset>;
+    std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize, ValidMapKeyValue, TypeConstraint, FuncConstraint, ZeroCtxOffset>;
 
 struct Assert {
     AssertionConstraint cst;
@@ -355,7 +365,7 @@ struct IncrementLoopCounter {
     constexpr bool operator==(const IncrementLoopCounter&) const = default;
 };
 
-using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert, IncrementLoopCounter>;
+using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Callx, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert, IncrementLoopCounter>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 351493355..b6ad9b670 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -252,7 +252,7 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, inst.opcode);
             bool isLoad = getMemIsLoad(inst.opcode);
             if (isLoad && inst.dst == R10_STACK_POINTER)
-                throw InvalidInstruction(pc, "Cannot modify r10");
+                throw InvalidInstruction(pc, "cannot modify r10");
             bool isImm = !(inst.opcode & 1);
             if (isImm && inst.src != 0)
                 throw InvalidInstruction(pc, inst.opcode);
@@ -302,7 +302,7 @@ struct Unmarshaller {
 
     auto makeAluOp(size_t pc, ebpf_inst inst) -> Instruction {
         if (inst.dst == R10_STACK_POINTER)
-            throw InvalidInstruction(pc, "Invalid target r10");
+            throw InvalidInstruction(pc, "invalid target r10");
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
             throw InvalidInstruction(pc, "bad register");
         bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
@@ -379,7 +379,7 @@ struct Unmarshaller {
     auto makeCall(int32_t imm) const {
         EbpfHelperPrototype proto = info.platform->get_helper_prototype(imm);
         if (proto.return_type == EBPF_RETURN_TYPE_UNSUPPORTED) {
-            throw std::runtime_error(std::string("Unsupported function: ") + proto.name);
+            throw std::runtime_error(std::string("unsupported function: ") + proto.name);
         }
         Call res;
         res.func = imm;
@@ -397,7 +397,7 @@ struct Unmarshaller {
         for (size_t i = 1; i < args.size() - 1; i++) {
             switch (args[i]) {
             case EBPF_ARGUMENT_TYPE_UNSUPPORTED: {
-                throw std::runtime_error(std::string("Unsupported function: ") + proto.name);
+                throw std::runtime_error(std::string("unsupported function: ") + proto.name);
             }
             case EBPF_ARGUMENT_TYPE_DONTCARE: return res;
             case EBPF_ARGUMENT_TYPE_ANYTHING:
@@ -422,21 +422,38 @@ struct Unmarshaller {
         return res;
     }
 
+    auto makeCallx(ebpf_inst inst, pc_t pc) const {
+        // callx puts the register number in the 'dst' field rather than the 'src' field.
+        if (inst.dst > R10_STACK_POINTER)
+            throw InvalidInstruction(pc, "bad register");
+        if (inst.imm != 0) {
+            // Clang prior to v19 put the register number into the 'imm' field.
+            if (inst.dst > 0)
+                throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            if (inst.imm < 0 || inst.imm > R10_STACK_POINTER)
+                throw InvalidInstruction(pc, "bad register");
+            return Callx{(uint8_t)inst.imm};
+        }
+        return Callx{inst.dst};
+    }
+
     auto makeJmp(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
         switch ((inst.opcode >> 4) & 0xF) {
         case INST_CALL:
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.opcode & INST_SRC_REG)
+            if (!info.platform->callx && (inst.opcode & INST_SRC_REG))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.src > 0)
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.offset != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            if (inst.opcode & INST_SRC_REG)
+                return makeCallx(inst, pc);
             if (inst.dst != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
             if (!info.platform->is_helper_usable(inst.imm))
-                throw InvalidInstruction(pc, "invalid helper function id");
+                throw InvalidInstruction(pc, "invalid helper function id " + std::to_string(inst.imm));
             return makeCall(inst.imm);
         case INST_EXIT:
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG))
diff --git a/src/assertions.cpp b/src/assertions.cpp
index f99a67d6f..d760a5420 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -105,6 +105,13 @@ class AssertExtractor {
         return res;
     }
 
+    vector<Assert> operator()(Callx const& callx) const {
+        vector<Assert> res;
+        res.emplace_back(TypeConstraint{callx.func, TypeGroup::number});
+        res.emplace_back(FuncConstraint{callx.func});
+        return res;
+    }
+
     [[nodiscard]]
     vector<Assert> explicate(Condition cond) const {
         if (info.type.is_privileged)
@@ -234,6 +241,10 @@ class AssertExtractor {
     }
 };
 
+vector<Assert> get_assertions(Instruction ins, const program_info& info) {
+    return std::visit(AssertExtractor{info}, ins);
+}
+
 /// Annotate the CFG by adding explicit assertions for all the preconditions
 /// of any instruction. For example, jump instructions are asserted not to
 /// compare numbers and pointers, or pointers to potentially distinct memory
@@ -244,7 +255,7 @@ void explicate_assertions(cfg_t& cfg, const program_info& info) {
         (void)label; // unused
         vector<Instruction> insts;
         for (const auto& ins : vector<Instruction>(bb.begin(), bb.end())) {
-            for (auto a : std::visit(AssertExtractor{info}, ins))
+            for (auto a : get_assertions(ins, info))
                 insts.emplace_back(a);
             insts.push_back(ins);
         }
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index c4ebe7404..dc9872402 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -519,6 +519,7 @@ std::map<std::string, int> collect_stats(const cfg_t&);
 cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit=true);
 
 void explicate_assertions(cfg_t& cfg, const program_info& info);
+std::vector<Assert> get_assertions(Instruction ins, const program_info& info);
 
 void print_dot(const cfg_t& cfg, std::ostream& out);
 void print_dot(const cfg_t& cfg, const std::string& outfile);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 67e74fd2b..f0b06bcc1 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -15,6 +15,7 @@
 #include "crab/ebpf_domain.hpp"
 
 #include "asm_ostream.hpp"
+#include "asm_unmarshal.hpp"
 #include "config.hpp"
 #include "dsl_syntax.hpp"
 #include "platform.hpp"
@@ -1558,13 +1559,35 @@ void ebpf_domain_t::operator()(const ValidStore& s) {
 
 void ebpf_domain_t::operator()(const TypeConstraint& s) {
     if (!type_inv.is_in_group(m_inv, s.reg, s.types))
-        require(m_inv, linear_constraint_t::FALSE(), "");
+        require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
+}
+
+void ebpf_domain_t::operator()(const FuncConstraint& s) {
+    // Look up the helper function id.
+    const reg_pack_t& reg = reg_pack(s.reg);
+    auto src_interval = m_inv.eval_interval(reg.svalue);
+    if (auto sn = src_interval.singleton()) {
+        if (sn->fits_sint32()) {
+            // We can now process it as if the id was immediate.
+            int32_t imm = sn->cast_to_sint32();
+            if (!global_program_info->platform->is_helper_usable(imm)) {
+                require(m_inv, linear_constraint_t::FALSE(), "invalid helper function id " + std::to_string(imm));
+                return;
+            }
+            Call call = make_call(imm, *global_program_info->platform);
+            for (Assert a : get_assertions(call, *global_program_info)) {
+                (*this)(a);
+            }
+            return;
+        }
+    }
+    require(m_inv, linear_constraint_t::FALSE(), "callx helper function id is not a valid singleton");
 }
 
 void ebpf_domain_t::operator()(const ValidSize& s) {
     using namespace crab::dsl_syntax;
     auto r = reg_pack(s.reg);
-    require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "");
+    require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "Invalid size");
 }
 
 // Get the start and end of the range of possible map fd values.
@@ -1825,7 +1848,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
 void ebpf_domain_t::operator()(const ZeroCtxOffset& s) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
-    require(m_inv, reg.ctx_offset == 0, "");
+    require(m_inv, reg.ctx_offset == 0, "Nonzero context offset");
 }
 
 void ebpf_domain_t::operator()(const Assert& stmt) {
@@ -2232,6 +2255,28 @@ void ebpf_domain_t::operator()(const Call& call) {
     }
 }
 
+void ebpf_domain_t::operator()(const Callx& callx) {
+    using namespace crab::dsl_syntax;
+    if (m_inv.is_bottom())
+        return;
+
+    // Look up the helper function id.
+    const reg_pack_t& reg = reg_pack(callx.func);
+    auto src_interval = m_inv.eval_interval(reg.svalue);
+    if (auto sn = src_interval.singleton()) {
+        if (sn->fits_sint32()) {
+            // We can now process it as if the id was immediate.
+            int32_t imm = sn->cast_to_sint32();
+            if (!global_program_info->platform->is_helper_usable(imm)) {
+                return;
+            }
+            Call call = make_call(imm, *global_program_info->platform);
+            (*this)(call);
+            return;
+        }
+    }
+}
+
 void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null) {
     const EbpfMapDescriptor& desc = global_program_info->platform->get_map_descriptor(mapfd);
     const EbpfMapType& type = global_program_info->platform->get_map_type(desc.type);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index fb3ef276a..efc2dabc8 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -61,8 +61,10 @@ class ebpf_domain_t final {
     void operator()(const Assume&);
     void operator()(const Bin&);
     void operator()(const Call&);
+    void operator()(const Callx&);
     void operator()(const Comparable&);
     void operator()(const Exit&);
+    void operator()(const FuncConstraint&);
     void operator()(const Jmp&);
     void operator()(const LoadMapFd&);
     void operator()(const LockAdd&);
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 9941bfeeb..1b60c8478 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -61,7 +61,8 @@ enum {
 
     INST_OP_JA32 = ((INST_JA << 4) | INST_CLS_JMP32),
     INST_OP_JA16 = ((INST_JA << 4) | INST_CLS_JMP),
-    INST_OP_CALL = ((INST_CALL << 4) | INST_CLS_JMP),
+    INST_OP_CALL = ((INST_CALL << 4) | INST_SRC_IMM | INST_CLS_JMP),
+    INST_OP_CALLX = ((INST_CALL << 4) | INST_SRC_REG | INST_CLS_JMP),
     INST_OP_EXIT = ((INST_EXIT << 4) | INST_CLS_JMP),
 
     INST_ALU_OP_ADD  = 0x00,
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index f728d6c88..dee8d9e3b 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -19,20 +19,25 @@
 using std::vector;
 using std::string;
 
+// The YAML tests for Call depend on Linux prototypes.
+// parse_instruction() in asm_parse.cpp explicitly uses
+// g_ebpf_platform_linux when parsing Call instructions
+// so we do the same here.
+
 static EbpfProgramType ebpf_get_program_type(const string& section, const string& path) {
-    return {};
+    return g_ebpf_platform_linux.get_program_type(section, path);
 }
 
 static EbpfMapType ebpf_get_map_type(uint32_t platform_specific_type) {
-    return {};
+    return g_ebpf_platform_linux.get_map_type(platform_specific_type);
 }
 
 static EbpfHelperPrototype ebpf_get_helper_prototype(int32_t n) {
-    return {};
+    return g_ebpf_platform_linux.get_helper_prototype(n);
 }
 
-static bool ebpf_is_helper_usable(int32_t n){
-    return false;
+static bool ebpf_is_helper_usable(int32_t n) {
+    return g_ebpf_platform_linux.is_helper_usable(n);
 }
 
 static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>& map_descriptors, const char* data, size_t map_record_size, int map_count,
@@ -59,6 +64,7 @@ ebpf_platform_t g_platform_test = {
     .get_map_descriptor = ebpf_get_map_descriptor,
     .get_map_type = ebpf_get_map_type,
     .legacy = true,
+    .callx = true
 };
 
 static EbpfProgramType make_program_type(const string& name, ebpf_context_descriptor_t* context_descriptor) {
@@ -321,7 +327,9 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
         pre_invariant = pre_invariant + stack_contents_invariant(memory_bytes);
     }
     raw_program raw_prog{.prog = insts};
-    raw_prog.info.platform = &g_ebpf_platform_linux;
+    ebpf_platform_t platform = g_ebpf_platform_linux;
+    platform.callx = true;
+    raw_prog.info.platform = &platform;
 
     // Convert the raw program section to a set of instructions.
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
diff --git a/src/linux/gpl/spec_prototypes.cpp b/src/linux/gpl/spec_prototypes.cpp
index 4f600a72c..915432509 100644
--- a/src/linux/gpl/spec_prototypes.cpp
+++ b/src/linux/gpl/spec_prototypes.cpp
@@ -44,6 +44,7 @@ const ebpf_context_descriptor_t g_sock_ops_descr = sock_ops_descr;
 
 static const struct EbpfHelperPrototype bpf_unspec_proto = {
     .name = "unspec",
+    .return_type = EBPF_RETURN_TYPE_UNSUPPORTED
 };
 
 const struct EbpfHelperPrototype bpf_tail_call_proto = {
diff --git a/src/linux/linux_platform.cpp b/src/linux/linux_platform.cpp
index 1ae825cdc..a57ccc16b 100644
--- a/src/linux/linux_platform.cpp
+++ b/src/linux/linux_platform.cpp
@@ -255,5 +255,6 @@ const ebpf_platform_t g_ebpf_platform_linux = {
     get_map_descriptor_linux,
     get_map_type_linux,
     resolve_inner_map_references_linux,
-    true // Legacy packet access instructions
+    true, // Legacy packet access instructions
+    false // No callx instructions
 };
diff --git a/src/main/check.cpp b/src/main/check.cpp
index bf832fc73..887177c92 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -68,6 +68,8 @@ int main(int argc, char** argv) {
     app.add_flag("-v", verbose, "Print both invariants and failures");
     bool legacy = false;
     app.add_flag("--legacy", legacy, "Allow deprecated packet access instructions");
+    bool callx = false;
+    app.add_flag("--callx", callx, "Allow callx instructions");
     bool no_division_by_zero = false;
     app.add_flag("--no-division-by-zero", no_division_by_zero, "Do not allow division by zero");
     app.add_flag("--no-simplify", ebpf_verifier_options.no_simplify, "Do not simplify");
@@ -115,6 +117,7 @@ int main(int argc, char** argv) {
         ebpf_verifier_options.mock_map_fds = false;
     ebpf_platform_t platform = g_ebpf_platform_linux;
     platform.legacy = legacy;
+    platform.callx = callx;
 
     // Read a set of raw program sections from an ELF file.
     vector<raw_program> raw_progs;
diff --git a/src/platform.hpp b/src/platform.hpp
index bc50b9601..d3635bfcd 100644
--- a/src/platform.hpp
+++ b/src/platform.hpp
@@ -43,8 +43,9 @@ struct ebpf_platform_t {
     ebpf_get_map_type_fn get_map_type;
     ebpf_resolve_inner_map_references_fn resolve_inner_map_references;
 
-    // Option indicating support for various deprecated instructions.
+    // Fields indicating support for various instruction types.
     bool legacy;
+    bool callx;
 };
 
 extern const ebpf_platform_t g_ebpf_platform_linux;
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index abb00e63f..7474d7257 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -14,7 +14,8 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
         test_path.remove_filename().append("conformance_check" + extension.string()).string();
     std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result = bpf_conformance(
         test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
-        bpf_conformance_groups_t::default_groups, bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
+        bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::callx,
+        bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
     for (auto file : test_files) {
         auto& [file_result, reason] = result[file];
         REQUIRE(file_result == expected_result);
@@ -76,6 +77,7 @@ TEST_CONFORMANCE("be32.data")
 TEST_CONFORMANCE("be64.data")
 TEST_CONFORMANCE_VERIFICATION_FAILED("call_local.data")
 TEST_CONFORMANCE("call_unwind_fail.data")
+TEST_CONFORMANCE("callx.data")
 TEST_CONFORMANCE("div32-by-zero-reg.data")
 TEST_CONFORMANCE("div32-by-zero-reg-2.data")
 TEST_CONFORMANCE("div32-high-divisor.data")
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 55d02fa98..c3ff87c30 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -5,6 +5,7 @@
 #include "asm_ostream.hpp"
 #include "asm_marshal.hpp"
 #include "asm_unmarshal.hpp"
+#include "../external/bpf_conformance/include/bpf_conformance.h"
 
 // Below we define a tample of instruction templates that specify
 // what values each field are allowed to contain.  We first define
@@ -20,9 +21,14 @@ constexpr int SRC = 9; // Any source register number.
 constexpr int IMM = -1; // Any imm value.
 constexpr int INVALID_REGISTER = R10_STACK_POINTER + 1; // Not a valid register.
 
+struct ebpf_instruction_template_t {
+    ebpf_inst inst;
+    bpf_conformance_groups_t groups;
+};
+
 // The following table is derived from the table in the Appendix of the
 // BPF ISA specification (https://datatracker.ietf.org/doc/draft-ietf-bpf-isa/).
-static const ebpf_inst instruction_template[] = {
+static const ebpf_instruction_template_t instruction_template[] = {
     // opcode, dst, src, offset, imm.
     {0x04, DST, 0, 0, IMM},
     {0x05, 0, 0, JMP_OFFSET, 0},
@@ -123,6 +129,7 @@ static const ebpf_inst instruction_template[] = {
     // TODO(issue #590): Add support for calling a helper function by BTF ID.
     // {0x85, 0, 2, 0, IMM},
     {0x87, DST, 0, 0, 0},
+    {{0x8d, DST, 0, 0, 0}, bpf_conformance_groups_t::callx},
     {0x94, DST, 0, 0, IMM},
     {0x94, DST, 0, 1, IMM},
     {0x95, 0, 0, 0, 0},
@@ -198,9 +205,9 @@ static const ebpf_inst instruction_template[] = {
 
 // Verify that if we unmarshal an instruction and then re-marshal it,
 // we get what we expect.
-static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t* platform = &g_ebpf_platform_linux) {
-    program_info info{.platform = platform,
-                      .type = platform->get_program_type("unspec", "unspec")};
+static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform,
+                      .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
@@ -253,8 +260,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 // Verify that if we marshal an instruction and then unmarshal it,
 // we get the original.
 static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform,
-                      .type = platform.get_program_type("unspec", "unspec")};
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
     auto [_, single, _2] = parsed.back();
@@ -264,15 +270,13 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
 }
 
 static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform,
-                      .type = platform.get_program_type("unspec", "unspec")};
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
 static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform,
-                      .type = platform.get_program_type("unspec", "unspec")};
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
     auto result = unmarshal(raw_program{"", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
@@ -280,9 +284,8 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     REQUIRE(error_message == expected_error_message);
 }
 
-static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     std::vector<ebpf_inst> insns{inst, exit, exit};
     auto result = unmarshal(raw_program{"", "", insns, info});
@@ -292,9 +295,8 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
 }
 
 // Check that unmarshaling a 64-bit immediate instruction fails.
-static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message) {
-    program_info info{.platform = &g_ebpf_platform_linux,
-                      .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
+static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst1, inst2};
     auto result = unmarshal(raw_program{"", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
@@ -330,7 +332,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
             }
             SECTION("r10") {
                 check_marshal_unmarshal_fail(Bin{.op = Bin::Op::ADD, .dst = Reg{10}, .v = Imm{4}, .is64=true},
-                                             "0: Invalid target r10\n");
+                                             "0: invalid target r10\n");
             }
         }
     }
@@ -400,6 +402,25 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
     SECTION("Call") {
         for (int func : {1, 17})
             compare_marshal_unmarshal(Call{func});
+
+        // Test callx without support.
+        std::ostringstream oss;
+        oss << "0: bad instruction op 0x" << std::hex << INST_OP_CALLX << std::endl;
+        check_unmarshal_fail(ebpf_inst{.opcode = INST_OP_CALLX}, oss.str());
+
+        // Test callx with support.  Note that callx puts the register number in 'dst' not 'src'.
+        ebpf_platform_t platform = g_ebpf_platform_linux;
+        platform.callx = true;
+        compare_marshal_unmarshal(Callx{8}, false, platform);
+        ebpf_inst callx{.opcode = INST_OP_CALLX, .dst = 8};
+        compare_unmarshal_marshal(callx, callx, platform);
+        check_unmarshal_fail({.opcode = INST_OP_CALLX, .dst = 11}, "0: bad register\n", platform);
+        check_unmarshal_fail({.opcode = INST_OP_CALLX, .dst = 8, .imm = 8}, "0: nonzero imm for op 0x8d\n", platform);
+
+        // clang prior to v19 put the register into 'imm' instead of 'dst' so we treat it as equivalent.
+        compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x8d */ INST_OP_CALLX, .imm = 8}, callx, platform);
+        check_unmarshal_fail({.opcode = INST_OP_CALLX, .imm = 11}, "0: bad register\n", platform);
+        check_unmarshal_fail({.opcode = INST_OP_CALLX, .imm = -1}, "0: bad register\n", platform);
     }
 
     SECTION("Exit") { compare_marshal_unmarshal(Exit{}); }
@@ -481,7 +502,7 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
         access.offset = 0;
         access.width = 8;
         check_marshal_unmarshal_fail(Mem{.access = access, .value = Reg{10}, .is_load = true},
-                                     "0: Cannot modify r10\n");
+                                     "0: cannot modify r10\n");
     }
     SECTION("Store Register") {
         for (int w : ws) {
@@ -518,108 +539,120 @@ TEST_CASE("unmarshal extension opcodes", "[disasm][marshal]") {
 }
 
 // Check that unmarshaling an invalid instruction fails with a given message.
-static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string& message) {
+static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string& message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     if (inst.offset == JMP_OFFSET) {
         inst.offset = 1;
         check_unmarshal_fail_goto(inst, message);
     } else if (inst.opcode == INST_OP_LDDW_IMM)
-        check_unmarshal_fail(inst, ebpf_inst{}, message);
+        check_unmarshal_fail(inst, ebpf_inst{}, message, platform);
     else
-        check_unmarshal_fail(inst, message);
+        check_unmarshal_fail(inst, message, platform);
+}
+
+static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t& previous_template) {
+    ebpf_platform_t platform = g_ebpf_platform_linux;
+    if ((previous_template.groups & bpf_conformance_groups_t::callx) != bpf_conformance_groups_t::none)
+        platform.callx = true;
+    return platform;
 }
 
 // Check that various 'dst' variations between two valid instruction templates fail.
-static void check_instruction_dst_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
-    ebpf_inst inst = previous_template;
+static void check_instruction_dst_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+    ebpf_inst inst = previous_template.inst;
+    ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.dst == DST) {
         inst.dst = INVALID_REGISTER;
-        check_unmarshal_instruction_fail(inst, "0: bad register\n");
+        check_unmarshal_instruction_fail(inst, "0: bad register\n", platform);
     } else {
         // This instruction doesn't put a register number in the 'dst' field.
         // Just try the next value unless that's what the next template has.
         inst.dst++;
-        if (inst != next_template) {
+        if (!next_template || (inst != next_template->inst)) {
             std::ostringstream oss;
             if (inst.dst == 1)
                 oss << "0: nonzero dst for register op 0x" << std::hex << (int)inst.opcode << std::endl;
             else
                 oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
-            check_unmarshal_instruction_fail(inst, oss.str());
+            check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 }
 
 // Check that various 'src' variations between two valid instruction templates fail.
-static void check_instruction_src_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
-    ebpf_inst inst = previous_template;
+static void check_instruction_src_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+    ebpf_inst inst = previous_template.inst;
+    ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.src == SRC) {
         inst.src = INVALID_REGISTER;
-        check_unmarshal_instruction_fail(inst, "0: bad register\n");
+        check_unmarshal_instruction_fail(inst, "0: bad register\n", platform);
     } else {
         // This instruction doesn't put a register number in the 'src' field.
         // Just try the next value unless that's what the next template has.
         inst.src++;
-        if (inst != next_template) {
+        if (!next_template || (inst != next_template->inst)) {
             std::ostringstream oss;
             oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
-            check_unmarshal_instruction_fail(inst, oss.str());
+            check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 }
 
 // Check that various 'offset' variations between two valid instruction templates fail.
-static void check_instruction_offset_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
-    ebpf_inst inst = previous_template;
+static void check_instruction_offset_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+    ebpf_inst inst = previous_template.inst;
+    ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.offset == JMP_OFFSET) {
         inst.offset = 0; // Not a valid jump offset.
-        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n");
+        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n", platform);
     } else if (inst.offset != MEM_OFFSET) {
         // This instruction limits what can appear in the 'offset' field.
         // Just try the next value unless that's what the next template has.
         inst.offset++;
-        if (inst != next_template) {
+        if (!next_template || (inst != next_template->inst)) {
             std::ostringstream oss;
             if (inst.offset == 1 &&
-                (!next_template || next_template->opcode != inst.opcode || next_template->offset == 0))
+                (!next_template || next_template->inst.opcode != inst.opcode || next_template->inst.offset == 0))
                 oss << "0: nonzero offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
             else
                 oss << "0: invalid offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
-            check_unmarshal_instruction_fail(inst, oss.str());
+            check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 }
 
 // Check that various 'imm' variations between two valid instruction templates fail.
-static void check_instruction_imm_variations(const ebpf_inst& previous_template, std::optional<const ebpf_inst> next_template) {
-    ebpf_inst inst = previous_template;
+static void check_instruction_imm_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+    ebpf_inst inst = previous_template.inst;
+    ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.imm == JMP_OFFSET) {
         inst.imm = 0; // Not a valid jump offset.
-        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n");
+        check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n", platform);
     } else if (inst.imm != IMM) {
         // This instruction limits what can appear in the 'imm' field.
         // Just try the next value unless that's what the next template has.
         inst.imm++;
-        if (inst != next_template) {
+        if (!next_template || (inst != next_template->inst)) {
             std::ostringstream oss;
             if (inst.imm == 1)
                 oss << "0: nonzero imm for op 0x" << std::hex << (int)inst.opcode << std::endl;
             else
                 oss << "0: unsupported immediate" << std::endl;
-            check_unmarshal_instruction_fail(inst, oss.str());
+            check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 
     // Some instructions only permit non-zero imm values.
     // If the next template is for one of those, check the zero value now.
-    if (next_template && (previous_template.opcode != next_template->opcode) && (next_template->imm > 0) && (next_template->imm != JMP_OFFSET)) {
-        inst = *next_template;
+    if (next_template && (previous_template.inst.opcode != next_template->inst.opcode) &&
+        (next_template->inst.imm > 0) && (next_template->inst.imm != JMP_OFFSET)) {
+        inst = next_template->inst;
         inst.imm = 0;
         check_unmarshal_instruction_fail(inst, "0: unsupported immediate\n");
     }
 }
 
 // Check that various variations between two valid instruction templates fail.
-static void check_instruction_variations(std::optional<const ebpf_inst> previous_template, std::optional<const ebpf_inst> next_template) {
+static void check_instruction_variations(std::optional<const ebpf_instruction_template_t> previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
     if (previous_template) {
         check_instruction_dst_variations(*previous_template, next_template);
         check_instruction_src_variations(*previous_template, next_template);
@@ -628,8 +661,8 @@ static void check_instruction_variations(std::optional<const ebpf_inst> previous
     }
 
     // Check any invalid opcodes in between the previous and next templates.
-    int previous_opcode = previous_template ? previous_template->opcode : -1;
-    int next_opcode = next_template ? next_template->opcode : 0x100;
+    int previous_opcode = previous_template ? previous_template->inst.opcode : -1;
+    int next_opcode = next_template ? next_template->inst.opcode : 0x100;
     for (int opcode = previous_opcode + 1; opcode < next_opcode; opcode++) {
         ebpf_inst inst{.opcode = (uint8_t)opcode};
         std::ostringstream oss;
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 8e95638ad..f94b598d0 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -23,6 +23,7 @@ YAML_CASE("test-data/add.yaml")
 YAML_CASE("test-data/assign.yaml")
 YAML_CASE("test-data/bitop.yaml")
 YAML_CASE("test-data/call.yaml")
+YAML_CASE("test-data/callx.yaml")
 YAML_CASE("test-data/udivmod.yaml")
 YAML_CASE("test-data/sdivmod.yaml")
 YAML_CASE("test-data/full64.yaml")
diff --git a/test-data/call.yaml b/test-data/call.yaml
index 49b856236..47beb799f 100644
--- a/test-data/call.yaml
+++ b/test-data/call.yaml
@@ -76,7 +76,7 @@ post:
   - s[504...511].type=number
 
 messages:
-  - "0:  (r3.type in {stack, packet})"
+  - "0: Invalid type (r3.type in {stack, packet})"
   - "0: Only stack or packet can be used as a parameter (within stack(r3:value_size(r1)))"
 ---
 test-case: bpf_ringbuf_output with numeric stack value
@@ -129,7 +129,7 @@ post:
   - s[504...511].type=number
 
 messages:
-  - "0:  (r2.type in {stack, packet, shared})"
+  - "0: Invalid type (r2.type in {stack, packet, shared})"
 ---
 test-case: bpf_get_stack
 
@@ -161,7 +161,7 @@ post:
   - r0.type=number
 
 messages:
-  - "0:  (r2.type in {stack, packet, shared})"
+  - "0: Invalid type (r2.type in {stack, packet, shared})"
 ---
 test-case: bpf_get_stack writing into shared memory
 
diff --git a/test-data/callx.yaml b/test-data/callx.yaml
new file mode 100644
index 000000000..d262aafde
--- /dev/null
+++ b/test-data/callx.yaml
@@ -0,0 +1,266 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: callx bpf_map_lookup_elem
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1",
+      "s[504...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+  - s[504...511].type=number
+---
+test-case: callx 0
+
+pre: ["r8.type=number", "r8.svalue=1000", "r8.uvalue=1000"]
+
+code:
+  <start>: |
+    callx r8
+
+post:
+  - r8.type=number
+  - r8.svalue=1000
+  - r8.uvalue=1000
+
+messages:
+  - "0: invalid helper function id 1000 (r8.type is helper)"
+---
+test-case: callx with invalid id
+
+pre: ["r8.type=number", "r8.svalue=1000", "r8.uvalue=1000"]
+
+code:
+  <start>: |
+    callx r8
+
+post:
+  - r8.type=number
+  - r8.svalue=1000
+  - r8.uvalue=1000
+
+messages:
+  - "0: invalid helper function id 1000 (r8.type is helper)"
+---
+test-case: callx with interval
+
+pre: ["r8.type=number", "r8.svalue=[1, 2]", "r8.uvalue=[1, 2]"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r8.type=number
+  - r8.svalue=[1, 2]
+  - r8.uvalue=[1, 2]
+
+messages:
+  - "0: callx helper function id is not a valid singleton (r8.type is helper)"
+---
+test-case: callx bpf_map_lookup_elem with non-numeric stack key
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+
+messages:
+  - "0: Illegal map update with a non-numerical value [-oo-oo) (within stack(r2:key_size(r1)))"
+---
+test-case: callx bpf_map_update_elem with non-numeric stack value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=stack", "r3.stack_offset=496",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[504...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[504...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+messages:
+  - "0: Illegal map update with a non-numerical value [496-500) (within stack(r3:value_size(r1)))"
+---
+test-case: callx bpf_map_update_elem with context value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=ctx", "r3.ctx_offset=0",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[504...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[504...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+messages:
+  - "0: Invalid type (r3.type in {stack, packet})"
+  - "0: Only stack or packet can be used as a parameter (within stack(r3:value_size(r1)))"
+---
+test-case: callx bpf_ringbuf_output with numeric stack value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=number", "r3.svalue=8", "r3.uvalue=8",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=130", "r8.uvalue=130",
+      "s[504...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_ringbuf_output
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=130
+  - r8.uvalue=130
+  - s[504...511].type=number
+---
+test-case: callx bpf_ringbuf_output with non-numeric stack value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=number", "r3.svalue=8", "r3.uvalue=8",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=130", "r8.uvalue=130"]
+
+code:
+  <start>: |
+    callx r8; bpf_ringbuf_output
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=130
+  - r8.uvalue=130
+
+messages:
+  - "0: Stack content is not numeric (valid_access(r2.offset, width=r3) for read)"
+---
+test-case: callx bpf_ringbuf_output with context value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=ctx", "r2.ctx_offset=0",
+      "r3.type=number", "r3.svalue=8", "r3.uvalue=8",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=130", "r8.uvalue=130",
+      "s[504...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_ringbuf_output
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=130
+  - r8.uvalue=130
+  - s[504...511].type=number
+
+messages:
+  - "0: Invalid type (r2.type in {stack, packet, shared})"
+---
+test-case: callx bpf_get_stack
+
+pre: ["r1.type=ctx", "r1.ctx_offset=0",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=number", "r3.svalue=8", "r3.uvalue=8",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=67", "r8.uvalue=67"]
+
+code:
+  <start>: |
+    callx r8; bpf_get_stack
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=67
+  - r8.uvalue=67
+  - s[504...511].type=number
+---
+test-case: callx bpf_get_stack overwriting ctx
+
+pre: ["r1.type=ctx", "r1.ctx_offset=0",
+      "r2.type=ctx", "r2.ctx_offset=0",
+      "r3.type=number", "r3.svalue=8", "r3.uvalue=8",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=67", "r8.uvalue=67"]
+
+code:
+  <start>: |
+    callx r8; bpf_get_stack
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=67
+  - r8.uvalue=67
+
+messages:
+  - "0: Invalid type (r2.type in {stack, packet, shared})"
+---
+test-case: callx bpf_get_stack writing into shared memory
+
+pre: ["r1.type=ctx", "r1.ctx_offset=0",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=64", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]",
+      "r3.type=number", "r3.svalue=64", "r3.uvalue=64",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=67", "r8.uvalue=67"]
+
+code:
+  <start>: |
+    callx r8; bpf_get_stack, doesn't this leak pointers into the shared memory?
+
+post:
+  - r0.type=number
+  - r8.type=number
+  - r8.svalue=67
+  - r8.uvalue=67
diff --git a/test-data/jump.yaml b/test-data/jump.yaml
index 2595b703a..940b70179 100644
--- a/test-data/jump.yaml
+++ b/test-data/jump.yaml
@@ -714,4 +714,4 @@ post:
   - r1.map_fd-r2.map_fd<=-1
 
 messages:
-  - "0:  (r1.type == non_map_fd)"
+  - "0: Invalid type (r1.type == non_map_fd)"
diff --git a/test-data/movsx.yaml b/test-data/movsx.yaml
index 2645dddd8..6a3d3c835 100644
--- a/test-data/movsx.yaml
+++ b/test-data/movsx.yaml
@@ -97,7 +97,7 @@ code:
 post: []
 
 messages:
-  - "0:  (r1.type == number)"
+  - "0: Invalid type (r1.type == number)"
 ---
 test-case: movsx8 register range to 32 bits without wrap
 

From f1ce7589a87b341f9169acb1f0f9a0950c64a798 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 2 Mar 2024 16:14:03 +0000
Subject: [PATCH 049/373] Bump external/libbtf from `d0938e0` to `604e8bc`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `d0938e0` to `604e8bc`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/d0938e01fe143b632a13bce712605eba33e2169d...604e8bc8889060a4ab985afc7310cb701540124e)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index d0938e01f..604e8bc88 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit d0938e01fe143b632a13bce712605eba33e2169d
+Subproject commit 604e8bc8889060a4ab985afc7310cb701540124e

From 800101de8422499e490190059af56e2a9782f9fd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 2 Mar 2024 16:14:07 +0000
Subject: [PATCH 050/373] Bump external/bpf_conformance from `cfec46b` to
 `68a9fda`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `cfec46b` to `68a9fda`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/cfec46b36fae802c2534285229927bef351ad7a7...68a9fdab3a3093c9911840d78b71de24e1b66fd9)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index cfec46b36..68a9fdab3 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit cfec46b36fae802c2534285229927bef351ad7a7
+Subproject commit 68a9fdab3a3093c9911840d78b71de24e1b66fd9

From c1b6cc3a245c45e7b978acc113d6dd753670603f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 9 Mar 2024 16:38:40 +0000
Subject: [PATCH 051/373] Bump external/libbtf from `604e8bc` to `07e30bd`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `604e8bc` to `07e30bd`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/604e8bc8889060a4ab985afc7310cb701540124e...07e30bde8e12857694061dc2c6aea247d640615d)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 604e8bc88..07e30bde8 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 604e8bc8889060a4ab985afc7310cb701540124e
+Subproject commit 07e30bde8e12857694061dc2c6aea247d640615d

From 6d092f4a9b02967ecd1b3c0da5d826c75385bc2e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 9 Mar 2024 16:38:43 +0000
Subject: [PATCH 052/373] Bump external/bpf_conformance from `68a9fda` to
 `6356e3e`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `68a9fda` to `6356e3e`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/68a9fdab3a3093c9911840d78b71de24e1b66fd9...6356e3ee03b2c1a70fd6839a85713974bab999b3)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 68a9fdab3..6356e3ee0 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 68a9fdab3a3093c9911840d78b71de24e1b66fd9
+Subproject commit 6356e3ee03b2c1a70fd6839a85713974bab999b3

From fe59c86c51091f5449409c2326eae7d257d36277 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 14 Mar 2024 19:28:20 +0200
Subject: [PATCH 053/373] Update .clang-format

---
 .clang-format | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.clang-format b/.clang-format
index ad34e5d80..09976dd24 100644
--- a/.clang-format
+++ b/.clang-format
@@ -4,6 +4,6 @@ AlwaysBreakTemplateDeclarations: Yes
 AllowShortCaseLabelsOnASingleLine: true
 PointerAlignment: Left
 AlignEscapedNewlines: Left
-#BreakAfterAttributes: Always
+BreakAfterAttributes: Always
 PenaltyReturnTypeOnItsOwnLine: 60
 AlwaysBreakAfterReturnType: None

From a7c4cfc09be30bd6573e285c6573622752f84fd5 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 14 Mar 2024 15:37:39 -0700
Subject: [PATCH 054/373] add other atomic instructions (#558)

Fixes #483
* Fast path for atomic operations on shared memory
---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_cfg.cpp               |   2 +-
 src/asm_marshal.cpp           |  15 +-
 src/asm_ostream.cpp           |  18 +-
 src/asm_ostream.hpp           |   2 +-
 src/asm_parse.cpp             |  18 +-
 src/asm_syntax.hpp            |  21 +-
 src/asm_unmarshal.cpp         |  34 +-
 src/assertions.cpp            |  10 +-
 src/crab/ebpf_domain.cpp      |  65 +++-
 src/crab/ebpf_domain.hpp      |   2 +-
 src/ebpf_vm_isa.hpp           |  20 +-
 src/test/test_conformance.cpp |  40 +--
 src/test/test_marshal.cpp     |  25 +-
 src/test/test_yaml.cpp        |   1 +
 test-data/atomic.yaml         | 578 ++++++++++++++++++++++++++++++++++
 15 files changed, 788 insertions(+), 63 deletions(-)
 create mode 100644 test-data/atomic.yaml

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 1b37a4328..b67e87921 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -178,7 +178,7 @@ static std::string instype(Instruction ins) {
         return "callx";
     } else if (std::holds_alternative<Mem>(ins)) {
         return std::get<Mem>(ins).is_load ? "load" : "store";
-    } else if (std::holds_alternative<LockAdd>(ins)) {
+    } else if (std::holds_alternative<Atomic>(ins)) {
         return "load_store";
     } else if (std::holds_alternative<Packet>(ins)) {
         return "packet_access";
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index a80f20345..5e7f015e7 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -219,7 +219,7 @@ struct MarshalVisitor {
     vector<ebpf_inst> operator()(Mem const& b) {
         Deref access = b.access;
         ebpf_inst res{
-            .opcode = static_cast<uint8_t>((INST_MEM << 5) | width_to_opcode(access.width)),
+            .opcode = static_cast<uint8_t>(INST_MODE_MEM | width_to_opcode(access.width)),
             .dst = 0,
             .src = 0,
             .offset = static_cast<int16_t>(access.offset),
@@ -253,21 +253,24 @@ struct MarshalVisitor {
             .imm = static_cast<int32_t>(b.offset),
         };
         if (b.regoffset) {
-            res.opcode |= (INST_IND << 5);
+            res.opcode |= INST_MODE_IND;
             res.src = b.regoffset->v;
         } else {
-            res.opcode |= (INST_ABS << 5);
+            res.opcode |= INST_MODE_ABS;
         }
         return {res};
     }
 
-    vector<ebpf_inst> operator()(LockAdd const& b) {
+    vector<ebpf_inst> operator()(Atomic const& b) {
+        int32_t imm = (int32_t)b.op;
+        if (b.fetch)
+            imm |= INST_FETCH;
         return {ebpf_inst{
-            .opcode = static_cast<uint8_t>(INST_CLS_ST | 0x1 | (INST_XADD << 5) | width_to_opcode(b.access.width)),
+            .opcode = static_cast<uint8_t>(INST_CLS_STX | INST_MODE_ATOMIC | width_to_opcode(b.access.width)),
             .dst = b.access.basereg.v,
             .src = b.valreg.v,
             .offset = static_cast<int16_t>(b.access.offset),
-            .imm = 0}};
+            .imm = imm}};
     }
 
     vector<ebpf_inst> operator()(IncrementLoopCounter const& ins) {
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 66e8f1991..283bece2d 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -328,10 +328,24 @@ struct InstructionPrinterVisitor {
         }
     }
 
-    void operator()(LockAdd const& b) {
+    void operator()(Atomic const& b) {
         os_ << "lock ";
         print(b.access);
-        os_ << " += " << b.valreg;
+        os_ << " ";
+        bool showfetch = true;
+        switch (b.op) {
+        case Atomic::Op::ADD: os_ << "+"; break;
+        case Atomic::Op::OR : os_ << "|"; break;
+        case Atomic::Op::AND: os_ << "&"; break;
+        case Atomic::Op::XOR: os_ << "^"; break;
+        case Atomic::Op::XCHG: os_ << "x"; showfetch = false; break;
+        case Atomic::Op::CMPXCHG: os_ << "cx"; showfetch = false; break;
+        }
+        os_ << "= " << b.valreg;
+
+        if (showfetch && b.fetch) {
+            os_ << " fetch";
+        }
     }
 
     void operator()(Assume const& b) {
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index 31af5d63c..e51842cad 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -59,7 +59,7 @@ inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os <<
 inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, LockAdd const& a) { return os << (Instruction)a; }
+inline std::ostream& operator<<(std::ostream& os, Atomic const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << (Instruction)a; }
 inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) { return os << (Instruction)a; }
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index a6e00d89b..474446fbd 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -34,6 +34,7 @@ using crab::linear_expression_t;
 #define ASSIGN R"_(\s*=\s*)_"
 #define LONGLONG R"_(\s*(ll|)\s*)_"
 #define UNOP R"_((-|be16|be32|be64|le16|le32|le64|swap16|swap32|swap64))_"
+#define ATOMICOP R"_((\+|\||&|\^|x|cx)=)_"
 
 #define PLUSMINUS R"_((\s*[+-])\s*)_"
 #define LPAREN R"_(\s*\(\s*)_"
@@ -81,6 +82,14 @@ static const std::map<std::string, Condition::Op> str_to_cmpop = {
     {"s<", Condition::Op::SLT}, {"s<=", Condition::Op::SLE}, {"s>", Condition::Op::SGT},  {"s>=", Condition::Op::SGE},
 };
 
+static const std::map<std::string, Atomic::Op> str_to_atomicop = {
+    {"+", Atomic::Op::ADD},
+    {"|", Atomic::Op::OR},
+    {"&", Atomic::Op::AND},
+    {"^", Atomic::Op::XOR},
+    {"x", Atomic::Op::XCHG},
+    {"cx", Atomic::Op::CMPXCHG}};
+
 static const std::map<std::string, int> str_to_width = {
     {"8", 1},
     {"16", 2},
@@ -182,8 +191,13 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
             .is_load = false,
         };
     }
-    if (regex_match(text, m, regex("lock " DEREF PAREN(REG PLUSMINUS IMM) " [+]= " REG))) {
-        return LockAdd{.access = deref(m[1], m[2], m[3], m[4]), .valreg = reg(m[5])};
+    if (regex_match(text, m, regex("lock " DEREF PAREN(REG PLUSMINUS IMM) " " ATOMICOP " " REG "( fetch)?"))) {
+        Atomic::Op op = str_to_atomicop.at(m[5]);
+        return Atomic{
+            .op = op,
+            .fetch = m[7].matched || op == Atomic::Op::XCHG || op == Atomic::Op::CMPXCHG,
+            .access = deref(m[1], m[2], m[3], m[4]),
+            .valreg = reg(m[6])};
     }
     if (regex_match(text, m, regex("r0 = " DEREF "skb\\[(.*)\\]"))) {
         auto width = str_to_width.at(m[1]);
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index f37f141bd..f98e6dc31 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -235,11 +235,24 @@ struct Packet {
     constexpr bool operator==(const Packet&) const = default;
 };
 
-/// Special instruction for incrementing values inside shared memory.
-struct LockAdd {
+/// Special instruction for atomically updating values inside shared memory.
+/// The analysis just treats an atomic operation as a series of consecutive
+/// operations, and the atomicity itself is not significant.
+struct Atomic {
+    enum class Op {
+        ADD = 0x00,
+        OR = 0x40,
+        AND = 0x50,
+        XOR = 0xa0,
+        XCHG = 0xe0,    // Only valid with fetch=true.
+        CMPXCHG = 0xf0, // Only valid with fetch=true.
+    };
+
+    Op op;
+    bool fetch{};
     Deref access;
     Reg valreg;
-    constexpr bool operator==(const LockAdd&) const = default;
+    constexpr bool operator==(const Atomic&) const = default;
 };
 
 /// Not an instruction, just used for failure cases.
@@ -365,7 +378,7 @@ struct IncrementLoopCounter {
     constexpr bool operator==(const IncrementLoopCounter&) const = default;
 };
 
-using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Callx, Exit, Jmp, Mem, Packet, LockAdd, Assume, Assert, IncrementLoopCounter>;
+using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Callx, Exit, Jmp, Mem, Packet, Atomic, Assume, Assert, IncrementLoopCounter>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index b6ad9b670..71232c936 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -177,6 +177,21 @@ struct Unmarshaller {
         return {};
     }
 
+    auto getAtomicOp(size_t pc, ebpf_inst inst) -> Atomic::Op {
+        Atomic::Op op = (Atomic::Op)(inst.imm & ~INST_FETCH);
+        switch (op) {
+        case Atomic::Op::XCHG:
+        case Atomic::Op::CMPXCHG:
+            if ((inst.imm & INST_FETCH) == 0)
+                throw InvalidInstruction(pc, "unsupported immediate");
+        case Atomic::Op::ADD:
+        case Atomic::Op::OR:
+        case Atomic::Op::AND:
+        case Atomic::Op::XOR: return op;
+        }
+        throw InvalidInstruction(pc, "unsupported immediate");
+    }
+
     uint64_t sign_extend(int32_t imm) { return (uint64_t)(int64_t)imm; }
 
     uint64_t zero_extend(int32_t imm) { return (uint64_t)(uint32_t)imm; }
@@ -223,9 +238,10 @@ struct Unmarshaller {
 
         int width = getMemWidth(inst.opcode);
         bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
-        switch ((inst.opcode & INST_MODE_MASK) >> 5) {
-        case 0: throw InvalidInstruction(pc, inst.opcode);
-        case INST_ABS:
+        switch (inst.opcode & INST_MODE_MASK) {
+        case INST_MODE_IMM:
+            throw InvalidInstruction(pc, inst.opcode);
+        case INST_MODE_ABS:
             if (!info.platform->legacy || !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.dst != 0)
@@ -236,7 +252,7 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Packet{.width = width, .offset = inst.imm, .regoffset = {}};
 
-        case INST_IND:
+        case INST_MODE_IND:
             if (!info.platform->legacy || !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.dst != 0)
@@ -247,7 +263,7 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Packet{.width = width, .offset = inst.imm, .regoffset = Reg{inst.src}};
 
-        case INST_MEM: {
+        case INST_MODE_MEM: {
             if (isLD)
                 throw InvalidInstruction(pc, inst.opcode);
             bool isLoad = getMemIsLoad(inst.opcode);
@@ -279,14 +295,14 @@ struct Unmarshaller {
             return res;
         }
 
-        case INST_XADD:
+        case INST_MODE_ATOMIC:
             if (((inst.opcode & INST_CLS_MASK) != INST_CLS_STX) ||
                 ((inst.opcode & INST_SIZE_MASK) != INST_SIZE_W &&
                  (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW))
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.imm != 0)
-                throw InvalidInstruction(pc, "unsupported immediate");
-            return LockAdd{
+            return Atomic{
+                .op = getAtomicOp(pc, inst),
+                .fetch = (inst.imm & INST_FETCH) == INST_FETCH,
                 .access =
                     Deref{
                         .width = width,
diff --git a/src/assertions.cpp b/src/assertions.cpp
index d760a5420..c3e090134 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -170,11 +170,17 @@ class AssertExtractor {
         return res;
     }
 
-    vector<Assert> operator()(LockAdd ins) const {
+    vector<Assert> operator()(Atomic ins) const {
         vector<Assert> res;
-        res.emplace_back(TypeConstraint{ins.access.basereg, TypeGroup::shared});
+        res.emplace_back(TypeConstraint{ins.access.basereg, TypeGroup::pointer});
         res.emplace_back(ValidAccess{ins.access.basereg, ins.access.offset,
                                      Imm{static_cast<uint32_t>(ins.access.width)}, false});
+        if (ins.op == Atomic::Op::CMPXCHG) {
+            // The memory contents pointed to by ins.access will be compared
+            // against the value of the ins.valreg register.  Only numbers are
+            // supported.
+            res.emplace_back(TypeConstraint{ins.valreg, TypeGroup::number});
+        }
         return res;
     }
 
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index f0b06bcc1..a8c9e1f01 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2154,8 +2154,69 @@ void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue,
     });
 }
 
-void ebpf_domain_t::operator()(const LockAdd& a) {
-    // nothing to do here
+// Construct a Bin operation that does the main operation that a given Atomic operation does atomically.
+static Bin atomic_to_bin(const Atomic& a) {
+    Bin bin{
+        .dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = (a.access.width == sizeof(uint64_t)), .lddw = false};
+    switch (a.op) {
+    case Atomic::Op::ADD: bin.op = Bin::Op::ADD; break;
+    case Atomic::Op::OR: bin.op = Bin::Op::OR; break;
+    case Atomic::Op::AND: bin.op = Bin::Op::AND; break;
+    case Atomic::Op::XOR: bin.op = Bin::Op::XOR; break;
+    case Atomic::Op::XCHG:
+    case Atomic::Op::CMPXCHG: bin.op = Bin::Op::MOV; break;
+    default: throw std::exception();
+    }
+    return bin;
+}
+
+void ebpf_domain_t::operator()(const Atomic& a) {
+    if (m_inv.is_bottom())
+        return;
+    if (!m_inv.entail(type_is_pointer(reg_pack(a.access.basereg))) ||
+        !m_inv.entail(type_is_number(reg_pack(a.valreg)))) {
+        return;
+    }
+    if (m_inv.entail(type_is_not_stack(reg_pack(a.access.basereg)))) {
+        // Shared memory regions are volatile so we can just havoc
+        // any register that will be updated.
+        if (a.op == Atomic::Op::CMPXCHG)
+            havoc_register(m_inv, Reg{R0_RETURN_VALUE});
+        else if (a.fetch)
+            havoc_register(m_inv, a.valreg);
+        return;
+    }
+
+    // Fetch the current value into the R11 pseudo-register.
+    const Reg r11{R11_ATOMIC_SCRATCH};
+    (*this)(Mem{.access = a.access, .value = r11, .is_load = true});
+
+    // Compute the new value in R11.
+    (*this)(atomic_to_bin(a));
+
+    if (a.op == Atomic::Op::CMPXCHG) {
+        // For CMPXCHG, store the original value in r0.
+        (*this)(Mem{.access = a.access, .value = Reg{R0_RETURN_VALUE}, .is_load = true});
+
+        // For the destination, there are 3 possibilities:
+        // 1) dst.value == r0.value : set R11 to valreg
+        // 2) dst.value != r0.value : don't modify R11
+        // 3) dst.value may or may not == r0.value : set R11 to the union of R11 and valreg
+        // For now we just havoc the value of R11.
+        havoc_register(m_inv, r11);
+    } else if (a.fetch) {
+        // For other FETCH operations, store the original value in the src register.
+        (*this)(Mem{.access = a.access, .value = a.valreg, .is_load = true});
+    }
+
+    // Store the new value back in the original shared memory location.
+    // Note that do_mem_store() currently doesn't track shared memory values,
+    // but stack memory values are tracked and are legal here.
+    (*this)(Mem{.access = a.access, .value = r11, .is_load = false});
+
+    // Clear the R11 pseudo-register.
+    havoc_register(m_inv, r11);
+    type_inv.havoc_type(m_inv, r11);
 }
 
 void ebpf_domain_t::operator()(const Call& call) {
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index efc2dabc8..39f11e73b 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -67,7 +67,7 @@ class ebpf_domain_t final {
     void operator()(const FuncConstraint&);
     void operator()(const Jmp&);
     void operator()(const LoadMapFd&);
-    void operator()(const LockAdd&);
+    void operator()(const Atomic&);
     void operator()(const Mem&);
     void operator()(const ValidDivisor&);
     void operator()(const Packet&);
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 1b60c8478..8af2b2503 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -45,16 +45,19 @@ enum {
 
     INST_MODE_MASK = 0xe0,
 
-    INST_ABS = 1, // Deprecated
-    INST_IND = 2, // Deprecated
-    INST_MEM = 3,
-    INST_LEN = 4,
-    INST_MSH = 5,
-    INST_XADD = 6,
-    INST_MEM_UNUSED = 7,
+    INST_MODE_IMM = 0x00, // 64-bit immediate instructions
+    INST_MODE_ABS = 0x20, // legacy BPF packet access (absolute)
+    INST_MODE_IND = 0x40, // legacy BPF packet access (indirect)
+    INST_MODE_MEM = 0x60, // regular load and store operations
+    INST_MODE_MEMSX = 0x80, // sign-extension load operations
+    INST_MODE_UNUSED1 = 0xa0,
+    INST_MODE_ATOMIC = 0xc0, // atomic operations
+    INST_MODE_UNUSED2 = 0xe0,
 
     INST_OP_LDDW_IMM = (INST_CLS_LD | INST_SRC_IMM | INST_SIZE_DW), // Special
 
+    INST_FETCH = 0x1,
+
     INST_JA = 0x0,
     INST_CALL = 0x8,
     INST_EXIT = 0x9,
@@ -91,7 +94,8 @@ enum {
     R7 = 7,
     R8 = 8,
     R9 = 9,
-    R10_STACK_POINTER = 10
+    R10_STACK_POINTER = 10,
+    R11_ATOMIC_SCRATCH = 11, // Pseudo-register used internally for atomic instructions.
 };
 
 int opcode_to_width(uint8_t opcode);
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index 7474d7257..b1f2dce57 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -149,26 +149,26 @@ TEST_CONFORMANCE("ldxw.data")
 TEST_CONFORMANCE("le16.data")
 TEST_CONFORMANCE("le32.data")
 TEST_CONFORMANCE("le64.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_add.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_add32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_and.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_and32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_cmpxchg.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_cmpxchg32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_add.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_add32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_and.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_and32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_or.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_or32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_xor.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_fetch_xor32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_or.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_or32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_xchg.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_xchg32.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_xor.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("lock_xor32.data")
+TEST_CONFORMANCE("lock_add.data")
+TEST_CONFORMANCE_RANGE("lock_add32.data", "[0, 1311768467463790321]")
+TEST_CONFORMANCE("lock_and.data")
+TEST_CONFORMANCE_TOP("lock_and32.data")
+TEST_CONFORMANCE_TOP("lock_cmpxchg.data")
+TEST_CONFORMANCE_TOP("lock_cmpxchg32.data")
+TEST_CONFORMANCE("lock_fetch_add.data")
+TEST_CONFORMANCE_RANGE("lock_fetch_add32.data", "[0, 1311768467463790321]")
+TEST_CONFORMANCE("lock_fetch_and.data")
+TEST_CONFORMANCE_TOP("lock_fetch_and32.data")
+TEST_CONFORMANCE("lock_fetch_or.data")
+TEST_CONFORMANCE_TOP("lock_fetch_or32.data")
+TEST_CONFORMANCE("lock_fetch_xor.data")
+TEST_CONFORMANCE_TOP("lock_fetch_xor32.data")
+TEST_CONFORMANCE("lock_or.data")
+TEST_CONFORMANCE_TOP("lock_or32.data")
+TEST_CONFORMANCE("lock_xchg.data")
+TEST_CONFORMANCE("lock_xchg32.data")
+TEST_CONFORMANCE("lock_xor.data")
+TEST_CONFORMANCE_TOP("lock_xor32.data")
 TEST_CONFORMANCE("lsh32-imm.data")
 TEST_CONFORMANCE("lsh32-imm-high.data")
 TEST_CONFORMANCE("lsh32-imm-neg.data")
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index c3ff87c30..02ee4c4ff 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -434,11 +434,26 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
         }
     }
 
-    SECTION("LockAdd") {
+    SECTION("Atomic") {
         for (int w : ws) {
             if (w == 4 || w == 8) {
                 Deref access{.width = w, .basereg = Reg{2}, .offset = 17};
-                compare_marshal_unmarshal(LockAdd{.access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::ADD, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::ADD, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::OR, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::OR, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::AND, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::AND, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XOR, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XOR, .fetch = true, .access = access, .valreg = Reg{1}});
+                check_marshal_unmarshal_fail(
+                    Atomic{.op = Atomic::Op::XCHG, .fetch = false, .access = access, .valreg = Reg{1}},
+                    "0: unsupported immediate\n");
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XCHG, .fetch = true, .access = access, .valreg = Reg{1}});
+                check_marshal_unmarshal_fail(
+                    Atomic{.op = Atomic::Op::CMPXCHG, .fetch = false, .access = access, .valreg = Reg{1}},
+                    "0: unsupported immediate\n");
+                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::CMPXCHG, .fetch = true, .access = access, .valreg = Reg{1}});
             }
         }
     }
@@ -450,7 +465,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
         Mem m{.access = access, .value = Reg{3}, .is_load = true};
         auto ins = marshal(m, 0).at(0);
         ebpf_inst expect{
-            .opcode = (uint8_t)(INST_CLS_LD | (INST_MEM << 5) | width_to_opcode(1) | 0x1),
+            .opcode = (uint8_t)(INST_CLS_LD | INST_MODE_MEM | width_to_opcode(1) | 0x1),
             .dst = 3,
             .src = 4,
             .offset = 6,
@@ -473,7 +488,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
         REQUIRE(ins.dst == 4);
         REQUIRE(ins.offset == 6);
         REQUIRE(ins.imm == 0);
-        REQUIRE(ins.opcode == (uint8_t)(INST_CLS_ST | (INST_MEM << 5) | width_to_opcode(1) | 0x1));
+        REQUIRE(ins.opcode == (uint8_t)(INST_CLS_ST | INST_MODE_MEM | width_to_opcode(1) | 0x1));
     }
     SECTION("StoreImm") {
         Deref access{.width = 1, .basereg = Reg{4}, .offset = 6};
@@ -482,7 +497,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
         REQUIRE(ins.dst == 4);
         REQUIRE(ins.offset == 6);
         REQUIRE(ins.imm == 3);
-        REQUIRE(ins.opcode == (uint8_t)(INST_CLS_ST | (INST_MEM << 5) | width_to_opcode(1) | 0x0));
+        REQUIRE(ins.opcode == (uint8_t)(INST_CLS_ST | INST_MODE_MEM | width_to_opcode(1) | 0x0));
     }
 }
 
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index f94b598d0..da124a8bf 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -21,6 +21,7 @@
 
 YAML_CASE("test-data/add.yaml")
 YAML_CASE("test-data/assign.yaml")
+YAML_CASE("test-data/atomic.yaml")
 YAML_CASE("test-data/bitop.yaml")
 YAML_CASE("test-data/call.yaml")
 YAML_CASE("test-data/callx.yaml")
diff --git a/test-data/atomic.yaml b/test-data/atomic.yaml
new file mode 100644
index 000000000..2e4787ef3
--- /dev/null
+++ b/test-data/atomic.yaml
@@ -0,0 +1,578 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: atomic 32-bit ADD shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit ADD and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit ADD shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit ADD and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) += r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit AND shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) &= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit AND and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) &= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit AND shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) &= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit AND and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) &= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit OR shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) |= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit OR and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) |= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit OR shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) |= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit OR and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) |= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit XOR shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) ^= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit XOR and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) ^= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit XOR shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) ^= r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit XOR and fetch shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) ^= r1 fetch
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit XCHG shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) x= r1
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit XCHG shared
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) x= r1
+
+post: ["r1.type=number",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit CMPXCHG shared
+
+pre: ["r0.type=number", "r0.svalue=1", "r0.uvalue=1",
+      "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) cx= r1
+
+post: ["r0.type=number",
+       "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=12", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 64-bit CMPXCHG shared
+
+pre: ["r0.type=number", "r0.svalue=2", "r0.uvalue=2",
+      "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) cx= r1
+
+post: ["r0.type=number",
+       "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+---
+test-case: atomic 32-bit ADD past end of shared region
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=shared", "r2.shared_region_size=10", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=shared", "r2.shared_region_size=10", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+messages:
+  - "0: Upper bound must be at most r2.shared_region_size (valid_access(r2.offset+4, width=4) for write)"
+---
+test-case: atomic 32-bit ADD stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
+---
+test-case: atomic 32-bit ADD and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1 fetch
+
+post: ["r1.type=number", "r1.svalue=1", "r1.uvalue=1",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
+---
+test-case: atomic 64-bit ADD stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
+---
+test-case: atomic 64-bit ADD and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) += r1 fetch
+
+post: ["r1.type=number", "r1.svalue=1", "r1.uvalue=1",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
+---
+test-case: atomic 32-bit AND stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) &= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+---
+test-case: atomic 32-bit AND and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) &= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+---
+test-case: atomic 64-bit AND stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) &= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+---
+test-case: atomic 64-bit AND and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) &= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+---
+test-case: atomic 32-bit OR stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) |= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
+---
+test-case: atomic 32-bit OR and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) |= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
+---
+test-case: atomic 64-bit OR stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) |= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
+---
+test-case: atomic 64-bit OR and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) |= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
+---
+test-case: atomic 32-bit XOR stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) ^= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
+---
+test-case: atomic 32-bit XOR and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) ^= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
+---
+test-case: atomic 64-bit XOR stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) ^= r1
+
+post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
+---
+test-case: atomic 64-bit XOR and fetch stack
+
+pre: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) ^= r1 fetch
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
+---
+test-case: atomic 32-bit XCHG stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=5", "s[4...7].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) x= r1
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=2", "s[4...7].uvalue=2"]
+---
+test-case: atomic 64-bit XCHG stack
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=5", "s[4...11].uvalue=5"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) x= r1
+
+post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=2", "s[4...11].uvalue=2"]
+---
+test-case: atomic 32-bit CMPXCHG stack
+
+pre: ["r0.type=number", "r0.svalue=1", "r0.uvalue=1",
+      "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) cx= r1
+
+post: ["r0.type=number", "r0.svalue=1", "r0.uvalue=1",
+       "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number"]
+---
+test-case: atomic 64-bit CMPXCHG stack
+
+pre: ["r0.type=number", "r0.svalue=1", "r0.uvalue=1",
+      "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) cx= r1
+
+post: ["r0.type=number", "r0.svalue=1", "r0.uvalue=1",
+       "r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number"]
+---
+test-case: atomic 32-bit ADD to non-pointer space
+
+pre: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=number", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u32 *)(r2 + 4) += r1
+
+post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
+      "r2.type=number", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+messages:
+  - "0: Invalid type (r2.type in {ctx, stack, packet, shared})"
+  - "0: Only pointers can be dereferenced (valid_access(r2.offset+4, width=4) for write)"
+---
+test-case: atomic 64-bit CMPXCHG comparing against non-number
+
+pre: ["r0.type=number", "r0.svalue=2", "r0.uvalue=2",
+      "r1.type=shared", "r1.shared_region_size=16", "r1.shared_offset=4",
+      "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+code:
+  <start>: |
+    lock *(u64 *)(r2 + 4) cx= r1
+
+post: ["r0.type=number", "r0.svalue=2", "r0.uvalue=2",
+       "r1.type=shared", "r1.shared_region_size=16", "r1.shared_offset=4",
+       "r2.type=shared", "r2.shared_region_size=16", "r2.shared_offset=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+
+messages:
+  - "0: Invalid type (r1.type == number)"

From 856817629ba7d719bfb25ed11afd1654bec40284 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 16 Mar 2024 16:40:29 +0000
Subject: [PATCH 055/373] Bump external/libbtf from `07e30bd` to `fdd2121`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `07e30bd` to `fdd2121`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/07e30bde8e12857694061dc2c6aea247d640615d...fdd21218051415d7a974ae4bc449aa5da6f7b998)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 07e30bde8..fdd212180 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 07e30bde8e12857694061dc2c6aea247d640615d
+Subproject commit fdd21218051415d7a974ae4bc449aa5da6f7b998

From fbd98b0ea33e8537eddc8cd8c667bbde31ba25f3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 16 Mar 2024 16:40:27 +0000
Subject: [PATCH 056/373] Bump external/bpf_conformance from `6356e3e` to
 `22b6df4`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `6356e3e` to `22b6df4`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/6356e3ee03b2c1a70fd6839a85713974bab999b3...22b6df461372f4b736c6b042c836ef73323c8a3a)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 6356e3ee0..22b6df461 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 6356e3ee03b2c1a70fd6839a85713974bab999b3
+Subproject commit 22b6df461372f4b736c6b042c836ef73323c8a3a

From e7b9e90dff34b5c4d055c206341635fc2f0cf199 Mon Sep 17 00:00:00 2001
From: Jorge Navas <navasjorgea@gmail.com>
Date: Fri, 7 Jan 2022 19:27:09 +0100
Subject: [PATCH 057/373] refactor: added stubs for a proof generator

 Author:    Jorge Navas <navasjorgea@gmail.com>
 Date:      Fri Jan 7 19:27:09 2022 +0100
---
 src/crab_verifier.cpp    | 59 +++++++++++++---------------------------
 src/crab_verifier.hpp    | 55 ++++++++++++++++++++++++++++++++++++-
 src/ebpf_proof.cpp       | 25 +++++++++++++++++
 src/ebpf_proof.hpp       | 19 +++++++++++++
 src/main/check.cpp       | 17 +++++++++---
 src/main/utils.hpp       |  4 +--
 src/test/test_verify.cpp |  6 ++--
 7 files changed, 135 insertions(+), 50 deletions(-)
 create mode 100644 src/ebpf_proof.cpp
 create mode 100644 src/ebpf_proof.hpp

diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 3d5d33f31..cdee1e9cf 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -26,36 +26,8 @@ using std::string;
 thread_local crab::lazy_allocator<program_info> global_program_info;
 thread_local ebpf_verifier_options_t thread_local_options;
 
-// Toy database to store invariants.
-struct checks_db final {
-    std::map<label_t, std::vector<std::string>> m_db{};
-    int total_warnings{};
-    int total_unreachable{};
-    crab::bound_t max_loop_count{crab::number_t{0}};
-
-    void add(const label_t& label, const std::string& msg) { m_db[label].emplace_back(msg); }
-
-    void add_warning(const label_t& label, const std::string& msg) {
-        add(label, msg);
-        total_warnings++;
-    }
-
-    void add_unreachable(const label_t& label, const std::string& msg) {
-        add(label, msg);
-        total_unreachable++;
-    }
-
-    [[nodiscard]] int get_max_loop_count() const {
-        auto m = this->max_loop_count.number();
-        if (m && m->fits_sint32())
-            return m->cast_to_sint32();
-        else
-            return std::numeric_limits<int>::max();
-    }
-    checks_db() = default;
-};
-
-static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invariants,
+static checks_db generate_report(cfg_t& cfg,
+                                 crab::invariant_table_t& pre_invariants,
                                  crab::invariant_table_t& post_invariants) {
     checks_db m_db;
     for (const label_t& label : cfg.sorted_labels()) {
@@ -142,8 +114,7 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invarian
     return db;
 }
 
-static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
-                                 const ebpf_verifier_options_t* options) {
+crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, const ebpf_verifier_options_t* options) {
     global_program_info = std::move(info);
     crab::domains::clear_global_state();
     crab::variable_t::clear_thread_local_state();
@@ -152,13 +123,19 @@ static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
     try {
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         ebpf_domain_t entry_dom = ebpf_domain_t::setup_entry(true);
-        auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_dom));
-        return get_analysis_report(s, cfg, pre_invariants, post_invariants);
+        auto [pre_invariants, post_invariants] =
+            crab::run_forward_analyzer(cfg, std::move(entry_dom));
+        return crab_results(std::move(cfg),
+			    std::move(pre_invariants), std::move(post_invariants),
+			    std::move(get_analysis_report(s, cfg, pre_invariants, post_invariants)));
     } catch (std::runtime_error& e) {
         // Convert verifier runtime_error exceptions to failure.
         checks_db db;
         db.add_warning(label_t::exit, e.what());
-        return db;
+        crab::invariant_table_t pre_invariants, post_invariants;
+        return crab_results(std::move(cfg),
+			    std::move(pre_invariants), std::move(post_invariants),
+			    std::move(db));
     }
 }
 
@@ -167,7 +144,7 @@ bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, co
                        ebpf_verifier_stats_t* stats) {
     if (options == nullptr)
         options = &ebpf_verifier_default_options;
-    checks_db report = get_ebpf_report(s, cfg, info, options);
+    checks_db report = get_ebpf_report(s, cfg, info, options).db;
     if (stats) {
         stats->total_unreachable = report.total_unreachable;
         stats->total_warnings = report.total_warnings;
@@ -208,8 +185,8 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
 }
 
 /// Returned value is true if the program passes verification.
-bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const program_info& info,
-                         const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats) {
+crab_results ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const program_info& info,
+				 const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats) {
     if (options == nullptr)
         options = &ebpf_verifier_default_options;
 
@@ -217,7 +194,8 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
     // in a "passive", non-deterministic form.
     cfg_t cfg = prepare_cfg(prog, info, !options->no_simplify);
 
-    checks_db report = get_ebpf_report(os, cfg, info, options);
+    crab_results results = get_ebpf_report(os, cfg, info, options);
+    checks_db &report = results.db;
     if (options->print_failures) {
         print_report(os, report, prog, options->print_line_info);
     }
@@ -226,7 +204,8 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
         stats->total_warnings = report.total_warnings;
         stats->max_loop_count = report.get_max_loop_count();
     }
-    return (report.total_warnings == 0);
+    //return (report.total_warnings == 0);
+    return results;
 }
 
 void ebpf_verifier_clear_thread_local_state() {
diff --git a/src/crab_verifier.hpp b/src/crab_verifier.hpp
index 1709104ae..1e64f8e79 100644
--- a/src/crab_verifier.hpp
+++ b/src/crab_verifier.hpp
@@ -4,13 +4,66 @@
 
 #include "config.hpp"
 #include "crab/cfg.hpp"
+#include "crab/fwd_analyzer.hpp"
 #include "spec_type_descriptors.hpp"
 #include "string_constraints.hpp"
 
+#include <set>
+#include <map>
+
+// Toy database to store invariants.
+// Temporary moved here but it's better to hide it again in crab_verifier.cpp
+struct checks_db final {
+    std::map<label_t, std::vector<std::string>> m_db{};
+    int total_warnings{};
+    int total_unreachable{};
+    crab::bound_t max_loop_count{crab::number_t{0}};
+
+    void add(const label_t& label, const std::string& msg) { m_db[label].emplace_back(msg); }
+
+    void add_warning(const label_t& label, const std::string& msg) {
+        add(label, msg);
+        total_warnings++;
+    }
+
+    void add_unreachable(const label_t& label, const std::string& msg) {
+        add(label, msg);
+        total_unreachable++;
+    }
+
+    [[nodiscard]] int get_max_loop_count() const {
+        auto m = this->max_loop_count.number();
+        if (m && m->fits_sint32())
+            return m->cast_to_sint32();
+        else
+            return std::numeric_limits<int>::max();
+    }
+    checks_db() = default;
+};
+
+struct crab_results {
+  crab::cfg_t cfg;
+  crab::invariant_table_t pre_invariants;
+  crab::invariant_table_t post_invariants;
+  checks_db db;
+
+  crab_results(cfg_t &&_cfg,
+	       crab::invariant_table_t &&pre, crab::invariant_table_t &&post,
+	       checks_db &&_db)
+    : cfg(std::move(_cfg)),
+      pre_invariants(std::move(pre)),
+      post_invariants(std::move(post)),
+      db(std::move(_db)) {}
+
+  bool pass_verify() const {
+    return db.total_warnings == 0;
+  }
+};
+
 bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, const ebpf_verifier_options_t* options,
     ebpf_verifier_stats_t* stats);
 
-bool ebpf_verify_program(
+crab_results ebpf_verify_program(
     std::ostream& s,
     const InstructionSeq& prog,
     const program_info& info,
diff --git a/src/ebpf_proof.cpp b/src/ebpf_proof.cpp
new file mode 100644
index 000000000..f6f6ba2d0
--- /dev/null
+++ b/src/ebpf_proof.cpp
@@ -0,0 +1,25 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#include "ebpf_proof.hpp"
+
+bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
+                         const ebpf_verifier_options_t* options, const crab_results& results) {
+    if (!results.pass_verify()) {
+        // If the program is not correct then we cannot generate a proof
+        return false;
+    }
+
+    /*
+      The goal is to translate results.pre_invariants and
+      results.post_invariants into types from our type system. For that,
+      we will need first to define all the C++ types/classes needed for
+      defining our type system (for pointer, checked_pointer, etc), and
+      then the conversion.
+
+      A type checker is not part of the proof but we should also
+      implement it so that we can be sure that our types are correct.
+     */
+
+    s << "TODO: proof\n";
+    return false;
+}
diff --git a/src/ebpf_proof.hpp b/src/ebpf_proof.hpp
new file mode 100644
index 000000000..65e479758
--- /dev/null
+++ b/src/ebpf_proof.hpp
@@ -0,0 +1,19 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "config.hpp"
+#include "crab/cfg.hpp"
+#include "crab_verifier.hpp"
+
+// - prog is a prevail representation of the eBPF program
+// - results contains the Crab CFG together with the inferred invariants
+//
+// Return true if proof is generated.
+//
+// TODO: we need to return also a proof object. We could take prog is
+// a non-const reference and add the types (i.e., our proof) as debug
+// symbols or metadata. However, note that InstructionSeq is a prevail
+// thing. Ultimately, we want to annotate eBPF bytecode with types.
+bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
+                         const ebpf_verifier_options_t* options, const crab_results& results);
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 887177c92..72ee1b2b8 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -8,6 +8,7 @@
 #include "CLI11.hpp"
 
 #include "ebpf_verifier.hpp"
+#include "ebpf_proof.hpp"
 #ifdef _WIN32
 #include "memsize_windows.hpp"
 #else
@@ -76,6 +77,9 @@ int main(int argc, char** argv) {
     app.add_flag("--line-info", ebpf_verifier_options.print_line_info, "Print line information");
     app.add_flag("--print-btf-types", ebpf_verifier_options.dump_btf_types_json, "Print BTF types");
 
+    bool gen_proof = false;
+    app.add_flag("--gen-proof", gen_proof, "Generate a proof if program is proven correct");
+
     std::string asmfile;
     app.add_option("--asm", asmfile, "Print disassembly to FILE")->type_name("FILE");
     std::string dotfile;
@@ -164,14 +168,19 @@ int main(int argc, char** argv) {
 
     if (domain == "zoneCrab") {
         ebpf_verifier_stats_t verifier_stats;
-        const auto [res, seconds] = timed_execution([&] {
+        auto [res, seconds] = timed_execution([&] {
             return ebpf_verify_program(std::cout, prog, raw_prog.info, &ebpf_verifier_options, &verifier_stats);
         });
-        if (res && ebpf_verifier_options.check_termination && (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
+        if (res.pass_verify() && ebpf_verifier_options.check_termination && (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
             std::cout << "Program terminates within " << verifier_stats.max_loop_count << " loop iterations\n";
         }
-        std::cout << res << "," << seconds << "," << resident_set_size_kb() << "\n";
-        return !res;
+        std::cout << res.pass_verify() << "," << seconds << "," << resident_set_size_kb() << "\n";
+
+	if (gen_proof) {
+	  ebpf_generate_proof(std::cout, prog, raw_prog.info, &ebpf_verifier_options, res);
+	}
+
+        return !res.pass_verify();
     } else if (domain == "linux") {
         // Pass the instruction sequence to the Linux kernel verifier.
         const auto [res, seconds] = bpf_verify_program(raw_prog.info.type, raw_prog.prog, &ebpf_verifier_options);
diff --git a/src/main/utils.hpp b/src/main/utils.hpp
index 97c05330e..4cefecb5b 100644
--- a/src/main/utils.hpp
+++ b/src/main/utils.hpp
@@ -5,10 +5,10 @@ template<typename F>
 auto timed_execution(F f) {
     clock_t begin = clock();
 
-    const auto& res = f();
+    auto res = f();
 
     clock_t end = clock();
 
     double elapsed_secs = double(end - begin) / CLOCKS_PER_SEC;
-    return std::make_tuple(res, elapsed_secs);
+    return std::make_tuple(std::move(res), elapsed_secs);
 }
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index bca93d05b..32f90054e 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -40,11 +40,11 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
         REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
         auto& prog = std::get<InstructionSeq>(prog_or_error); \
-        bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
+        crab_results res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
         if (pass)                                            \
-            REQUIRE(res);                                    \
+	  REQUIRE(res.pass_verify());			     \
         else                                                 \
-            REQUIRE(!res);                                   \
+	  REQUIRE(!res.pass_verify());			     \
     } while (0)
 
 #define TEST_SECTION(project, filename, section) \

From 2db3f30a4d016852968a6fc4d33e0bcfd74d4ca0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 27 Jun 2023 20:08:28 -0400
Subject: [PATCH 058/373] refactor: remove unused ebpf_domain_t::operator==

---
 src/crab/ebpf_domain.cpp | 6 +++---
 src/crab/ebpf_domain.hpp | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index a8c9e1f01..6d3cd51b7 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -814,9 +814,9 @@ bool ebpf_domain_t::is_top() const { return m_inv.is_top() && stack.is_top(); }
 
 bool ebpf_domain_t::operator<=(const ebpf_domain_t& other) { return m_inv <= other.m_inv && stack <= other.stack; }
 
-bool ebpf_domain_t::operator==(const ebpf_domain_t& other) const {
-    return stack == other.stack && m_inv <= other.m_inv && other.m_inv <= m_inv;
-}
+// bool ebpf_domain_t::operator==(const ebpf_domain_t& other) const {
+//     return stack == other.stack && m_inv <= other.m_inv && other.m_inv <= m_inv;
+// }
 
 void ebpf_domain_t::TypeDomain::add_extra_invariant(NumAbsDomain& dst,
                                                     std::map<crab::variable_t, crab::interval_t>& extra_invariants,
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 39f11e73b..85f49b762 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -34,7 +34,7 @@ class ebpf_domain_t final {
     [[nodiscard]] bool is_bottom() const;
     [[nodiscard]] bool is_top() const;
     bool operator<=(const ebpf_domain_t& other);
-    bool operator==(const ebpf_domain_t& other) const;
+    //bool operator==(const ebpf_domain_t& other) const;
     void operator|=(ebpf_domain_t&& other);
     void operator|=(const ebpf_domain_t& other);
     ebpf_domain_t operator|(ebpf_domain_t&& other) const;

From 82f48af9e35cada3f2778490a9482be0e5fc872c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 30 Mar 2024 16:19:14 +0000
Subject: [PATCH 059/373] Bump external/libbtf from `fdd2121` to `6e28ce2`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `fdd2121` to `6e28ce2`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/fdd21218051415d7a974ae4bc449aa5da6f7b998...6e28ce2813e6a9fe7d1448298ba058531dd81adb)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index fdd212180..6e28ce281 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit fdd21218051415d7a974ae4bc449aa5da6f7b998
+Subproject commit 6e28ce2813e6a9fe7d1448298ba058531dd81adb

From ede97b4c803792f95bb664d0eae8870753b0256c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 30 Mar 2024 16:19:10 +0000
Subject: [PATCH 060/373] Bump external/bpf_conformance from `22b6df4` to
 `73b6ea3`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `22b6df4` to `73b6ea3`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/22b6df461372f4b736c6b042c836ef73323c8a3a...73b6ea325b8b48ebdb17f2382c25ec38183154f8)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 22b6df461..73b6ea325 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 22b6df461372f4b736c6b042c836ef73323c8a3a
+Subproject commit 73b6ea325b8b48ebdb17f2382c25ec38183154f8

From affae64922c7536a7f301740d47a2952e2f488e5 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 31 Mar 2024 03:00:37 -0700
Subject: [PATCH 061/373] add support for conformance groups (#598)

Per https://datatracker.ietf.org/doc/draft-ietf-bpf-isa/
---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_unmarshal.cpp        |  75 +++++--
 src/ebpf_yaml.cpp            |   6 +-
 src/linux/linux_platform.cpp |   3 +-
 src/main/check.cpp           |  70 ++++++-
 src/platform.hpp             |   8 +-
 src/test/test_marshal.cpp    | 391 +++++++++++++++++++----------------
 src/test/test_verify.cpp     |   2 +-
 7 files changed, 350 insertions(+), 205 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 71232c936..d331b40d0 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -100,14 +100,21 @@ struct Unmarshaller {
 
     auto getAluOp(size_t pc, ebpf_inst inst) -> std::variant<Bin::Op, Un::Op> {
         // First handle instructions that support a non-zero offset.
+        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_DIV:
+            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
+                                                    : bpf_conformance_groups_t::divmul32))
+                throw InvalidInstruction(pc, inst.opcode);
             switch (inst.offset) {
             case 0: return Bin::Op::UDIV;
             case 1: return Bin::Op::SDIV;
             default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         case INST_ALU_OP_MOD:
+            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
+                                                    : bpf_conformance_groups_t::divmul32))
+                throw InvalidInstruction(pc, inst.opcode);
             switch (inst.offset) {
             case 0: return Bin::Op::UMOD;
             case 1: return Bin::Op::SMOD;
@@ -132,7 +139,11 @@ struct Unmarshaller {
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_ADD: return Bin::Op::ADD;
         case INST_ALU_OP_SUB: return Bin::Op::SUB;
-        case INST_ALU_OP_MUL: return Bin::Op::MUL;
+        case INST_ALU_OP_MUL:
+            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
+                                                    : bpf_conformance_groups_t::divmul32))
+                throw InvalidInstruction(pc, inst.opcode);
+            return Bin::Op::MUL;
         case INST_ALU_OP_OR: return Bin::Op::OR;
         case INST_ALU_OP_AND: return Bin::Op::AND;
         case INST_ALU_OP_LSH: return Bin::Op::LSH;
@@ -158,16 +169,34 @@ struct Unmarshaller {
                 if (inst.opcode & INST_END_BE)
                     throw InvalidInstruction(pc, inst.opcode);
                 switch (inst.imm) {
-                case 16: return Un::Op::SWAP16;
-                case 32: return Un::Op::SWAP32;
-                case 64: return Un::Op::SWAP64;
+                case 16:
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                        throw InvalidInstruction(pc, inst.opcode);
+                    return Un::Op::SWAP16;
+                case 32:
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                        throw InvalidInstruction(pc, inst.opcode);
+                    return Un::Op::SWAP32;
+                case 64:
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+                        throw InvalidInstruction(pc, inst.opcode);
+                    return Un::Op::SWAP64;
                 default: throw InvalidInstruction(pc, "unsupported immediate");
                 }
             }
             switch (inst.imm) {
-            case 16: return (inst.opcode & INST_END_BE) ? Un::Op::BE16 : Un::Op::LE16;
-            case 32: return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
-            case 64: return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
+            case 16:
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                    throw InvalidInstruction(pc, inst.opcode);
+                return (inst.opcode & INST_END_BE) ? Un::Op::BE16 : Un::Op::LE16;
+            case 32:
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                    throw InvalidInstruction(pc, inst.opcode);
+                return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
+            case 64:
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+                    throw InvalidInstruction(pc, inst.opcode);
+                return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
             default:
                 throw InvalidInstruction(pc, "unsupported immediate");
             }
@@ -237,12 +266,16 @@ struct Unmarshaller {
             throw InvalidInstruction(pc, "bad register");
 
         int width = getMemWidth(inst.opcode);
+        if (!info.platform->supports_group((width == sizeof(uint64_t)) ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+            throw InvalidInstruction(pc, inst.opcode);
         bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
         switch (inst.opcode & INST_MODE_MASK) {
         case INST_MODE_IMM:
             throw InvalidInstruction(pc, inst.opcode);
+
         case INST_MODE_ABS:
-            if (!info.platform->legacy || !isLD || (width == 8))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) ||
+                !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.dst != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
@@ -253,7 +286,8 @@ struct Unmarshaller {
             return Packet{.width = width, .offset = inst.imm, .regoffset = {}};
 
         case INST_MODE_IND:
-            if (!info.platform->legacy || !isLD || (width == 8))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) ||
+                !isLD || (width == 8))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.dst != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
@@ -300,6 +334,8 @@ struct Unmarshaller {
                 ((inst.opcode & INST_SIZE_MASK) != INST_SIZE_W &&
                  (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW))
                 throw InvalidInstruction(pc, inst.opcode);
+            if (!info.platform->supports_group(((inst.opcode & INST_SIZE_MASK) == INST_SIZE_DW) ? bpf_conformance_groups_t::atomic64 : bpf_conformance_groups_t::atomic32))
+                 throw InvalidInstruction(pc, inst.opcode);
             return Atomic{
                 .op = getAtomicOp(pc, inst),
                 .fetch = (inst.imm & INST_FETCH) == INST_FETCH,
@@ -317,11 +353,13 @@ struct Unmarshaller {
     }
 
     auto makeAluOp(size_t pc, ebpf_inst inst) -> Instruction {
+        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
+        if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+            throw InvalidInstruction(pc, inst.opcode);
         if (inst.dst == R10_STACK_POINTER)
             throw InvalidInstruction(pc, "invalid target r10");
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
             throw InvalidInstruction(pc, "bad register");
-        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
         return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
                                      [&](Bin::Op op) -> Instruction {
                                          Bin res{
@@ -339,6 +377,8 @@ struct Unmarshaller {
     }
 
     auto makeLddw(ebpf_inst inst, int32_t next_imm, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
+        if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+            throw InvalidInstruction{pc, inst.opcode};
         if (pc >= insts.size() - 1)
             throw InvalidInstruction(pc, "incomplete lddw");
         ebpf_inst next = insts[pc + 1];
@@ -458,7 +498,10 @@ struct Unmarshaller {
         case INST_CALL:
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!info.platform->callx && (inst.opcode & INST_SRC_REG))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::callx) &&
+                (inst.opcode & INST_SRC_REG))
+                throw InvalidInstruction(pc, inst.opcode);
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.src > 0)
                 throw InvalidInstruction(pc, inst.opcode);
@@ -472,6 +515,8 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, "invalid helper function id " + std::to_string(inst.imm));
             return makeCall(inst.imm);
         case INST_EXIT:
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                throw InvalidInstruction(pc, inst.opcode);
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.src != 0)
@@ -484,8 +529,9 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
             return Exit{};
         case INST_JA:
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP &&
-                (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32)
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP && (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32)
+                throw InvalidInstruction(pc, inst.opcode);
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.opcode & INST_SRC_REG)
                 throw InvalidInstruction(pc, inst.opcode);
@@ -497,6 +543,9 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
         default: {
             // First validate the opcode, src, and imm.
+            auto is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_JMP;
+            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+                throw InvalidInstruction(pc, inst.opcode);
             auto op = getJmpOp(pc, inst.opcode);
             if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0))
                 throw InvalidInstruction(pc, inst.opcode);
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index dee8d9e3b..50378f5a8 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -63,8 +63,8 @@ ebpf_platform_t g_platform_test = {
     .parse_maps_section = ebpf_parse_maps_section,
     .get_map_descriptor = ebpf_get_map_descriptor,
     .get_map_type = ebpf_get_map_type,
-    .legacy = true,
-    .callx = true
+    .supported_conformance_groups =
+        bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::packet | bpf_conformance_groups_t::callx
 };
 
 static EbpfProgramType make_program_type(const string& name, ebpf_context_descriptor_t* context_descriptor) {
@@ -328,7 +328,7 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
     }
     raw_program raw_prog{.prog = insts};
     ebpf_platform_t platform = g_ebpf_platform_linux;
-    platform.callx = true;
+    platform.supported_conformance_groups |= bpf_conformance_groups_t::callx;
     raw_prog.info.platform = &platform;
 
     // Convert the raw program section to a set of instructions.
diff --git a/src/linux/linux_platform.cpp b/src/linux/linux_platform.cpp
index a57ccc16b..01cd9477c 100644
--- a/src/linux/linux_platform.cpp
+++ b/src/linux/linux_platform.cpp
@@ -255,6 +255,5 @@ const ebpf_platform_t g_ebpf_platform_linux = {
     get_map_descriptor_linux,
     get_map_type_linux,
     resolve_inner_map_references_linux,
-    true, // Legacy packet access instructions
-    false // No callx instructions
+    bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::packet
 };
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 887177c92..902eb3b96 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -3,6 +3,7 @@
 #include <iostream>
 #include <vector>
 
+#include <boost/algorithm/string.hpp>
 #include <boost/functional/hash.hpp>
 
 #include "CLI11.hpp"
@@ -32,6 +33,42 @@ struct at_scope_exit
     ~at_scope_exit() { on_exit(); }
 };
 
+static const std::map<std::string, bpf_conformance_groups_t> _conformance_groups = {
+    {"atomic32", bpf_conformance_groups_t::atomic32},
+    {"atomic64", bpf_conformance_groups_t::atomic64},
+    {"base32", bpf_conformance_groups_t::base32},
+    {"base64", bpf_conformance_groups_t::base64},
+    {"callx", bpf_conformance_groups_t::callx},
+    {"divmul32", bpf_conformance_groups_t::divmul32},
+    {"divmul64", bpf_conformance_groups_t::divmul64},
+    {"packet", bpf_conformance_groups_t::packet}};
+
+static std::optional<bpf_conformance_groups_t> _get_conformance_group_by_name(std::string group) {
+    if (!_conformance_groups.contains(group)) {
+        return {};
+    }
+    return _conformance_groups.find(group)->second;
+}
+
+static std::string _get_conformance_group_names() {
+    std::string result;
+    for (const auto& entry : _conformance_groups) {
+        if (!result.empty()) {
+            result += ", ";
+        }
+        result += entry.first;
+    }
+    return result;
+}
+
+// Given a string containing comma-separated tokens, split them into a list of strings.
+static std::vector<std::string> get_string_vector(std::string list) {
+    std::vector<std::string> string_vector;
+    if (!list.empty())
+       boost::split(string_vector, list, boost::is_any_of(","));
+    return string_vector;
+}
+
 int main(int argc, char** argv) {
     // Always call ebpf_verifier_clear_thread_local_state on scope exit.
     at_scope_exit<ebpf_verifier_clear_thread_local_state> clear_thread_local_state;
@@ -66,10 +103,12 @@ int main(int argc, char** argv) {
     app.add_flag("-f", ebpf_verifier_options.print_failures, "Print verifier's failure logs");
     app.add_flag("-s", ebpf_verifier_options.strict, "Apply additional checks that would cause runtime failures");
     app.add_flag("-v", verbose, "Print both invariants and failures");
-    bool legacy = false;
-    app.add_flag("--legacy", legacy, "Allow deprecated packet access instructions");
-    bool callx = false;
-    app.add_flag("--callx", callx, "Allow callx instructions");
+    std::string include_groups;
+    app.add_option("include_groups", include_groups,
+                   "Include conformance groups (valid group names: " + _get_conformance_group_names() + ")");
+    std::string exclude_groups;
+    app.add_option("exclude_groups", exclude_groups,
+                   "Exclude conformance groups (valid group names: " + _get_conformance_group_names() + ")");
     bool no_division_by_zero = false;
     app.add_flag("--no-division-by-zero", no_division_by_zero, "Do not allow division by zero");
     app.add_flag("--no-simplify", ebpf_verifier_options.no_simplify, "Do not simplify");
@@ -88,6 +127,26 @@ int main(int argc, char** argv) {
         ebpf_verifier_options.print_invariants = ebpf_verifier_options.print_failures = true;
     ebpf_verifier_options.allow_division_by_zero = !no_division_by_zero;
 
+    // Enable default conformance groups, which don't include callx or packet.
+    ebpf_platform_t platform = g_ebpf_platform_linux;
+    platform.supported_conformance_groups = bpf_conformance_groups_t::default_groups;
+    for (auto group_name : get_string_vector(include_groups)) {
+        if (auto group = _get_conformance_group_by_name(group_name)) {
+            platform.supported_conformance_groups |= *group;
+        } else {
+            std::cerr << "Invalid group: " << group_name << std::endl;
+            return 1;
+        }
+    }
+    for (auto group_name : get_string_vector(exclude_groups)) {
+        if (auto group = _get_conformance_group_by_name(group_name)) {
+            platform.supported_conformance_groups &= ~(*group);
+        } else {
+            std::cerr << "Invalid group: " << group_name << std::endl;
+            return 1;
+        }
+    }
+
     // Main program
 
     if (filename == "@headers") {
@@ -115,9 +174,6 @@ int main(int argc, char** argv) {
 
     if (domain == "linux")
         ebpf_verifier_options.mock_map_fds = false;
-    ebpf_platform_t platform = g_ebpf_platform_linux;
-    platform.legacy = legacy;
-    platform.callx = callx;
 
     // Read a set of raw program sections from an ELF file.
     vector<raw_program> raw_progs;
diff --git a/src/platform.hpp b/src/platform.hpp
index d3635bfcd..ab4ddcda5 100644
--- a/src/platform.hpp
+++ b/src/platform.hpp
@@ -6,6 +6,7 @@
 // that supports eBPF can have an ebpf_platform_t struct that the verifier
 // can use to call platform-specific functions.
 
+#include "../external/bpf_conformance/include/bpf_conformance.h"
 #include "config.hpp"
 #include "spec_type_descriptors.hpp"
 #include "helpers.hpp"
@@ -42,10 +43,11 @@ struct ebpf_platform_t {
     ebpf_get_map_descriptor_fn get_map_descriptor;
     ebpf_get_map_type_fn get_map_type;
     ebpf_resolve_inner_map_references_fn resolve_inner_map_references;
+    bpf_conformance_groups_t supported_conformance_groups;
 
-    // Fields indicating support for various instruction types.
-    bool legacy;
-    bool callx;
+    bool supports_group(bpf_conformance_groups_t group) const {
+        return (supported_conformance_groups & group) == group;
+    }
 };
 
 extern const ebpf_platform_t g_ebpf_platform_linux;
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 02ee4c4ff..06508d25a 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -5,7 +5,6 @@
 #include "asm_ostream.hpp"
 #include "asm_marshal.hpp"
 #include "asm_unmarshal.hpp"
-#include "../external/bpf_conformance/include/bpf_conformance.h"
 
 // Below we define a tample of instruction templates that specify
 // what values each field are allowed to contain.  We first define
@@ -17,6 +16,7 @@
 constexpr int MEM_OFFSET = 3; // Any valid memory offset value.
 constexpr int JMP_OFFSET = 5; // Any valid jump offset value.
 constexpr int DST = 7; // Any destination register number.
+constexpr int HELPER_ID = 8; // Any helper ID.
 constexpr int SRC = 9; // Any source register number.
 constexpr int IMM = -1; // Any imm value.
 constexpr int INVALID_REGISTER = R10_STACK_POINTER + 1; // Not a valid register.
@@ -29,180 +29,196 @@ struct ebpf_instruction_template_t {
 // The following table is derived from the table in the Appendix of the
 // BPF ISA specification (https://datatracker.ietf.org/doc/draft-ietf-bpf-isa/).
 static const ebpf_instruction_template_t instruction_template[] = {
-    // opcode, dst, src, offset, imm.
-    {0x04, DST, 0, 0, IMM},
-    {0x05, 0, 0, JMP_OFFSET, 0},
-    {0x06, 0, 0, 0, JMP_OFFSET},
-    {0x07, DST, 0, 0, IMM},
-    {0x0c, DST, SRC, 0, 0},
-    {0x0f, DST, SRC, 0, 0},
-    {0x14, DST, 0, 0, IMM},
-    {0x15, DST, 0, JMP_OFFSET, IMM},
-    {0x16, DST, 0, JMP_OFFSET, IMM},
-    {0x17, DST, 0, 0, IMM},
-    {0x18, DST, 0, 0, IMM},
-    {0x18, DST, 1, 0, IMM},
+    // {opcode, dst, src, offset, imm}, group
+    {{0x04, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x05, 0, 0, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x06, 0, 0, 0, JMP_OFFSET}, bpf_conformance_groups_t::base32},
+    {{0x07, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x0c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x0f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x14, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x15, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x16, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x17, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x18, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x18, DST, 1, 0, IMM}, bpf_conformance_groups_t::base64},
     // TODO(issue #533): add support for LDDW with src_reg > 1.
-    // {0x18, DST, 2, 0, IMM},
-    // {0x18, DST, 3, 0, IMM},
-    // {0x18, DST, 4, 0, IMM},
-    // {0x18, DST, 5, 0, IMM},
-    // {0x18, DST, 6, 0, IMM},
-    {0x1c, DST, SRC, 0, 0},
-    {0x1d, DST, SRC, JMP_OFFSET, 0},
-    {0x1e, DST, SRC, JMP_OFFSET, 0},
-    {0x1f, DST, SRC, 0, 0},
-    {0x20, 0, 0, 0, IMM},
-    {0x24, DST, 0, 0, IMM},
-    {0x25, DST, 0, JMP_OFFSET, IMM},
-    {0x26, DST, 0, JMP_OFFSET, IMM},
-    {0x27, DST, 0, 0, IMM},
-    {0x28, 0, 0, 0, IMM},
-    {0x2c, DST, SRC, 0, 0},
-    {0x2d, DST, SRC, JMP_OFFSET, 0},
-    {0x2e, DST, SRC, JMP_OFFSET, 0},
-    {0x2f, DST, SRC, 0, 0},
-    {0x30, 0, 0, 0, IMM},
-    {0x34, DST, 0, 0, IMM},
-    {0x34, DST, 0, 1, IMM},
-    {0x35, DST, 0, JMP_OFFSET, IMM},
-    {0x36, DST, 0, JMP_OFFSET, IMM},
-    {0x37, DST, 0, 0, IMM},
-    {0x37, DST, 0, 1, IMM},
-    {0x3c, DST, SRC, 0, 0},
-    {0x3c, DST, SRC, 1, 0},
-    {0x3d, DST, SRC, JMP_OFFSET, 0},
-    {0x3e, DST, SRC, JMP_OFFSET, 0},
-    {0x3f, DST, SRC, 0, 0},
-    {0x3f, DST, SRC, 1, 0},
-    {0x40, 0, SRC, 0, IMM},
-    {0x44, DST, 0, 0, IMM},
-    {0x45, DST, 0, JMP_OFFSET, IMM},
-    {0x46, DST, 0, JMP_OFFSET, IMM},
-    {0x47, DST, 0, 0, IMM},
-    {0x48, 0, SRC, 0, IMM},
-    {0x4c, DST, SRC, 0, 0},
-    {0x4d, DST, SRC, JMP_OFFSET, 0},
-    {0x4e, DST, SRC, JMP_OFFSET, 0},
-    {0x4f, DST, SRC, 0, 0},
-    {0x50, 0, SRC, 0, IMM},
-    {0x54, DST, 0, 0, IMM},
-    {0x55, DST, 0, JMP_OFFSET, IMM},
-    {0x56, DST, 0, JMP_OFFSET, IMM},
-    {0x57, DST, 0, 0, IMM},
-    {0x5c, DST, SRC, 0, 0},
-    {0x5d, DST, SRC, JMP_OFFSET, 0},
-    {0x5e, DST, SRC, JMP_OFFSET, 0},
-    {0x5f, DST, SRC, 0, 0},
-    {0x61, DST, SRC, MEM_OFFSET, 0},
-    {0x62, DST, 0, MEM_OFFSET, IMM},
-    {0x63, DST, SRC, MEM_OFFSET, 0},
-    {0x64, DST, 0, 0, IMM},
-    {0x65, DST, 0, JMP_OFFSET, IMM},
-    {0x66, DST, 0, JMP_OFFSET, IMM},
-    {0x67, DST, 0, 0, IMM},
-    {0x69, DST, SRC, MEM_OFFSET, 0},
-    {0x6a, DST, 0, MEM_OFFSET, IMM},
-    {0x6b, DST, SRC, MEM_OFFSET, 0},
-    {0x6c, DST, SRC, 0, 0},
-    {0x6d, DST, SRC, JMP_OFFSET, 0},
-    {0x6e, DST, SRC, JMP_OFFSET, 0},
-    {0x6f, DST, SRC, 0, 0},
-    {0x71, DST, SRC, MEM_OFFSET, 0},
-    {0x72, DST, 0, MEM_OFFSET, IMM},
-    {0x73, DST, SRC, MEM_OFFSET, 0},
-    {0x74, DST, 0, 0, IMM},
-    {0x75, DST, 0, JMP_OFFSET, IMM},
-    {0x76, DST, 0, JMP_OFFSET, IMM},
-    {0x77, DST, 0, 0, IMM},
-    {0x79, DST, SRC, MEM_OFFSET, 0},
-    {0x7a, DST, 0, MEM_OFFSET, IMM},
-    {0x7b, DST, SRC, MEM_OFFSET, 0},
-    {0x7c, DST, SRC, 0, 0},
-    {0x7d, DST, SRC, JMP_OFFSET, 0},
-    {0x7e, DST, SRC, JMP_OFFSET, 0},
-    {0x7f, DST, SRC, 0, 0},
-    {0x84, DST, 0, 0, 0},
-    {0x85, 0, 0, 0, IMM},
+    // {{0x18, DST, 2, 0, IMM}, bpf_conformance_groups_t::base64},
+    // {{0x18, DST, 3, 0, IMM}, bpf_conformance_groups_t::base64},
+    // {{0x18, DST, 4, 0, IMM}, bpf_conformance_groups_t::base64},
+    // {{0x18, DST, 5, 0, IMM}, bpf_conformance_groups_t::base64},
+    // {{0x18, DST, 6, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x1c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x1d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x1e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x1f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x20, 0, 0, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x24, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul32},
+    {{0x25, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x26, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x27, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul64},
+    {{0x28, 0, 0, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x2c, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul32},
+    {{0x2d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x2e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x2f, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul64},
+    {{0x30, 0, 0, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x34, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul32},
+    {{0x34, DST, 0, 1, IMM}, bpf_conformance_groups_t::divmul32},
+    {{0x35, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x36, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x37, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul64},
+    {{0x37, DST, 0, 1, IMM}, bpf_conformance_groups_t::divmul64},
+    {{0x3c, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul32},
+    {{0x3c, DST, SRC, 1, 0}, bpf_conformance_groups_t::divmul32},
+    {{0x3d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x3e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x3f, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul64},
+    {{0x3f, DST, SRC, 1, 0}, bpf_conformance_groups_t::divmul64},
+    {{0x40, 0, SRC, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x44, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x45, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x46, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x47, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x48, 0, SRC, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x4c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x4d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x4e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x4f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x50, 0, SRC, 0, IMM}, bpf_conformance_groups_t::packet},
+    {{0x54, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x55, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x56, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x57, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x5c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x5d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x5e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x5f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x61, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x62, DST, 0, MEM_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x63, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x64, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x65, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x66, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x67, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x69, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x6a, DST, 0, MEM_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x6b, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x6c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x6d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x6e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x6f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x71, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x72, DST, 0, MEM_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x73, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x74, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x75, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x76, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0x77, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0x79, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x7a, DST, 0, MEM_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0x7b, DST, SRC, MEM_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x7c, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x7d, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0x7e, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0x7f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0x84, DST, 0, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x85, 0, 0, 0, HELPER_ID}, bpf_conformance_groups_t::base32},
     // TODO(issue #582): Add support for subprograms (call_local).
-    // {0x85, 0, 1, 0, IMM},
+    // {{0x85, 0, 1, 0, IMM}, bpf_conformance_groups_t::base32},
     // TODO(issue #590): Add support for calling a helper function by BTF ID.
-    // {0x85, 0, 2, 0, IMM},
-    {0x87, DST, 0, 0, 0},
+    // {{0x85, 0, 2, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x87, DST, 0, 0, 0}, bpf_conformance_groups_t::base64},
     {{0x8d, DST, 0, 0, 0}, bpf_conformance_groups_t::callx},
-    {0x94, DST, 0, 0, IMM},
-    {0x94, DST, 0, 1, IMM},
-    {0x95, 0, 0, 0, 0},
-    {0x97, DST, 0, 0, IMM},
-    {0x97, DST, 0, 1, IMM},
-    {0x9c, DST, SRC, 0, 0},
-    {0x9c, DST, SRC, 1, 0},
-    {0x9f, DST, SRC, 0, 0},
-    {0x9f, DST, SRC, 1, 0},
-    {0xa4, DST, 0, 0, IMM},
-    {0xa5, DST, 0, JMP_OFFSET, IMM},
-    {0xa6, DST, 0, JMP_OFFSET, IMM},
-    {0xa7, DST, 0, 0, IMM},
-    {0xac, DST, SRC, 0, 0},
-    {0xad, DST, SRC, JMP_OFFSET, 0},
-    {0xae, DST, SRC, JMP_OFFSET, 0},
-    {0xaf, DST, SRC, 0, 0},
-    {0xb4, DST, 0, 0, IMM},
-    {0xb5, DST, 0, JMP_OFFSET, IMM},
-    {0xb6, DST, 0, JMP_OFFSET, IMM},
-    {0xb7, DST, 0, 0, IMM},
-    {0xbc, DST, SRC, 0, 0},
-    {0xbc, DST, SRC, 8, 0},
-    {0xbc, DST, SRC, 16, 0},
-    {0xbd, DST, SRC, JMP_OFFSET, 0},
-    {0xbe, DST, SRC, JMP_OFFSET, 0},
-    {0xbf, DST, SRC, 0, 0},
-    {0xbf, DST, SRC, 8, 0},
-    {0xbf, DST, SRC, 16, 0},
-    {0xbf, DST, SRC, 32, 0},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x00},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x01},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x40},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x41},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x50},
-    {0xc3, DST, SRC, MEM_OFFSET, 0x51},
-    {0xc3, DST, SRC, MEM_OFFSET, 0xa0},
-    {0xc3, DST, SRC, MEM_OFFSET, 0xa1},
-    {0xc3, DST, SRC, MEM_OFFSET, 0xe1},
-    {0xc3, DST, SRC, MEM_OFFSET, 0xf1},
-    {0xc4, DST, 0, 0, IMM},
-    {0xc5, DST, 0, JMP_OFFSET, IMM},
-    {0xc6, DST, 0, JMP_OFFSET, IMM},
-    {0xc7, DST, 0, 0, IMM},
-    {0xcc, DST, SRC, 0, 0},
-    {0xcd, DST, SRC, JMP_OFFSET, 0},
-    {0xce, DST, SRC, JMP_OFFSET, 0},
-    {0xcf, DST, SRC, 0, 0},
-    {0xd4, DST, 0, 0, 0x10},
-    {0xd4, DST, 0, 0, 0x20},
-    {0xd4, DST, 0, 0, 0x40},
-    {0xd5, DST, 0, JMP_OFFSET, IMM},
-    {0xd6, DST, 0, JMP_OFFSET, IMM},
-    {0xd7, DST, 0, 0, 0x10},
-    {0xd7, DST, 0, 0, 0x20},
-    {0xd7, DST, 0, 0, 0x40},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x00},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x01},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x40},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x41},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x50},
-    {0xdb, DST, SRC, MEM_OFFSET, 0x51},
-    {0xdb, DST, SRC, MEM_OFFSET, 0xa0},
-    {0xdb, DST, SRC, MEM_OFFSET, 0xa1},
-    {0xdb, DST, SRC, MEM_OFFSET, 0xe1},
-    {0xdb, DST, SRC, MEM_OFFSET, 0xf1},
-    {0xdc, DST, 0, 0, 0x10},
-    {0xdc, DST, 0, 0, 0x20},
-    {0xdc, DST, 0, 0, 0x40},
-    {0xdd, DST, SRC, JMP_OFFSET, 0},
-    {0xde, DST, SRC, JMP_OFFSET, 0},
+    {{0x94, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul32},
+    {{0x94, DST, 0, 1, IMM}, bpf_conformance_groups_t::divmul32},
+    {{0x95, 0, 0, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0x97, DST, 0, 0, IMM}, bpf_conformance_groups_t::divmul64},
+    {{0x97, DST, 0, 1, IMM}, bpf_conformance_groups_t::divmul64},
+    {{0x9c, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul32},
+    {{0x9c, DST, SRC, 1, 0}, bpf_conformance_groups_t::divmul32},
+    {{0x9f, DST, SRC, 0, 0}, bpf_conformance_groups_t::divmul64},
+    {{0x9f, DST, SRC, 1, 0}, bpf_conformance_groups_t::divmul64},
+    {{0xa4, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0xa5, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0xa6, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0xa7, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0xac, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0xad, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0xae, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0xaf, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0xb4, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0xb5, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0xb6, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0xb7, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0xbc, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0xbc, DST, SRC, 8, 0}, bpf_conformance_groups_t::base32},
+    {{0xbc, DST, SRC, 16, 0}, bpf_conformance_groups_t::base32},
+    {{0xbd, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0xbe, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0xbf, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0xbf, DST, SRC, 8, 0}, bpf_conformance_groups_t::base64},
+    {{0xbf, DST, SRC, 16, 0}, bpf_conformance_groups_t::base64},
+    {{0xbf, DST, SRC, 32, 0}, bpf_conformance_groups_t::base64},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x00}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x01}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x40}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x41}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x50}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0x51}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0xa0}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0xa1}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0xe1}, bpf_conformance_groups_t::atomic32},
+    {{0xc3, DST, SRC, MEM_OFFSET, 0xf1}, bpf_conformance_groups_t::atomic32},
+    {{0xc4, DST, 0, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0xc5, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0xc6, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0xc7, DST, 0, 0, IMM}, bpf_conformance_groups_t::base64},
+    {{0xcc, DST, SRC, 0, 0}, bpf_conformance_groups_t::base32},
+    {{0xcd, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0xce, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
+    {{0xcf, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
+    {{0xd4, DST, 0, 0, 0x10}, bpf_conformance_groups_t::base32},
+    {{0xd4, DST, 0, 0, 0x20}, bpf_conformance_groups_t::base32},
+    {{0xd4, DST, 0, 0, 0x40}, bpf_conformance_groups_t::base64},
+    {{0xd5, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base64},
+    {{0xd6, DST, 0, JMP_OFFSET, IMM}, bpf_conformance_groups_t::base32},
+    {{0xd7, DST, 0, 0, 0x10}, bpf_conformance_groups_t::base32},
+    {{0xd7, DST, 0, 0, 0x20}, bpf_conformance_groups_t::base32},
+    {{0xd7, DST, 0, 0, 0x40}, bpf_conformance_groups_t::base64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x00}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x01}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x40}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x41}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x50}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0x51}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0xa0}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0xa1}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0xe1}, bpf_conformance_groups_t::atomic64},
+    {{0xdb, DST, SRC, MEM_OFFSET, 0xf1}, bpf_conformance_groups_t::atomic64},
+    {{0xdc, DST, 0, 0, 0x10}, bpf_conformance_groups_t::base32},
+    {{0xdc, DST, 0, 0, 0x20}, bpf_conformance_groups_t::base32},
+    {{0xdc, DST, 0, 0, 0x40}, bpf_conformance_groups_t::base64},
+    {{0xdd, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base64},
+    {{0xde, DST, SRC, JMP_OFFSET, 0}, bpf_conformance_groups_t::base32},
 };
 
+// Verify that we can successfully unmarshal an instruction.
+static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
+    REQUIRE(parsed.size() == 3);
+}
+
+// Verify that we can successfully unmarshal a 64-bit immediate instruction.
+static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
+    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {inst1, inst2, exit, exit}, info}));
+    REQUIRE(parsed.size() == 3);
+}
+
 // Verify that if we unmarshal an instruction and then re-marshal it,
 // we get what we expect.
 static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
@@ -410,7 +426,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
 
         // Test callx with support.  Note that callx puts the register number in 'dst' not 'src'.
         ebpf_platform_t platform = g_ebpf_platform_linux;
-        platform.callx = true;
+        platform.supported_conformance_groups |= bpf_conformance_groups_t::callx;
         compare_marshal_unmarshal(Callx{8}, false, platform);
         ebpf_inst callx{.opcode = INST_OP_CALLX, .dst = 8};
         compare_unmarshal_marshal(callx, callx, platform);
@@ -566,8 +582,7 @@ static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string&
 
 static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t& previous_template) {
     ebpf_platform_t platform = g_ebpf_platform_linux;
-    if ((previous_template.groups & bpf_conformance_groups_t::callx) != bpf_conformance_groups_t::none)
-        platform.callx = true;
+    platform.supported_conformance_groups |= previous_template.groups;
     return platform;
 }
 
@@ -642,7 +657,7 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
     if (inst.imm == JMP_OFFSET) {
         inst.imm = 0; // Not a valid jump offset.
         check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n", platform);
-    } else if (inst.imm != IMM) {
+    } else if (inst.imm != IMM && inst.imm != HELPER_ID) {
         // This instruction limits what can appear in the 'imm' field.
         // Just try the next value unless that's what the next template has.
         inst.imm++;
@@ -659,7 +674,8 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
     // Some instructions only permit non-zero imm values.
     // If the next template is for one of those, check the zero value now.
     if (next_template && (previous_template.inst.opcode != next_template->inst.opcode) &&
-        (next_template->inst.imm > 0) && (next_template->inst.imm != JMP_OFFSET)) {
+        (next_template->inst.imm > 0) && (next_template->inst.imm != HELPER_ID) &&
+        (next_template->inst.imm != JMP_OFFSET)) {
         inst = next_template->inst;
         inst.imm = 0;
         check_unmarshal_instruction_fail(inst, "0: unsupported immediate\n");
@@ -699,6 +715,29 @@ TEST_CASE("fail unmarshal bad instructions", "[disasm][marshal]") {
     check_instruction_variations(instruction_template[template_count - 1], {});
 }
 
+TEST_CASE("check unmarshal conformance groups", "[disasm][marshal]") {
+    for (const auto& current : instruction_template) {
+        // Try unmarshaling without support.
+        ebpf_platform_t platform = g_ebpf_platform_linux;
+        platform.supported_conformance_groups &= ~current.groups;
+        std::ostringstream oss;
+        oss << "0: bad instruction op 0x" << std::hex << (int)current.inst.opcode << std::endl;
+        check_unmarshal_fail(current.inst, oss.str(), platform);
+
+        // Try unmarshaling with support.
+        platform.supported_conformance_groups |= current.groups;
+        ebpf_inst inst = current.inst;
+        if (inst.offset == JMP_OFFSET)
+            inst.offset = 1;
+        if (inst.imm == JMP_OFFSET)
+            inst.imm = 1;
+        if (inst.opcode == INST_OP_LDDW_IMM)
+            check_unmarshal_succeed(inst, ebpf_inst{}, platform);
+        else
+            check_unmarshal_succeed(inst, platform);
+    }
+}
+
 TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
     // The following opcodes are deprecated and should no longer be used.
     static uint8_t supported_legacy_opcodes[] = {0x20, 0x28, 0x30, 0x40, 0x48, 0x50};
@@ -706,9 +745,9 @@ TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
         compare_unmarshal_marshal(ebpf_inst{.opcode = opcode}, ebpf_inst{.opcode = opcode});
     }
 
-    // Disable legacy support.
+    // Disable legacy packet instruction support.
     ebpf_platform_t platform = g_ebpf_platform_linux;
-    platform.legacy = false;
+    platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet;
     for (uint8_t opcode : supported_legacy_opcodes) {
         std::ostringstream oss;
         oss << "0: bad instruction op 0x" << std::hex << (int)opcode << std::endl;
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index bca93d05b..c5bf67fb5 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -79,7 +79,7 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_SECTION(dirname, filename, sectionname) \
     TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
         ebpf_platform_t platform = g_ebpf_platform_linux; \
-        platform.legacy = false; \
+        platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet; \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &platform); \
         REQUIRE(raw_progs.size() == 1); \
         raw_program raw_prog = raw_progs.back(); \

From d9b8390b3dd7e3e057de6d3d9f46d8b0c0dfc93f Mon Sep 17 00:00:00 2001
From: Jorge Navas <navasjorgea@gmail.com>
Date: Fri, 25 Mar 2022 14:03:46 -0600
Subject: [PATCH 062/373] refactor(crab): made Prevail parametric wrt abstract
 domain

Prevail was designed to use ebpf_domain_t as the only abstract domain.
We made changes in Prevail so that other abstract domains can be
easily plugin.  To add a new domain:

1) Implement the public interface of abstract_domain_t defined in
crab/abstract_domain.hpp.

2) Modify the enum class abstract_domain_kind in config.hpp to assign
a new id to the new abstract domain.

3) Extend make_initial in crab_verifier.cpp to create new instances of
the new domain

 Author:    Jorge Navas <navasjorgea@gmail.com>
 Date:      Fri Mar 25 14:03:46 2022 -0600
---
 src/config.cpp               |   1 +
 src/config.hpp               |   3 +
 src/crab/abstract_domain.cpp | 285 +++++++++++++++++++++++++++++++++++
 src/crab/abstract_domain.hpp | 135 +++++++++++++++++
 src/crab/ebpf_domain.cpp     |  29 ++--
 src/crab/ebpf_domain.hpp     |   9 +-
 src/crab/fwd_analyzer.cpp    |  61 +++++---
 src/crab/fwd_analyzer.hpp    |   6 +-
 src/crab_verifier.cpp        |  56 ++++++-
 9 files changed, 540 insertions(+), 45 deletions(-)
 create mode 100644 src/crab/abstract_domain.cpp
 create mode 100644 src/crab/abstract_domain.hpp

diff --git a/src/config.cpp b/src/config.cpp
index 3849162c5..138e3711a 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -8,6 +8,7 @@ const ebpf_verifier_options_t ebpf_verifier_default_options = {
     .print_invariants = false,
     .print_failures = false,
     .no_simplify = false,
+    .abstract_domain = abstract_domain_kind::EBPF_DOMAIN,
     .mock_map_fds = true,
     .strict = false,
     .print_line_info = false,
diff --git a/src/config.hpp b/src/config.hpp
index cf3065fd9..c425d8019 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -2,12 +2,15 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN };
+
 struct ebpf_verifier_options_t {
     bool check_termination;
     bool assume_assertions;
     bool print_invariants;
     bool print_failures;
     bool no_simplify;
+    abstract_domain_kind abstract_domain;
 
     // False to use actual map fd's, true to use mock fd's.
     bool mock_map_fds;
diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
new file mode 100644
index 000000000..244f770ae
--- /dev/null
+++ b/src/crab/abstract_domain.cpp
@@ -0,0 +1,285 @@
+#include "abstract_domain.hpp"
+#include "ebpf_domain.hpp"
+
+template <typename Domain>
+abstract_domain_t::abstract_domain_model<Domain>::abstract_domain_model(Domain abs_val)
+    : m_abs_val(std::move(abs_val)) {}
+
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept>
+abstract_domain_t::abstract_domain_model<Domain>::clone() const {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res =
+        std::make_unique<abstract_domain_t::abstract_domain_model<Domain>>(m_abs_val);
+    return std::move(res);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::set_to_top() {
+    m_abs_val.set_to_top();
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::set_to_bottom() {
+    m_abs_val.set_to_bottom();
+}
+
+template <typename Domain>
+bool abstract_domain_t::abstract_domain_model<Domain>::is_bottom() const {
+    return m_abs_val.is_bottom();
+}
+
+template <typename Domain>
+bool abstract_domain_t::abstract_domain_model<Domain>::is_top() const {
+    return m_abs_val.is_top();
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+bool abstract_domain_t::abstract_domain_model<Domain>::operator<=(
+    const abstract_domain_t::abstract_domain_concept& abs) {
+    return m_abs_val.operator<=(static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator|=(
+    const abstract_domain_t::abstract_domain_concept& abs) {
+    m_abs_val |= static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val;
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator|=(abstract_domain_t::abstract_domain_concept&& abs) {
+    m_abs_val |= std::move(static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept> abstract_domain_t::abstract_domain_model<Domain>::operator|(
+    const abstract_domain_t::abstract_domain_concept& abs) const {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res(
+        new abstract_domain_t::abstract_domain_model<Domain>(m_abs_val.operator|(
+            static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val)));
+    return std::move(res);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept>
+abstract_domain_t::abstract_domain_model<Domain>::operator|(abstract_domain_t::abstract_domain_concept&& abs) const {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res(
+        new abstract_domain_t::abstract_domain_model<Domain>(m_abs_val.operator|(
+            std::move(static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val))));
+    return std::move(res);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept> abstract_domain_t::abstract_domain_model<Domain>::operator&(
+    const abstract_domain_t::abstract_domain_concept& abs) const {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res(
+        new abstract_domain_t::abstract_domain_model<Domain>(m_abs_val.operator&(
+            static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val)));
+    return std::move(res);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept>
+abstract_domain_t::abstract_domain_model<Domain>::widen(const abstract_domain_t::abstract_domain_concept& abs, bool to_constants) {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res(
+        new abstract_domain_t::abstract_domain_model<Domain>(
+            m_abs_val.widen(static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val, to_constants)));
+    return std::move(res);
+}
+
+// unsafe: if the underlying domain in abs is not Domain then it will crash
+template <typename Domain>
+std::unique_ptr<abstract_domain_t::abstract_domain_concept>
+abstract_domain_t::abstract_domain_model<Domain>::narrow(const abstract_domain_t::abstract_domain_concept& abs) const {
+    std::unique_ptr<abstract_domain_t::abstract_domain_concept> res(
+        new abstract_domain_t::abstract_domain_model<Domain>(
+            m_abs_val.narrow(static_cast<const abstract_domain_t::abstract_domain_model<Domain>*>(&abs)->m_abs_val)));
+    return std::move(res);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_block_t& bb) {
+    m_abs_val.operator()(bb);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s) {
+    m_abs_val.operator()(s);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::write(std::ostream& os) const {
+    m_abs_val.write(os);
+}
+
+template <typename Domain>
+crab::bound_t abstract_domain_t::abstract_domain_model<Domain>::get_loop_count_upper_bound() {
+    return m_abs_val.get_loop_count_upper_bound();
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::initialize_loop_counter(const label_t label) {
+    m_abs_val.initialize_loop_counter(label);
+}
+
+template <typename Domain>
+string_invariant abstract_domain_t::abstract_domain_model<Domain>::to_set() {
+    return m_abs_val.to_set();
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::set_require_check(check_require_func_t f) {
+    m_abs_val.set_require_check(f);
+}
+
+abstract_domain_t::abstract_domain_t(std::unique_ptr<typename abstract_domain_t::abstract_domain_concept> concept_)
+    : m_concept(std::move(concept_)) {}
+
+template <typename Domain>
+abstract_domain_t::abstract_domain_t(Domain abs_val)
+    : m_concept(new abstract_domain_t::abstract_domain_model<Domain>(std::move(abs_val))) {}
+
+abstract_domain_t::abstract_domain_t(const abstract_domain_t& o) : m_concept(o.m_concept->clone()) {}
+
+abstract_domain_t& abstract_domain_t::operator=(const abstract_domain_t& o) {
+    if (this != &o) {
+        m_concept = o.m_concept->clone();
+    }
+    return *this;
+}
+
+void abstract_domain_t::set_to_top() { m_concept->set_to_top(); }
+
+void abstract_domain_t::set_to_bottom() { m_concept->set_to_bottom(); }
+
+bool abstract_domain_t::is_bottom() const { return m_concept->is_bottom(); }
+
+bool abstract_domain_t::is_top() const { return m_concept->is_top(); }
+
+bool abstract_domain_t::operator<=(const abstract_domain_t& abs) {
+    return m_concept->operator<=(*(abs.m_concept));
+}
+
+void abstract_domain_t::operator|=(const abstract_domain_t& abs) { m_concept->operator|=(*(abs.m_concept)); }
+
+void abstract_domain_t::operator|=(abstract_domain_t&& abs) { m_concept->operator|=(std::move(*(abs.m_concept))); }
+
+abstract_domain_t abstract_domain_t::operator|(const abstract_domain_t& abs) const {
+    return abstract_domain_t(std::move(m_concept->operator|(*(abs.m_concept))));
+}
+
+abstract_domain_t abstract_domain_t::operator|(abstract_domain_t&& abs) const {
+    return abstract_domain_t(std::move(m_concept->operator|(std::move(*(abs.m_concept)))));
+}
+
+abstract_domain_t abstract_domain_t::operator&(const abstract_domain_t& abs) const {
+    return abstract_domain_t(std::move(m_concept->operator&(*(abs.m_concept))));
+}
+
+abstract_domain_t abstract_domain_t::widen(const abstract_domain_t& abs, bool to_constants) {
+    return abstract_domain_t(std::move(m_concept->widen(*(abs.m_concept), to_constants)));
+}
+
+abstract_domain_t abstract_domain_t::narrow(const abstract_domain_t& abs) const {
+    return abstract_domain_t(std::move(m_concept->narrow(*(abs.m_concept))));
+}
+
+void abstract_domain_t::operator()(const basic_block_t& bb) {
+    m_concept->operator()(bb);
+}
+
+void abstract_domain_t::operator()(const Undefined& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Bin& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Un& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const LoadMapFd& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Call& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Exit& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Jmp& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Mem& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Packet& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Assume& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::operator()(const Assert& s) { m_concept->operator()(s); }
+
+void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
+
+crab::bound_t abstract_domain_t::get_loop_count_upper_bound() { return m_concept->get_loop_count_upper_bound(); }
+
+void abstract_domain_t::initialize_loop_counter(const label_t label) { m_concept->initialize_loop_counter(label); }
+
+string_invariant abstract_domain_t::to_set() { return m_concept->to_set(); }
+
+void abstract_domain_t::set_require_check(check_require_func_t f) { m_concept->set_require_check(f); }
+
+std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
+    dom.write(o);
+    return o;
+}
+
+// REQUIRED: instantiation for supported domains
+template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
new file mode 100644
index 000000000..ae03cb2a1
--- /dev/null
+++ b/src/crab/abstract_domain.hpp
@@ -0,0 +1,135 @@
+#pragma once
+
+#include "cfg.hpp"
+#include "linear_constraint.hpp"
+#include "string_constraints.hpp"
+
+#include "array_domain.hpp"
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
+class abstract_domain_t {
+  private:
+    class abstract_domain_concept {
+      public:
+        abstract_domain_concept() = default;
+        virtual ~abstract_domain_concept() = default;
+        abstract_domain_concept(const abstract_domain_concept&) = delete;
+        abstract_domain_concept(abstract_domain_concept&&) = delete;
+        abstract_domain_concept& operator=(const abstract_domain_concept&) = delete;
+        abstract_domain_concept& operator=(abstract_domain_concept&&) = delete;
+        virtual std::unique_ptr<abstract_domain_concept> clone() const = 0;
+        virtual void set_to_top() = 0;
+        virtual void set_to_bottom() = 0;
+        virtual bool is_bottom() const = 0;
+        virtual bool is_top() const = 0;
+        virtual bool operator<=(const abstract_domain_concept& abs) = 0;
+        virtual std::unique_ptr<abstract_domain_concept> operator|(const abstract_domain_concept& abs) const = 0;
+        virtual std::unique_ptr<abstract_domain_concept> operator|(abstract_domain_concept&& abs) const = 0;
+        virtual void operator|=(const abstract_domain_concept& abs) = 0;
+        virtual void operator|=(abstract_domain_concept&& abs) = 0;
+        virtual std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const = 0;
+        virtual std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) = 0;
+        virtual std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const = 0;
+        virtual void operator()(const basic_block_t&) = 0;
+        virtual void operator()(const Undefined&) = 0;
+        virtual void operator()(const Bin&) = 0;
+        virtual void operator()(const Un&) = 0;
+        virtual void operator()(const LoadMapFd&) = 0;
+        virtual void operator()(const Call&) = 0;
+        virtual void operator()(const Exit&) = 0;
+        virtual void operator()(const Jmp&) = 0;
+        virtual void operator()(const Mem&) = 0;
+        virtual void operator()(const Packet&) = 0;
+        virtual void operator()(const Assume&) = 0;
+        virtual void operator()(const Assert&) = 0;
+        virtual void write(std::ostream& o) const = 0;
+
+        /* These operations are not very conventional for an abstract
+           domain but it's convenient to have them */
+
+        virtual crab::bound_t get_loop_count_upper_bound() = 0;
+        virtual void initialize_loop_counter(const label_t) = 0;
+        virtual string_invariant to_set() = 0;
+        virtual void set_require_check(check_require_func_t f) = 0;
+    }; // end class abstract_domain_concept
+
+    template <typename Domain>
+    class abstract_domain_model final : public abstract_domain_concept {
+        Domain m_abs_val;
+
+      public:
+        explicit abstract_domain_model(Domain abs_val);
+        std::unique_ptr<abstract_domain_concept> clone() const override;
+        void set_to_top() override;
+        void set_to_bottom() override;
+        bool is_bottom() const override;
+        bool is_top() const override;
+        bool operator<=(const abstract_domain_concept& abs) override;
+        void operator|=(const abstract_domain_concept& abs) override;
+        void operator|=(abstract_domain_concept&& abs) override;
+        std::unique_ptr<abstract_domain_concept> operator|(const abstract_domain_concept& abs) const override;
+        std::unique_ptr<abstract_domain_concept> operator|(abstract_domain_concept&& abs) const override;
+        std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const override;
+        std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
+        std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
+        void operator()(const basic_block_t& bb) override;
+        void operator()(const Undefined& s) override;
+        void operator()(const Bin& s) override;
+        void operator()(const Un& s) override;
+        void operator()(const LoadMapFd& s) override;
+        void operator()(const Call& s) override;
+        void operator()(const Exit& s) override;
+        void operator()(const Jmp& s) override;
+        void operator()(const Mem& s) override;
+        void operator()(const Packet& s) override;
+        void operator()(const Assume& s) override;
+        void operator()(const Assert& s) override;
+        void write(std::ostream& o) const override;
+        void initialize_loop_counter(const label_t) override;
+        crab::bound_t get_loop_count_upper_bound() override;
+        string_invariant to_set() override;
+        void set_require_check(check_require_func_t f) override;
+    }; // end class abstract_domain_model
+
+    std::unique_ptr<abstract_domain_concept> m_concept;
+    explicit abstract_domain_t(std::unique_ptr<abstract_domain_concept> concept_);
+
+  public:
+    template <typename Domain>
+    abstract_domain_t(Domain abs_val);
+    ~abstract_domain_t() = default;
+    abstract_domain_t(const abstract_domain_t& o);
+    abstract_domain_t& operator=(const abstract_domain_t& o);
+    abstract_domain_t(abstract_domain_t&& o) = default;
+    abstract_domain_t& operator=(abstract_domain_t&& o) = default;
+    void set_to_top();
+    void set_to_bottom();
+    bool is_bottom() const;
+    bool is_top() const;
+    bool operator<=(const abstract_domain_t& abs);
+    void operator|=(const abstract_domain_t& abs);
+    void operator|=(abstract_domain_t&& abs);
+    abstract_domain_t operator|(const abstract_domain_t& abs) const;
+    abstract_domain_t operator|(abstract_domain_t&& abs) const;
+    abstract_domain_t operator&(const abstract_domain_t& abs) const;
+    abstract_domain_t widen(const abstract_domain_t& abs, bool);
+    abstract_domain_t narrow(const abstract_domain_t& abs) const;
+    void operator()(const basic_block_t& bb);
+    void operator()(const Undefined& s);
+    void operator()(const Bin& s);
+    void operator()(const Un& s);
+    void operator()(const LoadMapFd& s);
+    void operator()(const Call& s);
+    void operator()(const Exit& s);
+    void operator()(const Jmp& s);
+    void operator()(const Mem& s);
+    void operator()(const Packet& s);
+    void operator()(const Assume& s);
+    void operator()(const Assert& s);
+    void write(std::ostream& o) const;
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t);
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
+
+    friend std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom);
+};
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 6d3cd51b7..9fb6d0811 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -23,6 +23,8 @@
 
 using crab::domains::NumAbsDomain;
 namespace crab {
+using crab::data_kind_t;
+
 struct reg_pack_t {
     variable_t svalue; // int64_t value.
     variable_t uvalue; // uint64_t value.
@@ -812,7 +814,9 @@ bool ebpf_domain_t::is_bottom() const { return m_inv.is_bottom(); }
 
 bool ebpf_domain_t::is_top() const { return m_inv.is_top() && stack.is_top(); }
 
-bool ebpf_domain_t::operator<=(const ebpf_domain_t& other) { return m_inv <= other.m_inv && stack <= other.stack; }
+bool ebpf_domain_t::operator<=(const ebpf_domain_t& other) {
+    return m_inv <= other.m_inv && stack <= other.stack;
+}
 
 // bool ebpf_domain_t::operator==(const ebpf_domain_t& other) const {
 //     return stack == other.stack && m_inv <= other.m_inv && other.m_inv <= m_inv;
@@ -905,14 +909,10 @@ ebpf_domain_t ebpf_domain_t::operator|(ebpf_domain_t&& other) const {
     return ebpf_domain_t(m_inv | std::move(other.m_inv), stack | other.stack);
 }
 
-ebpf_domain_t ebpf_domain_t::operator|(const ebpf_domain_t& other) const& {
+ebpf_domain_t ebpf_domain_t::operator|(const ebpf_domain_t& other) const {
     return ebpf_domain_t(m_inv | other.m_inv, stack | other.stack);
 }
 
-ebpf_domain_t ebpf_domain_t::operator|(const ebpf_domain_t& other) && {
-    return ebpf_domain_t(other.m_inv | std::move(m_inv), other.stack | stack);
-}
-
 ebpf_domain_t ebpf_domain_t::operator&(const ebpf_domain_t& other) const {
     return ebpf_domain_t(m_inv & other.m_inv, stack & other.stack);
 }
@@ -952,7 +952,12 @@ ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, bool to_constants
     return res;
 }
 
-ebpf_domain_t ebpf_domain_t::narrow(const ebpf_domain_t& other) {
+// ebpf_domain_t ebpf_domain_t::widening_thresholds(const ebpf_domain_t& other, const crab::iterators::thresholds_t& ts)
+// {
+//     return ebpf_domain_t(m_inv.widening_thresholds(other.m_inv, ts), stack | other.stack);
+// }
+
+ebpf_domain_t ebpf_domain_t::narrow(const ebpf_domain_t& other) const {
     return ebpf_domain_t(m_inv.narrow(other.m_inv), stack & other.stack);
 }
 
@@ -2920,12 +2925,16 @@ void ebpf_domain_t::operator()(const Bin& bin) {
 
 string_invariant ebpf_domain_t::to_set() { return this->m_inv.to_set() + this->stack.to_set(); }
 
-std::ostream& operator<<(std::ostream& o, const ebpf_domain_t& dom) {
-    if (dom.is_bottom()) {
+void ebpf_domain_t::write(std::ostream& o) const {
+    if (is_bottom()) {
         o << "_|_";
     } else {
-        o << dom.m_inv << "\nStack: " << dom.stack;
+        o << m_inv << "\nStack: " << stack;
     }
+}
+
+std::ostream& operator<<(std::ostream& o, ebpf_domain_t dom) {
+    dom.write(o);
     return o;
 }
 
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 85f49b762..92b683d1c 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -8,6 +8,7 @@
 #include <optional>
 #include <vector>
 
+#include "crab/abstract_domain.hpp"
 #include "crab/array_domain.hpp"
 #include "crab/split_dbm.hpp"
 #include "crab/variable.hpp"
@@ -38,12 +39,11 @@ class ebpf_domain_t final {
     void operator|=(ebpf_domain_t&& other);
     void operator|=(const ebpf_domain_t& other);
     ebpf_domain_t operator|(ebpf_domain_t&& other) const;
-    ebpf_domain_t operator|(const ebpf_domain_t& other) const&;
-    ebpf_domain_t operator|(const ebpf_domain_t& other) &&;
+    ebpf_domain_t operator|(const ebpf_domain_t& other) const;
     ebpf_domain_t operator&(const ebpf_domain_t& other) const;
     ebpf_domain_t widen(const ebpf_domain_t& other, bool to_constants);
     ebpf_domain_t widening_thresholds(const ebpf_domain_t& other, const crab::iterators::thresholds_t& ts);
-    ebpf_domain_t narrow(const ebpf_domain_t& other);
+    ebpf_domain_t narrow(const ebpf_domain_t& other) const;
 
     typedef bool check_require_func_t(NumAbsDomain&, const linear_constraint_t&, std::string);
     void set_require_check(std::function<check_require_func_t> f);
@@ -81,6 +81,9 @@ class ebpf_domain_t final {
     void operator()(const ZeroCtxOffset&);
     void operator()(const IncrementLoopCounter&);
 
+    // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
+    void write(std::ostream& o) const;
+
     void initialize_loop_counter(label_t label);
     static ebpf_domain_t calculate_constant_limits();
   private:
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index d08f515d3..047dc1b72 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -6,7 +6,6 @@
 #include "crab/cfg.hpp"
 #include "crab/wto.hpp"
 
-#include "crab/ebpf_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 
 namespace crab {
@@ -45,6 +44,7 @@ class interleaved_fwd_fixpoint_iterator_t final {
     using iterator = typename invariant_table_t::iterator;
 
     cfg_t& _cfg;
+    abstract_domain_t _bottom_inv;
     wto_t _wto;
     invariant_table_t _pre, _post;
 
@@ -59,16 +59,28 @@ class interleaved_fwd_fixpoint_iterator_t final {
     bool _skip{true};
 
   private:
-    void set_pre(const label_t& label, const ebpf_domain_t& v) { _pre[label] = v; }
+    void set_pre(const label_t& label, const abstract_domain_t& v) {
+        auto res = _pre.insert({label, v});
+        if (!res.second) {
+            // if the insertion failed then we just update value
+            res.first->second = v;
+        }
+    }
 
-    void transform_to_post(const label_t& label, ebpf_domain_t pre) {
+    inline void transform_to_post(const label_t& label, abstract_domain_t pre) {
         basic_block_t& bb = _cfg.get_node(label);
         pre(bb);
-        _post[label] = std::move(pre);
+
+        auto it = _post.find(label);
+        if (it == _post.end()) {
+            _post.insert({label, std::move(pre)});
+        } else {
+            it->second = std::move(pre);
+        }
     }
 
-    [[nodiscard]] static ebpf_domain_t extrapolate(ebpf_domain_t before, const ebpf_domain_t& after,
-                                                   unsigned int iteration) {
+    [[nodiscard]] abstract_domain_t extrapolate(abstract_domain_t before, const abstract_domain_t& after,
+                                                unsigned int iteration) const {
         /// number of iterations until triggering widening
         constexpr auto _widening_delay = 2;
 
@@ -78,7 +90,8 @@ class interleaved_fwd_fixpoint_iterator_t final {
         return before.widen(after, iteration == _widening_delay);
     }
 
-    static ebpf_domain_t refine(ebpf_domain_t before, const ebpf_domain_t& after, unsigned int iteration) {
+    static abstract_domain_t refine(abstract_domain_t before, const abstract_domain_t& after,
+                                    unsigned int iteration) {
         if (iteration == 1) {
             return before & after;
         } else {
@@ -86,8 +99,8 @@ class interleaved_fwd_fixpoint_iterator_t final {
         }
     }
 
-    ebpf_domain_t join_all_prevs(const label_t& node) {
-        ebpf_domain_t res = ebpf_domain_t::bottom();
+    abstract_domain_t join_all_prevs(const label_t& node) {
+        abstract_domain_t res(_bottom_inv);
         for (const label_t& prev : _cfg.prev_nodes(node)) {
             res |= get_post(prev);
         }
@@ -95,27 +108,33 @@ class interleaved_fwd_fixpoint_iterator_t final {
     }
 
   public:
-    explicit interleaved_fwd_fixpoint_iterator_t(cfg_t& cfg) : _cfg(cfg), _wto(cfg) {
+    explicit interleaved_fwd_fixpoint_iterator_t(cfg_t& cfg, const abstract_domain_t& entry)
+        : _cfg(cfg), _bottom_inv(entry), _wto(cfg) {
+
+        _bottom_inv.set_to_bottom();
+
         for (const auto& label : _cfg.labels()) {
-            _pre.emplace(label, ebpf_domain_t::bottom());
-            _post.emplace(label, ebpf_domain_t::bottom());
+            _pre.emplace(label, _bottom_inv);
+            _post.emplace(label, _bottom_inv);
         }
+        set_pre(_cfg.entry_label(), entry);
     }
 
-    ebpf_domain_t get_pre(const label_t& node) { return _pre.at(node); }
+    abstract_domain_t get_pre(const label_t& node) { return _pre.at(node); }
 
-    ebpf_domain_t get_post(const label_t& node) { return _post.at(node); }
+    abstract_domain_t get_post(const label_t& node) { return _post.at(node); }
 
     void operator()(const label_t& node);
 
     void operator()(std::shared_ptr<wto_cycle_t>& cycle);
 
-    friend std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv);
+    friend std::pair<invariant_table_t, invariant_table_t>
+    run_forward_analyzer(cfg_t& cfg, abstract_domain_t entry_inv);
 };
 
-std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv) {
+std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, abstract_domain_t entry_inv) {
     // Go over the CFG in weak topological order (accounting for loops).
-    interleaved_fwd_fixpoint_iterator_t analyzer(cfg);
+    interleaved_fwd_fixpoint_iterator_t analyzer(cfg, entry_inv);
     if (thread_local_options.check_termination) {
         std::vector<label_t> cycle_heads;
         for (auto& component : analyzer._wto) {
@@ -144,7 +163,7 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(const label_t& node) {
         return;
     }
 
-    ebpf_domain_t pre = node == _cfg.entry_label() ? get_pre(node) : join_all_prevs(node);
+    abstract_domain_t pre = node == _cfg.entry_label() ? get_pre(node) : join_all_prevs(node);
 
     set_pre(node, pre);
     transform_to_post(node, pre);
@@ -167,7 +186,7 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
         }
     }
 
-    ebpf_domain_t invariant = ebpf_domain_t::bottom();
+    abstract_domain_t invariant(_bottom_inv);
     if (entry_in_this_cycle) {
         invariant = get_pre(_cfg.entry_label());
     } else {
@@ -188,7 +207,7 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
             if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head))
                 std::visit(*this, *component);
         }
-        ebpf_domain_t new_pre = join_all_prevs(head);
+        abstract_domain_t new_pre = join_all_prevs(head);
         if (new_pre <= invariant) {
             // Post-fixpoint reached
             set_pre(head, new_pre);
@@ -208,7 +227,7 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
             if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head))
                 std::visit(*this, *component);
         }
-        ebpf_domain_t new_pre = join_all_prevs(head);
+        abstract_domain_t new_pre = join_all_prevs(head);
         if (invariant <= new_pre) {
             // No more refinement possible(pre == new_pre)
             break;
diff --git a/src/crab/fwd_analyzer.hpp b/src/crab/fwd_analyzer.hpp
index a6e35e476..632da744c 100644
--- a/src/crab/fwd_analyzer.hpp
+++ b/src/crab/fwd_analyzer.hpp
@@ -6,13 +6,13 @@
 #include <tuple>
 
 #include "config.hpp"
+#include "crab/abstract_domain.hpp"
 #include "crab/cfg.hpp"
-#include "crab/ebpf_domain.hpp"
 
 namespace crab {
 
-using invariant_table_t = std::map<label_t, ebpf_domain_t>;
+using invariant_table_t = std::map<label_t, abstract_domain_t>;
 
-std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv);
+std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, abstract_domain_t entry_inv);
 
 } // namespace crab
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index cdee1e9cf..f7cd3265c 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -12,6 +12,7 @@
 
 #include <boost/algorithm/string.hpp>
 
+#include "crab/abstract_domain.hpp"
 #include "crab/ebpf_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 #include "crab_utils/lazy_allocator.hpp"
@@ -21,7 +22,7 @@
 #include "string_constraints.hpp"
 
 using crab::ebpf_domain_t;
-using std::string;
+using crab::linear_constraint_t;
 
 thread_local crab::lazy_allocator<program_info> global_program_info;
 thread_local ebpf_verifier_options_t thread_local_options;
@@ -32,9 +33,10 @@ static checks_db generate_report(cfg_t& cfg,
     checks_db m_db;
     for (const label_t& label : cfg.sorted_labels()) {
         basic_block_t& bb = cfg.get_node(label);
-        ebpf_domain_t from_inv(pre_invariants.at(label));
+        abstract_domain_t from_inv(pre_invariants.at(label));
+
         from_inv.set_require_check(
-            [&m_db, label](auto& inv, const crab::linear_constraint_t& cst, const std::string& s) {
+            [&m_db, label](auto& inv, const linear_constraint_t& cst, const std::string& s) {
                 if (inv.is_bottom())
                     return true;
                 if (cst.is_contradiction()) {
@@ -114,6 +116,43 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invarian
     return db;
 }
 
+/* EXTEND FOR NEW DOMAINS */
+static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
+    switch (options->abstract_domain) {
+    case abstract_domain_kind::EBPF_DOMAIN: {
+        ebpf_domain_t entry_inv = ebpf_domain_t::setup_entry(true);
+        return abstract_domain_t(entry_inv);
+    }
+    case abstract_domain_kind::TYPE_DOMAIN: {
+        // TODO
+    }
+    default:
+        // FIXME: supported abstract domains should be checked in check.cpp
+        std::cerr << "error: unsupported abstract domain\n";
+        std::exit(1);
+    }
+}
+
+/* EXTEND FOR NEW DOMAINS */
+static abstract_domain_t make_initial(abstract_domain_kind abstract_domain, const string_invariant& entry_invariant, bool setup_constraints) {
+
+    switch (abstract_domain) {
+    case abstract_domain_kind::EBPF_DOMAIN: {
+        ebpf_domain_t entry_inv = entry_invariant.is_bottom()
+                                      ? ebpf_domain_t::from_constraints({"false"}, setup_constraints)
+                                      : ebpf_domain_t::from_constraints(entry_invariant.value(), setup_constraints);
+        return abstract_domain_t(entry_inv);
+    }
+    case abstract_domain_kind::TYPE_DOMAIN: {
+        // TODO
+    }
+    default:
+        // FIXME: supported abstract domains should be checked in check.cpp
+        std::cerr << "error: unsupported abstract domain\n";
+        std::exit(1);
+    }
+}
+
 crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, const ebpf_verifier_options_t* options) {
     global_program_info = std::move(info);
     crab::domains::clear_global_state();
@@ -121,8 +160,9 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
     thread_local_options = *options;
 
     try {
+
+        abstract_domain_t entry_dom = make_initial(options);
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
-        ebpf_domain_t entry_dom = ebpf_domain_t::setup_entry(true);
         auto [pre_invariants, post_invariants] =
             crab::run_forward_analyzer(cfg, std::move(entry_dom));
         return crab_results(std::move(cfg),
@@ -171,7 +211,7 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
     thread_local_options = options;
     global_program_info = info;
     assert(!entry_invariant.is_bottom());
-    ebpf_domain_t entry_inv = ebpf_domain_t::from_constraints(entry_invariant.value(), options.setup_constraints);
+    abstract_domain_t entry_inv = make_initial(abstract_domain_kind::EBPF_DOMAIN, entry_invariant, options.setup_constraints);
     if (entry_inv.is_bottom())
         throw std::runtime_error("Entry invariant is inconsistent");
     cfg_t cfg = prepare_cfg(prog, info, !options.no_simplify, false);
@@ -186,7 +226,7 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
 
 /// Returned value is true if the program passes verification.
 crab_results ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const program_info& info,
-				 const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats) {
+                                 const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats) {
     if (options == nullptr)
         options = &ebpf_verifier_default_options;
 
@@ -195,7 +235,7 @@ crab_results ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, c
     cfg_t cfg = prepare_cfg(prog, info, !options->no_simplify);
 
     crab_results results = get_ebpf_report(os, cfg, info, options);
-    checks_db &report = results.db;
+    checks_db& report = results.db;
     if (options->print_failures) {
         print_report(os, report, prog, options->print_line_info);
     }
@@ -204,7 +244,7 @@ crab_results ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, c
         stats->total_warnings = report.total_warnings;
         stats->max_loop_count = report.get_max_loop_count();
     }
-    //return (report.total_warnings == 0);
+    // return (report.total_warnings == 0);
     return results;
 }
 

From 05046ca559b0fbe7e4efa482012eb38d20926bd0 Mon Sep 17 00:00:00 2001
From: Jorge Navas <navasjorgea@gmail.com>
Date: Fri, 25 Mar 2022 14:05:12 -0600
Subject: [PATCH 063/373] test: a script to run prevail on ebpf-samples

---
 scripts/runcheck.sh | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100755 scripts/runcheck.sh

diff --git a/scripts/runcheck.sh b/scripts/runcheck.sh
new file mode 100755
index 000000000..520d0e4cf
--- /dev/null
+++ b/scripts/runcheck.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+### Update this path to the root of your prevail repository.
+PREVAIL_ROOT=/Users/jorge/Repos/prevail-type-proofs
+
+
+EBPF_BENCHMARKS=${PREVAIL_ROOT}/ebpf-samples
+PREVAIL_CHECK=${PREVAIL_ROOT}/check
+DOMAINS="zoneCrab"
+PREFIX=prevail_$(date +"%m%d%y%H%M")
+
+for dom in $DOMAINS
+do
+    rm -f log_${dom}.txt
+    echo -n "Running Prevail with $dom ... "
+    echo "File,Result,Cpu,Mem"  1>> ${PREFIX}_${dom}.csv
+    for f in ${EBPF_BENCHMARKS}/*/*.o
+    do
+	sections=($(${PREVAIL_CHECK} $f -l 2> /dev/null))
+	for s in "${sections[@]}"
+	do
+	    echo "${PREVAIL_CHECK} ${f} ${s} --domain=${dom}" >> log_${dom}.txt
+	    echo -n $f:$s 1>> ${PREFIX}_${dom}.csv
+	    o=$(${PREVAIL_CHECK} ${f} ${s} --domain=${dom} 2>>log_${dom}.txt)
+	    echo -n ",$o" 1>> ${PREFIX}_${dom}.csv
+	    echo 1>> ${PREFIX}_${dom}.csv
+	done
+    done
+    echo "DONE"
+done

From 223306cb2a671910005eb77d63ab7299fe17ec91 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Fri, 11 Mar 2022 13:15:48 -0500
Subject: [PATCH 064/373] Initial implementation for type domain; Abstract
 transformers for assignment and memory instruction implemented; Join not
 implemented yet

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 204 +++++++++++++++++++++++++++++++++++++++
 src/crab/type_domain.hpp | 115 ++++++++++++++++++++++
 src/ebpf_proof.cpp       |  40 +++++++-
 src/ebpf_proof.hpp       |  17 ++++
 4 files changed, 375 insertions(+), 1 deletion(-)
 create mode 100644 src/crab/type_domain.cpp
 create mode 100644 src/crab/type_domain.hpp

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
new file mode 100644
index 000000000..ec41d1d67
--- /dev/null
+++ b/src/crab/type_domain.cpp
@@ -0,0 +1,204 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include <unordered_map>
+
+#include "crab/type_domain.hpp"
+
+using crab::ptr_t;
+using crab::ptr_with_off_t;
+using crab::ptr_no_off_t;
+using crab::ctx_t;
+
+void type_domain_t::operator()(const Undefined & u) {}
+void type_domain_t::operator()(const Un &u) {}
+void type_domain_t::operator()(const LoadMapFd &u) {}
+void type_domain_t::operator()(const Call &u) {}
+void type_domain_t::operator()(const Exit &u) {}
+void type_domain_t::operator()(const Jmp &u) {}
+void type_domain_t::operator()(const Packet & u) {}
+void type_domain_t::operator()(const LockAdd &u) {}
+void type_domain_t::operator()(const Assume &u) {}
+void type_domain_t::operator()(const Assert &u) {}
+
+
+type_domain_t type_domain_t::setup_entry(const ctx_t& _ctx) {
+
+    type_domain_t inv;
+
+    inv.types.insert(std::make_pair(R1_ARG, ptr_with_off_t(crab::region::T_CTX, 0)));
+    inv.types.insert(std::make_pair(R10_STACK_POINTER, ptr_with_off_t(crab::region::T_STACK, 512)));
+
+    for (auto& p : _ctx) {
+        inv.ctx.insert(p);
+    }
+
+    return inv;
+}
+
+void type_domain_t::operator()(const Bin& bin) {
+
+    if (std::holds_alternative<Reg>(bin.v)) {
+        Reg src = std::get<Reg>(bin.v);
+        switch (bin.op)
+        {
+            case Bin::Op::MOV: {
+
+                auto it = types.find(src.v);
+                if (it == types.end()) {
+                    std::cout << "type error: assigning an unknown pointer or a number\n";
+                    exit(0);
+                }
+
+                types.insert(std::make_pair(bin.dst.v, it->second));
+            }
+
+            default:
+                break;
+        }
+    }
+}
+
+void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
+
+    int offset = b.access.offset;
+    Reg basereg = b.access.basereg;
+
+    auto it = types.find(basereg.v);
+    if (it == types.end()) {
+        std::cout << "type_error: loading from an unknown pointer, or from number\n";
+        exit(0);
+    }
+
+    ptr_t type_basereg = it->second;
+
+    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
+        std::cout << "type_error: loading from either packet or shared region not allowed\n";
+        exit(0);
+    }
+
+    ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
+    int load_at = offset+type_with_off.offset;
+
+    switch (type_with_off.r) {
+        case crab::region::T_STACK: {
+
+            auto it = stack.find(load_at);
+
+            if (it == stack.end()) {
+                std::cout << "type_error: no field at loaded offset in stack\n";
+                exit(0);
+            }
+            ptr_t type_loaded = it->second;
+
+            if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
+                ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
+                types.insert(std::make_pair(target_reg.v, type_loaded_with_off));
+            }
+            else {
+                ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
+                types.insert(std::make_pair(target_reg.v, type_loaded_no_off));
+            }
+
+            break;
+        }
+        case crab::region::T_CTX: {
+
+            auto it = ctx.find(load_at);
+
+            if (it == ctx.end()) {
+                std::cout << "type_error: no field at loaded offset in context\n";
+                exit(0);
+            }
+            ptr_no_off_t type_loaded = it->second;
+
+            types.insert(std::make_pair(target_reg.v, type_loaded));
+            break;
+        }
+
+        default: {
+            assert(false);
+        }
+    }
+}
+
+void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
+
+    int offset = b.access.offset;
+    Reg basereg = b.access.basereg;
+
+    auto it = types.find(basereg.v);
+    if (it == types.end()) {
+        std::cout << "type_error: storing at an unknown pointer, or from number\n";
+        exit(0);
+    }
+
+    ptr_t type_basereg = it->second;
+
+    auto it2 = types.find(target_reg.v);
+    if (it2 == types.end()) {
+        std::cout << "type_error: storing either a number or an unknown pointer\n";
+        exit(0);
+    }
+
+    ptr_t type_stored = it2->second;
+
+    if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
+        ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
+        if (type_stored_with_off.r == crab::region::T_STACK) {
+            std::cout << "type_error: we do not store stack pointers into stack\n";
+            exit(0);
+        }
+    }
+
+    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
+        std::cout << "type_error: we cannot store pointers into packet or shared\n";
+        exit(0);
+    }
+
+    ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
+    if (type_basereg_with_off.r == crab::region::T_CTX) {
+        std::cout << "type_error: we cannot store pointers into ctx\n";
+        exit(0);
+    }
+
+    int store_at = offset+type_basereg_with_off.offset;
+
+    auto it3 = stack.find(store_at);
+    if (it3 == stack.end()) {
+        stack.insert(std::make_pair(store_at, type_stored));
+    }
+    else {
+        auto type_in_stack = it3->second;
+        if (type_stored.index() != type_in_stack.index()) {
+            std::cout << "type_error: type being stored is not the same as stored already in stack\n";
+            exit(0);
+        }
+        if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
+            if (std::get<ptr_with_off_t>(type_stored) != std::get<ptr_with_off_t>(type_in_stack)) {
+                std::cout << "type_error: type being stored is not the same as stored already in stack\n";
+                exit(0);
+            }
+        }
+        else {
+            if (std::get<ptr_no_off_t>(type_stored) != std::get<ptr_no_off_t>(type_in_stack)) {
+                std::cout << "type_error: type being stored is not the same as stored already in stack\n";
+                exit(0);
+            }
+        }
+    }
+}
+
+void type_domain_t::operator()(const Mem& b) {
+
+    if (std::holds_alternative<Reg>(b.value)) {
+        if (b.is_load) {
+            do_load(b, std::get<Reg>(b.value));
+        } else {
+            do_mem_store(b, std::get<Reg>(b.value));
+        }
+    } else {
+        std::cout << "Either loading to a number (not allowed) or storing a number (not allowed yet)\n";
+        exit(0);
+    }
+}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
new file mode 100644
index 000000000..3a2a1a013
--- /dev/null
+++ b/src/crab/type_domain.hpp
@@ -0,0 +1,115 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <unordered_map>
+
+#include "crab/cfg.hpp"
+
+namespace crab {
+
+enum class region {
+	T_CTX,
+	T_STACK,
+	T_PACKET,
+	T_SHARED,
+};
+
+
+struct ptr_with_off_t;
+
+struct ptr_no_off_t {
+    region r;
+
+    ptr_no_off_t(region _r) : r(_r) {}
+    ptr_no_off_t(const ptr_no_off_t& p) : r(p.r) {}
+    bool operator!=(const ptr_with_off_t& p) {
+        return false;
+    }
+    bool operator!=(const ptr_no_off_t& p) {
+        return r != p.r;
+    }
+};
+
+struct ptr_with_off_t {
+    region r;
+    int offset;
+
+    ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
+    ptr_with_off_t(const ptr_with_off_t& p) : r(p.r), offset(p.offset) {}
+    bool operator!=(const ptr_no_off_t& p) {
+        return false;
+    }
+    bool operator!=(const ptr_with_off_t& p) {
+        return r != p.r;
+    }
+};
+
+struct reg_with_loc_t {
+    uint8_t r;
+    int loc;
+};
+
+using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+
+using stack_t = std::unordered_map<int, ptr_t>;
+using types_t = std::unordered_map<uint8_t, ptr_t>;
+using ctx_t = std::unordered_map<int, ptr_no_off_t>;
+}
+
+class type_domain_t final {
+
+    crab::stack_t stack;
+    crab::types_t types;
+    crab::ctx_t ctx;
+
+  public:
+
+  type_domain_t() {}
+  // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+  static type_domain_t setup_entry(const crab::ctx_t&);
+  // bottom/top
+  void set_to_top();
+  void set_to_bottom();
+  bool is_bottom() const;
+  bool is_top() const;
+  // inclusion
+  bool operator<=(const type_domain_t& other) const;
+  // join
+  void operator|=(type_domain_t& other) const;
+  void operator|=(const type_domain_t& other) const;
+  type_domain_t operator|(type_domain_t& other) const;
+  type_domain_t operator|(const type_domain_t& other) const;
+  // meet
+  type_domain_t operator&(const type_domain_t& other) const;
+  // widening
+  type_domain_t widen(const type_domain_t& other) const;
+  // narrowing
+  type_domain_t narrow(const type_domain_t& other) const;
+
+  //// abstract transformers
+  void operator()(const Undefined &);
+  void operator()(const Bin &);
+  void operator()(const Un &) ;
+  void operator()(const LoadMapFd &);
+  void operator()(const Call &);
+  void operator()(const Exit &);
+  void operator()(const Jmp &);
+  void operator()(const Mem &);
+  void operator()(const Packet &);
+  void operator()(const LockAdd &);
+  void operator()(const Assume &);
+  void operator()(const Assert &);
+  void operator()(const basic_block_t& bb) {
+      for (const Instruction& statement : bb) {
+        std::visit(*this, statement);
+    }
+  }
+
+  private:
+
+  void do_load(const Mem&, const Reg&);
+  void do_mem_store(const Mem&, const Reg&);
+
+}; // end type_domain_t
diff --git a/src/ebpf_proof.cpp b/src/ebpf_proof.cpp
index f6f6ba2d0..26a86d2d7 100644
--- a/src/ebpf_proof.cpp
+++ b/src/ebpf_proof.cpp
@@ -1,9 +1,34 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
+
 #include "ebpf_proof.hpp"
 
+type_domain_t get_post(const label_t& node, types_table_t& t)
+{
+    auto it = t.find(node);
+    if (it != t.end()) {
+        std::cout << "type information is not available for basic block\n";
+        exit(0);
+    }
+    return it->second;
+}
+
+type_domain_t join_all_prevs(const label_t& node, types_table_t& t, const cfg_t& cfg) {
+    type_domain_t type;
+    for (const label_t& prev : cfg.prev_nodes(node)) {
+        // rather than join, it just assigns the type domain of previous basic block; should work for no branch examples
+        type = get_post(prev, t);
+    }
+    return type;
+}
+
 bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
                          const ebpf_verifier_options_t* options, const crab_results& results) {
+
+    ctx_t ctx(info.type.context_descriptor);
+
+    types_table_t types_table;
+
     if (!results.pass_verify()) {
         // If the program is not correct then we cannot generate a proof
         return false;
@@ -20,6 +45,19 @@ bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const prog
       implement it so that we can be sure that our types are correct.
      */
 
-    s << "TODO: proof\n";
+    type_domain_t type = type_domain_t::setup_entry(ctx.packet_ptrs);
+
+    auto labels = results.cfg.labels();
+    for (auto& label : labels)
+    {
+        if (label != results.cfg.entry_label()) {
+            type = join_all_prevs(label, types_table, results.cfg);
+        }
+        auto& bb = results.cfg.get_node(label);
+        type(bb);
+
+        types_table.insert(std::make_pair(label, type));
+    }
+
     return false;
 }
diff --git a/src/ebpf_proof.hpp b/src/ebpf_proof.hpp
index 65e479758..851d0280a 100644
--- a/src/ebpf_proof.hpp
+++ b/src/ebpf_proof.hpp
@@ -5,6 +5,23 @@
 #include "config.hpp"
 #include "crab/cfg.hpp"
 #include "crab_verifier.hpp"
+#include "crab/type_domain.hpp"
+
+using types_table_t = std::map<label_t, type_domain_t>;
+
+using offset_to_ptr_t = std::unordered_map<int, crab::ptr_no_off_t>;
+
+struct ctx_t {
+    offset_to_ptr_t packet_ptrs;
+
+    ctx_t(const ebpf_context_descriptor_t* desc)
+    {
+        packet_ptrs.insert(std::make_pair(desc->data, crab::ptr_no_off_t(crab::region::T_PACKET)));
+        packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
+    }
+};
+
+type_domain_t join_all_prevs(const label_t& label);
 
 // - prog is a prevail representation of the eBPF program
 // - results contains the Crab CFG together with the inferred invariants

From a8644d9958d646317d85642b6d661e02ceadc864 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 2 Jul 2023 02:46:14 -0400
Subject: [PATCH 065/373] Fixed error prints; moved functionality from
 ebpf_proof to testcase/type_domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 51 +++++++++++++++-------------------------
 src/crab/type_domain.hpp | 33 ++++++++++++++++----------
 src/ebpf_proof.cpp       | 37 -----------------------------
 src/ebpf_proof.hpp       | 16 -------------
 4 files changed, 39 insertions(+), 98 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index ec41d1d67..f666b3054 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -5,6 +5,8 @@
 
 #include "crab/type_domain.hpp"
 
+using crab::___print___;
+
 using crab::ptr_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
@@ -21,8 +23,7 @@ void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
 void type_domain_t::operator()(const Assert &u) {}
 
-
-type_domain_t type_domain_t::setup_entry(const ctx_t& _ctx) {
+type_domain_t type_domain_t::setup_entry(const crab::offset_to_ptr_t& _ctx) {
 
     type_domain_t inv;
 
@@ -46,8 +47,7 @@ void type_domain_t::operator()(const Bin& bin) {
 
                 auto it = types.find(src.v);
                 if (it == types.end()) {
-                    std::cout << "type error: assigning an unknown pointer or a number\n";
-                    exit(0);
+                    CRAB_ERROR("type error: assigning an unknown pointer or a number");
                 }
 
                 types.insert(std::make_pair(bin.dst.v, it->second));
@@ -66,19 +66,17 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
     auto it = types.find(basereg.v);
     if (it == types.end()) {
-        std::cout << "type_error: loading from an unknown pointer, or from number\n";
-        exit(0);
+        CRAB_ERROR("type_error: loading from an unknown pointer, or from number");
     }
 
     ptr_t type_basereg = it->second;
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        std::cout << "type_error: loading from either packet or shared region not allowed\n";
-        exit(0);
+        CRAB_ERROR("type_error: loading from either packet or shared region not allowed");
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
-    int load_at = offset+type_with_off.offset;
+    uint64_t load_at = offset+type_with_off.offset;
 
     switch (type_with_off.r) {
         case crab::region::T_STACK: {
@@ -86,8 +84,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = stack.find(load_at);
 
             if (it == stack.end()) {
-                std::cout << "type_error: no field at loaded offset in stack\n";
-                exit(0);
+                CRAB_ERROR("type_error: no field at loaded offset in stack");
             }
             ptr_t type_loaded = it->second;
 
@@ -107,8 +104,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = ctx.find(load_at);
 
             if (it == ctx.end()) {
-                std::cout << "type_error: no field at loaded offset in context\n";
-                exit(0);
+                CRAB_ERROR("type_error: no field at loaded offset in context");
             }
             ptr_no_off_t type_loaded = it->second;
 
@@ -129,16 +125,14 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
     auto it = types.find(basereg.v);
     if (it == types.end()) {
-        std::cout << "type_error: storing at an unknown pointer, or from number\n";
-        exit(0);
+        CRAB_ERROR("type_error: storing at an unknown pointer, or from number");
     }
 
     ptr_t type_basereg = it->second;
 
     auto it2 = types.find(target_reg.v);
     if (it2 == types.end()) {
-        std::cout << "type_error: storing either a number or an unknown pointer\n";
-        exit(0);
+        CRAB_ERROR("type_error: storing either a number or an unknown pointer");
     }
 
     ptr_t type_stored = it2->second;
@@ -146,23 +140,20 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
         ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
         if (type_stored_with_off.r == crab::region::T_STACK) {
-            std::cout << "type_error: we do not store stack pointers into stack\n";
-            exit(0);
+            CRAB_ERROR("type_error: we do not store stack pointers into stack");
         }
     }
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        std::cout << "type_error: we cannot store pointers into packet or shared\n";
-        exit(0);
+        CRAB_ERROR("type_error: we cannot store pointers into packet or shared");
     }
 
     ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
     if (type_basereg_with_off.r == crab::region::T_CTX) {
-        std::cout << "type_error: we cannot store pointers into ctx\n";
-        exit(0);
+        CRAB_ERROR("type_error: we cannot store pointers into ctx");
     }
 
-    int store_at = offset+type_basereg_with_off.offset;
+    uint64_t store_at = offset+type_basereg_with_off.offset;
 
     auto it3 = stack.find(store_at);
     if (it3 == stack.end()) {
@@ -171,19 +162,16 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     else {
         auto type_in_stack = it3->second;
         if (type_stored.index() != type_in_stack.index()) {
-            std::cout << "type_error: type being stored is not the same as stored already in stack\n";
-            exit(0);
+            CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
         }
         if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
             if (std::get<ptr_with_off_t>(type_stored) != std::get<ptr_with_off_t>(type_in_stack)) {
-                std::cout << "type_error: type being stored is not the same as stored already in stack\n";
-                exit(0);
+                CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
             }
         }
         else {
             if (std::get<ptr_no_off_t>(type_stored) != std::get<ptr_no_off_t>(type_in_stack)) {
-                std::cout << "type_error: type being stored is not the same as stored already in stack\n";
-                exit(0);
+                CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
             }
         }
     }
@@ -198,7 +186,6 @@ void type_domain_t::operator()(const Mem& b) {
             do_mem_store(b, std::get<Reg>(b.value));
         }
     } else {
-        std::cout << "Either loading to a number (not allowed) or storing a number (not allowed yet)\n";
-        exit(0);
+        CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet)");
     }
 }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 3a2a1a013..e00799e37 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -16,17 +16,12 @@ enum class region {
 	T_SHARED,
 };
 
-
-struct ptr_with_off_t;
-
 struct ptr_no_off_t {
     region r;
 
     ptr_no_off_t(region _r) : r(_r) {}
     ptr_no_off_t(const ptr_no_off_t& p) : r(p.r) {}
-    bool operator!=(const ptr_with_off_t& p) {
-        return false;
-    }
+
     bool operator!=(const ptr_no_off_t& p) {
         return r != p.r;
     }
@@ -38,9 +33,7 @@ struct ptr_with_off_t {
 
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
     ptr_with_off_t(const ptr_with_off_t& p) : r(p.r), offset(p.offset) {}
-    bool operator!=(const ptr_no_off_t& p) {
-        return false;
-    }
+
     bool operator!=(const ptr_with_off_t& p) {
         return r != p.r;
     }
@@ -53,22 +46,34 @@ struct reg_with_loc_t {
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 
-using stack_t = std::unordered_map<int, ptr_t>;
+using stack_t = std::unordered_map<uint64_t, ptr_t>;
 using types_t = std::unordered_map<uint8_t, ptr_t>;
-using ctx_t = std::unordered_map<int, ptr_no_off_t>;
+
+
+using offset_to_ptr_t = std::unordered_map<int, crab::ptr_no_off_t>;
+
+struct ctx_t {
+    offset_to_ptr_t packet_ptrs;
+
+    ctx_t(const ebpf_context_descriptor_t* desc)
+    {
+        packet_ptrs.insert(std::make_pair(desc->data, crab::ptr_no_off_t(crab::region::T_PACKET)));
+        packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
+    }
+};
 }
 
 class type_domain_t final {
 
     crab::stack_t stack;
     crab::types_t types;
-    crab::ctx_t ctx;
+    crab::offset_to_ptr_t ctx;
 
   public:
 
   type_domain_t() {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-  static type_domain_t setup_entry(const crab::ctx_t&);
+  static type_domain_t setup_entry(const crab::offset_to_ptr_t&);
   // bottom/top
   void set_to_top();
   void set_to_bottom();
@@ -113,3 +118,5 @@ class type_domain_t final {
   void do_mem_store(const Mem&, const Reg&);
 
 }; // end type_domain_t
+
+using types_table_t = std::map<label_t, type_domain_t>;
diff --git a/src/ebpf_proof.cpp b/src/ebpf_proof.cpp
index 26a86d2d7..0ec47b746 100644
--- a/src/ebpf_proof.cpp
+++ b/src/ebpf_proof.cpp
@@ -3,32 +3,9 @@
 
 #include "ebpf_proof.hpp"
 
-type_domain_t get_post(const label_t& node, types_table_t& t)
-{
-    auto it = t.find(node);
-    if (it != t.end()) {
-        std::cout << "type information is not available for basic block\n";
-        exit(0);
-    }
-    return it->second;
-}
-
-type_domain_t join_all_prevs(const label_t& node, types_table_t& t, const cfg_t& cfg) {
-    type_domain_t type;
-    for (const label_t& prev : cfg.prev_nodes(node)) {
-        // rather than join, it just assigns the type domain of previous basic block; should work for no branch examples
-        type = get_post(prev, t);
-    }
-    return type;
-}
-
 bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
                          const ebpf_verifier_options_t* options, const crab_results& results) {
 
-    ctx_t ctx(info.type.context_descriptor);
-
-    types_table_t types_table;
-
     if (!results.pass_verify()) {
         // If the program is not correct then we cannot generate a proof
         return false;
@@ -45,19 +22,5 @@ bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const prog
       implement it so that we can be sure that our types are correct.
      */
 
-    type_domain_t type = type_domain_t::setup_entry(ctx.packet_ptrs);
-
-    auto labels = results.cfg.labels();
-    for (auto& label : labels)
-    {
-        if (label != results.cfg.entry_label()) {
-            type = join_all_prevs(label, types_table, results.cfg);
-        }
-        auto& bb = results.cfg.get_node(label);
-        type(bb);
-
-        types_table.insert(std::make_pair(label, type));
-    }
-
     return false;
 }
diff --git a/src/ebpf_proof.hpp b/src/ebpf_proof.hpp
index 851d0280a..8137e019b 100644
--- a/src/ebpf_proof.hpp
+++ b/src/ebpf_proof.hpp
@@ -7,22 +7,6 @@
 #include "crab_verifier.hpp"
 #include "crab/type_domain.hpp"
 
-using types_table_t = std::map<label_t, type_domain_t>;
-
-using offset_to_ptr_t = std::unordered_map<int, crab::ptr_no_off_t>;
-
-struct ctx_t {
-    offset_to_ptr_t packet_ptrs;
-
-    ctx_t(const ebpf_context_descriptor_t* desc)
-    {
-        packet_ptrs.insert(std::make_pair(desc->data, crab::ptr_no_off_t(crab::region::T_PACKET)));
-        packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
-    }
-};
-
-type_domain_t join_all_prevs(const label_t& label);
-
 // - prog is a prevail representation of the eBPF program
 // - results contains the Crab CFG together with the inferred invariants
 //

From 6ea1e0ed12600049824e1d8b47f8faa84f9c7c46 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 2 Jul 2023 02:49:36 -0400
Subject: [PATCH 066/373] Added shared_ptrs for types and context

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 63 ++++++++++++++++++++++++++--------------
 src/crab/type_domain.hpp | 48 +++++++++++++++++++++++++-----
 2 files changed, 81 insertions(+), 30 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index f666b3054..30cfde9ac 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -6,11 +6,18 @@
 #include "crab/type_domain.hpp"
 
 using crab::___print___;
-
 using crab::ptr_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
 using crab::ctx_t;
+using crab::types_t;
+using crab::reg_with_loc_t;
+
+void update(std::shared_ptr<types_t> m, const reg_with_loc_t& key, const ptr_t& value) {
+    auto it = m->insert(std::make_pair(key, value));
+    if (not it.second) it.first->second = value;
+}
+
 
 void type_domain_t::operator()(const Undefined & u) {}
 void type_domain_t::operator()(const Un &u) {}
@@ -23,16 +30,15 @@ void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
 void type_domain_t::operator()(const Assert &u) {}
 
-type_domain_t type_domain_t::setup_entry(const crab::offset_to_ptr_t& _ctx) {
+type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<types_t> _types) {
 
-    type_domain_t inv;
+    type_domain_t inv(label_t::entry);
 
-    inv.types.insert(std::make_pair(R1_ARG, ptr_with_off_t(crab::region::T_CTX, 0)));
-    inv.types.insert(std::make_pair(R10_STACK_POINTER, ptr_with_off_t(crab::region::T_STACK, 512)));
+    inv.types = _types;
+    inv.ctx = _ctx;
 
-    for (auto& p : _ctx) {
-        inv.ctx.insert(p);
-    }
+    inv.live_vars[R1_ARG] = crab::reg_with_loc_t(R1_ARG, label_t::entry, -1);
+    inv.live_vars[R10_STACK_POINTER] = crab::reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
 
     return inv;
 }
@@ -45,12 +51,15 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto it = types.find(src.v);
-                if (it == types.end()) {
+                auto reg_to_look = reg_with_loc_t(src.v, label, -1);
+                auto it = types->find(reg_to_look);
+                if (it == types->end()) {
                     CRAB_ERROR("type error: assigning an unknown pointer or a number");
                 }
 
-                types.insert(std::make_pair(bin.dst.v, it->second));
+                auto reg = reg_with_loc_t(bin.dst.v, label, -1);
+                update(types, reg, it->second);
+                live_vars[bin.dst.v] = reg;
             }
 
             default:
@@ -64,8 +73,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = types.find(basereg.v);
-    if (it == types.end()) {
+    auto reg_to_look = reg_with_loc_t(basereg.v, label, -1);
+    auto it = types->find(reg_to_look);
+    if (it == types->end()) {
         CRAB_ERROR("type_error: loading from an unknown pointer, or from number");
     }
 
@@ -90,25 +100,32 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                types.insert(std::make_pair(target_reg.v, type_loaded_with_off));
+                auto reg = reg_with_loc_t(target_reg.v, label, -1);
+                update(types, reg, type_loaded_with_off);
+                live_vars[target_reg.v] = reg;
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
-                types.insert(std::make_pair(target_reg.v, type_loaded_no_off));
+                auto reg = reg_with_loc_t(target_reg.v, label, -1);
+                update(types, reg, type_loaded_no_off);
+                live_vars[target_reg.v] = reg;
             }
 
             break;
         }
         case crab::region::T_CTX: {
 
-            auto it = ctx.find(load_at);
+            auto ptrs = ctx->packet_ptrs;
+            auto it = ptrs.find(load_at);
 
-            if (it == ctx.end()) {
+            if (it == ptrs.end()) {
                 CRAB_ERROR("type_error: no field at loaded offset in context");
             }
             ptr_no_off_t type_loaded = it->second;
 
-            types.insert(std::make_pair(target_reg.v, type_loaded));
+            auto reg = reg_with_loc_t(target_reg.v, label, -1);
+            update(types, reg, type_loaded);
+            live_vars[target_reg.v] = reg;
             break;
         }
 
@@ -123,15 +140,17 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = types.find(basereg.v);
-    if (it == types.end()) {
+    auto reg_to_look = reg_with_loc_t(basereg.v, label, -1);
+    auto it = types->find(reg_to_look);
+    if (it == types->end()) {
         CRAB_ERROR("type_error: storing at an unknown pointer, or from number");
     }
 
     ptr_t type_basereg = it->second;
 
-    auto it2 = types.find(target_reg.v);
-    if (it2 == types.end()) {
+    reg_to_look = reg_with_loc_t(target_reg.v, label, -1);
+    auto it2 = types->find(reg_to_look);
+    if (it2 == types->end()) {
         CRAB_ERROR("type_error: storing either a number or an unknown pointer");
     }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index e00799e37..feed28c70 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -40,14 +40,23 @@ struct ptr_with_off_t {
 };
 
 struct reg_with_loc_t {
-    uint8_t r;
-    int loc;
+    int r;
+    std::pair<label_t, int> loc;
+
+    reg_with_loc_t() : r(-1), loc(std::make_pair(label_t::entry, -1)) {}
+    reg_with_loc_t(int _r, const label_t& l, int loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
+
+    bool operator==(const reg_with_loc_t& other) const {
+        return (r == other.r && loc.first == other.loc.first && loc.second == other.loc.second);
+    }
 };
 
+
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 
 using stack_t = std::unordered_map<uint64_t, ptr_t>;
-using types_t = std::unordered_map<uint8_t, ptr_t>;
+using types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+using live_vars_t = std::array<reg_with_loc_t, 11>;
 
 
 using offset_to_ptr_t = std::unordered_map<int, crab::ptr_no_off_t>;
@@ -66,14 +75,16 @@ struct ctx_t {
 class type_domain_t final {
 
     crab::stack_t stack;
-    crab::types_t types;
-    crab::offset_to_ptr_t ctx;
+    std::shared_ptr<crab::types_t> types;
+    crab::live_vars_t live_vars;
+    std::shared_ptr<crab::ctx_t> ctx;
+    label_t label;
 
   public:
 
-  type_domain_t() {}
+  type_domain_t(const label_t& _l) : label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-  static type_domain_t setup_entry(const crab::offset_to_ptr_t&);
+  static type_domain_t setup_entry(std::shared_ptr<crab::ctx_t>, std::shared_ptr<crab::types_t>);
   // bottom/top
   void set_to_top();
   void set_to_bottom();
@@ -107,6 +118,7 @@ class type_domain_t final {
   void operator()(const Assume &);
   void operator()(const Assert &);
   void operator()(const basic_block_t& bb) {
+      label = bb.label();
       for (const Instruction& statement : bb) {
         std::visit(*this, statement);
     }
@@ -119,4 +131,24 @@ class type_domain_t final {
 
 }; // end type_domain_t
 
-using types_table_t = std::map<label_t, type_domain_t>;
+// adapted from top answer in
+// https://stackoverflow.com/questions/17016175/c-unordered-map-using-a-custom-class-type-as-the-key
+// works for now but needs to be checked again
+template <>
+struct std::hash<crab::reg_with_loc_t>
+{
+    std::size_t operator()(const crab::reg_with_loc_t& reg) const
+    {
+        using std::size_t;
+        using std::hash;
+        using std::string;
+
+        // Compute individual hash values for first,
+        // second and third and combine them using XOR
+        // and bit shifting:
+
+        return ((hash<int>()(reg.r)
+               ^ (hash<int>()(reg.loc.first.from) << 1)) >> 1)
+               ^ (hash<int>()(reg.loc.second) << 1);
+    }
+};

From c304b2af7b78dde438b22efe82ccca8836e0b218 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 16:14:33 -0400
Subject: [PATCH 067/373] Proper lookups using live_vars and global types

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 30cfde9ac..2ceb27026 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -37,8 +37,8 @@ type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::share
     inv.types = _types;
     inv.ctx = _ctx;
 
-    inv.live_vars[R1_ARG] = crab::reg_with_loc_t(R1_ARG, label_t::entry, -1);
-    inv.live_vars[R10_STACK_POINTER] = crab::reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
+    inv.live_vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
+    inv.live_vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
 
     return inv;
 }
@@ -51,10 +51,10 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto reg_to_look = reg_with_loc_t(src.v, label, -1);
+                auto reg_to_look = live_vars[src.v];    // need checks that array actually contains an element, not default value
                 auto it = types->find(reg_to_look);
                 if (it == types->end()) {
-                    CRAB_ERROR("type error: assigning an unknown pointer or a number");
+                    CRAB_ERROR("type error: assigning an unknown pointer or a number - R", src.v);
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, label, -1);
@@ -73,16 +73,16 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = reg_with_loc_t(basereg.v, label, -1);
+    auto reg_to_look = live_vars[basereg.v];
     auto it = types->find(reg_to_look);
     if (it == types->end()) {
-        CRAB_ERROR("type_error: loading from an unknown pointer, or from number");
+        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", basereg.v);
     }
 
     ptr_t type_basereg = it->second;
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: loading from either packet or shared region not allowed");
+        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - R", basereg.v);
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
@@ -94,7 +94,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = stack.find(load_at);
 
             if (it == stack.end()) {
-                CRAB_ERROR("type_error: no field at loaded offset in stack");
+                CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
             }
             ptr_t type_loaded = it->second;
 
@@ -119,7 +119,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = ptrs.find(load_at);
 
             if (it == ptrs.end()) {
-                CRAB_ERROR("type_error: no field at loaded offset in context");
+                CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
             }
             ptr_no_off_t type_loaded = it->second;
 
@@ -140,18 +140,18 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = reg_with_loc_t(basereg.v, label, -1);
+    auto reg_to_look = live_vars[basereg.v];
     auto it = types->find(reg_to_look);
     if (it == types->end()) {
-        CRAB_ERROR("type_error: storing at an unknown pointer, or from number");
+        CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
     }
 
     ptr_t type_basereg = it->second;
 
-    reg_to_look = reg_with_loc_t(target_reg.v, label, -1);
+    reg_to_look = live_vars[target_reg.v];
     auto it2 = types->find(reg_to_look);
     if (it2 == types->end()) {
-        CRAB_ERROR("type_error: storing either a number or an unknown pointer");
+        CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
     }
 
     ptr_t type_stored = it2->second;
@@ -159,17 +159,17 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
         ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
         if (type_stored_with_off.r == crab::region::T_STACK) {
-            CRAB_ERROR("type_error: we do not store stack pointers into stack");
+            CRAB_ERROR("type_error: we cannot store stack pointer, R", (int)target_reg.v, ", into stack");
         }
     }
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: we cannot store pointers into packet or shared");
+        CRAB_ERROR("type_error: we cannot store pointer, R", (int)target_reg.v, ", into packet or shared");
     }
 
     ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
     if (type_basereg_with_off.r == crab::region::T_CTX) {
-        CRAB_ERROR("type_error: we cannot store pointers into ctx");
+        CRAB_ERROR("type_error: we cannot store pointer, R", (int)target_reg.v, ", into ctx");
     }
 
     uint64_t store_at = offset+type_basereg_with_off.offset;
@@ -181,16 +181,16 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     else {
         auto type_in_stack = it3->second;
         if (type_stored.index() != type_in_stack.index()) {
-            CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
+            CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
         }
         if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
             if (std::get<ptr_with_off_t>(type_stored) != std::get<ptr_with_off_t>(type_in_stack)) {
-                CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
+                CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
             }
         }
         else {
             if (std::get<ptr_no_off_t>(type_stored) != std::get<ptr_no_off_t>(type_in_stack)) {
-                CRAB_ERROR("type_error: type being stored is not the same as stored already in stack");
+                CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
             }
         }
     }
@@ -205,6 +205,6 @@ void type_domain_t::operator()(const Mem& b) {
             do_mem_store(b, std::get<Reg>(b.value));
         }
     } else {
-        CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet)");
+        CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet) - ", std::get<Imm>(b.value).v);
     }
 }

From 76d4752485ae7c11d38446cbd0a3417d021bdbd4 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:06:49 -0400
Subject: [PATCH 068/373] Support for join operations; better error printing;
 refactored;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 40 +++++++++++----------
 src/crab/type_domain.hpp | 77 +++++++++++++++++++++++++++++++++++-----
 2 files changed, 91 insertions(+), 26 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 2ceb27026..87df83338 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -19,6 +19,10 @@ void update(std::shared_ptr<types_t> m, const reg_with_loc_t& key, const ptr_t&
 }
 
 
+type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
+    return type_domain_t(live_def | other.live_def, stack | other.stack, label, other.types, other.ctx);
+}
+
 void type_domain_t::operator()(const Undefined & u) {}
 void type_domain_t::operator()(const Un &u) {}
 void type_domain_t::operator()(const LoadMapFd &u) {}
@@ -37,8 +41,8 @@ type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::share
     inv.types = _types;
     inv.ctx = _ctx;
 
-    inv.live_vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
-    inv.live_vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
+    inv.live_def.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
+    inv.live_def.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
 
     return inv;
 }
@@ -51,15 +55,15 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto reg_to_look = live_vars[src.v];    // need checks that array actually contains an element, not default value
+                auto reg_to_look = live_def.vars[src.v];    // need checks that array actually contains an element, not default value
                 auto it = types->find(reg_to_look);
                 if (it == types->end()) {
-                    CRAB_ERROR("type error: assigning an unknown pointer or a number - R", src.v);
+                    CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, label, -1);
                 update(types, reg, it->second);
-                live_vars[bin.dst.v] = reg;
+                live_def.vars[bin.dst.v] = reg;
             }
 
             default:
@@ -73,16 +77,16 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = live_vars[basereg.v];
+    auto reg_to_look = live_def.vars[basereg.v];
     auto it = types->find(reg_to_look);
     if (it == types->end()) {
-        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", basereg.v);
+        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", (int)basereg.v);
     }
 
     ptr_t type_basereg = it->second;
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - R", basereg.v);
+        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - R", (int)basereg.v);
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
@@ -91,9 +95,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     switch (type_with_off.r) {
         case crab::region::T_STACK: {
 
-            auto it = stack.find(load_at);
+            auto it = stack.ptrs.find(load_at);
 
-            if (it == stack.end()) {
+            if (it == stack.ptrs.end()) {
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
             }
             ptr_t type_loaded = it->second;
@@ -102,13 +106,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, -1);
                 update(types, reg, type_loaded_with_off);
-                live_vars[target_reg.v] = reg;
+                live_def.vars[target_reg.v] = reg;
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, -1);
                 update(types, reg, type_loaded_no_off);
-                live_vars[target_reg.v] = reg;
+                live_def.vars[target_reg.v] = reg;
             }
 
             break;
@@ -125,7 +129,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             auto reg = reg_with_loc_t(target_reg.v, label, -1);
             update(types, reg, type_loaded);
-            live_vars[target_reg.v] = reg;
+            live_def.vars[target_reg.v] = reg;
             break;
         }
 
@@ -140,7 +144,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = live_vars[basereg.v];
+    auto reg_to_look = live_def.vars[basereg.v];
     auto it = types->find(reg_to_look);
     if (it == types->end()) {
         CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
@@ -148,7 +152,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
     ptr_t type_basereg = it->second;
 
-    reg_to_look = live_vars[target_reg.v];
+    reg_to_look = live_def.vars[target_reg.v];
     auto it2 = types->find(reg_to_look);
     if (it2 == types->end()) {
         CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
@@ -174,9 +178,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
     uint64_t store_at = offset+type_basereg_with_off.offset;
 
-    auto it3 = stack.find(store_at);
-    if (it3 == stack.end()) {
-        stack.insert(std::make_pair(store_at, type_stored));
+    auto it3 = stack.ptrs.find(store_at);
+    if (it3 == stack.ptrs.end()) {
+        stack.ptrs.insert(std::make_pair(store_at, type_stored));
     }
     else {
         auto type_in_stack = it3->second;
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index feed28c70..656406b19 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -25,6 +25,10 @@ struct ptr_no_off_t {
     bool operator!=(const ptr_no_off_t& p) {
         return r != p.r;
     }
+
+    bool operator==(const ptr_no_off_t& p) {
+        return r == p.r;
+    }
 };
 
 struct ptr_with_off_t {
@@ -37,6 +41,10 @@ struct ptr_with_off_t {
     bool operator!=(const ptr_with_off_t& p) {
         return r != p.r;
     }
+
+    bool operator==(const ptr_with_off_t& p) {
+        return r == p.r;
+    }
 };
 
 struct reg_with_loc_t {
@@ -47,22 +55,20 @@ struct reg_with_loc_t {
     reg_with_loc_t(int _r, const label_t& l, int loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
 
     bool operator==(const reg_with_loc_t& other) const {
-        return (r == other.r && loc.first == other.loc.first && loc.second == other.loc.second);
+        return (r != -1 && r == other.r && loc.first == other.loc.first && loc.second == other.loc.second);
     }
 };
 
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 
-using stack_t = std::unordered_map<uint64_t, ptr_t>;
 using types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
-using live_vars_t = std::array<reg_with_loc_t, 11>;
-
 
-using offset_to_ptr_t = std::unordered_map<int, crab::ptr_no_off_t>;
+using offset_to_ptr_no_off_t = std::unordered_map<uint64_t, ptr_no_off_t>;
+using offset_to_ptr_t = std::unordered_map<uint64_t, ptr_t>;
 
 struct ctx_t {
-    offset_to_ptr_t packet_ptrs;
+    offset_to_ptr_no_off_t packet_ptrs;
 
     ctx_t(const ebpf_context_descriptor_t* desc)
     {
@@ -70,19 +76,74 @@ struct ctx_t {
         packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
     }
 };
+
+struct stack_t {
+    offset_to_ptr_t ptrs;
+
+    stack_t operator|(const stack_t& other) const {
+        stack_t st{};
+        for (auto& e : ptrs) {
+            auto it = other.ptrs.find(e.first);
+            if (it == other.ptrs.end()) {
+                st.ptrs.insert(e);
+            }
+            else {
+                if (it->second.index() == e.second.index()) {
+                    if (std::holds_alternative<ptr_no_off_t>(it->second)) {
+                        ptr_no_off_t t = std::get<ptr_no_off_t>(it->second);
+                        ptr_no_off_t t1 = std::get<ptr_no_off_t>(e.second);
+                        if (t == t1) st.ptrs.insert(e);
+                    }
+                    else {
+                        ptr_with_off_t t = std::get<ptr_with_off_t>(it->second);
+                        ptr_with_off_t t1 = std::get<ptr_with_off_t>(e.second);
+                        if (t == t1) st.ptrs.insert(e);
+                    }
+                }
+            }
+        }
+
+        for (auto& e : other.ptrs) {
+            auto it = ptrs.find(e.first);
+            if (it == ptrs.end()) {
+                st.ptrs.insert(e);
+            }
+        }
+        return st;
+    }
+};
+
+struct live_def_t {
+    std::array<reg_with_loc_t, 11> vars;
+
+    live_def_t operator|(const live_def_t& other) const {
+        live_def_t v{};
+        for (int i = 0; i < vars.size(); i++) {
+            if (vars[i] == other.vars[i]) {
+                std::cout << "equal at: " << i << "\n";
+                v.vars[i] = vars[i];
+            }
+        }
+        return v;
+    }
+};
+
 }
 
 class type_domain_t final {
 
     crab::stack_t stack;
     std::shared_ptr<crab::types_t> types;
-    crab::live_vars_t live_vars;
+    crab::live_def_t live_def;
     std::shared_ptr<crab::ctx_t> ctx;
     label_t label;
 
   public:
 
   type_domain_t(const label_t& _l) : label(_l) {}
+  type_domain_t(const crab::live_def_t& _live, const crab::stack_t& _st, const label_t& _l,
+          std::shared_ptr<crab::types_t> _types, std::shared_ptr<crab::ctx_t> _ctx)
+            : stack(_st), types(_types), live_def(_live), ctx(_ctx), label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
   static type_domain_t setup_entry(std::shared_ptr<crab::ctx_t>, std::shared_ptr<crab::types_t>);
   // bottom/top
@@ -96,7 +157,7 @@ class type_domain_t final {
   void operator|=(type_domain_t& other) const;
   void operator|=(const type_domain_t& other) const;
   type_domain_t operator|(type_domain_t& other) const;
-  type_domain_t operator|(const type_domain_t& other) const;
+  type_domain_t operator|(const type_domain_t& other) const&;
   // meet
   type_domain_t operator&(const type_domain_t& other) const;
   // widening

From 9aecfb8177e5bb68f7ae844ddb35d666d135a073 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:08:59 -0400
Subject: [PATCH 069/373] Added limited functionality related to bottom/top;
 fixed issues with join; refactored

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp |  71 ++++++++++++++----------
 src/crab/type_domain.hpp | 113 ++++++++++++++++++++++++++-------------
 2 files changed, 120 insertions(+), 64 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 87df83338..4ffad470d 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -10,17 +10,34 @@ using crab::ptr_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
 using crab::ctx_t;
-using crab::types_t;
+using crab::all_types_t;
 using crab::reg_with_loc_t;
 
-void update(std::shared_ptr<types_t> m, const reg_with_loc_t& key, const ptr_t& value) {
+void update(std::shared_ptr<all_types_t> m, const reg_with_loc_t& key, const ptr_t& value) {
     auto it = m->insert(std::make_pair(key, value));
     if (not it.second) it.first->second = value;
 }
 
+type_domain_t type_domain_t::bottom() {
+    type_domain_t typ(label_t::entry);
+    typ.set_to_bottom();
+    return typ;
+}
+
+bool type_domain_t::is_bottom() const {
+    return (stack.is_bottom() && types.is_bottom());
+}
+
+void type_domain_t::set_to_bottom() {
+    stack.set_to_bottom();
+    types.set_to_bottom();
+}
 
 type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
-    return type_domain_t(live_def | other.live_def, stack | other.stack, label, other.types, other.ctx);
+    if (is_bottom()) {
+        return other;
+    }
+    return type_domain_t(types | other.types, stack | other.stack, label, other.ctx);
 }
 
 void type_domain_t::operator()(const Undefined & u) {}
@@ -34,15 +51,15 @@ void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
 void type_domain_t::operator()(const Assert &u) {}
 
-type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<types_t> _types) {
+type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<all_types_t> _types) {
 
     type_domain_t inv(label_t::entry);
 
-    inv.types = _types;
+    inv.types.all_types = _types;
     inv.ctx = _ctx;
 
-    inv.live_def.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
-    inv.live_def.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
+    inv.types.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
+    inv.types.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
 
     return inv;
 }
@@ -55,15 +72,15 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto reg_to_look = live_def.vars[src.v];    // need checks that array actually contains an element, not default value
-                auto it = types->find(reg_to_look);
-                if (it == types->end()) {
+                auto reg_to_look = types.vars[src.v];    // need checks that array actually contains an element, not default value
+                auto it = types.all_types->find(reg_to_look);
+                if (it == types.all_types->end()) {
                     CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, label, -1);
-                update(types, reg, it->second);
-                live_def.vars[bin.dst.v] = reg;
+                update(types.all_types, reg, it->second);
+                types.vars[bin.dst.v] = reg;
             }
 
             default:
@@ -77,9 +94,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = live_def.vars[basereg.v];
-    auto it = types->find(reg_to_look);
-    if (it == types->end()) {
+    auto reg_to_look = types.vars[basereg.v];
+    auto it = types.all_types->find(reg_to_look);
+    if (it == types.all_types->end()) {
         CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", (int)basereg.v);
     }
 
@@ -105,14 +122,14 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, -1);
-                update(types, reg, type_loaded_with_off);
-                live_def.vars[target_reg.v] = reg;
+                update(types.all_types, reg, type_loaded_with_off);
+                types.vars[target_reg.v] = reg;
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, -1);
-                update(types, reg, type_loaded_no_off);
-                live_def.vars[target_reg.v] = reg;
+                update(types.all_types, reg, type_loaded_no_off);
+                types.vars[target_reg.v] = reg;
             }
 
             break;
@@ -128,8 +145,8 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             ptr_no_off_t type_loaded = it->second;
 
             auto reg = reg_with_loc_t(target_reg.v, label, -1);
-            update(types, reg, type_loaded);
-            live_def.vars[target_reg.v] = reg;
+            update(types.all_types, reg, type_loaded);
+            types.vars[target_reg.v] = reg;
             break;
         }
 
@@ -144,17 +161,17 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = live_def.vars[basereg.v];
-    auto it = types->find(reg_to_look);
-    if (it == types->end()) {
+    auto reg_to_look = types.vars[basereg.v];
+    auto it = types.all_types->find(reg_to_look);
+    if (it == types.all_types->end()) {
         CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
     }
 
     ptr_t type_basereg = it->second;
 
-    reg_to_look = live_def.vars[target_reg.v];
-    auto it2 = types->find(reg_to_look);
-    if (it2 == types->end()) {
+    reg_to_look = types.vars[target_reg.v];
+    auto it2 = types.all_types->find(reg_to_look);
+    if (it2 == types.all_types->end()) {
         CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
     }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 656406b19..602d5ae5d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -47,6 +47,9 @@ struct ptr_with_off_t {
     }
 };
 
+using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+
+
 struct reg_with_loc_t {
     int r;
     std::pair<label_t, int> loc;
@@ -55,14 +58,35 @@ struct reg_with_loc_t {
     reg_with_loc_t(int _r, const label_t& l, int loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
 
     bool operator==(const reg_with_loc_t& other) const {
-        return (r != -1 && r == other.r && loc.first == other.loc.first && loc.second == other.loc.second);
+        return (r != -1 && r == other.r);
     }
 };
+}
 
+// adapted from top answer in
+// https://stackoverflow.com/questions/17016175/c-unordered-map-using-a-custom-class-type-as-the-key
+// works for now but needs to be checked again
+template <>
+struct std::hash<crab::reg_with_loc_t>
+{
+    std::size_t operator()(const crab::reg_with_loc_t& reg) const
+    {
+        using std::size_t;
+        using std::hash;
+        using std::string;
 
-using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+        // Compute individual hash values for first,
+        // second and third and combine them using XOR
+        // and bit shifting:
+
+        return ((hash<int>()(reg.r)
+               ^ (hash<int>()(reg.loc.first.from) << 1)) >> 1)
+               ^ (hash<int>()(reg.loc.second) << 1);
+    }
+};
+
+namespace crab {
 
-using types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
 using offset_to_ptr_no_off_t = std::unordered_map<uint64_t, ptr_no_off_t>;
 using offset_to_ptr_t = std::unordered_map<uint64_t, ptr_t>;
@@ -111,21 +135,59 @@ struct stack_t {
         }
         return st;
     }
+
+    void set_to_bottom() {
+        ptrs.clear();
+    }
+
+    bool is_bottom() const {
+        return ptrs.empty();
+    }
 };
 
-struct live_def_t {
+using all_types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+
+struct types_t {
     std::array<reg_with_loc_t, 11> vars;
+    std::shared_ptr<crab::all_types_t> all_types;
 
-    live_def_t operator|(const live_def_t& other) const {
-        live_def_t v{};
+    types_t() {}
+    types_t(const types_t& other) : vars(other.vars), all_types(other.all_types) {}
+
+    types_t operator|(const types_t& other) const {
+        types_t v{};
         for (int i = 0; i < vars.size(); i++) {
-            if (vars[i] == other.vars[i]) {
-                std::cout << "equal at: " << i << "\n";
-                v.vars[i] = vars[i];
+            auto it1 = all_types->find(vars[i]);
+            auto it2 = other.all_types->find(other.vars[i]);
+            if (it1 != all_types->end() && it2 != other.all_types->end()) {
+                if (it1->second.index() == it2->second.index()) {
+                    if (std::holds_alternative<ptr_no_off_t>(it1->second)) {
+                        if (std::get<ptr_no_off_t>(it1->second) == std::get<ptr_no_off_t>(it2->second)) {
+                            v.vars[i] = vars[i];
+                        }
+                    }
+                    else {
+                        if (std::get<ptr_with_off_t>(it1->second) == std::get<ptr_with_off_t>(it2->second)) {
+                            v.vars[i] = vars[i];
+                        }
+                    }
+                }
             }
         }
+        v.all_types = all_types;
         return v;
     }
+
+    void set_to_bottom() {
+       vars = {};
+    }
+
+    bool is_bottom() const {
+        for (auto& it : vars) {
+            if (it.r != -1) return false;
+        }
+        return true;
+    }
 };
 
 }
@@ -133,20 +195,19 @@ struct live_def_t {
 class type_domain_t final {
 
     crab::stack_t stack;
-    std::shared_ptr<crab::types_t> types;
-    crab::live_def_t live_def;
+    crab::types_t types;
     std::shared_ptr<crab::ctx_t> ctx;
     label_t label;
 
   public:
 
   type_domain_t(const label_t& _l) : label(_l) {}
-  type_domain_t(const crab::live_def_t& _live, const crab::stack_t& _st, const label_t& _l,
-          std::shared_ptr<crab::types_t> _types, std::shared_ptr<crab::ctx_t> _ctx)
-            : stack(_st), types(_types), live_def(_live), ctx(_ctx), label(_l) {}
+  type_domain_t(const crab::types_t& _types, const crab::stack_t& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
+            : stack(_st), types(_types), ctx(_ctx), label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-  static type_domain_t setup_entry(std::shared_ptr<crab::ctx_t>, std::shared_ptr<crab::types_t>);
+  static type_domain_t setup_entry(std::shared_ptr<crab::ctx_t>, std::shared_ptr<crab::all_types_t>);
   // bottom/top
+  static type_domain_t bottom();
   void set_to_top();
   void set_to_bottom();
   bool is_bottom() const;
@@ -191,25 +252,3 @@ class type_domain_t final {
   void do_mem_store(const Mem&, const Reg&);
 
 }; // end type_domain_t
-
-// adapted from top answer in
-// https://stackoverflow.com/questions/17016175/c-unordered-map-using-a-custom-class-type-as-the-key
-// works for now but needs to be checked again
-template <>
-struct std::hash<crab::reg_with_loc_t>
-{
-    std::size_t operator()(const crab::reg_with_loc_t& reg) const
-    {
-        using std::size_t;
-        using std::hash;
-        using std::string;
-
-        // Compute individual hash values for first,
-        // second and third and combine them using XOR
-        // and bit shifting:
-
-        return ((hash<int>()(reg.r)
-               ^ (hash<int>()(reg.loc.first.from) << 1)) >> 1)
-               ^ (hash<int>()(reg.loc.second) << 1);
-    }
-};

From f0bdd5d10221f5258c429e1ec75b7cca3b7e3fc0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:13:26 -0400
Subject: [PATCH 070/373] Refactored

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 12 +----------
 src/crab/type_domain.hpp | 45 ++++++++++------------------------------
 2 files changed, 12 insertions(+), 45 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 4ffad470d..9ea81b299 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -201,19 +201,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     }
     else {
         auto type_in_stack = it3->second;
-        if (type_stored.index() != type_in_stack.index()) {
+        if (type_stored != type_in_stack) {
             CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
         }
-        if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
-            if (std::get<ptr_with_off_t>(type_stored) != std::get<ptr_with_off_t>(type_in_stack)) {
-                CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
-            }
-        }
-        else {
-            if (std::get<ptr_no_off_t>(type_stored) != std::get<ptr_no_off_t>(type_in_stack)) {
-                CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
-            }
-        }
     }
 }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 602d5ae5d..614882708 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -22,12 +22,12 @@ struct ptr_no_off_t {
     ptr_no_off_t(region _r) : r(_r) {}
     ptr_no_off_t(const ptr_no_off_t& p) : r(p.r) {}
 
-    bool operator!=(const ptr_no_off_t& p) {
-        return r != p.r;
+    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+        return (p1.r == p2.r);
     }
 
-    bool operator==(const ptr_no_off_t& p) {
-        return r == p.r;
+    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+        return !(p2 == p1);
     }
 };
 
@@ -38,12 +38,12 @@ struct ptr_with_off_t {
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
     ptr_with_off_t(const ptr_with_off_t& p) : r(p.r), offset(p.offset) {}
 
-    bool operator!=(const ptr_with_off_t& p) {
-        return r != p.r;
+    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+        return (p1.r == p2.r);
     }
 
-    bool operator==(const ptr_with_off_t& p) {
-        return r == p.r;
+    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+        return !(p1 == p2);
     }
 };
 
@@ -108,23 +108,9 @@ struct stack_t {
         stack_t st{};
         for (auto& e : ptrs) {
             auto it = other.ptrs.find(e.first);
-            if (it == other.ptrs.end()) {
+            if (it == other.ptrs.end() || it->second == e.second) {
                 st.ptrs.insert(e);
             }
-            else {
-                if (it->second.index() == e.second.index()) {
-                    if (std::holds_alternative<ptr_no_off_t>(it->second)) {
-                        ptr_no_off_t t = std::get<ptr_no_off_t>(it->second);
-                        ptr_no_off_t t1 = std::get<ptr_no_off_t>(e.second);
-                        if (t == t1) st.ptrs.insert(e);
-                    }
-                    else {
-                        ptr_with_off_t t = std::get<ptr_with_off_t>(it->second);
-                        ptr_with_off_t t1 = std::get<ptr_with_off_t>(e.second);
-                        if (t == t1) st.ptrs.insert(e);
-                    }
-                }
-            }
         }
 
         for (auto& e : other.ptrs) {
@@ -160,17 +146,8 @@ struct types_t {
             auto it1 = all_types->find(vars[i]);
             auto it2 = other.all_types->find(other.vars[i]);
             if (it1 != all_types->end() && it2 != other.all_types->end()) {
-                if (it1->second.index() == it2->second.index()) {
-                    if (std::holds_alternative<ptr_no_off_t>(it1->second)) {
-                        if (std::get<ptr_no_off_t>(it1->second) == std::get<ptr_no_off_t>(it2->second)) {
-                            v.vars[i] = vars[i];
-                        }
-                    }
-                    else {
-                        if (std::get<ptr_with_off_t>(it1->second) == std::get<ptr_with_off_t>(it2->second)) {
-                            v.vars[i] = vars[i];
-                        }
-                    }
+                if (it1->second == it2->second) {
+                    v.vars[i] = vars[i];
                 }
             }
         }

From 8b0c5548d537e0688bd601573a8611658c34a7b9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:15:10 -0400
Subject: [PATCH 071/373] Support for recognizing types at instruction level

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 12 ++++++------
 src/crab/type_domain.hpp |  9 ++++++---
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 9ea81b299..c87105de5 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -58,8 +58,8 @@ type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::share
     inv.types.all_types = _types;
     inv.ctx = _ctx;
 
-    inv.types.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, -1);
-    inv.types.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, -1);
+    inv.types.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, 0);
+    inv.types.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
 
     return inv;
 }
@@ -78,7 +78,7 @@ void type_domain_t::operator()(const Bin& bin) {
                     CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
                 }
 
-                auto reg = reg_with_loc_t(bin.dst.v, label, -1);
+                auto reg = reg_with_loc_t(bin.dst.v, label, m_curr_pos);
                 update(types.all_types, reg, it->second);
                 types.vars[bin.dst.v] = reg;
             }
@@ -121,13 +121,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, label, -1);
+                auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
                 update(types.all_types, reg, type_loaded_with_off);
                 types.vars[target_reg.v] = reg;
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, label, -1);
+                auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
                 update(types.all_types, reg, type_loaded_no_off);
                 types.vars[target_reg.v] = reg;
             }
@@ -144,7 +144,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             }
             ptr_no_off_t type_loaded = it->second;
 
-            auto reg = reg_with_loc_t(target_reg.v, label, -1);
+            auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
             update(types.all_types, reg, type_loaded);
             types.vars[target_reg.v] = reg;
             break;
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 614882708..59a336472 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -52,10 +52,10 @@ using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 
 struct reg_with_loc_t {
     int r;
-    std::pair<label_t, int> loc;
+    std::pair<label_t, uint32_t> loc;
 
-    reg_with_loc_t() : r(-1), loc(std::make_pair(label_t::entry, -1)) {}
-    reg_with_loc_t(int _r, const label_t& l, int loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
+    reg_with_loc_t() : r(-1), loc(std::make_pair(label_t::entry, 0)) {}
+    reg_with_loc_t(int _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
 
     bool operator==(const reg_with_loc_t& other) const {
         return (r != -1 && r == other.r);
@@ -175,6 +175,7 @@ class type_domain_t final {
     crab::types_t types;
     std::shared_ptr<crab::ctx_t> ctx;
     label_t label;
+    uint32_t m_curr_pos = 0;
 
   public:
 
@@ -217,8 +218,10 @@ class type_domain_t final {
   void operator()(const Assume &);
   void operator()(const Assert &);
   void operator()(const basic_block_t& bb) {
+      m_curr_pos = 0;
       label = bb.label();
       for (const Instruction& statement : bb) {
+        m_curr_pos++;
         std::visit(*this, statement);
     }
   }

From 6b93ef15045922e1c8c9b7cd858b0781143f2cb6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Thu, 17 Mar 2022 23:25:03 -0400
Subject: [PATCH 072/373] More structural functionality for stack and context

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 25 +++++++++++------------
 src/crab/type_domain.hpp | 43 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 52 insertions(+), 16 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index c87105de5..3ba051160 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -112,12 +112,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     switch (type_with_off.r) {
         case crab::region::T_STACK: {
 
-            auto it = stack.ptrs.find(load_at);
+            auto it = stack.find(load_at);
 
-            if (it == stack.ptrs.end()) {
+            if (!it) {
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
             }
-            ptr_t type_loaded = it->second;
+            ptr_t type_loaded = it.value();
 
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
@@ -136,13 +136,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
         }
         case crab::region::T_CTX: {
 
-            auto ptrs = ctx->packet_ptrs;
-            auto it = ptrs.find(load_at);
+            auto it = ctx->find(load_at);
 
-            if (it == ptrs.end()) {
+            if (!it) {
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
             }
-            ptr_no_off_t type_loaded = it->second;
+            ptr_no_off_t type_loaded = it.value();
 
             auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
             update(types.all_types, reg, type_loaded);
@@ -195,16 +194,16 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
     uint64_t store_at = offset+type_basereg_with_off.offset;
 
-    auto it3 = stack.ptrs.find(store_at);
-    if (it3 == stack.ptrs.end()) {
-        stack.ptrs.insert(std::make_pair(store_at, type_stored));
-    }
-    else {
-        auto type_in_stack = it3->second;
+    auto it3 = stack.find(store_at);
+    if (it3) {
+        auto type_in_stack = it3.value();
         if (type_stored != type_in_stack) {
             CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
         }
     }
+    else {
+        stack.insert(store_at, type_stored);
+    }
 }
 
 void type_domain_t::operator()(const Mem& b) {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 59a336472..259fe61ee 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -92,17 +92,30 @@ using offset_to_ptr_no_off_t = std::unordered_map<uint64_t, ptr_no_off_t>;
 using offset_to_ptr_t = std::unordered_map<uint64_t, ptr_t>;
 
 struct ctx_t {
+  private:
     offset_to_ptr_no_off_t packet_ptrs;
 
+  public:
     ctx_t(const ebpf_context_descriptor_t* desc)
     {
         packet_ptrs.insert(std::make_pair(desc->data, crab::ptr_no_off_t(crab::region::T_PACKET)));
         packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
     }
+
+    std::optional<ptr_no_off_t> find(int key) const {
+        auto it = packet_ptrs.find(key);
+        if (it == packet_ptrs.end()) return {};
+        return it->second;
+    }
 };
 
 struct stack_t {
+  private:
     offset_to_ptr_t ptrs;
+    bool _is_bottom;
+
+  public:
+    explicit stack_t(bool is_bottom = false) : _is_bottom(is_bottom) {}
 
     stack_t operator|(const stack_t& other) const {
         stack_t st{};
@@ -123,19 +136,43 @@ struct stack_t {
     }
 
     void set_to_bottom() {
-        ptrs.clear();
+        this->~stack_t();
+        new (this) stack_t(true);
     }
 
-    bool is_bottom() const {
+    void set_to_top() {
+        this->~stack_t();
+        new (this) stack_t(false);
+    }
+
+    static stack_t bottom() { return stack_t(true); }
+
+    static stack_t top() { return stack_t(false); }
+
+    bool is_bottom() const { return _is_bottom; }
+
+    bool is_top() const {
+        if (_is_bottom)
+            return false;
         return ptrs.empty();
     }
+
+    offset_to_ptr_t get_ptrs() const { return ptrs; }
+
+    void insert(int key, ptr_t value) { ptrs.insert(std::make_pair(key, value)); }
+
+    std::optional<ptr_t> find(int key) {
+        auto it = ptrs.find(key);
+        if (it == ptrs.end()) return {};
+        return it->second;
+    }
 };
 
 using all_types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
 struct types_t {
     std::array<reg_with_loc_t, 11> vars;
-    std::shared_ptr<crab::all_types_t> all_types;
+    std::shared_ptr<all_types_t> all_types;
 
     types_t() {}
     types_t(const types_t& other) : vars(other.vars), all_types(other.all_types) {}

From c44faafa8100d821f57faaa5acd11ed95b3814cb Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:17:29 -0400
Subject: [PATCH 073/373]  Cleaner API for both types_domain_t and types_t

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 69 +++++++++++++++++-----------------------
 src/crab/type_domain.hpp | 47 +++++++++++++++++++--------
 2 files changed, 63 insertions(+), 53 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 3ba051160..0d7db1d25 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -12,22 +12,19 @@ using crab::ptr_no_off_t;
 using crab::ctx_t;
 using crab::all_types_t;
 using crab::reg_with_loc_t;
+using crab::reg_live_vars_t;
+using crab::types_t;
 
-void update(std::shared_ptr<all_types_t> m, const reg_with_loc_t& key, const ptr_t& value) {
-    auto it = m->insert(std::make_pair(key, value));
-    if (not it.second) it.first->second = value;
+bool type_domain_t::is_bottom() const {
+    return (stack.is_bottom() && types.is_bottom());
 }
 
 type_domain_t type_domain_t::bottom() {
-    type_domain_t typ(label_t::entry);
+    type_domain_t typ;
     typ.set_to_bottom();
     return typ;
 }
 
-bool type_domain_t::is_bottom() const {
-    return (stack.is_bottom() && types.is_bottom());
-}
-
 void type_domain_t::set_to_bottom() {
     stack.set_to_bottom();
     types.set_to_bottom();
@@ -51,15 +48,18 @@ void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
 void type_domain_t::operator()(const Assert &u) {}
 
-type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<all_types_t> _types) {
+type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<all_types_t> all_types) {
+
+    reg_live_vars_t vars;
+    types_t typ(vars, all_types, true);
 
-    type_domain_t inv(label_t::entry);
+    auto r1 = reg_with_loc_t(R1_ARG, label_t::entry, 0);
+    auto r10 = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
 
-    inv.types.all_types = _types;
-    inv.ctx = _ctx;
+    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
+    typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
-    inv.types.vars[R1_ARG] = reg_with_loc_t(R1_ARG, label_t::entry, 0);
-    inv.types.vars[R10_STACK_POINTER] = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
+    type_domain_t inv(typ, crab::stack_t::bottom(), label_t::entry, _ctx);
 
     return inv;
 }
@@ -72,15 +72,13 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto reg_to_look = types.vars[src.v];    // need checks that array actually contains an element, not default value
-                auto it = types.all_types->find(reg_to_look);
-                if (it == types.all_types->end()) {
+                auto it = types.find(src.v);
+                if (!it) {
                     CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, label, m_curr_pos);
-                update(types.all_types, reg, it->second);
-                types.vars[bin.dst.v] = reg;
+                types.insert(bin.dst.v, reg, it.value());
             }
 
             default:
@@ -94,13 +92,11 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = types.vars[basereg.v];
-    auto it = types.all_types->find(reg_to_look);
-    if (it == types.all_types->end()) {
+    auto it = types.find(basereg.v);
+    if (!it) {
         CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", (int)basereg.v);
     }
-
-    ptr_t type_basereg = it->second;
+    ptr_t type_basereg = it.value();
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
         CRAB_ERROR("type_error: loading from either packet or shared region not allowed - R", (int)basereg.v);
@@ -122,14 +118,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-                update(types.all_types, reg, type_loaded_with_off);
-                types.vars[target_reg.v] = reg;
+                types.insert(target_reg.v, reg, type_loaded_with_off);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-                update(types.all_types, reg, type_loaded_no_off);
-                types.vars[target_reg.v] = reg;
+                types.insert(target_reg.v, reg, type_loaded_no_off);
             }
 
             break;
@@ -144,8 +138,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             ptr_no_off_t type_loaded = it.value();
 
             auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-            update(types.all_types, reg, type_loaded);
-            types.vars[target_reg.v] = reg;
+            types.insert(target_reg.v, reg, type_loaded);
             break;
         }
 
@@ -160,21 +153,17 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto reg_to_look = types.vars[basereg.v];
-    auto it = types.all_types->find(reg_to_look);
-    if (it == types.all_types->end()) {
+    auto it = types.find(basereg.v);
+    if (!it) {
         CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
     }
+    ptr_t type_basereg = it.value();
 
-    ptr_t type_basereg = it->second;
-
-    reg_to_look = types.vars[target_reg.v];
-    auto it2 = types.all_types->find(reg_to_look);
-    if (it2 == types.all_types->end()) {
+    auto it2 = types.find(target_reg.v);
+    if (!it2) {
         CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
     }
-
-    ptr_t type_stored = it2->second;
+    ptr_t type_stored = it2.value();
 
     if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
         ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 259fe61ee..ce6379f7c 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -169,45 +169,66 @@ struct stack_t {
 };
 
 using all_types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+using reg_live_vars_t = std::array<reg_with_loc_t, 11>;
 
 struct types_t {
-    std::array<reg_with_loc_t, 11> vars;
+  private:
+    reg_live_vars_t vars;
     std::shared_ptr<all_types_t> all_types;
+    bool _is_bottom = false;
 
-    types_t() {}
-    types_t(const types_t& other) : vars(other.vars), all_types(other.all_types) {}
+  public:
+    types_t(bool is_bottom = false) : _is_bottom(is_bottom) {}
+    explicit types_t(reg_live_vars_t _vars, std::shared_ptr<all_types_t> _all_types, bool is_bottom = false)
+        : vars(_vars), all_types(_all_types), _is_bottom(is_bottom) {}
 
     types_t operator|(const types_t& other) const {
-        types_t v{};
+        reg_live_vars_t _vars;
         for (int i = 0; i < vars.size(); i++) {
             auto it1 = all_types->find(vars[i]);
             auto it2 = other.all_types->find(other.vars[i]);
             if (it1 != all_types->end() && it2 != other.all_types->end()) {
                 if (it1->second == it2->second) {
-                    v.vars[i] = vars[i];
+                    _vars[i] = vars[i];
                 }
             }
         }
-        v.all_types = all_types;
+
+        types_t v(_vars, all_types, false);
         return v;
     }
 
     void set_to_bottom() {
-       vars = {};
+        this->~types_t();
+        new (this) types_t(true);
     }
 
-    bool is_bottom() const {
-        for (auto& it : vars) {
-            if (it.r != -1) return false;
-        }
+    bool is_bottom() const { return _is_bottom; }
+
+    bool is_top() const {
+        if (_is_bottom)
+            return false;
         return true;
     }
+
+    void insert(uint32_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
+        auto it = all_types->insert(std::make_pair(reg_with_loc, type));
+        if (not it.second) it.first->second = type;
+        vars[reg] = reg_with_loc;
+    }
+
+    std::optional<ptr_t> find(uint32_t key) {
+        auto reg = vars[key];
+        auto it = all_types->find(reg);
+        if (it == all_types->end()) return {};
+        return it->second;
+    }
 };
 
 }
 
 class type_domain_t final {
-
+  private:
     crab::stack_t stack;
     crab::types_t types;
     std::shared_ptr<crab::ctx_t> ctx;
@@ -216,7 +237,7 @@ class type_domain_t final {
 
   public:
 
-  type_domain_t(const label_t& _l) : label(_l) {}
+  type_domain_t() : label(label_t::entry) {}
   type_domain_t(const crab::types_t& _types, const crab::stack_t& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
             : stack(_st), types(_types), ctx(_ctx), label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.

From cf341fa40937d6b7362d78ad94591d4b4ec0f190 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:19:48 -0400
Subject: [PATCH 074/373] Support for printing the state after each statement

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp |  8 ++++
 src/crab/type_domain.hpp | 83 +++++++++++++++++++++++++++++++++++-----
 2 files changed, 82 insertions(+), 9 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 0d7db1d25..b74b15f4c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -37,6 +37,12 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
     return type_domain_t(types | other.types, stack | other.stack, label, other.ctx);
 }
 
+std::ostream& operator<<(std::ostream& o, const type_domain_t& t) {
+    o << t.types;
+    o << "\t" << t.stack << "\n";
+    return o;
+}
+
 void type_domain_t::operator()(const Undefined & u) {}
 void type_domain_t::operator()(const Un &u) {}
 void type_domain_t::operator()(const LoadMapFd &u) {}
@@ -66,6 +72,7 @@ type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::share
 
 void type_domain_t::operator()(const Bin& bin) {
 
+    std::cout << "  " << bin << "\n";
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
@@ -197,6 +204,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
 void type_domain_t::operator()(const Mem& b) {
 
+    std::cout << "  " << b << "\n";
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
             do_load(b, std::get<Reg>(b.value));
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index ce6379f7c..ee14e4abc 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -13,9 +13,29 @@ enum class region {
 	T_CTX,
 	T_STACK,
 	T_PACKET,
-	T_SHARED,
+	T_SHARED
 };
 
+std::string get_region(const region& r) {
+    switch (r) {
+        case region::T_CTX:
+            return "ctx";
+        case region::T_STACK:
+            return "stack";
+        case region::T_PACKET:
+            return "packet";
+        case region::T_SHARED:
+            return "shared";
+        default:
+            return "undefined";
+    }
+}
+
+std::ostream& operator<<(std::ostream& o, const region& t) {
+    o << static_cast<std::underlying_type<region>::type>(t);
+    return o;
+}
+
 struct ptr_no_off_t {
     region r;
 
@@ -29,6 +49,10 @@ struct ptr_no_off_t {
     friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
         return !(p2 == p1);
     }
+
+    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
+        return o << "{" << get_region(p.r) << "}";
+    }
 };
 
 struct ptr_with_off_t {
@@ -45,6 +69,10 @@ struct ptr_with_off_t {
     friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
         return !(p1 == p2);
     }
+
+    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
+        return o << "{" << get_region(p.r) << ", " << p.offset << "}";
+    }
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
@@ -166,6 +194,22 @@ struct stack_t {
         if (it == ptrs.end()) return {};
         return it->second;
     }
+
+    friend std::ostream& operator<<(std::ostream& o, const stack_t& st) {
+        o << "Stack: {";
+        for (auto s : st.get_ptrs()) {
+            o << s.first << ": ";
+            if (std::holds_alternative<ptr_with_off_t>(s.second)) {
+                auto t = std::get<ptr_with_off_t>(s.second);
+                o << t << ", ";
+            }
+            else {
+                auto t = std::get<ptr_no_off_t>(s.second);
+                o << t << ", ";
+            }
+        }
+        return o << "}";
+    }
 };
 
 using all_types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
@@ -205,24 +249,42 @@ struct types_t {
 
     bool is_bottom() const { return _is_bottom; }
 
-    bool is_top() const {
-        if (_is_bottom)
-            return false;
-        return true;
-    }
-
     void insert(uint32_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
         auto it = all_types->insert(std::make_pair(reg_with_loc, type));
         if (not it.second) it.first->second = type;
         vars[reg] = reg_with_loc;
     }
 
-    std::optional<ptr_t> find(uint32_t key) {
-        auto reg = vars[key];
+    std::optional<ptr_t> find(const reg_with_loc_t& reg) const {
         auto it = all_types->find(reg);
         if (it == all_types->end()) return {};
         return it->second;
     }
+
+    std::optional<ptr_t> find(uint32_t key) const {
+        auto reg = vars[key];
+        return find(reg);
+    }
+
+    reg_live_vars_t get_vars() const { return vars; }
+
+    friend std::ostream& operator<<(std::ostream& o, const types_t& typ) {
+        for (const auto& v : typ.get_vars()) {
+            auto it = typ.find(v);
+            if (it) {
+                o << "\ttype of r" << v.r << ": ";
+                if (std::holds_alternative<ptr_with_off_t>(it.value())) {
+                    auto t = std::get<ptr_with_off_t>(it.value());
+                    o << t << "\n";
+                }
+                else {
+                    auto t = std::get<ptr_no_off_t>(it.value());
+                    o << t << "\n";
+                }
+            }
+        }
+        return o;
+    }
 };
 
 }
@@ -253,6 +315,7 @@ class type_domain_t final {
   // join
   void operator|=(type_domain_t& other) const;
   void operator|=(const type_domain_t& other) const;
+  friend std::ostream& operator<<(std::ostream&, const type_domain_t&);
   type_domain_t operator|(type_domain_t& other) const;
   type_domain_t operator|(const type_domain_t& other) const&;
   // meet
@@ -278,9 +341,11 @@ class type_domain_t final {
   void operator()(const basic_block_t& bb) {
       m_curr_pos = 0;
       label = bb.label();
+      std::cout << label << ": \n";
       for (const Instruction& statement : bb) {
         m_curr_pos++;
         std::visit(*this, statement);
+        std::cout << *this << "\n";
     }
   }
 

From 2d4e327a8d15f89f0d697250e557c3315d9faab3 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 22 Mar 2022 11:56:42 -0400
Subject: [PATCH 075/373] Minor fix for comparing two types correctly

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index ee14e4abc..749236a49 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -63,7 +63,7 @@ struct ptr_with_off_t {
     ptr_with_off_t(const ptr_with_off_t& p) : r(p.r), offset(p.offset) {}
 
     friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-        return (p1.r == p2.r);
+        return (p1.r == p2.r && p1.offset == p2.offset);
     }
 
     friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {

From e8b582c0253f18eb8ed12ce10a22b5d3ef55f125 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:25:06 -0400
Subject: [PATCH 076/373] Attempt to fix Github Actions build

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.hpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 749236a49..d9f3d4d3d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -16,7 +16,7 @@ enum class region {
 	T_SHARED
 };
 
-std::string get_region(const region& r) {
+inline std::string get_region(const region& r) {
     switch (r) {
         case region::T_CTX:
             return "ctx";
@@ -31,7 +31,7 @@ std::string get_region(const region& r) {
     }
 }
 
-std::ostream& operator<<(std::ostream& o, const region& t) {
+inline std::ostream& operator<<(std::ostream& o, const region& t) {
     o << static_cast<std::underlying_type<region>::type>(t);
     return o;
 }

From 750aed2e6354740b3df771b08c58060ffedbf491 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 18:35:22 -0400
Subject: [PATCH 077/373] Majority of revisions required in review

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp |  76 ++++++------
 src/crab/type_domain.hpp | 241 ++++++++++++++++++++-------------------
 2 files changed, 170 insertions(+), 147 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index b74b15f4c..492f91898 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -10,13 +10,18 @@ using crab::ptr_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
 using crab::ctx_t;
-using crab::all_types_t;
+using crab::global_type_env_t;
 using crab::reg_with_loc_t;
-using crab::reg_live_vars_t;
-using crab::types_t;
+using crab::live_registers_t;
+using crab::register_types_t;
+
 
 bool type_domain_t::is_bottom() const {
-    return (stack.is_bottom() && types.is_bottom());
+    return (m_stack.is_bottom() || m_types.is_bottom());
+}
+
+bool type_domain_t::is_top() const {
+    return (m_stack.is_top() || m_types.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -26,20 +31,23 @@ type_domain_t type_domain_t::bottom() {
 }
 
 void type_domain_t::set_to_bottom() {
-    stack.set_to_bottom();
-    types.set_to_bottom();
+    m_stack.set_to_bottom();
+    m_types.set_to_bottom();
 }
 
 type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return other;
     }
-    return type_domain_t(types | other.types, stack | other.stack, label, other.ctx);
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), m_label, other.m_ctx);
 }
 
 std::ostream& operator<<(std::ostream& o, const type_domain_t& t) {
-    o << t.types;
-    o << "\t" << t.stack << "\n";
+    o << t.m_types;
+    o << "\t" << t.m_stack << "\n";
     return o;
 }
 
@@ -54,10 +62,14 @@ void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
 void type_domain_t::operator()(const Assert &u) {}
 
-type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::shared_ptr<all_types_t> all_types) {
+type_domain_t type_domain_t::setup_entry() {
+
+    ebpf_context_descriptor_t context_descriptor{0, 0, 4, -1};
+    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(&context_descriptor);
+    std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
-    reg_live_vars_t vars;
-    types_t typ(vars, all_types, true);
+    live_registers_t vars;
+    register_types_t typ(std::move(vars), all_types, true);
 
     auto r1 = reg_with_loc_t(R1_ARG, label_t::entry, 0);
     auto r10 = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
@@ -65,7 +77,7 @@ type_domain_t type_domain_t::setup_entry(std::shared_ptr<ctx_t> _ctx, std::share
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
-    type_domain_t inv(typ, crab::stack_t::bottom(), label_t::entry, _ctx);
+    type_domain_t inv(std::move(typ), crab::stack_t::bottom(), label_t::entry, ctx);
 
     return inv;
 }
@@ -79,13 +91,13 @@ void type_domain_t::operator()(const Bin& bin) {
         {
             case Bin::Op::MOV: {
 
-                auto it = types.find(src.v);
+                auto it = m_types.find(src.v);
                 if (!it) {
                     CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
                 }
 
-                auto reg = reg_with_loc_t(bin.dst.v, label, m_curr_pos);
-                types.insert(bin.dst.v, reg, it.value());
+                auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
+                m_types.insert(bin.dst.v, reg, it.value());
             }
 
             default:
@@ -99,7 +111,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = types.find(basereg.v);
+    auto it = m_types.find(basereg.v);
     if (!it) {
         CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", (int)basereg.v);
     }
@@ -110,12 +122,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
-    uint64_t load_at = offset+type_with_off.offset;
+    int load_at = offset+type_with_off.offset;
 
     switch (type_with_off.r) {
         case crab::region::T_STACK: {
 
-            auto it = stack.find(load_at);
+            auto it = m_stack.find(load_at);
 
             if (!it) {
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
@@ -124,28 +136,28 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-                types.insert(target_reg.v, reg, type_loaded_with_off);
+                auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+                m_types.insert(target_reg.v, reg, type_loaded_with_off);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-                types.insert(target_reg.v, reg, type_loaded_no_off);
+                auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+                m_types.insert(target_reg.v, reg, type_loaded_no_off);
             }
 
             break;
         }
         case crab::region::T_CTX: {
 
-            auto it = ctx->find(load_at);
+            auto it = m_ctx->find(load_at);
 
             if (!it) {
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
             }
             ptr_no_off_t type_loaded = it.value();
 
-            auto reg = reg_with_loc_t(target_reg.v, label, m_curr_pos);
-            types.insert(target_reg.v, reg, type_loaded);
+            auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+            m_types.insert(target_reg.v, reg, type_loaded);
             break;
         }
 
@@ -160,13 +172,13 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = types.find(basereg.v);
+    auto it = m_types.find(basereg.v);
     if (!it) {
         CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
     }
     ptr_t type_basereg = it.value();
 
-    auto it2 = types.find(target_reg.v);
+    auto it2 = m_types.find(target_reg.v);
     if (!it2) {
         CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
     }
@@ -188,9 +200,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
         CRAB_ERROR("type_error: we cannot store pointer, R", (int)target_reg.v, ", into ctx");
     }
 
-    uint64_t store_at = offset+type_basereg_with_off.offset;
+    int store_at = offset+type_basereg_with_off.offset;
 
-    auto it3 = stack.find(store_at);
+    auto it3 = m_stack.find(store_at);
     if (it3) {
         auto type_in_stack = it3.value();
         if (type_stored != type_in_stack) {
@@ -198,7 +210,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
         }
     }
     else {
-        stack.insert(store_at, type_stored);
+        m_stack.insert(store_at, type_stored);
     }
 }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index d9f3d4d3d..4f77fca0e 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -24,10 +24,8 @@ inline std::string get_region(const region& r) {
             return "stack";
         case region::T_PACKET:
             return "packet";
-        case region::T_SHARED:
-            return "shared";
         default:
-            return "undefined";
+            return "shared";
     }
 }
 
@@ -39,8 +37,13 @@ inline std::ostream& operator<<(std::ostream& o, const region& t) {
 struct ptr_no_off_t {
     region r;
 
+    ptr_no_off_t() = default;
+    ptr_no_off_t(const ptr_no_off_t &) = default;
+    ptr_no_off_t(ptr_no_off_t &&) = default;
+    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
+    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
+
     ptr_no_off_t(region _r) : r(_r) {}
-    ptr_no_off_t(const ptr_no_off_t& p) : r(p.r) {}
 
     friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
         return (p1.r == p2.r);
@@ -59,8 +62,13 @@ struct ptr_with_off_t {
     region r;
     int offset;
 
+    ptr_with_off_t() = default;
+    ptr_with_off_t(const ptr_with_off_t &) = default;
+    ptr_with_off_t(ptr_with_off_t &&) = default;
+    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
+    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
+
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
-    ptr_with_off_t(const ptr_with_off_t& p) : r(p.r), offset(p.offset) {}
 
     friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
         return (p1.r == p2.r && p1.offset == p2.offset);
@@ -76,128 +84,121 @@ struct ptr_with_off_t {
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
-
+using register_t = uint8_t;
 
 struct reg_with_loc_t {
-    int r;
+    register_t r;
     std::pair<label_t, uint32_t> loc;
 
-    reg_with_loc_t() : r(-1), loc(std::make_pair(label_t::entry, 0)) {}
-    reg_with_loc_t(int _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
+    reg_with_loc_t() : r(11), loc(std::make_pair(label_t::entry, 0)) {}
+    reg_with_loc_t(register_t _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
 
     bool operator==(const reg_with_loc_t& other) const {
-        return (r != -1 && r == other.r);
+        return (r < 11 && r == other.r);
     }
-};
-}
 
-// adapted from top answer in
-// https://stackoverflow.com/questions/17016175/c-unordered-map-using-a-custom-class-type-as-the-key
-// works for now but needs to be checked again
-template <>
-struct std::hash<crab::reg_with_loc_t>
-{
-    std::size_t operator()(const crab::reg_with_loc_t& reg) const
-    {
-        using std::size_t;
+    std::size_t hash() const {
+        // Similar to boost::hash_combine
         using std::hash;
-        using std::string;
 
-        // Compute individual hash values for first,
-        // second and third and combine them using XOR
-        // and bit shifting:
+        std::size_t seed = hash<register_t>()(r);
+        seed ^= hash<int>()(loc.first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+        seed ^= hash<int>()(loc.second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
 
-        return ((hash<int>()(reg.r)
-               ^ (hash<int>()(reg.loc.first.from) << 1)) >> 1)
-               ^ (hash<int>()(reg.loc.second) << 1);
+        return seed;
     }
 };
+}
 
-namespace crab {
+namespace std {
+    template <>
+    struct std::hash<crab::reg_with_loc_t> {
+        std::size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    };
+}
 
+namespace crab {
 
-using offset_to_ptr_no_off_t = std::unordered_map<uint64_t, ptr_no_off_t>;
-using offset_to_ptr_t = std::unordered_map<uint64_t, ptr_t>;
+class ctx_t {
+    using offset_to_ptr_no_off_t = std::unordered_map<int, ptr_no_off_t>;
 
-struct ctx_t {
-  private:
-    offset_to_ptr_no_off_t packet_ptrs;
+    offset_to_ptr_no_off_t m_packet_ptrs;
 
   public:
     ctx_t(const ebpf_context_descriptor_t* desc)
     {
-        packet_ptrs.insert(std::make_pair(desc->data, crab::ptr_no_off_t(crab::region::T_PACKET)));
-        packet_ptrs.insert(std::make_pair(desc->end, crab::ptr_no_off_t(crab::region::T_PACKET)));
+        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
+        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
     }
 
     std::optional<ptr_no_off_t> find(int key) const {
-        auto it = packet_ptrs.find(key);
-        if (it == packet_ptrs.end()) return {};
+        auto it = m_packet_ptrs.find(key);
+        if (it == m_packet_ptrs.end()) return {};
         return it->second;
     }
 };
 
-struct stack_t {
-  private:
-    offset_to_ptr_t ptrs;
-    bool _is_bottom;
+class stack_t {
+    using offset_to_ptr_t = std::unordered_map<int, ptr_t>;
+
+    offset_to_ptr_t m_ptrs;
+    bool m_is_bottom;
 
   public:
-    explicit stack_t(bool is_bottom = false) : _is_bottom(is_bottom) {}
+    stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+    stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
+    : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
 
     stack_t operator|(const stack_t& other) const {
-        stack_t st{};
-        for (auto& e : ptrs) {
-            auto it = other.ptrs.find(e.first);
-            if (it == other.ptrs.end() || it->second == e.second) {
-                st.ptrs.insert(e);
-            }
+        if (is_bottom() || other.is_top()) {
+            return other;
+        } else if (other.is_bottom() || is_top()) {
+            return *this;
         }
-
-        for (auto& e : other.ptrs) {
-            auto it = ptrs.find(e.first);
-            if (it == ptrs.end()) {
-                st.ptrs.insert(e);
-            }
+        offset_to_ptr_t out_ptrs;
+        for (auto const&kv: m_ptrs) {
+            auto it = other.find(kv.first);
+            if (it && kv.second == it.value())
+                out_ptrs.insert(kv);
         }
-        return st;
+        return stack_t(std::move(out_ptrs), false);
     }
 
     void set_to_bottom() {
-        this->~stack_t();
-        new (this) stack_t(true);
+        m_ptrs.clear();
+        m_is_bottom = true;
     }
 
     void set_to_top() {
-        this->~stack_t();
-        new (this) stack_t(false);
+        m_ptrs.clear();
+        m_is_bottom = false;
     }
 
     static stack_t bottom() { return stack_t(true); }
 
     static stack_t top() { return stack_t(false); }
 
-    bool is_bottom() const { return _is_bottom; }
+    bool is_bottom() const { return m_is_bottom; }
 
     bool is_top() const {
-        if (_is_bottom)
+        if (m_is_bottom)
             return false;
-        return ptrs.empty();
+        return m_ptrs.empty();
     }
 
-    offset_to_ptr_t get_ptrs() const { return ptrs; }
+    const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
 
-    void insert(int key, ptr_t value) { ptrs.insert(std::make_pair(key, value)); }
+    void insert(int key, ptr_t value) { m_ptrs.insert(std::make_pair(key, value)); }
 
-    std::optional<ptr_t> find(int key) {
-        auto it = ptrs.find(key);
-        if (it == ptrs.end()) return {};
+    std::optional<ptr_t> find(int key) const {
+        auto it = m_ptrs.find(key);
+        if (it == m_ptrs.end()) return {};
         return it->second;
     }
 
     friend std::ostream& operator<<(std::ostream& o, const stack_t& st) {
         o << "Stack: {";
-        for (auto s : st.get_ptrs()) {
+        for (auto s : st.m_ptrs) {
             o << s.first << ": ";
             if (std::holds_alternative<ptr_with_off_t>(s.second)) {
                 auto t = std::get<ptr_with_off_t>(s.second);
@@ -212,64 +213,75 @@ struct stack_t {
     }
 };
 
-using all_types_t = std::unordered_map<reg_with_loc_t, ptr_t>;
-using reg_live_vars_t = std::array<reg_with_loc_t, 11>;
+using live_registers_t = std::array<reg_with_loc_t, 11>;
+using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
-struct types_t {
-  private:
-    reg_live_vars_t vars;
-    std::shared_ptr<all_types_t> all_types;
-    bool _is_bottom = false;
+class register_types_t {
+    live_registers_t m_vars;
+    std::shared_ptr<global_type_env_t> m_all_types;
+    bool m_is_bottom = false;
 
   public:
-    types_t(bool is_bottom = false) : _is_bottom(is_bottom) {}
-    explicit types_t(reg_live_vars_t _vars, std::shared_ptr<all_types_t> _all_types, bool is_bottom = false)
-        : vars(_vars), all_types(_all_types), _is_bottom(is_bottom) {}
-
-    types_t operator|(const types_t& other) const {
-        reg_live_vars_t _vars;
-        for (int i = 0; i < vars.size(); i++) {
-            auto it1 = all_types->find(vars[i]);
-            auto it2 = other.all_types->find(other.vars[i]);
-            if (it1 != all_types->end() && it2 != other.all_types->end()) {
-                if (it1->second == it2->second) {
-                    _vars[i] = vars[i];
-                }
+    register_types_t(bool is_bottom = false) : m_all_types(nullptr), m_is_bottom(is_bottom) {}
+    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> all_types, bool is_bottom = false)
+        : m_vars(std::move(vars)), m_all_types(all_types), m_is_bottom(is_bottom) {}
+
+    register_types_t operator|(const register_types_t& other) const {
+        if (is_bottom() || other.is_top()) {
+            return other;
+        } else if (other.is_bottom() || is_top()) {
+            return *this;
+        }
+        live_registers_t out_vars;
+        for (size_t i = 0; i < m_vars.size(); i++) {
+            auto it1 = find(m_vars[i]);
+            auto it2 = other.find(other.m_vars[i]);
+            if (it1 && it2 && it1.value() == it2.value()) {
+                out_vars[i] = m_vars[i];
             }
         }
 
-        types_t v(_vars, all_types, false);
-        return v;
+        return register_types_t(std::move(out_vars), m_all_types, false);
     }
 
     void set_to_bottom() {
-        this->~types_t();
-        new (this) types_t(true);
+        m_vars = live_registers_t{};
+        m_is_bottom = true;
     }
 
-    bool is_bottom() const { return _is_bottom; }
+    void set_to_top() {
+        m_vars = live_registers_t{};
+        m_is_bottom = false;
+    }
 
-    void insert(uint32_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-        auto it = all_types->insert(std::make_pair(reg_with_loc, type));
+    bool is_bottom() const { return m_is_bottom; }
+
+    bool is_top() const {
+        if (m_is_bottom) { return false; }
+        return (m_all_types == nullptr || m_vars.empty());
+    }
+
+    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
+        auto it = m_all_types->insert(std::make_pair(reg_with_loc, type));
         if (not it.second) it.first->second = type;
-        vars[reg] = reg_with_loc;
+        m_vars[reg] = reg_with_loc;
     }
 
     std::optional<ptr_t> find(const reg_with_loc_t& reg) const {
-        auto it = all_types->find(reg);
-        if (it == all_types->end()) return {};
+        auto it = m_all_types->find(reg);
+        if (it == m_all_types->end()) return {};
         return it->second;
     }
 
-    std::optional<ptr_t> find(uint32_t key) const {
-        auto reg = vars[key];
+    std::optional<ptr_t> find(register_t key) const {
+        auto reg = m_vars[key];
         return find(reg);
     }
 
-    reg_live_vars_t get_vars() const { return vars; }
+    const live_registers_t &get_vars() { return m_vars; }
 
-    friend std::ostream& operator<<(std::ostream& o, const types_t& typ) {
-        for (const auto& v : typ.get_vars()) {
+    friend std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
+        for (const auto& v : typ.m_vars) {
             auto it = typ.find(v);
             if (it) {
                 o << "\ttype of r" << v.r << ": ";
@@ -290,20 +302,19 @@ struct types_t {
 }
 
 class type_domain_t final {
-  private:
-    crab::stack_t stack;
-    crab::types_t types;
-    std::shared_ptr<crab::ctx_t> ctx;
-    label_t label;
+    crab::stack_t m_stack;
+    crab::register_types_t m_types;
+    std::shared_ptr<crab::ctx_t> m_ctx;
+    label_t m_label;
     uint32_t m_curr_pos = 0;
 
   public:
 
-  type_domain_t() : label(label_t::entry) {}
-  type_domain_t(const crab::types_t& _types, const crab::stack_t& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
-            : stack(_st), types(_types), ctx(_ctx), label(_l) {}
+  type_domain_t() : m_label(label_t::entry) {}
+  type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
+            : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx), m_label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-  static type_domain_t setup_entry(std::shared_ptr<crab::ctx_t>, std::shared_ptr<crab::all_types_t>);
+  static type_domain_t setup_entry();
   // bottom/top
   static type_domain_t bottom();
   void set_to_top();
@@ -340,8 +351,8 @@ class type_domain_t final {
   void operator()(const Assert &);
   void operator()(const basic_block_t& bb) {
       m_curr_pos = 0;
-      label = bb.label();
-      std::cout << label << ": \n";
+      m_label = bb.label();
+      std::cout << m_label << ": \n";
       for (const Instruction& statement : bb) {
         m_curr_pos++;
         std::visit(*this, statement);

From bda0f208af8edeffae46b2a7c6cbc840eca56292 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Fri, 25 Mar 2022 11:31:54 -0400
Subject: [PATCH 078/373] Attempt to add specialization for std::equal_to
 failed

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.hpp | 55 +++++++++++++++++++++++++++-------------
 1 file changed, 38 insertions(+), 17 deletions(-)

diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 4f77fca0e..7d6e1e627 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -45,14 +45,6 @@ struct ptr_no_off_t {
 
     ptr_no_off_t(region _r) : r(_r) {}
 
-    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-        return (p1.r == p2.r);
-    }
-
-    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-        return !(p2 == p1);
-    }
-
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
         return o << "{" << get_region(p.r) << "}";
     }
@@ -70,19 +62,28 @@ struct ptr_with_off_t {
 
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
 
-    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-        return (p1.r == p2.r && p1.offset == p2.offset);
-    }
-
-    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-        return !(p1 == p2);
-    }
-
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-        return o << "{" << get_region(p.r) << ", " << p.offset << "}";
+        o << "{" << get_region(p.r) << ", " << p.offset << "}";
+        return o;
     }
 };
 
+bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return (p1.r == p2.r);
+}
+
+bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return !(p1 == p2);
+}
+
+bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return (p1.r == p2.r && p1.offset == p2.offset);
+}
+
+bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return !(p1 == p2);
+}
+
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 using register_t = uint8_t;
 
@@ -110,13 +111,33 @@ struct reg_with_loc_t {
 };
 }
 
+
 namespace std {
     template <>
     struct std::hash<crab::reg_with_loc_t> {
         std::size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
     };
+
+    // does not seem to work for me
+    template <>
+    struct std::equal_to<crab::ptr_t> {
+        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
+            if (p1.index() != p2.index()) return false;
+            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
+                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
+                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
+                return (ptr_no_off1.r == ptr_no_off2.r);
+            }
+            else {
+                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
+                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
+                return (ptr_with_off1.r == ptr_with_off2.r && ptr_with_off1.offset == ptr_with_off2.offset);
+            }
+        }
+    };
 }
 
+
 namespace crab {
 
 class ctx_t {

From 4ec9cfd86af84c669b87827dc7626ef92dec805d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 19:53:13 -0400
Subject: [PATCH 079/373] Added type_domain in the abstract_domain framework

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp |  2 +
 src/crab/type_domain.cpp     | 59 ++++++++++++++++++++++++---
 src/crab/type_domain.hpp     | 79 +++++++++++++++++++++++++++---------
 src/crab_verifier.cpp        |  6 ++-
 src/main/check.cpp           |  3 ++
 5 files changed, 123 insertions(+), 26 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 244f770ae..ed580787d 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -1,5 +1,6 @@
 #include "abstract_domain.hpp"
 #include "ebpf_domain.hpp"
+#include "type_domain.hpp"
 
 template <typename Domain>
 abstract_domain_t::abstract_domain_model<Domain>::abstract_domain_model(Domain abs_val)
@@ -283,3 +284,4 @@ std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
 
 // REQUIRED: instantiation for supported domains
 template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
+template abstract_domain_t::abstract_domain_t(type_domain_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 492f91898..61c65081c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -15,6 +15,7 @@ using crab::reg_with_loc_t;
 using crab::live_registers_t;
 using crab::register_types_t;
 
+type_domain_t::type_domain_t(const type_domain_t& o) : m_label(label_t::entry) {}
 
 bool type_domain_t::is_bottom() const {
     return (m_stack.is_bottom() || m_types.is_bottom());
@@ -35,6 +36,19 @@ void type_domain_t::set_to_bottom() {
     m_types.set_to_bottom();
 }
 
+void type_domain_t::set_to_top() {
+    m_stack.set_to_top();
+    m_types.set_to_top();
+}
+
+bool type_domain_t::operator<=(const type_domain_t& abs) const {
+    return true;
+}
+
+void type_domain_t::operator|=(const type_domain_t& abs) const {}
+    
+void type_domain_t::operator|=(type_domain_t&& abs) const {}
+
 type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -45,10 +59,39 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
     return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), m_label, other.m_ctx);
 }
 
-std::ostream& operator<<(std::ostream& o, const type_domain_t& t) {
-    o << t.m_types;
-    o << "\t" << t.m_stack << "\n";
-    return o;
+type_domain_t type_domain_t::operator|(type_domain_t&& abs) const {
+    return std::move(abs);
+}
+
+type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
+    return abs;
+}
+
+type_domain_t type_domain_t::widen(const type_domain_t& abs) const {
+    return abs;
+}
+
+type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
+    return other;
+}
+
+void type_domain_t::write(std::ostream& os) const { 
+    os << "I am printing types in the start\n";
+    os << m_types;
+    os << "I am printing stack in the start\n";
+    os << "\t" << m_stack << "\n";
+}
+
+std::string type_domain_t::domain_name() const {
+    return "type_domain";
+}
+
+int type_domain_t::get_instruction_count_upper_bound() {
+    return 0;
+}
+
+string_invariant type_domain_t::to_set() {
+    return string_invariant{};
 }
 
 void type_domain_t::operator()(const Undefined & u) {}
@@ -60,7 +103,10 @@ void type_domain_t::operator()(const Jmp &u) {}
 void type_domain_t::operator()(const Packet & u) {}
 void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
-void type_domain_t::operator()(const Assert &u) {}
+void type_domain_t::operator()(const Assert &u) {
+
+    std::cout << "I am in Assert\n";
+}
 
 type_domain_t type_domain_t::setup_entry() {
 
@@ -84,6 +130,7 @@ type_domain_t type_domain_t::setup_entry() {
 
 void type_domain_t::operator()(const Bin& bin) {
 
+    std::cout << "I am in Bin\n";
     std::cout << "  " << bin << "\n";
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
@@ -227,3 +274,5 @@ void type_domain_t::operator()(const Mem& b) {
         CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet) - ", std::get<Imm>(b.value).v);
     }
 }
+
+void type_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 7d6e1e627..1625abe87 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -5,7 +5,10 @@
 
 #include <unordered_map>
 
+#include "crab/abstract_domain.hpp"
 #include "crab/cfg.hpp"
+#include "linear_constraint.hpp"
+#include "string_constraints.hpp"
 
 namespace crab {
 
@@ -48,6 +51,15 @@ struct ptr_no_off_t {
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
         return o << "{" << get_region(p.r) << "}";
     }
+  
+    // temporarily make operators friend functions in order to avoid duplicate symbol errors
+    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+        return (p1.r == p2.r);
+    }
+
+    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+        return !(p1 == p2);
+    }
 };
 
 struct ptr_with_off_t {
@@ -66,23 +78,16 @@ struct ptr_with_off_t {
         o << "{" << get_region(p.r) << ", " << p.offset << "}";
         return o;
     }
-};
 
-bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return (p1.r == p2.r);
-}
-
-bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return !(p1 == p2);
-}
-
-bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.r == p2.r && p1.offset == p2.offset);
-}
+    // temporarily make operators friend functions in order to avoid duplicate symbol errors
+    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+        return (p1.r == p2.r && p1.offset == p2.offset);
+    }
 
-bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return !(p1 == p2);
-}
+    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+        return !(p1 == p2);
+    }
+};
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 using register_t = uint8_t;
@@ -169,6 +174,12 @@ class stack_t {
     stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
     stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
     : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
+    
+   // stack_t(stack_t&& s) = default; 
+   // stack_t(const stack_t& s) = default;
+    
+   // stack_t& operator=(const stack_t& s) = default;
+ //   stack_t& operator=(stack_t&& s) = default;
 
     stack_t operator|(const stack_t& other) const {
         if (is_bottom() || other.is_top()) {
@@ -184,7 +195,27 @@ class stack_t {
         }
         return stack_t(std::move(out_ptrs), false);
     }
+/*
+    stack_t operator|(stack_t&& other) && {
+        if (is_bottom() || other.is_top) 
+            return std::move(other);
+        if (other.is_bottom() || is_top())
+            return std::move(*this);
+        return ((const stack_t&)*this) | (const stack_t&)other;
+    }
+
+    stack_t operator|(const stack_t& other) && {
+        if (is_top() || other.is_bottom())
+            return std::move(*this);
+        return ((const stack_t&
+    }
 
+    stack_t operator|(stack_t&& other) const& {
+        if (is_bottom() || other.is_top())
+            return std::move(other);
+        return (*this) | (const stack_t&)other;
+    }
+*/
     void set_to_bottom() {
         m_ptrs.clear();
         m_is_bottom = true;
@@ -246,6 +277,8 @@ class register_types_t {
     register_types_t(bool is_bottom = false) : m_all_types(nullptr), m_is_bottom(is_bottom) {}
     explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> all_types, bool is_bottom = false)
         : m_vars(std::move(vars)), m_all_types(all_types), m_is_bottom(is_bottom) {}
+    //register_types_t(register_types_t&& t) = default;
+   // register_types_t& operator=(register_types_t&& t) = default;
 
     register_types_t operator|(const register_types_t& other) const {
         if (is_bottom() || other.is_top()) {
@@ -331,7 +364,10 @@ class type_domain_t final {
 
   public:
 
+  type_domain_t(const type_domain_t& o);
   type_domain_t() : m_label(label_t::entry) {}
+  type_domain_t(type_domain_t&& o) = default;
+  type_domain_t& operator=(type_domain_t&& o) = default;
   type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
             : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx), m_label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
@@ -345,10 +381,9 @@ class type_domain_t final {
   // inclusion
   bool operator<=(const type_domain_t& other) const;
   // join
-  void operator|=(type_domain_t& other) const;
+  void operator|=(type_domain_t&& other) const;
   void operator|=(const type_domain_t& other) const;
-  friend std::ostream& operator<<(std::ostream&, const type_domain_t&);
-  type_domain_t operator|(type_domain_t& other) const;
+  type_domain_t operator|(type_domain_t&& other) const;
   type_domain_t operator|(const type_domain_t& other) const&;
   // meet
   type_domain_t operator&(const type_domain_t& other) const;
@@ -370,16 +405,20 @@ class type_domain_t final {
   void operator()(const LockAdd &);
   void operator()(const Assume &);
   void operator()(const Assert &);
-  void operator()(const basic_block_t& bb) {
+  void operator()(const basic_block_t& bb, bool check_termination) {
       m_curr_pos = 0;
       m_label = bb.label();
       std::cout << m_label << ": \n";
       for (const Instruction& statement : bb) {
         m_curr_pos++;
         std::visit(*this, statement);
-        std::cout << *this << "\n";
     }
   }
+  void write(std::ostream& os) const;
+  std::string domain_name() const;
+  int get_instruction_count_upper_bound();
+  string_invariant to_set();
+  void set_require_check(check_require_func_t f);
 
   private:
 
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index f7cd3265c..66237a04b 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -14,6 +14,7 @@
 
 #include "crab/abstract_domain.hpp"
 #include "crab/ebpf_domain.hpp"
+#include "crab/type_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 
@@ -124,7 +125,9 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
         return abstract_domain_t(entry_inv);
     }
     case abstract_domain_kind::TYPE_DOMAIN: {
-        // TODO
+        type_domain_t entry_inv = type_domain_t::setup_entry();
+        entry_inv.write(std::cout);
+        return abstract_domain_t(entry_inv);
     }
     default:
         // FIXME: supported abstract domains should be checked in check.cpp
@@ -162,6 +165,7 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
     try {
 
         abstract_domain_t entry_dom = make_initial(options);
+        entry_dom.write(std::cout);
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         auto [pre_invariants, post_invariants] =
             crab::run_forward_analyzer(cfg, std::move(entry_dom));
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 72ee1b2b8..ed9a00c40 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -92,6 +92,9 @@ int main(int argc, char** argv) {
         ebpf_verifier_options.print_invariants = ebpf_verifier_options.print_failures = true;
     ebpf_verifier_options.allow_division_by_zero = !no_division_by_zero;
 
+    if (gen_proof) 
+        ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
+
     // Main program
 
     if (filename == "@headers") {

From 64c865d5e9b2b0a56298d533c51dc1686dbc2224 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Mon, 28 Mar 2022 22:39:34 -0400
Subject: [PATCH 080/373] Cleaned up prints in previous code; implemented
 required features for type_domain_t to be used as an abstract_domain_t;
 printing types after each statement that is supported;

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 109 ++++++++++++++++++++++++++++++++-------
 src/crab/type_domain.hpp |  86 +++++++-----------------------
 src/crab_verifier.cpp    |   3 +-
 3 files changed, 112 insertions(+), 86 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 61c65081c..6c2554f92 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -15,14 +15,54 @@ using crab::reg_with_loc_t;
 using crab::live_registers_t;
 using crab::register_types_t;
 
-type_domain_t::type_domain_t(const type_domain_t& o) : m_label(label_t::entry) {}
+void print_pointer(const ptr_t& p) {
+    if (std::holds_alternative<ptr_with_off_t>(p)) {
+        auto t = std::get<ptr_with_off_t>(p);
+        std::cout << t;
+    }
+    else {
+        auto t = std::get<ptr_no_off_t>(p);
+        std::cout << t;
+    }
+}
+
+void print_type(register_t r, const ptr_t& p) {
+    std::cout << ">>>>type of r" << static_cast<unsigned int>(r) << ": ";
+    print_pointer(p);
+    std::cout << "\n";
+}
+
+namespace crab {
+
+std::ostream& operator<<(std::ostream& o, const stack_t& st) {
+    o << "Stack: {";
+    for (auto it = st.m_ptrs.begin(); it != st.m_ptrs.end(); it++) {
+        auto s = *it;
+        o << s.first << ": ";
+        print_pointer(s.second);
+        if (++it != st.m_ptrs.end()) o << ",";
+    }
+    return o << "}";
+}
+
+std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
+    for (const auto& v : typ.m_vars) {
+        auto it = typ.find(v);
+        if (it) {
+            o << "\t";
+            print_type(v.r, it.value());
+        }
+    }
+    return o;
+}
+}
 
 bool type_domain_t::is_bottom() const {
     return (m_stack.is_bottom() || m_types.is_bottom());
 }
 
 bool type_domain_t::is_top() const {
-    return (m_stack.is_top() || m_types.is_top());
+    return (m_stack.is_top() && m_types.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -45,22 +85,37 @@ bool type_domain_t::operator<=(const type_domain_t& abs) const {
     return true;
 }
 
-void type_domain_t::operator|=(const type_domain_t& abs) const {}
-    
-void type_domain_t::operator|=(type_domain_t&& abs) const {}
+void type_domain_t::operator|=(const type_domain_t& abs) {
+    type_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void type_domain_t::operator|=(type_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
 
-type_domain_t type_domain_t::operator|(const type_domain_t& other) const& {
+type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     }
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), m_label, other.m_ctx);
+    return type_domain_t(m_types | other.m_types, m_stack | other.m_stack, m_label, other.m_ctx);
 }
 
-type_domain_t type_domain_t::operator|(type_domain_t&& abs) const {
-    return std::move(abs);
+type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), m_label, other.m_ctx);
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -76,9 +131,7 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
 }
 
 void type_domain_t::write(std::ostream& os) const { 
-    os << "I am printing types in the start\n";
     os << m_types;
-    os << "I am printing stack in the start\n";
     os << "\t" << m_stack << "\n";
 }
 
@@ -103,10 +156,7 @@ void type_domain_t::operator()(const Jmp &u) {}
 void type_domain_t::operator()(const Packet & u) {}
 void type_domain_t::operator()(const LockAdd &u) {}
 void type_domain_t::operator()(const Assume &u) {}
-void type_domain_t::operator()(const Assert &u) {
-
-    std::cout << "I am in Assert\n";
-}
+void type_domain_t::operator()(const Assert &u) {}
 
 type_domain_t type_domain_t::setup_entry() {
 
@@ -114,6 +164,9 @@ type_domain_t type_domain_t::setup_entry() {
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(&context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
+    std::cout << "Printing types ==============\n\n";
+    std::cout << *ctx << "\n";
+
     live_registers_t vars;
     register_types_t typ(std::move(vars), all_types, true);
 
@@ -123,6 +176,15 @@ type_domain_t type_domain_t::setup_entry() {
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
+    auto it = typ.find(R1_ARG);
+    if (it)
+        print_type(R1_ARG, it.value());
+
+    auto it2 = typ.find(R10_STACK_POINTER);
+    if (it2)
+        print_type(R10_STACK_POINTER, it2.value());
+    std::cout << "\n";
+
     type_domain_t inv(std::move(typ), crab::stack_t::bottom(), label_t::entry, ctx);
 
     return inv;
@@ -130,8 +192,6 @@ type_domain_t type_domain_t::setup_entry() {
 
 void type_domain_t::operator()(const Bin& bin) {
 
-    std::cout << "I am in Bin\n";
-    std::cout << "  " << bin << "\n";
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
@@ -145,6 +205,13 @@ void type_domain_t::operator()(const Bin& bin) {
 
                 auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
                 m_types.insert(bin.dst.v, reg, it.value());
+
+                auto it2 = m_types.find(bin.dst.v);
+                if (it2) {
+                    std::cout << "\t";
+                    print_type(bin.dst.v, it2.value());
+                    std::cout << "\n";
+                }
             }
 
             default:
@@ -212,6 +279,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             assert(false);
         }
     }
+
+    auto it2 = m_types.find(target_reg.v);
+    if (it2) {
+        std::cout << "\t";
+        print_type(target_reg.v, it2.value());
+        std::cout << "\n";
+    }
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
@@ -263,7 +337,6 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
 void type_domain_t::operator()(const Mem& b) {
 
-    std::cout << "  " << b << "\n";
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
             do_load(b, std::get<Reg>(b.value));
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 1625abe87..6916312f3 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -162,6 +162,15 @@ class ctx_t {
         if (it == m_packet_ptrs.end()) return {};
         return it->second;
     }
+
+    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
+
+        o << "type of context: \n";
+        for (const auto& it : _ctx.m_packet_ptrs) {
+            o << "\tstores at " << it.first << ": " << it.second << "\n";
+        }
+        return o;
+    }
 };
 
 class stack_t {
@@ -175,12 +184,6 @@ class stack_t {
     stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
     : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
     
-   // stack_t(stack_t&& s) = default; 
-   // stack_t(const stack_t& s) = default;
-    
-   // stack_t& operator=(const stack_t& s) = default;
- //   stack_t& operator=(stack_t&& s) = default;
-
     stack_t operator|(const stack_t& other) const {
         if (is_bottom() || other.is_top()) {
             return other;
@@ -195,27 +198,7 @@ class stack_t {
         }
         return stack_t(std::move(out_ptrs), false);
     }
-/*
-    stack_t operator|(stack_t&& other) && {
-        if (is_bottom() || other.is_top) 
-            return std::move(other);
-        if (other.is_bottom() || is_top())
-            return std::move(*this);
-        return ((const stack_t&)*this) | (const stack_t&)other;
-    }
 
-    stack_t operator|(const stack_t& other) && {
-        if (is_top() || other.is_bottom())
-            return std::move(*this);
-        return ((const stack_t&
-    }
-
-    stack_t operator|(stack_t&& other) const& {
-        if (is_bottom() || other.is_top())
-            return std::move(other);
-        return (*this) | (const stack_t&)other;
-    }
-*/
     void set_to_bottom() {
         m_ptrs.clear();
         m_is_bottom = true;
@@ -248,21 +231,7 @@ class stack_t {
         return it->second;
     }
 
-    friend std::ostream& operator<<(std::ostream& o, const stack_t& st) {
-        o << "Stack: {";
-        for (auto s : st.m_ptrs) {
-            o << s.first << ": ";
-            if (std::holds_alternative<ptr_with_off_t>(s.second)) {
-                auto t = std::get<ptr_with_off_t>(s.second);
-                o << t << ", ";
-            }
-            else {
-                auto t = std::get<ptr_no_off_t>(s.second);
-                o << t << ", ";
-            }
-        }
-        return o << "}";
-    }
+    friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
 };
 
 using live_registers_t = std::array<reg_with_loc_t, 11>;
@@ -277,8 +246,6 @@ class register_types_t {
     register_types_t(bool is_bottom = false) : m_all_types(nullptr), m_is_bottom(is_bottom) {}
     explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> all_types, bool is_bottom = false)
         : m_vars(std::move(vars)), m_all_types(all_types), m_is_bottom(is_bottom) {}
-    //register_types_t(register_types_t&& t) = default;
-   // register_types_t& operator=(register_types_t&& t) = default;
 
     register_types_t operator|(const register_types_t& other) const {
         if (is_bottom() || other.is_top()) {
@@ -334,28 +301,13 @@ class register_types_t {
 
     const live_registers_t &get_vars() { return m_vars; }
 
-    friend std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
-        for (const auto& v : typ.m_vars) {
-            auto it = typ.find(v);
-            if (it) {
-                o << "\ttype of r" << v.r << ": ";
-                if (std::holds_alternative<ptr_with_off_t>(it.value())) {
-                    auto t = std::get<ptr_with_off_t>(it.value());
-                    o << t << "\n";
-                }
-                else {
-                    auto t = std::get<ptr_no_off_t>(it.value());
-                    o << t << "\n";
-                }
-            }
-        }
-        return o;
-    }
+    friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
 };
 
 }
 
 class type_domain_t final {
+
     crab::stack_t m_stack;
     crab::register_types_t m_types;
     std::shared_ptr<crab::ctx_t> m_ctx;
@@ -364,10 +316,11 @@ class type_domain_t final {
 
   public:
 
-  type_domain_t(const type_domain_t& o);
   type_domain_t() : m_label(label_t::entry) {}
   type_domain_t(type_domain_t&& o) = default;
+  type_domain_t(const type_domain_t& o) = default;
   type_domain_t& operator=(type_domain_t&& o) = default;
+  type_domain_t& operator=(const type_domain_t& o) = default;
   type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
             : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx), m_label(_l) {}
   // eBPF initialization: R1 points to ctx, R10 to stack, etc.
@@ -381,10 +334,10 @@ class type_domain_t final {
   // inclusion
   bool operator<=(const type_domain_t& other) const;
   // join
-  void operator|=(type_domain_t&& other) const;
-  void operator|=(const type_domain_t& other) const;
-  type_domain_t operator|(type_domain_t&& other) const;
-  type_domain_t operator|(const type_domain_t& other) const&;
+  void operator|=(const type_domain_t& abs);
+  void operator|=(type_domain_t&& abs);
+  type_domain_t operator|(const type_domain_t& other) const;
+  type_domain_t operator|(type_domain_t&& abs) const;
   // meet
   type_domain_t operator&(const type_domain_t& other) const;
   // widening
@@ -408,8 +361,9 @@ class type_domain_t final {
   void operator()(const basic_block_t& bb, bool check_termination) {
       m_curr_pos = 0;
       m_label = bb.label();
-      std::cout << m_label << ": \n";
+      std::cout << m_label << "\n";
       for (const Instruction& statement : bb) {
+        std::cout << "  " << statement << "\n";
         m_curr_pos++;
         std::visit(*this, statement);
     }
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 66237a04b..8760db327 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -126,7 +126,6 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
     }
     case abstract_domain_kind::TYPE_DOMAIN: {
         type_domain_t entry_inv = type_domain_t::setup_entry();
-        entry_inv.write(std::cout);
         return abstract_domain_t(entry_inv);
     }
     default:
@@ -164,8 +163,8 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
 
     try {
 
+        s << cfg;
         abstract_domain_t entry_dom = make_initial(options);
-        entry_dom.write(std::cout);
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         auto [pre_invariants, post_invariants] =
             crab::run_forward_analyzer(cfg, std::move(entry_dom));

From 566ccdad29b3720ce7cc295ac14e38b0c47df548 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 29 Mar 2022 11:28:34 -0400
Subject: [PATCH 081/373] Minor refactorings

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 49 ++++++++++++++++++++++++++++------------
 src/crab/type_domain.hpp | 22 +++++++++++++-----
 src/crab_verifier.cpp    |  3 ++-
 3 files changed, 53 insertions(+), 21 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 6c2554f92..092f8153c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -130,6 +130,10 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
     return other;
 }
 
+void type_domain_t::operator-=(variable_t var) {
+    m_types -= var;
+}
+
 void type_domain_t::write(std::ostream& os) const { 
     os << m_types;
     os << "\t" << m_stack << "\n";
@@ -160,8 +164,7 @@ void type_domain_t::operator()(const Assert &u) {}
 
 type_domain_t type_domain_t::setup_entry() {
 
-    ebpf_context_descriptor_t context_descriptor{0, 0, 4, -1};
-    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(&context_descriptor);
+    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
     std::cout << "Printing types ==============\n\n";
@@ -176,13 +179,17 @@ type_domain_t type_domain_t::setup_entry() {
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
+    std::cout << "Initial register types:\n";
     auto it = typ.find(R1_ARG);
-    if (it)
+    if (it) {
+        std::cout << "\t";
         print_type(R1_ARG, it.value());
-
+    }
     auto it2 = typ.find(R10_STACK_POINTER);
-    if (it2)
+    if (it2) {
+        std::cout << "\t";
         print_type(R10_STACK_POINTER, it2.value());
+    }
     std::cout << "\n";
 
     type_domain_t inv(std::move(typ), crab::stack_t::bottom(), label_t::entry, ctx);
@@ -197,10 +204,9 @@ void type_domain_t::operator()(const Bin& bin) {
         switch (bin.op)
         {
             case Bin::Op::MOV: {
-
                 auto it = m_types.find(src.v);
                 if (!it) {
-                    CRAB_ERROR("type error: assigning an unknown pointer or a number - R", (int)src.v);
+                    CRAB_ERROR("type error: assigning an unknown pointer or a number - r", (int)src.v);
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
@@ -212,6 +218,9 @@ void type_domain_t::operator()(const Bin& bin) {
                     print_type(bin.dst.v, it2.value());
                     std::cout << "\n";
                 }
+                else {
+                    CRAB_ERROR("Type of r", static_cast<int>(bin.dst.v), " is not being stored");
+                }
             }
 
             default:
@@ -227,12 +236,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - R", (int)basereg.v);
+        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - r", (int)basereg.v);
     }
     ptr_t type_basereg = it.value();
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - R", (int)basereg.v);
+        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - r", (int)basereg.v);
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
@@ -286,43 +295,55 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
         print_type(target_reg.v, it2.value());
         std::cout << "\n";
     }
+    else {
+        CRAB_ERROR("Type of r", static_cast<int>(target_reg.v), " is not being stored");
+    }
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
+    int width = b.access.width;
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        CRAB_ERROR("type_error: storing at an unknown pointer, or from number - R", (int)basereg.v);
+        CRAB_ERROR("type_error: storing at an unknown pointer, or from number - r", (int)basereg.v);
     }
     ptr_t type_basereg = it.value();
 
     auto it2 = m_types.find(target_reg.v);
     if (!it2) {
-        CRAB_ERROR("type_error: storing either a number or an unknown pointer - R", (int)target_reg.v);
+        CRAB_ERROR("type_error: storing either a number or an unknown pointer - r", (int)target_reg.v);
     }
     ptr_t type_stored = it2.value();
 
     if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
         ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
         if (type_stored_with_off.r == crab::region::T_STACK) {
-            CRAB_ERROR("type_error: we cannot store stack pointer, R", (int)target_reg.v, ", into stack");
+            CRAB_ERROR("type_error: we cannot store stack pointer, r", (int)target_reg.v, ", into stack");
         }
     }
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: we cannot store pointer, R", (int)target_reg.v, ", into packet or shared");
+        CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into packet or shared");
     }
 
     ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
     if (type_basereg_with_off.r == crab::region::T_CTX) {
-        CRAB_ERROR("type_error: we cannot store pointer, R", (int)target_reg.v, ", into ctx");
+        CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into ctx");
     }
 
     int store_at = offset+type_basereg_with_off.offset;
 
+    for (auto i = store_at; i < store_at+width; i++) {
+        auto it = m_stack.find(i);
+        if (it) {
+            CRAB_ERROR("type_error: type being stored into stack at ", store_at, " is overlapping with already stored\
+            at", i);
+        }
+    }
+
     auto it3 = m_stack.find(store_at);
     if (it3) {
         auto type_in_stack = it3.value();
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 6916312f3..228a4ae9d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -153,8 +153,10 @@ class ctx_t {
   public:
     ctx_t(const ebpf_context_descriptor_t* desc)
     {
-        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
-        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
+        if (desc->data != -1)
+            m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
+        if (desc->end != -1)
+            m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
     }
 
     std::optional<ptr_no_off_t> find(int key) const {
@@ -165,7 +167,7 @@ class ctx_t {
 
     friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
 
-        o << "type of context: \n";
+        o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "_|_" : "") << "\n";
         for (const auto& it : _ctx.m_packet_ptrs) {
             o << "\tstores at " << it.first << ": " << it.second << "\n";
         }
@@ -283,8 +285,13 @@ class register_types_t {
     }
 
     void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-        auto it = m_all_types->insert(std::make_pair(reg_with_loc, type));
-        if (not it.second) it.first->second = type;
+        auto it = m_all_types->find(reg_with_loc);
+        if (it == m_all_types->end())
+            m_all_types->insert(std::make_pair(reg_with_loc, type));
+        else
+            it->second = type;
+        //auto it = m_all_types->insert(std::make_pair(reg_with_loc, type));
+        //if (not it.second) it.first->second = type;
         m_vars[reg] = reg_with_loc;
     }
 
@@ -344,6 +351,8 @@ class type_domain_t final {
   type_domain_t widen(const type_domain_t& other) const;
   // narrowing
   type_domain_t narrow(const type_domain_t& other) const;
+  //forget
+  void operator-=(variable_t var);
 
   //// abstract transformers
   void operator()(const Undefined &);
@@ -361,12 +370,13 @@ class type_domain_t final {
   void operator()(const basic_block_t& bb, bool check_termination) {
       m_curr_pos = 0;
       m_label = bb.label();
-      std::cout << m_label << "\n";
+      std::cout << m_label << ":\n";
       for (const Instruction& statement : bb) {
         std::cout << "  " << statement << "\n";
         m_curr_pos++;
         std::visit(*this, statement);
     }
+    std::cout << "\n";
   }
   void write(std::ostream& os) const;
   std::string domain_name() const;
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 8760db327..306bb8a00 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -162,8 +162,9 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
     thread_local_options = *options;
 
     try {
-
+        s << "\nprinting the cfg ==============\n";
         s << cfg;
+        s << "\n";
         abstract_domain_t entry_dom = make_initial(options);
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         auto [pre_invariants, post_invariants] =

From cbb58f6c0fff7e137a18151a692b14fae26a64fb Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 29 Mar 2022 19:33:02 -0400
Subject: [PATCH 082/373] Fixed computation of types when non-supported
 operations are present; Fixed printing of types; Refactoring

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 177 ++++++++++++++++++++++++++-------------
 src/crab/type_domain.hpp |  81 +++++++++++-------
 src/crab_verifier.cpp    |   4 +-
 3 files changed, 173 insertions(+), 89 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 092f8153c..968081421 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -15,7 +15,9 @@ using crab::reg_with_loc_t;
 using crab::live_registers_t;
 using crab::register_types_t;
 
-void print_pointer(const ptr_t& p) {
+static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
+
+void print_ptr_type(const ptr_t& p) {
     if (std::holds_alternative<ptr_with_off_t>(p)) {
         auto t = std::get<ptr_with_off_t>(p);
         std::cout << t;
@@ -27,30 +29,55 @@ void print_pointer(const ptr_t& p) {
 }
 
 void print_type(register_t r, const ptr_t& p) {
-    std::cout << ">>>>type of r" << static_cast<unsigned int>(r) << ": ";
-    print_pointer(p);
-    std::cout << "\n";
+    std::cout << "r" << static_cast<unsigned int>(r) << " : ";
+    print_ptr_type(p);
+}
+
+void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
+    if (b.is_load) {
+        os_ << "  ";
+        print_type(std::get<Reg>(b.value).v, p);
+        os_ << " = ";
+    }
+    std::string sign = b.access.offset < 0 ? " - " : " + ";
+    int offset = std::abs(b.access.offset);
+    os_ << "*(" << size(b.access.width) << " *)";
+    os_ << "(" << b.access.basereg << sign << offset << ")\n";
+}
+
+void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
+    os_ << "  ";
+    print_type(0, p);
+    os_ << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
 namespace crab {
 
 std::ostream& operator<<(std::ostream& o, const stack_t& st) {
-    o << "Stack: {";
-    for (auto it = st.m_ptrs.begin(); it != st.m_ptrs.end(); it++) {
-        auto s = *it;
-        o << s.first << ": ";
-        print_pointer(s.second);
-        if (++it != st.m_ptrs.end()) o << ",";
+    o << "Stack: ";
+    if (st.is_bottom())
+        o << "_|_\n";
+    else {
+        o << "{";
+        for (auto it = st.m_ptrs.begin(); it != st.m_ptrs.end(); it++) {
+            auto s = *it;
+            o << s.first << ": ";
+            print_ptr_type(s.second);
+            if (++it != st.m_ptrs.end()) o << ",";
+        }
+        o << "}";
     }
-    return o << "}";
+    return o;
 }
 
 std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
-    for (const auto& v : typ.m_vars) {
-        auto it = typ.find(v);
-        if (it) {
-            o << "\t";
-            print_type(v.r, it.value());
+    if (typ.is_bottom())
+        o << "_|_\n";
+    else {
+        for (const auto& v : *(typ.m_all_types)) {
+            o << v.first << ": ";
+            print_ptr_type(v.second);
+            o << "\n";
         }
     }
     return o;
@@ -72,7 +99,6 @@ type_domain_t type_domain_t::bottom() {
 }
 
 void type_domain_t::set_to_bottom() {
-    m_stack.set_to_bottom();
     m_types.set_to_bottom();
 }
 
@@ -130,13 +156,9 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
     return other;
 }
 
-void type_domain_t::operator-=(variable_t var) {
-    m_types -= var;
-}
-
 void type_domain_t::write(std::ostream& os) const { 
     os << m_types;
-    os << "\t" << m_stack << "\n";
+    os << m_stack << "\n";
 }
 
 std::string type_domain_t::domain_name() const {
@@ -151,27 +173,71 @@ string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined & u) {}
-void type_domain_t::operator()(const Un &u) {}
-void type_domain_t::operator()(const LoadMapFd &u) {}
-void type_domain_t::operator()(const Call &u) {}
-void type_domain_t::operator()(const Exit &u) {}
-void type_domain_t::operator()(const Jmp &u) {}
-void type_domain_t::operator()(const Packet & u) {}
-void type_domain_t::operator()(const LockAdd &u) {}
-void type_domain_t::operator()(const Assume &u) {}
-void type_domain_t::operator()(const Assert &u) {}
+void type_domain_t::operator()(const Undefined & u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const Un &u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const LoadMapFd &u) {
+    std::cout << "  " << u << ";\n";
+    m_types -= u.dst.v;
+}
+void type_domain_t::operator()(const Call &u) {
+    register_t r0_reg{R0_RETURN_VALUE};
+    if (u.is_map_lookup) {
+        auto r0 = reg_with_loc_t(r0_reg, m_label, m_curr_pos);
+        auto type = ptr_no_off_t(crab::region::T_SHARED);
+        m_types.insert(r0_reg, r0, type);
+        print_annotated(u, type, std::cout);
+    }
+    else {
+        m_types -= r0_reg;
+        std::cout << "  " << u << ";\n";
+    }
+}
+void type_domain_t::operator()(const Exit &u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const Jmp &u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const Packet & u) {
+    std::cout << "  " << u << ";\n";
+    //CRAB_ERROR("type_error: loading from packet region not allowed");
+    m_types -= register_t{0};
+}
+void type_domain_t::operator()(const LockAdd &u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const Assume &u) {
+    std::cout << "  " << u << ";\n";
+}
+void type_domain_t::operator()(const Assert &u) {
+    std::cout << "  " << u << ";\n";
+}
+
+void print_info() {
+    std::cout << "\nhow to interpret:\n";
+    std::cout << "  packet_p = packet pointer\n";
+    std::cout << "  shared_p = shared pointer\n";
+    std::cout << "  stack_p<n> = stack pointer at offset n\n";
+    std::cout << "  ctx_p<n> = context pointer at offset n\n";
+    std::cout << "  context = _|_ means context contains no elements stored\n\n";
+    std::cout << "**************************************************************\n\n";
+}
 
 type_domain_t type_domain_t::setup_entry() {
 
+    print_info();
+
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
-    std::cout << "Printing types ==============\n\n";
     std::cout << *ctx << "\n";
 
     live_registers_t vars;
-    register_types_t typ(std::move(vars), all_types, true);
+    register_types_t typ(std::move(vars), all_types);
 
     auto r1 = reg_with_loc_t(R1_ARG, label_t::entry, 0);
     auto r10 = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
@@ -182,18 +248,19 @@ type_domain_t type_domain_t::setup_entry() {
     std::cout << "Initial register types:\n";
     auto it = typ.find(R1_ARG);
     if (it) {
-        std::cout << "\t";
+        std::cout << "  ";
         print_type(R1_ARG, it.value());
+        std::cout << "\n";
     }
     auto it2 = typ.find(R10_STACK_POINTER);
     if (it2) {
-        std::cout << "\t";
+        std::cout << "  ";
         print_type(R10_STACK_POINTER, it2.value());
+        std::cout << "\n";
     }
     std::cout << "\n";
 
-    type_domain_t inv(std::move(typ), crab::stack_t::bottom(), label_t::entry, ctx);
-
+    type_domain_t inv(std::move(typ), crab::stack_t::top(), label_t::entry, ctx);
     return inv;
 }
 
@@ -211,22 +278,18 @@ void type_domain_t::operator()(const Bin& bin) {
 
                 auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
                 m_types.insert(bin.dst.v, reg, it.value());
-
-                auto it2 = m_types.find(bin.dst.v);
-                if (it2) {
-                    std::cout << "\t";
-                    print_type(bin.dst.v, it2.value());
-                    std::cout << "\n";
-                }
-                else {
-                    CRAB_ERROR("Type of r", static_cast<int>(bin.dst.v), " is not being stored");
-                }
+                break;
             }
 
             default:
+                m_types -= bin.dst.v;
                 break;
         }
     }
+    else {
+        m_types -= bin.dst.v;
+    }
+    std::cout << "  " << bin << ";\n";
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
@@ -236,11 +299,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
     auto it = m_types.find(basereg.v);
     if (!it) {
+        std::cout << "  " << b << "\n";
         CRAB_ERROR("type_error: loading from an unknown pointer, or from number - r", (int)basereg.v);
     }
     ptr_t type_basereg = it.value();
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
+        std::cout << "  " << b << "\n";
         CRAB_ERROR("type_error: loading from either packet or shared region not allowed - r", (int)basereg.v);
     }
 
@@ -253,6 +318,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = m_stack.find(load_at);
 
             if (!it) {
+                std::cout << "  " << b << "\n";
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
             }
             ptr_t type_loaded = it.value();
@@ -261,11 +327,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
                 m_types.insert(target_reg.v, reg, type_loaded_with_off);
+                print_annotated(b, type_loaded_with_off, std::cout);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
                 m_types.insert(target_reg.v, reg, type_loaded_no_off);
+                print_annotated(b, type_loaded_no_off, std::cout);
             }
 
             break;
@@ -275,12 +343,14 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             auto it = m_ctx->find(load_at);
 
             if (!it) {
+                std::cout << "  " << b << "\n";
                 CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
             }
             ptr_no_off_t type_loaded = it.value();
 
             auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
             m_types.insert(target_reg.v, reg, type_loaded);
+            print_annotated(b, type_loaded, std::cout);
             break;
         }
 
@@ -288,20 +358,11 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             assert(false);
         }
     }
-
-    auto it2 = m_types.find(target_reg.v);
-    if (it2) {
-        std::cout << "\t";
-        print_type(target_reg.v, it2.value());
-        std::cout << "\n";
-    }
-    else {
-        CRAB_ERROR("Type of r", static_cast<int>(target_reg.v), " is not being stored");
-    }
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
 
+    std::cout << "  " << b << ";\n";
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
     int width = b.access.width;
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 228a4ae9d..a7665857e 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -19,16 +19,16 @@ enum class region {
 	T_SHARED
 };
 
-inline std::string get_region(const region& r) {
+inline std::string get_reg_ptr(const region& r) {
     switch (r) {
         case region::T_CTX:
-            return "ctx";
+            return "ctx_p";
         case region::T_STACK:
-            return "stack";
+            return "stack_p";
         case region::T_PACKET:
-            return "packet";
+            return "packet_p";
         default:
-            return "shared";
+            return "shared_p";
     }
 }
 
@@ -49,7 +49,7 @@ struct ptr_no_off_t {
     ptr_no_off_t(region _r) : r(_r) {}
 
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-        return o << "{" << get_region(p.r) << "}";
+        return o << get_reg_ptr(p.r);
     }
   
     // temporarily make operators friend functions in order to avoid duplicate symbol errors
@@ -75,7 +75,7 @@ struct ptr_with_off_t {
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
 
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-        o << "{" << get_region(p.r) << ", " << p.offset << "}";
+        o << get_reg_ptr(p.r) << "<" << p.offset << ">";
         return o;
     }
 
@@ -96,11 +96,10 @@ struct reg_with_loc_t {
     register_t r;
     std::pair<label_t, uint32_t> loc;
 
-    reg_with_loc_t() : r(11), loc(std::make_pair(label_t::entry, 0)) {}
     reg_with_loc_t(register_t _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
 
     bool operator==(const reg_with_loc_t& other) const {
-        return (r < 11 && r == other.r);
+        return (r == other.r && loc == other.loc);
     }
 
     std::size_t hash() const {
@@ -113,6 +112,11 @@ struct reg_with_loc_t {
 
         return seed;
     }
+
+    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
+        o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc.second << " in " << reg.loc.first;
+        return o;
+    }
 };
 }
 
@@ -169,7 +173,7 @@ class ctx_t {
 
         o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "_|_" : "") << "\n";
         for (const auto& it : _ctx.m_packet_ptrs) {
-            o << "\tstores at " << it.first << ": " << it.second << "\n";
+            o << "  stores at " << it.first << ": " << it.second << "\n";
         }
         return o;
     }
@@ -236,7 +240,7 @@ class stack_t {
     friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
 };
 
-using live_registers_t = std::array<reg_with_loc_t, 11>;
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
 using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
 class register_types_t {
@@ -257,8 +261,9 @@ class register_types_t {
         }
         live_registers_t out_vars;
         for (size_t i = 0; i < m_vars.size(); i++) {
-            auto it1 = find(m_vars[i]);
-            auto it2 = other.find(other.m_vars[i]);
+            if (m_vars[i] == nullptr) continue;
+            auto it1 = find(*(m_vars[i]));
+            auto it2 = other.find(*(other.m_vars[i]));
             if (it1 && it2 && it1.value() == it2.value()) {
                 out_vars[i] = m_vars[i];
             }
@@ -267,13 +272,20 @@ class register_types_t {
         return register_types_t(std::move(out_vars), m_all_types, false);
     }
 
+    void operator-=(register_t var) {
+        if (is_bottom()) {
+            return;
+        }
+        m_vars[var] = nullptr;
+    }
+
     void set_to_bottom() {
-        m_vars = live_registers_t{};
+        m_vars = live_registers_t{nullptr};
         m_is_bottom = true;
     }
 
     void set_to_top() {
-        m_vars = live_registers_t{};
+        m_vars = live_registers_t{nullptr};
         m_is_bottom = false;
     }
 
@@ -281,34 +293,34 @@ class register_types_t {
 
     bool is_top() const {
         if (m_is_bottom) { return false; }
-        return (m_all_types == nullptr || m_vars.empty());
+        if (m_all_types == nullptr) return true;
+        for (auto it : m_vars) {
+            if (it != nullptr) return false;
+        }
+        return true;
     }
 
     void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-        auto it = m_all_types->find(reg_with_loc);
-        if (it == m_all_types->end())
-            m_all_types->insert(std::make_pair(reg_with_loc, type));
-        else
-            it->second = type;
-        //auto it = m_all_types->insert(std::make_pair(reg_with_loc, type));
-        //if (not it.second) it.first->second = type;
-        m_vars[reg] = reg_with_loc;
+        (*m_all_types)[reg_with_loc] = type;
+        m_vars[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
     }
 
-    std::optional<ptr_t> find(const reg_with_loc_t& reg) const {
+    std::optional<ptr_t> find(reg_with_loc_t reg) const {
         auto it = m_all_types->find(reg);
         if (it == m_all_types->end()) return {};
         return it->second;
     }
 
     std::optional<ptr_t> find(register_t key) const {
-        auto reg = m_vars[key];
+        if (m_vars[key] == nullptr) return {};
+        const reg_with_loc_t& reg = *(m_vars[key]);
         return find(reg);
     }
 
     const live_registers_t &get_vars() { return m_vars; }
 
     friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
+
 };
 
 }
@@ -372,11 +384,24 @@ class type_domain_t final {
       m_label = bb.label();
       std::cout << m_label << ":\n";
       for (const Instruction& statement : bb) {
-        std::cout << "  " << statement << "\n";
         m_curr_pos++;
         std::visit(*this, statement);
     }
-    std::cout << "\n";
+    auto [it, et] = bb.next_blocks();
+    if (it != et) {
+        std::cout << "  "
+          << "goto ";
+        for (; it != et;) {
+            std::cout << *it;
+            ++it;
+            if (it == et) {
+                std::cout << ";";
+            } else {
+                std::cout << ",";
+            }
+        }
+    }
+    std::cout << "\n\n";
   }
   void write(std::ostream& os) const;
   std::string domain_name() const;
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 306bb8a00..c8c82ec8b 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -162,9 +162,7 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
     thread_local_options = *options;
 
     try {
-        s << "\nprinting the cfg ==============\n";
-        s << cfg;
-        s << "\n";
+
         abstract_domain_t entry_dom = make_initial(options);
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         auto [pre_invariants, post_invariants] =

From 2f5689919f36aa49f5ca0d97ed75838d50ba03ba Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 29 Mar 2022 20:52:35 -0400
Subject: [PATCH 083/373] Refactoring

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 251 ++++++++++++++++++++++++-
 src/crab/type_domain.hpp | 384 +++++++++------------------------------
 2 files changed, 331 insertions(+), 304 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 968081421..01f732157 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -17,6 +17,33 @@ using crab::register_types_t;
 
 static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
 
+
+namespace std {
+    template <>
+    struct std::hash<crab::reg_with_loc_t> {
+        std::size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    };
+
+    // does not seem to work for me
+    template <>
+    struct std::equal_to<crab::ptr_t> {
+        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
+            if (p1.index() != p2.index()) return false;
+            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
+                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
+                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
+                return (ptr_no_off1.r == ptr_no_off2.r);
+            }
+            else {
+                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
+                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
+                return (ptr_with_off1.r == ptr_with_off2.r && ptr_with_off1.offset == ptr_with_off2.offset);
+            }
+        }
+    };
+}
+
+
 void print_ptr_type(const ptr_t& p) {
     if (std::holds_alternative<ptr_with_off_t>(p)) {
         auto t = std::get<ptr_with_off_t>(p);
@@ -53,6 +80,69 @@ void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
 
 namespace crab {
 
+inline std::string get_reg_ptr(const region& r) {
+    switch (r) {
+        case region::T_CTX:
+            return "ctx_p";
+        case region::T_STACK:
+            return "stack_p";
+        case region::T_PACKET:
+            return "packet_p";
+        default:
+            return "shared_p";
+    }
+}
+
+inline std::ostream& operator<<(std::ostream& o, const region& t) {
+    o << static_cast<std::underlying_type<region>::type>(t);
+    return o;
+}
+
+bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return (p1.r == p2.r && p1.offset == p2.offset);
+}
+
+bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return !(p1 == p2);
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
+    o << get_reg_ptr(p.r) << "<" << p.offset << ">";
+    return o;
+}
+
+bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return (p1.r == p2.r);
+}
+
+bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return !(p1 == p2);
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
+    return o << get_reg_ptr(p.r);
+}
+
+std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
+    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc.second << " in " << reg.loc.first;
+    return o;
+}
+
+bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
+    return (r == other.r && loc == other.loc);
+}
+
+std::size_t reg_with_loc_t::hash() const {
+    // Similar to boost::hash_combine
+    using std::hash;
+
+    std::size_t seed = hash<register_t>()(r);
+    seed ^= hash<int>()(loc.first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(loc.second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+
+    return seed;
+}
+
 std::ostream& operator<<(std::ostream& o, const stack_t& st) {
     o << "Stack: ";
     if (st.is_bottom())
@@ -70,6 +160,30 @@ std::ostream& operator<<(std::ostream& o, const stack_t& st) {
     return o;
 }
 
+std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
+
+    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "_|_" : "") << "\n";
+    for (const auto& it : _ctx.m_packet_ptrs) {
+        o << "  stores at " << it.first << ": " << it.second << "\n";
+    }
+    return o;
+}
+
+ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
+{
+    if (desc->data != -1)
+        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->end != -1)
+        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
+}
+
+std::optional<ptr_no_off_t> ctx_t::find(int key) const {
+    auto it = m_packet_ptrs.find(key);
+    if (it == m_packet_ptrs.end()) return {};
+    return it->second;
+}
+
+
 std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
     if (typ.is_bottom())
         o << "_|_\n";
@@ -82,6 +196,116 @@ std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
     }
     return o;
 }
+
+register_types_t register_types_t::operator|(const register_types_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    live_registers_t out_vars;
+    for (size_t i = 0; i < m_vars.size(); i++) {
+        if (m_vars[i] == nullptr) continue;
+        auto it1 = find(*(m_vars[i]));
+        auto it2 = other.find(*(other.m_vars[i]));
+        if (it1 && it2 && it1.value() == it2.value()) {
+            out_vars[i] = m_vars[i];
+        }
+    }
+
+    return register_types_t(std::move(out_vars), m_all_types, false);
+}
+
+void register_types_t::operator-=(register_t var) {
+    if (is_bottom()) {
+        return;
+    }
+    m_vars[var] = nullptr;
+}
+
+void register_types_t::set_to_bottom() {
+    m_vars = live_registers_t{nullptr};
+    m_is_bottom = true;
+}
+
+void register_types_t::set_to_top() {
+    m_vars = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+bool register_types_t::is_bottom() const { return m_is_bottom; }
+
+bool register_types_t::is_top() const {
+    if (m_is_bottom) { return false; }
+    if (m_all_types == nullptr) return true;
+    for (auto it : m_vars) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
+    (*m_all_types)[reg_with_loc] = type;
+    m_vars[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
+    auto it = m_all_types->find(reg);
+    if (it == m_all_types->end()) return {};
+    return it->second;
+}
+
+std::optional<ptr_t> register_types_t::find(register_t key) const {
+    if (m_vars[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_vars[key]);
+    return find(reg);
+}
+
+stack_t stack_t::operator|(const stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    offset_to_ptr_t out_ptrs;
+    for (auto const&kv: m_ptrs) {
+        auto it = other.find(kv.first);
+        if (it && kv.second == it.value())
+            out_ptrs.insert(kv);
+    }
+    return stack_t(std::move(out_ptrs), false);
+}
+
+void stack_t::set_to_bottom() {
+    m_ptrs.clear();
+    m_is_bottom = true;
+}
+
+void stack_t::set_to_top() {
+    m_ptrs.clear();
+    m_is_bottom = false;
+}
+
+stack_t stack_t::bottom() { return stack_t(true); }
+
+stack_t stack_t::top() { return stack_t(false); }
+
+bool stack_t::is_bottom() const { return m_is_bottom; }
+
+bool stack_t::is_top() const {
+    if (m_is_bottom)
+        return false;
+    return m_ptrs.empty();
+}
+
+void stack_t::insert(int key, ptr_t value) { m_ptrs.insert(std::make_pair(key, value)); }
+
+std::optional<ptr_t> stack_t::find(int key) const {
+    auto it = m_ptrs.find(key);
+    if (it == m_ptrs.end()) return {};
+    return it->second;
+}
+
 }
 
 bool type_domain_t::is_bottom() const {
@@ -223,7 +447,7 @@ void print_info() {
     std::cout << "  shared_p = shared pointer\n";
     std::cout << "  stack_p<n> = stack pointer at offset n\n";
     std::cout << "  ctx_p<n> = context pointer at offset n\n";
-    std::cout << "  context = _|_ means context contains no elements stored\n\n";
+    std::cout << "  'context = _|_' means context contains no elements stored\n\n";
     std::cout << "**************************************************************\n\n";
 }
 
@@ -430,4 +654,29 @@ void type_domain_t::operator()(const Mem& b) {
     }
 }
 
+void type_domain_t::operator()(const basic_block_t& bb, bool check_termination) {
+    m_curr_pos = 0;
+    m_label = bb.label();
+    std::cout << m_label << ":\n";
+    for (const Instruction& statement : bb) {
+        m_curr_pos++;
+        std::visit(*this, statement);
+    }
+    auto [it, et] = bb.next_blocks();
+    if (it != et) {
+        std::cout << "  "
+        << "goto ";
+        for (; it != et;) {
+            std::cout << *it;
+            ++it;
+            if (it == et) {
+                std::cout << ";";
+            } else {
+                std::cout << ",";
+            }
+        }
+    }
+    std::cout << "\n\n";
+}
+
 void type_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index a7665857e..0c3c330e0 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -19,24 +19,6 @@ enum class region {
 	T_SHARED
 };
 
-inline std::string get_reg_ptr(const region& r) {
-    switch (r) {
-        case region::T_CTX:
-            return "ctx_p";
-        case region::T_STACK:
-            return "stack_p";
-        case region::T_PACKET:
-            return "packet_p";
-        default:
-            return "shared_p";
-    }
-}
-
-inline std::ostream& operator<<(std::ostream& o, const region& t) {
-    o << static_cast<std::underlying_type<region>::type>(t);
-    return o;
-}
-
 struct ptr_no_off_t {
     region r;
 
@@ -45,21 +27,11 @@ struct ptr_no_off_t {
     ptr_no_off_t(ptr_no_off_t &&) = default;
     ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
     ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-
     ptr_no_off_t(region _r) : r(_r) {}
 
-    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-        return o << get_reg_ptr(p.r);
-    }
-  
-    // temporarily make operators friend functions in order to avoid duplicate symbol errors
-    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-        return (p1.r == p2.r);
-    }
-
-    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-        return !(p1 == p2);
-    }
+    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
+    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2);
+    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2);
 };
 
 struct ptr_with_off_t {
@@ -71,22 +43,11 @@ struct ptr_with_off_t {
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-
     ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
 
-    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-        o << get_reg_ptr(p.r) << "<" << p.offset << ">";
-        return o;
-    }
-
-    // temporarily make operators friend functions in order to avoid duplicate symbol errors
-    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-        return (p1.r == p2.r && p1.offset == p2.offset);
-    }
-
-    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-        return !(p1 == p2);
-    }
+    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
+    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2);
+    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2);
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
@@ -97,57 +58,10 @@ struct reg_with_loc_t {
     std::pair<label_t, uint32_t> loc;
 
     reg_with_loc_t(register_t _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
-
-    bool operator==(const reg_with_loc_t& other) const {
-        return (r == other.r && loc == other.loc);
-    }
-
-    std::size_t hash() const {
-        // Similar to boost::hash_combine
-        using std::hash;
-
-        std::size_t seed = hash<register_t>()(r);
-        seed ^= hash<int>()(loc.first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-        seed ^= hash<int>()(loc.second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-
-        return seed;
-    }
-
-    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-        o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc.second << " in " << reg.loc.first;
-        return o;
-    }
+    bool operator==(const reg_with_loc_t& other) const;
+    std::size_t hash() const;
+    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
 };
-}
-
-
-namespace std {
-    template <>
-    struct std::hash<crab::reg_with_loc_t> {
-        std::size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
-    };
-
-    // does not seem to work for me
-    template <>
-    struct std::equal_to<crab::ptr_t> {
-        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
-            if (p1.index() != p2.index()) return false;
-            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
-                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
-                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
-                return (ptr_no_off1.r == ptr_no_off2.r);
-            }
-            else {
-                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
-                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
-                return (ptr_with_off1.r == ptr_with_off2.r && ptr_with_off1.offset == ptr_with_off2.offset);
-            }
-        }
-    };
-}
-
-
-namespace crab {
 
 class ctx_t {
     using offset_to_ptr_no_off_t = std::unordered_map<int, ptr_no_off_t>;
@@ -155,28 +69,9 @@ class ctx_t {
     offset_to_ptr_no_off_t m_packet_ptrs;
 
   public:
-    ctx_t(const ebpf_context_descriptor_t* desc)
-    {
-        if (desc->data != -1)
-            m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
-        if (desc->end != -1)
-            m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
-    }
-
-    std::optional<ptr_no_off_t> find(int key) const {
-        auto it = m_packet_ptrs.find(key);
-        if (it == m_packet_ptrs.end()) return {};
-        return it->second;
-    }
-
-    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
-
-        o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "_|_" : "") << "\n";
-        for (const auto& it : _ctx.m_packet_ptrs) {
-            o << "  stores at " << it.first << ": " << it.second << "\n";
-        }
-        return o;
-    }
+    ctx_t(const ebpf_context_descriptor_t* desc);
+    std::optional<ptr_no_off_t> find(int key) const;
+    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx);
 };
 
 class stack_t {
@@ -190,53 +85,16 @@ class stack_t {
     stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
     : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
     
-    stack_t operator|(const stack_t& other) const {
-        if (is_bottom() || other.is_top()) {
-            return other;
-        } else if (other.is_bottom() || is_top()) {
-            return *this;
-        }
-        offset_to_ptr_t out_ptrs;
-        for (auto const&kv: m_ptrs) {
-            auto it = other.find(kv.first);
-            if (it && kv.second == it.value())
-                out_ptrs.insert(kv);
-        }
-        return stack_t(std::move(out_ptrs), false);
-    }
-
-    void set_to_bottom() {
-        m_ptrs.clear();
-        m_is_bottom = true;
-    }
-
-    void set_to_top() {
-        m_ptrs.clear();
-        m_is_bottom = false;
-    }
-
-    static stack_t bottom() { return stack_t(true); }
-
-    static stack_t top() { return stack_t(false); }
-
-    bool is_bottom() const { return m_is_bottom; }
-
-    bool is_top() const {
-        if (m_is_bottom)
-            return false;
-        return m_ptrs.empty();
-    }
-
+    stack_t operator|(const stack_t& other) const;
+    void set_to_bottom();
+    void set_to_top();
+    static stack_t bottom();
+    static stack_t top();
+    bool is_bottom() const;
+    bool is_top() const;
     const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
-
-    void insert(int key, ptr_t value) { m_ptrs.insert(std::make_pair(key, value)); }
-
-    std::optional<ptr_t> find(int key) const {
-        auto it = m_ptrs.find(key);
-        if (it == m_ptrs.end()) return {};
-        return it->second;
-    }
-
+    void insert(int key, ptr_t value);
+    std::optional<ptr_t> find(int key) const;
     friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
 };
 
@@ -253,74 +111,17 @@ class register_types_t {
     explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> all_types, bool is_bottom = false)
         : m_vars(std::move(vars)), m_all_types(all_types), m_is_bottom(is_bottom) {}
 
-    register_types_t operator|(const register_types_t& other) const {
-        if (is_bottom() || other.is_top()) {
-            return other;
-        } else if (other.is_bottom() || is_top()) {
-            return *this;
-        }
-        live_registers_t out_vars;
-        for (size_t i = 0; i < m_vars.size(); i++) {
-            if (m_vars[i] == nullptr) continue;
-            auto it1 = find(*(m_vars[i]));
-            auto it2 = other.find(*(other.m_vars[i]));
-            if (it1 && it2 && it1.value() == it2.value()) {
-                out_vars[i] = m_vars[i];
-            }
-        }
-
-        return register_types_t(std::move(out_vars), m_all_types, false);
-    }
-
-    void operator-=(register_t var) {
-        if (is_bottom()) {
-            return;
-        }
-        m_vars[var] = nullptr;
-    }
-
-    void set_to_bottom() {
-        m_vars = live_registers_t{nullptr};
-        m_is_bottom = true;
-    }
-
-    void set_to_top() {
-        m_vars = live_registers_t{nullptr};
-        m_is_bottom = false;
-    }
-
-    bool is_bottom() const { return m_is_bottom; }
-
-    bool is_top() const {
-        if (m_is_bottom) { return false; }
-        if (m_all_types == nullptr) return true;
-        for (auto it : m_vars) {
-            if (it != nullptr) return false;
-        }
-        return true;
-    }
-
-    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-        (*m_all_types)[reg_with_loc] = type;
-        m_vars[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
-    }
-
-    std::optional<ptr_t> find(reg_with_loc_t reg) const {
-        auto it = m_all_types->find(reg);
-        if (it == m_all_types->end()) return {};
-        return it->second;
-    }
-
-    std::optional<ptr_t> find(register_t key) const {
-        if (m_vars[key] == nullptr) return {};
-        const reg_with_loc_t& reg = *(m_vars[key]);
-        return find(reg);
-    }
-
+    register_types_t operator|(const register_types_t& other) const;
+    void operator-=(register_t var);
+    void set_to_bottom();
+    void set_to_top();
+    bool is_bottom() const;
+    bool is_top() const;
+    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type);
+    std::optional<ptr_t> find(reg_with_loc_t reg) const;
+    std::optional<ptr_t> find(register_t key) const;
     const live_registers_t &get_vars() { return m_vars; }
-
     friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
-
 };
 
 }
@@ -335,83 +136,60 @@ class type_domain_t final {
 
   public:
 
-  type_domain_t() : m_label(label_t::entry) {}
-  type_domain_t(type_domain_t&& o) = default;
-  type_domain_t(const type_domain_t& o) = default;
-  type_domain_t& operator=(type_domain_t&& o) = default;
-  type_domain_t& operator=(const type_domain_t& o) = default;
-  type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
+    type_domain_t() : m_label(label_t::entry) {}
+    type_domain_t(type_domain_t&& o) = default;
+    type_domain_t(const type_domain_t& o) = default;
+    type_domain_t& operator=(type_domain_t&& o) = default;
+    type_domain_t& operator=(const type_domain_t& o) = default;
+    type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
             : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx), m_label(_l) {}
-  // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-  static type_domain_t setup_entry();
-  // bottom/top
-  static type_domain_t bottom();
-  void set_to_top();
-  void set_to_bottom();
-  bool is_bottom() const;
-  bool is_top() const;
-  // inclusion
-  bool operator<=(const type_domain_t& other) const;
-  // join
-  void operator|=(const type_domain_t& abs);
-  void operator|=(type_domain_t&& abs);
-  type_domain_t operator|(const type_domain_t& other) const;
-  type_domain_t operator|(type_domain_t&& abs) const;
-  // meet
-  type_domain_t operator&(const type_domain_t& other) const;
-  // widening
-  type_domain_t widen(const type_domain_t& other) const;
-  // narrowing
-  type_domain_t narrow(const type_domain_t& other) const;
-  //forget
-  void operator-=(variable_t var);
-
-  //// abstract transformers
-  void operator()(const Undefined &);
-  void operator()(const Bin &);
-  void operator()(const Un &) ;
-  void operator()(const LoadMapFd &);
-  void operator()(const Call &);
-  void operator()(const Exit &);
-  void operator()(const Jmp &);
-  void operator()(const Mem &);
-  void operator()(const Packet &);
-  void operator()(const LockAdd &);
-  void operator()(const Assume &);
-  void operator()(const Assert &);
-  void operator()(const basic_block_t& bb, bool check_termination) {
-      m_curr_pos = 0;
-      m_label = bb.label();
-      std::cout << m_label << ":\n";
-      for (const Instruction& statement : bb) {
-        m_curr_pos++;
-        std::visit(*this, statement);
-    }
-    auto [it, et] = bb.next_blocks();
-    if (it != et) {
-        std::cout << "  "
-          << "goto ";
-        for (; it != et;) {
-            std::cout << *it;
-            ++it;
-            if (it == et) {
-                std::cout << ";";
-            } else {
-                std::cout << ",";
-            }
-        }
-    }
-    std::cout << "\n\n";
-  }
-  void write(std::ostream& os) const;
-  std::string domain_name() const;
-  int get_instruction_count_upper_bound();
-  string_invariant to_set();
-  void set_require_check(check_require_func_t f);
+    // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+    static type_domain_t setup_entry();
+    // bottom/top
+    static type_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const type_domain_t& other) const;
+    // join
+    void operator|=(const type_domain_t& abs);
+    void operator|=(type_domain_t&& abs);
+    type_domain_t operator|(const type_domain_t& other) const;
+    type_domain_t operator|(type_domain_t&& abs) const;
+    // meet
+    type_domain_t operator&(const type_domain_t& other) const;
+    // widening
+    type_domain_t widen(const type_domain_t& other) const;
+    // narrowing
+    type_domain_t narrow(const type_domain_t& other) const;
+    //forget
+    void operator-=(variable_t var);
+
+    //// abstract transformers
+    void operator()(const Undefined &);
+    void operator()(const Bin &);
+    void operator()(const Un &) ;
+    void operator()(const LoadMapFd &);
+    void operator()(const Call &);
+    void operator()(const Exit &);
+    void operator()(const Jmp &);
+    void operator()(const Mem &);
+    void operator()(const Packet &);
+    void operator()(const LockAdd &);
+    void operator()(const Assume &);
+    void operator()(const Assert &);
+    void operator()(const basic_block_t& bb, bool check_termination);
+    void write(std::ostream& os) const;
+    std::string domain_name() const;
+    int get_instruction_count_upper_bound();
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
 
   private:
 
-  void do_load(const Mem&, const Reg&);
-  void do_mem_store(const Mem&, const Reg&);
+    void do_load(const Mem&, const Reg&);
+    void do_mem_store(const Mem&, const Reg&);
 
 }; // end type_domain_t

From 2e3bf4456a914b40f5bdd5a757dc2629cb888298 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 29 Mar 2022 21:22:15 -0400
Subject: [PATCH 084/373] Fixing automatic builds on Github Actions

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 01f732157..e20a9ef44 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -20,13 +20,13 @@ static std::string size(int w) { return std::string("u") + std::to_string(w * 8)
 
 namespace std {
     template <>
-    struct std::hash<crab::reg_with_loc_t> {
-        std::size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    struct hash<crab::reg_with_loc_t> {
+        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
     };
 
     // does not seem to work for me
     template <>
-    struct std::equal_to<crab::ptr_t> {
+    struct equal_to<crab::ptr_t> {
         constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
             if (p1.index() != p2.index()) return false;
             if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {

From f153d64a853b7f613d2b5775dd250487d776c5db Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 3 Jul 2023 20:13:19 -0400
Subject: [PATCH 085/373] Changes needed in current type domain due to latest
 prevail version upgrade

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 6 +++---
 src/crab/type_domain.hpp | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index e20a9ef44..953d289c9 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -389,8 +389,8 @@ std::string type_domain_t::domain_name() const {
     return "type_domain";
 }
 
-int type_domain_t::get_instruction_count_upper_bound() {
-    return 0;
+crab::bound_t type_domain_t::get_instruction_count_upper_bound() {
+    return crab::bound_t(crab::number_t(0));
 }
 
 string_invariant type_domain_t::to_set() {
@@ -455,7 +455,7 @@ type_domain_t type_domain_t::setup_entry() {
 
     print_info();
 
-    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.type.context_descriptor);
+    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
     std::cout << *ctx << "\n";
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 0c3c330e0..850cdd197 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -165,7 +165,7 @@ class type_domain_t final {
     // narrowing
     type_domain_t narrow(const type_domain_t& other) const;
     //forget
-    void operator-=(variable_t var);
+    void operator-=(crab::variable_t var);
 
     //// abstract transformers
     void operator()(const Undefined &);
@@ -183,7 +183,7 @@ class type_domain_t final {
     void operator()(const basic_block_t& bb, bool check_termination);
     void write(std::ostream& os) const;
     std::string domain_name() const;
-    int get_instruction_count_upper_bound();
+    crab::bound_t get_instruction_count_upper_bound();
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 

From 4bb4c20412f7ca8de6fd7287980a4ae5c5ad439a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 29 Mar 2022 22:11:39 -0400
Subject: [PATCH 086/373] minor printing fix

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 953d289c9..7c7ce26f2 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -497,6 +497,7 @@ void type_domain_t::operator()(const Bin& bin) {
             case Bin::Op::MOV: {
                 auto it = m_types.find(src.v);
                 if (!it) {
+                    std::cout << "  " << bin << "\n";
                     CRAB_ERROR("type error: assigning an unknown pointer or a number - r", (int)src.v);
                 }
 

From f460cafaf86c93112837645cb0f0a2e806d82a66 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Wed, 30 Mar 2022 19:11:41 -0400
Subject: [PATCH 087/373] Removed the type errors that are too restrictive;
 Forgetting the offset into stack when we cannot reason about it

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 125 ++++++++++++++++++++++++---------------
 src/crab/type_domain.hpp |   1 +
 2 files changed, 79 insertions(+), 47 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7c7ce26f2..9cc50a56a 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -149,11 +149,10 @@ std::ostream& operator<<(std::ostream& o, const stack_t& st) {
         o << "_|_\n";
     else {
         o << "{";
-        for (auto it = st.m_ptrs.begin(); it != st.m_ptrs.end(); it++) {
-            auto s = *it;
+        for (auto s : st.m_ptrs) {
             o << s.first << ": ";
             print_ptr_type(s.second);
-            if (++it != st.m_ptrs.end()) o << ",";
+            o << ", ";
         }
         o << "}";
     }
@@ -205,7 +204,7 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     }
     live_registers_t out_vars;
     for (size_t i = 0; i < m_vars.size(); i++) {
-        if (m_vars[i] == nullptr) continue;
+        if (m_vars[i] == nullptr || other.m_vars[i] == nullptr) continue;
         auto it1 = find(*(m_vars[i]));
         auto it2 = other.find(*(other.m_vars[i]));
         if (it1 && it2 && it1.value() == it2.value()) {
@@ -276,6 +275,12 @@ stack_t stack_t::operator|(const stack_t& other) const {
     return stack_t(std::move(out_ptrs), false);
 }
 
+void stack_t::operator-=(int key) {
+    auto it = find(key);
+    if (it)
+        m_ptrs.erase(key);
+}
+
 void stack_t::set_to_bottom() {
     m_ptrs.clear();
     m_is_bottom = true;
@@ -298,7 +303,9 @@ bool stack_t::is_top() const {
     return m_ptrs.empty();
 }
 
-void stack_t::insert(int key, ptr_t value) { m_ptrs.insert(std::make_pair(key, value)); }
+void stack_t::insert(int key, ptr_t value) {
+    m_ptrs[key] = value;
+}
 
 std::optional<ptr_t> stack_t::find(int key) const {
     auto it = m_ptrs.find(key);
@@ -381,7 +388,7 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
 }
 
 void type_domain_t::write(std::ostream& os) const { 
-    os << m_types;
+    //os << m_types;
     os << m_stack << "\n";
 }
 
@@ -453,7 +460,7 @@ void print_info() {
 
 type_domain_t type_domain_t::setup_entry() {
 
-    print_info();
+    //print_info();
 
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
@@ -469,6 +476,8 @@ type_domain_t type_domain_t::setup_entry() {
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
+    std::cout << "is types bottom in the start: " << typ.is_bottom() << "\n";
+
     std::cout << "Initial register types:\n";
     auto it = typ.find(R1_ARG);
     if (it) {
@@ -497,8 +506,10 @@ void type_domain_t::operator()(const Bin& bin) {
             case Bin::Op::MOV: {
                 auto it = m_types.find(src.v);
                 if (!it) {
-                    std::cout << "  " << bin << "\n";
-                    CRAB_ERROR("type error: assigning an unknown pointer or a number - r", (int)src.v);
+                    //std::cout << "  " << bin << "\n";
+                    //CRAB_ERROR("type error: assigning an unknown pointer or a number - r", (int)src.v);
+                    m_types -= bin.dst.v;
+                    break;
                 }
 
                 auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
@@ -531,7 +542,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
         std::cout << "  " << b << "\n";
-        CRAB_ERROR("type_error: loading from either packet or shared region not allowed - r", (int)basereg.v);
+        //CRAB_ERROR("type_error: loading from either packet or shared region not allowed - r", (int)basereg.v);
+        m_types -= target_reg.v;
+        return;
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
@@ -544,7 +557,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (!it) {
                 std::cout << "  " << b << "\n";
-                CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
+                //CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
+                m_types -= target_reg.v;
+                return;
             }
             ptr_t type_loaded = it.value();
 
@@ -569,7 +584,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (!it) {
                 std::cout << "  " << b << "\n";
-                CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
+                //CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
+                m_types -= target_reg.v;
+                return;
             }
             ptr_no_off_t type_loaded = it.value();
 
@@ -599,46 +616,60 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     ptr_t type_basereg = it.value();
 
     auto it2 = m_types.find(target_reg.v);
-    if (!it2) {
-        CRAB_ERROR("type_error: storing either a number or an unknown pointer - r", (int)target_reg.v);
-    }
-    ptr_t type_stored = it2.value();
 
-    if (std::holds_alternative<ptr_with_off_t>(type_stored)) {
-        ptr_with_off_t type_stored_with_off = std::get<ptr_with_off_t>(type_stored);
-        if (type_stored_with_off.r == crab::region::T_STACK) {
-            CRAB_ERROR("type_error: we cannot store stack pointer, r", (int)target_reg.v, ", into stack");
-        }
-    }
-
-    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into packet or shared");
-    }
-
-    ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
-    if (type_basereg_with_off.r == crab::region::T_CTX) {
-        CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into ctx");
-    }
-
-    int store_at = offset+type_basereg_with_off.offset;
-
-    for (auto i = store_at; i < store_at+width; i++) {
-        auto it = m_stack.find(i);
-        if (it) {
-            CRAB_ERROR("type_error: type being stored into stack at ", store_at, " is overlapping with already stored\
-            at", i);
+    if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
+        // we know base register is either CTX_P or STACK_P
+        ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
+
+        int store_at = offset+type_basereg_with_off.offset;
+        if (type_basereg_with_off.r == crab::region::T_STACK) {
+            // type of basereg is STACK_P
+            if (!it2) {
+                //CRAB_ERROR("type_error: storing either a number or an unknown pointer - r", (int)target_reg.v);
+                m_stack -= store_at;
+                return;
+            }
+            else {
+                auto type_to_store = it2.value();
+                if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
+                        std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
+                    CRAB_ERROR("type_error: we cannot store stack pointer, r", (int)target_reg.v, ", into stack");
+                }
+                else {
+                    for (auto i = store_at; i < store_at+width; i++) {
+                        auto it3 = m_stack.find(i);
+                        if (it3) {
+                            CRAB_ERROR("type_error: type being stored into stack at ", store_at, " is overlapping with already stored\
+                            at", i);
+                        }
+                    }
+                    auto it4 = m_stack.find(store_at);
+                    if (it4) {
+                        auto type_in_stack = it4.value();
+                        if (type_to_store != type_in_stack) {
+                            CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
+                        }
+                    }
+                    else {
+                        m_stack.insert(store_at, type_to_store);
+                    }
+                }
+            }
         }
-    }
-
-    auto it3 = m_stack.find(store_at);
-    if (it3) {
-        auto type_in_stack = it3.value();
-        if (type_stored != type_in_stack) {
-            CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
+        else if (type_basereg_with_off.r == crab::region::T_CTX) {
+            // type of basereg is CTX_P
+            if (it2) {
+                CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into ctx");
+            }
         }
+        else
+            assert(false);
     }
     else {
-        m_stack.insert(store_at, type_stored);
+        // base register type is either PACKET_P or SHARED_P
+        if (it2) {
+            CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into packet or shared");
+        }
     }
 }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 850cdd197..22bd0e30b 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -86,6 +86,7 @@ class stack_t {
     : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
     
     stack_t operator|(const stack_t& other) const;
+    void operator-=(int);
     void set_to_bottom();
     void set_to_top();
     static stack_t bottom();

From e5ad362610aefdeddcd521f55a77a8087086c2e6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 31 Mar 2024 16:17:23 -0400
Subject: [PATCH 088/373] Removed dependency to keep bb label and instruction
 count in type domain state

Also, multiple changes to ebpf_domain_t, type_domain_t, and
abstract_domain_t, as we are currently rebasing the type domain to
latest PREVAIL, and a lot of changes happened in PREVAIL since old
version;

 Author:    Ameer Hamza <ah18r@my.fsu.edu>
 Date:      Thu Mar 31 07:47:48 2022 -0400
---
 src/crab/abstract_domain.cpp |  66 +++++++++++-----------
 src/crab/abstract_domain.hpp |  74 ++++++++++++------------
 src/crab/ebpf_domain.cpp     |  46 +++++++--------
 src/crab/ebpf_domain.hpp     |  47 ++++++++--------
 src/crab/type_domain.cpp     | 105 +++++++++++++++++++----------------
 src/crab/type_domain.hpp     |  51 ++++++++---------
 6 files changed, 200 insertions(+), 189 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index ed580787d..f89cd5576 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -110,58 +110,58 @@ void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_bl
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s) {
-    m_abs_val.operator()(s);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
@@ -245,27 +245,27 @@ void abstract_domain_t::operator()(const basic_block_t& bb) {
     m_concept->operator()(bb);
 }
 
-void abstract_domain_t::operator()(const Undefined& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Undefined& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Bin& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Bin& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Un& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Un& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const LoadMapFd& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Call& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Call& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Exit& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Exit& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Jmp& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Jmp& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Mem& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Mem& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Packet& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Packet& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Assume& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Assume& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Assert& s) { m_concept->operator()(s); }
+void abstract_domain_t::operator()(const Assert& s, location_t loc) { m_concept->operator()(s, loc); }
 
 void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
 
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index ae03cb2a1..c3f8a43e5 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -1,11 +1,13 @@
 #pragma once
 
+#include <boost/optional/optional.hpp>
 #include "cfg.hpp"
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
 
 #include "array_domain.hpp"
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
+using location_t = boost::optional<std::pair<label_t, uint32_t>>;
 class abstract_domain_t {
   private:
     class abstract_domain_concept {
@@ -30,18 +32,18 @@ class abstract_domain_t {
         virtual std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) = 0;
         virtual std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const = 0;
         virtual void operator()(const basic_block_t&) = 0;
-        virtual void operator()(const Undefined&) = 0;
-        virtual void operator()(const Bin&) = 0;
-        virtual void operator()(const Un&) = 0;
-        virtual void operator()(const LoadMapFd&) = 0;
-        virtual void operator()(const Call&) = 0;
-        virtual void operator()(const Exit&) = 0;
-        virtual void operator()(const Jmp&) = 0;
-        virtual void operator()(const Mem&) = 0;
-        virtual void operator()(const Packet&) = 0;
-        virtual void operator()(const Assume&) = 0;
-        virtual void operator()(const Assert&) = 0;
-        virtual void write(std::ostream& o) const = 0;
+        virtual void operator()(const Undefined&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Bin&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Un&, location_t loc = boost::none) = 0;
+        virtual void operator()(const LoadMapFd&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Call&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Exit&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Jmp&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Mem&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Packet&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Assume&, location_t loc = boost::none) = 0;
+        virtual void operator()(const Assert&, location_t loc = boost::none) = 0;
+        virtual void write(std::ostream& os) const = 0;
 
         /* These operations are not very conventional for an abstract
            domain but it's convenient to have them */
@@ -72,18 +74,18 @@ class abstract_domain_t {
         std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
         std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
         void operator()(const basic_block_t& bb) override;
-        void operator()(const Undefined& s) override;
-        void operator()(const Bin& s) override;
-        void operator()(const Un& s) override;
-        void operator()(const LoadMapFd& s) override;
-        void operator()(const Call& s) override;
-        void operator()(const Exit& s) override;
-        void operator()(const Jmp& s) override;
-        void operator()(const Mem& s) override;
-        void operator()(const Packet& s) override;
-        void operator()(const Assume& s) override;
-        void operator()(const Assert& s) override;
-        void write(std::ostream& o) const override;
+        void operator()(const Undefined& s, location_t loc = boost::none) override;
+        void operator()(const Bin& s, location_t loc = boost::none) override;
+        void operator()(const Un& s, location_t loc = boost::none) override;
+        void operator()(const LoadMapFd& s, location_t loc = boost::none) override;
+        void operator()(const Call& s, location_t loc = boost::none) override;
+        void operator()(const Exit& s, location_t loc = boost::none) override;
+        void operator()(const Jmp& s, location_t loc = boost::none) override;
+        void operator()(const Mem& s, location_t loc = boost::none) override;
+        void operator()(const Packet& s, location_t loc = boost::none) override;
+        void operator()(const Assume& s, location_t loc = boost::none) override;
+        void operator()(const Assert& s, location_t loc = boost::none) override;
+        void write(std::ostream& os) const override;
         void initialize_loop_counter(const label_t) override;
         crab::bound_t get_loop_count_upper_bound() override;
         string_invariant to_set() override;
@@ -114,18 +116,18 @@ class abstract_domain_t {
     abstract_domain_t widen(const abstract_domain_t& abs, bool);
     abstract_domain_t narrow(const abstract_domain_t& abs) const;
     void operator()(const basic_block_t& bb);
-    void operator()(const Undefined& s);
-    void operator()(const Bin& s);
-    void operator()(const Un& s);
-    void operator()(const LoadMapFd& s);
-    void operator()(const Call& s);
-    void operator()(const Exit& s);
-    void operator()(const Jmp& s);
-    void operator()(const Mem& s);
-    void operator()(const Packet& s);
-    void operator()(const Assume& s);
-    void operator()(const Assert& s);
-    void write(std::ostream& o) const;
+    void operator()(const Undefined& s, location_t loc = boost::none);
+    void operator()(const Bin& s, location_t loc = boost::none);
+    void operator()(const Un& s, location_t loc = boost::none);
+    void operator()(const LoadMapFd& s, location_t loc = boost::none);
+    void operator()(const Call& s, location_t loc = boost::none);
+    void operator()(const Exit& s, location_t loc = boost::none);
+    void operator()(const Jmp& s, location_t loc = boost::none);
+    void operator()(const Mem& s, location_t loc = boost::none);
+    void operator()(const Packet& s, location_t loc = boost::none);
+    void operator()(const Assume& s, location_t loc = boost::none);
+    void operator()(const Assert& s, location_t loc = boost::none);
+    void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t);
     string_invariant to_set();
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 9fb6d0811..822961689 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1417,7 +1417,7 @@ void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expressi
     require(inv, ub <= region_size, std::string("Upper bound must be at most ") + region_size.name());
 }
 
-void ebpf_domain_t::operator()(const Assume& s) {
+void ebpf_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     auto dst = reg_pack(cond.left);
     if (std::holds_alternative<Reg>(cond.right)) {
@@ -1450,9 +1450,9 @@ void ebpf_domain_t::operator()(const Assume& s) {
     }
 }
 
-void ebpf_domain_t::operator()(const Undefined& a) {}
+void ebpf_domain_t::operator()(const Undefined& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Un& stmt) {
+void ebpf_domain_t::operator()(const Un& stmt, location_t loc) {
     auto dst = reg_pack(stmt.dst);
     auto swap_endianness = [&](variable_t v, auto input, const auto& be_or_le) {
         if (m_inv.entail(type_is_number(stmt.dst))) {
@@ -1516,11 +1516,11 @@ void ebpf_domain_t::operator()(const Un& stmt) {
     }
 }
 
-void ebpf_domain_t::operator()(const Exit& a) {}
+void ebpf_domain_t::operator()(const Exit& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Jmp& a) {}
+void ebpf_domain_t::operator()(const Jmp& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Comparable& s) {
+void ebpf_domain_t::operator()(const Comparable& s, location_t loc) {
     using namespace crab::dsl_syntax;
     if (type_inv.same_type(m_inv, s.r1, s.r2)) {
         // Same type. If both are numbers, that's okay. Otherwise:
@@ -1541,12 +1541,12 @@ void ebpf_domain_t::operator()(const Comparable& s) {
     };
 }
 
-void ebpf_domain_t::operator()(const Addable& s) {
+void ebpf_domain_t::operator()(const Addable& s, location_t loc) {
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be added to pointers");
 }
 
-void ebpf_domain_t::operator()(const ValidDivisor& s) {
+void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg)))
@@ -1557,12 +1557,12 @@ void ebpf_domain_t::operator()(const ValidDivisor& s) {
     }
 }
 
-void ebpf_domain_t::operator()(const ValidStore& s) {
+void ebpf_domain_t::operator()(const ValidStore& s, location_t loc) {
     if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be stored to externally-visible regions");
 }
 
-void ebpf_domain_t::operator()(const TypeConstraint& s) {
+void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     if (!type_inv.is_in_group(m_inv, s.reg, s.types))
         require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
 }
@@ -1589,7 +1589,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
     require(m_inv, linear_constraint_t::FALSE(), "callx helper function id is not a valid singleton");
 }
 
-void ebpf_domain_t::operator()(const ValidSize& s) {
+void ebpf_domain_t::operator()(const ValidSize& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto r = reg_pack(s.reg);
     require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "Invalid size");
@@ -1698,7 +1698,7 @@ crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const
     return result;
 }
 
-void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
+void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc) {
     using namespace crab::dsl_syntax;
 
     auto fd_type = get_map_type(s.map_fd_reg);
@@ -1764,7 +1764,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
     });
 }
 
-void ebpf_domain_t::operator()(const ValidAccess& s) {
+void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc) {
     using namespace crab::dsl_syntax;
 
     bool is_comparison_check = s.width == (Value)Imm{0};
@@ -1850,13 +1850,13 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
     });
 }
 
-void ebpf_domain_t::operator()(const ZeroCtxOffset& s) {
+void ebpf_domain_t::operator()(const ZeroCtxOffset& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     require(m_inv, reg.ctx_offset == 0, "Nonzero context offset");
 }
 
-void ebpf_domain_t::operator()(const Assert& stmt) {
+void ebpf_domain_t::operator()(const Assert& stmt, location_t loc) {
     if (check_require || thread_local_options.assume_assertions) {
         this->current_assertion = to_string(stmt.cst);
         std::visit(*this, stmt.cst);
@@ -1864,7 +1864,7 @@ void ebpf_domain_t::operator()(const Assert& stmt) {
     }
 }
 
-void ebpf_domain_t::operator()(const Packet& a) {
+void ebpf_domain_t::operator()(const Packet& a, location_t loc) {
     auto reg = reg_pack(R0_RETURN_VALUE);
     Reg r0_reg{(uint8_t)R0_RETURN_VALUE};
     type_inv.assign_type(m_inv, r0_reg, T_NUM);
@@ -2119,7 +2119,7 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
     }
 }
 
-void ebpf_domain_t::operator()(const Mem& b) {
+void ebpf_domain_t::operator()(const Mem& b, location_t loc) {
     if (m_inv.is_bottom())
         return;
     if (std::holds_alternative<Reg>(b.value)) {
@@ -2175,7 +2175,7 @@ static Bin atomic_to_bin(const Atomic& a) {
     return bin;
 }
 
-void ebpf_domain_t::operator()(const Atomic& a) {
+void ebpf_domain_t::operator()(const Atomic& a, location_t loc) {
     if (m_inv.is_bottom())
         return;
     if (!m_inv.entail(type_is_pointer(reg_pack(a.access.basereg))) ||
@@ -2224,7 +2224,7 @@ void ebpf_domain_t::operator()(const Atomic& a) {
     type_inv.havoc_type(m_inv, r11);
 }
 
-void ebpf_domain_t::operator()(const Call& call) {
+void ebpf_domain_t::operator()(const Call& call, location_t loc) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2321,7 +2321,7 @@ void ebpf_domain_t::operator()(const Call& call) {
     }
 }
 
-void ebpf_domain_t::operator()(const Callx& callx) {
+void ebpf_domain_t::operator()(const Callx& callx, location_t loc) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2356,7 +2356,7 @@ void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null
     assign_valid_ptr(dst_reg, maybe_null);
 }
 
-void ebpf_domain_t::operator()(const LoadMapFd& ins) { do_load_mapfd(ins.dst, ins.mapfd, false); }
+void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc) { do_load_mapfd(ins.dst, ins.mapfd, false); }
 
 void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
     using namespace crab::dsl_syntax;
@@ -2578,7 +2578,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
     havoc_offsets(dst_reg);
 }
 
-void ebpf_domain_t::operator()(const Bin& bin) {
+void ebpf_domain_t::operator()(const Bin& bin, location_t loc) {
     using namespace crab::dsl_syntax;
 
     auto dst = reg_pack(bin.dst);
@@ -3010,7 +3010,7 @@ bound_t ebpf_domain_t::get_loop_count_upper_bound() {
     return ub;
 }
 
-void ebpf_domain_t::operator()(const IncrementLoopCounter& ins) {
+void ebpf_domain_t::operator()(const IncrementLoopCounter& ins, location_t loc) {
     this->add(variable_t::loop_counter(to_string(ins.name)), 1);
 }
 } // namespace crab
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 92b683d1c..b3147f395 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -23,6 +23,7 @@ struct reg_pack_t;
 class ebpf_domain_t final {
     struct TypeDomain;
 
+  using location_t = boost::optional<std::pair<label_t, uint32_t>>;
   public:
     ebpf_domain_t();
     ebpf_domain_t(crab::domains::NumAbsDomain inv, crab::domains::array_domain_t stack);
@@ -56,30 +57,30 @@ class ebpf_domain_t final {
     // abstract transformers
     void operator()(const basic_block_t& bb);
 
-    void operator()(const Addable&);
-    void operator()(const Assert&);
-    void operator()(const Assume&);
-    void operator()(const Bin&);
-    void operator()(const Call&);
-    void operator()(const Callx&);
-    void operator()(const Comparable&);
-    void operator()(const Exit&);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
     void operator()(const FuncConstraint&);
-    void operator()(const Jmp&);
-    void operator()(const LoadMapFd&);
-    void operator()(const Atomic&);
-    void operator()(const Mem&);
-    void operator()(const ValidDivisor&);
-    void operator()(const Packet&);
-    void operator()(const TypeConstraint&);
-    void operator()(const Un&);
-    void operator()(const Undefined&);
-    void operator()(const ValidAccess&);
-    void operator()(const ValidMapKeyValue&);
-    void operator()(const ValidSize&);
-    void operator()(const ValidStore&);
-    void operator()(const ZeroCtxOffset&);
-    void operator()(const IncrementLoopCounter&);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const ValidDivisor&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
 
     // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
     void write(std::ostream& o) const;
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 9cc50a56a..3cf26f3a2 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -124,7 +124,7 @@ std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
 }
 
 std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc.second << " in " << reg.loc.first;
+    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc->second << " in " << reg.loc->first;
     return o;
 }
 
@@ -137,8 +137,9 @@ std::size_t reg_with_loc_t::hash() const {
     using std::hash;
 
     std::size_t seed = hash<register_t>()(r);
-    seed ^= hash<int>()(loc.first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(loc.second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
 
     return seed;
 }
@@ -342,6 +343,12 @@ bool type_domain_t::operator<=(const type_domain_t& abs) const {
     return true;
 }
 
+type_domain_t type_domain_t::widen(const type_domain_t& other, bool to_constants) {
+    // WARNING: Not implemented yet
+    type_domain_t res{m_types | other.m_types, m_stack | other.m_stack, other.m_ctx};
+    return res;
+}
+
 void type_domain_t::operator|=(const type_domain_t& abs) {
     type_domain_t tmp{abs};
     operator|=(std::move(tmp));
@@ -362,7 +369,7 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_types | other.m_types, m_stack | other.m_stack, m_label, other.m_ctx);
+    return type_domain_t(m_types | other.m_types, m_stack | other.m_stack, other.m_ctx);
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
@@ -372,52 +379,55 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), m_label, other.m_ctx);
+    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), other.m_ctx);
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
     return abs;
 }
 
-type_domain_t type_domain_t::widen(const type_domain_t& abs) const {
-    return abs;
-}
-
 type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
     return other;
 }
 
 void type_domain_t::write(std::ostream& os) const { 
-    //os << m_types;
+    os << m_types;
     os << m_stack << "\n";
 }
 
-std::string type_domain_t::domain_name() const {
-    return "type_domain";
+void type_domain_t::initialize_loop_counter(label_t label) {
+    // WARNING: Not implemented yet
 }
 
-crab::bound_t type_domain_t::get_instruction_count_upper_bound() {
-    return crab::bound_t(crab::number_t(0));
+crab::bound_t type_domain_t::get_loop_count_upper_bound() {
+    // WARNING: Not implemented yet
+    return crab::bound_t{crab::number_t{0}};
 }
 
 string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined & u) {
+void type_domain_t::operator()(const Undefined & u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Un &u) {
+void type_domain_t::operator()(const Un &u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const LoadMapFd &u) {
+void type_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     std::cout << "  " << u << ";\n";
     m_types -= u.dst.v;
 }
-void type_domain_t::operator()(const Call &u) {
+void type_domain_t::operator()(const Atomic &u, location_t loc) {
+    // WARNING: Not implemented yet
+}
+void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
+    // WARNING: Not implemented yet
+}
+void type_domain_t::operator()(const Call &u, location_t loc) {
     register_t r0_reg{R0_RETURN_VALUE};
     if (u.is_map_lookup) {
-        auto r0 = reg_with_loc_t(r0_reg, m_label, m_curr_pos);
+        auto r0 = reg_with_loc_t(r0_reg, loc);
         auto type = ptr_no_off_t(crab::region::T_SHARED);
         m_types.insert(r0_reg, r0, type);
         print_annotated(u, type, std::cout);
@@ -427,24 +437,24 @@ void type_domain_t::operator()(const Call &u) {
         std::cout << "  " << u << ";\n";
     }
 }
-void type_domain_t::operator()(const Exit &u) {
+void type_domain_t::operator()(const Callx &u, location_t loc) {
+    // WARNING: Not implemented yet
+}
+void type_domain_t::operator()(const Exit &u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Jmp &u) {
+void type_domain_t::operator()(const Jmp &u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Packet & u) {
+void type_domain_t::operator()(const Packet & u, location_t loc) {
     std::cout << "  " << u << ";\n";
     //CRAB_ERROR("type_error: loading from packet region not allowed");
     m_types -= register_t{0};
 }
-void type_domain_t::operator()(const LockAdd &u) {
-    std::cout << "  " << u << ";\n";
-}
-void type_domain_t::operator()(const Assume &u) {
+void type_domain_t::operator()(const Assume &u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Assert &u) {
+void type_domain_t::operator()(const Assert &u, location_t loc) {
     std::cout << "  " << u << ";\n";
 }
 
@@ -470,14 +480,12 @@ type_domain_t type_domain_t::setup_entry() {
     live_registers_t vars;
     register_types_t typ(std::move(vars), all_types);
 
-    auto r1 = reg_with_loc_t(R1_ARG, label_t::entry, 0);
-    auto r10 = reg_with_loc_t(R10_STACK_POINTER, label_t::entry, 0);
+    auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
+    auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
 
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
-    std::cout << "is types bottom in the start: " << typ.is_bottom() << "\n";
-
     std::cout << "Initial register types:\n";
     auto it = typ.find(R1_ARG);
     if (it) {
@@ -493,12 +501,11 @@ type_domain_t type_domain_t::setup_entry() {
     }
     std::cout << "\n";
 
-    type_domain_t inv(std::move(typ), crab::stack_t::top(), label_t::entry, ctx);
+    type_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
     return inv;
 }
 
-void type_domain_t::operator()(const Bin& bin) {
-
+void type_domain_t::operator()(const Bin& bin, location_t loc) {
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
@@ -512,7 +519,7 @@ void type_domain_t::operator()(const Bin& bin) {
                     break;
                 }
 
-                auto reg = reg_with_loc_t(bin.dst.v, m_label, m_curr_pos);
+                auto reg = reg_with_loc_t(bin.dst.v, loc);
                 m_types.insert(bin.dst.v, reg, it.value());
                 break;
             }
@@ -528,7 +535,7 @@ void type_domain_t::operator()(const Bin& bin) {
     std::cout << "  " << bin << ";\n";
 }
 
-void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
+void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc) {
 
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
@@ -565,13 +572,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
 
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+                auto reg = reg_with_loc_t(target_reg.v, loc);
                 m_types.insert(target_reg.v, reg, type_loaded_with_off);
                 print_annotated(b, type_loaded_with_off, std::cout);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+                auto reg = reg_with_loc_t(target_reg.v, loc);
                 m_types.insert(target_reg.v, reg, type_loaded_no_off);
                 print_annotated(b, type_loaded_no_off, std::cout);
             }
@@ -590,7 +597,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
             }
             ptr_no_off_t type_loaded = it.value();
 
-            auto reg = reg_with_loc_t(target_reg.v, m_label, m_curr_pos);
+            auto reg = reg_with_loc_t(target_reg.v, loc);
             m_types.insert(target_reg.v, reg, type_loaded);
             print_annotated(b, type_loaded, std::cout);
             break;
@@ -602,7 +609,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     }
 }
 
-void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
+void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc) {
 
     std::cout << "  " << b << ";\n";
     int offset = b.access.offset;
@@ -673,26 +680,26 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg) {
     }
 }
 
-void type_domain_t::operator()(const Mem& b) {
+void type_domain_t::operator()(const Mem& b, location_t loc) {
 
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value));
+            do_load(b, std::get<Reg>(b.value), loc);
         } else {
-            do_mem_store(b, std::get<Reg>(b.value));
+            do_mem_store(b, std::get<Reg>(b.value), loc);
         }
     } else {
         CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet) - ", std::get<Imm>(b.value).v);
     }
 }
 
-void type_domain_t::operator()(const basic_block_t& bb, bool check_termination) {
-    m_curr_pos = 0;
-    m_label = bb.label();
-    std::cout << m_label << ":\n";
+void type_domain_t::operator()(const basic_block_t& bb) {
+    uint32_t curr_pos = 0;
+    auto label = bb.label();
+    std::cout << label << ":\n";
     for (const Instruction& statement : bb) {
-        m_curr_pos++;
-        std::visit(*this, statement);
+        location_t loc = location_t(std::make_pair(label, ++curr_pos));
+        std::visit([this, loc](const auto& v) { std::apply(*this, std::make_pair(v, loc)); }, statement);
     }
     auto [it, et] = bb.next_blocks();
     if (it != et) {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 22bd0e30b..ec918b5c1 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -52,12 +52,13 @@ struct ptr_with_off_t {
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 using register_t = uint8_t;
+using location_t = boost::optional<std::pair<label_t, uint32_t>>;
 
 struct reg_with_loc_t {
     register_t r;
-    std::pair<label_t, uint32_t> loc;
+    location_t loc;
 
-    reg_with_loc_t(register_t _r, const label_t& l, uint32_t loc_instr) : r(_r), loc(std::make_pair(l, loc_instr)) {}
+    reg_with_loc_t(register_t _r, location_t _loc) : r(_r), loc(_loc) {}
     bool operator==(const reg_with_loc_t& other) const;
     std::size_t hash() const;
     friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
@@ -132,18 +133,16 @@ class type_domain_t final {
     crab::stack_t m_stack;
     crab::register_types_t m_types;
     std::shared_ptr<crab::ctx_t> m_ctx;
-    label_t m_label;
-    uint32_t m_curr_pos = 0;
 
   public:
 
-    type_domain_t() : m_label(label_t::entry) {}
+    type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
-    type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, const label_t& _l, std::shared_ptr<crab::ctx_t> _ctx)
-            : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx), m_label(_l) {}
+    type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
+            : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static type_domain_t setup_entry();
     // bottom/top
@@ -162,35 +161,37 @@ class type_domain_t final {
     // meet
     type_domain_t operator&(const type_domain_t& other) const;
     // widening
-    type_domain_t widen(const type_domain_t& other) const;
+    type_domain_t widen(const type_domain_t& other, bool);
     // narrowing
     type_domain_t narrow(const type_domain_t& other) const;
     //forget
     void operator-=(crab::variable_t var);
 
     //// abstract transformers
-    void operator()(const Undefined &);
-    void operator()(const Bin &);
-    void operator()(const Un &) ;
-    void operator()(const LoadMapFd &);
-    void operator()(const Call &);
-    void operator()(const Exit &);
-    void operator()(const Jmp &);
-    void operator()(const Mem &);
-    void operator()(const Packet &);
-    void operator()(const LockAdd &);
-    void operator()(const Assume &);
-    void operator()(const Assert &);
-    void operator()(const basic_block_t& bb, bool check_termination);
+    void operator()(const Undefined &, location_t loc = boost::none);
+    void operator()(const Bin &, location_t loc = boost::none);
+    void operator()(const Un &, location_t loc = boost::none);
+    void operator()(const LoadMapFd &, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none);
+    void operator()(const Call &, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Exit &, location_t loc = boost::none);
+    void operator()(const Jmp &, location_t loc = boost::none);
+    void operator()(const Mem &, location_t loc = boost::none);
+    void operator()(const Packet &, location_t loc = boost::none);
+    void operator()(const Assume &, location_t loc = boost::none);
+    void operator()(const Assert &, location_t loc = boost::none);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
-    std::string domain_name() const;
-    crab::bound_t get_instruction_count_upper_bound();
+    void initialize_loop_counter(label_t label);
+    crab::bound_t get_loop_count_upper_bound();
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
   private:
 
-    void do_load(const Mem&, const Reg&);
-    void do_mem_store(const Mem&, const Reg&);
+    void do_load(const Mem&, const Reg&, location_t);
+    void do_mem_store(const Mem&, const Reg&, location_t);
 
 }; // end type_domain_t

From 56b9fce1d6a4e14e2c8d8856ceef77f01ff29c90 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Thu, 31 Mar 2022 07:57:05 -0400
Subject: [PATCH 089/373] Pretty printing fix

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 3cf26f3a2..23ea9b9b4 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -124,7 +124,7 @@ std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
 }
 
 std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc->second << " in " << reg.loc->first;
+    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc->second << " in " << reg.loc->first << " ";
     return o;
 }
 
@@ -464,13 +464,15 @@ void print_info() {
     std::cout << "  shared_p = shared pointer\n";
     std::cout << "  stack_p<n> = stack pointer at offset n\n";
     std::cout << "  ctx_p<n> = context pointer at offset n\n";
-    std::cout << "  'context = _|_' means context contains no elements stored\n\n";
+    std::cout << "  'context = _|_' means context contains no elements stored\n";
+    std::cout << "  when invoked with print invariants option\n";
+    std::cout << "      'r@n in bb : p_type' means register 'r' in basic block 'bb' at offset 'n' has type 'p_type'\n\n";
     std::cout << "**************************************************************\n\n";
 }
 
 type_domain_t type_domain_t::setup_entry() {
 
-    //print_info();
+    print_info();
 
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();

From 59c4015bdfd12de053917d2f46059cb93e00ab82 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Mon, 25 Apr 2022 12:22:04 -0400
Subject: [PATCH 090/373] configured types as separate domain option;
 refactored some redundant code

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>

 Conflicts:
	src/main/check.cpp

 Author:    Ameer Hamza <ah18r@my.fsu.edu>
 Date:      Mon Apr 25 12:22:04 2022 -0400
 Changes to be committed:
	modified:   src/ebpf_proof.cpp
	modified:   src/main/check.cpp
---
 src/ebpf_proof.cpp |  1 +
 src/main/check.cpp | 17 +++++------------
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/src/ebpf_proof.cpp b/src/ebpf_proof.cpp
index 0ec47b746..58203f08e 100644
--- a/src/ebpf_proof.cpp
+++ b/src/ebpf_proof.cpp
@@ -8,6 +8,7 @@ bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const prog
 
     if (!results.pass_verify()) {
         // If the program is not correct then we cannot generate a proof
+        std::cout << "Proof generation not implemented\n";
         return false;
     }
 
diff --git a/src/main/check.cpp b/src/main/check.cpp
index ed9a00c40..968c02c9e 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -55,7 +55,7 @@ int main(int argc, char** argv) {
     app.add_flag("-l", list, "List sections");
 
     std::string domain = "zoneCrab";
-    std::set<string> doms{"stats", "linux", "zoneCrab", "cfg"};
+    std::set<string> doms{"stats", "linux", "zoneCrab", "types", "cfg"};
     app.add_set("-d,--dom,--domain", domain, doms, "Abstract domain")->type_name("DOMAIN");
 
     app.add_flag("--termination", ebpf_verifier_options.check_termination, "Verify termination");
@@ -77,9 +77,6 @@ int main(int argc, char** argv) {
     app.add_flag("--line-info", ebpf_verifier_options.print_line_info, "Print line information");
     app.add_flag("--print-btf-types", ebpf_verifier_options.dump_btf_types_json, "Print BTF types");
 
-    bool gen_proof = false;
-    app.add_flag("--gen-proof", gen_proof, "Generate a proof if program is proven correct");
-
     std::string asmfile;
     app.add_option("--asm", asmfile, "Print disassembly to FILE")->type_name("FILE");
     std::string dotfile;
@@ -92,9 +89,6 @@ int main(int argc, char** argv) {
         ebpf_verifier_options.print_invariants = ebpf_verifier_options.print_failures = true;
     ebpf_verifier_options.allow_division_by_zero = !no_division_by_zero;
 
-    if (gen_proof) 
-        ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
-
     // Main program
 
     if (filename == "@headers") {
@@ -169,8 +163,11 @@ int main(int argc, char** argv) {
         print_map_descriptors(global_program_info->map_descriptors, out);
     }
 
-    if (domain == "zoneCrab") {
+    if (domain == "zoneCrab" || domain == "types") {
         ebpf_verifier_stats_t verifier_stats;
+        if (domain == "types") {
+          ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
+        }
         auto [res, seconds] = timed_execution([&] {
             return ebpf_verify_program(std::cout, prog, raw_prog.info, &ebpf_verifier_options, &verifier_stats);
         });
@@ -179,10 +176,6 @@ int main(int argc, char** argv) {
         }
         std::cout << res.pass_verify() << "," << seconds << "," << resident_set_size_kb() << "\n";
 
-	if (gen_proof) {
-	  ebpf_generate_proof(std::cout, prog, raw_prog.info, &ebpf_verifier_options, res);
-	}
-
         return !res.pass_verify();
     } else if (domain == "linux") {
         // Pass the instruction sequence to the Linux kernel verifier.

From ec91cd2393389e280d40f053f87becc9114f5e38 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Wed, 27 Apr 2022 09:50:44 -0400
Subject: [PATCH 091/373] Move printing after the analysis;

by default, prints minimal types;
-v option prints types for debugging

 Author:    Ameer Hamza <ah18r@my.fsu.edu>
 Date:      Wed Apr 27 09:50:44 2022 -0400
---
 src/crab/abstract_domain.cpp |  74 ++++-----
 src/crab/abstract_domain.hpp |  72 ++++-----
 src/crab/ebpf_domain.cpp     |  48 +++---
 src/crab/ebpf_domain.hpp     |  50 +++---
 src/crab/type_domain.cpp     | 294 ++++++++++++++++++++++-------------
 src/crab/type_domain.hpp     |  37 +++--
 src/crab_verifier.cpp        |   8 +-
 7 files changed, 339 insertions(+), 244 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index f89cd5576..8a5fb1c7f 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -105,63 +105,63 @@ abstract_domain_t::abstract_domain_model<Domain>::narrow(const abstract_domain_t
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_block_t& bb) {
-    m_abs_val.operator()(bb);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_block_t& bb, int print) {
+    m_abs_val.operator()(bb, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s, location_t loc) {
-    m_abs_val.operator()(s, loc);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s, location_t loc, int print) {
+    m_abs_val.operator()(s, loc, print);
 }
 
 template <typename Domain>
@@ -241,31 +241,31 @@ abstract_domain_t abstract_domain_t::narrow(const abstract_domain_t& abs) const
     return abstract_domain_t(std::move(m_concept->narrow(*(abs.m_concept))));
 }
 
-void abstract_domain_t::operator()(const basic_block_t& bb) {
-    m_concept->operator()(bb);
+void abstract_domain_t::operator()(const basic_block_t& bb, int print) {
+    m_concept->operator()(bb, print);
 }
 
-void abstract_domain_t::operator()(const Undefined& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Undefined& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Bin& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Bin& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Un& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Un& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Call& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Call& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Exit& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Exit& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Jmp& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Jmp& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Mem& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Mem& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Packet& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Packet& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Assume& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Assume& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
-void abstract_domain_t::operator()(const Assert& s, location_t loc) { m_concept->operator()(s, loc); }
+void abstract_domain_t::operator()(const Assert& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
 
 void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
 
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index c3f8a43e5..172d93f36 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -31,18 +31,18 @@ class abstract_domain_t {
         virtual std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const = 0;
         virtual std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) = 0;
         virtual std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const = 0;
-        virtual void operator()(const basic_block_t&) = 0;
-        virtual void operator()(const Undefined&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Bin&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Un&, location_t loc = boost::none) = 0;
-        virtual void operator()(const LoadMapFd&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Call&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Exit&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Jmp&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Mem&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Packet&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Assume&, location_t loc = boost::none) = 0;
-        virtual void operator()(const Assert&, location_t loc = boost::none) = 0;
+        virtual void operator()(const basic_block_t&, int) = 0;
+        virtual void operator()(const Undefined&, location_t, int) = 0;
+        virtual void operator()(const Bin&, location_t, int) = 0;
+        virtual void operator()(const Un&, location_t, int) = 0;
+        virtual void operator()(const LoadMapFd&, location_t, int) = 0;
+        virtual void operator()(const Call&, location_t, int) = 0;
+        virtual void operator()(const Exit&, location_t, int) = 0;
+        virtual void operator()(const Jmp&, location_t, int) = 0;
+        virtual void operator()(const Mem&, location_t, int) = 0;
+        virtual void operator()(const Packet&, location_t, int) = 0;
+        virtual void operator()(const Assume&, location_t, int) = 0;
+        virtual void operator()(const Assert&, location_t, int) = 0;
         virtual void write(std::ostream& os) const = 0;
 
         /* These operations are not very conventional for an abstract
@@ -73,18 +73,18 @@ class abstract_domain_t {
         std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const override;
         std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
         std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
-        void operator()(const basic_block_t& bb) override;
-        void operator()(const Undefined& s, location_t loc = boost::none) override;
-        void operator()(const Bin& s, location_t loc = boost::none) override;
-        void operator()(const Un& s, location_t loc = boost::none) override;
-        void operator()(const LoadMapFd& s, location_t loc = boost::none) override;
-        void operator()(const Call& s, location_t loc = boost::none) override;
-        void operator()(const Exit& s, location_t loc = boost::none) override;
-        void operator()(const Jmp& s, location_t loc = boost::none) override;
-        void operator()(const Mem& s, location_t loc = boost::none) override;
-        void operator()(const Packet& s, location_t loc = boost::none) override;
-        void operator()(const Assume& s, location_t loc = boost::none) override;
-        void operator()(const Assert& s, location_t loc = boost::none) override;
+        void operator()(const basic_block_t& bb, int print = 0) override;
+        void operator()(const Undefined& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Bin& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Un& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const LoadMapFd& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Call& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Exit& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Jmp& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Mem& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Packet& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Assume& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Assert& s, location_t loc = boost::none, int print = 0) override;
         void write(std::ostream& os) const override;
         void initialize_loop_counter(const label_t) override;
         crab::bound_t get_loop_count_upper_bound() override;
@@ -115,18 +115,18 @@ class abstract_domain_t {
     abstract_domain_t operator&(const abstract_domain_t& abs) const;
     abstract_domain_t widen(const abstract_domain_t& abs, bool);
     abstract_domain_t narrow(const abstract_domain_t& abs) const;
-    void operator()(const basic_block_t& bb);
-    void operator()(const Undefined& s, location_t loc = boost::none);
-    void operator()(const Bin& s, location_t loc = boost::none);
-    void operator()(const Un& s, location_t loc = boost::none);
-    void operator()(const LoadMapFd& s, location_t loc = boost::none);
-    void operator()(const Call& s, location_t loc = boost::none);
-    void operator()(const Exit& s, location_t loc = boost::none);
-    void operator()(const Jmp& s, location_t loc = boost::none);
-    void operator()(const Mem& s, location_t loc = boost::none);
-    void operator()(const Packet& s, location_t loc = boost::none);
-    void operator()(const Assume& s, location_t loc = boost::none);
-    void operator()(const Assert& s, location_t loc = boost::none);
+    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const Undefined& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Un& s, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Call& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert& s, location_t loc = boost::none, int print = 0);
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 822961689..5cb1738c3 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1377,7 +1377,7 @@ void ebpf_domain_t::overflow_unsigned(NumAbsDomain& inv, variable_t lhs, int fin
     overflow_bounds(inv, lhs, span, finite_width, false);
 }
 
-void ebpf_domain_t::operator()(const basic_block_t& bb) {
+void ebpf_domain_t::operator()(const basic_block_t& bb, int print) {
     for (const Instruction& statement : bb) {
         std::visit(*this, statement);
     }
@@ -1417,7 +1417,7 @@ void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expressi
     require(inv, ub <= region_size, std::string("Upper bound must be at most ") + region_size.name());
 }
 
-void ebpf_domain_t::operator()(const Assume& s, location_t loc) {
+void ebpf_domain_t::operator()(const Assume& s, location_t loc, int print) {
     Condition cond = s.cond;
     auto dst = reg_pack(cond.left);
     if (std::holds_alternative<Reg>(cond.right)) {
@@ -1450,9 +1450,9 @@ void ebpf_domain_t::operator()(const Assume& s, location_t loc) {
     }
 }
 
-void ebpf_domain_t::operator()(const Undefined& a, location_t loc) {}
+void ebpf_domain_t::operator()(const Undefined& a, location_t loc, int print) {}
 
-void ebpf_domain_t::operator()(const Un& stmt, location_t loc) {
+void ebpf_domain_t::operator()(const Un& stmt, location_t loc, int print) {
     auto dst = reg_pack(stmt.dst);
     auto swap_endianness = [&](variable_t v, auto input, const auto& be_or_le) {
         if (m_inv.entail(type_is_number(stmt.dst))) {
@@ -1516,11 +1516,11 @@ void ebpf_domain_t::operator()(const Un& stmt, location_t loc) {
     }
 }
 
-void ebpf_domain_t::operator()(const Exit& a, location_t loc) {}
+void ebpf_domain_t::operator()(const Exit& a, location_t loc, int print) {}
 
-void ebpf_domain_t::operator()(const Jmp& a, location_t loc) {}
+void ebpf_domain_t::operator()(const Jmp& a, location_t loc, int print) {}
 
-void ebpf_domain_t::operator()(const Comparable& s, location_t loc) {
+void ebpf_domain_t::operator()(const Comparable& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     if (type_inv.same_type(m_inv, s.r1, s.r2)) {
         // Same type. If both are numbers, that's okay. Otherwise:
@@ -1541,12 +1541,12 @@ void ebpf_domain_t::operator()(const Comparable& s, location_t loc) {
     };
 }
 
-void ebpf_domain_t::operator()(const Addable& s, location_t loc) {
+void ebpf_domain_t::operator()(const Addable& s, location_t loc, int print) {
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be added to pointers");
 }
 
-void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc) {
+void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg)))
@@ -1557,12 +1557,12 @@ void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc) {
     }
 }
 
-void ebpf_domain_t::operator()(const ValidStore& s, location_t loc) {
+void ebpf_domain_t::operator()(const ValidStore& s, location_t loc, int print) {
     if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be stored to externally-visible regions");
 }
 
-void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc) {
+void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
     if (!type_inv.is_in_group(m_inv, s.reg, s.types))
         require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
 }
@@ -1589,7 +1589,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
     require(m_inv, linear_constraint_t::FALSE(), "callx helper function id is not a valid singleton");
 }
 
-void ebpf_domain_t::operator()(const ValidSize& s, location_t loc) {
+void ebpf_domain_t::operator()(const ValidSize& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     auto r = reg_pack(s.reg);
     require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "Invalid size");
@@ -1698,7 +1698,7 @@ crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const
     return result;
 }
 
-void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc) {
+void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
 
     auto fd_type = get_map_type(s.map_fd_reg);
@@ -1764,7 +1764,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc) {
     });
 }
 
-void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc) {
+void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
 
     bool is_comparison_check = s.width == (Value)Imm{0};
@@ -1850,13 +1850,13 @@ void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc) {
     });
 }
 
-void ebpf_domain_t::operator()(const ZeroCtxOffset& s, location_t loc) {
+void ebpf_domain_t::operator()(const ZeroCtxOffset& s, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     require(m_inv, reg.ctx_offset == 0, "Nonzero context offset");
 }
 
-void ebpf_domain_t::operator()(const Assert& stmt, location_t loc) {
+void ebpf_domain_t::operator()(const Assert& stmt, location_t loc, int print) {
     if (check_require || thread_local_options.assume_assertions) {
         this->current_assertion = to_string(stmt.cst);
         std::visit(*this, stmt.cst);
@@ -1864,7 +1864,7 @@ void ebpf_domain_t::operator()(const Assert& stmt, location_t loc) {
     }
 }
 
-void ebpf_domain_t::operator()(const Packet& a, location_t loc) {
+void ebpf_domain_t::operator()(const Packet& a, location_t loc, int print) {
     auto reg = reg_pack(R0_RETURN_VALUE);
     Reg r0_reg{(uint8_t)R0_RETURN_VALUE};
     type_inv.assign_type(m_inv, r0_reg, T_NUM);
@@ -2119,7 +2119,7 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
     }
 }
 
-void ebpf_domain_t::operator()(const Mem& b, location_t loc) {
+void ebpf_domain_t::operator()(const Mem& b, location_t loc, int print) {
     if (m_inv.is_bottom())
         return;
     if (std::holds_alternative<Reg>(b.value)) {
@@ -2175,7 +2175,7 @@ static Bin atomic_to_bin(const Atomic& a) {
     return bin;
 }
 
-void ebpf_domain_t::operator()(const Atomic& a, location_t loc) {
+void ebpf_domain_t::operator()(const Atomic& a, location_t loc, int print) {
     if (m_inv.is_bottom())
         return;
     if (!m_inv.entail(type_is_pointer(reg_pack(a.access.basereg))) ||
@@ -2224,7 +2224,7 @@ void ebpf_domain_t::operator()(const Atomic& a, location_t loc) {
     type_inv.havoc_type(m_inv, r11);
 }
 
-void ebpf_domain_t::operator()(const Call& call, location_t loc) {
+void ebpf_domain_t::operator()(const Call& call, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2321,7 +2321,7 @@ void ebpf_domain_t::operator()(const Call& call, location_t loc) {
     }
 }
 
-void ebpf_domain_t::operator()(const Callx& callx, location_t loc) {
+void ebpf_domain_t::operator()(const Callx& callx, location_t loc, int print) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2356,7 +2356,7 @@ void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null
     assign_valid_ptr(dst_reg, maybe_null);
 }
 
-void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc) { do_load_mapfd(ins.dst, ins.mapfd, false); }
+void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc, int print) { do_load_mapfd(ins.dst, ins.mapfd, false); }
 
 void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
     using namespace crab::dsl_syntax;
@@ -2578,7 +2578,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
     havoc_offsets(dst_reg);
 }
 
-void ebpf_domain_t::operator()(const Bin& bin, location_t loc) {
+void ebpf_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     using namespace crab::dsl_syntax;
 
     auto dst = reg_pack(bin.dst);
@@ -3010,7 +3010,7 @@ bound_t ebpf_domain_t::get_loop_count_upper_bound() {
     return ub;
 }
 
-void ebpf_domain_t::operator()(const IncrementLoopCounter& ins, location_t loc) {
+void ebpf_domain_t::operator()(const IncrementLoopCounter& ins, location_t loc, int print) {
     this->add(variable_t::loop_counter(to_string(ins.name)), 1);
 }
 } // namespace crab
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index b3147f395..620764bc6 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -55,32 +55,32 @@ class ebpf_domain_t final {
     string_invariant to_set();
 
     // abstract transformers
-    void operator()(const basic_block_t& bb);
-
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const basic_block_t& bb, int print = 0);
+
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
+    void operator()(const Call&, location_t loc = boost::none, int print = 0);
+    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
     void operator()(const FuncConstraint&);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
+    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
+    void operator()(const Un&, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
 
     // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
     void write(std::ostream& o) const;
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 23ea9b9b4..a37c8640f 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -78,6 +78,12 @@ void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
     os_ << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
+void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
+    os_ << "  ";
+    print_type(b.dst.v, p);
+    os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+}
+
 namespace crab {
 
 inline std::string get_reg_ptr(const region& r) {
@@ -162,7 +168,7 @@ std::ostream& operator<<(std::ostream& o, const stack_t& st) {
 
 std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
 
-    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "_|_" : "") << "\n";
+    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "top" : "") << "\n";
     for (const auto& it : _ctx.m_packet_ptrs) {
         o << "  stores at " << it.first << ": " << it.second << "\n";
     }
@@ -317,10 +323,12 @@ std::optional<ptr_t> stack_t::find(int key) const {
 }
 
 bool type_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
     return (m_stack.is_bottom() || m_types.is_bottom());
 }
 
 bool type_domain_t::is_top() const {
+    if (m_is_bottom) return false;
     return (m_stack.is_top() && m_types.is_top());
 }
 
@@ -331,6 +339,7 @@ type_domain_t type_domain_t::bottom() {
 }
 
 void type_domain_t::set_to_bottom() {
+    m_is_bottom = true;
     m_types.set_to_bottom();
 }
 
@@ -408,77 +417,90 @@ string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined & u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const Undefined & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Un &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const Un &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const LoadMapFd &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        std::cout << "  " << u << ";\n";
+        return;
+    }
     m_types -= u.dst.v;
 }
-void type_domain_t::operator()(const Atomic &u, location_t loc) {
+void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
-void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
+void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
-void type_domain_t::operator()(const Call &u, location_t loc) {
+void type_domain_t::operator()(const Call &u, location_t loc, int print) {
+    if (is_bottom()) return;
     register_t r0_reg{R0_RETURN_VALUE};
+    auto r0 = reg_with_loc_t(r0_reg, loc);
+    if (print > 0) {
+        if (u.is_map_lookup) {
+            auto it = m_types.find(r0);
+            if (it) {
+                print_annotated(u, it.value(), std::cout);
+            }
+        }
+        else
+            std::cout << "  " << u << ";\n";
+        return;
+    }
     if (u.is_map_lookup) {
-        auto r0 = reg_with_loc_t(r0_reg, loc);
         auto type = ptr_no_off_t(crab::region::T_SHARED);
         m_types.insert(r0_reg, r0, type);
-        print_annotated(u, type, std::cout);
     }
     else {
         m_types -= r0_reg;
-        std::cout << "  " << u << ";\n";
     }
 }
-void type_domain_t::operator()(const Callx &u, location_t loc) {
+void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
-void type_domain_t::operator()(const Exit &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const Exit &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Jmp &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const Jmp &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
-void type_domain_t::operator()(const Packet & u, location_t loc) {
-    std::cout << "  " << u << ";\n";
-    //CRAB_ERROR("type_error: loading from packet region not allowed");
+void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        std::cout << "  " << u << ";\n";
+        return;
+    }
     m_types -= register_t{0};
 }
-void type_domain_t::operator()(const Assume &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
-}
-void type_domain_t::operator()(const Assert &u, location_t loc) {
-    std::cout << "  " << u << ";\n";
+void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
-
-void print_info() {
-    std::cout << "\nhow to interpret:\n";
-    std::cout << "  packet_p = packet pointer\n";
-    std::cout << "  shared_p = shared pointer\n";
-    std::cout << "  stack_p<n> = stack pointer at offset n\n";
-    std::cout << "  ctx_p<n> = context pointer at offset n\n";
-    std::cout << "  'context = _|_' means context contains no elements stored\n";
-    std::cout << "  when invoked with print invariants option\n";
-    std::cout << "      'r@n in bb : p_type' means register 'r' in basic block 'bb' at offset 'n' has type 'p_type'\n\n";
-    std::cout << "**************************************************************\n\n";
+void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
 }
 
 type_domain_t type_domain_t::setup_entry() {
 
-    print_info();
-
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
     std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
 
-    std::cout << *ctx << "\n";
-
     live_registers_t vars;
     register_types_t typ(std::move(vars), all_types);
 
@@ -488,26 +510,27 @@ type_domain_t type_domain_t::setup_entry() {
     typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
     typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
 
-    std::cout << "Initial register types:\n";
-    auto it = typ.find(R1_ARG);
-    if (it) {
-        std::cout << "  ";
-        print_type(R1_ARG, it.value());
-        std::cout << "\n";
-    }
-    auto it2 = typ.find(R10_STACK_POINTER);
-    if (it2) {
-        std::cout << "  ";
-        print_type(R10_STACK_POINTER, it2.value());
-        std::cout << "\n";
-    }
-    std::cout << "\n";
-
     type_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
     return inv;
 }
 
-void type_domain_t::operator()(const Bin& bin, location_t loc) {
+void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        if (print == 2) {
+            if (std::holds_alternative<Reg>(bin.v) && bin.op == Bin::Op::MOV) {
+                auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
+                auto it = m_types.find(reg_with_loc);
+                if (it) {
+                    print_annotated(bin, it.value(), std::cout);
+                    std::cout << "\n";
+                    return;
+                }
+            }
+        }
+        std::cout << "  " << bin << ";\n";
+        return;
+    }
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
@@ -515,8 +538,7 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
             case Bin::Op::MOV: {
                 auto it = m_types.find(src.v);
                 if (!it) {
-                    //std::cout << "  " << bin << "\n";
-                    //CRAB_ERROR("type error: assigning an unknown pointer or a number - r", (int)src.v);
+                    //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
                     m_types -= bin.dst.v;
                     break;
                 }
@@ -534,24 +556,33 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
     else {
         m_types -= bin.dst.v;
     }
-    std::cout << "  " << bin << ";\n";
 }
 
-void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc) {
+void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
 
+    if (print > 0) {
+        auto target_reg_loc = reg_with_loc_t(target_reg.v, loc);
+        auto it = m_types.find(target_reg_loc);
+        if (it)
+            print_annotated(b, it.value(), std::cout);
+        else
+            std::cout << "  " << b << ";\n";
+        return;
+    }
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        std::cout << "  " << b << "\n";
-        CRAB_ERROR("type_error: loading from an unknown pointer, or from number - r", (int)basereg.v);
+        error_location = loc;
+        std::cout << "type_error: loading from an unknown pointer, or from number - r" << (int)basereg.v << "\n";
+        set_to_bottom();
+        return;
     }
     ptr_t type_basereg = it.value();
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        std::cout << "  " << b << "\n";
-        //CRAB_ERROR("type_error: loading from either packet or shared region not allowed - r", (int)basereg.v);
+        //std::cout << "type_error: loading from either packet or shared region not allowed - r" << (int)basereg.v << "\n";
         m_types -= target_reg.v;
         return;
     }
@@ -565,8 +596,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc)
             auto it = m_stack.find(load_at);
 
             if (!it) {
-                std::cout << "  " << b << "\n";
-                //CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in stack");
+                //std::cout << "type_error: no field at loaded offset " << load_at << " in stack\n";
                 m_types -= target_reg.v;
                 return;
             }
@@ -576,13 +606,11 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc)
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, loc);
                 m_types.insert(target_reg.v, reg, type_loaded_with_off);
-                print_annotated(b, type_loaded_with_off, std::cout);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, loc);
                 m_types.insert(target_reg.v, reg, type_loaded_no_off);
-                print_annotated(b, type_loaded_no_off, std::cout);
             }
 
             break;
@@ -592,8 +620,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc)
             auto it = m_ctx->find(load_at);
 
             if (!it) {
-                std::cout << "  " << b << "\n";
-                //CRAB_ERROR("type_error: no field at loaded offset ", load_at, " in context");
+                //std::cout << "type_error: no field at loaded offset " << load_at << " in context\n";
                 m_types -= target_reg.v;
                 return;
             }
@@ -601,7 +628,6 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc)
 
             auto reg = reg_with_loc_t(target_reg.v, loc);
             m_types.insert(target_reg.v, reg, type_loaded);
-            print_annotated(b, type_loaded, std::cout);
             break;
         }
 
@@ -611,16 +637,22 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc)
     }
 }
 
-void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc) {
+void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
 
-    std::cout << "  " << b << ";\n";
+    if (print > 0) {
+        std::cout << "  " << b << ";\n";
+        return;
+    }
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
     int width = b.access.width;
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        CRAB_ERROR("type_error: storing at an unknown pointer, or from number - r", (int)basereg.v);
+        error_location = loc;
+        std::cout << "type_error: storing at an unknown pointer, or from number - r" << (int)basereg.v << "\n";
+        set_to_bottom();
+        return;
     }
     ptr_t type_basereg = it.value();
 
@@ -634,7 +666,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
         if (type_basereg_with_off.r == crab::region::T_STACK) {
             // type of basereg is STACK_P
             if (!it2) {
-                //CRAB_ERROR("type_error: storing either a number or an unknown pointer - r", (int)target_reg.v);
+                //std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
                 m_stack -= store_at;
                 return;
             }
@@ -642,21 +674,30 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                 auto type_to_store = it2.value();
                 if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
                         std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
-                    CRAB_ERROR("type_error: we cannot store stack pointer, r", (int)target_reg.v, ", into stack");
+                    error_location = loc;
+                    std::cout << "type_error: we cannot store stack pointer, r" << (int)target_reg.v << ", into stack\n";
+                    set_to_bottom();
+                    return;
                 }
                 else {
                     for (auto i = store_at; i < store_at+width; i++) {
                         auto it3 = m_stack.find(i);
                         if (it3) {
-                            CRAB_ERROR("type_error: type being stored into stack at ", store_at, " is overlapping with already stored\
-                            at", i);
+                            error_location = loc;
+                            std::cout << "type_error: type being stored into stack at " << store_at << " is overlapping with already stored\
+                            at" << i << "\n";
+                            set_to_bottom();
+                            return;
                         }
                     }
                     auto it4 = m_stack.find(store_at);
                     if (it4) {
                         auto type_in_stack = it4.value();
                         if (type_to_store != type_in_stack) {
-                            CRAB_ERROR("type_error: type being stored at offset ", store_at, " is not the same as stored already in stack");
+                            error_location = loc;
+                            std::cout << "type_error: type being stored at offset " << store_at << " is not the same as stored already in stack\n";
+                            set_to_bottom();
+                            return;
                         }
                     }
                     else {
@@ -668,7 +709,10 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
         else if (type_basereg_with_off.r == crab::region::T_CTX) {
             // type of basereg is CTX_P
             if (it2) {
-                CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into ctx");
+                error_location = loc;
+                std::cout << "type_error: we cannot store pointer, r" << (int)target_reg.v << ", into ctx\n";
+                set_to_bottom();
+                return;
             }
         }
         else
@@ -677,47 +721,89 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
     else {
         // base register type is either PACKET_P or SHARED_P
         if (it2) {
-            CRAB_ERROR("type_error: we cannot store pointer, r", (int)target_reg.v, ", into packet or shared");
+            error_location = loc;
+            std::cout << "type_error: we cannot store pointer, r" << (int)target_reg.v << ", into packet or shared\n";
+            set_to_bottom();
+            return;
         }
     }
 }
 
-void type_domain_t::operator()(const Mem& b, location_t loc) {
+void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
+    if (is_bottom()) return;
 
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value), loc);
+            do_load(b, std::get<Reg>(b.value), loc, print);
         } else {
-            do_mem_store(b, std::get<Reg>(b.value), loc);
+            do_mem_store(b, std::get<Reg>(b.value), loc, print);
         }
     } else {
-        CRAB_ERROR("Either loading to a number (not allowed) or storing a number (not allowed yet) - ", std::get<Imm>(b.value).v);
+        error_location = loc;
+        std::cout << "type_error: Either loading to a number (not allowed) or storing a number (not allowed yet) - " << std::get<Imm>(b.value).v << "\n";
+        set_to_bottom();
+        return;
     }
 }
 
-void type_domain_t::operator()(const basic_block_t& bb) {
-    uint32_t curr_pos = 0;
+void type_domain_t::print_initial_types() {
+    auto label = label_t::entry;
+    location_t loc = location_t(std::make_pair(label, 0));
+    std::cout << "\n" << *m_ctx << "\n";
+    std::cout << m_stack << "\n";
+
+    std::cout << "Initial register types:\n";
+    auto r1_with_loc = reg_with_loc_t(R1_ARG, loc);
+    auto it = m_types.find(r1_with_loc);
+    if (it) {
+        std::cout << "  ";
+        print_type(R1_ARG, it.value());
+        std::cout << "\n";
+    }
+    auto r10_with_loc = reg_with_loc_t(R10_STACK_POINTER, loc);
+    auto it2 = m_types.find(r10_with_loc);
+    if (it2) {
+        std::cout << "  ";
+        print_type(R10_STACK_POINTER, it2.value());
+        std::cout << "\n";
+    }
+    std::cout << "\n";
+}
+
+void type_domain_t::operator()(const basic_block_t& bb, int print) {
     auto label = bb.label();
-    std::cout << label << ":\n";
+    uint32_t curr_pos = 0;
+    location_t loc;
+    if (print > 0) {
+        if (label == label_t::entry) {
+            print_initial_types();
+        }
+        std::cout << label << ":\n";
+    }
+
     for (const Instruction& statement : bb) {
-        location_t loc = location_t(std::make_pair(label, ++curr_pos));
-        std::visit([this, loc](const auto& v) { std::apply(*this, std::make_pair(v, loc)); }, statement);
-    }
-    auto [it, et] = bb.next_blocks();
-    if (it != et) {
-        std::cout << "  "
-        << "goto ";
-        for (; it != et;) {
-            std::cout << *it;
-            ++it;
-            if (it == et) {
-                std::cout << ";";
-            } else {
-                std::cout << ",";
+        loc = location_t(std::make_pair(label, ++curr_pos));
+        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
+        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) CRAB_ERROR("type_error");
+    }
+
+    if (print > 0) {
+        auto [it, et] = bb.next_blocks();
+        if (it != et) {
+            std::cout << "  "
+            << "goto ";
+            for (; it != et;) {
+                std::cout << *it;
+                ++it;
+                if (it == et) {
+                    std::cout << ";";
+                } else {
+                    std::cout << ",";
+                }
             }
         }
+        std::cout << "\n\n";
     }
-    std::cout << "\n\n";
 }
 
 void type_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index ec918b5c1..81ce3007a 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -130,6 +130,8 @@ class register_types_t {
 
 class type_domain_t final {
 
+    bool m_is_bottom = false;
+    location_t error_location = boost::none;
     crab::stack_t m_stack;
     crab::register_types_t m_types;
     std::shared_ptr<crab::ctx_t> m_ctx;
@@ -168,21 +170,21 @@ class type_domain_t final {
     void operator-=(crab::variable_t var);
 
     //// abstract transformers
-    void operator()(const Undefined &, location_t loc = boost::none);
-    void operator()(const Bin &, location_t loc = boost::none);
-    void operator()(const Un &, location_t loc = boost::none);
-    void operator()(const LoadMapFd &, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none);
-    void operator()(const Call &, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none);
-    void operator()(const Exit &, location_t loc = boost::none);
-    void operator()(const Jmp &, location_t loc = boost::none);
-    void operator()(const Mem &, location_t loc = boost::none);
-    void operator()(const Packet &, location_t loc = boost::none);
-    void operator()(const Assume &, location_t loc = boost::none);
-    void operator()(const Assert &, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
-    void operator()(const basic_block_t& bb);
+    void operator()(const Undefined &, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin &, location_t loc = boost::none, int print = 0);
+    void operator()(const Un &, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd &, location_t loc = boost::none, int print = 0);
+    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
+    void operator()(const Call &, location_t loc = boost::none, int print = 0);
+    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit &, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp &, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem &, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet &, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume &, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert &, location_t loc = boost::none, int print = 0);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
+    void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound();
@@ -191,7 +193,8 @@ class type_domain_t final {
 
   private:
 
-    void do_load(const Mem&, const Reg&, location_t);
-    void do_mem_store(const Mem&, const Reg&, location_t);
+    void do_load(const Mem&, const Reg&, location_t, int print = 0);
+    void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
+    void print_initial_types();
 
 }; // end type_domain_t
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index c8c82ec8b..972b5b6f6 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -107,7 +107,13 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invarian
                                      crab::invariant_table_t& post_invariants) {
     // Analyze the control-flow graph.
     checks_db db = generate_report(cfg, pre_invariants, post_invariants);
-    if (thread_local_options.print_invariants) {
+    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN) {
+        auto state = post_invariants.at(label_t::exit);
+        for (const label_t& label : cfg.sorted_labels()) {
+            state(cfg.get_node(label), thread_local_options.print_invariants ? 2 : 1);
+        }
+    }
+    else if (thread_local_options.print_invariants) {
         for (const label_t& label : cfg.sorted_labels()) {
             s << "\nPre-invariant : " << pre_invariants.at(label) << "\n";
             s << cfg.get_node(label);

From 56244d46be0b8769b2e18ee513e1505c6de75b2f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Wed, 27 Apr 2022 13:04:23 -0400
Subject: [PATCH 092/373] Resetting bottom flag for type domain when pringing
 types; refactoring

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 62 +++++++++++++++++++++++-----------------
 src/crab/type_domain.hpp |  1 +
 2 files changed, 36 insertions(+), 27 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index a37c8640f..8cefd7473 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -340,7 +340,6 @@ type_domain_t type_domain_t::bottom() {
 
 void type_domain_t::set_to_bottom() {
     m_is_bottom = true;
-    m_types.set_to_bottom();
 }
 
 void type_domain_t::set_to_top() {
@@ -514,6 +513,13 @@ type_domain_t type_domain_t::setup_entry() {
     return inv;
 }
 
+void type_domain_t::report_type_error(std::string s, location_t loc) {
+    std::cout << "type_error at line " << loc->second << " in bb " << loc->first << "\n";
+    std::cout << s;
+    error_location = loc;
+    set_to_bottom();
+}
+
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     if (is_bottom()) return;
     if (print > 0) {
@@ -574,9 +580,9 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        error_location = loc;
-        std::cout << "type_error: loading from an unknown pointer, or from number - r" << (int)basereg.v << "\n";
-        set_to_bottom();
+        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+        std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
+        report_type_error(desc, loc);
         return;
     }
     ptr_t type_basereg = it.value();
@@ -649,9 +655,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
 
     auto it = m_types.find(basereg.v);
     if (!it) {
-        error_location = loc;
-        std::cout << "type_error: storing at an unknown pointer, or from number - r" << (int)basereg.v << "\n";
-        set_to_bottom();
+        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+        std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
+        report_type_error(desc, loc);
         return;
     }
     ptr_t type_basereg = it.value();
@@ -674,19 +680,19 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                 auto type_to_store = it2.value();
                 if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
                         std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
-                    error_location = loc;
-                    std::cout << "type_error: we cannot store stack pointer, r" << (int)target_reg.v << ", into stack\n";
-                    set_to_bottom();
+                    std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+                    std::string desc = std::string("\twe cannot store stack pointer, - r") + s + ", into stack\n";
+                    report_type_error(desc, loc);
                     return;
                 }
                 else {
                     for (auto i = store_at; i < store_at+width; i++) {
                         auto it3 = m_stack.find(i);
                         if (it3) {
-                            error_location = loc;
-                            std::cout << "type_error: type being stored into stack at " << store_at << " is overlapping with already stored\
-                            at" << i << "\n";
-                            set_to_bottom();
+                            std::string s = std::to_string(store_at);
+                            std::string s1 = std::to_string(i);
+                            std::string desc = std::string("\ttype being stored into stack at ") + s + " is overlapping with already stored at " + s1 + "\n";
+                            report_type_error(desc, loc);
                             return;
                         }
                     }
@@ -694,9 +700,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                     if (it4) {
                         auto type_in_stack = it4.value();
                         if (type_to_store != type_in_stack) {
-                            error_location = loc;
-                            std::cout << "type_error: type being stored at offset " << store_at << " is not the same as stored already in stack\n";
-                            set_to_bottom();
+                            std::string s = std::to_string(store_at);
+                            std::string desc = std::string("\ttype being stored at offset ") + s + " is not the same as already stored in stack\n";
+                            report_type_error(desc, loc);
                             return;
                         }
                     }
@@ -709,9 +715,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
         else if (type_basereg_with_off.r == crab::region::T_CTX) {
             // type of basereg is CTX_P
             if (it2) {
-                error_location = loc;
-                std::cout << "type_error: we cannot store pointer, r" << (int)target_reg.v << ", into ctx\n";
-                set_to_bottom();
+                std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+                std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into ctx\n";
+                report_type_error(desc, loc);
                 return;
             }
         }
@@ -721,9 +727,9 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
     else {
         // base register type is either PACKET_P or SHARED_P
         if (it2) {
-            error_location = loc;
-            std::cout << "type_error: we cannot store pointer, r" << (int)target_reg.v << ", into packet or shared\n";
-            set_to_bottom();
+            std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
+            report_type_error(desc, loc);
             return;
         }
     }
@@ -739,9 +745,9 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
             do_mem_store(b, std::get<Reg>(b.value), loc, print);
         }
     } else {
-        error_location = loc;
-        std::cout << "type_error: Either loading to a number (not allowed) or storing a number (not allowed yet) - " << std::get<Imm>(b.value).v << "\n";
-        set_to_bottom();
+        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
+        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
+        report_type_error(desc, loc);
         return;
     }
 }
@@ -777,14 +783,16 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
     if (print > 0) {
         if (label == label_t::entry) {
             print_initial_types();
+            m_is_bottom = false;
         }
         std::cout << label << ":\n";
     }
 
     for (const Instruction& statement : bb) {
         loc = location_t(std::make_pair(label, ++curr_pos));
+        if (print > 0) std::cout << " " << curr_pos << ".";
         std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
-        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) CRAB_ERROR("type_error");
+        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) std::cout << "type_error\n";
     }
 
     if (print > 0) {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 81ce3007a..ee7f3a117 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -196,5 +196,6 @@ class type_domain_t final {
     void do_load(const Mem&, const Reg&, location_t, int print = 0);
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
     void print_initial_types();
+    void report_type_error(std::string, location_t);
 
 }; // end type_domain_t

From 153ba80d8860adb22760a81c795663612f74bcb3 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Wed, 11 May 2022 17:21:47 -0400
Subject: [PATCH 093/373] Added support for pointer arithmetic removed
 conservative type errors, like storing a stack pointer into stack

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 110 +++++++++++++++++++++++++++++++++------
 1 file changed, 94 insertions(+), 16 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 8cefd7473..f6875c490 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -81,7 +81,17 @@ void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
 void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
     os_ << "  ";
     print_type(b.dst.v, p);
-    os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+    // add better checks as we add more support
+    if (std::holds_alternative<Reg>(b.v)) {
+        if (b.op == Bin::Op::MOV)
+            os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+        else if (b.op == Bin::Op::ADD)
+            os_ << " += r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+    }
+    else {
+        if (b.op == Bin::Op::ADD)
+            os_ << " += " << static_cast<int>(std::get<Imm>(b.v).v) << ";";
+    }
 }
 
 namespace crab {
@@ -524,7 +534,8 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     if (is_bottom()) return;
     if (print > 0) {
         if (print == 2) {
-            if (std::holds_alternative<Reg>(bin.v) && bin.op == Bin::Op::MOV) {
+            if ((std::holds_alternative<Reg>(bin.v) && (bin.op == Bin::Op::MOV || bin.op == Bin::Op::ADD)) ||
+            (std::holds_alternative<Imm>(bin.v) && bin.op == Bin::Op::ADD)) {
                 auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
                 auto it = m_types.find(reg_with_loc);
                 if (it) {
@@ -537,30 +548,86 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         std::cout << "  " << bin << ";\n";
         return;
     }
+
+    ptr_t dst_reg;
+    if (bin.op == Bin::Op::ADD) {
+        auto it = m_types.find(bin.dst.v);
+        if (!it) {
+            m_types -= bin.dst.v;
+            return;
+        }
+        dst_reg = it.value();
+    }
+
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
         {
             case Bin::Op::MOV: {
-                auto it = m_types.find(src.v);
-                if (!it) {
+                auto it1 = m_types.find(src.v);
+                if (!it1) {
                     //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
                     m_types -= bin.dst.v;
                     break;
                 }
-
                 auto reg = reg_with_loc_t(bin.dst.v, loc);
-                m_types.insert(bin.dst.v, reg, it.value());
+                m_types.insert(bin.dst.v, reg, it1.value());
+                break;
+            }
+            case Bin::Op::ADD: {
+                auto it1 = m_types.find(src.v);
+                if (it1) {
+                    std::string s = std::to_string(static_cast<unsigned int>(src.v));
+                    std::string s1 = std::to_string(static_cast<unsigned int>(bin.dst.v));
+                    std::string desc = std::string("\taddition of two pointers, r") + s + " and r" + s1 + " not allowed\n";
+                    report_type_error(desc, loc);
+                    return;
+                }
+                else {
+                    if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                        /*
+                        std::string s = std::to_string(static_cast<unsigned int>(bin.dst.v));
+                        std::string desc = std::string("\toffset of the pointer r") + s + " unknown\n";
+                        report_type_error(desc, loc);
+                        return;
+                        */
+                        m_stack.set_to_top();
+                        m_stack -= std::get<ptr_with_off_t>(dst_reg).offset;
+                    }
+                    else {
+                        auto reg = reg_with_loc_t(bin.dst.v, loc);
+                        m_types.insert(bin.dst.v, reg, dst_reg);
+                    }
+                }
                 break;
             }
-
             default:
                 m_types -= bin.dst.v;
                 break;
         }
     }
     else {
-        m_types -= bin.dst.v;
+        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
+        switch (bin.op)
+        {
+            case Bin::Op::ADD: {
+                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                    auto ptr_with_off = std::get<ptr_with_off_t>(dst_reg);
+                    ptr_with_off.offset = ptr_with_off.offset + imm;
+                    auto reg = reg_with_loc_t(bin.dst.v, loc);
+                    m_types.insert(bin.dst.v, reg, ptr_with_off);
+                }
+                else {
+                    auto reg = reg_with_loc_t(bin.dst.v, loc);
+                    m_types.insert(bin.dst.v, reg, dst_reg);
+                }
+                break;
+            }
+            default: {
+                m_types -= bin.dst.v;
+                break;
+            }
+        }
     }
 }
 
@@ -665,28 +732,30 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
     auto it2 = m_types.find(target_reg.v);
 
     if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
-        // we know base register is either CTX_P or STACK_P
+        // base register is either CTX_P or STACK_P
         ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
 
         int store_at = offset+type_basereg_with_off.offset;
         if (type_basereg_with_off.r == crab::region::T_STACK) {
             // type of basereg is STACK_P
             if (!it2) {
-                //std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
+               // std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
                 m_stack -= store_at;
                 return;
             }
             else {
                 auto type_to_store = it2.value();
+                /*
                 if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
                         std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
                     std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-                    std::string desc = std::string("\twe cannot store stack pointer, - r") + s + ", into stack\n";
-                    report_type_error(desc, loc);
+                    std::string desc = std::string("\twe cannot store stack pointer, r") + s + ", into stack\n";
+                    //report_type_error(desc, loc);
                     return;
                 }
                 else {
-                    for (auto i = store_at; i < store_at+width; i++) {
+                */
+                    for (auto i = store_at+1; i < store_at+width; i++) {
                         auto it3 = m_stack.find(i);
                         if (it3) {
                             std::string s = std::to_string(store_at);
@@ -696,6 +765,10 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                             return;
                         }
                     }
+                    m_stack.insert(store_at, type_to_store);
+                    // revise: code below checks if there is already something stored at same location, the type should be the same -- it is very restricted and not required.
+                    // However, when we support storing info like width of type, we need more checks
+                    /*
                     auto it4 = m_stack.find(store_at);
                     if (it4) {
                         auto type_in_stack = it4.value();
@@ -709,7 +782,8 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                     else {
                         m_stack.insert(store_at, type_to_store);
                     }
-                }
+                    */
+                //}
             }
         }
         else if (type_basereg_with_off.r == crab::region::T_CTX) {
@@ -725,8 +799,12 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
             assert(false);
     }
     else {
-        // base register type is either PACKET_P or SHARED_P
-        if (it2) {
+        // base register type is either PACKET_P, SHARED_P or STACK_P without known offset
+        ptr_no_off_t type_basereg_no_off = std::get<ptr_no_off_t>(type_basereg);
+
+        // if basereg is a stack_p with no offset, we do not store anything, and no type errors
+        // if we later load with that pointer, we read nothing -- load is no-op
+        if (it2 && type_basereg_no_off.r != crab::region::T_STACK) {
             std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
             std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
             report_type_error(desc, loc);

From 6e62c4cb0ed4e18da9e1d8162e81edc1ef560416 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Fri, 13 May 2022 10:14:29 -0400
Subject: [PATCH 094/373] Handling metadata offset properly

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index f6875c490..c976c9b22 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -191,6 +191,8 @@ ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
         m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
     if (desc->end != -1)
         m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->meta != -1)
+        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region::T_PACKET);
 }
 
 std::optional<ptr_no_off_t> ctx_t::find(int key) const {

From b01ce5f39418c9f1271c184bfda40f2be9875801 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Fri, 3 Jun 2022 07:36:28 -0700
Subject: [PATCH 095/373] Refactoring

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 206 +++++++++++++++++++++++----------------
 src/crab/type_domain.hpp |  59 ++++++-----
 2 files changed, 160 insertions(+), 105 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index c976c9b22..2ea3b7f0e 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -25,6 +25,7 @@ namespace std {
     };
 
     // does not seem to work for me
+    /*
     template <>
     struct equal_to<crab::ptr_t> {
         constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
@@ -32,19 +33,34 @@ namespace std {
             if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
                 auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
                 auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
-                return (ptr_no_off1.r == ptr_no_off2.r);
+                return (ptr_no_off1.get_region() == ptr_no_off2.get_region());
             }
             else {
                 auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
                 auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
-                return (ptr_with_off1.r == ptr_with_off2.r && ptr_with_off1.offset == ptr_with_off2.offset);
+                return (ptr_with_off1.get_region() == ptr_with_off2.get_region() && ptr_with_off1.get_offset() == ptr_with_off2.get_offset());
             }
         }
     };
+
+    template <>
+    struct equal_to<crab::ptr_with_off_t> {
+        constexpr bool operator()(const crab::ptr_with_off_t& p1, const crab::ptr_with_off_t& p2) const {
+            return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
+        }
+    };
+
+    template <>
+    struct equal_to<crab::ptr_no_off_t> {
+        constexpr bool operator()(const crab::ptr_no_off_t& p1, const crab::ptr_no_off_t& p2) const {
+            return (p1.get_region() == p2.get_region());
+        }
+    };
+    */
 }
 
 
-void print_ptr_type(const ptr_t& p) {
+static void print_ptr_type(const ptr_t& p) {
     if (std::holds_alternative<ptr_with_off_t>(p)) {
         auto t = std::get<ptr_with_off_t>(p);
         std::cout << t;
@@ -55,12 +71,12 @@ void print_ptr_type(const ptr_t& p) {
     }
 }
 
-void print_type(register_t r, const ptr_t& p) {
+static void print_type(register_t r, const ptr_t& p) {
     std::cout << "r" << static_cast<unsigned int>(r) << " : ";
     print_ptr_type(p);
 }
 
-void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
+static void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
     if (b.is_load) {
         os_ << "  ";
         print_type(std::get<Reg>(b.value).v, p);
@@ -72,13 +88,13 @@ void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
     os_ << "(" << b.access.basereg << sign << offset << ")\n";
 }
 
-void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
+static void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
     os_ << "  ";
     print_type(0, p);
     os_ << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
-void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
+static void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
     os_ << "  ";
     print_type(b.dst.v, p);
     // add better checks as we add more support
@@ -115,47 +131,72 @@ inline std::ostream& operator<<(std::ostream& o, const region& t) {
 }
 
 bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.r == p2.r && p1.offset == p2.offset);
+    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
 }
 
-bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return !(p1 == p2);
+bool ptr_with_off_t::operator!=(const ptr_with_off_t& p2) {
+    return !(*this == p2);
+}
+
+void ptr_with_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(m_r) << "<" << m_offset << ">";
 }
 
 std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-    o << get_reg_ptr(p.r) << "<" << p.offset << ">";
+    p.write(o);
     return o;
 }
 
+void ptr_with_off_t::set_offset(int off) { m_offset = off; }
+
+constexpr int ptr_with_off_t::get_offset() const { return m_offset; }
+
+void ptr_with_off_t::set_region(region r) { m_r = r; }
+
+constexpr region ptr_with_off_t::get_region() const { return m_r; }
+
 bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return (p1.r == p2.r);
+    return (p1.get_region() == p2.get_region());
+}
+
+bool ptr_no_off_t::operator!=(const ptr_no_off_t& p2) {
+    return !(*this == p2);
 }
 
-bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return !(p1 == p2);
+void ptr_no_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(get_region());
 }
 
 std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-    return o << get_reg_ptr(p.r);
+    p.write(o);
+    return o;
+}
+
+void ptr_no_off_t::set_region(region r) { m_r = r; }
+
+constexpr region ptr_no_off_t::get_region() const { return m_r; }
+
+void reg_with_loc_t::write(std::ostream& o) const {
+    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
 }
 
 std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    o << "r" << static_cast<unsigned int>(reg.r) << "@" << reg.loc->second << " in " << reg.loc->first << " ";
+    reg.write(o);
     return o;
 }
 
 bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
-    return (r == other.r && loc == other.loc);
+    return (m_reg == other.m_reg && m_loc == other.m_loc);
 }
 
 std::size_t reg_with_loc_t::hash() const {
     // Similar to boost::hash_combine
     using std::hash;
 
-    std::size_t seed = hash<register_t>()(r);
-    seed ^= hash<int>()(loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    std::size_t seed = hash<register_t>()(m_reg);
+    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
 
     return seed;
 }
@@ -206,7 +247,7 @@ std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
     if (typ.is_bottom())
         o << "_|_\n";
     else {
-        for (const auto& v : *(typ.m_all_types)) {
+        for (const auto& v : *(typ.m_reg_type_env)) {
             o << v.first << ": ";
             print_ptr_type(v.second);
             o << "\n";
@@ -222,32 +263,32 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
         return *this;
     }
     live_registers_t out_vars;
-    for (size_t i = 0; i < m_vars.size(); i++) {
-        if (m_vars[i] == nullptr || other.m_vars[i] == nullptr) continue;
-        auto it1 = find(*(m_vars[i]));
-        auto it2 = other.find(*(other.m_vars[i]));
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2 && it1.value() == it2.value()) {
-            out_vars[i] = m_vars[i];
+            out_vars[i] = m_cur_def[i];
         }
     }
 
-    return register_types_t(std::move(out_vars), m_all_types, false);
+    return register_types_t(std::move(out_vars), m_reg_type_env, false);
 }
 
 void register_types_t::operator-=(register_t var) {
     if (is_bottom()) {
         return;
     }
-    m_vars[var] = nullptr;
+    m_cur_def[var] = nullptr;
 }
 
 void register_types_t::set_to_bottom() {
-    m_vars = live_registers_t{nullptr};
+    m_cur_def = live_registers_t{nullptr};
     m_is_bottom = true;
 }
 
 void register_types_t::set_to_top() {
-    m_vars = live_registers_t{nullptr};
+    m_cur_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
 
@@ -255,27 +296,27 @@ bool register_types_t::is_bottom() const { return m_is_bottom; }
 
 bool register_types_t::is_top() const {
     if (m_is_bottom) { return false; }
-    if (m_all_types == nullptr) return true;
-    for (auto it : m_vars) {
+    if (m_reg_type_env == nullptr) return true;
+    for (auto it : m_cur_def) {
         if (it != nullptr) return false;
     }
     return true;
 }
 
 void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-    (*m_all_types)[reg_with_loc] = type;
-    m_vars[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+    (*m_reg_type_env)[reg_with_loc] = type;
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
 std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
-    auto it = m_all_types->find(reg);
-    if (it == m_all_types->end()) return {};
+    auto it = m_reg_type_env->find(reg);
+    if (it == m_reg_type_env->end()) return {};
     return it->second;
 }
 
 std::optional<ptr_t> register_types_t::find(register_t key) const {
-    if (m_vars[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_vars[key]);
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
     return find(reg);
 }
 
@@ -336,12 +377,12 @@ std::optional<ptr_t> stack_t::find(int key) const {
 
 bool type_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
-    return (m_stack.is_bottom() || m_types.is_bottom());
+    return (m_stack.is_bottom() || m_registers.is_bottom());
 }
 
 bool type_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_stack.is_top() && m_types.is_top());
+    return (m_stack.is_top() && m_registers.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -356,10 +397,11 @@ void type_domain_t::set_to_bottom() {
 
 void type_domain_t::set_to_top() {
     m_stack.set_to_top();
-    m_types.set_to_top();
+    m_registers.set_to_top();
 }
 
 bool type_domain_t::operator<=(const type_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
     return true;
 }
 
@@ -389,7 +431,7 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_types | other.m_types, m_stack | other.m_stack, other.m_ctx);
+    return type_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx);
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
@@ -399,7 +441,7 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_types | std::move(other.m_types), m_stack | std::move(other.m_stack), other.m_ctx);
+    return type_domain_t(m_registers | std::move(other.m_registers), m_stack | std::move(other.m_stack), other.m_ctx);
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -411,7 +453,7 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
 }
 
 void type_domain_t::write(std::ostream& os) const { 
-    os << m_types;
+    os << m_registers;
     os << m_stack << "\n";
 }
 
@@ -444,7 +486,7 @@ void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
         std::cout << "  " << u << ";\n";
         return;
     }
-    m_types -= u.dst.v;
+    m_registers -= u.dst.v;
 }
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet
@@ -458,7 +500,7 @@ void type_domain_t::operator()(const Call &u, location_t loc, int print) {
     auto r0 = reg_with_loc_t(r0_reg, loc);
     if (print > 0) {
         if (u.is_map_lookup) {
-            auto it = m_types.find(r0);
+            auto it = m_registers.find(r0);
             if (it) {
                 print_annotated(u, it.value(), std::cout);
             }
@@ -469,10 +511,10 @@ void type_domain_t::operator()(const Call &u, location_t loc, int print) {
     }
     if (u.is_map_lookup) {
         auto type = ptr_no_off_t(crab::region::T_SHARED);
-        m_types.insert(r0_reg, r0, type);
+        m_registers.insert(r0_reg, r0, type);
     }
     else {
-        m_types -= r0_reg;
+        m_registers -= r0_reg;
     }
 }
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
@@ -494,7 +536,7 @@ void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
         std::cout << "  " << u << ";\n";
         return;
     }
-    m_types -= register_t{0};
+    m_registers -= register_t{0};
 }
 void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
     if (is_bottom()) return;
@@ -539,7 +581,7 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
             if ((std::holds_alternative<Reg>(bin.v) && (bin.op == Bin::Op::MOV || bin.op == Bin::Op::ADD)) ||
             (std::holds_alternative<Imm>(bin.v) && bin.op == Bin::Op::ADD)) {
                 auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
-                auto it = m_types.find(reg_with_loc);
+                auto it = m_registers.find(reg_with_loc);
                 if (it) {
                     print_annotated(bin, it.value(), std::cout);
                     std::cout << "\n";
@@ -553,9 +595,9 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
 
     ptr_t dst_reg;
     if (bin.op == Bin::Op::ADD) {
-        auto it = m_types.find(bin.dst.v);
+        auto it = m_registers.find(bin.dst.v);
         if (!it) {
-            m_types -= bin.dst.v;
+            m_registers -= bin.dst.v;
             return;
         }
         dst_reg = it.value();
@@ -566,18 +608,18 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         switch (bin.op)
         {
             case Bin::Op::MOV: {
-                auto it1 = m_types.find(src.v);
+                auto it1 = m_registers.find(src.v);
                 if (!it1) {
                     //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
-                    m_types -= bin.dst.v;
+                    m_registers -= bin.dst.v;
                     break;
                 }
                 auto reg = reg_with_loc_t(bin.dst.v, loc);
-                m_types.insert(bin.dst.v, reg, it1.value());
+                m_registers.insert(bin.dst.v, reg, it1.value());
                 break;
             }
             case Bin::Op::ADD: {
-                auto it1 = m_types.find(src.v);
+                auto it1 = m_registers.find(src.v);
                 if (it1) {
                     std::string s = std::to_string(static_cast<unsigned int>(src.v));
                     std::string s1 = std::to_string(static_cast<unsigned int>(bin.dst.v));
@@ -594,17 +636,17 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
                         return;
                         */
                         m_stack.set_to_top();
-                        m_stack -= std::get<ptr_with_off_t>(dst_reg).offset;
+                        m_stack -= std::get<ptr_with_off_t>(dst_reg).get_offset();
                     }
                     else {
                         auto reg = reg_with_loc_t(bin.dst.v, loc);
-                        m_types.insert(bin.dst.v, reg, dst_reg);
+                        m_registers.insert(bin.dst.v, reg, dst_reg);
                     }
                 }
                 break;
             }
             default:
-                m_types -= bin.dst.v;
+                m_registers -= bin.dst.v;
                 break;
         }
     }
@@ -615,18 +657,18 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
             case Bin::Op::ADD: {
                 if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
                     auto ptr_with_off = std::get<ptr_with_off_t>(dst_reg);
-                    ptr_with_off.offset = ptr_with_off.offset + imm;
+                    ptr_with_off.set_offset(ptr_with_off.get_offset() + imm);
                     auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_types.insert(bin.dst.v, reg, ptr_with_off);
+                    m_registers.insert(bin.dst.v, reg, ptr_with_off);
                 }
                 else {
                     auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_types.insert(bin.dst.v, reg, dst_reg);
+                    m_registers.insert(bin.dst.v, reg, dst_reg);
                 }
                 break;
             }
             default: {
-                m_types -= bin.dst.v;
+                m_registers -= bin.dst.v;
                 break;
             }
         }
@@ -637,7 +679,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
 
     if (print > 0) {
         auto target_reg_loc = reg_with_loc_t(target_reg.v, loc);
-        auto it = m_types.find(target_reg_loc);
+        auto it = m_registers.find(target_reg_loc);
         if (it)
             print_annotated(b, it.value(), std::cout);
         else
@@ -647,7 +689,7 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = m_types.find(basereg.v);
+    auto it = m_registers.find(basereg.v);
     if (!it) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
@@ -658,21 +700,21 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
 
     if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
         //std::cout << "type_error: loading from either packet or shared region not allowed - r" << (int)basereg.v << "\n";
-        m_types -= target_reg.v;
+        m_registers -= target_reg.v;
         return;
     }
 
     ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
-    int load_at = offset+type_with_off.offset;
+    int load_at = offset+type_with_off.get_offset();
 
-    switch (type_with_off.r) {
+    switch (type_with_off.get_region()) {
         case crab::region::T_STACK: {
 
             auto it = m_stack.find(load_at);
 
             if (!it) {
                 //std::cout << "type_error: no field at loaded offset " << load_at << " in stack\n";
-                m_types -= target_reg.v;
+                m_registers -= target_reg.v;
                 return;
             }
             ptr_t type_loaded = it.value();
@@ -680,12 +722,12 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
             if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
                 ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_types.insert(target_reg.v, reg, type_loaded_with_off);
+                m_registers.insert(target_reg.v, reg, type_loaded_with_off);
             }
             else {
                 ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
                 auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_types.insert(target_reg.v, reg, type_loaded_no_off);
+                m_registers.insert(target_reg.v, reg, type_loaded_no_off);
             }
 
             break;
@@ -696,13 +738,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc,
 
             if (!it) {
                 //std::cout << "type_error: no field at loaded offset " << load_at << " in context\n";
-                m_types -= target_reg.v;
+                m_registers -= target_reg.v;
                 return;
             }
             ptr_no_off_t type_loaded = it.value();
 
             auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_types.insert(target_reg.v, reg, type_loaded);
+            m_registers.insert(target_reg.v, reg, type_loaded);
             break;
         }
 
@@ -722,7 +764,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
     Reg basereg = b.access.basereg;
     int width = b.access.width;
 
-    auto it = m_types.find(basereg.v);
+    auto it = m_registers.find(basereg.v);
     if (!it) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
@@ -731,14 +773,14 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
     }
     ptr_t type_basereg = it.value();
 
-    auto it2 = m_types.find(target_reg.v);
+    auto it2 = m_registers.find(target_reg.v);
 
     if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
         // base register is either CTX_P or STACK_P
         ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
 
-        int store_at = offset+type_basereg_with_off.offset;
-        if (type_basereg_with_off.r == crab::region::T_STACK) {
+        int store_at = offset+type_basereg_with_off.get_offset();
+        if (type_basereg_with_off.get_region() == crab::region::T_STACK) {
             // type of basereg is STACK_P
             if (!it2) {
                // std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
@@ -788,7 +830,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
                 //}
             }
         }
-        else if (type_basereg_with_off.r == crab::region::T_CTX) {
+        else if (type_basereg_with_off.get_region() == crab::region::T_CTX) {
             // type of basereg is CTX_P
             if (it2) {
                 std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
@@ -806,7 +848,7 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
 
         // if basereg is a stack_p with no offset, we do not store anything, and no type errors
         // if we later load with that pointer, we read nothing -- load is no-op
-        if (it2 && type_basereg_no_off.r != crab::region::T_STACK) {
+        if (it2 && type_basereg_no_off.get_region() != crab::region::T_STACK) {
             std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
             std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
             report_type_error(desc, loc);
@@ -840,14 +882,14 @@ void type_domain_t::print_initial_types() {
 
     std::cout << "Initial register types:\n";
     auto r1_with_loc = reg_with_loc_t(R1_ARG, loc);
-    auto it = m_types.find(r1_with_loc);
+    auto it = m_registers.find(r1_with_loc);
     if (it) {
         std::cout << "  ";
         print_type(R1_ARG, it.value());
         std::cout << "\n";
     }
     auto r10_with_loc = reg_with_loc_t(R10_STACK_POINTER, loc);
-    auto it2 = m_types.find(r10_with_loc);
+    auto it2 = m_registers.find(r10_with_loc);
     if (it2) {
         std::cout << "  ";
         print_type(R10_STACK_POINTER, it2.value());
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index ee7f3a117..67ce96114 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -19,49 +19,62 @@ enum class region {
 	T_SHARED
 };
 
-struct ptr_no_off_t {
-    region r;
 
+class ptr_no_off_t {
+    region m_r;
+
+  public:
     ptr_no_off_t() = default;
     ptr_no_off_t(const ptr_no_off_t &) = default;
     ptr_no_off_t(ptr_no_off_t &&) = default;
     ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
     ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-    ptr_no_off_t(region _r) : r(_r) {}
+    ptr_no_off_t(region _r) : m_r(_r) {}
 
+    constexpr region get_region() const;
+    void set_region(region);
+    void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
-    friend bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2);
-    friend bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2);
+    bool operator==(const ptr_no_off_t& p2);
+    bool operator!=(const ptr_no_off_t& p2);
 };
 
-struct ptr_with_off_t {
-    region r;
-    int offset;
+class ptr_with_off_t {
+    region m_r;
+    int m_offset;
 
+  public:
     ptr_with_off_t() = default;
     ptr_with_off_t(const ptr_with_off_t &) = default;
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region _r, int _off) : r(_r), offset(_off) {}
+    ptr_with_off_t(region _r, int _off) : m_r(_r), m_offset(_off) {}
 
+    constexpr int get_offset() const;
+    void set_offset(int);
+    constexpr region get_region() const;
+    void set_region(region);
+    void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
-    friend bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2);
-    friend bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2);
+    bool operator==(const ptr_with_off_t& p2);
+    bool operator!=(const ptr_with_off_t& p2);
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 using register_t = uint8_t;
 using location_t = boost::optional<std::pair<label_t, uint32_t>>;
 
-struct reg_with_loc_t {
-    register_t r;
-    location_t loc;
+class reg_with_loc_t {
+    register_t m_reg;
+    location_t m_loc;
 
-    reg_with_loc_t(register_t _r, location_t _loc) : r(_r), loc(_loc) {}
+  public:
+    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
     bool operator==(const reg_with_loc_t& other) const;
     std::size_t hash() const;
     friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
+    void write(std::ostream& ) const;
 };
 
 class ctx_t {
@@ -104,14 +117,14 @@ using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
 using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
 class register_types_t {
-    live_registers_t m_vars;
-    std::shared_ptr<global_type_env_t> m_all_types;
+    live_registers_t m_cur_def;
+    std::shared_ptr<global_type_env_t> m_reg_type_env;
     bool m_is_bottom = false;
 
   public:
-    register_types_t(bool is_bottom = false) : m_all_types(nullptr), m_is_bottom(is_bottom) {}
-    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> all_types, bool is_bottom = false)
-        : m_vars(std::move(vars)), m_all_types(all_types), m_is_bottom(is_bottom) {}
+    register_types_t(bool is_bottom = false) : m_reg_type_env(nullptr), m_is_bottom(is_bottom) {}
+    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> reg_type_env, bool is_bottom = false)
+        : m_cur_def(std::move(vars)), m_reg_type_env(reg_type_env), m_is_bottom(is_bottom) {}
 
     register_types_t operator|(const register_types_t& other) const;
     void operator-=(register_t var);
@@ -122,7 +135,7 @@ class register_types_t {
     void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type);
     std::optional<ptr_t> find(reg_with_loc_t reg) const;
     std::optional<ptr_t> find(register_t key) const;
-    const live_registers_t &get_vars() { return m_vars; }
+    const live_registers_t &get_vars() { return m_cur_def; }
     friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
 };
 
@@ -133,7 +146,7 @@ class type_domain_t final {
     bool m_is_bottom = false;
     location_t error_location = boost::none;
     crab::stack_t m_stack;
-    crab::register_types_t m_types;
+    crab::register_types_t m_registers;
     std::shared_ptr<crab::ctx_t> m_ctx;
 
   public:
@@ -144,7 +157,7 @@ class type_domain_t final {
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
     type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
-            : m_stack(std::move(_st)), m_types(std::move(_types)), m_ctx(_ctx) {}
+            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static type_domain_t setup_entry();
     // bottom/top

From 7d45c2dc3bf646d450345a61c71513e7f43d2db4 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Tue, 14 Jun 2022 15:50:35 -0400
Subject: [PATCH 096/373] Fix for the automatic build

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 8 ++++----
 src/crab/type_domain.hpp | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 2ea3b7f0e..bab04f9a9 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -134,8 +134,8 @@ bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
     return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
 }
 
-bool ptr_with_off_t::operator!=(const ptr_with_off_t& p2) {
-    return !(*this == p2);
+bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return !(p1 == p2);
 }
 
 void ptr_with_off_t::write(std::ostream& o) const {
@@ -159,8 +159,8 @@ bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
     return (p1.get_region() == p2.get_region());
 }
 
-bool ptr_no_off_t::operator!=(const ptr_no_off_t& p2) {
-    return !(*this == p2);
+bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return !(p1 == p2);
 }
 
 void ptr_no_off_t::write(std::ostream& o) const {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 67ce96114..0624e4f32 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -35,8 +35,8 @@ class ptr_no_off_t {
     void set_region(region);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
-    bool operator==(const ptr_no_off_t& p2);
-    bool operator!=(const ptr_no_off_t& p2);
+    //bool operator==(const ptr_no_off_t& p2);
+    //bool operator!=(const ptr_no_off_t& p2);
 };
 
 class ptr_with_off_t {
@@ -57,8 +57,8 @@ class ptr_with_off_t {
     void set_region(region);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
-    bool operator==(const ptr_with_off_t& p2);
-    bool operator!=(const ptr_with_off_t& p2);
+    //bool operator==(const ptr_with_off_t& p2);
+    //bool operator!=(const ptr_with_off_t& p2);
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;

From 07c5891fbde9209afe70763cc56721012ca481d2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@my.fsu.edu>
Date: Fri, 17 Jun 2022 10:32:04 -0400
Subject: [PATCH 097/373] A small change to implement forgetting of offsets in
 ctx and stack separately; does not affect functionality, as the case for ctx
 is empty yet;

Signed-off-by: Ameer Hamza <ah18r@my.fsu.edu>
---
 src/crab/type_domain.cpp | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index bab04f9a9..e20dc0fb7 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -629,14 +629,23 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
                 }
                 else {
                     if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                        // register to be added is not a pointer, but a number. its value is unknown
                         /*
                         std::string s = std::to_string(static_cast<unsigned int>(bin.dst.v));
                         std::string desc = std::string("\toffset of the pointer r") + s + " unknown\n";
                         report_type_error(desc, loc);
                         return;
                         */
-                        m_stack.set_to_top();
-                        m_stack -= std::get<ptr_with_off_t>(dst_reg).get_offset();
+                        ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
+                        if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
+                            m_stack.set_to_top();
+                            m_stack -= dst_reg_with_off.get_offset();
+                            return;
+                        }
+                        else {
+                            // currently, we do not read any other pointers from CTX except the ones already stored
+                            // in case we add the functionality, we will have to implement forgetting of CTX offsets
+                        }
                     }
                     else {
                         auto reg = reg_with_loc_t(bin.dst.v, loc);

From 42ebdeadd75b0c048b121e41fab1f575e79f6435 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 9 Jul 2023 16:34:57 -0400
Subject: [PATCH 098/373] Initial setting to incorporate region domain into
 type domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/config.hpp               |   2 +-
 src/crab/abstract_domain.cpp |   2 +
 src/crab/region_domain.cpp   | 950 +++++++++++++++++++++++++++++++++++
 src/crab/region_domain.hpp   | 215 ++++++++
 src/crab/type_domain.cpp     | 829 +-----------------------------
 src/crab/type_domain.hpp     | 137 -----
 src/crab_verifier.cpp        |   9 +-
 src/main/check.cpp           |   9 +-
 8 files changed, 1187 insertions(+), 966 deletions(-)
 create mode 100644 src/crab/region_domain.cpp
 create mode 100644 src/crab/region_domain.hpp

diff --git a/src/config.hpp b/src/config.hpp
index c425d8019..e0da39ee2 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN };
+enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN, REGION_DOMAIN };
 
 struct ebpf_verifier_options_t {
     bool check_termination;
diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 8a5fb1c7f..cc20d4189 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -1,6 +1,7 @@
 #include "abstract_domain.hpp"
 #include "ebpf_domain.hpp"
 #include "type_domain.hpp"
+#include "region_domain.hpp"
 
 template <typename Domain>
 abstract_domain_t::abstract_domain_model<Domain>::abstract_domain_model(Domain abs_val)
@@ -285,3 +286,4 @@ std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
 // REQUIRED: instantiation for supported domains
 template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
 template abstract_domain_t::abstract_domain_t(type_domain_t);
+template abstract_domain_t::abstract_domain_t(region_domain_t);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
new file mode 100644
index 000000000..cfaa59a57
--- /dev/null
+++ b/src/crab/region_domain.cpp
@@ -0,0 +1,950 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include <unordered_map>
+
+#include "crab/region_domain.hpp"
+
+using crab::___print___;
+using crab::ptr_t;
+using crab::ptr_with_off_t;
+using crab::ptr_no_off_t;
+using crab::ctx_t;
+using crab::global_type_env_t;
+using crab::reg_with_loc_t;
+using crab::live_registers_t;
+using crab::register_types_t;
+
+static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
+
+
+namespace std {
+    template <>
+    struct hash<crab::reg_with_loc_t> {
+        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    };
+
+    // does not seem to work for me
+    /*
+    template <>
+    struct equal_to<crab::ptr_t> {
+        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
+            if (p1.index() != p2.index()) return false;
+            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
+                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
+                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
+                return (ptr_no_off1.get_region() == ptr_no_off2.get_region());
+            }
+            else {
+                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
+                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
+                return (ptr_with_off1.get_region() == ptr_with_off2.get_region() && ptr_with_off1.get_offset() == ptr_with_off2.get_offset());
+            }
+        }
+    };
+
+    template <>
+    struct equal_to<crab::ptr_with_off_t> {
+        constexpr bool operator()(const crab::ptr_with_off_t& p1, const crab::ptr_with_off_t& p2) const {
+            return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
+        }
+    };
+
+    template <>
+    struct equal_to<crab::ptr_no_off_t> {
+        constexpr bool operator()(const crab::ptr_no_off_t& p1, const crab::ptr_no_off_t& p2) const {
+            return (p1.get_region() == p2.get_region());
+        }
+    };
+    */
+}
+
+
+static void print_ptr_type(const ptr_t& p) {
+    if (std::holds_alternative<ptr_with_off_t>(p)) {
+        auto t = std::get<ptr_with_off_t>(p);
+        std::cout << t;
+    }
+    else {
+        auto t = std::get<ptr_no_off_t>(p);
+        std::cout << t;
+    }
+}
+
+static void print_type(register_t r, const ptr_t& p) {
+    std::cout << "r" << static_cast<unsigned int>(r) << " : ";
+    print_ptr_type(p);
+}
+
+static void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
+    if (b.is_load) {
+        os_ << "  ";
+        print_type(std::get<Reg>(b.value).v, p);
+        os_ << " = ";
+    }
+    std::string sign = b.access.offset < 0 ? " - " : " + ";
+    int offset = std::abs(b.access.offset);
+    os_ << "*(" << size(b.access.width) << " *)";
+    os_ << "(" << b.access.basereg << sign << offset << ")\n";
+}
+
+static void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
+    os_ << "  ";
+    print_type(0, p);
+    os_ << " = " << call.name << ":" << call.func << "(...)\n";
+}
+
+static void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
+    os_ << "  ";
+    print_type(b.dst.v, p);
+    // add better checks as we add more support
+    if (std::holds_alternative<Reg>(b.v)) {
+        if (b.op == Bin::Op::MOV)
+            os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+        else if (b.op == Bin::Op::ADD)
+            os_ << " += r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
+    }
+    else {
+        if (b.op == Bin::Op::ADD)
+            os_ << " += " << static_cast<int>(std::get<Imm>(b.v).v) << ";";
+    }
+}
+
+namespace crab {
+
+inline std::string get_reg_ptr(const region& r) {
+    switch (r) {
+        case region::T_CTX:
+            return "ctx_p";
+        case region::T_STACK:
+            return "stack_p";
+        case region::T_PACKET:
+            return "packet_p";
+        default:
+            return "shared_p";
+    }
+}
+
+inline std::ostream& operator<<(std::ostream& o, const region& t) {
+    o << static_cast<std::underlying_type<region>::type>(t);
+    return o;
+}
+
+bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
+}
+
+bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return !(p1 == p2);
+}
+
+void ptr_with_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(m_r) << "<" << m_offset << ">";
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
+    p.write(o);
+    return o;
+}
+
+void ptr_with_off_t::set_offset(int off) { m_offset = off; }
+
+constexpr int ptr_with_off_t::get_offset() const { return m_offset; }
+
+void ptr_with_off_t::set_region(region r) { m_r = r; }
+
+constexpr region ptr_with_off_t::get_region() const { return m_r; }
+
+bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return (p1.get_region() == p2.get_region());
+}
+
+bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return !(p1 == p2);
+}
+
+void ptr_no_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(get_region());
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
+    p.write(o);
+    return o;
+}
+
+void ptr_no_off_t::set_region(region r) { m_r = r; }
+
+constexpr region ptr_no_off_t::get_region() const { return m_r; }
+
+void reg_with_loc_t::write(std::ostream& o) const {
+    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
+}
+
+std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
+    reg.write(o);
+    return o;
+}
+
+bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
+    return (m_reg == other.m_reg && m_loc == other.m_loc);
+}
+
+std::size_t reg_with_loc_t::hash() const {
+    // Similar to boost::hash_combine
+    using std::hash;
+
+    std::size_t seed = hash<register_t>()(m_reg);
+    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+
+    return seed;
+}
+
+std::ostream& operator<<(std::ostream& o, const stack_t& st) {
+    o << "Stack: ";
+    if (st.is_bottom())
+        o << "_|_\n";
+    else {
+        o << "{";
+        for (auto s : st.m_ptrs) {
+            o << s.first << ": ";
+            print_ptr_type(s.second);
+            o << ", ";
+        }
+        o << "}";
+    }
+    return o;
+}
+
+std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
+
+    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "top" : "") << "\n";
+    for (const auto& it : _ctx.m_packet_ptrs) {
+        o << "  stores at " << it.first << ": " << it.second << "\n";
+    }
+    return o;
+}
+
+ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
+{
+    if (desc->data != -1)
+        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->end != -1)
+        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->meta != -1)
+        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region::T_PACKET);
+}
+
+std::optional<ptr_no_off_t> ctx_t::find(int key) const {
+    auto it = m_packet_ptrs.find(key);
+    if (it == m_packet_ptrs.end()) return {};
+    return it->second;
+}
+
+
+std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
+    if (typ.is_bottom())
+        o << "_|_\n";
+    else {
+        for (const auto& v : *(typ.m_reg_type_env)) {
+            o << v.first << ": ";
+            print_ptr_type(v.second);
+            o << "\n";
+        }
+    }
+    return o;
+}
+
+register_types_t register_types_t::operator|(const register_types_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    live_registers_t out_vars;
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2 && it1.value() == it2.value()) {
+            out_vars[i] = m_cur_def[i];
+        }
+    }
+
+    return register_types_t(std::move(out_vars), m_reg_type_env, false);
+}
+
+void register_types_t::operator-=(register_t var) {
+    if (is_bottom()) {
+        return;
+    }
+    m_cur_def[var] = nullptr;
+}
+
+void register_types_t::set_to_bottom() {
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = true;
+}
+
+void register_types_t::set_to_top() {
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+bool register_types_t::is_bottom() const { return m_is_bottom; }
+
+bool register_types_t::is_top() const {
+    if (m_is_bottom) { return false; }
+    if (m_reg_type_env == nullptr) return true;
+    for (auto it : m_cur_def) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
+    (*m_reg_type_env)[reg_with_loc] = type;
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
+    auto it = m_reg_type_env->find(reg);
+    if (it == m_reg_type_env->end()) return {};
+    return it->second;
+}
+
+std::optional<ptr_t> register_types_t::find(register_t key) const {
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    return find(reg);
+}
+
+stack_t stack_t::operator|(const stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    offset_to_ptr_t out_ptrs;
+    for (auto const&kv: m_ptrs) {
+        auto it = other.find(kv.first);
+        if (it && kv.second == it.value())
+            out_ptrs.insert(kv);
+    }
+    return stack_t(std::move(out_ptrs), false);
+}
+
+void stack_t::operator-=(int key) {
+    auto it = find(key);
+    if (it)
+        m_ptrs.erase(key);
+}
+
+void stack_t::set_to_bottom() {
+    m_ptrs.clear();
+    m_is_bottom = true;
+}
+
+void stack_t::set_to_top() {
+    m_ptrs.clear();
+    m_is_bottom = false;
+}
+
+stack_t stack_t::bottom() { return stack_t(true); }
+
+stack_t stack_t::top() { return stack_t(false); }
+
+bool stack_t::is_bottom() const { return m_is_bottom; }
+
+bool stack_t::is_top() const {
+    if (m_is_bottom)
+        return false;
+    return m_ptrs.empty();
+}
+
+void stack_t::insert(int key, ptr_t value) {
+    m_ptrs[key] = value;
+}
+
+std::optional<ptr_t> stack_t::find(int key) const {
+    auto it = m_ptrs.find(key);
+    if (it == m_ptrs.end()) return {};
+    return it->second;
+}
+
+}
+
+bool region_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
+    return (m_stack.is_bottom() || m_registers.is_bottom());
+}
+
+bool region_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_stack.is_top() && m_registers.is_top());
+}
+
+region_domain_t region_domain_t::bottom() {
+    region_domain_t typ;
+    typ.set_to_bottom();
+    return typ;
+}
+
+void region_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+void region_domain_t::set_to_top() {
+    m_stack.set_to_top();
+    m_registers.set_to_top();
+}
+
+bool region_domain_t::operator<=(const region_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return true;
+}
+
+void region_domain_t::operator|=(const region_domain_t& abs) {
+    region_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void region_domain_t::operator|=(region_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+region_domain_t region_domain_t::operator|(const region_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx);
+}
+
+region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return region_domain_t(m_registers | std::move(other.m_registers), m_stack | std::move(other.m_stack), other.m_ctx);
+}
+
+region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
+    return abs;
+}
+
+region_domain_t region_domain_t::widen(const region_domain_t& abs, bool to_constants) {
+    return abs;
+}
+
+region_domain_t region_domain_t::narrow(const region_domain_t& other) const {
+    return other;
+}
+
+void region_domain_t::write(std::ostream& os) const { 
+    os << m_registers;
+    os << m_stack << "\n";
+}
+
+std::string region_domain_t::domain_name() const {
+    return "type_domain";
+}
+
+crab::bound_t region_domain_t::get_loop_count_upper_bound() {
+    // WARNING: Not implemented yet.
+    return crab::bound_t{crab::number_t{0}};
+}
+
+void region_domain_t::initialize_loop_counter(const label_t& label) {
+    // WARNING: Not implemented yet.
+}
+
+string_invariant region_domain_t::to_set() {
+    return string_invariant{};
+}
+
+void region_domain_t::operator()(const Undefined & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+void region_domain_t::operator()(const Un &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        std::cout << "  " << u << ";\n";
+        return;
+    }
+    m_registers -= u.dst.v;
+}
+void region_domain_t::operator()(const Call &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    register_t r0_reg{R0_RETURN_VALUE};
+    auto r0 = reg_with_loc_t(r0_reg, loc);
+    if (print > 0) {
+        if (u.is_map_lookup) {
+            auto it = m_registers.find(r0);
+            if (it) {
+                print_annotated(u, it.value(), std::cout);
+            }
+        }
+        else
+            std::cout << "  " << u << ";\n";
+        return;
+    }
+    if (u.is_map_lookup) {
+        auto type = ptr_no_off_t(crab::region::T_SHARED);
+        m_registers.insert(r0_reg, r0, type);
+    }
+    else {
+        m_registers -= r0_reg;
+    }
+}
+void region_domain_t::operator()(const Callx &u, location_t loc, int print) {
+    // WARNING: Not implemented yet.
+}
+void region_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
+    // WARNING: Not implemented yet.
+}
+void region_domain_t::operator()(const Atomic &u, location_t loc, int print) {
+    // WARNING: Not implemented yet.
+}
+void region_domain_t::operator()(const Exit &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+void region_domain_t::operator()(const Jmp &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+void region_domain_t::operator()(const Packet & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        std::cout << "  " << u << ";\n";
+        return;
+    }
+    m_registers -= register_t{0};
+}
+void region_domain_t::operator()(const Assume &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+void region_domain_t::operator()(const Assert &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0)
+        std::cout << "  " << u << ";\n";
+}
+
+region_domain_t region_domain_t::setup_entry() {
+
+    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
+    std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
+
+    live_registers_t vars;
+    register_types_t typ(std::move(vars), all_types);
+
+    auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
+    auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
+
+    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
+    typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
+
+    region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
+    return inv;
+}
+
+void region_domain_t::report_type_error(std::string s, location_t loc) {
+    std::cout << "type_error at line " << loc->second << " in bb " << loc->first << "\n";
+    std::cout << s;
+    error_location = loc;
+    set_to_bottom();
+}
+
+void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+    if (is_bottom()) return;
+    if (print > 0) {
+        if (print == 2) {
+            if ((std::holds_alternative<Reg>(bin.v) && (bin.op == Bin::Op::MOV || bin.op == Bin::Op::ADD)) ||
+            (std::holds_alternative<Imm>(bin.v) && bin.op == Bin::Op::ADD)) {
+                auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
+                auto it = m_registers.find(reg_with_loc);
+                if (it) {
+                    print_annotated(bin, it.value(), std::cout);
+                    std::cout << "\n";
+                    return;
+                }
+            }
+        }
+        std::cout << "  " << bin << ";\n";
+        return;
+    }
+
+    ptr_t dst_reg;
+    if (bin.op == Bin::Op::ADD) {
+        auto it = m_registers.find(bin.dst.v);
+        if (!it) {
+            m_registers -= bin.dst.v;
+            return;
+        }
+        dst_reg = it.value();
+    }
+
+    if (std::holds_alternative<Reg>(bin.v)) {
+        Reg src = std::get<Reg>(bin.v);
+        switch (bin.op)
+        {
+            case Bin::Op::MOV: {
+                auto it1 = m_registers.find(src.v);
+                if (!it1) {
+                    //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
+                    m_registers -= bin.dst.v;
+                    break;
+                }
+                auto reg = reg_with_loc_t(bin.dst.v, loc);
+                m_registers.insert(bin.dst.v, reg, it1.value());
+                break;
+            }
+            case Bin::Op::ADD: {
+                auto it1 = m_registers.find(src.v);
+                if (it1) {
+                    std::string s = std::to_string(static_cast<unsigned int>(src.v));
+                    std::string s1 = std::to_string(static_cast<unsigned int>(bin.dst.v));
+                    std::string desc = std::string("\taddition of two pointers, r") + s + " and r" + s1 + " not allowed\n";
+                    report_type_error(desc, loc);
+                    return;
+                }
+                else {
+                    if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                        // register to be added is not a pointer, but a number. its value is unknown
+                        /*
+                        std::string s = std::to_string(static_cast<unsigned int>(bin.dst.v));
+                        std::string desc = std::string("\toffset of the pointer r") + s + " unknown\n";
+                        report_type_error(desc, loc);
+                        return;
+                        */
+                        ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
+                        if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
+                            m_stack.set_to_top();
+                            m_stack -= dst_reg_with_off.get_offset();
+                            return;
+                        }
+                        else {
+                            // currently, we do not read any other pointers from CTX except the ones already stored
+                            // in case we add the functionality, we will have to implement forgetting of CTX offsets
+                        }
+                    }
+                    else {
+                        auto reg = reg_with_loc_t(bin.dst.v, loc);
+                        m_registers.insert(bin.dst.v, reg, dst_reg);
+                    }
+                }
+                break;
+            }
+            default:
+                m_registers -= bin.dst.v;
+                break;
+        }
+    }
+    else {
+        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
+        switch (bin.op)
+        {
+            case Bin::Op::ADD: {
+                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                    auto ptr_with_off = std::get<ptr_with_off_t>(dst_reg);
+                    ptr_with_off.set_offset(ptr_with_off.get_offset() + imm);
+                    auto reg = reg_with_loc_t(bin.dst.v, loc);
+                    m_registers.insert(bin.dst.v, reg, ptr_with_off);
+                }
+                else {
+                    auto reg = reg_with_loc_t(bin.dst.v, loc);
+                    m_registers.insert(bin.dst.v, reg, dst_reg);
+                }
+                break;
+            }
+            default: {
+                m_registers -= bin.dst.v;
+                break;
+            }
+        }
+    }
+}
+
+void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+
+    if (print > 0) {
+        auto target_reg_loc = reg_with_loc_t(target_reg.v, loc);
+        auto it = m_registers.find(target_reg_loc);
+        if (it)
+            print_annotated(b, it.value(), std::cout);
+        else
+            std::cout << "  " << b << ";\n";
+        return;
+    }
+    int offset = b.access.offset;
+    Reg basereg = b.access.basereg;
+
+    auto it = m_registers.find(basereg.v);
+    if (!it) {
+        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+        std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
+        report_type_error(desc, loc);
+        return;
+    }
+    ptr_t type_basereg = it.value();
+
+    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
+        //std::cout << "type_error: loading from either packet or shared region not allowed - r" << (int)basereg.v << "\n";
+        m_registers -= target_reg.v;
+        return;
+    }
+
+    ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
+    int load_at = offset+type_with_off.get_offset();
+
+    switch (type_with_off.get_region()) {
+        case crab::region::T_STACK: {
+
+            auto it = m_stack.find(load_at);
+
+            if (!it) {
+                //std::cout << "type_error: no field at loaded offset " << load_at << " in stack\n";
+                m_registers -= target_reg.v;
+                return;
+            }
+            ptr_t type_loaded = it.value();
+
+            if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
+                ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
+                auto reg = reg_with_loc_t(target_reg.v, loc);
+                m_registers.insert(target_reg.v, reg, type_loaded_with_off);
+            }
+            else {
+                ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
+                auto reg = reg_with_loc_t(target_reg.v, loc);
+                m_registers.insert(target_reg.v, reg, type_loaded_no_off);
+            }
+
+            break;
+        }
+        case crab::region::T_CTX: {
+
+            auto it = m_ctx->find(load_at);
+
+            if (!it) {
+                //std::cout << "type_error: no field at loaded offset " << load_at << " in context\n";
+                m_registers -= target_reg.v;
+                return;
+            }
+            ptr_no_off_t type_loaded = it.value();
+
+            auto reg = reg_with_loc_t(target_reg.v, loc);
+            m_registers.insert(target_reg.v, reg, type_loaded);
+            break;
+        }
+
+        default: {
+            assert(false);
+        }
+    }
+}
+
+void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+
+    if (print > 0) {
+        std::cout << "  " << b << ";\n";
+        return;
+    }
+    int offset = b.access.offset;
+    Reg basereg = b.access.basereg;
+    int width = b.access.width;
+
+    auto it = m_registers.find(basereg.v);
+    if (!it) {
+        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+        std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
+        report_type_error(desc, loc);
+        return;
+    }
+    ptr_t type_basereg = it.value();
+
+    auto it2 = m_registers.find(target_reg.v);
+
+    if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
+        // base register is either CTX_P or STACK_P
+        ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
+
+        int store_at = offset+type_basereg_with_off.get_offset();
+        if (type_basereg_with_off.get_region() == crab::region::T_STACK) {
+            // type of basereg is STACK_P
+            if (!it2) {
+               // std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
+                m_stack -= store_at;
+                return;
+            }
+            else {
+                auto type_to_store = it2.value();
+                /*
+                if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
+                        std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
+                    std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+                    std::string desc = std::string("\twe cannot store stack pointer, r") + s + ", into stack\n";
+                    //report_type_error(desc, loc);
+                    return;
+                }
+                else {
+                */
+                    for (auto i = store_at+1; i < store_at+width; i++) {
+                        auto it3 = m_stack.find(i);
+                        if (it3) {
+                            std::string s = std::to_string(store_at);
+                            std::string s1 = std::to_string(i);
+                            std::string desc = std::string("\ttype being stored into stack at ") + s + " is overlapping with already stored at " + s1 + "\n";
+                            report_type_error(desc, loc);
+                            return;
+                        }
+                    }
+                    m_stack.insert(store_at, type_to_store);
+                    // revise: code below checks if there is already something stored at same location, the type should be the same -- it is very restricted and not required.
+                    // However, when we support storing info like width of type, we need more checks
+                    /*
+                    auto it4 = m_stack.find(store_at);
+                    if (it4) {
+                        auto type_in_stack = it4.value();
+                        if (type_to_store != type_in_stack) {
+                            std::string s = std::to_string(store_at);
+                            std::string desc = std::string("\ttype being stored at offset ") + s + " is not the same as already stored in stack\n";
+                            report_type_error(desc, loc);
+                            return;
+                        }
+                    }
+                    else {
+                        m_stack.insert(store_at, type_to_store);
+                    }
+                    */
+                //}
+            }
+        }
+        else if (type_basereg_with_off.get_region() == crab::region::T_CTX) {
+            // type of basereg is CTX_P
+            if (it2) {
+                std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+                std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into ctx\n";
+                report_type_error(desc, loc);
+                return;
+            }
+        }
+        else
+            assert(false);
+    }
+    else {
+        // base register type is either PACKET_P, SHARED_P or STACK_P without known offset
+        ptr_no_off_t type_basereg_no_off = std::get<ptr_no_off_t>(type_basereg);
+
+        // if basereg is a stack_p with no offset, we do not store anything, and no type errors
+        // if we later load with that pointer, we read nothing -- load is no-op
+        if (it2 && type_basereg_no_off.get_region() != crab::region::T_STACK) {
+            std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
+            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
+            report_type_error(desc, loc);
+            return;
+        }
+    }
+}
+
+void region_domain_t::operator()(const Mem& b, location_t loc, int print) {
+    if (is_bottom()) return;
+
+    if (std::holds_alternative<Reg>(b.value)) {
+        if (b.is_load) {
+            do_load(b, std::get<Reg>(b.value), loc, print);
+        } else {
+            do_mem_store(b, std::get<Reg>(b.value), loc, print);
+        }
+    } else {
+        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
+        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
+        report_type_error(desc, loc);
+        return;
+    }
+}
+
+void region_domain_t::print_initial_types() {
+    auto label = label_t::entry;
+    location_t loc = location_t(std::make_pair(label, 0));
+    std::cout << "\n" << *m_ctx << "\n";
+    std::cout << m_stack << "\n";
+
+    std::cout << "Initial register types:\n";
+    auto r1_with_loc = reg_with_loc_t(R1_ARG, loc);
+    auto it = m_registers.find(r1_with_loc);
+    if (it) {
+        std::cout << "  ";
+        print_type(R1_ARG, it.value());
+        std::cout << "\n";
+    }
+    auto r10_with_loc = reg_with_loc_t(R10_STACK_POINTER, loc);
+    auto it2 = m_registers.find(r10_with_loc);
+    if (it2) {
+        std::cout << "  ";
+        print_type(R10_STACK_POINTER, it2.value());
+        std::cout << "\n";
+    }
+    std::cout << "\n";
+}
+
+void region_domain_t::operator()(const basic_block_t& bb, bool check_termination, int print) {
+    auto label = bb.label();
+    uint32_t curr_pos = 0;
+    location_t loc;
+    if (print > 0) {
+        if (label == label_t::entry) {
+            print_initial_types();
+            m_is_bottom = false;
+        }
+        std::cout << label << ":\n";
+    }
+
+    for (const Instruction& statement : bb) {
+        loc = location_t(std::make_pair(label, ++curr_pos));
+        if (print > 0) std::cout << " " << curr_pos << ".";
+        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
+        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) std::cout << "type_error\n";
+    }
+
+    if (print > 0) {
+        auto [it, et] = bb.next_blocks();
+        if (it != et) {
+            std::cout << "  "
+            << "goto ";
+            for (; it != et;) {
+                std::cout << *it;
+                ++it;
+                if (it == et) {
+                    std::cout << ";";
+                } else {
+                    std::cout << ",";
+                }
+            }
+        }
+        std::cout << "\n\n";
+    }
+}
+
+void region_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
new file mode 100644
index 000000000..8c72cb874
--- /dev/null
+++ b/src/crab/region_domain.hpp
@@ -0,0 +1,215 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <unordered_map>
+
+#include "crab/abstract_domain.hpp"
+#include "crab/cfg.hpp"
+#include "linear_constraint.hpp"
+#include "string_constraints.hpp"
+
+namespace crab {
+
+enum class region {
+	T_CTX,
+	T_STACK,
+	T_PACKET,
+	T_SHARED
+};
+
+
+class ptr_no_off_t {
+    region m_r;
+
+  public:
+    ptr_no_off_t() = default;
+    ptr_no_off_t(const ptr_no_off_t &) = default;
+    ptr_no_off_t(ptr_no_off_t &&) = default;
+    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
+    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
+    ptr_no_off_t(region _r) : m_r(_r) {}
+
+    constexpr region get_region() const;
+    void set_region(region);
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
+    //bool operator==(const ptr_no_off_t& p2);
+    //bool operator!=(const ptr_no_off_t& p2);
+};
+
+class ptr_with_off_t {
+    region m_r;
+    int m_offset;
+
+  public:
+    ptr_with_off_t() = default;
+    ptr_with_off_t(const ptr_with_off_t &) = default;
+    ptr_with_off_t(ptr_with_off_t &&) = default;
+    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
+    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
+    ptr_with_off_t(region _r, int _off) : m_r(_r), m_offset(_off) {}
+
+    constexpr int get_offset() const;
+    void set_offset(int);
+    constexpr region get_region() const;
+    void set_region(region);
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
+    //bool operator==(const ptr_with_off_t& p2);
+    //bool operator!=(const ptr_with_off_t& p2);
+};
+
+using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+using register_t = uint8_t;
+using location_t = boost::optional<std::pair<label_t, uint32_t>>;
+
+class reg_with_loc_t {
+    register_t m_reg;
+    location_t m_loc;
+
+  public:
+    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
+    bool operator==(const reg_with_loc_t& other) const;
+    std::size_t hash() const;
+    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
+    void write(std::ostream& ) const;
+};
+
+class ctx_t {
+    using offset_to_ptr_no_off_t = std::unordered_map<int, ptr_no_off_t>;
+
+    offset_to_ptr_no_off_t m_packet_ptrs;
+
+  public:
+    ctx_t(const ebpf_context_descriptor_t* desc);
+    std::optional<ptr_no_off_t> find(int key) const;
+    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx);
+};
+
+class stack_t {
+    using offset_to_ptr_t = std::unordered_map<int, ptr_t>;
+
+    offset_to_ptr_t m_ptrs;
+    bool m_is_bottom;
+
+  public:
+    stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+    stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
+    : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
+    
+    stack_t operator|(const stack_t& other) const;
+    void operator-=(int);
+    void set_to_bottom();
+    void set_to_top();
+    static stack_t bottom();
+    static stack_t top();
+    bool is_bottom() const;
+    bool is_top() const;
+    const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
+    void insert(int key, ptr_t value);
+    std::optional<ptr_t> find(int key) const;
+    friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
+};
+
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+
+class register_types_t {
+    live_registers_t m_cur_def;
+    std::shared_ptr<global_type_env_t> m_reg_type_env;
+    bool m_is_bottom = false;
+
+  public:
+    register_types_t(bool is_bottom = false) : m_reg_type_env(nullptr), m_is_bottom(is_bottom) {}
+    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> reg_type_env, bool is_bottom = false)
+        : m_cur_def(std::move(vars)), m_reg_type_env(reg_type_env), m_is_bottom(is_bottom) {}
+
+    register_types_t operator|(const register_types_t& other) const;
+    void operator-=(register_t var);
+    void set_to_bottom();
+    void set_to_top();
+    bool is_bottom() const;
+    bool is_top() const;
+    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type);
+    std::optional<ptr_t> find(reg_with_loc_t reg) const;
+    std::optional<ptr_t> find(register_t key) const;
+    const live_registers_t &get_vars() { return m_cur_def; }
+    friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
+};
+
+}
+
+class region_domain_t final {
+
+    bool m_is_bottom = false;
+    location_t error_location = boost::none;
+    crab::stack_t m_stack;
+    crab::register_types_t m_registers;
+    std::shared_ptr<crab::ctx_t> m_ctx;
+
+  public:
+
+    region_domain_t() = default;
+    region_domain_t(region_domain_t&& o) = default;
+    region_domain_t(const region_domain_t& o) = default;
+    region_domain_t& operator=(region_domain_t&& o) = default;
+    region_domain_t& operator=(const region_domain_t& o) = default;
+    region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
+            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx) {}
+    // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+    static region_domain_t setup_entry();
+    // bottom/top
+    static region_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const region_domain_t& other) const;
+    // join
+    void operator|=(const region_domain_t& abs);
+    void operator|=(region_domain_t&& abs);
+    region_domain_t operator|(const region_domain_t& other) const;
+    region_domain_t operator|(region_domain_t&& abs) const;
+    // meet
+    region_domain_t operator&(const region_domain_t& other) const;
+    // widening
+    region_domain_t widen(const region_domain_t& other, bool);
+    // narrowing
+    region_domain_t narrow(const region_domain_t& other) const;
+    //forget
+    void operator-=(crab::variable_t var);
+
+    //// abstract transformers
+    void operator()(const Undefined &, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin &, location_t loc = boost::none, int print = 0);
+    void operator()(const Un &, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd &, location_t loc = boost::none, int print = 0);
+    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
+    void operator()(const Call &, location_t loc = boost::none, int print = 0);
+    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit &, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp &, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem &, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet &, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume &, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert &, location_t loc = boost::none, int print = 0);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
+    void operator()(const basic_block_t& bb, bool check_termination, int print = 0);
+    void write(std::ostream& os) const;
+    std::string domain_name() const;
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t&);
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
+
+  private:
+
+    void do_load(const Mem&, const Reg&, location_t, int print = 0);
+    void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
+    void print_initial_types();
+    void report_type_error(std::string, location_t);
+
+}; // end region_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index e20dc0fb7..05528508f 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -5,384 +5,15 @@
 
 #include "crab/type_domain.hpp"
 
-using crab::___print___;
-using crab::ptr_t;
-using crab::ptr_with_off_t;
-using crab::ptr_no_off_t;
-using crab::ctx_t;
-using crab::global_type_env_t;
-using crab::reg_with_loc_t;
-using crab::live_registers_t;
-using crab::register_types_t;
-
 static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
 
 
-namespace std {
-    template <>
-    struct hash<crab::reg_with_loc_t> {
-        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
-    };
-
-    // does not seem to work for me
-    /*
-    template <>
-    struct equal_to<crab::ptr_t> {
-        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
-            if (p1.index() != p2.index()) return false;
-            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
-                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
-                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
-                return (ptr_no_off1.get_region() == ptr_no_off2.get_region());
-            }
-            else {
-                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
-                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
-                return (ptr_with_off1.get_region() == ptr_with_off2.get_region() && ptr_with_off1.get_offset() == ptr_with_off2.get_offset());
-            }
-        }
-    };
-
-    template <>
-    struct equal_to<crab::ptr_with_off_t> {
-        constexpr bool operator()(const crab::ptr_with_off_t& p1, const crab::ptr_with_off_t& p2) const {
-            return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
-        }
-    };
-
-    template <>
-    struct equal_to<crab::ptr_no_off_t> {
-        constexpr bool operator()(const crab::ptr_no_off_t& p1, const crab::ptr_no_off_t& p2) const {
-            return (p1.get_region() == p2.get_region());
-        }
-    };
-    */
-}
-
-
-static void print_ptr_type(const ptr_t& p) {
-    if (std::holds_alternative<ptr_with_off_t>(p)) {
-        auto t = std::get<ptr_with_off_t>(p);
-        std::cout << t;
-    }
-    else {
-        auto t = std::get<ptr_no_off_t>(p);
-        std::cout << t;
-    }
-}
-
-static void print_type(register_t r, const ptr_t& p) {
-    std::cout << "r" << static_cast<unsigned int>(r) << " : ";
-    print_ptr_type(p);
-}
-
-static void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
-    if (b.is_load) {
-        os_ << "  ";
-        print_type(std::get<Reg>(b.value).v, p);
-        os_ << " = ";
-    }
-    std::string sign = b.access.offset < 0 ? " - " : " + ";
-    int offset = std::abs(b.access.offset);
-    os_ << "*(" << size(b.access.width) << " *)";
-    os_ << "(" << b.access.basereg << sign << offset << ")\n";
-}
-
-static void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
-    os_ << "  ";
-    print_type(0, p);
-    os_ << " = " << call.name << ":" << call.func << "(...)\n";
-}
-
-static void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
-    os_ << "  ";
-    print_type(b.dst.v, p);
-    // add better checks as we add more support
-    if (std::holds_alternative<Reg>(b.v)) {
-        if (b.op == Bin::Op::MOV)
-            os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
-        else if (b.op == Bin::Op::ADD)
-            os_ << " += r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
-    }
-    else {
-        if (b.op == Bin::Op::ADD)
-            os_ << " += " << static_cast<int>(std::get<Imm>(b.v).v) << ";";
-    }
-}
-
-namespace crab {
-
-inline std::string get_reg_ptr(const region& r) {
-    switch (r) {
-        case region::T_CTX:
-            return "ctx_p";
-        case region::T_STACK:
-            return "stack_p";
-        case region::T_PACKET:
-            return "packet_p";
-        default:
-            return "shared_p";
-    }
-}
-
-inline std::ostream& operator<<(std::ostream& o, const region& t) {
-    o << static_cast<std::underlying_type<region>::type>(t);
-    return o;
-}
-
-bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
-}
-
-bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return !(p1 == p2);
-}
-
-void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r) << "<" << m_offset << ">";
-}
-
-std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-    p.write(o);
-    return o;
-}
-
-void ptr_with_off_t::set_offset(int off) { m_offset = off; }
-
-constexpr int ptr_with_off_t::get_offset() const { return m_offset; }
-
-void ptr_with_off_t::set_region(region r) { m_r = r; }
-
-constexpr region ptr_with_off_t::get_region() const { return m_r; }
-
-bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return (p1.get_region() == p2.get_region());
-}
-
-bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return !(p1 == p2);
-}
-
-void ptr_no_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(get_region());
-}
-
-std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-    p.write(o);
-    return o;
-}
-
-void ptr_no_off_t::set_region(region r) { m_r = r; }
-
-constexpr region ptr_no_off_t::get_region() const { return m_r; }
-
-void reg_with_loc_t::write(std::ostream& o) const {
-    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
-}
-
-std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    reg.write(o);
-    return o;
-}
-
-bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
-    return (m_reg == other.m_reg && m_loc == other.m_loc);
-}
-
-std::size_t reg_with_loc_t::hash() const {
-    // Similar to boost::hash_combine
-    using std::hash;
-
-    std::size_t seed = hash<register_t>()(m_reg);
-    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-
-    return seed;
-}
-
-std::ostream& operator<<(std::ostream& o, const stack_t& st) {
-    o << "Stack: ";
-    if (st.is_bottom())
-        o << "_|_\n";
-    else {
-        o << "{";
-        for (auto s : st.m_ptrs) {
-            o << s.first << ": ";
-            print_ptr_type(s.second);
-            o << ", ";
-        }
-        o << "}";
-    }
-    return o;
-}
-
-std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
-
-    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "top" : "") << "\n";
-    for (const auto& it : _ctx.m_packet_ptrs) {
-        o << "  stores at " << it.first << ": " << it.second << "\n";
-    }
-    return o;
-}
-
-ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
-{
-    if (desc->data != -1)
-        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
-    if (desc->end != -1)
-        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
-    if (desc->meta != -1)
-        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region::T_PACKET);
-}
-
-std::optional<ptr_no_off_t> ctx_t::find(int key) const {
-    auto it = m_packet_ptrs.find(key);
-    if (it == m_packet_ptrs.end()) return {};
-    return it->second;
-}
-
-
-std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
-    if (typ.is_bottom())
-        o << "_|_\n";
-    else {
-        for (const auto& v : *(typ.m_reg_type_env)) {
-            o << v.first << ": ";
-            print_ptr_type(v.second);
-            o << "\n";
-        }
-    }
-    return o;
-}
-
-register_types_t register_types_t::operator|(const register_types_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    } else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    live_registers_t out_vars;
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
-        if (it1 && it2 && it1.value() == it2.value()) {
-            out_vars[i] = m_cur_def[i];
-        }
-    }
-
-    return register_types_t(std::move(out_vars), m_reg_type_env, false);
-}
-
-void register_types_t::operator-=(register_t var) {
-    if (is_bottom()) {
-        return;
-    }
-    m_cur_def[var] = nullptr;
-}
-
-void register_types_t::set_to_bottom() {
-    m_cur_def = live_registers_t{nullptr};
-    m_is_bottom = true;
-}
-
-void register_types_t::set_to_top() {
-    m_cur_def = live_registers_t{nullptr};
-    m_is_bottom = false;
-}
-
-bool register_types_t::is_bottom() const { return m_is_bottom; }
-
-bool register_types_t::is_top() const {
-    if (m_is_bottom) { return false; }
-    if (m_reg_type_env == nullptr) return true;
-    for (auto it : m_cur_def) {
-        if (it != nullptr) return false;
-    }
-    return true;
-}
-
-void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-    (*m_reg_type_env)[reg_with_loc] = type;
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
-}
-
-std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
-    auto it = m_reg_type_env->find(reg);
-    if (it == m_reg_type_env->end()) return {};
-    return it->second;
-}
-
-std::optional<ptr_t> register_types_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
-    return find(reg);
-}
-
-stack_t stack_t::operator|(const stack_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    } else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    offset_to_ptr_t out_ptrs;
-    for (auto const&kv: m_ptrs) {
-        auto it = other.find(kv.first);
-        if (it && kv.second == it.value())
-            out_ptrs.insert(kv);
-    }
-    return stack_t(std::move(out_ptrs), false);
-}
-
-void stack_t::operator-=(int key) {
-    auto it = find(key);
-    if (it)
-        m_ptrs.erase(key);
-}
-
-void stack_t::set_to_bottom() {
-    m_ptrs.clear();
-    m_is_bottom = true;
-}
-
-void stack_t::set_to_top() {
-    m_ptrs.clear();
-    m_is_bottom = false;
-}
-
-stack_t stack_t::bottom() { return stack_t(true); }
-
-stack_t stack_t::top() { return stack_t(false); }
-
-bool stack_t::is_bottom() const { return m_is_bottom; }
-
-bool stack_t::is_top() const {
-    if (m_is_bottom)
-        return false;
-    return m_ptrs.empty();
-}
-
-void stack_t::insert(int key, ptr_t value) {
-    m_ptrs[key] = value;
-}
-
-std::optional<ptr_t> stack_t::find(int key) const {
-    auto it = m_ptrs.find(key);
-    if (it == m_ptrs.end()) return {};
-    return it->second;
-}
-
-}
-
 bool type_domain_t::is_bottom() const {
-    if (m_is_bottom) return true;
-    return (m_stack.is_bottom() || m_registers.is_bottom());
+    return false;
 }
 
 bool type_domain_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_stack.is_top() && m_registers.is_top());
+    return false;
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -396,8 +27,6 @@ void type_domain_t::set_to_bottom() {
 }
 
 void type_domain_t::set_to_top() {
-    m_stack.set_to_top();
-    m_registers.set_to_top();
 }
 
 bool type_domain_t::operator<=(const type_domain_t& abs) const {
@@ -406,42 +35,22 @@ bool type_domain_t::operator<=(const type_domain_t& abs) const {
 }
 
 type_domain_t type_domain_t::widen(const type_domain_t& other, bool to_constants) {
-    // WARNING: Not implemented yet
-    type_domain_t res{m_types | other.m_types, m_stack | other.m_stack, other.m_ctx};
+    type_domain_t res{};
     return res;
 }
 
 void type_domain_t::operator|=(const type_domain_t& abs) {
-    type_domain_t tmp{abs};
-    operator|=(std::move(tmp));
 }
 
 void type_domain_t::operator|=(type_domain_t&& abs) {
-    if (is_bottom()) {
-        *this = abs;
-        return;
-    }
-    *this = *this | std::move(abs);
 }
 
 type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    return type_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx);
+    return other;
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
-        return std::move(other);
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    return type_domain_t(m_registers | std::move(other.m_registers), m_stack | std::move(other.m_stack), other.m_ctx);
+    return other;
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -453,8 +62,6 @@ type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
 }
 
 void type_domain_t::write(std::ostream& os) const { 
-    os << m_registers;
-    os << m_stack << "\n";
 }
 
 void type_domain_t::initialize_loop_counter(label_t label) {
@@ -471,22 +78,10 @@ string_invariant type_domain_t::to_set() {
 }
 
 void type_domain_t::operator()(const Undefined & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 void type_domain_t::operator()(const Un &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        std::cout << "  " << u << ";\n";
-        return;
-    }
-    m_registers -= u.dst.v;
 }
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet
@@ -495,454 +90,42 @@ void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, in
     // WARNING: Not implemented yet
 }
 void type_domain_t::operator()(const Call &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    register_t r0_reg{R0_RETURN_VALUE};
-    auto r0 = reg_with_loc_t(r0_reg, loc);
-    if (print > 0) {
-        if (u.is_map_lookup) {
-            auto it = m_registers.find(r0);
-            if (it) {
-                print_annotated(u, it.value(), std::cout);
-            }
-        }
-        else
-            std::cout << "  " << u << ";\n";
-        return;
-    }
-    if (u.is_map_lookup) {
-        auto type = ptr_no_off_t(crab::region::T_SHARED);
-        m_registers.insert(r0_reg, r0, type);
-    }
-    else {
-        m_registers -= r0_reg;
-    }
 }
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
 void type_domain_t::operator()(const Exit &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 void type_domain_t::operator()(const Jmp &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        std::cout << "  " << u << ";\n";
-        return;
-    }
-    m_registers -= register_t{0};
 }
 void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
 }
 
 type_domain_t type_domain_t::setup_entry() {
-
-    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
-    std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
-
-    live_registers_t vars;
-    register_types_t typ(std::move(vars), all_types);
-
-    auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
-    auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
-
-    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
-    typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
-
-    type_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
+    type_domain_t inv;
     return inv;
 }
 
 void type_domain_t::report_type_error(std::string s, location_t loc) {
-    std::cout << "type_error at line " << loc->second << " in bb " << loc->first << "\n";
-    std::cout << s;
-    error_location = loc;
-    set_to_bottom();
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        if (print == 2) {
-            if ((std::holds_alternative<Reg>(bin.v) && (bin.op == Bin::Op::MOV || bin.op == Bin::Op::ADD)) ||
-            (std::holds_alternative<Imm>(bin.v) && bin.op == Bin::Op::ADD)) {
-                auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
-                auto it = m_registers.find(reg_with_loc);
-                if (it) {
-                    print_annotated(bin, it.value(), std::cout);
-                    std::cout << "\n";
-                    return;
-                }
-            }
-        }
-        std::cout << "  " << bin << ";\n";
-        return;
-    }
-
-    ptr_t dst_reg;
-    if (bin.op == Bin::Op::ADD) {
-        auto it = m_registers.find(bin.dst.v);
-        if (!it) {
-            m_registers -= bin.dst.v;
-            return;
-        }
-        dst_reg = it.value();
-    }
-
-    if (std::holds_alternative<Reg>(bin.v)) {
-        Reg src = std::get<Reg>(bin.v);
-        switch (bin.op)
-        {
-            case Bin::Op::MOV: {
-                auto it1 = m_registers.find(src.v);
-                if (!it1) {
-                    //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
-                    m_registers -= bin.dst.v;
-                    break;
-                }
-                auto reg = reg_with_loc_t(bin.dst.v, loc);
-                m_registers.insert(bin.dst.v, reg, it1.value());
-                break;
-            }
-            case Bin::Op::ADD: {
-                auto it1 = m_registers.find(src.v);
-                if (it1) {
-                    std::string s = std::to_string(static_cast<unsigned int>(src.v));
-                    std::string s1 = std::to_string(static_cast<unsigned int>(bin.dst.v));
-                    std::string desc = std::string("\taddition of two pointers, r") + s + " and r" + s1 + " not allowed\n";
-                    report_type_error(desc, loc);
-                    return;
-                }
-                else {
-                    if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
-                        // register to be added is not a pointer, but a number. its value is unknown
-                        /*
-                        std::string s = std::to_string(static_cast<unsigned int>(bin.dst.v));
-                        std::string desc = std::string("\toffset of the pointer r") + s + " unknown\n";
-                        report_type_error(desc, loc);
-                        return;
-                        */
-                        ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
-                        if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
-                            m_stack.set_to_top();
-                            m_stack -= dst_reg_with_off.get_offset();
-                            return;
-                        }
-                        else {
-                            // currently, we do not read any other pointers from CTX except the ones already stored
-                            // in case we add the functionality, we will have to implement forgetting of CTX offsets
-                        }
-                    }
-                    else {
-                        auto reg = reg_with_loc_t(bin.dst.v, loc);
-                        m_registers.insert(bin.dst.v, reg, dst_reg);
-                    }
-                }
-                break;
-            }
-            default:
-                m_registers -= bin.dst.v;
-                break;
-        }
-    }
-    else {
-        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
-        switch (bin.op)
-        {
-            case Bin::Op::ADD: {
-                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
-                    auto ptr_with_off = std::get<ptr_with_off_t>(dst_reg);
-                    ptr_with_off.set_offset(ptr_with_off.get_offset() + imm);
-                    auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_registers.insert(bin.dst.v, reg, ptr_with_off);
-                }
-                else {
-                    auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_registers.insert(bin.dst.v, reg, dst_reg);
-                }
-                break;
-            }
-            default: {
-                m_registers -= bin.dst.v;
-                break;
-            }
-        }
-    }
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-
-    if (print > 0) {
-        auto target_reg_loc = reg_with_loc_t(target_reg.v, loc);
-        auto it = m_registers.find(target_reg_loc);
-        if (it)
-            print_annotated(b, it.value(), std::cout);
-        else
-            std::cout << "  " << b << ";\n";
-        return;
-    }
-    int offset = b.access.offset;
-    Reg basereg = b.access.basereg;
-
-    auto it = m_registers.find(basereg.v);
-    if (!it) {
-        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-        std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
-        report_type_error(desc, loc);
-        return;
-    }
-    ptr_t type_basereg = it.value();
-
-    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        //std::cout << "type_error: loading from either packet or shared region not allowed - r" << (int)basereg.v << "\n";
-        m_registers -= target_reg.v;
-        return;
-    }
-
-    ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
-    int load_at = offset+type_with_off.get_offset();
-
-    switch (type_with_off.get_region()) {
-        case crab::region::T_STACK: {
-
-            auto it = m_stack.find(load_at);
-
-            if (!it) {
-                //std::cout << "type_error: no field at loaded offset " << load_at << " in stack\n";
-                m_registers -= target_reg.v;
-                return;
-            }
-            ptr_t type_loaded = it.value();
-
-            if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
-                ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded_with_off);
-            }
-            else {
-                ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded_no_off);
-            }
-
-            break;
-        }
-        case crab::region::T_CTX: {
-
-            auto it = m_ctx->find(load_at);
-
-            if (!it) {
-                //std::cout << "type_error: no field at loaded offset " << load_at << " in context\n";
-                m_registers -= target_reg.v;
-                return;
-            }
-            ptr_no_off_t type_loaded = it.value();
-
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_registers.insert(target_reg.v, reg, type_loaded);
-            break;
-        }
-
-        default: {
-            assert(false);
-        }
-    }
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-
-    if (print > 0) {
-        std::cout << "  " << b << ";\n";
-        return;
-    }
-    int offset = b.access.offset;
-    Reg basereg = b.access.basereg;
-    int width = b.access.width;
-
-    auto it = m_registers.find(basereg.v);
-    if (!it) {
-        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-        std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
-        report_type_error(desc, loc);
-        return;
-    }
-    ptr_t type_basereg = it.value();
-
-    auto it2 = m_registers.find(target_reg.v);
-
-    if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
-        // base register is either CTX_P or STACK_P
-        ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
-
-        int store_at = offset+type_basereg_with_off.get_offset();
-        if (type_basereg_with_off.get_region() == crab::region::T_STACK) {
-            // type of basereg is STACK_P
-            if (!it2) {
-               // std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
-                m_stack -= store_at;
-                return;
-            }
-            else {
-                auto type_to_store = it2.value();
-                /*
-                if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
-                        std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
-                    std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-                    std::string desc = std::string("\twe cannot store stack pointer, r") + s + ", into stack\n";
-                    //report_type_error(desc, loc);
-                    return;
-                }
-                else {
-                */
-                    for (auto i = store_at+1; i < store_at+width; i++) {
-                        auto it3 = m_stack.find(i);
-                        if (it3) {
-                            std::string s = std::to_string(store_at);
-                            std::string s1 = std::to_string(i);
-                            std::string desc = std::string("\ttype being stored into stack at ") + s + " is overlapping with already stored at " + s1 + "\n";
-                            report_type_error(desc, loc);
-                            return;
-                        }
-                    }
-                    m_stack.insert(store_at, type_to_store);
-                    // revise: code below checks if there is already something stored at same location, the type should be the same -- it is very restricted and not required.
-                    // However, when we support storing info like width of type, we need more checks
-                    /*
-                    auto it4 = m_stack.find(store_at);
-                    if (it4) {
-                        auto type_in_stack = it4.value();
-                        if (type_to_store != type_in_stack) {
-                            std::string s = std::to_string(store_at);
-                            std::string desc = std::string("\ttype being stored at offset ") + s + " is not the same as already stored in stack\n";
-                            report_type_error(desc, loc);
-                            return;
-                        }
-                    }
-                    else {
-                        m_stack.insert(store_at, type_to_store);
-                    }
-                    */
-                //}
-            }
-        }
-        else if (type_basereg_with_off.get_region() == crab::region::T_CTX) {
-            // type of basereg is CTX_P
-            if (it2) {
-                std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-                std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into ctx\n";
-                report_type_error(desc, loc);
-                return;
-            }
-        }
-        else
-            assert(false);
-    }
-    else {
-        // base register type is either PACKET_P, SHARED_P or STACK_P without known offset
-        ptr_no_off_t type_basereg_no_off = std::get<ptr_no_off_t>(type_basereg);
-
-        // if basereg is a stack_p with no offset, we do not store anything, and no type errors
-        // if we later load with that pointer, we read nothing -- load is no-op
-        if (it2 && type_basereg_no_off.get_region() != crab::region::T_STACK) {
-            std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
-            report_type_error(desc, loc);
-            return;
-        }
-    }
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
-    if (is_bottom()) return;
-
-    if (std::holds_alternative<Reg>(b.value)) {
-        if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value), loc, print);
-        } else {
-            do_mem_store(b, std::get<Reg>(b.value), loc, print);
-        }
-    } else {
-        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
-        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
-        report_type_error(desc, loc);
-        return;
-    }
-}
-
-void type_domain_t::print_initial_types() {
-    auto label = label_t::entry;
-    location_t loc = location_t(std::make_pair(label, 0));
-    std::cout << "\n" << *m_ctx << "\n";
-    std::cout << m_stack << "\n";
-
-    std::cout << "Initial register types:\n";
-    auto r1_with_loc = reg_with_loc_t(R1_ARG, loc);
-    auto it = m_registers.find(r1_with_loc);
-    if (it) {
-        std::cout << "  ";
-        print_type(R1_ARG, it.value());
-        std::cout << "\n";
-    }
-    auto r10_with_loc = reg_with_loc_t(R10_STACK_POINTER, loc);
-    auto it2 = m_registers.find(r10_with_loc);
-    if (it2) {
-        std::cout << "  ";
-        print_type(R10_STACK_POINTER, it2.value());
-        std::cout << "\n";
-    }
-    std::cout << "\n";
 }
 
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
-    auto label = bb.label();
-    uint32_t curr_pos = 0;
-    location_t loc;
-    if (print > 0) {
-        if (label == label_t::entry) {
-            print_initial_types();
-            m_is_bottom = false;
-        }
-        std::cout << label << ":\n";
-    }
-
-    for (const Instruction& statement : bb) {
-        loc = location_t(std::make_pair(label, ++curr_pos));
-        if (print > 0) std::cout << " " << curr_pos << ".";
-        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
-        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) std::cout << "type_error\n";
-    }
-
-    if (print > 0) {
-        auto [it, et] = bb.next_blocks();
-        if (it != et) {
-            std::cout << "  "
-            << "goto ";
-            for (; it != et;) {
-                std::cout << *it;
-                ++it;
-                if (it == et) {
-                    std::cout << ";";
-                } else {
-                    std::cout << ",";
-                }
-            }
-        }
-        std::cout << "\n\n";
-    }
 }
 
 void type_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 0624e4f32..c0cd87bc7 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -10,144 +10,9 @@
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
 
-namespace crab {
-
-enum class region {
-	T_CTX,
-	T_STACK,
-	T_PACKET,
-	T_SHARED
-};
-
-
-class ptr_no_off_t {
-    region m_r;
-
-  public:
-    ptr_no_off_t() = default;
-    ptr_no_off_t(const ptr_no_off_t &) = default;
-    ptr_no_off_t(ptr_no_off_t &&) = default;
-    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
-    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-    ptr_no_off_t(region _r) : m_r(_r) {}
-
-    constexpr region get_region() const;
-    void set_region(region);
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
-    //bool operator==(const ptr_no_off_t& p2);
-    //bool operator!=(const ptr_no_off_t& p2);
-};
-
-class ptr_with_off_t {
-    region m_r;
-    int m_offset;
-
-  public:
-    ptr_with_off_t() = default;
-    ptr_with_off_t(const ptr_with_off_t &) = default;
-    ptr_with_off_t(ptr_with_off_t &&) = default;
-    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
-    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region _r, int _off) : m_r(_r), m_offset(_off) {}
-
-    constexpr int get_offset() const;
-    void set_offset(int);
-    constexpr region get_region() const;
-    void set_region(region);
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
-    //bool operator==(const ptr_with_off_t& p2);
-    //bool operator!=(const ptr_with_off_t& p2);
-};
-
-using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
-using register_t = uint8_t;
-using location_t = boost::optional<std::pair<label_t, uint32_t>>;
-
-class reg_with_loc_t {
-    register_t m_reg;
-    location_t m_loc;
-
-  public:
-    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
-    bool operator==(const reg_with_loc_t& other) const;
-    std::size_t hash() const;
-    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
-    void write(std::ostream& ) const;
-};
-
-class ctx_t {
-    using offset_to_ptr_no_off_t = std::unordered_map<int, ptr_no_off_t>;
-
-    offset_to_ptr_no_off_t m_packet_ptrs;
-
-  public:
-    ctx_t(const ebpf_context_descriptor_t* desc);
-    std::optional<ptr_no_off_t> find(int key) const;
-    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx);
-};
-
-class stack_t {
-    using offset_to_ptr_t = std::unordered_map<int, ptr_t>;
-
-    offset_to_ptr_t m_ptrs;
-    bool m_is_bottom;
-
-  public:
-    stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-    stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
-    : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
-    
-    stack_t operator|(const stack_t& other) const;
-    void operator-=(int);
-    void set_to_bottom();
-    void set_to_top();
-    static stack_t bottom();
-    static stack_t top();
-    bool is_bottom() const;
-    bool is_top() const;
-    const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
-    void insert(int key, ptr_t value);
-    std::optional<ptr_t> find(int key) const;
-    friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
-};
-
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
-using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
-
-class register_types_t {
-    live_registers_t m_cur_def;
-    std::shared_ptr<global_type_env_t> m_reg_type_env;
-    bool m_is_bottom = false;
-
-  public:
-    register_types_t(bool is_bottom = false) : m_reg_type_env(nullptr), m_is_bottom(is_bottom) {}
-    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> reg_type_env, bool is_bottom = false)
-        : m_cur_def(std::move(vars)), m_reg_type_env(reg_type_env), m_is_bottom(is_bottom) {}
-
-    register_types_t operator|(const register_types_t& other) const;
-    void operator-=(register_t var);
-    void set_to_bottom();
-    void set_to_top();
-    bool is_bottom() const;
-    bool is_top() const;
-    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type);
-    std::optional<ptr_t> find(reg_with_loc_t reg) const;
-    std::optional<ptr_t> find(register_t key) const;
-    const live_registers_t &get_vars() { return m_cur_def; }
-    friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
-};
-
-}
-
 class type_domain_t final {
 
     bool m_is_bottom = false;
-    location_t error_location = boost::none;
-    crab::stack_t m_stack;
-    crab::register_types_t m_registers;
-    std::shared_ptr<crab::ctx_t> m_ctx;
 
   public:
 
@@ -156,8 +21,6 @@ class type_domain_t final {
     type_domain_t(const type_domain_t& o) = default;
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
-    type_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
-            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static type_domain_t setup_entry();
     // bottom/top
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 972b5b6f6..e2cebdf1e 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -15,6 +15,7 @@
 #include "crab/abstract_domain.hpp"
 #include "crab/ebpf_domain.hpp"
 #include "crab/type_domain.hpp"
+#include "crab/region_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 
@@ -106,8 +107,7 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
 static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invariant_table_t& pre_invariants,
                                      crab::invariant_table_t& post_invariants) {
     // Analyze the control-flow graph.
-    checks_db db = generate_report(cfg, pre_invariants, post_invariants);
-    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN) {
+    if (thread_local_options.abstract_domain == abstract_domain_kind::REGION_DOMAIN) {
         auto state = post_invariants.at(label_t::exit);
         for (const label_t& label : cfg.sorted_labels()) {
             state(cfg.get_node(label), thread_local_options.print_invariants ? 2 : 1);
@@ -130,6 +130,10 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
         ebpf_domain_t entry_inv = ebpf_domain_t::setup_entry(true);
         return abstract_domain_t(entry_inv);
     }
+    case abstract_domain_kind::REGION_DOMAIN: {
+        region_domain_t entry_inv = region_domain_t::setup_entry();
+        return abstract_domain_t(entry_inv);
+    }
     case abstract_domain_kind::TYPE_DOMAIN: {
         type_domain_t entry_inv = type_domain_t::setup_entry();
         return abstract_domain_t(entry_inv);
@@ -176,6 +180,7 @@ crab_results get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, con
         return crab_results(std::move(cfg),
 			    std::move(pre_invariants), std::move(post_invariants),
 			    std::move(get_analysis_report(s, cfg, pre_invariants, post_invariants)));
+
     } catch (std::runtime_error& e) {
         // Convert verifier runtime_error exceptions to failure.
         checks_db db;
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 968c02c9e..aac3713a4 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -55,7 +55,7 @@ int main(int argc, char** argv) {
     app.add_flag("-l", list, "List sections");
 
     std::string domain = "zoneCrab";
-    std::set<string> doms{"stats", "linux", "zoneCrab", "types", "cfg"};
+    std::set<string> doms{"stats", "linux", "zoneCrab", "region", "offset", "cfg"};
     app.add_set("-d,--dom,--domain", domain, doms, "Abstract domain")->type_name("DOMAIN");
 
     app.add_flag("--termination", ebpf_verifier_options.check_termination, "Verify termination");
@@ -163,9 +163,12 @@ int main(int argc, char** argv) {
         print_map_descriptors(global_program_info->map_descriptors, out);
     }
 
-    if (domain == "zoneCrab" || domain == "types") {
+    if (domain == "zoneCrab" || domain == "region" || domain == "type") {
         ebpf_verifier_stats_t verifier_stats;
-        if (domain == "types") {
+        if (domain == "region") {
+          ebpf_verifier_options.abstract_domain = abstract_domain_kind::REGION_DOMAIN;
+        }
+        else if (domain == "type") {
           ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
         }
         auto [res, seconds] = timed_execution([&] {

From eda405efb7df8a9fb3d62ae6fa90862f62b98cd5 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 11 Jul 2023 03:37:47 -0400
Subject: [PATCH 099/373] Implementation for multiple transformers for region
 domain

Incorporate region domain into a super type domain;
Implement load, store and binary operation transformers;
Implement join;
Print initial types in the type domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/ebpf_domain.cpp             |   2 +-
 src/crab/ebpf_domain.hpp             |   2 +-
 src/crab/region_domain.cpp           | 257 +++++++++---
 src/crab/region_domain.hpp           |  56 ++-
 src/crab/type_domain.cpp             | 167 +++++++-
 src/crab/type_domain.hpp             |  26 +-
 src/crab_verifier.cpp                |   4 +-
 src/main/check.cpp                   |   2 +-
 src/test/test_verify_type_domain.cpp | 577 +++++++++++++++++++++++++++
 9 files changed, 992 insertions(+), 101 deletions(-)
 create mode 100644 src/test/test_verify_type_domain.cpp

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 5cb1738c3..039849bec 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1567,7 +1567,7 @@ void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc, int prin
         require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
 }
 
-void ebpf_domain_t::operator()(const FuncConstraint& s) {
+void ebpf_domain_t::operator()(const FuncConstraint& s, location_t loc, int print) {
     // Look up the helper function id.
     const reg_pack_t& reg = reg_pack(s.reg);
     auto src_interval = m_inv.eval_interval(reg.svalue);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 620764bc6..83966e936 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -65,7 +65,7 @@ class ebpf_domain_t final {
     void operator()(const Callx&, location_t loc = boost::none, int print = 0);
     void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
     void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint&);
+    void operator()(const FuncConstraint&, location_t loc = boost::none, int print = 0);
     void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
     void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
     void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index cfaa59a57..7c3920e11 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -10,7 +10,7 @@ using crab::ptr_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
 using crab::ctx_t;
-using crab::global_type_env_t;
+using crab::global_region_env_t;
 using crab::reg_with_loc_t;
 using crab::live_registers_t;
 using crab::register_types_t;
@@ -149,12 +149,8 @@ std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
 
 void ptr_with_off_t::set_offset(int off) { m_offset = off; }
 
-constexpr int ptr_with_off_t::get_offset() const { return m_offset; }
-
 void ptr_with_off_t::set_region(region r) { m_r = r; }
 
-constexpr region ptr_with_off_t::get_region() const { return m_r; }
-
 bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
     return (p1.get_region() == p2.get_region());
 }
@@ -174,8 +170,6 @@ std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
 
 void ptr_no_off_t::set_region(region r) { m_r = r; }
 
-constexpr region ptr_no_off_t::get_region() const { return m_r; }
-
 void reg_with_loc_t::write(std::ostream& o) const {
     o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
 }
@@ -228,12 +222,29 @@ std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
 
 ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
 {
-    if (desc->data != -1)
+    if (desc->data != -1) {
         m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
-    if (desc->end != -1)
+    }
+    if (desc->end != -1) {
         m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
-    if (desc->meta != -1)
+    }
+    if (desc->meta != -1) {
         m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    }
+}
+
+size_t ctx_t::size() const {
+    return m_packet_ptrs.size();
+}
+
+std::vector<int> ctx_t::get_keys() const {
+    std::vector<int> keys;
+    keys.reserve(size());
+
+    for (auto const&kv : m_packet_ptrs) {
+        keys.push_back(kv.first);
+    }
+    return keys;
 }
 
 std::optional<ptr_no_off_t> ctx_t::find(int key) const {
@@ -247,7 +258,7 @@ std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
     if (typ.is_bottom())
         o << "_|_\n";
     else {
-        for (const auto& v : *(typ.m_reg_type_env)) {
+        for (const auto& v : *(typ.m_region_env)) {
             o << v.first << ": ";
             print_ptr_type(v.second);
             o << "\n";
@@ -267,12 +278,25 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
-        if (it1 && it2 && it1.value() == it2.value()) {
-            out_vars[i] = m_cur_def[i];
+        if (it1 && it2) {
+            ptr_t pt1 = it1.value(), pt2 = it2.value();
+            if (pt1 == pt2) {
+                out_vars[i] = m_cur_def[i];
+            }
+            // TODO
+            //else if (std::holds_alternative<ptr_with_off_t>(pt1)
+            //        && std::holds_alternative<ptr_with_off_t>(pt2)) {
+            //    auto pt_with_off1 = std::get<ptr_with_off_t>(pt1);
+            //    auto pt_with_off2 = std::get<ptr_with_off_t>(pt2);
+            //    if (pt_with_off1.get_region() == pt_with_off2.get_region()) {
+            //        //out_vars[i] = std::make_shared<ptr_no_off_t(pt_with_off1.get_region());
+            //    }
+            //}
+            //implement above the same for offset_domain
         }
     }
 
-    return register_types_t(std::move(out_vars), m_reg_type_env, false);
+    return register_types_t(std::move(out_vars), m_region_env, false);
 }
 
 void register_types_t::operator-=(register_t var) {
@@ -296,7 +320,7 @@ bool register_types_t::is_bottom() const { return m_is_bottom; }
 
 bool register_types_t::is_top() const {
     if (m_is_bottom) { return false; }
-    if (m_reg_type_env == nullptr) return true;
+    if (m_region_env == nullptr) return true;
     for (auto it : m_cur_def) {
         if (it != nullptr) return false;
     }
@@ -304,13 +328,13 @@ bool register_types_t::is_top() const {
 }
 
 void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
-    (*m_reg_type_env)[reg_with_loc] = type;
+    (*m_region_env)[reg_with_loc] = type;
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
 std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
-    auto it = m_reg_type_env->find(reg);
-    if (it == m_reg_type_env->end()) return {};
+    auto it = m_region_env->find(reg);
+    if (it == m_region_env->end()) return {};
     return it->second;
 }
 
@@ -320,6 +344,19 @@ std::optional<ptr_t> register_types_t::find(register_t key) const {
     return find(reg);
 }
 
+void register_types_t::print_types_at(location_t loc) const {
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        auto reg_with_loc = reg_with_loc_t(i, loc);
+        auto it = find(reg_with_loc);
+        if (it) {
+            std::cout << "  ";
+            print_type(i, it.value());
+            std::cout << "\n";
+        }
+    }
+    std::cout << "\n";
+}
+
 stack_t stack_t::operator|(const stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -367,6 +404,21 @@ void stack_t::insert(int key, ptr_t value) {
     m_ptrs[key] = value;
 }
 
+size_t stack_t::size() const {
+    return m_ptrs.size();
+}
+
+std::vector<int> stack_t::get_keys() const {
+    std::vector<int> keys;
+    keys.reserve(size());
+
+    for (auto const&kv : m_ptrs) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
+
 std::optional<ptr_t> stack_t::find(int key) const {
     auto it = m_ptrs.find(key);
     if (it == m_ptrs.end()) return {};
@@ -375,6 +427,10 @@ std::optional<ptr_t> stack_t::find(int key) const {
 
 }
 
+std::optional<ptr_t> region_domain_t::find_ptr_type(register_t reg) {
+    return m_registers.find(reg);
+}
+
 bool region_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
     return (m_stack.is_bottom() || m_registers.is_bottom());
@@ -400,6 +456,26 @@ void region_domain_t::set_to_top() {
     m_registers.set_to_top();
 }
 
+size_t region_domain_t::ctx_size() const {
+    return m_ctx->size();
+}
+
+std::vector<int> region_domain_t::get_ctx_keys() const {
+    return m_ctx->get_keys();
+}
+
+std::vector<int> region_domain_t::get_stack_keys() const {
+    return m_stack.get_keys();
+}
+
+std::optional<ptr_no_off_t> region_domain_t::find_in_ctx(int key) const {
+    return m_ctx->find(key);
+}
+
+std::optional<ptr_t> region_domain_t::find_in_stack(int key) const {
+    return m_stack.find(key);
+}
+
 bool region_domain_t::operator<=(const region_domain_t& abs) const {
     /* WARNING: The operation is not implemented yet.*/
     return true;
@@ -455,10 +531,6 @@ void region_domain_t::write(std::ostream& os) const {
     os << m_stack << "\n";
 }
 
-std::string region_domain_t::domain_name() const {
-    return "type_domain";
-}
-
 crab::bound_t region_domain_t::get_loop_count_upper_bound() {
     // WARNING: Not implemented yet.
     return crab::bound_t{crab::number_t{0}};
@@ -545,19 +617,27 @@ void region_domain_t::operator()(const Assume &u, location_t loc, int print) {
     if (print > 0)
         std::cout << "  " << u << ";\n";
 }
+
+void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+    check_type_constraint(s);
+}
+
 void region_domain_t::operator()(const Assert &u, location_t loc, int print) {
     if (is_bottom()) return;
-    if (print > 0)
+    if (print > 0) {
         std::cout << "  " << u << ";\n";
+        return;
+    }
+    //std::cout << "assert: " << u << "\n";
+    std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
 region_domain_t region_domain_t::setup_entry() {
 
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
-    std::shared_ptr<global_type_env_t> all_types = std::make_shared<global_type_env_t>();
+    std::shared_ptr<global_region_env_t> all_types = std::make_shared<global_region_env_t>();
 
-    live_registers_t vars;
-    register_types_t typ(std::move(vars), all_types);
+    register_types_t typ(all_types);
 
     auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
     auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
@@ -576,7 +656,62 @@ void region_domain_t::report_type_error(std::string s, location_t loc) {
     set_to_bottom();
 }
 
-void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+void region_domain_t::check_type_constraint(const TypeConstraint& s) {
+    auto it = find_ptr_type(s.reg.v);
+    if (it) {
+        if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num
+                || s.types == TypeGroup::non_map_fd) return;
+        ptr_t p_type = it.value();
+        if (std::holds_alternative<ptr_with_off_t>(p_type)) {
+            ptr_with_off_t p_type_with_off = std::get<ptr_with_off_t>(p_type);
+            if (p_type_with_off.get_region() == crab::region::T_CTX) {
+                if (s.types == TypeGroup::ctx) return;
+            }
+            else {
+                if (s.types == TypeGroup::stack || s.types == TypeGroup::mem
+                        || s.types == TypeGroup::stack_or_packet || s.types == TypeGroup::mem_or_num) {
+                    return;
+                }
+            }
+        }
+        else {
+            ptr_no_off_t p_type_no_off = std::get<ptr_no_off_t>(p_type);
+            if (p_type_no_off.get_region() == crab::region::T_PACKET) {
+                if (s.types == TypeGroup::packet || s.types == TypeGroup::mem
+                        || s.types == TypeGroup::mem_or_num) return;
+            }
+            else if (p_type_no_off.get_region() == crab::region::T_SHARED) {
+                if (s.types == TypeGroup::shared || s.types == TypeGroup::mem
+                        || s.types == TypeGroup::mem_or_num) return;
+            }
+            else {
+                // we might have the case where we add an unknown number to stack or ctx's offset and we do not know the offset now
+                if (p_type_no_off.get_region() == crab::region::T_STACK) {
+                    if (s.types == TypeGroup::stack || s.types == TypeGroup::stack_or_packet
+                            || s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num)
+                        return;
+                }
+                else {
+                    if (s.types == TypeGroup::ctx) return;
+                }
+            }
+        }
+    }
+    else {
+        // map_fd, non_map_fd, map_fd_programs, and numbers, all should come here
+        // right now, pass any such cases, add more strict checks later
+        // TODO
+        if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
+                || s.types == TypeGroup::map_fd_programs || s.types == TypeGroup::non_map_fd
+                || s.types == TypeGroup::ptr_or_num || s.types == TypeGroup::mem_or_num
+                || s.types == TypeGroup::map_fd)
+            return;
+    }
+    std::cout << "type constraint assert fail: " << s << "\n";
+    //exit(1);
+}
+
+void region_domain_t::do_bin(const Bin& bin, std::shared_ptr<int> src_const_value, location_t loc, int print) {
     if (is_bottom()) return;
     if (print > 0) {
         if (print == 2) {
@@ -609,10 +744,10 @@ void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         Reg src = std::get<Reg>(bin.v);
         switch (bin.op)
         {
+            // ra = rb
             case Bin::Op::MOV: {
                 auto it1 = m_registers.find(src.v);
                 if (!it1) {
-                    //std::cout << "type_error: assigning an unknown pointer or a number - r" << (int)src.v << "\n";
                     m_registers -= bin.dst.v;
                     break;
                 }
@@ -620,6 +755,7 @@ void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
                 m_registers.insert(bin.dst.v, reg, it1.value());
                 break;
             }
+            // ra += rb
             case Bin::Op::ADD: {
                 auto it1 = m_registers.find(src.v);
                 if (it1) {
@@ -629,31 +765,31 @@ void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
                     report_type_error(desc, loc);
                     return;
                 }
-                else {
-                    if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
-                        // register to be added is not a pointer, but a number. its value is unknown
-                        /*
-                        std::string s = std::to_string(static_cast<unsigned int>(bin.dst.v));
-                        std::string desc = std::string("\toffset of the pointer r") + s + " unknown\n";
-                        report_type_error(desc, loc);
-                        return;
-                        */
-                        ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
-                        if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
+                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
+                    ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
+                    if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
+                        if (src_const_value) {
+                            int updated_offset = dst_reg_with_off.get_offset()+(*src_const_value);
+                            dst_reg_with_off.set_offset(updated_offset);
+                            auto reg = reg_with_loc_t(bin.dst.v, loc);
+                            m_registers.insert(bin.dst.v, reg, dst_reg_with_off);
+
+                        }
+                        else {
                             m_stack.set_to_top();
                             m_stack -= dst_reg_with_off.get_offset();
                             return;
                         }
-                        else {
-                            // currently, we do not read any other pointers from CTX except the ones already stored
-                            // in case we add the functionality, we will have to implement forgetting of CTX offsets
-                        }
                     }
                     else {
-                        auto reg = reg_with_loc_t(bin.dst.v, loc);
-                        m_registers.insert(bin.dst.v, reg, dst_reg);
+                        // currently, we do not read any other pointers from CTX except the ones already stored
+                        // in case we add the functionality, we will have to implement forgetting of CTX offsets
                     }
                 }
+                else {
+                    auto reg = reg_with_loc_t(bin.dst.v, loc);
+                    m_registers.insert(bin.dst.v, reg, dst_reg);
+                }
                 break;
             }
             default:
@@ -686,6 +822,10 @@ void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     }
 }
 
+void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+    do_bin(bin, nullptr, loc, print);
+}
+
 void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
 
     if (print > 0) {
@@ -885,31 +1025,20 @@ void region_domain_t::operator()(const Mem& b, location_t loc, int print) {
     }
 }
 
-void region_domain_t::print_initial_types() {
+void region_domain_t::print_registers_at(location_t loc) const {
+    m_registers.print_types_at(loc);
+}
+
+void region_domain_t::print_initial_types() const {
     auto label = label_t::entry;
     location_t loc = location_t(std::make_pair(label, 0));
     std::cout << "\n" << *m_ctx << "\n";
     std::cout << m_stack << "\n";
-
     std::cout << "Initial register types:\n";
-    auto r1_with_loc = reg_with_loc_t(R1_ARG, loc);
-    auto it = m_registers.find(r1_with_loc);
-    if (it) {
-        std::cout << "  ";
-        print_type(R1_ARG, it.value());
-        std::cout << "\n";
-    }
-    auto r10_with_loc = reg_with_loc_t(R10_STACK_POINTER, loc);
-    auto it2 = m_registers.find(r10_with_loc);
-    if (it2) {
-        std::cout << "  ";
-        print_type(R10_STACK_POINTER, it2.value());
-        std::cout << "\n";
-    }
-    std::cout << "\n";
+    print_registers_at(loc);
 }
 
-void region_domain_t::operator()(const basic_block_t& bb, bool check_termination, int print) {
+void region_domain_t::operator()(const basic_block_t& bb, int print) {
     auto label = bb.label();
     uint32_t curr_pos = 0;
     location_t loc;
@@ -946,5 +1075,3 @@ void region_domain_t::operator()(const basic_block_t& bb, bool check_termination
         std::cout << "\n\n";
     }
 }
-
-void region_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 8c72cb874..c4d1998b3 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -9,6 +9,7 @@
 #include "crab/cfg.hpp"
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
+#include <boost/optional/optional_io.hpp>
 
 namespace crab {
 
@@ -31,7 +32,7 @@ class ptr_no_off_t {
     ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
     ptr_no_off_t(region _r) : m_r(_r) {}
 
-    constexpr region get_region() const;
+    constexpr region get_region() const { return m_r; }
     void set_region(region);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
@@ -51,9 +52,9 @@ class ptr_with_off_t {
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
     ptr_with_off_t(region _r, int _off) : m_r(_r), m_offset(_off) {}
 
-    constexpr int get_offset() const;
+    constexpr int get_offset() const { return m_offset; }
     void set_offset(int);
-    constexpr region get_region() const;
+    constexpr region get_region() const { return m_r; }
     void set_region(region);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
@@ -84,6 +85,8 @@ class ctx_t {
 
   public:
     ctx_t(const ebpf_context_descriptor_t* desc);
+    size_t size() const;
+    std::vector<int> get_keys() const;
     std::optional<ptr_no_off_t> find(int key) const;
     friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx);
 };
@@ -110,21 +113,27 @@ class stack_t {
     const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
     void insert(int key, ptr_t value);
     std::optional<ptr_t> find(int key) const;
+    std::vector<int> get_keys() const;
+    size_t size() const;
     friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
 };
 
 using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
-using global_type_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
 
 class register_types_t {
+
     live_registers_t m_cur_def;
-    std::shared_ptr<global_type_env_t> m_reg_type_env;
+    std::shared_ptr<global_region_env_t> m_region_env;
     bool m_is_bottom = false;
 
   public:
-    register_types_t(bool is_bottom = false) : m_reg_type_env(nullptr), m_is_bottom(is_bottom) {}
-    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_type_env_t> reg_type_env, bool is_bottom = false)
-        : m_cur_def(std::move(vars)), m_reg_type_env(reg_type_env), m_is_bottom(is_bottom) {}
+    register_types_t(bool is_bottom = false) : m_region_env(nullptr), m_is_bottom(is_bottom) {}
+    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
+        : m_cur_def(std::move(vars)), m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
+
+    explicit register_types_t(std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
+        : m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
 
     register_types_t operator|(const register_types_t& other) const;
     void operator-=(register_t var);
@@ -137,6 +146,7 @@ class register_types_t {
     std::optional<ptr_t> find(register_t key) const;
     const live_registers_t &get_vars() { return m_cur_def; }
     friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
+    void print_types_at(location_t) const;
 };
 
 }
@@ -196,20 +206,36 @@ class region_domain_t final {
     void operator()(const Packet &, location_t loc = boost::none, int print = 0);
     void operator()(const Assume &, location_t loc = boost::none, int print = 0);
     void operator()(const Assert &, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Comparable& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Addable& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const TypeConstraint& s, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidMapKeyValue& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ZeroCtxOffset& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
-    void operator()(const basic_block_t& bb, bool check_termination, int print = 0);
+    void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
-    std::string domain_name() const;
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t&);
     string_invariant to_set();
-    void set_require_check(check_require_func_t f);
-
-  private:
+    void set_require_check(check_require_func_t f) {}
 
     void do_load(const Mem&, const Reg&, location_t, int print = 0);
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
-    void print_initial_types();
-    void report_type_error(std::string, location_t);
+    void do_bin(const Bin&, std::shared_ptr<int>, location_t, int print = 0);
+    void check_type_constraint(const TypeConstraint&);
 
+    void report_type_error(std::string, location_t);
+    std::optional<crab::ptr_t> find_ptr_type(register_t);
+    size_t ctx_size() const;
+    std::optional<crab::ptr_no_off_t> find_in_ctx(int key) const;
+    std::vector<int> get_ctx_keys() const;
+    std::optional<crab::ptr_t> find_in_stack(int key) const;
+    std::vector<int> get_stack_keys() const;
+    void print_registers_at(location_t) const;
+    void print_initial_types() const;
 }; // end region_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 05528508f..46ff873fd 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -5,15 +5,13 @@
 
 #include "crab/type_domain.hpp"
 
-static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
-
-
 bool type_domain_t::is_bottom() const {
-    return false;
+    return m_is_bottom;
 }
 
 bool type_domain_t::is_top() const {
-    return false;
+    if (m_is_bottom) return false;
+    return (m_region.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -27,6 +25,7 @@ void type_domain_t::set_to_bottom() {
 }
 
 void type_domain_t::set_to_top() {
+    m_region.set_to_top();
 }
 
 bool type_domain_t::operator<=(const type_domain_t& abs) const {
@@ -40,17 +39,36 @@ type_domain_t type_domain_t::widen(const type_domain_t& other, bool to_constants
 }
 
 void type_domain_t::operator|=(const type_domain_t& abs) {
+    type_domain_t tmp{abs};
+    operator|=(std::move(tmp));
 }
 
 void type_domain_t::operator|=(type_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
 }
 
 type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
-    return other;
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return type_domain_t(m_region | other.m_region);
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
-    return other;
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return type_domain_t(m_region | std::move(other.m_region));
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -78,10 +96,16 @@ string_invariant type_domain_t::to_set() {
 }
 
 void type_domain_t::operator()(const Undefined & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Un &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet
@@ -90,42 +114,157 @@ void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, in
     // WARNING: Not implemented yet
 }
 void type_domain_t::operator()(const Call &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
 void type_domain_t::operator()(const Exit &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Jmp &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
 void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region(u, loc, print);
 }
-void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
+
+void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
 }
 
-type_domain_t type_domain_t::setup_entry() {
-    type_domain_t inv;
-    return inv;
+void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+    m_region.check_type_constraint(s);
 }
 
-void type_domain_t::report_type_error(std::string s, location_t loc) {
+void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
+    if (is_bottom()) return;
+    std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
+}
+
+type_domain_t type_domain_t::setup_entry() {
+    region_domain_t reg = region_domain_t::setup_entry();
+    type_domain_t typ(std::move(reg));
+    return typ;
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+    if (is_bottom()) return;
+    m_region.do_bin(bin, nullptr, loc, print);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+    m_region.do_load(b, target_reg, loc, print);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+    m_region.do_mem_store(b, target_reg, loc, print);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
+    if (is_bottom()) return;
+ 
+    if (std::holds_alternative<Reg>(b.value)) {
+        if (b.is_load) {
+            do_load(b, std::get<Reg>(b.value), loc, print);
+        } else {
+            do_mem_store(b, std::get<Reg>(b.value), loc, print);
+        }
+    }
 }
 
-void type_domain_t::operator()(const basic_block_t& bb, int print) {
+static void print_ptr_type(ptr_t ptr) {
+    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
+        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
+        std::cout << ptr_with_off;
+    }
+    else {
+        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
+        std::cout << ptr_no_off;
+    }
 }
 
-void type_domain_t::set_require_check(check_require_func_t f) {}
+void type_domain_t::print_ctx() const {
+    std::vector<int> ctx_keys = m_region.get_ctx_keys();
+    std::cout << "ctx: {\n";
+    for (auto const k : ctx_keys) {
+        std::optional<ptr_t> ptr = m_region.find_in_ctx(k);
+        if (ptr) {
+            std::cout << "  " << k << ": ";
+            print_ptr_type(ptr.value());
+            std::cout << ",\n";
+        }
+    }
+    std::cout << "}\n\n";
+}
+
+void type_domain_t::print_stack() const {
+    std::vector<int> stack_keys = m_region.get_stack_keys();
+    std::cout << "stack: {\n";
+    for (auto const k : stack_keys) {
+        std::optional<ptr_t> ptr = m_region.find_in_stack(k);
+        if (ptr) {
+            std::cout << "  " << k << ": ";
+            print_ptr_type(ptr.value());
+            std::cout << ",\n";
+        }
+    }
+    std::cout << "}\n\n";
+}
+
+void type_domain_t::print_initial_registers() const {
+    auto label = label_t::entry;
+    location_t loc = location_t(std::make_pair(label, 0));
+    std::cout << "Initial register types:\n";
+    m_region.print_registers_at(loc);
+}
+
+void type_domain_t::print_initial_types() const {
+    print_ctx();
+    print_stack();
+    print_initial_registers();
+}
+
+void type_domain_t::operator()(const basic_block_t& bb, int print) {
+    auto label = bb.label();
+    uint32_t curr_pos = 0;
+    location_t loc;
+    if (print > 0) {
+        if (label == label_t::entry) {
+            print_initial_types();
+            m_is_bottom = false;
+        }
+        std::cout << label << ":\n";
+    }
+
+    for (const Instruction& statement : bb) {
+        loc = location_t(std::make_pair(label, ++curr_pos));
+        if (print > 0) std::cout << " " << curr_pos << ".";
+        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
+    }
+
+    if (print > 0) {
+        auto [it, et] = bb.next_blocks();
+        if (it != et) {
+            std::cout << "  "
+            << "goto ";
+            for (; it != et;) {
+                std::cout << *it;
+                ++it;
+                if (it == et) {
+                    std::cout << ";";
+                } else {
+                    std::cout << ",";
+                }
+            }
+        }
+        std::cout << "\n\n";
+    }
+}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index c0cd87bc7..2a3f5656e 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -6,12 +6,17 @@
 #include <unordered_map>
 
 #include "crab/abstract_domain.hpp"
+#include "crab/region_domain.hpp"
 #include "crab/cfg.hpp"
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
 
-class type_domain_t final {
+using crab::ptr_t;
+using crab::ptr_with_off_t;
+using crab::ptr_no_off_t;
 
+class type_domain_t final {
+    region_domain_t m_region;
     bool m_is_bottom = false;
 
   public:
@@ -19,6 +24,8 @@ class type_domain_t final {
     type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
+    explicit type_domain_t(region_domain_t&& reg, bool is_bottom = false) :
+        m_region(reg), m_is_bottom(is_bottom) {}
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
@@ -59,19 +66,32 @@ class type_domain_t final {
     void operator()(const Packet &, location_t loc = boost::none, int print = 0);
     void operator()(const Assume &, location_t loc = boost::none, int print = 0);
     void operator()(const Assert &, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
+    void operator()(const Comparable& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Addable& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const TypeConstraint& s, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidMapKeyValue& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ZeroCtxOffset& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound();
     string_invariant to_set();
-    void set_require_check(check_require_func_t f);
+    void set_require_check(check_require_func_t f) {}
 
   private:
 
     void do_load(const Mem&, const Reg&, location_t, int print = 0);
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
-    void print_initial_types();
+    void print_initial_types() const;
     void report_type_error(std::string, location_t);
+    void print_ctx() const;
+    void print_stack() const;
+    void print_initial_registers() const;
 
 }; // end type_domain_t
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index e2cebdf1e..d63066e22 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -107,7 +107,9 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
 static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invariant_table_t& pre_invariants,
                                      crab::invariant_table_t& post_invariants) {
     // Analyze the control-flow graph.
-    if (thread_local_options.abstract_domain == abstract_domain_kind::REGION_DOMAIN) {
+    checks_db db = generate_report(cfg, pre_invariants, post_invariants);
+    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN
+            || thread_local_options.abstract_domain == abstract_domain_kind::REGION_DOMAIN) {
         auto state = post_invariants.at(label_t::exit);
         for (const label_t& label : cfg.sorted_labels()) {
             state(cfg.get_node(label), thread_local_options.print_invariants ? 2 : 1);
diff --git a/src/main/check.cpp b/src/main/check.cpp
index aac3713a4..42c9a682e 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -55,7 +55,7 @@ int main(int argc, char** argv) {
     app.add_flag("-l", list, "List sections");
 
     std::string domain = "zoneCrab";
-    std::set<string> doms{"stats", "linux", "zoneCrab", "region", "offset", "cfg"};
+    std::set<string> doms{"stats", "linux", "zoneCrab", "region", "cfg", "type"};
     app.add_set("-d,--dom,--domain", domain, doms, "Abstract domain")->type_name("DOMAIN");
 
     app.add_flag("--termination", ebpf_verifier_options.check_termination, "Verify termination");
diff --git a/src/test/test_verify_type_domain.cpp b/src/test/test_verify_type_domain.cpp
new file mode 100644
index 000000000..cadc10f24
--- /dev/null
+++ b/src/test/test_verify_type_domain.cpp
@@ -0,0 +1,577 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#include <thread>
+#include <catch2/catch_all.hpp>
+#include "ebpf_verifier.hpp"
+
+#define FAIL_LOAD_ELF(dirname, filename, sectionname) \
+    TEST_CASE("Try loading nonexisting program: " dirname "/" filename, "[elf]") { \
+        try { \
+            read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
+            REQUIRE(false); \
+        } catch (const std::runtime_error&) { \
+        }\
+    }
+
+// Some intentional failures
+FAIL_LOAD_ELF("cilium", "not-found.o", "2/1")
+FAIL_LOAD_ELF("cilium", "bpf_lxc.o", "not-found")
+FAIL_LOAD_ELF("build", "badrelo.o", ".text")
+FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
+
+#define FAIL_UNMARSHAL(dirname, filename, sectionname) \
+    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename, "[unmarshal]") { \
+        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
+        REQUIRE(raw_progs.size() == 1); \
+        raw_program raw_prog = raw_progs.back(); \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
+        REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
+    }
+
+// Some intentional unmarshal failures
+FAIL_UNMARSHAL("build", "wronghelper.o", "xdp")
+FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
+
+#define VERIFY_SECTION(dirname, filename, sectionname, options, pass) \
+    do { \
+        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
+        REQUIRE(raw_progs.size() == 1); \
+        raw_program raw_prog = raw_progs.back(); \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
+        REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
+        auto& prog = std::get<InstructionSeq>(prog_or_error); \
+        crab_results res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
+        if (pass)                                            \
+	  REQUIRE(res.pass_verify());			     \
+        else                                                 \
+	  REQUIRE(!res.pass_verify());			     \
+    } while (0)
+
+#define TEST_SECTION(project, filename, section) \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, true); \
+    }
+
+#define TEST_SECTION_REJECT(project, filename, section) \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, false); \
+    }
+
+#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section) \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, true); \
+        options.strict = true; \
+        VERIFY_SECTION(project, filename, section, &options, false); \
+    }
+
+#define TEST_SECTION_FAIL(project, filename, section) \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, true); \
+    }
+
+#define TEST_SECTION_REJECT_FAIL(project, filename, section) \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, false); \
+    }
+
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "1/0xdc06")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/3")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/4")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/5")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/6")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/7")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/10")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "from-container")
+
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "1/0x1010")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/3")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/4")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/5")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/6")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/7")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "from-container")
+
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "1/0x1010")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/3")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/4")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/5")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/6")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/7")
+TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "from-container")
+
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/3")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/4")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/5")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/7")
+TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "from-netdev")
+
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/3")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/4")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/5")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/7")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "3/2")
+TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "from-overlay")
+
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "from-netdev")
+
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "from-netdev")
+
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "2/1")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "2/2")
+TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "from-netdev")
+
+TEST_SECTION("cilium", "bpf_lb.o", "2/1")
+TEST_SECTION("cilium", "bpf_lb.o", "from-netdev")
+
+TEST_SECTION("cilium", "bpf_lxc.o", "1/0x1010")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/1")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/3")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/4")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/5")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/6")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/7")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/8")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/9")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/10")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/11")
+TEST_SECTION("cilium", "bpf_lxc.o", "2/12")
+TEST_SECTION("cilium", "bpf_lxc.o", "from-container")
+
+TEST_SECTION("cilium", "bpf_netdev.o", "2/1")
+TEST_SECTION("cilium", "bpf_netdev.o", "2/3")
+TEST_SECTION("cilium", "bpf_netdev.o", "2/4")
+TEST_SECTION("cilium", "bpf_netdev.o", "2/5")
+TEST_SECTION("cilium", "bpf_netdev.o", "2/7")
+TEST_SECTION("cilium", "bpf_netdev.o", "from-netdev")
+
+TEST_SECTION("cilium", "bpf_overlay.o", "2/1")
+TEST_SECTION("cilium", "bpf_overlay.o", "2/3")
+TEST_SECTION("cilium", "bpf_overlay.o", "2/4")
+TEST_SECTION("cilium", "bpf_overlay.o", "2/5")
+TEST_SECTION("cilium", "bpf_overlay.o", "2/7")
+TEST_SECTION("cilium", "bpf_overlay.o", "from-overlay")
+
+TEST_SECTION("cilium", "bpf_xdp.o", "from-netdev")
+
+TEST_SECTION("cilium", "bpf_xdp_dsr_linux_v1_1.o", "from-netdev")
+TEST_SECTION("cilium", "bpf_xdp_dsr_linux.o", "2/1")
+TEST_SECTION("cilium", "bpf_xdp_dsr_linux.o", "from-netdev")
+
+TEST_SECTION("cilium", "bpf_xdp_snat_linux.o", "2/1")
+TEST_SECTION("cilium", "bpf_xdp_snat_linux.o", "from-netdev")
+
+TEST_SECTION("linux", "cpustat_kern.o", "tracepoint/power/cpu_frequency")
+TEST_SECTION("linux", "cpustat_kern.o", "tracepoint/power/cpu_idle")
+TEST_SECTION("linux", "lathist_kern.o", "kprobe/trace_preempt_off")
+TEST_SECTION("linux", "lathist_kern.o", "kprobe/trace_preempt_on")
+TEST_SECTION("linux", "lwt_len_hist_kern.o", "len_hist")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getegid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_geteuid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getgid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getpgid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getppid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_gettid")
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getuid")
+TEST_SECTION("linux", "offwaketime_kern.o", "kprobe/try_to_wake_up")
+TEST_SECTION("linux", "offwaketime_kern.o", "tracepoint/sched/sched_switch")
+TEST_SECTION("linux", "sampleip_kern.o", "perf_event")
+TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock1")
+TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock2")
+TEST_SECTION("linux", "sockex1_kern.o", "socket1")
+TEST_SECTION("linux", "sockex2_kern.o", "socket2")
+TEST_SECTION("linux", "sockex3_kern.o", "socket/3")
+TEST_SECTION("linux", "sockex3_kern.o", "socket/4")
+TEST_SECTION("linux", "sockex3_kern.o", "socket/1")
+TEST_SECTION("linux", "sockex3_kern.o", "socket/2")
+TEST_SECTION("linux", "sockex3_kern.o", "socket/0")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/__htab_percpu_map_update_elem")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_bh")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_irq")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_irqsave")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_trylock_bh")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_trylock")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock_bh")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock_irqrestore")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/htab_map_alloc")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/htab_map_update_elem")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/mutex_spin_on_owner")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/rwsem_spin_on_owner")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_lock")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_unlock")
+TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_unlock_irqrestore")
+TEST_SECTION("linux", "syscall_tp_kern.o", "tracepoint/syscalls/sys_enter_open")
+TEST_SECTION("linux", "syscall_tp_kern.o", "tracepoint/syscalls/sys_exit_open")
+TEST_SECTION("linux", "task_fd_query_kern.o", "kprobe/blk_start_request")
+TEST_SECTION("linux", "task_fd_query_kern.o", "kretprobe/blk_account_io_completion")
+TEST_SECTION("linux", "tc_l2_redirect_kern.o", "drop_non_tun_vip")
+TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_ip6tun_ingress_redirect")
+TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_iptun_ingress_forward")
+TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_iptun_ingress_redirect")
+TEST_SECTION("linux", "tcp_basertt_kern.o", "sockops")
+TEST_SECTION("linux", "tcp_bufs_kern.o", "sockops")
+TEST_SECTION("linux", "tcp_cong_kern.o", "sockops")
+TEST_SECTION("linux", "tcp_iw_kern.o", "sockops")
+TEST_SECTION("linux", "tcbpf1_kern.o", "classifier")
+TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_recv")
+TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_xmit")
+TEST_SECTION("linux", "tcbpf1_kern.o", "redirect_recv")
+TEST_SECTION("linux", "tcbpf1_kern.o", "redirect_xmit")
+TEST_SECTION("linux", "tcp_clamp_kern.o", "sockops")
+TEST_SECTION("linux", "tcp_rwnd_kern.o", "sockops")
+TEST_SECTION("linux", "tcp_synrto_kern.o", "sockops")
+TEST_SECTION("linux", "test_cgrp2_tc_kern.o", "filter")
+TEST_SECTION("linux", "test_current_task_under_cgroup_kern.o", "kprobe/sys_sync")
+TEST_SECTION("linux", "test_overhead_kprobe_kern.o", "kprobe/__set_task_comm")
+TEST_SECTION("linux", "test_overhead_kprobe_kern.o", "kprobe/urandom_read")
+TEST_SECTION("linux", "test_overhead_raw_tp_kern.o", "raw_tracepoint/task_rename")
+TEST_SECTION("linux", "test_overhead_raw_tp_kern.o", "raw_tracepoint/urandom_read")
+TEST_SECTION("linux", "test_overhead_tp_kern.o", "tracepoint/random/urandom_read")
+TEST_SECTION("linux", "test_overhead_tp_kern.o", "tracepoint/task/task_rename")
+TEST_SECTION("linux", "test_probe_write_user_kern.o", "kprobe/sys_connect")
+TEST_SECTION("linux", "trace_event_kern.o", "perf_event")
+TEST_SECTION("linux", "trace_output_kern.o", "kprobe/sys_write")
+TEST_SECTION("linux", "tracex1_kern.o", "kprobe/__netif_receive_skb_core")
+TEST_SECTION("linux", "tracex2_kern.o", "kprobe/kfree_skb")
+TEST_SECTION("linux", "tracex2_kern.o", "kprobe/sys_write")
+TEST_SECTION("linux", "tracex3_kern.o", "kprobe/blk_account_io_completion")
+TEST_SECTION("linux", "tracex3_kern.o", "kprobe/blk_start_request")
+TEST_SECTION("linux", "tracex4_kern.o", "kprobe/kmem_cache_free")
+TEST_SECTION("linux", "tracex4_kern.o", "kretprobe/kmem_cache_alloc_node")
+TEST_SECTION("linux", "tracex5_kern.o", "kprobe/__seccomp_filter")
+TEST_SECTION("linux", "tracex5_kern.o", "kprobe/0")
+TEST_SECTION("linux", "tracex5_kern.o", "kprobe/1")
+TEST_SECTION("linux", "tracex5_kern.o", "kprobe/9")
+TEST_SECTION("linux", "tracex6_kern.o", "kprobe/htab_map_get_next_key")
+TEST_SECTION("linux", "tracex6_kern.o", "kprobe/htab_map_lookup_elem")
+TEST_SECTION("linux", "tracex7_kern.o", "kprobe/open_ctree")
+TEST_SECTION("linux", "xdp_adjust_tail_kern.o", "xdp_icmp")
+TEST_SECTION("linux", "xdp_fwd_kern.o", "xdp_fwd")
+TEST_SECTION("linux", "xdp_fwd_kern.o", "xdp_fwd_direct")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_devmap_xmit")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_exception")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_err")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map")
+TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map0")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map1_touch_data")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map2_round_robin")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map3_proto_separate")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map4_ddos_filter_pktgen")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map5_lb_hash_ip_pairs")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_exception")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_err")
+TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
+TEST_SECTION("linux", "xdp_redirect_kern.o", "xdp_redirect")
+TEST_SECTION("linux", "xdp_redirect_kern.o", "xdp_redirect_dummy")
+TEST_SECTION("linux", "xdp_redirect_map_kern.o", "xdp_redirect_dummy")
+TEST_SECTION("linux", "xdp_redirect_map_kern.o", "xdp_redirect_map")
+TEST_SECTION("linux", "xdp_router_ipv4_kern.o", "xdp_router_ipv4")
+TEST_SECTION("linux", "xdp_rxq_info_kern.o", "xdp_prog0")
+TEST_SECTION("linux", "xdp_sample_pkts_kern.o", "xdp_sample")
+TEST_SECTION("linux", "xdp_tx_iptunnel_kern.o", "xdp_tx_iptunnel")
+TEST_SECTION("linux", "xdp1_kern.o", "xdp1")
+TEST_SECTION("linux", "xdp2_kern.o", "xdp1")
+TEST_SECTION("linux", "xdp2skb_meta_kern.o", "tc_mark")
+TEST_SECTION("linux", "xdp2skb_meta_kern.o", "xdp_mark")
+TEST_SECTION("linux", "xdpsock_kern.o", "xdp_sock")
+// Finally passes; still requires double-check
+TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_connect")
+
+TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_entry")
+TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_exit")
+TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_raise")
+TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/napi/napi_poll")
+TEST_SECTION("prototype-kernel", "tc_bench01_redirect_kern.o", "ingress_redirect")
+TEST_SECTION("prototype-kernel", "xdp_bench01_mem_access_cost_kern.o", "xdp_bench01")
+TEST_SECTION("prototype-kernel", "xdp_bench02_drop_pattern_kern.o", "xdp_bench02")
+TEST_SECTION("prototype-kernel", "xdp_ddos01_blacklist_kern.o", "xdp_prog")
+TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect")
+TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_err")
+TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
+TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map0")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map2_round_robin")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_exception")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_err")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map1_touch_data")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map3_proto_separate")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map4_ddos_filter_pktgen")
+TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map5_ip_l3_flow_hash")
+TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_dummy")
+TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_map")
+TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_map_rr")
+TEST_SECTION("prototype-kernel", "xdp_tcpdump_kern.o", "xdp_tcpdump_to_perf_ring")
+TEST_SECTION("prototype-kernel", "xdp_ttl_kern.o", "xdp_ttl")
+TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "tc_vlan_push")
+TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_drop_vlan_4011")
+TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_change")
+TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_remove_outer")
+TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_remove_outer2")
+
+TEST_SECTION("ovs", "datapath.o", "tail-0")
+TEST_SECTION("ovs", "datapath.o", "tail-1")
+TEST_SECTION("ovs", "datapath.o", "tail-2")
+TEST_SECTION("ovs", "datapath.o", "tail-3")
+TEST_SECTION("ovs", "datapath.o", "tail-4")
+TEST_SECTION("ovs", "datapath.o", "tail-5")
+TEST_SECTION("ovs", "datapath.o", "tail-7")
+TEST_SECTION("ovs", "datapath.o", "tail-8")
+TEST_SECTION("ovs", "datapath.o", "tail-11")
+TEST_SECTION("ovs", "datapath.o", "tail-12")
+TEST_SECTION("ovs", "datapath.o", "tail-13")
+TEST_SECTION("ovs", "datapath.o", "tail-32")
+TEST_SECTION("ovs", "datapath.o", "tail-33")
+TEST_SECTION("ovs", "datapath.o", "tail-35")
+TEST_SECTION("ovs", "datapath.o", "af_xdp")
+TEST_SECTION("ovs", "datapath.o", "downcall")
+TEST_SECTION("ovs", "datapath.o", "egress")
+TEST_SECTION("ovs", "datapath.o", "ingress")
+TEST_SECTION("ovs", "datapath.o", "xdp")
+
+TEST_SECTION("suricata", "bypass_filter.o", "filter")
+TEST_SECTION("suricata", "lb.o", "loadbalancer")
+TEST_SECTION("suricata", "filter.o", "filter")
+TEST_SECTION("suricata", "vlan_filter.o", "filter")
+TEST_SECTION("suricata", "xdp_filter.o", "xdp")
+
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_accept4_e")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_empty")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_pread64_e")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_preadv64_e")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_pwrite64_e")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_single_x")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_sysdigevent_e")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/terminate_filler")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/page_fault_kernel")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/page_fault_user")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/sched_switch")
+TEST_SECTION("falco", "probe.o", "raw_tracepoint/signal_deliver")
+
+// Test some programs that should pass verification except when the strict flag is set.
+TEST_SECTION_REJECT_IF_STRICT("build", "mapoverflow.o", ".text")
+TEST_SECTION_REJECT_IF_STRICT("build", "mapunderflow.o", ".text")
+
+/*
+ * These programs contain "call -1" instruction and cannot be verified:
+TEST_SECTION("raw_tracepoint/filler/sys_access_e")
+TEST_SECTION("raw_tracepoint/filler/sys_bpf_x")
+TEST_SECTION("raw_tracepoint/filler/sys_brk_munmap_mmap_x")
+TEST_SECTION("raw_tracepoint/filler/sys_eventfd_e")
+TEST_SECTION("raw_tracepoint/filler/sys_execve_e")
+TEST_SECTION("raw_tracepoint/filler/sys_generic")
+TEST_SECTION("raw_tracepoint/filler/sys_getrlimit_setrlimit_e")
+TEST_SECTION("raw_tracepoint/filler/sys_getrlimit_setrlrimit_x")
+TEST_SECTION("raw_tracepoint/filler/sys_mount_e")
+TEST_SECTION("raw_tracepoint/filler/sys_nanosleep_e")
+TEST_SECTION("raw_tracepoint/filler/sys_pagefault_e")
+TEST_SECTION("raw_tracepoint/filler/sys_procexit_e")
+TEST_SECTION("raw_tracepoint/filler/sys_single")
+TEST_SECTION("raw_tracepoint/filler/sys_unshare_e")
+TEST_SECTION("raw_tracepoint/sched_process_exit")
+TEST_SECTION("raw_tracepoint/filler/sys_chmod_x")
+TEST_SECTION("raw_tracepoint/filler/sys_fchmod_x")
+TEST_SECTION("raw_tracepoint/filler/sys_fcntl_e")
+TEST_SECTION("raw_tracepoint/filler/sys_flock_e")
+TEST_SECTION("raw_tracepoint/filler/sys_poll_x")
+TEST_SECTION("raw_tracepoint/filler/sys_prlimit_e")
+TEST_SECTION("raw_tracepoint/filler/sys_prlimit_x")
+TEST_SECTION("raw_tracepoint/filler/sys_ptrace_e")
+TEST_SECTION("raw_tracepoint/filler/sys_quotactl_e")
+TEST_SECTION("raw_tracepoint/filler/sys_semop_x")
+TEST_SECTION("raw_tracepoint/filler/sys_send_e")
+TEST_SECTION("raw_tracepoint/filler/sys_sendfile_x")
+TEST_SECTION("raw_tracepoint/filler/sys_setns_e")
+TEST_SECTION("raw_tracepoint/filler/sys_shutdown_e")
+TEST_SECTION("raw_tracepoint/filler/sys_fchmodat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_futex_e")
+TEST_SECTION("raw_tracepoint/filler/sys_lseek_e")
+TEST_SECTION("raw_tracepoint/filler/sys_mkdirat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_poll_e")
+TEST_SECTION("raw_tracepoint/filler/sys_ptrace_x")
+TEST_SECTION("raw_tracepoint/filler/sys_quotactl_x")
+TEST_SECTION("raw_tracepoint/filler/sys_semget_e")
+TEST_SECTION("raw_tracepoint/filler/sys_signaldeliver_e")
+TEST_SECTION("raw_tracepoint/filler/sys_symlinkat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_unlinkat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_writev_e")
+TEST_SECTION("raw_tracepoint/filler/sys_llseek_e")
+TEST_SECTION("raw_tracepoint/filler/sys_ppoll_e")
+TEST_SECTION("raw_tracepoint/filler/sys_pwritev_e")
+TEST_SECTION("raw_tracepoint/filler/sys_renameat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_semctl_e")
+TEST_SECTION("raw_tracepoint/filler/sched_switch_e")
+TEST_SECTION("raw_tracepoint/filler/sys_getsockopt_x")
+TEST_SECTION("raw_tracepoint/filler/sys_linkat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_renameat2_x")
+TEST_SECTION("raw_tracepoint/filler/sys_sendfile_e")
+TEST_SECTION("raw_tracepoint/filler/sys_setsockopt_x")
+TEST_SECTION("raw_tracepoint/filler/sys_getresuid_and_gid_x")
+TEST_SECTION("raw_tracepoint/filler/sys_mmap_e")
+TEST_SECTION("raw_tracepoint/filler/sys_socket_bind_x")
+TEST_SECTION("raw_tracepoint/filler/sys_socket_x")
+TEST_SECTION("raw_tracepoint/sys_enter")
+TEST_SECTION("raw_tracepoint/sys_exit")
+TEST_SECTION("raw_tracepoint/filler/sys_pipe_x")
+TEST_SECTION("raw_tracepoint/filler/sys_socketpair_x")
+TEST_SECTION("raw_tracepoint/filler/sys_creat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_open_x")
+TEST_SECTION("raw_tracepoint/filler/sys_openat_x")
+TEST_SECTION("raw_tracepoint/filler/sys_autofill")
+TEST_SECTION("raw_tracepoint/filler/proc_startupdate")
+TEST_SECTION("raw_tracepoint/filler/sys_recvmsg_x_2")
+TEST_SECTION("raw_tracepoint/filler/sys_sendmsg_e")
+TEST_SECTION("raw_tracepoint/filler/sys_connect_x")
+TEST_SECTION("raw_tracepoint/filler/sys_sendto_e")
+TEST_SECTION("raw_tracepoint/filler/sys_accept_x")
+TEST_SECTION("raw_tracepoint/filler/sys_read_x")
+TEST_SECTION("raw_tracepoint/filler/sys_recv_x")
+TEST_SECTION("raw_tracepoint/filler/sys_recvmsg_x")
+TEST_SECTION("raw_tracepoint/filler/sys_send_x")
+TEST_SECTION("raw_tracepoint/filler/proc_startupdate_3")
+TEST_SECTION("raw_tracepoint/filler/sys_readv_preadv_x")
+TEST_SECTION("raw_tracepoint/filler/sys_write_x")
+TEST_SECTION("raw_tracepoint/filler/sys_writev_pwritev_x")
+TEST_SECTION("raw_tracepoint/filler/sys_sendmsg_x")
+TEST_SECTION("raw_tracepoint/filler/proc_startupdate_2")
+TEST_SECTION("raw_tracepoint/filler/sys_recvfrom_x")
+*/
+TEST_SECTION("build", "byteswap.o", ".text")
+TEST_SECTION("build", "stackok.o", ".text")
+TEST_SECTION("build", "packet_start_ok.o", "xdp")
+TEST_SECTION("build", "packet_access.o", "xdp")
+TEST_SECTION("build", "tail_call.o", "xdp_prog")
+TEST_SECTION("build", "map_in_map.o", ".text")
+TEST_SECTION("build", "map_in_map_legacy.o", ".text")
+TEST_SECTION("build", "twomaps.o", ".text");
+TEST_SECTION("build", "twostackvars.o", ".text");
+TEST_SECTION("build", "twotypes.o", ".text");
+
+// Test some programs that ought to fail verification.
+TEST_SECTION_REJECT("build", "badhelpercall.o", ".text")
+TEST_SECTION_REJECT("build", "ctxoffset.o", "sockops")
+TEST_SECTION_REJECT("build", "badmapptr.o", "test")
+TEST_SECTION_REJECT("build", "exposeptr.o", ".text")
+TEST_SECTION_REJECT("build", "exposeptr2.o", ".text")
+TEST_SECTION_REJECT("build", "mapvalue-overrun.o", ".text")
+TEST_SECTION_REJECT("build", "nullmapref.o", "test")
+TEST_SECTION_REJECT("build", "packet_overflow.o", "xdp")
+TEST_SECTION_REJECT("build", "packet_reallocate.o", "socket_filter")
+TEST_SECTION_REJECT("build", "tail_call_bad.o", "xdp_prog")
+TEST_SECTION_REJECT("build", "ringbuf_uninit.o", ".text");
+
+// The following eBPF programs currently fail verification.
+// If the verifier is later updated to accept them, these should
+// be changed to TEST_SECTION().
+
+// Unsupported: ebpf-function
+TEST_SECTION_FAIL("prototype-kernel", "xdp_ddos01_blacklist_kern.o", ".text")
+
+// Unsupported: implications are lost in correlated branches
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/7")
+
+// Failure: 166:168: Upper bound must be at most packet_size (valid_access(r4.offset, width=2) for read)
+// This is the result of merging two branches, one with value 0 and another with value -22,
+// then checking that the result is != 0. The minor issue is not handling the int32 comparison precisely enough.
+// The bigger issue is that the convexity of the numerical domain means that precise handling would still get
+// [-22, -1] which is not sufficient (at most -2 is needed)
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/10")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/21")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/24")
+
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/15")
+
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/17")
+
+// Failure: trying to access r4 where r4.packet_offset=[0, 255] and packet_size=[54, 65534]
+// Root cause: r5.value=[0, 65535] 209: w5 >>= 8; clears r5 instead of yielding [0, 255]
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/18")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/10")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/18")
+
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/19")
+
+// Failure: 230: Upper bound must be at most packet_size (valid_access(r3.offset+32, width=8) for write)
+// r3.packet_offset=[0, 82] and packet_size=[34, 65534]
+// looks like a combination of misunderstanding the value passed to xdp_adjust_tail()
+// which is "r7.value=[0, 82]; w7 -= r9;" where r9.value where "r7.value-r9.value<=48"
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/20")
+
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/7")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/15")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/17")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/19")
+
+// Failure (&255): assert r5.type == number; w5 &= 255;
+// fails since in one branch (77) r5 is a number but in another (92:93) it is a packet
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/24")
+// Failure (&255): assert r3.type == number; w3 &= 255;
+TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/16")
+TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/16")
+
+// False positive, unknown cause
+TEST_SECTION_FAIL("linux", "test_map_in_map_kern.o", "kprobe/sys_connect")
+
+void test_analyze_thread(cfg_t* cfg, program_info* info, bool* res) {
+    *res = run_ebpf_analysis(std::cout, *cfg, *info, nullptr, nullptr);
+}
+
+// Test multithreading
+TEST_CASE("multithreading", "[verify][multithreading]") {
+    auto raw_progs1 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/1", nullptr, &g_ebpf_platform_linux);
+    REQUIRE(raw_progs1.size() == 1);
+    raw_program raw_prog1 = raw_progs1.back();
+    std::variant<InstructionSeq, std::string> prog_or_error1 = unmarshal(raw_prog1);
+    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error1));
+    auto& prog1 = std::get<InstructionSeq>(prog_or_error1);
+    cfg_t cfg1 = prepare_cfg(prog1, raw_prog1.info, true);
+
+    auto raw_progs2 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/2", nullptr, &g_ebpf_platform_linux);
+    REQUIRE(raw_progs2.size() == 1);
+    raw_program raw_prog2 = raw_progs2.back();
+    std::variant<InstructionSeq, std::string> prog_or_error2 = unmarshal(raw_prog2);
+    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error2));
+    auto& prog2 = std::get<InstructionSeq>(prog_or_error2);
+    cfg_t cfg2 = prepare_cfg(prog2, raw_prog2.info, true);
+
+    bool res1, res2;
+    std::thread a(test_analyze_thread, &cfg1, &raw_prog1.info, &res1);
+    std::thread b(test_analyze_thread, &cfg2, &raw_prog2.info, &res2);
+    a.join();
+    b.join();
+
+    REQUIRE(res1);
+    REQUIRE(res2);
+}

From 838002fb59c658b788da2db73934d66a23014074 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 12 Jul 2023 04:21:37 -0400
Subject: [PATCH 100/373] Implementing all important transformers, assertion
 checks, join for all important types; Better printing and error reporting

Only accessible domain is type domain, while region domain is not;
Printing only allowed from type domain;
Support for map_fd registers and storing/loading into/from stack;
Implement all important transformers, assertion checks, and join related to region domain;
Report errors similar to how ebpf domain reports them to help verify results, which is important to run tests;
Add support for shared pointers as containing offsets and fixed related operations;
Add support for keeping track of widths of pointers stored in stack, but not for register pointers

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp |    7 +
 src/crab/abstract_domain.hpp |    3 +
 src/crab/ebpf_domain.hpp     |    1 +
 src/crab/interval.hpp        |    4 +-
 src/crab/region_domain.cpp   | 1149 ++++++++++++++++++----------------
 src/crab/region_domain.hpp   |  178 ++++--
 src/crab/type_domain.cpp     |  453 +++++++++++---
 src/crab/type_domain.hpp     |   33 +-
 src/crab_verifier.cpp        |   45 +-
 src/main/check.cpp           |    9 +-
 10 files changed, 1154 insertions(+), 728 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index cc20d4189..059e746c6 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -190,6 +190,11 @@ void abstract_domain_t::abstract_domain_model<Domain>::set_require_check(check_r
     m_abs_val.set_require_check(f);
 }
 
+template <typename Domain>
+std::vector<std::string> abstract_domain_t::abstract_domain_model<Domain>::get_errors() {
+    return m_abs_val.get_errors();
+}
+
 abstract_domain_t::abstract_domain_t(std::unique_ptr<typename abstract_domain_t::abstract_domain_concept> concept_)
     : m_concept(std::move(concept_)) {}
 
@@ -278,6 +283,8 @@ string_invariant abstract_domain_t::to_set() { return m_concept->to_set(); }
 
 void abstract_domain_t::set_require_check(check_require_func_t f) { m_concept->set_require_check(f); }
 
+std::vector<std::string> abstract_domain_t::get_errors() { return m_concept->get_errors(); }
+
 std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
     dom.write(o);
     return o;
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index 172d93f36..7b5f297ab 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -52,6 +52,7 @@ class abstract_domain_t {
         virtual void initialize_loop_counter(const label_t) = 0;
         virtual string_invariant to_set() = 0;
         virtual void set_require_check(check_require_func_t f) = 0;
+        virtual std::vector<std::string> get_errors() = 0;
     }; // end class abstract_domain_concept
 
     template <typename Domain>
@@ -90,6 +91,7 @@ class abstract_domain_t {
         crab::bound_t get_loop_count_upper_bound() override;
         string_invariant to_set() override;
         void set_require_check(check_require_func_t f) override;
+        std::vector<std::string> get_errors() override;
     }; // end class abstract_domain_model
 
     std::unique_ptr<abstract_domain_concept> m_concept;
@@ -132,6 +134,7 @@ class abstract_domain_t {
     void initialize_loop_counter(const label_t);
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
+    std::vector<std::string> get_errors();
 
     friend std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom);
 };
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 83966e936..6ace2e9a9 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -50,6 +50,7 @@ class ebpf_domain_t final {
     void set_require_check(std::function<check_require_func_t> f);
     bound_t get_loop_count_upper_bound();
     static ebpf_domain_t setup_entry(bool init_r1);
+    std::vector<std::string> get_errors() { return std::vector<std::string>(); }
 
     static ebpf_domain_t from_constraints(const std::set<std::string>& constraints, bool setup_constraints);
     string_invariant to_set();
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 47878de00..972f4f8bf 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -232,6 +232,8 @@ class interval_t final {
     bound_t _ub;
 
   public:
+    interval_t() : _lb(number_t{0}), _ub(-1) {}
+
     static interval_t top() { return interval_t(bound_t::minus_infinity(), bound_t::plus_infinity()); }
 
     static interval_t bottom() { return interval_t(); }
@@ -239,8 +241,6 @@ class interval_t final {
     [[nodiscard]] std::optional<number_t> finite_size() const { return (_ub - _lb).number(); }
 
   private:
-    interval_t() : _lb(number_t{0}), _ub(-1) {}
-
     static number_t abs(const number_t& x) { return x < 0 ? -x : x; }
 
     static number_t max(const number_t& x, const number_t& y) { return x.operator<=(y) ? y : x; }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 7c3920e11..359503152 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1,12 +1,12 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include <unordered_map>
-
 #include "crab/region_domain.hpp"
 
 using crab::___print___;
 using crab::ptr_t;
+using crab::mapfd_t;
+using crab::ptr_or_mapfd_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
 using crab::ctx_t;
@@ -14,9 +14,9 @@ using crab::global_region_env_t;
 using crab::reg_with_loc_t;
 using crab::live_registers_t;
 using crab::register_types_t;
-
-static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
-
+using crab::map_key_size_t;
+using crab::map_value_size_t;
+using crab::ptr_or_mapfd_cells_t;
 
 namespace std {
     template <>
@@ -42,96 +42,71 @@ namespace std {
             }
         }
     };
-
-    template <>
-    struct equal_to<crab::ptr_with_off_t> {
-        constexpr bool operator()(const crab::ptr_with_off_t& p1, const crab::ptr_with_off_t& p2) const {
-            return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
-        }
-    };
-
-    template <>
-    struct equal_to<crab::ptr_no_off_t> {
-        constexpr bool operator()(const crab::ptr_no_off_t& p1, const crab::ptr_no_off_t& p2) const {
-            return (p1.get_region() == p2.get_region());
-        }
-    };
     */
-}
-
 
-static void print_ptr_type(const ptr_t& p) {
-    if (std::holds_alternative<ptr_with_off_t>(p)) {
-        auto t = std::get<ptr_with_off_t>(p);
-        std::cout << t;
+    static ptr_t get_ptr(const ptr_or_mapfd_t& t) {
+    return std::visit( overloaded
+               {
+                   []( const ptr_with_off_t& x ){ return ptr_t{x};},
+                   []( const ptr_no_off_t& x ){ return ptr_t{x};},
+                   []( auto& ) { return ptr_t{};}
+                }, t
+            );
     }
-    else {
-        auto t = std::get<ptr_no_off_t>(p);
-        std::cout << t;
-    }
-}
-
-static void print_type(register_t r, const ptr_t& p) {
-    std::cout << "r" << static_cast<unsigned int>(r) << " : ";
-    print_ptr_type(p);
 }
 
-static void print_annotated(Mem const& b, const ptr_t& p, std::ostream& os_) {
-    if (b.is_load) {
-        os_ << "  ";
-        print_type(std::get<Reg>(b.value).v, p);
-        os_ << " = ";
-    }
-    std::string sign = b.access.offset < 0 ? " - " : " + ";
-    int offset = std::abs(b.access.offset);
-    os_ << "*(" << size(b.access.width) << " *)";
-    os_ << "(" << b.access.basereg << sign << offset << ")\n";
-}
-
-static void print_annotated(Call const& call, const ptr_t& p, std::ostream& os_) {
-    os_ << "  ";
-    print_type(0, p);
-    os_ << " = " << call.name << ":" << call.func << "(...)\n";
-}
-
-static void print_annotated(Bin const& b, const ptr_t& p, std::ostream& os_) {
-    os_ << "  ";
-    print_type(b.dst.v, p);
-    // add better checks as we add more support
-    if (std::holds_alternative<Reg>(b.v)) {
-        if (b.op == Bin::Op::MOV)
-            os_ << " = r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
-        else if (b.op == Bin::Op::ADD)
-            os_ << " += r" << static_cast<unsigned int>(std::get<Reg>(b.v).v) << ";";
-    }
-    else {
-        if (b.op == Bin::Op::ADD)
-            os_ << " += " << static_cast<int>(std::get<Imm>(b.v).v) << ";";
-    }
-}
 
 namespace crab {
 
-inline std::string get_reg_ptr(const region& r) {
+inline std::string get_reg_ptr(const region_t& r) {
     switch (r) {
-        case region::T_CTX:
+        case region_t::T_CTX:
             return "ctx_p";
-        case region::T_STACK:
+        case region_t::T_STACK:
             return "stack_p";
-        case region::T_PACKET:
+        case region_t::T_PACKET:
             return "packet_p";
         default:
             return "shared_p";
     }
 }
 
-inline std::ostream& operator<<(std::ostream& o, const region& t) {
-    o << static_cast<std::underlying_type<region>::type>(t);
+static bool same_region(const ptr_t& ptr1, const ptr_t& ptr2) {
+    return ((std::holds_alternative<ptr_with_off_t>(ptr1)
+                && std::holds_alternative<ptr_with_off_t>(ptr2))
+            || (std::holds_alternative<ptr_no_off_t>(ptr1)
+                && std::holds_alternative<ptr_no_off_t>(ptr2)));
+}
+
+static void print_ptr_type(const ptr_t& ptr) {
+    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
+        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
+        std::cout << ptr_with_off;
+    }
+    else {
+        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
+        std::cout << ptr_no_off;
+    }
+}
+
+static void print_ptr_or_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
+    if (std::holds_alternative<mapfd_t>(ptr_or_mapfd)) {
+        std::cout << std::get<mapfd_t>(ptr_or_mapfd);
+    }
+    else {
+        auto ptr = get_ptr(ptr_or_mapfd);
+        print_ptr_type(ptr);
+    }
+}
+
+inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
+    o << static_cast<std::underlying_type<region_t>::type>(t);
     return o;
 }
 
 bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset());
+    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset()
+            && p1.get_region_size() == p2.get_region_size());
 }
 
 bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
@@ -139,7 +114,9 @@ bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
 }
 
 void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r) << "<" << m_offset << ">";
+    o << get_reg_ptr(m_r) << "<" << m_offset;
+    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size;
+    o << ">";
 }
 
 std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
@@ -147,9 +124,17 @@ std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
     return o;
 }
 
-void ptr_with_off_t::set_offset(int off) { m_offset = off; }
+interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
 
-void ptr_with_off_t::set_region(region r) { m_r = r; }
+void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
+
+void ptr_with_off_t::set_region_size(interval_t region_sz) { m_region_size = region_sz; }
+
+void ptr_with_off_t::set_region(region_t r) { m_r = r; }
+
+ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
+    return ptr_with_off_t(m_r, m_offset | other.m_offset, m_region_size | other.m_region_size);
+}
 
 bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
     return (p1.get_region() == p2.get_region());
@@ -168,7 +153,29 @@ std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
     return o;
 }
 
-void ptr_no_off_t::set_region(region r) { m_r = r; }
+void ptr_no_off_t::set_region(region_t r) { m_r = r; }
+
+bool operator==(const mapfd_t& m1, const mapfd_t& m2) {
+    return (m1.get_value_type() == m2.get_value_type());
+}
+
+std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
+    m.write(o);
+    return o;
+}
+
+bool mapfd_t::has_type_map_programs() const {
+    return (m_value_type == EbpfMapValueType::PROGRAM);
+}
+
+void mapfd_t::write(std::ostream& o) const {
+    if (has_type_map_programs()) {
+        o << "map_fd_programs";
+    }
+    else {
+        o << "map_fd";
+    }
+}
 
 void reg_with_loc_t::write(std::ostream& o) const {
     o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
@@ -195,51 +202,29 @@ std::size_t reg_with_loc_t::hash() const {
     return seed;
 }
 
-std::ostream& operator<<(std::ostream& o, const stack_t& st) {
-    o << "Stack: ";
-    if (st.is_bottom())
-        o << "_|_\n";
-    else {
-        o << "{";
-        for (auto s : st.m_ptrs) {
-            o << s.first << ": ";
-            print_ptr_type(s.second);
-            o << ", ";
-        }
-        o << "}";
-    }
-    return o;
-}
-
-std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx) {
-
-    o << "type of context: " << (_ctx.m_packet_ptrs.empty() ? "top" : "") << "\n";
-    for (const auto& it : _ctx.m_packet_ptrs) {
-        o << "  stores at " << it.first << ": " << it.second << "\n";
-    }
-    return o;
-}
-
 ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
 {
-    if (desc->data != -1) {
-        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->data >= 0) {
+        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
+    }
+    if (desc->end >= 0) {
+        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
     }
-    if (desc->end != -1) {
-        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->meta >= 0) {
+        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
     }
-    if (desc->meta != -1) {
-        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region::T_PACKET);
+    if (desc->size >= 0) {
+        size = desc->size;
     }
 }
 
-size_t ctx_t::size() const {
-    return m_packet_ptrs.size();
+int ctx_t::get_size() const {
+    return size;
 }
 
-std::vector<int> ctx_t::get_keys() const {
-    std::vector<int> keys;
-    keys.reserve(size());
+std::vector<uint64_t> ctx_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(size);
 
     for (auto const&kv : m_packet_ptrs) {
         keys.push_back(kv.first);
@@ -247,26 +232,12 @@ std::vector<int> ctx_t::get_keys() const {
     return keys;
 }
 
-std::optional<ptr_no_off_t> ctx_t::find(int key) const {
+std::optional<ptr_no_off_t> ctx_t::find(uint64_t key) const {
     auto it = m_packet_ptrs.find(key);
     if (it == m_packet_ptrs.end()) return {};
     return it->second;
 }
 
-
-std::ostream& operator<<(std::ostream& o, const register_types_t& typ) {
-    if (typ.is_bottom())
-        o << "_|_\n";
-    else {
-        for (const auto& v : *(typ.m_region_env)) {
-            o << v.first << ": ";
-            print_ptr_type(v.second);
-            o << "\n";
-        }
-    }
-    return o;
-}
-
 register_types_t register_types_t::operator|(const register_types_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -274,28 +245,39 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
         return *this;
     }
     live_registers_t out_vars;
+
+    // a hack to store region information at the start of a joined basic block
+    // in join, we do not know the label of the bb, hence we store the information
+    // at a bb that is not used anywhere else in the program, and later when we know
+    // the bb label, we can fix
+    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+
     for (size_t i = 0; i < m_cur_def.size(); i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2) {
-            ptr_t pt1 = it1.value(), pt2 = it2.value();
-            if (pt1 == pt2) {
+            ptr_or_mapfd_t ptr_or_mapfd1 = it1.value(), ptr_or_mapfd2 = it2.value();
+            auto reg = reg_with_loc_t((register_t)i, loc);
+            if (ptr_or_mapfd1 == ptr_or_mapfd2) {
                 out_vars[i] = m_cur_def[i];
             }
-            // TODO
-            //else if (std::holds_alternative<ptr_with_off_t>(pt1)
-            //        && std::holds_alternative<ptr_with_off_t>(pt2)) {
-            //    auto pt_with_off1 = std::get<ptr_with_off_t>(pt1);
-            //    auto pt_with_off2 = std::get<ptr_with_off_t>(pt2);
-            //    if (pt_with_off1.get_region() == pt_with_off2.get_region()) {
-            //        //out_vars[i] = std::make_shared<ptr_no_off_t(pt_with_off1.get_region());
-            //    }
-            //}
-            //implement above the same for offset_domain
+            else if (!std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
+                    && !std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                auto ptr1 = get_ptr(ptr_or_mapfd1);
+                auto ptr2 = get_ptr(ptr_or_mapfd2);
+                if (std::holds_alternative<ptr_with_off_t>(ptr1)
+                        && std::holds_alternative<ptr_with_off_t>(ptr2)) {
+                    ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr1);
+                    ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr2);
+                    if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                        out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
+                        (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
+                    }
+                }
+            }
         }
     }
-
     return register_types_t(std::move(out_vars), m_region_env, false);
 }
 
@@ -307,7 +289,6 @@ void register_types_t::operator-=(register_t var) {
 }
 
 void register_types_t::set_to_bottom() {
-    m_cur_def = live_registers_t{nullptr};
     m_is_bottom = true;
 }
 
@@ -327,34 +308,51 @@ bool register_types_t::is_top() const {
     return true;
 }
 
-void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type) {
+void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
+        const ptr_or_mapfd_t& type) {
     (*m_region_env)[reg_with_loc] = type;
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
-std::optional<ptr_t> register_types_t::find(reg_with_loc_t reg) const {
+void register_types_t::print_all_register_types() const {
+    std::cout << "\tregion types: {\n";
+    for (auto const& kv : *m_region_env) {
+        std::cout << "\t\t" << kv.first << " : ";
+        print_ptr_or_mapfd_type(kv.second);
+        std::cout << "\n";
+    }
+    std::cout << "\t}\n";
+}
+
+std::optional<ptr_or_mapfd_t> register_types_t::find(reg_with_loc_t reg) const {
     auto it = m_region_env->find(reg);
     if (it == m_region_env->end()) return {};
     return it->second;
 }
 
-std::optional<ptr_t> register_types_t::find(register_t key) const {
+std::optional<ptr_or_mapfd_t> register_types_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
     const reg_with_loc_t& reg = *(m_cur_def[key]);
     return find(reg);
 }
 
-void register_types_t::print_types_at(location_t loc) const {
+void register_types_t::adjust_bb_for_registers(location_t loc) {
+    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
     for (size_t i = 0; i < m_cur_def.size(); i++) {
-        auto reg_with_loc = reg_with_loc_t(i, loc);
-        auto it = find(reg_with_loc);
-        if (it) {
-            std::cout << "  ";
-            print_type(i, it.value());
-            std::cout << "\n";
+        auto new_reg = reg_with_loc_t((register_t)i, loc);
+        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
+
+        auto it = find((register_t)i);
+        if (!it) continue;
+
+        if (*m_cur_def[i] == old_reg) {
+            m_region_env->erase(old_reg);
         }
+
+        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
+        (*m_region_env)[new_reg] = it.value();
+
     }
-    std::cout << "\n";
 }
 
 stack_t stack_t::operator|(const stack_t& other) const {
@@ -363,21 +361,46 @@ stack_t stack_t::operator|(const stack_t& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    offset_to_ptr_t out_ptrs;
+    ptr_or_mapfd_types_t out_ptrs;
     for (auto const&kv: m_ptrs) {
-        auto it = other.find(kv.first);
-        if (it && kv.second == it.value())
-            out_ptrs.insert(kv);
+        auto maybe_ptr_or_mapfd_cells = other.find(kv.first);
+        if (maybe_ptr_or_mapfd_cells) {
+            auto ptr_or_mapfd_cells1 = kv.second;
+            auto ptr_or_mapfd_cells2 = maybe_ptr_or_mapfd_cells.value();
+            auto ptr_or_mapfd1 = ptr_or_mapfd_cells1.first;
+            auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
+            int width1 = ptr_or_mapfd_cells1.second;
+            int width2 = ptr_or_mapfd_cells2.second;
+            int width_joined = std::max(width1, width2);
+            if (ptr_or_mapfd1 == ptr_or_mapfd2) {
+                out_ptrs[kv.first] = std::make_pair(ptr_or_mapfd1, width_joined);
+            }
+            else if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                    out_ptrs[kv.first]
+                        = std::make_pair(ptr_with_off1 | ptr_with_off2, width_joined);
+                }
+            }
+        }
     }
     return stack_t(std::move(out_ptrs), false);
 }
 
-void stack_t::operator-=(int key) {
+void stack_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
         m_ptrs.erase(key);
 }
 
+void stack_t::operator-=(const std::vector<uint64_t>& keys) {
+    for (auto &key : keys) {
+       *this -= key;
+    }
+}
+
 void stack_t::set_to_bottom() {
     m_ptrs.clear();
     m_is_bottom = true;
@@ -400,16 +423,16 @@ bool stack_t::is_top() const {
     return m_ptrs.empty();
 }
 
-void stack_t::insert(int key, ptr_t value) {
-    m_ptrs[key] = value;
+void stack_t::store(uint64_t key, ptr_or_mapfd_t value, int width) {
+    m_ptrs[key] = std::make_pair(value, width);
 }
 
 size_t stack_t::size() const {
     return m_ptrs.size();
 }
 
-std::vector<int> stack_t::get_keys() const {
-    std::vector<int> keys;
+std::vector<uint64_t> stack_t::get_keys() const {
+    std::vector<uint64_t> keys;
     keys.reserve(size());
 
     for (auto const&kv : m_ptrs) {
@@ -419,15 +442,36 @@ std::vector<int> stack_t::get_keys() const {
 }
 
 
-std::optional<ptr_t> stack_t::find(int key) const {
+std::optional<ptr_or_mapfd_cells_t> stack_t::find(uint64_t key) const {
     auto it = m_ptrs.find(key);
     if (it == m_ptrs.end()) return {};
     return it->second;
 }
 
+std::vector<uint64_t> stack_t::find_overlapping_cells(uint64_t start, int width) const {
+    std::vector<uint64_t> overlapping_cells;
+    auto it = m_ptrs.begin();
+    while (it != m_ptrs.end() && it->first < start) {
+        it++;
+    }
+    if (it != m_ptrs.begin()) {
+        it--;
+        auto key = it->first;
+        auto width_key = it->second.second;
+        if (key < start && key+width_key > start) overlapping_cells.push_back(key);
+    }
+
+    for (; it != m_ptrs.end(); it++) {
+        auto key = it->first;
+        if (key >= start && key < start+width) overlapping_cells.push_back(key);
+        if (key >= start+width) break;
+    }
+    return overlapping_cells;
+}
+
 }
 
-std::optional<ptr_t> region_domain_t::find_ptr_type(register_t reg) {
+std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_type(register_t reg) const {
     return m_registers.find(reg);
 }
 
@@ -456,23 +500,27 @@ void region_domain_t::set_to_top() {
     m_registers.set_to_top();
 }
 
+std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_at_loc(const reg_with_loc_t& reg) const {
+    return m_registers.find(reg);
+}
+
 size_t region_domain_t::ctx_size() const {
-    return m_ctx->size();
+    return m_ctx->get_size();
 }
 
-std::vector<int> region_domain_t::get_ctx_keys() const {
+std::vector<uint64_t> region_domain_t::get_ctx_keys() const {
     return m_ctx->get_keys();
 }
 
-std::vector<int> region_domain_t::get_stack_keys() const {
+std::vector<uint64_t> region_domain_t::get_stack_keys() const {
     return m_stack.get_keys();
 }
 
-std::optional<ptr_no_off_t> region_domain_t::find_in_ctx(int key) const {
+std::optional<ptr_no_off_t> region_domain_t::find_in_ctx(uint64_t key) const {
     return m_ctx->find(key);
 }
 
-std::optional<ptr_t> region_domain_t::find_in_stack(int key) const {
+std::optional<ptr_or_mapfd_cells_t> region_domain_t::find_in_stack(uint64_t key) const {
     return m_stack.find(key);
 }
 
@@ -515,22 +563,20 @@ region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
 }
 
 region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
     return abs;
 }
 
 region_domain_t region_domain_t::widen(const region_domain_t& abs, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
     return abs;
 }
 
 region_domain_t region_domain_t::narrow(const region_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
     return other;
 }
 
-void region_domain_t::write(std::ostream& os) const { 
-    os << m_registers;
-    os << m_stack << "\n";
-}
-
 crab::bound_t region_domain_t::get_loop_count_upper_bound() {
     // WARNING: Not implemented yet.
     return crab::bound_t{crab::number_t{0}};
@@ -544,92 +590,144 @@ string_invariant region_domain_t::to_set() {
     return string_invariant{};
 }
 
-void region_domain_t::operator()(const Undefined & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
-}
-void region_domain_t::operator()(const Un &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
-}
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        std::cout << "  " << u << ";\n";
-        return;
-    }
-    m_registers -= u.dst.v;
+    auto reg = u.dst.v;
+    auto reg_with_loc = reg_with_loc_t(reg, loc);
+    const EbpfMapDescriptor& desc = global_program_info.get().platform->get_map_descriptor(u.mapfd);
+    const EbpfMapValueType& map_value_type = global_program_info.get().platform->
+        get_map_type(desc.type).value_type;
+    map_key_size_t map_key_size = desc.key_size;
+    map_value_size_t map_value_size = desc.value_size;
+    auto type = mapfd_t(u.mapfd, map_value_type, map_key_size, map_value_size);
+    m_registers.insert(reg, reg_with_loc, type);
 }
+
 void region_domain_t::operator()(const Call &u, location_t loc, int print) {
-    if (is_bottom()) return;
+    std::optional<Reg> maybe_fd_reg{};
+    for (ArgSingle param : u.singles) {
+        if (param.kind == ArgSingle::Kind::MAP_FD) maybe_fd_reg = param.reg;
+        break;
+    }
     register_t r0_reg{R0_RETURN_VALUE};
     auto r0 = reg_with_loc_t(r0_reg, loc);
-    if (print > 0) {
-        if (u.is_map_lookup) {
-            auto it = m_registers.find(r0);
-            if (it) {
-                print_annotated(u, it.value(), std::cout);
-            }
-        }
-        else
-            std::cout << "  " << u << ";\n";
-        return;
-    }
     if (u.is_map_lookup) {
-        auto type = ptr_no_off_t(crab::region::T_SHARED);
-        m_registers.insert(r0_reg, r0, type);
+        if (!maybe_fd_reg) {
+            m_registers -= r0_reg;
+            return;
+        }
+        auto ptr_or_mapfd = m_registers.find(maybe_fd_reg->v);
+        if (!ptr_or_mapfd || !std::holds_alternative<mapfd_t>(ptr_or_mapfd.value())) {
+            m_registers -= r0_reg;
+            return;
+        }
+        auto mapfd = std::get<mapfd_t>(ptr_or_mapfd.value());
+        auto map_desc = global_program_info.get().platform->get_map_descriptor(mapfd.get_mapfd());
+        if (mapfd.get_value_type() == EbpfMapValueType::MAP) {
+            const EbpfMapDescriptor& inner_map_desc = global_program_info.get().platform->
+                get_map_descriptor(map_desc.inner_map_fd);
+            const EbpfMapValueType& inner_map_value_type = global_program_info.get().platform->
+                get_map_type(inner_map_desc.type).value_type;
+            map_key_size_t inner_map_key_size = inner_map_desc.key_size;
+            map_value_size_t inner_map_value_size = inner_map_desc.value_size;
+            auto type = mapfd_t(map_desc.inner_map_fd, inner_map_value_type,
+                    inner_map_key_size, inner_map_value_size);
+            m_registers.insert(r0_reg, r0, type);
+        }
+        else {
+            auto type = ptr_with_off_t(crab::region_t::T_SHARED, interval_t{number_t{0}},
+                    interval_t{mapfd.get_value_size()});
+            m_registers.insert(r0_reg, r0, type);
+        }
     }
     else {
         m_registers -= r0_reg;
     }
 }
+
 void region_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet.
 }
+
 void region_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
     // WARNING: Not implemented yet.
 }
+
 void region_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet.
 }
-void region_domain_t::operator()(const Exit &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
-}
-void region_domain_t::operator()(const Jmp &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
-}
+
 void region_domain_t::operator()(const Packet & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        std::cout << "  " << u << ";\n";
+    m_registers -= register_t{R0_RETURN_VALUE};
+}
+
+void region_domain_t::operator()(const Addable& u, location_t loc, int print) {
+
+    auto maybe_ptr_type1 = m_registers.find(u.ptr.v);
+    auto maybe_ptr_type2 = m_registers.find(u.num.v);
+    // a -> b <-> !a || b
+    if (!maybe_ptr_type1 || !maybe_ptr_type2) {
         return;
     }
-    m_registers -= register_t{0};
-}
-void region_domain_t::operator()(const Assume &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0)
-        std::cout << "  " << u << ";\n";
+    //std::cout << "type error: Addable assertion fail\n";
+    m_errors.push_back("Addable assertion fail");
+}
+
+void region_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+    bool is_comparison_check = s.width == (Value)Imm{0};
+    if (std::holds_alternative<Reg>(s.width)) return;
+    int width = std::get<Imm>(s.width).v;
+
+    auto maybe_ptr_or_mapfd_type = m_registers.find(s.reg.v);
+    if (maybe_ptr_or_mapfd_type) {
+        auto reg_ptr_or_mapfd_type = maybe_ptr_or_mapfd_type.value();
+        if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
+            auto reg_with_off_ptr_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
+            auto offset = reg_with_off_ptr_type.get_offset();
+            auto offset_to_check = offset+interval_t{s.offset};
+            auto offset_lb = offset_to_check.lb();
+            auto offset_plus_width_ub = offset_to_check.ub()+crab::bound_t{width};
+            if (reg_with_off_ptr_type.get_region() == crab::region_t::T_STACK) {
+                if (crab::bound_t{STACK_BEGIN} <= offset_lb
+                        && offset_plus_width_ub <= crab::bound_t{EBPF_STACK_SIZE})
+                    return;
+            }
+            else if (reg_with_off_ptr_type.get_region() == crab::region_t::T_CTX) {
+                if (crab::bound_t{CTX_BEGIN} <= offset_lb
+                        && offset_plus_width_ub <= crab::bound_t{ctx_size()})
+                    return;
+            }
+            else { // shared
+                if (crab::bound_t{SHARED_BEGIN} <= offset_lb &&
+                        offset_plus_width_ub <= reg_with_off_ptr_type.get_region_size().lb()) return;
+                // TODO: check null access
+                //return;
+            }
+        }
+        else if (std::holds_alternative<ptr_no_off_t>(reg_ptr_or_mapfd_type)) {
+            // We do not handle packet ptr access in region domain
+            return;
+        }
+        else {
+            // mapfd
+            if (is_comparison_check) return;
+            //std::cout << "type error: FDs cannot be dereferenced directly\n";
+            m_errors.push_back("FDs cannot be dereferenced directly");
+        }
+        //std::cout << "type error: valid access assert fail\n";
+        m_errors.push_back("valid access assert fail");
+    }
 }
 
-void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
-    check_type_constraint(s);
-}
+void region_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
 
-void region_domain_t::operator()(const Assert &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        std::cout << "  " << u << ";\n";
+    bool is_stack_p = is_stack_pointer(u.mem.v);
+    auto maybe_ptr_type2 = m_registers.find(u.val.v);
+
+    if (is_stack_p || !maybe_ptr_type2) {
         return;
     }
-    //std::cout << "assert: " << u << "\n";
-    std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
+    //std::cout << "type error: Valid store assertion fail\n";
+    m_errors.push_back("Valid store assertion fail");
 }
 
 region_domain_t region_domain_t::setup_entry() {
@@ -642,8 +740,9 @@ region_domain_t region_domain_t::setup_entry() {
     auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
     auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
 
-    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region::T_CTX, 0));
-    typ.insert(R10_STACK_POINTER, r10, ptr_with_off_t(crab::region::T_STACK, 512));
+    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region_t::T_CTX, interval_t{number_t{0}}));
+    typ.insert(R10_STACK_POINTER, r10,
+            ptr_with_off_t(crab::region_t::T_STACK, interval_t{number_t{512}}));
 
     region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
     return inv;
@@ -656,187 +755,184 @@ void region_domain_t::report_type_error(std::string s, location_t loc) {
     set_to_bottom();
 }
 
-void region_domain_t::check_type_constraint(const TypeConstraint& s) {
-    auto it = find_ptr_type(s.reg.v);
+void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+    auto it = find_ptr_or_mapfd_type(s.reg.v);
     if (it) {
-        if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num
-                || s.types == TypeGroup::non_map_fd) return;
-        ptr_t p_type = it.value();
-        if (std::holds_alternative<ptr_with_off_t>(p_type)) {
-            ptr_with_off_t p_type_with_off = std::get<ptr_with_off_t>(p_type);
-            if (p_type_with_off.get_region() == crab::region::T_CTX) {
+        // it is a pointer or mapfd
+        ptr_or_mapfd_t ptr_or_mapfd_type = it.value();
+        if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)) {
+            if (s.types == TypeGroup::non_map_fd) return;
+            if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
+            ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_type);
+            if (ptr_with_off.get_region() == crab::region_t::T_CTX) {
                 if (s.types == TypeGroup::ctx) return;
             }
+            else if (ptr_with_off.get_region() == crab::region_t::T_SHARED) {
+                if (s.types == TypeGroup::shared || s.types == TypeGroup::mem
+                        || s.types == TypeGroup::mem_or_num) return;
+            }
             else {
                 if (s.types == TypeGroup::stack || s.types == TypeGroup::mem
-                        || s.types == TypeGroup::stack_or_packet || s.types == TypeGroup::mem_or_num) {
+                        || s.types == TypeGroup::stack_or_packet
+                        || s.types == TypeGroup::mem_or_num) {
                     return;
                 }
             }
         }
+        else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)) {
+            if (s.types == TypeGroup::non_map_fd) return;
+            if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
+            if (s.types == TypeGroup::packet || s.types == TypeGroup::mem
+                    || s.types == TypeGroup::mem_or_num
+                    || s.types == TypeGroup::stack_or_packet) return;
+        }
         else {
-            ptr_no_off_t p_type_no_off = std::get<ptr_no_off_t>(p_type);
-            if (p_type_no_off.get_region() == crab::region::T_PACKET) {
-                if (s.types == TypeGroup::packet || s.types == TypeGroup::mem
-                        || s.types == TypeGroup::mem_or_num) return;
-            }
-            else if (p_type_no_off.get_region() == crab::region::T_SHARED) {
-                if (s.types == TypeGroup::shared || s.types == TypeGroup::mem
-                        || s.types == TypeGroup::mem_or_num) return;
-            }
-            else {
-                // we might have the case where we add an unknown number to stack or ctx's offset and we do not know the offset now
-                if (p_type_no_off.get_region() == crab::region::T_STACK) {
-                    if (s.types == TypeGroup::stack || s.types == TypeGroup::stack_or_packet
-                            || s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num)
-                        return;
-                }
-                else {
-                    if (s.types == TypeGroup::ctx) return;
-                }
+            auto map_fd = std::get<mapfd_t>(ptr_or_mapfd_type);
+            if (map_fd.has_type_map_programs()) {
+                if (s.types == TypeGroup::map_fd_programs) return;
+            } else {
+                if (s.types == TypeGroup::map_fd) return;
             }
         }
     }
     else {
-        // map_fd, non_map_fd, map_fd_programs, and numbers, all should come here
-        // right now, pass any such cases, add more strict checks later
-        // TODO
+        // if we don't know the type, we assume it is a number
         if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
-                || s.types == TypeGroup::map_fd_programs || s.types == TypeGroup::non_map_fd
-                || s.types == TypeGroup::ptr_or_num || s.types == TypeGroup::mem_or_num
-                || s.types == TypeGroup::map_fd)
+                || s.types == TypeGroup::non_map_fd || s.types == TypeGroup::ptr_or_num
+                || s.types == TypeGroup::mem_or_num)
             return;
     }
-    std::cout << "type constraint assert fail: " << s << "\n";
-    //exit(1);
-}
-
-void region_domain_t::do_bin(const Bin& bin, std::shared_ptr<int> src_const_value, location_t loc, int print) {
-    if (is_bottom()) return;
-    if (print > 0) {
-        if (print == 2) {
-            if ((std::holds_alternative<Reg>(bin.v) && (bin.op == Bin::Op::MOV || bin.op == Bin::Op::ADD)) ||
-            (std::holds_alternative<Imm>(bin.v) && bin.op == Bin::Op::ADD)) {
-                auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
-                auto it = m_registers.find(reg_with_loc);
-                if (it) {
-                    print_annotated(bin, it.value(), std::cout);
-                    std::cout << "\n";
-                    return;
-                }
-            }
-        }
-        std::cout << "  " << bin << ";\n";
-        return;
+    //std::cout << "type error: type constraint assert fail: " << s << "\n";
+    m_errors.push_back("type constraint assert fail");
+}
+
+void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const interval_t&& change,
+        Bin::Op op, const reg_with_loc_t& reg_with_loc, uint8_t reg) {
+    if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
+        auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
+        auto offset = ptr_or_mapfd_with_off.get_offset();
+        auto updated_offset = op == Bin::Op::ADD ? offset + change : offset - change;
+        ptr_or_mapfd_with_off.set_offset(updated_offset);
+        m_registers.insert(reg, reg_with_loc, ptr_or_mapfd_with_off);
     }
-
-    ptr_t dst_reg;
-    if (bin.op == Bin::Op::ADD) {
-        auto it = m_registers.find(bin.dst.v);
-        if (!it) {
-            m_registers -= bin.dst.v;
-            return;
-        }
-        dst_reg = it.value();
+    else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd)) {
+        m_registers.insert(reg, reg_with_loc, ptr_or_mapfd);
+    }
+    else {
+        //std::cout << "type error: mapfd register cannot be incremented/decremented\n";
+        m_errors.push_back("mapfd register cannot be incremented/decremented");
+        m_registers -= reg;
     }
+}
 
-    if (std::holds_alternative<Reg>(bin.v)) {
-        Reg src = std::get<Reg>(bin.v);
-        switch (bin.op)
-        {
-            // ra = rb
-            case Bin::Op::MOV: {
-                auto it1 = m_registers.find(src.v);
-                if (!it1) {
-                    m_registers -= bin.dst.v;
-                    break;
+interval_t region_domain_t::do_bin(const Bin& bin,
+        const std::optional<interval_t>& src_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
+
+    using Op = Bin::Op;
+    // if we are doing a move, where src is a number and dst is not set, nothing to do
+    if (src_interval_opt && !dst_ptr_or_mapfd_opt && bin.op == Op::MOV)
+        return interval_t::bottom();
+
+    ptr_or_mapfd_t src_ptr_or_mapfd, dst_ptr_or_mapfd;
+    interval_t src_interval;
+    if (src_ptr_or_mapfd_opt) src_ptr_or_mapfd = std::move(src_ptr_or_mapfd_opt.value());
+    if (dst_ptr_or_mapfd_opt) dst_ptr_or_mapfd = std::move(dst_ptr_or_mapfd_opt.value());
+    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
+
+    auto reg = reg_with_loc_t(bin.dst.v, loc);
+
+    switch (bin.op)
+    {
+        // ra = b, where b is a pointer/mapfd, a numerical register, or a constant;
+        case Op::MOV: {
+            // b is a pointer/mapfd
+            if (src_ptr_or_mapfd_opt)
+                m_registers.insert(bin.dst.v, reg, src_ptr_or_mapfd);
+            // b is a numerical register, or constant
+            else if (dst_ptr_or_mapfd_opt) {
+                m_registers -= bin.dst.v;
+            }
+            break;
+        }
+        // ra += b, where ra is a pointer/mapfd, or a numerical register,
+        // b is a pointer/mapfd, a numerical register, or a constant;
+        case Op::ADD: {
+            // adding pointer to another
+            if (src_ptr_or_mapfd_opt && dst_ptr_or_mapfd_opt) {
+                if (is_stack_pointer(bin.dst.v))
+                    m_stack.set_to_top();
+                else {
+                    // TODO: handle other cases properly
+                    //std::cout << "type error: addition of two pointers\n";
+                    m_errors.push_back("addition of two pointers");
                 }
-                auto reg = reg_with_loc_t(bin.dst.v, loc);
-                m_registers.insert(bin.dst.v, reg, it1.value());
-                break;
+                m_registers -= bin.dst.v;
             }
-            // ra += rb
-            case Bin::Op::ADD: {
-                auto it1 = m_registers.find(src.v);
-                if (it1) {
-                    std::string s = std::to_string(static_cast<unsigned int>(src.v));
-                    std::string s1 = std::to_string(static_cast<unsigned int>(bin.dst.v));
-                    std::string desc = std::string("\taddition of two pointers, r") + s + " and r" + s1 + " not allowed\n";
-                    report_type_error(desc, loc);
-                    return;
+            // ra is a pointer/mapfd
+            // b is a numerical register, or a constant
+            else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
+                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
+                        bin.op, reg, bin.dst.v);
+            }
+            // b is a pointer/mapfd
+            // ra is a numerical register
+            else if (src_ptr_or_mapfd_opt && !dst_ptr_or_mapfd_opt) {
+                update_ptr_or_mapfd(std::move(src_ptr_or_mapfd), interval_t::top(),
+                        bin.op, reg, bin.dst.v);
+            }
+            break;
+        }
+        // ra -= b, where ra is a pointer/mapfd
+        // b is a pointer/mapfd, numerical register, or a constant;
+        case Op::SUB: {
+            // b is a pointer/mapfd
+            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) {
+                if (std::holds_alternative<mapfd_t>(dst_ptr_or_mapfd) &&
+                        std::holds_alternative<mapfd_t>(src_ptr_or_mapfd)) {
+                    //std::cout << "type error: mapfd registers subtraction not defined\n";
+                    m_errors.push_back("mapfd registers subtraction not defined");
                 }
-                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
-                    ptr_with_off_t dst_reg_with_off = std::get<ptr_with_off_t>(dst_reg);
-                    if (dst_reg_with_off.get_region() == crab::region::T_STACK) {
-                        if (src_const_value) {
-                            int updated_offset = dst_reg_with_off.get_offset()+(*src_const_value);
-                            dst_reg_with_off.set_offset(updated_offset);
-                            auto reg = reg_with_loc_t(bin.dst.v, loc);
-                            m_registers.insert(bin.dst.v, reg, dst_reg_with_off);
-
-                        }
-                        else {
-                            m_stack.set_to_top();
-                            m_stack -= dst_reg_with_off.get_offset();
-                            return;
-                        }
+                else if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd) &&
+                        std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
+                    auto dst_ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
+                    auto src_ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
+                    if (dst_ptr_or_mapfd_with_off.get_region()
+                            == src_ptr_or_mapfd_with_off.get_region()) {
+                        m_registers -= bin.dst.v;
+                        return (dst_ptr_or_mapfd_with_off.get_offset() -
+                            src_ptr_or_mapfd_with_off.get_offset());
                     }
                     else {
-                        // currently, we do not read any other pointers from CTX except the ones already stored
-                        // in case we add the functionality, we will have to implement forgetting of CTX offsets
+                        //std::cout << "type error: subtraction between pointers of different region\n";
+                        m_errors.push_back("subtraction between pointers of different region");
                     }
                 }
-                else {
-                    auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_registers.insert(bin.dst.v, reg, dst_reg);
+                else if (!same_region(get_ptr(dst_ptr_or_mapfd), get_ptr(src_ptr_or_mapfd))) {
+                    //std::cout << "type error: subtraction between pointers of different region\n";
+                    m_errors.push_back("subtraction between pointers of different region");
                 }
-                break;
-            }
-            default:
                 m_registers -= bin.dst.v;
-                break;
-        }
-    }
-    else {
-        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
-        switch (bin.op)
-        {
-            case Bin::Op::ADD: {
-                if (std::holds_alternative<ptr_with_off_t>(dst_reg)) {
-                    auto ptr_with_off = std::get<ptr_with_off_t>(dst_reg);
-                    ptr_with_off.set_offset(ptr_with_off.get_offset() + imm);
-                    auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_registers.insert(bin.dst.v, reg, ptr_with_off);
-                }
-                else {
-                    auto reg = reg_with_loc_t(bin.dst.v, loc);
-                    m_registers.insert(bin.dst.v, reg, dst_reg);
-                }
-                break;
             }
-            default: {
-                m_registers -= bin.dst.v;
-                break;
+            // b is a numerical register, or a constant
+            else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
+                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
+                        bin.op, reg, bin.dst.v);
             }
+            break;
+        }
+        default: {
+            m_registers -= bin.dst.v;
+            break;
         }
     }
+    return interval_t::bottom();
 }
 
-void region_domain_t::operator()(const Bin& bin, location_t loc, int print) {
-    do_bin(bin, nullptr, loc, print);
-}
-
-void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc) {
 
-    if (print > 0) {
-        auto target_reg_loc = reg_with_loc_t(target_reg.v, loc);
-        auto it = m_registers.find(target_reg_loc);
-        if (it)
-            print_annotated(b, it.value(), std::cout);
-        else
-            std::cout << "  " << b << ";\n";
-        return;
-    }
+    int width = b.access.width;
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
@@ -844,58 +940,86 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t lo
     if (!it) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
-        report_type_error(desc, loc);
+        //std::cout << desc;
+        m_registers -= target_reg.v;
         return;
     }
-    ptr_t type_basereg = it.value();
+    auto type_basereg = it.value();
 
-    if (std::holds_alternative<ptr_no_off_t>(type_basereg)) {
-        //std::cout << "type_error: loading from either packet or shared region not allowed - r" << (int)basereg.v << "\n";
+    if (!std::holds_alternative<ptr_with_off_t>(type_basereg)
+            || std::get<ptr_with_off_t>(type_basereg).get_region() == crab::region_t::T_SHARED) {
+        // loading from either packet, shared region or mapfd does not happen in region domain
         m_registers -= target_reg.v;
         return;
     }
 
-    ptr_with_off_t type_with_off = std::get<ptr_with_off_t>(type_basereg);
-    int load_at = offset+type_with_off.get_offset();
+    auto type_with_off = std::get<ptr_with_off_t>(type_basereg);
+    auto p_offset = type_with_off.get_offset();
+    auto offset_singleton = p_offset.singleton();
 
     switch (type_with_off.get_region()) {
-        case crab::region::T_STACK: {
-
-            auto it = m_stack.find(load_at);
-
-            if (!it) {
-                //std::cout << "type_error: no field at loaded offset " << load_at << " in stack\n";
+        case crab::region_t::T_STACK: {
+            if (!offset_singleton) {
+                for (auto const& k : m_stack.get_keys()) {
+                    auto start = p_offset.lb();
+                    auto end = p_offset.ub()+number_t{offset+width-1};
+                    interval_t range{start, end};
+                    if (range[number_t{(int)k}]) {
+                        //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
+                        m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
+                        break;
+                    }
+                }
                 m_registers -= target_reg.v;
-                return;
-            }
-            ptr_t type_loaded = it.value();
-
-            if (std::holds_alternative<ptr_with_off_t>(type_loaded)) {
-                ptr_with_off_t type_loaded_with_off = std::get<ptr_with_off_t>(type_loaded);
-                auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded_with_off);
             }
             else {
-                ptr_no_off_t type_loaded_no_off = std::get<ptr_no_off_t>(type_loaded);
+                auto ptr_offset = offset_singleton.value();
+                auto load_at = (uint64_t)(ptr_offset + offset);
+
+                auto it = m_stack.find(load_at);
+
+                if (!it) {
+                    // no field at loaded offset in stack
+                    m_registers -= target_reg.v;
+                    return;
+                }
+                auto type_loaded = it.value();
+
                 auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded_no_off);
+                m_registers.insert(target_reg.v, reg, type_loaded.first);
             }
-
             break;
         }
-        case crab::region::T_CTX: {
-
-            auto it = m_ctx->find(load_at);
-
-            if (!it) {
-                //std::cout << "type_error: no field at loaded offset " << load_at << " in context\n";
+        case crab::region_t::T_CTX: {
+
+            if (!offset_singleton) {
+                for (auto const& k : m_ctx->get_keys()) {
+                    auto start = p_offset.lb();
+                    auto end = p_offset.ub()+crab::bound_t{offset+width-1};
+                    interval_t range{start, end};
+                    if (range[number_t{(int)k}]) {
+                        //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
+                        m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
+                        break;
+                    }
+                }
                 m_registers -= target_reg.v;
-                return;
             }
-            ptr_no_off_t type_loaded = it.value();
+            else {
+                auto ptr_offset = offset_singleton.value();
+                auto load_at = (uint64_t)(ptr_offset + offset);
+                auto it = m_ctx->find(load_at);
+
+                if (!it) {
+                    // no field at loaded offset in ctx
+                    m_registers -= target_reg.v;
+                    return;
+                }
+                ptr_no_off_t type_loaded = it.value();
 
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_registers.insert(target_reg.v, reg, type_loaded);
+                auto reg = reg_with_loc_t(target_reg.v, loc);
+                m_registers.insert(target_reg.v, reg, type_loaded);
+            }
             break;
         }
 
@@ -905,173 +1029,96 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t lo
     }
 }
 
-void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
+void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc) {
 
-    if (print > 0) {
-        std::cout << "  " << b << ";\n";
-        return;
-    }
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
     int width = b.access.width;
 
-    auto it = m_registers.find(basereg.v);
-    if (!it) {
+    // TODO: move generic checks to type domain
+    auto maybe_basereg_type = m_registers.find(basereg.v);
+    if (!maybe_basereg_type) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
-        report_type_error(desc, loc);
+        //std::cout << desc;
+        m_errors.push_back(desc);
         return;
     }
-    ptr_t type_basereg = it.value();
-
-    auto it2 = m_registers.find(target_reg.v);
-
-    if (std::holds_alternative<ptr_with_off_t>(type_basereg)) {
-        // base register is either CTX_P or STACK_P
-        ptr_with_off_t type_basereg_with_off = std::get<ptr_with_off_t>(type_basereg);
-
-        int store_at = offset+type_basereg_with_off.get_offset();
-        if (type_basereg_with_off.get_region() == crab::region::T_STACK) {
-            // type of basereg is STACK_P
-            if (!it2) {
-               // std::cout << "type_error: storing either a number or an unknown pointer - r" << (int)target_reg.v << "\n";
-                m_stack -= store_at;
+    auto basereg_type = maybe_basereg_type.value();
+    auto targetreg_type = m_registers.find(target_reg.v);
+
+    if (std::holds_alternative<ptr_with_off_t>(basereg_type)) {
+        // base register is either CTX_P, STACK_P or SHARED_P
+        auto basereg_type_with_off = std::get<ptr_with_off_t>(basereg_type);
+
+        if (basereg_type_with_off.get_region() == crab::region_t::T_STACK) {
+            auto offset_singleton = basereg_type_with_off.get_offset().singleton();
+            if (!offset_singleton) {
+                //std::cout << "type error: storing to a pointer with unknown offset\n";
+                m_errors.push_back("storing to a pointer with unknown offset");
                 return;
             }
-            else {
-                auto type_to_store = it2.value();
-                /*
-                if (std::holds_alternative<ptr_with_off_t>(type_to_store) &&
-                        std::get<ptr_with_off_t>(type_to_store).r == crab::region::T_STACK) {
-                    std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-                    std::string desc = std::string("\twe cannot store stack pointer, r") + s + ", into stack\n";
-                    //report_type_error(desc, loc);
-                    return;
-                }
-                else {
-                */
-                    for (auto i = store_at+1; i < store_at+width; i++) {
-                        auto it3 = m_stack.find(i);
-                        if (it3) {
-                            std::string s = std::to_string(store_at);
-                            std::string s1 = std::to_string(i);
-                            std::string desc = std::string("\ttype being stored into stack at ") + s + " is overlapping with already stored at " + s1 + "\n";
-                            report_type_error(desc, loc);
-                            return;
-                        }
-                    }
-                    m_stack.insert(store_at, type_to_store);
-                    // revise: code below checks if there is already something stored at same location, the type should be the same -- it is very restricted and not required.
-                    // However, when we support storing info like width of type, we need more checks
-                    /*
-                    auto it4 = m_stack.find(store_at);
-                    if (it4) {
-                        auto type_in_stack = it4.value();
-                        if (type_to_store != type_in_stack) {
-                            std::string s = std::to_string(store_at);
-                            std::string desc = std::string("\ttype being stored at offset ") + s + " is not the same as already stored in stack\n";
-                            report_type_error(desc, loc);
-                            return;
-                        }
-                    }
-                    else {
-                        m_stack.insert(store_at, type_to_store);
-                    }
-                    */
-                //}
-            }
+            auto store_at = (uint64_t)offset+(uint64_t)offset_singleton.value();
+            // type of basereg is STACK_P
+            auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
+            m_stack -= overlapping_cells;
+
+            // if targetreg_type is empty, we are storing a number
+            if (!targetreg_type) return;
+
+            auto type_to_store = targetreg_type.value();
+            m_stack.store(store_at, type_to_store, width);
         }
-        else if (type_basereg_with_off.get_region() == crab::region::T_CTX) {
+        else if (basereg_type_with_off.get_region() == crab::region_t::T_CTX) {
             // type of basereg is CTX_P
-            if (it2) {
+            if (targetreg_type) {
                 std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
                 std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into ctx\n";
-                report_type_error(desc, loc);
+                //std::cout << desc;
+                m_errors.push_back(desc);
                 return;
             }
         }
-        else
-            assert(false);
+        else {
+            // type of basereg is SHARED_P
+            if (targetreg_type) {
+                //std::cout << "type error: we cannot store a pointer into shared\n";
+                m_errors.push_back("we cannot store a pointer into shared");
+            }
+        }
     }
-    else {
-        // base register type is either PACKET_P, SHARED_P or STACK_P without known offset
-        ptr_no_off_t type_basereg_no_off = std::get<ptr_no_off_t>(type_basereg);
-
-        // if basereg is a stack_p with no offset, we do not store anything, and no type errors
-        // if we later load with that pointer, we read nothing -- load is no-op
-        if (it2 && type_basereg_no_off.get_region() != crab::region::T_STACK) {
+    else if (std::holds_alternative<ptr_no_off_t>(basereg_type)) {
+        // base register type is a PACKET_P
+        if (targetreg_type) {
             std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet or shared\n";
-            report_type_error(desc, loc);
+            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet\n";
+            //std::cout << desc;
+            m_errors.push_back(desc);
             return;
         }
     }
-}
-
-void region_domain_t::operator()(const Mem& b, location_t loc, int print) {
-    if (is_bottom()) return;
-
-    if (std::holds_alternative<Reg>(b.value)) {
-        if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value), loc, print);
-        } else {
-            do_mem_store(b, std::get<Reg>(b.value), loc, print);
-        }
-    } else {
-        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
-        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
-        report_type_error(desc, loc);
+    else {
+        //std::cout << "type error: we cannot store a pointer into a mapfd\n";
+        m_errors.push_back("we cannot store a pointer into a mapfd");
         return;
     }
 }
 
-void region_domain_t::print_registers_at(location_t loc) const {
-    m_registers.print_types_at(loc);
-}
-
-void region_domain_t::print_initial_types() const {
-    auto label = label_t::entry;
-    location_t loc = location_t(std::make_pair(label, 0));
-    std::cout << "\n" << *m_ctx << "\n";
-    std::cout << m_stack << "\n";
-    std::cout << "Initial register types:\n";
-    print_registers_at(loc);
-}
 
-void region_domain_t::operator()(const basic_block_t& bb, int print) {
-    auto label = bb.label();
-    uint32_t curr_pos = 0;
-    location_t loc;
-    if (print > 0) {
-        if (label == label_t::entry) {
-            print_initial_types();
-            m_is_bottom = false;
-        }
-        std::cout << label << ":\n";
+bool region_domain_t::is_stack_pointer(register_t reg) const {
+    auto type = m_registers.find(reg);
+    if (!type) {    // not a pointer
+        return false;
     }
+    auto ptr_or_mapfd_type = type.value();
+    return (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type) &&
+            std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_STACK);
+}
 
-    for (const Instruction& statement : bb) {
-        loc = location_t(std::make_pair(label, ++curr_pos));
-        if (print > 0) std::cout << " " << curr_pos << ".";
-        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
-        if (print > 0 && error_location->first == loc->first && error_location->second == loc->second) std::cout << "type_error\n";
-    }
+void region_domain_t::adjust_bb_for_types(location_t loc) {
+    m_registers.adjust_bb_for_registers(loc);
+}
 
-    if (print > 0) {
-        auto [it, et] = bb.next_blocks();
-        if (it != et) {
-            std::cout << "  "
-            << "goto ";
-            for (; it != et;) {
-                std::cout << *it;
-                ++it;
-                if (it == et) {
-                    std::cout << ";";
-                } else {
-                    std::cout << ",";
-                }
-            }
-        }
-        std::cout << "\n\n";
-    }
+void region_domain_t::print_all_register_types() const {
+    m_registers.print_all_register_types();
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index c4d1998b3..0ea7fb7bd 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -4,6 +4,7 @@
 #pragma once
 
 #include <unordered_map>
+#include <map>
 
 #include "crab/abstract_domain.hpp"
 #include "crab/cfg.hpp"
@@ -11,9 +12,19 @@
 #include "string_constraints.hpp"
 #include <boost/optional/optional_io.hpp>
 
+#include "platform.hpp"
+
+using crab::interval_t;
+using crab::number_t;
+
+constexpr int STACK_BEGIN = 0;
+constexpr int CTX_BEGIN = 0;
+constexpr int PACKET_BEGIN = 0;
+constexpr int SHARED_BEGIN = 0;
+
 namespace crab {
 
-enum class region {
+enum class region_t {
 	T_CTX,
 	T_STACK,
 	T_PACKET,
@@ -22,7 +33,7 @@ enum class region {
 
 
 class ptr_no_off_t {
-    region m_r;
+    region_t m_r;
 
   public:
     ptr_no_off_t() = default;
@@ -30,10 +41,10 @@ class ptr_no_off_t {
     ptr_no_off_t(ptr_no_off_t &&) = default;
     ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
     ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-    ptr_no_off_t(region _r) : m_r(_r) {}
+    ptr_no_off_t(region_t _r) : m_r(_r) {}
 
-    constexpr region get_region() const { return m_r; }
-    void set_region(region);
+    constexpr region_t get_region() const { return m_r; }
+    void set_region(region_t);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
     //bool operator==(const ptr_no_off_t& p2);
@@ -41,8 +52,9 @@ class ptr_no_off_t {
 };
 
 class ptr_with_off_t {
-    region m_r;
-    int m_offset;
+    region_t m_r;
+    interval_t m_offset;
+    interval_t m_region_size;
 
   public:
     ptr_with_off_t() = default;
@@ -50,18 +62,48 @@ class ptr_with_off_t {
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region _r, int _off) : m_r(_r), m_offset(_off) {}
-
-    constexpr int get_offset() const { return m_offset; }
-    void set_offset(int);
-    constexpr region get_region() const { return m_r; }
-    void set_region(region);
+    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz=interval_t::top())
+        : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
+    ptr_with_off_t operator|(const ptr_with_off_t&) const;
+    interval_t get_region_size() const;
+    void set_region_size(interval_t);
+    interval_t get_offset() const { return m_offset; }
+    void set_offset(interval_t);
+    constexpr region_t get_region() const { return m_r; }
+    void set_region(region_t);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
     //bool operator==(const ptr_with_off_t& p2);
     //bool operator!=(const ptr_with_off_t& p2);
 };
 
+using map_key_size_t = unsigned int;
+using map_value_size_t = unsigned int;
+
+class mapfd_t {
+    int m_mapfd;
+    EbpfMapValueType m_value_type;
+    map_key_size_t m_key_size;
+    map_value_size_t m_value_size;
+
+  public:
+    mapfd_t(const mapfd_t&) = default;
+    mapfd_t(mapfd_t&&) = default;
+    mapfd_t &operator=(const mapfd_t&) = default;
+    mapfd_t &operator=(mapfd_t&&) = default;
+    mapfd_t(int mapfd, EbpfMapValueType val_type, map_key_size_t key_size,
+            map_value_size_t value_size)
+        : m_mapfd(mapfd), m_value_type(val_type), m_key_size(key_size), m_value_size(value_size) {}
+    friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
+    void write(std::ostream&) const;
+
+    bool has_type_map_programs() const;
+    constexpr EbpfMapValueType get_value_type() const { return m_value_type; }
+    constexpr map_key_size_t get_key_size() const { return m_key_size; }
+    constexpr map_value_size_t get_value_size() const { return m_value_size; }
+    constexpr int get_mapfd() const { return m_mapfd; }
+};
+
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
 using register_t = uint8_t;
 using location_t = boost::optional<std::pair<label_t, uint32_t>>;
@@ -79,47 +121,50 @@ class reg_with_loc_t {
 };
 
 class ctx_t {
-    using offset_to_ptr_no_off_t = std::unordered_map<int, ptr_no_off_t>;
+    using ptr_types_t = std::unordered_map<uint64_t, ptr_no_off_t>;
 
-    offset_to_ptr_no_off_t m_packet_ptrs;
+    ptr_types_t m_packet_ptrs;
+    int size = 0;
 
   public:
     ctx_t(const ebpf_context_descriptor_t* desc);
-    size_t size() const;
-    std::vector<int> get_keys() const;
-    std::optional<ptr_no_off_t> find(int key) const;
-    friend std::ostream& operator<<(std::ostream& o, const ctx_t& _ctx);
+    int get_size() const;
+    std::vector<uint64_t> get_keys() const;
+    std::optional<ptr_no_off_t> find(uint64_t key) const;
 };
 
-class stack_t {
-    using offset_to_ptr_t = std::unordered_map<int, ptr_t>;
+using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
+using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
+using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
 
-    offset_to_ptr_t m_ptrs;
+class stack_t {
+    ptr_or_mapfd_types_t m_ptrs;
     bool m_is_bottom;
 
   public:
     stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-    stack_t(offset_to_ptr_t && ptrs, bool is_bottom)
+    stack_t(ptr_or_mapfd_types_t && ptrs, bool is_bottom)
     : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
     
     stack_t operator|(const stack_t& other) const;
-    void operator-=(int);
+    void operator-=(uint64_t);
+    void operator-=(const std::vector<uint64_t>&);
     void set_to_bottom();
     void set_to_top();
     static stack_t bottom();
     static stack_t top();
     bool is_bottom() const;
     bool is_top() const;
-    const offset_to_ptr_t &get_ptrs() { return m_ptrs; }
-    void insert(int key, ptr_t value);
-    std::optional<ptr_t> find(int key) const;
-    std::vector<int> get_keys() const;
+    const ptr_or_mapfd_types_t &get_ptrs() { return m_ptrs; }
+    void store(uint64_t, ptr_or_mapfd_t, int);
+    std::optional<ptr_or_mapfd_cells_t> find(uint64_t) const;
+    std::vector<uint64_t> get_keys() const;
+    std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     size_t size() const;
-    friend std::ostream& operator<<(std::ostream& o, const stack_t& st);
 };
 
 using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
-using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_t>;
+using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
 
 class register_types_t {
 
@@ -129,10 +174,12 @@ class register_types_t {
 
   public:
     register_types_t(bool is_bottom = false) : m_region_env(nullptr), m_is_bottom(is_bottom) {}
-    explicit register_types_t(live_registers_t&& vars, std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
+    explicit register_types_t(live_registers_t&& vars,
+            std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
         : m_cur_def(std::move(vars)), m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
 
-    explicit register_types_t(std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
+    explicit register_types_t(std::shared_ptr<global_region_env_t> reg_type_env,
+            bool is_bottom = false)
         : m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
 
     register_types_t operator|(const register_types_t& other) const;
@@ -141,12 +188,12 @@ class register_types_t {
     void set_to_top();
     bool is_bottom() const;
     bool is_top() const;
-    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_t& type);
-    std::optional<ptr_t> find(reg_with_loc_t reg) const;
-    std::optional<ptr_t> find(register_t key) const;
+    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_or_mapfd_t& type);
+    std::optional<ptr_or_mapfd_t> find(reg_with_loc_t reg) const;
+    std::optional<ptr_or_mapfd_t> find(register_t key) const;
     const live_registers_t &get_vars() { return m_cur_def; }
-    friend std::ostream& operator<<(std::ostream& o, const register_types_t& p);
-    void print_types_at(location_t) const;
+    void adjust_bb_for_registers(location_t loc);
+    void print_all_register_types() const;
 };
 
 }
@@ -158,6 +205,7 @@ class region_domain_t final {
     crab::stack_t m_stack;
     crab::register_types_t m_registers;
     std::shared_ptr<crab::ctx_t> m_ctx;
+    std::vector<std::string> m_errors;
 
   public:
 
@@ -191,25 +239,26 @@ class region_domain_t final {
     region_domain_t narrow(const region_domain_t& other) const;
     //forget
     void operator-=(crab::variable_t var);
+    void operator-=(register_t var) { m_registers -= var; }
 
     //// abstract transformers
-    void operator()(const Undefined &, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin &, location_t loc = boost::none, int print = 0);
-    void operator()(const Un &, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Bin &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Un &, location_t loc = boost::none, int print = 0) {}
     void operator()(const LoadMapFd &, location_t loc = boost::none, int print = 0);
     void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
     void operator()(const Call &, location_t loc = boost::none, int print = 0);
     void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit &, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp &, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem &, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Jmp &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Mem &, location_t loc = boost::none, int print = 0) {}
     void operator()(const Packet &, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume &, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert &, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Assume &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Assert &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
     void operator()(const Comparable& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Addable& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Addable& s, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0);
     void operator()(const TypeConstraint& s, location_t loc = boost::none, int print = 0);
     void operator()(const ValidSize& s, location_t loc = boost::none, int print = 0) {}
     void operator()(const ValidMapKeyValue& s, location_t loc = boost::none, int print = 0) {}
@@ -217,25 +266,32 @@ class region_domain_t final {
     void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
     void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
-    void operator()(const basic_block_t& bb, int print = 0);
-    void write(std::ostream& os) const;
+    void operator()(const basic_block_t& bb, int print = 0) {}
+    void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t&);
+    friend std::ostream& operator<<(std::ostream&, const region_domain_t&);
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_load(const Mem&, const Reg&, location_t, int print = 0);
-    void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
-    void do_bin(const Bin&, std::shared_ptr<int>, location_t, int print = 0);
-    void check_type_constraint(const TypeConstraint&);
+    void do_load(const Mem&, const Reg&, location_t);
+    void do_mem_store(const Mem&, const Reg&, location_t);
+    interval_t do_bin(const Bin&, const std::optional<interval_t>&,
+            const std::optional<crab::ptr_or_mapfd_t>&,
+            const std::optional<crab::ptr_or_mapfd_t>&, location_t);
+    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&, Bin::Op,
+            const crab::reg_with_loc_t&, uint8_t);
 
     void report_type_error(std::string, location_t);
-    std::optional<crab::ptr_t> find_ptr_type(register_t);
+    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
     size_t ctx_size() const;
-    std::optional<crab::ptr_no_off_t> find_in_ctx(int key) const;
-    std::vector<int> get_ctx_keys() const;
-    std::optional<crab::ptr_t> find_in_stack(int key) const;
-    std::vector<int> get_stack_keys() const;
-    void print_registers_at(location_t) const;
-    void print_initial_types() const;
+    std::optional<crab::ptr_no_off_t> find_in_ctx(uint64_t key) const;
+    std::vector<uint64_t> get_ctx_keys() const;
+    std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
+    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
+    std::vector<uint64_t> get_stack_keys() const;
+    bool is_stack_pointer(register_t) const;
+    void adjust_bb_for_types(location_t loc);
+    void print_all_register_types() const;
+    std::vector<std::string>& get_errors() { return m_errors; }
 }; // end region_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 46ff873fd..dfe245540 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -5,6 +5,76 @@
 
 #include "crab/type_domain.hpp"
 
+namespace std {
+    static ptr_t get_ptr(const ptr_or_mapfd_t& t) {
+    return std::visit( overloaded
+               {
+                   []( const ptr_with_off_t& x ){ return ptr_t{x};},
+                   []( const ptr_no_off_t& x ){ return ptr_t{x};},
+                   []( auto& ) { return ptr_t{};}
+                }, t
+            );
+    }
+}
+
+static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
+
+static void print_ptr_type(const ptr_t& ptr) {
+    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
+        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
+        std::cout << ptr_with_off;
+    }
+    else {
+        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
+        std::cout << ptr_no_off;
+    }
+}
+
+static void print_ptr_or_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
+    if (std::holds_alternative<mapfd_t>(ptr_or_mapfd)) {
+        std::cout << std::get<mapfd_t>(ptr_or_mapfd);
+    }
+    else {
+        auto ptr = get_ptr(ptr_or_mapfd);
+        print_ptr_type(ptr);
+    }
+}
+
+static void print_register(Reg r, std::optional<ptr_or_mapfd_t>& p) {
+    std::cout << r << " : ";
+    if (p) {
+        print_ptr_or_mapfd_type(p.value());
+    }
+}
+
+static void print_annotated(std::ostream& o, const Call& call, std::optional<ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
+    o << " = " << call.name << ":" << call.func << "(...)\n";
+}
+
+static void print_annotated(std::ostream& o, const Bin& b, std::optional<ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(b.dst, p);
+    o << " " << b.op << "= " << b.v << "\n";
+}
+
+static void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(u.dst, p);
+    o << " = map_fd " << u.mapfd << "\n";
+}
+
+static void print_annotated(std::ostream& o, const Mem& b, std::optional<ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(std::get<Reg>(b.value), p);
+    o << " = ";
+    std::string sign = b.access.offset < 0 ? " - " : " + ";
+    int offset = std::abs(b.access.offset);
+    o << "*(" << size(b.access.width) << " *)";
+    o << "(" << b.access.basereg << sign << offset << ")\n";
+}
+
 bool type_domain_t::is_bottom() const {
     return m_is_bottom;
 }
@@ -34,6 +104,7 @@ bool type_domain_t::operator<=(const type_domain_t& abs) const {
 }
 
 type_domain_t type_domain_t::widen(const type_domain_t& other, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
     type_domain_t res{};
     return res;
 }
@@ -72,16 +143,15 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
     return abs;
 }
 
 type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
     return other;
 }
 
-void type_domain_t::write(std::ostream& os) const { 
-}
-
 void type_domain_t::initialize_loop_counter(label_t label) {
     // WARNING: Not implemented yet
 }
@@ -96,59 +166,193 @@ string_invariant type_domain_t::to_set() {
 }
 
 void type_domain_t::operator()(const Undefined & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Un &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
 }
+
 void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
 void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
+
 void type_domain_t::operator()(const Call &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+
+    for (ArgPair param : u.pairs) {
+        if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
+            auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
+            if (!maybe_ptr_or_mapfd) continue;
+            auto ptr_or_mapfd = maybe_ptr_or_mapfd.value();
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
+                auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
+                if (ptr_with_off.get_region() == region_t::T_STACK) {
+                    auto offset_singleton = ptr_with_off.get_offset().singleton();
+                    if (!offset_singleton) {
+                        //std::cout << "type error: storing at an unknown offset in stack\n";
+                        m_errors.push_back("storing at an unknown offset in stack");
+                        continue;
+                    }
+                }
+            }
+        }
+    }
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
+
 void type_domain_t::operator()(const Exit &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Jmp &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
+    m_region(u, loc);
 }
+
 void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region(u, loc, print);
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+    m_region(s, loc);
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
-    m_region.check_type_constraint(s);
+    m_region(s, loc);
 }
 
 void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
-    if (is_bottom()) return;
     std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
+static bool is_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
+    return (std::holds_alternative<mapfd_t>(ptr_or_mapfd));
+}
+
+static region_t get_region(const ptr_t& ptr) {
+    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
+        return std::get<ptr_with_off_t>(ptr).get_region();
+    }
+    else {
+        return std::get<ptr_no_off_t>(ptr).get_region();
+    }
+}
+
+void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+
+    auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
+    auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
+    if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
+        // an extra check just to make sure registers are not labelled both ptrs and numbers
+        auto ptr_or_mapfd1 = maybe_ptr_or_mapfd1.value();
+        auto ptr_or_mapfd2 = maybe_ptr_or_mapfd1.value();
+        if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) {
+            return;
+        }
+        else if (!is_mapfd_type(ptr_or_mapfd1) && !is_mapfd_type(ptr_or_mapfd2)) {
+            auto ptr1 = get_ptr(ptr_or_mapfd1);
+            auto ptr2 = get_ptr(ptr_or_mapfd2);
+            if (get_region(ptr1) == get_region(ptr2)) {
+                return;
+            }
+        }
+    }
+    else if (!maybe_ptr_or_mapfd1 && !maybe_ptr_or_mapfd2) {
+        // all other cases when we do not have a ptr or mapfd, the type is a number
+        return;
+    }
+    //std::cout << "type error: Non-comparable types\n";
+    m_errors.push_back("Non-comparable types");
+}
+
+void type_domain_t::operator()(const Addable& u, location_t loc, int print) {
+    m_region(u, loc);
+}
+
+void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+    m_region(u, loc);
+}
+
+
+void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+}
+
+void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+
+    int width;
+    auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
+    auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
+    if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
+        auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
+        auto mapfd = maybe_mapfd.value();
+        if (is_mapfd_type(mapfd)) {
+            auto mapfd_type = std::get<mapfd_t>(mapfd);
+            if (u.key) {
+                width = (int)mapfd_type.get_key_size();
+            }
+            else {
+                width = (int)mapfd_type.get_value_size();
+            }
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
+                auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
+                if (ptr_with_off.get_region() == region_t::T_STACK) {
+                    auto offset_singleton = ptr_with_off.get_offset().singleton();
+                    if (!offset_singleton) {
+                        //std::cout << "type error: reading the stack at an unknown offset\n";
+                        m_errors.push_back("reading the stack at an unknown offset");
+                        return;
+                    }
+                    auto offset_to_check = (uint64_t)offset_singleton.value();
+                    auto it2 = m_region.find_in_stack(offset_to_check);
+                    if (it2) {
+                        //std::cout << "type error: map update with a non-numerical value\n";
+                        m_errors.push_back("map update with a non-numerical value");
+                    }
+                    return;
+                }
+            }
+            else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_basereg)) {
+                auto ptr_no_off = std::get<ptr_no_off_t>(ptr_or_mapfd_basereg);
+                if (ptr_no_off.get_region() == region_t::T_PACKET) {
+                    // We do not check packet ptr accesses yet
+                    return;
+                }
+            }
+        }
+    }
+    //std::cout << "type error: valid map key value assertion failed\n";
+    m_errors.push_back("valid map key value assertion failed");
+}
+
+void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
+
+    auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
+    if (maybe_ptr_or_mapfd) {
+        if (std::holds_alternative<ptr_with_off_t>(maybe_ptr_or_mapfd.value())) {
+            auto ptr_type_with_off = std::get<ptr_with_off_t>(maybe_ptr_or_mapfd.value());
+            if (ptr_type_with_off.get_offset() == interval_t{crab::number_t{0}}) return;
+        }
+        else if (std::holds_alternative<ptr_no_off_t>(maybe_ptr_or_mapfd.value())) {
+            // We do not yet support packet ptr offsets
+            return;
+        }
+    }
+    //std::cout << "type error: Zero Offset assertion fail\n";
+    m_errors.push_back("Zero Offset assertion fail");
+}
+
 type_domain_t type_domain_t::setup_entry() {
     region_domain_t reg = region_domain_t::setup_entry();
     type_domain_t typ(std::move(reg));
@@ -156,115 +360,198 @@ type_domain_t type_domain_t::setup_entry() {
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
-    if (is_bottom()) return;
-    m_region.do_bin(bin, nullptr, loc, print);
+
+    auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
+
+    std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
+    std::optional<interval_t> src_interval;
+    if (std::holds_alternative<Reg>(bin.v)) {
+        Reg r = std::get<Reg>(bin.v);
+        src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
+    }
+    else {
+        auto imm = std::get<Imm>(bin.v);
+        src_interval = interval_t{crab::number_t{static_cast<int>(imm.v)}};
+    }
+
+    using Op = Bin::Op;
+    // for all operations except mov, add, sub, the src and dst should be numbers
+    if ((src_ptr_or_mapfd || dst_ptr_or_mapfd)
+            && (bin.op != Op::MOV && bin.op != Op::ADD && bin.op != Op::SUB)) {
+        //std::cout << "type error: operation on pointers not allowed\n";
+        m_errors.push_back("operation on pointers not allowed");
+        m_region -= bin.dst.v;
+        return;
+    }
+
+    m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-    m_region.do_load(b, target_reg, loc, print);
+    m_region.do_load(b, target_reg, loc);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-    m_region.do_mem_store(b, target_reg, loc, print);
+
+    m_region.do_mem_store(b, target_reg, loc);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
-    if (is_bottom()) return;
- 
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
             do_load(b, std::get<Reg>(b.value), loc, print);
         } else {
             do_mem_store(b, std::get<Reg>(b.value), loc, print);
         }
+    } else {
+        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
+        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
+        //std::cout << desc;
+        m_errors.push_back(desc);
+        return;
     }
 }
 
-static void print_ptr_type(ptr_t ptr) {
-    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
-        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
-        std::cout << ptr_with_off;
-    }
-    else {
-        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
-        std::cout << ptr_no_off;
+// the method does not work well as it requires info about the label of basic block we are in
+// this info is not available when we are only printing any state
+// but it is available when we are processing a basic block for all its instructions:w
+//
+void type_domain_t::print_registers() const {
+    std::cout << "  register types: {\n";
+    for (size_t i = 0; i < NUM_REGISTERS; i++) {
+        register_t reg = (register_t)i;
+        auto maybe_ptr_or_mapfd_type = m_region.find_ptr_or_mapfd_type(reg);
+        if (maybe_ptr_or_mapfd_type) {
+            std::cout << "    ";
+            print_register(Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type);
+            std::cout << "\n";
+        }
     }
+    std::cout << "  }\n";
 }
 
 void type_domain_t::print_ctx() const {
-    std::vector<int> ctx_keys = m_region.get_ctx_keys();
-    std::cout << "ctx: {\n";
-    for (auto const k : ctx_keys) {
-        std::optional<ptr_t> ptr = m_region.find_in_ctx(k);
+    std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
+    std::cout << "  ctx: {\n";
+    for (auto const& k : ctx_keys) {
+        auto ptr = m_region.find_in_ctx(k);
         if (ptr) {
-            std::cout << "  " << k << ": ";
+            std::cout << "    " << k << ": ";
             print_ptr_type(ptr.value());
             std::cout << ",\n";
         }
     }
-    std::cout << "}\n\n";
+    std::cout << "  }\n";
 }
 
 void type_domain_t::print_stack() const {
-    std::vector<int> stack_keys = m_region.get_stack_keys();
-    std::cout << "stack: {\n";
-    for (auto const k : stack_keys) {
-        std::optional<ptr_t> ptr = m_region.find_in_stack(k);
-        if (ptr) {
-            std::cout << "  " << k << ": ";
-            print_ptr_type(ptr.value());
+    std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
+    std::cout << "  stack: {\n";
+    for (auto const& k : stack_keys_region) {
+        auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
+        if (maybe_ptr_or_mapfd_cells) {
+            auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
+            int width = ptr_or_mapfd_cells.second;
+            auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
+            std::cout << "    [" << k << "-" << k+width-1 << "] : ";
+            print_ptr_or_mapfd_type(ptr_or_mapfd);
             std::cout << ",\n";
         }
     }
-    std::cout << "}\n\n";
-}
-
-void type_domain_t::print_initial_registers() const {
-    auto label = label_t::entry;
-    location_t loc = location_t(std::make_pair(label, 0));
-    std::cout << "Initial register types:\n";
-    m_region.print_registers_at(loc);
+    std::cout << "  }\n";
 }
 
-void type_domain_t::print_initial_types() const {
-    print_ctx();
-    print_stack();
-    print_initial_registers();
+void type_domain_t::adjust_bb_for_types(location_t loc) {
+    m_region.adjust_bb_for_types(loc);
 }
 
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
+
+    if (print != 0) {
+        write(std::cout, bb, print);
+        return;
+    }
+
     auto label = bb.label();
     uint32_t curr_pos = 0;
-    location_t loc;
-    if (print > 0) {
-        if (label == label_t::entry) {
-            print_initial_types();
-            m_is_bottom = false;
-        }
-        std::cout << label << ":\n";
-    }
+    location_t loc = location_t(std::make_pair(label, curr_pos));
+    if (print == 0)
+        adjust_bb_for_types(loc);
 
     for (const Instruction& statement : bb) {
         loc = location_t(std::make_pair(label, ++curr_pos));
-        if (print > 0) std::cout << " " << curr_pos << ".";
         std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
     }
 
-    if (print > 0) {
-        auto [it, et] = bb.next_blocks();
-        if (it != et) {
-            std::cout << "  "
-            << "goto ";
-            for (; it != et;) {
-                std::cout << *it;
-                ++it;
-                if (it == et) {
-                    std::cout << ";";
-                } else {
-                    std::cout << ",";
-                }
+    operator+=(m_region.get_errors());
+}
+
+void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) const {
+    if (is_bottom()) {
+        o << bb << "\n";
+        return;
+    }
+    if (print < 0) {
+        o << "state of stack and ctx in program:\n";
+        print_ctx();
+        print_stack();
+        o << "\n";
+        return;
+    }
+
+    o << bb.label() << ":\n";
+    uint32_t curr_pos = 0;
+    for (const Instruction& statement : bb) {
+        ++curr_pos;
+        location_t loc = location_t(std::make_pair(bb.label(), curr_pos));
+        o << "   " << curr_pos << ".";
+        if (std::holds_alternative<Call>(statement)) {
+            auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
+            auto region = m_region.find_ptr_or_mapfd_at_loc(r0_reg);
+            print_annotated(o, std::get<Call>(statement), region);
+        }
+        else if (std::holds_alternative<Bin>(statement)) {
+            auto b = std::get<Bin>(statement);
+            auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
+            auto region = m_region.find_ptr_or_mapfd_at_loc(reg_with_loc);
+            print_annotated(o, b, region);
+        }
+        else if (std::holds_alternative<Mem>(statement)) {
+            auto u = std::get<Mem>(statement);
+            if (u.is_load) {
+                auto target_reg = std::get<Reg>(u.value);
+                auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
+                auto region = m_region.find_ptr_or_mapfd_at_loc(target_reg_loc);
+                print_annotated(o, u, region);
+            }
+            else o << "  " << u << "\n";
+        }
+        else if (std::holds_alternative<LoadMapFd>(statement)) {
+            auto u = std::get<LoadMapFd>(statement);
+            auto reg = crab::reg_with_loc_t(u.dst.v, loc);
+            auto region = m_region.find_ptr_or_mapfd_at_loc(reg);
+            print_annotated(o, u, region);
+        }
+        else o << "  " << statement << "\n";
+    }
+
+    auto [it, et] = bb.next_blocks();
+    if (it != et) {
+        o << "  " << "goto ";
+        for (; it != et;) {
+            o << *it;
+            ++it;
+            if (it == et) {
+                o << ";";
+            } else {
+                o << ",";
             }
         }
-        std::cout << "\n\n";
     }
+    o << "\n\n";
+}
+
+std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
+    typ.write(o);
+    return o;
 }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 2a3f5656e..9ed5714f8 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -11,13 +11,19 @@
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
 
+constexpr int NUM_REGISTERS = 11;
+
 using crab::ptr_t;
+using crab::ptr_or_mapfd_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
+using crab::mapfd_t;
+using crab::region_t;
 
 class type_domain_t final {
     region_domain_t m_region;
     bool m_is_bottom = false;
+    std::vector<std::string> m_errors;
 
   public:
 
@@ -67,31 +73,36 @@ class type_domain_t final {
     void operator()(const Assume &, location_t loc = boost::none, int print = 0);
     void operator()(const Assert &, location_t loc = boost::none, int print = 0);
     void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Addable& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const TypeConstraint& s, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidMapKeyValue& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ZeroCtxOffset& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
     void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
     void operator()(const basic_block_t& bb, int print = 0);
-    void write(std::ostream& os) const;
+    void write(std::ostream& os, const basic_block_t&, int) const;
+    void write(std::ostream& os) const {}
+    friend std::ostream& operator<<(std::ostream& o, const type_domain_t& dom);
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound();
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
+    std::vector<std::string>& get_errors() { return m_errors; }
 
   private:
 
     void do_load(const Mem&, const Reg&, location_t, int print = 0);
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
-    void print_initial_types() const;
     void report_type_error(std::string, location_t);
+    void print_registers() const;
     void print_ctx() const;
     void print_stack() const;
-    void print_initial_registers() const;
-
+    void adjust_bb_for_types(location_t);
+    void operator+=(std::vector<std::string>& errs) {
+        m_errors.insert(m_errors.end(), errs.begin(), errs.end());
+    }
 }; // end type_domain_t
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index d63066e22..fea511dbb 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -75,6 +75,20 @@ static checks_db generate_report(cfg_t& cfg,
     return m_db;
 }
 
+static checks_db generate_report_type_domain(cfg_t& cfg,
+                                 crab::invariant_table_t& post_invariants) {
+    checks_db m_db;
+    for (const label_t& label : cfg.sorted_labels()) {
+        abstract_domain_t from_inv(post_invariants.at(label));
+        
+        auto errors = from_inv.get_errors();
+        for (auto& error : errors) {
+            m_db.add_warning(label, error);
+        }
+    }
+    return m_db;
+}
+
 static auto get_line_info(const InstructionSeq& insts) {
     std::map<int, btf_line_info_t> label_to_line_info;
     for (auto& [label, inst, line_info] : insts) {
@@ -107,19 +121,26 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
 static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invariant_table_t& pre_invariants,
                                      crab::invariant_table_t& post_invariants) {
     // Analyze the control-flow graph.
-    checks_db db = generate_report(cfg, pre_invariants, post_invariants);
-    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN
-            || thread_local_options.abstract_domain == abstract_domain_kind::REGION_DOMAIN) {
-        auto state = post_invariants.at(label_t::exit);
+    //checks_db db = generate_report(cfg, pre_invariants, post_invariants);
+    checks_db db;
+    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN) {
+        db = generate_report_type_domain(cfg, post_invariants);
+        auto exit_state = post_invariants.at(label_t::exit);
+        // only to print ctx and stack, fix later
+        exit_state(cfg.get_node(label_t::exit), -1);
         for (const label_t& label : cfg.sorted_labels()) {
-            state(cfg.get_node(label), thread_local_options.print_invariants ? 2 : 1);
+            auto post_state = post_invariants.at(label);
+            post_state(cfg.get_node(label), thread_local_options.print_invariants);
         }
     }
-    else if (thread_local_options.print_invariants) {
-        for (const label_t& label : cfg.sorted_labels()) {
-            s << "\nPre-invariant : " << pre_invariants.at(label) << "\n";
-            s << cfg.get_node(label);
-            s << "\nPost-invariant: " << post_invariants.at(label) << "\n";
+    else {
+        db = generate_report(cfg, pre_invariants, post_invariants);
+        if (thread_local_options.print_invariants) {
+            for (const label_t& label : cfg.sorted_labels()) {
+                s << "\nPre-invariant : " << pre_invariants.at(label) << "\n";
+                s << cfg.get_node(label);
+                s << "\nPost-invariant: " << post_invariants.at(label) << "\n";
+            }
         }
     }
     return db;
@@ -132,10 +153,6 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
         ebpf_domain_t entry_inv = ebpf_domain_t::setup_entry(true);
         return abstract_domain_t(entry_inv);
     }
-    case abstract_domain_kind::REGION_DOMAIN: {
-        region_domain_t entry_inv = region_domain_t::setup_entry();
-        return abstract_domain_t(entry_inv);
-    }
     case abstract_domain_kind::TYPE_DOMAIN: {
         type_domain_t entry_inv = type_domain_t::setup_entry();
         return abstract_domain_t(entry_inv);
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 42c9a682e..6b0a3bfd1 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -55,7 +55,7 @@ int main(int argc, char** argv) {
     app.add_flag("-l", list, "List sections");
 
     std::string domain = "zoneCrab";
-    std::set<string> doms{"stats", "linux", "zoneCrab", "region", "cfg", "type"};
+    std::set<string> doms{"stats", "linux", "zoneCrab", "cfg", "type"};
     app.add_set("-d,--dom,--domain", domain, doms, "Abstract domain")->type_name("DOMAIN");
 
     app.add_flag("--termination", ebpf_verifier_options.check_termination, "Verify termination");
@@ -163,12 +163,9 @@ int main(int argc, char** argv) {
         print_map_descriptors(global_program_info->map_descriptors, out);
     }
 
-    if (domain == "zoneCrab" || domain == "region" || domain == "type") {
+    if (domain == "zoneCrab" || domain == "type") {
         ebpf_verifier_stats_t verifier_stats;
-        if (domain == "region") {
-          ebpf_verifier_options.abstract_domain = abstract_domain_kind::REGION_DOMAIN;
-        }
-        else if (domain == "type") {
+        if (domain == "type") {
           ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
         }
         auto [res, seconds] = timed_execution([&] {

From 83ac4abe47e6289301b41e625a4d2f6f12f0a392 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 13 Jul 2023 05:27:16 -0400
Subject: [PATCH 101/373] Refactor

Move both type_domain_t and region_domain_t under the namespace crab;
Move common code to both domains to another file;
Remove redundant code/comments and improved structure;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp |   4 +-
 src/crab/common.cpp          | 208 ++++++++++++++++++++++++++
 src/crab/common.hpp          | 126 ++++++++++++++++
 src/crab/region_domain.cpp   | 275 ++++++++---------------------------
 src/crab/region_domain.hpp   | 178 +++++------------------
 src/crab/type_domain.cpp     | 136 ++++++-----------
 src/crab/type_domain.hpp     |  55 +++----
 src/crab_verifier.cpp        |   1 +
 8 files changed, 501 insertions(+), 482 deletions(-)
 create mode 100644 src/crab/common.cpp
 create mode 100644 src/crab/common.hpp

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 059e746c6..c5d18f8e2 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -292,5 +292,5 @@ std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
 
 // REQUIRED: instantiation for supported domains
 template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
-template abstract_domain_t::abstract_domain_t(type_domain_t);
-template abstract_domain_t::abstract_domain_t(region_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::type_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::region_domain_t);
diff --git a/src/crab/common.cpp b/src/crab/common.cpp
new file mode 100644
index 000000000..fd7d894ae
--- /dev/null
+++ b/src/crab/common.cpp
@@ -0,0 +1,208 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "crab/common.hpp"
+
+namespace std {
+    template <>
+    struct hash<crab::reg_with_loc_t> {
+        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    };
+
+    static crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
+    return std::visit( overloaded
+               {
+                   []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
+                   []( const crab::ptr_no_off_t& x ){ return crab::ptr_t{x};},
+                   []( auto& ) { return crab::ptr_t{};}
+                }, t
+            );
+    }
+}
+
+namespace crab {
+
+bool same_region(const ptr_t& ptr1, const ptr_t& ptr2) {
+    return ((std::holds_alternative<ptr_with_off_t>(ptr1)
+                && std::holds_alternative<ptr_with_off_t>(ptr2))
+            || (std::holds_alternative<ptr_no_off_t>(ptr1)
+                && std::holds_alternative<ptr_no_off_t>(ptr2)));
+}
+
+inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
+    o << static_cast<std::underlying_type<region_t>::type>(t);
+    return o;
+}
+
+bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset()
+            && p1.get_region_size() == p2.get_region_size());
+}
+
+bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
+    return !(p1 == p2);
+}
+
+interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
+
+void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
+
+void ptr_with_off_t::set_region_size(interval_t region_sz) { m_region_size = region_sz; }
+
+void ptr_with_off_t::set_region(region_t r) { m_r = r; }
+
+ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
+    return ptr_with_off_t(m_r, m_offset | other.m_offset, m_region_size | other.m_region_size);
+}
+
+bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return (p1.get_region() == p2.get_region());
+}
+
+bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
+    return !(p1 == p2);
+}
+
+void ptr_no_off_t::set_region(region_t r) { m_r = r; }
+
+bool operator==(const mapfd_t& m1, const mapfd_t& m2) {
+    return (m1.get_value_type() == m2.get_value_type());
+}
+
+std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
+    m.write(o);
+    return o;
+}
+
+bool mapfd_t::has_type_map_programs() const {
+    return (m_value_type == EbpfMapValueType::PROGRAM);
+}
+
+void mapfd_t::write(std::ostream& o) const {
+    if (has_type_map_programs()) {
+        o << "map_fd_programs";
+    }
+    else {
+        o << "map_fd";
+    }
+}
+
+void reg_with_loc_t::write(std::ostream& o) const {
+    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
+}
+
+std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
+    reg.write(o);
+    return o;
+}
+
+bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
+    return (m_reg == other.m_reg && m_loc == other.m_loc);
+}
+
+std::size_t reg_with_loc_t::hash() const {
+    // Similar to boost::hash_combine
+    using std::hash;
+
+    std::size_t seed = hash<register_t>()(m_reg);
+    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+
+    return seed;
+}
+
+inline std::string get_reg_ptr(const region_t& r) {
+    switch (r) {
+        case region_t::T_CTX:
+            return "ctx_p";
+        case region_t::T_STACK:
+            return "stack_p";
+        case region_t::T_PACKET:
+            return "packet_p";
+        default:
+            return "shared_p";
+    }
+}
+
+void ptr_with_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(m_r) << "<" << m_offset;
+    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size;
+    o << ">";
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
+    p.write(o);
+    return o;
+}
+
+void ptr_no_off_t::write(std::ostream& o) const {
+    o << get_reg_ptr(get_region());
+}
+
+std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
+    p.write(o);
+    return o;
+}
+
+} // namespace crab
+
+void print_ptr_type(const crab::ptr_t& ptr) {
+    if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
+        crab::ptr_with_off_t ptr_with_off = std::get<crab::ptr_with_off_t>(ptr);
+        std::cout << ptr_with_off;
+    }
+    else {
+        crab::ptr_no_off_t ptr_no_off = std::get<crab::ptr_no_off_t>(ptr);
+        std::cout << ptr_no_off;
+    }
+}
+
+void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
+    if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
+        std::cout << std::get<crab::mapfd_t>(ptr_or_mapfd);
+    }
+    else {
+        auto ptr = get_ptr(ptr_or_mapfd);
+        print_ptr_type(ptr);
+    }
+}
+
+void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
+    std::cout << r << " : ";
+    if (p) {
+        print_ptr_or_mapfd_type(p.value());
+    }
+}
+
+inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
+
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
+    o << " = " << call.name << ":" << call.func << "(...)\n";
+}
+
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(b.dst, p);
+    o << " " << b.op << "= " << b.v << "\n";
+}
+
+void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(u.dst, p);
+    o << " = map_fd " << u.mapfd << "\n";
+}
+
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(std::get<Reg>(b.value), p);
+    o << " = ";
+    std::string sign = b.access.offset < 0 ? " - " : " + ";
+    int offset = std::abs(b.access.offset);
+    o << "*(" << size_(b.access.width) << " *)";
+    o << "(" << b.access.basereg << sign << offset << ")\n";
+}
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
new file mode 100644
index 000000000..3d894ec38
--- /dev/null
+++ b/src/crab/common.hpp
@@ -0,0 +1,126 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "linear_constraint.hpp"
+#include "string_constraints.hpp"
+#include "asm_syntax.hpp"
+#include "asm_ostream.hpp"
+
+constexpr int NUM_REGISTERS = 11;
+
+constexpr int STACK_BEGIN = 0;
+constexpr int CTX_BEGIN = 0;
+constexpr int PACKET_BEGIN = 0;
+constexpr int SHARED_BEGIN = 0;
+
+namespace crab {
+
+enum class region_t {
+	T_CTX,
+	T_STACK,
+	T_PACKET,
+	T_SHARED
+};
+
+class ptr_no_off_t {
+    region_t m_r;
+
+  public:
+    ptr_no_off_t() = default;
+    ptr_no_off_t(const ptr_no_off_t &) = default;
+    ptr_no_off_t(ptr_no_off_t &&) = default;
+    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
+    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
+    ptr_no_off_t(region_t _r) : m_r(_r) {}
+
+    [[nodiscard]] region_t get_region() const { return m_r; }
+    void set_region(region_t);
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
+};
+
+class ptr_with_off_t {
+    region_t m_r;
+    interval_t m_offset;
+    interval_t m_region_size;
+
+  public:
+    ptr_with_off_t() = default;
+    ptr_with_off_t(const ptr_with_off_t &) = default;
+    ptr_with_off_t(ptr_with_off_t &&) = default;
+    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
+    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
+    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz=interval_t::top())
+        : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
+    ptr_with_off_t operator|(const ptr_with_off_t&) const;
+    interval_t get_region_size() const;
+    void set_region_size(interval_t);
+    [[nodiscard]] interval_t get_offset() const { return m_offset; }
+    void set_offset(interval_t);
+    [[nodiscard]] region_t get_region() const { return m_r; }
+    void set_region(region_t);
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
+};
+
+using map_key_size_t = unsigned int;
+using map_value_size_t = unsigned int;
+
+class mapfd_t {
+    int m_mapfd;
+    EbpfMapValueType m_value_type;
+    map_key_size_t m_key_size;
+    map_value_size_t m_value_size;
+
+  public:
+    mapfd_t(const mapfd_t&) = default;
+    mapfd_t(mapfd_t&&) = default;
+    mapfd_t &operator=(const mapfd_t&) = default;
+    mapfd_t &operator=(mapfd_t&&) = default;
+    mapfd_t(int mapfd, EbpfMapValueType val_type, map_key_size_t key_size,
+            map_value_size_t value_size)
+        : m_mapfd(mapfd), m_value_type(val_type), m_key_size(key_size), m_value_size(value_size) {}
+    friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
+    void write(std::ostream&) const;
+
+    bool has_type_map_programs() const;
+    [[nodiscard]] EbpfMapValueType get_value_type() const { return m_value_type; }
+    [[nodiscard]] map_key_size_t get_key_size() const { return m_key_size; }
+    [[nodiscard]] map_value_size_t get_value_size() const { return m_value_size; }
+    [[nodiscard]] int get_mapfd() const { return m_mapfd; }
+};
+
+using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+using register_t = uint8_t;
+using location_t = boost::optional<std::pair<label_t, uint32_t>>;
+
+class reg_with_loc_t {
+    register_t m_reg;
+    location_t m_loc;
+
+  public:
+    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
+    bool operator==(const reg_with_loc_t& other) const;
+    std::size_t hash() const;
+    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
+    void write(std::ostream& ) const;
+};
+
+using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
+using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
+using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
+
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
+
+} // namespace crab
+
+void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t&);
+void print_ptr_type(const crab::ptr_t& ptr);
+void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 359503152..4b46901ab 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -2,206 +2,10 @@
 // SPDX-License-Identifier: MIT
 
 #include "crab/region_domain.hpp"
-
-using crab::___print___;
-using crab::ptr_t;
-using crab::mapfd_t;
-using crab::ptr_or_mapfd_t;
-using crab::ptr_with_off_t;
-using crab::ptr_no_off_t;
-using crab::ctx_t;
-using crab::global_region_env_t;
-using crab::reg_with_loc_t;
-using crab::live_registers_t;
-using crab::register_types_t;
-using crab::map_key_size_t;
-using crab::map_value_size_t;
-using crab::ptr_or_mapfd_cells_t;
-
-namespace std {
-    template <>
-    struct hash<crab::reg_with_loc_t> {
-        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
-    };
-
-    // does not seem to work for me
-    /*
-    template <>
-    struct equal_to<crab::ptr_t> {
-        constexpr bool operator()(const crab::ptr_t& p1, const crab::ptr_t& p2) const {
-            if (p1.index() != p2.index()) return false;
-            if (std::holds_alternative<crab::ptr_no_off_t>(p1)) {
-                auto ptr_no_off1 = std::get<crab::ptr_no_off_t>(p1);
-                auto ptr_no_off2 = std::get<crab::ptr_no_off_t>(p2);
-                return (ptr_no_off1.get_region() == ptr_no_off2.get_region());
-            }
-            else {
-                auto ptr_with_off1 = std::get<crab::ptr_with_off_t>(p1);
-                auto ptr_with_off2 = std::get<crab::ptr_with_off_t>(p2);
-                return (ptr_with_off1.get_region() == ptr_with_off2.get_region() && ptr_with_off1.get_offset() == ptr_with_off2.get_offset());
-            }
-        }
-    };
-    */
-
-    static ptr_t get_ptr(const ptr_or_mapfd_t& t) {
-    return std::visit( overloaded
-               {
-                   []( const ptr_with_off_t& x ){ return ptr_t{x};},
-                   []( const ptr_no_off_t& x ){ return ptr_t{x};},
-                   []( auto& ) { return ptr_t{};}
-                }, t
-            );
-    }
-}
-
+#include "crab/common.cpp"
 
 namespace crab {
 
-inline std::string get_reg_ptr(const region_t& r) {
-    switch (r) {
-        case region_t::T_CTX:
-            return "ctx_p";
-        case region_t::T_STACK:
-            return "stack_p";
-        case region_t::T_PACKET:
-            return "packet_p";
-        default:
-            return "shared_p";
-    }
-}
-
-static bool same_region(const ptr_t& ptr1, const ptr_t& ptr2) {
-    return ((std::holds_alternative<ptr_with_off_t>(ptr1)
-                && std::holds_alternative<ptr_with_off_t>(ptr2))
-            || (std::holds_alternative<ptr_no_off_t>(ptr1)
-                && std::holds_alternative<ptr_no_off_t>(ptr2)));
-}
-
-static void print_ptr_type(const ptr_t& ptr) {
-    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
-        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
-        std::cout << ptr_with_off;
-    }
-    else {
-        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
-        std::cout << ptr_no_off;
-    }
-}
-
-static void print_ptr_or_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
-    if (std::holds_alternative<mapfd_t>(ptr_or_mapfd)) {
-        std::cout << std::get<mapfd_t>(ptr_or_mapfd);
-    }
-    else {
-        auto ptr = get_ptr(ptr_or_mapfd);
-        print_ptr_type(ptr);
-    }
-}
-
-inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
-    o << static_cast<std::underlying_type<region_t>::type>(t);
-    return o;
-}
-
-bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset()
-            && p1.get_region_size() == p2.get_region_size());
-}
-
-bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return !(p1 == p2);
-}
-
-void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r) << "<" << m_offset;
-    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size;
-    o << ">";
-}
-
-std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
-    p.write(o);
-    return o;
-}
-
-interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
-
-void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
-
-void ptr_with_off_t::set_region_size(interval_t region_sz) { m_region_size = region_sz; }
-
-void ptr_with_off_t::set_region(region_t r) { m_r = r; }
-
-ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
-    return ptr_with_off_t(m_r, m_offset | other.m_offset, m_region_size | other.m_region_size);
-}
-
-bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return (p1.get_region() == p2.get_region());
-}
-
-bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return !(p1 == p2);
-}
-
-void ptr_no_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(get_region());
-}
-
-std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-    p.write(o);
-    return o;
-}
-
-void ptr_no_off_t::set_region(region_t r) { m_r = r; }
-
-bool operator==(const mapfd_t& m1, const mapfd_t& m2) {
-    return (m1.get_value_type() == m2.get_value_type());
-}
-
-std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
-    m.write(o);
-    return o;
-}
-
-bool mapfd_t::has_type_map_programs() const {
-    return (m_value_type == EbpfMapValueType::PROGRAM);
-}
-
-void mapfd_t::write(std::ostream& o) const {
-    if (has_type_map_programs()) {
-        o << "map_fd_programs";
-    }
-    else {
-        o << "map_fd";
-    }
-}
-
-void reg_with_loc_t::write(std::ostream& o) const {
-    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
-}
-
-std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    reg.write(o);
-    return o;
-}
-
-bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
-    return (m_reg == other.m_reg && m_loc == other.m_loc);
-}
-
-std::size_t reg_with_loc_t::hash() const {
-    // Similar to boost::hash_combine
-    using std::hash;
-
-    std::size_t seed = hash<register_t>()(m_reg);
-    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-
-    return seed;
-}
-
 ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
 {
     if (desc->data >= 0) {
@@ -218,10 +22,6 @@ ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
     }
 }
 
-int ctx_t::get_size() const {
-    return size;
-}
-
 std::vector<uint64_t> ctx_t::get_keys() const {
     std::vector<uint64_t> keys;
     keys.reserve(size);
@@ -469,8 +269,6 @@ std::vector<uint64_t> stack_t::find_overlapping_cells(uint64_t start, int width)
     return overlapping_cells;
 }
 
-}
-
 std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_type(register_t reg) const {
     return m_registers.find(reg);
 }
@@ -590,6 +388,48 @@ string_invariant region_domain_t::to_set() {
     return string_invariant{};
 }
 
+void region_domain_t::operator()(const Undefined &u, location_t loc, int print) {}
+
+void region_domain_t::operator()(const Exit &u, location_t loc, int print) {}
+
+void region_domain_t::operator()(const Jmp &u, location_t loc, int print) {}
+
+void region_domain_t::operator()(const Assume& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const Assert& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const basic_block_t& bb, int print) {
+    // nothing to do here
+}
+
+void region_domain_t::operator()(const Un &u, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+void region_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+void region_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
     auto reg = u.dst.v;
     auto reg_with_loc = reg_with_loc_t(reg, loc);
@@ -656,11 +496,11 @@ void region_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet.
 }
 
-void region_domain_t::operator()(const Packet & u, location_t loc, int print) {
+void region_domain_t::operator()(const Packet &u, location_t loc, int print) {
     m_registers -= register_t{R0_RETURN_VALUE};
 }
 
-void region_domain_t::operator()(const Addable& u, location_t loc, int print) {
+void region_domain_t::operator()(const Addable &u, location_t loc, int print) {
 
     auto maybe_ptr_type1 = m_registers.find(u.ptr.v);
     auto maybe_ptr_type2 = m_registers.find(u.num.v);
@@ -672,7 +512,7 @@ void region_domain_t::operator()(const Addable& u, location_t loc, int print) {
     m_errors.push_back("Addable assertion fail");
 }
 
-void region_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print) {
     bool is_comparison_check = s.width == (Value)Imm{0};
     if (std::holds_alternative<Reg>(s.width)) return;
     int width = std::get<Imm>(s.width).v;
@@ -730,7 +570,7 @@ void region_domain_t::operator()(const ValidStore& u, location_t loc, int print)
     m_errors.push_back("Valid store assertion fail");
 }
 
-region_domain_t region_domain_t::setup_entry() {
+region_domain_t&& region_domain_t::setup_entry() {
 
     std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
     std::shared_ptr<global_region_env_t> all_types = std::make_shared<global_region_env_t>();
@@ -744,15 +584,8 @@ region_domain_t region_domain_t::setup_entry() {
     typ.insert(R10_STACK_POINTER, r10,
             ptr_with_off_t(crab::region_t::T_STACK, interval_t{number_t{512}}));
 
-    region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
-    return inv;
-}
-
-void region_domain_t::report_type_error(std::string s, location_t loc) {
-    std::cout << "type_error at line " << loc->second << " in bb " << loc->first << "\n";
-    std::cout << s;
-    error_location = loc;
-    set_to_bottom();
+    static region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
+    return std::move(inv);
 }
 
 void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
@@ -825,6 +658,10 @@ void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const i
     }
 }
 
+void region_domain_t::operator()(const Bin& b, location_t loc, int print) {
+    // nothing to do here
+}
+
 interval_t region_domain_t::do_bin(const Bin& bin,
         const std::optional<interval_t>& src_interval_opt,
         const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
@@ -1029,6 +866,10 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t lo
     }
 }
 
+void region_domain_t::operator()(const Mem& m, location_t loc, int print) {
+    // nothing to do here
+}
+
 void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc) {
 
     int offset = b.access.offset;
@@ -1122,3 +963,5 @@ void region_domain_t::adjust_bb_for_types(location_t loc) {
 void region_domain_t::print_all_register_types() const {
     m_registers.print_all_register_types();
 }
+
+} // namespace crab
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 0ea7fb7bd..3bd2111ba 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -7,6 +7,7 @@
 #include <map>
 
 #include "crab/abstract_domain.hpp"
+#include "crab/common.hpp"
 #include "crab/cfg.hpp"
 #include "linear_constraint.hpp"
 #include "string_constraints.hpp"
@@ -14,129 +15,21 @@
 
 #include "platform.hpp"
 
-using crab::interval_t;
-using crab::number_t;
-
-constexpr int STACK_BEGIN = 0;
-constexpr int CTX_BEGIN = 0;
-constexpr int PACKET_BEGIN = 0;
-constexpr int SHARED_BEGIN = 0;
-
 namespace crab {
 
-enum class region_t {
-	T_CTX,
-	T_STACK,
-	T_PACKET,
-	T_SHARED
-};
-
-
-class ptr_no_off_t {
-    region_t m_r;
-
-  public:
-    ptr_no_off_t() = default;
-    ptr_no_off_t(const ptr_no_off_t &) = default;
-    ptr_no_off_t(ptr_no_off_t &&) = default;
-    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
-    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-    ptr_no_off_t(region_t _r) : m_r(_r) {}
-
-    constexpr region_t get_region() const { return m_r; }
-    void set_region(region_t);
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
-    //bool operator==(const ptr_no_off_t& p2);
-    //bool operator!=(const ptr_no_off_t& p2);
-};
-
-class ptr_with_off_t {
-    region_t m_r;
-    interval_t m_offset;
-    interval_t m_region_size;
-
-  public:
-    ptr_with_off_t() = default;
-    ptr_with_off_t(const ptr_with_off_t &) = default;
-    ptr_with_off_t(ptr_with_off_t &&) = default;
-    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
-    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz=interval_t::top())
-        : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
-    ptr_with_off_t operator|(const ptr_with_off_t&) const;
-    interval_t get_region_size() const;
-    void set_region_size(interval_t);
-    interval_t get_offset() const { return m_offset; }
-    void set_offset(interval_t);
-    constexpr region_t get_region() const { return m_r; }
-    void set_region(region_t);
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
-    //bool operator==(const ptr_with_off_t& p2);
-    //bool operator!=(const ptr_with_off_t& p2);
-};
-
-using map_key_size_t = unsigned int;
-using map_value_size_t = unsigned int;
-
-class mapfd_t {
-    int m_mapfd;
-    EbpfMapValueType m_value_type;
-    map_key_size_t m_key_size;
-    map_value_size_t m_value_size;
-
-  public:
-    mapfd_t(const mapfd_t&) = default;
-    mapfd_t(mapfd_t&&) = default;
-    mapfd_t &operator=(const mapfd_t&) = default;
-    mapfd_t &operator=(mapfd_t&&) = default;
-    mapfd_t(int mapfd, EbpfMapValueType val_type, map_key_size_t key_size,
-            map_value_size_t value_size)
-        : m_mapfd(mapfd), m_value_type(val_type), m_key_size(key_size), m_value_size(value_size) {}
-    friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
-    void write(std::ostream&) const;
-
-    bool has_type_map_programs() const;
-    constexpr EbpfMapValueType get_value_type() const { return m_value_type; }
-    constexpr map_key_size_t get_key_size() const { return m_key_size; }
-    constexpr map_value_size_t get_value_size() const { return m_value_size; }
-    constexpr int get_mapfd() const { return m_mapfd; }
-};
-
-using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
-using register_t = uint8_t;
-using location_t = boost::optional<std::pair<label_t, uint32_t>>;
-
-class reg_with_loc_t {
-    register_t m_reg;
-    location_t m_loc;
-
-  public:
-    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
-    bool operator==(const reg_with_loc_t& other) const;
-    std::size_t hash() const;
-    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
-    void write(std::ostream& ) const;
-};
-
 class ctx_t {
     using ptr_types_t = std::unordered_map<uint64_t, ptr_no_off_t>;
 
     ptr_types_t m_packet_ptrs;
-    int size = 0;
+    size_t size = 0;
 
   public:
     ctx_t(const ebpf_context_descriptor_t* desc);
-    int get_size() const;
+    constexpr size_t get_size() const { return size; }
     std::vector<uint64_t> get_keys() const;
     std::optional<ptr_no_off_t> find(uint64_t key) const;
 };
 
-using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
-using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
-using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
-
 class stack_t {
     ptr_or_mapfd_types_t m_ptrs;
     bool m_is_bottom;
@@ -163,9 +56,6 @@ class stack_t {
     size_t size() const;
 };
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
-using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
-
 class register_types_t {
 
     live_registers_t m_cur_def;
@@ -191,17 +81,14 @@ class register_types_t {
     void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_or_mapfd_t& type);
     std::optional<ptr_or_mapfd_t> find(reg_with_loc_t reg) const;
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
-    const live_registers_t &get_vars() { return m_cur_def; }
+    [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
     void adjust_bb_for_registers(location_t loc);
     void print_all_register_types() const;
 };
 
-}
-
 class region_domain_t final {
 
     bool m_is_bottom = false;
-    location_t error_location = boost::none;
     crab::stack_t m_stack;
     crab::register_types_t m_registers;
     std::shared_ptr<crab::ctx_t> m_ctx;
@@ -217,7 +104,7 @@ class region_domain_t final {
     region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
             : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static region_domain_t setup_entry();
+    static region_domain_t&& setup_entry();
     // bottom/top
     static region_domain_t bottom();
     void set_to_top();
@@ -242,32 +129,32 @@ class region_domain_t final {
     void operator-=(register_t var) { m_registers -= var; }
 
     //// abstract transformers
-    void operator()(const Undefined &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Bin &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Un &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const LoadMapFd &, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
+    void operator()(const Un&, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
     void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call &, location_t loc = boost::none, int print = 0);
+    void operator()(const Call&, location_t loc = boost::none, int print = 0);
     void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Jmp &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Mem &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Packet &, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume &, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Assert &, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Addable& s, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore& s, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint& s, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidMapKeyValue& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ZeroCtxOffset& s, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
     void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
-    void operator()(const basic_block_t& bb, int print = 0) {}
-    void write(std::ostream& os) const {}
+    void operator()(const basic_block_t& bb, int print = 0);
+    void write(std::ostream& o) const {}
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t&);
     friend std::ostream& operator<<(std::ostream&, const region_domain_t&);
@@ -282,16 +169,17 @@ class region_domain_t final {
     void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&, Bin::Op,
             const crab::reg_with_loc_t&, uint8_t);
 
-    void report_type_error(std::string, location_t);
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
-    size_t ctx_size() const;
+    [[nodiscard]] size_t ctx_size() const;
     std::optional<crab::ptr_no_off_t> find_in_ctx(uint64_t key) const;
-    std::vector<uint64_t> get_ctx_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
-    std::vector<uint64_t> get_stack_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool is_stack_pointer(register_t) const;
-    void adjust_bb_for_types(location_t loc);
+    void adjust_bb_for_types(location_t);
     void print_all_register_types() const;
-    std::vector<std::string>& get_errors() { return m_errors; }
+    [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
 }; // end region_domain_t
+
+} // namespace crab
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index dfe245540..f78c5210d 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -1,79 +1,21 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include <unordered_map>
-
 #include "crab/type_domain.hpp"
 
 namespace std {
-    static ptr_t get_ptr(const ptr_or_mapfd_t& t) {
+    static crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
     return std::visit( overloaded
                {
-                   []( const ptr_with_off_t& x ){ return ptr_t{x};},
-                   []( const ptr_no_off_t& x ){ return ptr_t{x};},
-                   []( auto& ) { return ptr_t{};}
+                   []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
+                   []( const crab::ptr_no_off_t& x ){ return crab::ptr_t{x};},
+                   []( auto& ) { return crab::ptr_t{};}
                 }, t
             );
     }
 }
 
-static std::string size(int w) { return std::string("u") + std::to_string(w * 8); }
-
-static void print_ptr_type(const ptr_t& ptr) {
-    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
-        ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr);
-        std::cout << ptr_with_off;
-    }
-    else {
-        ptr_no_off_t ptr_no_off = std::get<ptr_no_off_t>(ptr);
-        std::cout << ptr_no_off;
-    }
-}
-
-static void print_ptr_or_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
-    if (std::holds_alternative<mapfd_t>(ptr_or_mapfd)) {
-        std::cout << std::get<mapfd_t>(ptr_or_mapfd);
-    }
-    else {
-        auto ptr = get_ptr(ptr_or_mapfd);
-        print_ptr_type(ptr);
-    }
-}
-
-static void print_register(Reg r, std::optional<ptr_or_mapfd_t>& p) {
-    std::cout << r << " : ";
-    if (p) {
-        print_ptr_or_mapfd_type(p.value());
-    }
-}
-
-static void print_annotated(std::ostream& o, const Call& call, std::optional<ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
-    o << " = " << call.name << ":" << call.func << "(...)\n";
-}
-
-static void print_annotated(std::ostream& o, const Bin& b, std::optional<ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(b.dst, p);
-    o << " " << b.op << "= " << b.v << "\n";
-}
-
-static void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(u.dst, p);
-    o << " = map_fd " << u.mapfd << "\n";
-}
-
-static void print_annotated(std::ostream& o, const Mem& b, std::optional<ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(std::get<Reg>(b.value), p);
-    o << " = ";
-    std::string sign = b.access.offset < 0 ? " - " : " + ";
-    int offset = std::abs(b.access.offset);
-    o << "*(" << size(b.access.width) << " *)";
-    o << "(" << b.access.basereg << sign << offset << ")\n";
-}
+namespace crab {
 
 bool type_domain_t::is_bottom() const {
     return m_is_bottom;
@@ -165,14 +107,11 @@ string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined & u, location_t loc, int print) {
-    m_region(u, loc);
-}
+void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {}
 
-void type_domain_t::operator()(const Un &u, location_t loc, int print) {
-}
+void type_domain_t::operator()(const Un& u, location_t loc, int print) {}
 
-void type_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
     m_region(u, loc);
 }
 
@@ -183,7 +122,7 @@ void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, in
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Call &u, location_t loc, int print) {
+void type_domain_t::operator()(const Call& u, location_t loc, int print) {
 
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
@@ -210,19 +149,20 @@ void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Exit &u, location_t loc, int print) {
-    m_region(u, loc);
-}
+void type_domain_t::operator()(const Exit& u, location_t loc, int print) {}
+
+void type_domain_t::operator()(const Jmp& u, location_t loc, int print) {}
 
-void type_domain_t::operator()(const Jmp &u, location_t loc, int print) {
+void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_region(u, loc);
 }
 
-void type_domain_t::operator()(const Packet & u, location_t loc, int print) {
-    m_region(u, loc);
+void type_domain_t::operator()(const Assume& u, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
 }
 
-void type_domain_t::operator()(const Assume &u, location_t loc, int print) {
+void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
@@ -233,7 +173,7 @@ void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int prin
     m_region(s, loc);
 }
 
-void type_domain_t::operator()(const Assert &u, location_t loc, int print) {
+void type_domain_t::operator()(const Assert& u, location_t loc, int print) {
     std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
@@ -285,8 +225,8 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
     m_region(u, loc);
 }
 
-
 void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+    m_region(u, loc);
 }
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
@@ -354,7 +294,7 @@ void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print
 }
 
 type_domain_t type_domain_t::setup_entry() {
-    region_domain_t reg = region_domain_t::setup_entry();
+    auto&& reg = crab::region_domain_t::setup_entry();
     type_domain_t typ(std::move(reg));
     return typ;
 }
@@ -468,7 +408,7 @@ void type_domain_t::adjust_bb_for_types(location_t loc) {
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
 
     if (print != 0) {
-        write(std::cout, bb, print);
+        print_annotated(std::cout, *this, bb, print);
         return;
     }
 
@@ -486,15 +426,29 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
     operator+=(m_region.get_errors());
 }
 
-void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) const {
-    if (is_bottom()) {
+std::optional<crab::ptr_or_mapfd_t>
+type_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_region.find_ptr_or_mapfd_at_loc(loc);
+}
+
+std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
+    typ.write(o);
+    return o;
+}
+
+} // namespace crab
+
+
+void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
+        const basic_block_t& bb, int print) {
+    if (typ.is_bottom()) {
         o << bb << "\n";
         return;
     }
     if (print < 0) {
         o << "state of stack and ctx in program:\n";
-        print_ctx();
-        print_stack();
+        typ.print_ctx();
+        typ.print_stack();
         o << "\n";
         return;
     }
@@ -507,13 +461,13 @@ void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) c
         o << "   " << curr_pos << ".";
         if (std::holds_alternative<Call>(statement)) {
             auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
-            auto region = m_region.find_ptr_or_mapfd_at_loc(r0_reg);
+            auto region = typ.find_ptr_or_mapfd_at_loc(r0_reg);
             print_annotated(o, std::get<Call>(statement), region);
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
-            auto region = m_region.find_ptr_or_mapfd_at_loc(reg_with_loc);
+            auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
             print_annotated(o, b, region);
         }
         else if (std::holds_alternative<Mem>(statement)) {
@@ -521,7 +475,7 @@ void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) c
             if (u.is_load) {
                 auto target_reg = std::get<Reg>(u.value);
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
-                auto region = m_region.find_ptr_or_mapfd_at_loc(target_reg_loc);
+                auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
                 print_annotated(o, u, region);
             }
             else o << "  " << u << "\n";
@@ -529,7 +483,7 @@ void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) c
         else if (std::holds_alternative<LoadMapFd>(statement)) {
             auto u = std::get<LoadMapFd>(statement);
             auto reg = crab::reg_with_loc_t(u.dst.v, loc);
-            auto region = m_region.find_ptr_or_mapfd_at_loc(reg);
+            auto region = typ.find_ptr_or_mapfd_at_loc(reg);
             print_annotated(o, u, region);
         }
         else o << "  " << statement << "\n";
@@ -551,7 +505,3 @@ void type_domain_t::write(std::ostream& o, const basic_block_t& bb, int print) c
     o << "\n\n";
 }
 
-std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
-    typ.write(o);
-    return o;
-}
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 9ed5714f8..d99432492 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -3,25 +3,24 @@
 
 #pragma once
 
-#include <unordered_map>
-
 #include "crab/abstract_domain.hpp"
 #include "crab/region_domain.hpp"
-#include "crab/cfg.hpp"
-#include "linear_constraint.hpp"
-#include "string_constraints.hpp"
-
-constexpr int NUM_REGISTERS = 11;
+#include "crab/common.hpp"
 
 using crab::ptr_t;
-using crab::ptr_or_mapfd_t;
+using crab::variable_t;
 using crab::ptr_with_off_t;
 using crab::ptr_no_off_t;
+using crab::region_domain_t;
 using crab::mapfd_t;
+using crab::ptr_or_mapfd_t;
 using crab::region_t;
+using crab::interval_t;
+
+namespace crab {
 
 class type_domain_t final {
-    region_domain_t m_region;
+    crab::region_domain_t m_region;
     bool m_is_bottom = false;
     std::vector<std::string> m_errors;
 
@@ -30,7 +29,7 @@ class type_domain_t final {
     type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
-    explicit type_domain_t(region_domain_t&& reg, bool is_bottom = false) :
+    explicit type_domain_t(crab::region_domain_t&& reg, bool is_bottom = false) :
         m_region(reg), m_is_bottom(is_bottom) {}
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
@@ -59,19 +58,19 @@ class type_domain_t final {
     void operator-=(crab::variable_t var);
 
     //// abstract transformers
-    void operator()(const Undefined &, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin &, location_t loc = boost::none, int print = 0);
-    void operator()(const Un &, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd &, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
+    void operator()(const Un&, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
     void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call &, location_t loc = boost::none, int print = 0);
+    void operator()(const Call&, location_t loc = boost::none, int print = 0);
     void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit &, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp &, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem &, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet &, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume &, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert &, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
     void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
     void operator()(const Addable&, location_t loc = boost::none, int print = 0);
@@ -80,18 +79,20 @@ class type_domain_t final {
     void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidDivisor& s, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
     void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
     void operator()(const basic_block_t& bb, int print = 0);
-    void write(std::ostream& os, const basic_block_t&, int) const;
     void write(std::ostream& os) const {}
     friend std::ostream& operator<<(std::ostream& o, const type_domain_t& dom);
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound();
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
-    std::vector<std::string>& get_errors() { return m_errors; }
+    [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+    void print_ctx() const;
+    void print_stack() const;
+    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
 
   private:
 
@@ -99,10 +100,12 @@ class type_domain_t final {
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
     void report_type_error(std::string, location_t);
     void print_registers() const;
-    void print_ctx() const;
-    void print_stack() const;
     void adjust_bb_for_types(location_t);
     void operator+=(std::vector<std::string>& errs) {
         m_errors.insert(m_errors.end(), errs.begin(), errs.end());
     }
 }; // end type_domain_t
+
+} // namespace crab
+
+void print_annotated(std::ostream&, const crab::type_domain_t&, const basic_block_t&, int);
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index fea511dbb..962ced1a7 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -24,6 +24,7 @@
 #include "string_constraints.hpp"
 
 using crab::ebpf_domain_t;
+using crab::type_domain_t;
 using crab::linear_constraint_t;
 
 thread_local crab::lazy_allocator<program_info> global_program_info;

From f92c2f2b39da7a1180c72b51959bd1b4e7044ed7 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 13 Jul 2023 19:36:55 -0400
Subject: [PATCH 102/373] Attempt to add functionality/fix code in reference to
 latest PREVAIL

List of added changes/fixes:
1) ZeroCtxOffset now only checks offsets for Ctx pointers, as the name suggests;
2) Better support for TypeConstraint assertions, and added TypeGroup::singleton_ptr;
3) Small fixes/additions in Bin and Load operations;
4) Refactor

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 120 +++++++++++++++++++++----------------
 src/crab/region_domain.hpp |   3 +-
 src/crab/type_domain.cpp   |  50 +++++++---------
 3 files changed, 93 insertions(+), 80 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 4b46901ab..8d46c00f8 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -411,15 +411,21 @@ void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int
 }
 
 void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
-    // nothing to do here
+    if (is_ctx_pointer(u.reg.v)) {
+        auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
+        auto ctx_ptr = std::get<ptr_with_off_t>(maybe_ptr_or_mapfd.value());
+        if (ctx_ptr.get_offset() == interval_t{crab::number_t{0}}) return;
+    }
+    //std::cout << "type error: Zero Offset assertion fail\n";
+    m_errors.push_back("Zero Ctx Offset assertion fail");
 }
 
 void region_domain_t::operator()(const basic_block_t& bb, int print) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Un &u, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+void region_domain_t::operator()(const Un& u, location_t loc, int print) {
+    // nothing to do here
 }
 
 void region_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
@@ -433,7 +439,8 @@ void region_domain_t::operator()(const ValidSize& u, location_t loc, int print)
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
     auto reg = u.dst.v;
     auto reg_with_loc = reg_with_loc_t(reg, loc);
-    const EbpfMapDescriptor& desc = global_program_info.get().platform->get_map_descriptor(u.mapfd);
+    const EbpfMapDescriptor& desc
+        = global_program_info.get().platform->get_map_descriptor(u.mapfd);
     const EbpfMapValueType& map_value_type = global_program_info.get().platform->
         get_map_type(desc.type).value_type;
     map_key_size_t map_key_size = desc.key_size;
@@ -589,37 +596,11 @@ region_domain_t&& region_domain_t::setup_entry() {
 }
 
 void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
-    auto it = find_ptr_or_mapfd_type(s.reg.v);
-    if (it) {
+    auto ptr_or_mapfd_opt = m_registers.find(s.reg.v);
+    if (ptr_or_mapfd_opt) {
         // it is a pointer or mapfd
-        ptr_or_mapfd_t ptr_or_mapfd_type = it.value();
-        if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)) {
-            if (s.types == TypeGroup::non_map_fd) return;
-            if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
-            ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_type);
-            if (ptr_with_off.get_region() == crab::region_t::T_CTX) {
-                if (s.types == TypeGroup::ctx) return;
-            }
-            else if (ptr_with_off.get_region() == crab::region_t::T_SHARED) {
-                if (s.types == TypeGroup::shared || s.types == TypeGroup::mem
-                        || s.types == TypeGroup::mem_or_num) return;
-            }
-            else {
-                if (s.types == TypeGroup::stack || s.types == TypeGroup::mem
-                        || s.types == TypeGroup::stack_or_packet
-                        || s.types == TypeGroup::mem_or_num) {
-                    return;
-                }
-            }
-        }
-        else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)) {
-            if (s.types == TypeGroup::non_map_fd) return;
-            if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
-            if (s.types == TypeGroup::packet || s.types == TypeGroup::mem
-                    || s.types == TypeGroup::mem_or_num
-                    || s.types == TypeGroup::stack_or_packet) return;
-        }
-        else {
+        auto ptr_or_mapfd_type = ptr_or_mapfd_opt.value();
+        if (std::holds_alternative<mapfd_t>(ptr_or_mapfd_type)) {
             auto map_fd = std::get<mapfd_t>(ptr_or_mapfd_type);
             if (map_fd.has_type_map_programs()) {
                 if (s.types == TypeGroup::map_fd_programs) return;
@@ -627,6 +608,33 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
                 if (s.types == TypeGroup::map_fd) return;
             }
         }
+        else {
+            if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
+            if (s.types == TypeGroup::non_map_fd) return;
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)) {
+                ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_type);
+                if (ptr_with_off.get_region() == crab::region_t::T_CTX) {
+                    if (s.types == TypeGroup::singleton_ptr) return;
+                    if (s.types == TypeGroup::ctx) return;
+                }
+                else {
+                    if (s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num) return;
+                    if (ptr_with_off.get_region() == crab::region_t::T_SHARED) {
+                        if (s.types == TypeGroup::shared) return;
+                    }
+                    else {
+                        if (s.types == TypeGroup::singleton_ptr) return;
+                        if (s.types == TypeGroup::stack || s.types == TypeGroup::stack_or_packet)
+                            return;
+                    }
+                }
+            }
+            else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)) {
+                if (s.types == TypeGroup::singleton_ptr) return;
+                if (s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num) return;
+                if (s.types == TypeGroup::packet || s.types == TypeGroup::stack_or_packet) return;
+            }
+        }
     }
     else {
         // if we don't know the type, we assume it is a number
@@ -640,11 +648,11 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
 }
 
 void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const interval_t&& change,
-        Bin::Op op, const reg_with_loc_t& reg_with_loc, uint8_t reg) {
+        const reg_with_loc_t& reg_with_loc, uint8_t reg) {
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
         auto offset = ptr_or_mapfd_with_off.get_offset();
-        auto updated_offset = op == Bin::Op::ADD ? offset + change : offset - change;
+        auto updated_offset = change == interval_t::top() ? offset : offset + change;
         ptr_or_mapfd_with_off.set_offset(updated_offset);
         m_registers.insert(reg, reg_with_loc, ptr_or_mapfd_with_off);
     }
@@ -711,13 +719,13 @@ interval_t region_domain_t::do_bin(const Bin& bin,
             // b is a numerical register, or a constant
             else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
                 update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
-                        bin.op, reg, bin.dst.v);
+                        reg, bin.dst.v);
             }
             // b is a pointer/mapfd
             // ra is a numerical register
             else if (src_ptr_or_mapfd_opt && !dst_ptr_or_mapfd_opt) {
                 update_ptr_or_mapfd(std::move(src_ptr_or_mapfd), interval_t::top(),
-                        bin.op, reg, bin.dst.v);
+                        reg, bin.dst.v);
             }
             break;
         }
@@ -754,16 +762,14 @@ interval_t region_domain_t::do_bin(const Bin& bin,
             }
             // b is a numerical register, or a constant
             else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
-                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
-                        bin.op, reg, bin.dst.v);
+                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), -std::move(src_interval),
+                        reg, bin.dst.v);
             }
             break;
         }
-        default: {
-            m_registers -= bin.dst.v;
-            break;
-        }
+        default: break;
     }
+    m_registers -= bin.dst.v;
     return interval_t::bottom();
 }
 
@@ -773,15 +779,15 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t lo
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
-    auto it = m_registers.find(basereg.v);
-    if (!it) {
+    auto ptr_or_mapfd_opt = m_registers.find(basereg.v);
+    if (!ptr_or_mapfd_opt) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
         //std::cout << desc;
         m_registers -= target_reg.v;
         return;
     }
-    auto type_basereg = it.value();
+    auto type_basereg = ptr_or_mapfd_opt.value();
 
     if (!std::holds_alternative<ptr_with_off_t>(type_basereg)
             || std::get<ptr_with_off_t>(type_basereg).get_region() == crab::region_t::T_SHARED) {
@@ -810,17 +816,21 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t lo
                 m_registers -= target_reg.v;
             }
             else {
+                if (width != 1 && width != 2 && width != 4 && width != 8) {
+                    m_registers -= target_reg.v;
+                    return;
+                }
                 auto ptr_offset = offset_singleton.value();
                 auto load_at = (uint64_t)(ptr_offset + offset);
 
-                auto it = m_stack.find(load_at);
+                auto ptr_or_mapfd_opt = m_stack.find(load_at);
 
-                if (!it) {
+                if (!ptr_or_mapfd_opt) {
                     // no field at loaded offset in stack
                     m_registers -= target_reg.v;
                     return;
                 }
-                auto type_loaded = it.value();
+                auto type_loaded = ptr_or_mapfd_opt.value();
 
                 auto reg = reg_with_loc_t(target_reg.v, loc);
                 m_registers.insert(target_reg.v, reg, type_loaded.first);
@@ -945,6 +955,16 @@ void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location
     }
 }
 
+bool region_domain_t::is_ctx_pointer(register_t reg) const {
+    auto type = m_registers.find(reg);
+    if (!type) {    // not a pointer
+        return false;
+    }
+    auto ptr_or_mapfd_type = type.value();
+    return (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type) &&
+            std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_CTX);
+}
+
 
 bool region_domain_t::is_stack_pointer(register_t reg) const {
     auto type = m_registers.find(reg);
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 3bd2111ba..7d8ba1f79 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -166,7 +166,7 @@ class region_domain_t final {
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&, location_t);
-    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&, Bin::Op,
+    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
             const crab::reg_with_loc_t&, uint8_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
@@ -177,6 +177,7 @@ class region_domain_t final {
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool is_stack_pointer(register_t) const;
+    bool is_ctx_pointer(register_t) const;
     void adjust_bb_for_types(location_t);
     void print_all_register_types() const;
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index f78c5210d..0722ea3fe 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -109,7 +109,9 @@ string_invariant type_domain_t::to_set() {
 
 void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {}
 
-void type_domain_t::operator()(const Un& u, location_t loc, int print) {}
+void type_domain_t::operator()(const Un& u, location_t loc, int print) {
+    /* WARNING: The operation is not implemented yet.*/
+}
 
 void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
     m_region(u, loc);
@@ -138,6 +140,7 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
                         m_errors.push_back("storing at an unknown offset in stack");
                         continue;
                     }
+                    // TODO: forget the stack at [offset, offset+width]
                 }
             }
         }
@@ -162,7 +165,7 @@ void type_domain_t::operator()(const Assume& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+    m_region(s, loc);
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
@@ -198,10 +201,10 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
         // an extra check just to make sure registers are not labelled both ptrs and numbers
         auto ptr_or_mapfd1 = maybe_ptr_or_mapfd1.value();
         auto ptr_or_mapfd2 = maybe_ptr_or_mapfd1.value();
-        if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) {
-            return;
-        }
-        else if (!is_mapfd_type(ptr_or_mapfd1) && !is_mapfd_type(ptr_or_mapfd2)) {
+        auto is_mapfd1 = is_mapfd_type(ptr_or_mapfd1);
+        auto is_mapfd2 = is_mapfd_type(ptr_or_mapfd2);
+        if (is_mapfd1 && is_mapfd2) return;
+        else if (!is_mapfd1 && !is_mapfd2) {
             auto ptr1 = get_ptr(ptr_or_mapfd1);
             auto ptr2 = get_ptr(ptr_or_mapfd2);
             if (get_region(ptr1) == get_region(ptr2)) {
@@ -226,7 +229,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
-    m_region(u, loc);
+    /* WARNING: The operation is not implemented yet.*/
 }
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
@@ -264,11 +267,8 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
                 }
             }
             else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_basereg)) {
-                auto ptr_no_off = std::get<ptr_no_off_t>(ptr_or_mapfd_basereg);
-                if (ptr_no_off.get_region() == region_t::T_PACKET) {
-                    // We do not check packet ptr accesses yet
-                    return;
-                }
+                // We do not check packet ptr accesses yet
+                return;
             }
         }
     }
@@ -277,20 +277,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
 }
 
 void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
-
-    auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
-    if (maybe_ptr_or_mapfd) {
-        if (std::holds_alternative<ptr_with_off_t>(maybe_ptr_or_mapfd.value())) {
-            auto ptr_type_with_off = std::get<ptr_with_off_t>(maybe_ptr_or_mapfd.value());
-            if (ptr_type_with_off.get_offset() == interval_t{crab::number_t{0}}) return;
-        }
-        else if (std::holds_alternative<ptr_no_off_t>(maybe_ptr_or_mapfd.value())) {
-            // We do not yet support packet ptr offsets
-            return;
-        }
-    }
-    //std::cout << "type error: Zero Offset assertion fail\n";
-    m_errors.push_back("Zero Offset assertion fail");
+    m_region(u, loc);
 }
 
 type_domain_t type_domain_t::setup_entry() {
@@ -310,8 +297,14 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
     }
     else {
-        auto imm = std::get<Imm>(bin.v);
-        src_interval = interval_t{crab::number_t{static_cast<int>(imm.v)}};
+        int64_t imm;
+        if (bin.is64) {
+            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+        }
+        else {
+            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+        }
+        src_interval = interval_t{crab::number_t{imm}};
     }
 
     using Op = Bin::Op;
@@ -348,7 +341,6 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
         std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
         //std::cout << desc;
         m_errors.push_back(desc);
-        return;
     }
 }
 

From 47cdb950f446f05d65ab23ad2b7e8c3c8ecc6a17 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 14 Jul 2023 14:10:14 -0400
Subject: [PATCH 103/373] Refactor and fix equal_to template specialization
 issues

Refactor: Restructured the code better, and moved most of printing code to a separate file; removed redundant code;
Fixed template specialization of equal_to for ptr_t and ptr_or_mapfd_t

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp        | 112 ++++++++-----------------------------
 src/crab/common.hpp        |  66 ++++++++++++++++++----
 src/crab/region_domain.cpp |   1 -
 src/crab/region_domain.hpp |   7 +--
 src/crab/type_domain.cpp   |  15 +----
 src/crab/type_domain.hpp   |  10 ----
 src/crab/type_ostream.cpp  |  63 +++++++++++++++++++++
 src/crab/type_ostream.hpp  |  17 ++++++
 8 files changed, 161 insertions(+), 130 deletions(-)
 create mode 100644 src/crab/type_ostream.cpp
 create mode 100644 src/crab/type_ostream.hpp

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index fd7d894ae..8ac692868 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -1,17 +1,10 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#pragma once
-
 #include "crab/common.hpp"
 
 namespace std {
-    template <>
-    struct hash<crab::reg_with_loc_t> {
-        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
-    };
-
-    static crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
+    crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
     return std::visit( overloaded
                {
                    []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
@@ -20,10 +13,32 @@ namespace std {
                 }, t
             );
     }
-}
+} // namespace std
 
 namespace crab {
 
+bool ptr_with_off_t::operator==(const ptr_with_off_t& other) const {
+    return (m_r == other.m_r && m_offset == other.m_offset
+            && m_region_size == other.m_region_size);
+}
+
+bool ptr_with_off_t::operator!=(const ptr_with_off_t& other) const {
+    return !(*this == other);
+}
+
+bool ptr_no_off_t::operator==(const ptr_no_off_t& other) const {
+    return (m_r == other.m_r);
+}
+
+bool ptr_no_off_t::operator!=(const ptr_no_off_t& other) const {
+    return !(*this == other);
+}
+
+bool mapfd_t::operator==(const mapfd_t& other) const {
+    return (m_mapfd == other.m_mapfd && m_key_size == other.m_key_size
+            && m_value_size == other.m_value_size);
+}
+
 bool same_region(const ptr_t& ptr1, const ptr_t& ptr2) {
     return ((std::holds_alternative<ptr_with_off_t>(ptr1)
                 && std::holds_alternative<ptr_with_off_t>(ptr2))
@@ -36,15 +51,6 @@ inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
     return o;
 }
 
-bool operator==(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return (p1.get_region() == p2.get_region() && p1.get_offset() == p2.get_offset()
-            && p1.get_region_size() == p2.get_region_size());
-}
-
-bool operator!=(const ptr_with_off_t& p1, const ptr_with_off_t& p2) {
-    return !(p1 == p2);
-}
-
 interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
 
 void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
@@ -57,20 +63,8 @@ ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
     return ptr_with_off_t(m_r, m_offset | other.m_offset, m_region_size | other.m_region_size);
 }
 
-bool operator==(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return (p1.get_region() == p2.get_region());
-}
-
-bool operator!=(const ptr_no_off_t& p1, const ptr_no_off_t& p2) {
-    return !(p1 == p2);
-}
-
 void ptr_no_off_t::set_region(region_t r) { m_r = r; }
 
-bool operator==(const mapfd_t& m1, const mapfd_t& m2) {
-    return (m1.get_value_type() == m2.get_value_type());
-}
-
 std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
     m.write(o);
     return o;
@@ -148,61 +142,3 @@ std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
 }
 
 } // namespace crab
-
-void print_ptr_type(const crab::ptr_t& ptr) {
-    if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
-        crab::ptr_with_off_t ptr_with_off = std::get<crab::ptr_with_off_t>(ptr);
-        std::cout << ptr_with_off;
-    }
-    else {
-        crab::ptr_no_off_t ptr_no_off = std::get<crab::ptr_no_off_t>(ptr);
-        std::cout << ptr_no_off;
-    }
-}
-
-void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
-    if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
-        std::cout << std::get<crab::mapfd_t>(ptr_or_mapfd);
-    }
-    else {
-        auto ptr = get_ptr(ptr_or_mapfd);
-        print_ptr_type(ptr);
-    }
-}
-
-void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
-    std::cout << r << " : ";
-    if (p) {
-        print_ptr_or_mapfd_type(p.value());
-    }
-}
-
-inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
-
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
-    o << " = " << call.name << ":" << call.func << "(...)\n";
-}
-
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(b.dst, p);
-    o << " " << b.op << "= " << b.v << "\n";
-}
-
-void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(u.dst, p);
-    o << " = map_fd " << u.mapfd << "\n";
-}
-
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p) {
-    o << "  ";
-    print_register(std::get<Reg>(b.value), p);
-    o << " = ";
-    std::string sign = b.access.offset < 0 ? " - " : " + ";
-    int offset = std::abs(b.access.offset);
-    o << "*(" << size_(b.access.width) << " *)";
-    o << "(" << b.access.basereg << sign << offset << ")\n";
-}
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 3d894ec38..a66fbd082 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -3,10 +3,13 @@
 
 #pragma once
 
-#include "linear_constraint.hpp"
+#include <boost/optional/optional_io.hpp>
+#include <functional>
+#include <optional>
+#include <vector>
+
 #include "string_constraints.hpp"
 #include "asm_syntax.hpp"
-#include "asm_ostream.hpp"
 
 constexpr int NUM_REGISTERS = 11;
 
@@ -39,12 +42,14 @@ class ptr_no_off_t {
     void set_region(region_t);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
+    bool operator==(const ptr_no_off_t&) const;
+    bool operator!=(const ptr_no_off_t&) const;
 };
 
 class ptr_with_off_t {
     region_t m_r;
     interval_t m_offset;
-    interval_t m_region_size;
+    interval_t m_region_size = interval_t::top();
 
   public:
     ptr_with_off_t() = default;
@@ -52,8 +57,9 @@ class ptr_with_off_t {
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz=interval_t::top())
+    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz)
         : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
+    ptr_with_off_t(region_t _r, interval_t _off) : m_r(_r), m_offset(_off) {}
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
     interval_t get_region_size() const;
     void set_region_size(interval_t);
@@ -63,6 +69,8 @@ class ptr_with_off_t {
     void set_region(region_t);
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p);
+    bool operator==(const ptr_with_off_t&) const;
+    bool operator!=(const ptr_with_off_t&) const;
 };
 
 using map_key_size_t = unsigned int;
@@ -83,6 +91,8 @@ class mapfd_t {
             map_value_size_t value_size)
         : m_mapfd(mapfd), m_value_type(val_type), m_key_size(key_size), m_value_size(value_size) {}
     friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
+    bool operator==(const mapfd_t&) const;
+    bool operator!=(const mapfd_t&) const;
     void write(std::ostream&) const;
 
     bool has_type_map_programs() const;
@@ -115,12 +125,46 @@ using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
 using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
 using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
 
+bool same_region(const ptr_t& ptr1, const ptr_t& ptr2);
+
 } // namespace crab
 
-void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t&);
-void print_ptr_type(const crab::ptr_t& ptr);
-void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p);
+
+namespace std {
+    template <>
+    struct hash<crab::reg_with_loc_t> {
+        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
+    };
+
+    template <>
+    struct equal_to<crab::ptr_t> {
+        constexpr bool operator()(const crab::ptr_t& lhs, const crab::ptr_t& rhs) const {
+            if (lhs.index() != rhs.index()) return false;
+            return std::visit( overloaded
+               {
+                   []( const crab::ptr_with_off_t& x, const crab::ptr_with_off_t& y ){ return x == y;},
+                   []( const crab::ptr_no_off_t& x, const crab::ptr_no_off_t& y ){ return x == y;},
+                   []( auto& , auto& ) { return true;}
+                }, lhs, rhs
+            );
+        }
+    };
+
+    template <>
+    struct equal_to<crab::ptr_or_mapfd_t> {
+        constexpr bool operator()(const crab::ptr_or_mapfd_t& lhs, const crab::ptr_or_mapfd_t& rhs) const {
+            if (lhs.index() != rhs.index()) return false;
+            return std::visit( overloaded
+               {
+                   []( const crab::ptr_with_off_t& x, const crab::ptr_with_off_t& y ){ return x == y;},
+                   []( const crab::ptr_no_off_t& x, const crab::ptr_no_off_t& y ){ return x == y;},
+                   []( const crab::mapfd_t& x, const crab::mapfd_t& y ){ return x == y;},
+                   []( auto& , auto& ) { return true;}
+                }, lhs, rhs
+            );
+        }
+    };
+
+    crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t);
+}
+
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 8d46c00f8..cf0f98904 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: MIT
 
 #include "crab/region_domain.hpp"
-#include "crab/common.cpp"
 
 namespace crab {
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 7d8ba1f79..370a80def 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -3,15 +3,10 @@
 
 #pragma once
 
-#include <unordered_map>
-#include <map>
-
 #include "crab/abstract_domain.hpp"
 #include "crab/common.hpp"
+#include "crab/type_ostream.hpp"
 #include "crab/cfg.hpp"
-#include "linear_constraint.hpp"
-#include "string_constraints.hpp"
-#include <boost/optional/optional_io.hpp>
 
 #include "platform.hpp"
 
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 0722ea3fe..02e16221a 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -1,19 +1,7 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "crab/type_domain.hpp"
-
-namespace std {
-    static crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
-    return std::visit( overloaded
-               {
-                   []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
-                   []( const crab::ptr_no_off_t& x ){ return crab::ptr_t{x};},
-                   []( auto& ) { return crab::ptr_t{};}
-                }, t
-            );
-    }
-}
+#include "type_domain.hpp"
 
 namespace crab {
 
@@ -430,7 +418,6 @@ std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
 
 } // namespace crab
 
-
 void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
         const basic_block_t& bb, int print) {
     if (typ.is_bottom()) {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index d99432492..0d67185ce 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -7,16 +7,6 @@
 #include "crab/region_domain.hpp"
 #include "crab/common.hpp"
 
-using crab::ptr_t;
-using crab::variable_t;
-using crab::ptr_with_off_t;
-using crab::ptr_no_off_t;
-using crab::region_domain_t;
-using crab::mapfd_t;
-using crab::ptr_or_mapfd_t;
-using crab::region_t;
-using crab::interval_t;
-
 namespace crab {
 
 class type_domain_t final {
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
new file mode 100644
index 000000000..c6057c12d
--- /dev/null
+++ b/src/crab/type_ostream.cpp
@@ -0,0 +1,63 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/type_ostream.hpp"
+
+void print_ptr_type(const crab::ptr_t& ptr) {
+    if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
+        crab::ptr_with_off_t ptr_with_off = std::get<crab::ptr_with_off_t>(ptr);
+        std::cout << ptr_with_off;
+    }
+    else {
+        crab::ptr_no_off_t ptr_no_off = std::get<crab::ptr_no_off_t>(ptr);
+        std::cout << ptr_no_off;
+    }
+}
+
+void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
+    if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
+        std::cout << std::get<crab::mapfd_t>(ptr_or_mapfd);
+    }
+    else {
+        auto ptr = get_ptr(ptr_or_mapfd);
+        print_ptr_type(ptr);
+    }
+}
+
+void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
+    std::cout << r << " : ";
+    if (p) {
+        print_ptr_or_mapfd_type(p.value());
+    }
+}
+
+inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
+
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
+    o << " = " << call.name << ":" << call.func << "(...)\n";
+}
+
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(b.dst, p);
+    o << " " << b.op << "= " << b.v << "\n";
+}
+
+void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(u.dst, p);
+    o << " = map_fd " << u.mapfd << "\n";
+}
+
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << "  ";
+    print_register(std::get<Reg>(b.value), p);
+    o << " = ";
+    std::string sign = b.access.offset < 0 ? " - " : " + ";
+    int offset = std::abs(b.access.offset);
+    o << "*(" << size_(b.access.width) << " *)";
+    o << "(" << b.access.basereg << sign << offset << ")\n";
+}
+
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
new file mode 100644
index 000000000..87ebfe4ba
--- /dev/null
+++ b/src/crab/type_ostream.hpp
@@ -0,0 +1,17 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "string_constraints.hpp"
+#include "asm_syntax.hpp"
+#include "asm_ostream.hpp"
+#include "crab/common.hpp"
+
+void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t&);
+void print_ptr_type(const crab::ptr_t& ptr);
+void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p);

From 16f23ab4d555c9862a7f3b309136a61e823056f5 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 15 Jul 2023 02:13:34 -0400
Subject: [PATCH 104/373] Refactor

Refactor/clean up a lot of code;
Simplify many pointer region checks by using functions, especially in memory operations;
Move some generic checks in memory operations to type domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp        |  14 +-
 src/crab/common.hpp        |  43 ++++-
 src/crab/region_domain.cpp | 319 ++++++++++++++-----------------------
 src/crab/region_domain.hpp |  10 +-
 src/crab/type_domain.cpp   |  59 +++----
 src/crab/type_domain.hpp   |   2 +-
 src/crab/type_ostream.cpp  |  31 ++--
 src/crab/type_ostream.hpp  |   4 +-
 8 files changed, 207 insertions(+), 275 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index 8ac692868..d0d2e31e0 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -3,6 +3,7 @@
 
 #include "crab/common.hpp"
 
+/*
 namespace std {
     crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
     return std::visit( overloaded
@@ -14,6 +15,7 @@ namespace std {
             );
     }
 } // namespace std
+*/
 
 namespace crab {
 
@@ -39,18 +41,6 @@ bool mapfd_t::operator==(const mapfd_t& other) const {
             && m_value_size == other.m_value_size);
 }
 
-bool same_region(const ptr_t& ptr1, const ptr_t& ptr2) {
-    return ((std::holds_alternative<ptr_with_off_t>(ptr1)
-                && std::holds_alternative<ptr_with_off_t>(ptr2))
-            || (std::holds_alternative<ptr_no_off_t>(ptr1)
-                && std::holds_alternative<ptr_no_off_t>(ptr2)));
-}
-
-inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
-    o << static_cast<std::underlying_type<region_t>::type>(t);
-    return o;
-}
-
 interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
 
 void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index a66fbd082..849ab624b 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -119,13 +119,44 @@ class reg_with_loc_t {
 };
 
 using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
-using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
-using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
-using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
+inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
+    return (ptr_or_mapfd && std::holds_alternative<mapfd_t>(*ptr_or_mapfd));
+}
+
+inline bool same_region(const ptr_or_mapfd_t& ptr1, const ptr_or_mapfd_t& ptr2) {
+    if (std::holds_alternative<ptr_no_off_t>(ptr1) && std::holds_alternative<ptr_no_off_t>(ptr2))
+        return true;
+    return (std::holds_alternative<ptr_with_off_t>(ptr1)
+            && std::holds_alternative<ptr_with_off_t>(ptr2)
+            && std::get<ptr_with_off_t>(ptr1).get_region()
+                == std::get<ptr_with_off_t>(ptr2).get_region());
+}
+
+inline bool is_stack_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+    return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_STACK);
+}
+
+inline bool is_ctx_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+    return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_CTX);
+}
+
+inline bool is_packet_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+    return (ptr && std::holds_alternative<ptr_no_off_t>(*ptr));
+}
+
+inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+    return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_SHARED);
+}
+
+inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
+    o << static_cast<std::underlying_type<region_t>::type>(t);
+    return o;
+}
 
-bool same_region(const ptr_t& ptr1, const ptr_t& ptr2);
 
 } // namespace crab
 
@@ -165,6 +196,6 @@ namespace std {
         }
     };
 
-    crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t);
+    //crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t);
 }
 
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index cf0f98904..f74ad1f1f 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -53,26 +53,21 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
 
     for (size_t i = 0; i < m_cur_def.size(); i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
-        if (it1 && it2) {
-            ptr_or_mapfd_t ptr_or_mapfd1 = it1.value(), ptr_or_mapfd2 = it2.value();
+        auto maybe_ptr1 = find(*(m_cur_def[i]));
+        auto maybe_ptr2 = other.find(*(other.m_cur_def[i]));
+        if (maybe_ptr1 && maybe_ptr2) {
+            ptr_or_mapfd_t ptr_or_mapfd1 = maybe_ptr1.value(), ptr_or_mapfd2 = maybe_ptr2.value();
             auto reg = reg_with_loc_t((register_t)i, loc);
             if (ptr_or_mapfd1 == ptr_or_mapfd2) {
                 out_vars[i] = m_cur_def[i];
             }
-            else if (!std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
-                    && !std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
-                auto ptr1 = get_ptr(ptr_or_mapfd1);
-                auto ptr2 = get_ptr(ptr_or_mapfd2);
-                if (std::holds_alternative<ptr_with_off_t>(ptr1)
-                        && std::holds_alternative<ptr_with_off_t>(ptr2)) {
-                    ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr1);
-                    ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr2);
-                    if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                        out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
-                        (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
-                    }
+            else if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
+                        && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                    out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
+                    (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
                 }
             }
         }
@@ -101,7 +96,7 @@ bool register_types_t::is_bottom() const { return m_is_bottom; }
 bool register_types_t::is_top() const {
     if (m_is_bottom) { return false; }
     if (m_region_env == nullptr) return true;
-    for (auto it : m_cur_def) {
+    for (auto &it : m_cur_def) {
         if (it != nullptr) return false;
     }
     return true;
@@ -117,7 +112,7 @@ void register_types_t::print_all_register_types() const {
     std::cout << "\tregion types: {\n";
     for (auto const& kv : *m_region_env) {
         std::cout << "\t\t" << kv.first << " : ";
-        print_ptr_or_mapfd_type(kv.second);
+        print_ptr_or_mapfd_type(std::cout, kv.second);
         std::cout << "\n";
     }
     std::cout << "\t}\n";
@@ -410,9 +405,9 @@ void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int
 }
 
 void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
-    if (is_ctx_pointer(u.reg.v)) {
-        auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
-        auto ctx_ptr = std::get<ptr_with_off_t>(maybe_ptr_or_mapfd.value());
+    auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
+    if (is_ctx_ptr(maybe_ptr_or_mapfd)) {
+        auto ctx_ptr = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
         if (ctx_ptr.get_offset() == interval_t{crab::number_t{0}}) return;
     }
     //std::cout << "type error: Zero Offset assertion fail\n";
@@ -438,10 +433,9 @@ void region_domain_t::operator()(const ValidSize& u, location_t loc, int print)
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
     auto reg = u.dst.v;
     auto reg_with_loc = reg_with_loc_t(reg, loc);
-    const EbpfMapDescriptor& desc
-        = global_program_info.get().platform->get_map_descriptor(u.mapfd);
-    const EbpfMapValueType& map_value_type = global_program_info.get().platform->
-        get_map_type(desc.type).value_type;
+    auto platform = global_program_info->platform;
+    const EbpfMapDescriptor& desc = platform->get_map_descriptor(u.mapfd);
+    const EbpfMapValueType& map_value_type = platform->get_map_type(desc.type).value_type;
     map_key_size_t map_key_size = desc.key_size;
     map_value_size_t map_value_size = desc.value_size;
     auto type = mapfd_t(u.mapfd, map_value_type, map_key_size, map_value_size);
@@ -467,11 +461,12 @@ void region_domain_t::operator()(const Call &u, location_t loc, int print) {
             return;
         }
         auto mapfd = std::get<mapfd_t>(ptr_or_mapfd.value());
-        auto map_desc = global_program_info.get().platform->get_map_descriptor(mapfd.get_mapfd());
+        auto platform = global_program_info->platform;
+        auto map_desc = platform->get_map_descriptor(mapfd.get_mapfd());
         if (mapfd.get_value_type() == EbpfMapValueType::MAP) {
-            const EbpfMapDescriptor& inner_map_desc = global_program_info.get().platform->
+            const EbpfMapDescriptor& inner_map_desc = platform->
                 get_map_descriptor(map_desc.inner_map_fd);
-            const EbpfMapValueType& inner_map_value_type = global_program_info.get().platform->
+            const EbpfMapValueType& inner_map_value_type = platform->
                 get_map_type(inner_map_desc.type).value_type;
             map_key_size_t inner_map_key_size = inner_map_desc.key_size;
             map_value_size_t inner_map_value_size = inner_map_desc.value_size;
@@ -525,7 +520,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print
 
     auto maybe_ptr_or_mapfd_type = m_registers.find(s.reg.v);
     if (maybe_ptr_or_mapfd_type) {
-        auto reg_ptr_or_mapfd_type = maybe_ptr_or_mapfd_type.value();
+        auto reg_ptr_or_mapfd_type = *maybe_ptr_or_mapfd_type;
         if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
             auto reg_with_off_ptr_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
             auto offset = reg_with_off_ptr_type.get_offset();
@@ -566,7 +561,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print
 
 void region_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
 
-    bool is_stack_p = is_stack_pointer(u.mem.v);
+    bool is_stack_p = is_stack_ptr(m_registers.find(u.val.v));
     auto maybe_ptr_type2 = m_registers.find(u.val.v);
 
     if (is_stack_p || !maybe_ptr_type2) {
@@ -686,6 +681,7 @@ interval_t region_domain_t::do_bin(const Bin& bin,
     if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
 
     auto reg = reg_with_loc_t(bin.dst.v, loc);
+    interval_t to_return = interval_t::bottom();
 
     switch (bin.op)
     {
@@ -705,7 +701,7 @@ interval_t region_domain_t::do_bin(const Bin& bin,
         case Op::ADD: {
             // adding pointer to another
             if (src_ptr_or_mapfd_opt && dst_ptr_or_mapfd_opt) {
-                if (is_stack_pointer(bin.dst.v))
+                if (is_stack_ptr(dst_ptr_or_mapfd))
                     m_stack.set_to_top();
                 else {
                     // TODO: handle other cases properly
@@ -738,22 +734,15 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                     //std::cout << "type error: mapfd registers subtraction not defined\n";
                     m_errors.push_back("mapfd registers subtraction not defined");
                 }
-                else if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd) &&
-                        std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
-                    auto dst_ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
-                    auto src_ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
-                    if (dst_ptr_or_mapfd_with_off.get_region()
-                            == src_ptr_or_mapfd_with_off.get_region()) {
-                        m_registers -= bin.dst.v;
-                        return (dst_ptr_or_mapfd_with_off.get_offset() -
-                            src_ptr_or_mapfd_with_off.get_offset());
-                    }
-                    else {
-                        //std::cout << "type error: subtraction between pointers of different region\n";
-                        m_errors.push_back("subtraction between pointers of different region");
+                else if (same_region(dst_ptr_or_mapfd, src_ptr_or_mapfd)) {
+                    if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd) &&
+                            std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
+                        auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
+                        auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
+                        to_return = dst_ptr_with_off.get_offset() - src_ptr_with_off.get_offset();
                     }
                 }
-                else if (!same_region(get_ptr(dst_ptr_or_mapfd), get_ptr(src_ptr_or_mapfd))) {
+                else {
                     //std::cout << "type error: subtraction between pointers of different region\n";
                     m_errors.push_back("subtraction between pointers of different region");
                 }
@@ -768,109 +757,94 @@ interval_t region_domain_t::do_bin(const Bin& bin,
         }
         default: break;
     }
-    m_registers -= bin.dst.v;
-    return interval_t::bottom();
+    return to_return;
 }
 
-void region_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc) {
+void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
+        location_t loc) {
+
+    if (unknown_ptr) {
+        m_registers -= target_reg.v;
+        return;
+    }
 
     int width = b.access.width;
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
 
     auto ptr_or_mapfd_opt = m_registers.find(basereg.v);
-    if (!ptr_or_mapfd_opt) {
-        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-        std::string desc = std::string("\tloading from an unknown pointer, or from number - r") + s + "\n";
-        //std::cout << desc;
+    bool is_stack_p = is_stack_ptr(ptr_or_mapfd_opt);
+    bool is_ctx_p = is_ctx_ptr(ptr_or_mapfd_opt);
+    if (!is_ctx_p && !is_stack_p) {
+        // loading from either packet or shared region or mapfd does not happen in region domain
         m_registers -= target_reg.v;
         return;
     }
-    auto type_basereg = ptr_or_mapfd_opt.value();
 
-    if (!std::holds_alternative<ptr_with_off_t>(type_basereg)
-            || std::get<ptr_with_off_t>(type_basereg).get_region() == crab::region_t::T_SHARED) {
-        // loading from either packet, shared region or mapfd does not happen in region domain
-        m_registers -= target_reg.v;
-        return;
-    }
-
-    auto type_with_off = std::get<ptr_with_off_t>(type_basereg);
+    auto type_with_off = std::get<ptr_with_off_t>(*ptr_or_mapfd_opt);
     auto p_offset = type_with_off.get_offset();
     auto offset_singleton = p_offset.singleton();
 
-    switch (type_with_off.get_region()) {
-        case crab::region_t::T_STACK: {
-            if (!offset_singleton) {
-                for (auto const& k : m_stack.get_keys()) {
-                    auto start = p_offset.lb();
-                    auto end = p_offset.ub()+number_t{offset+width-1};
-                    interval_t range{start, end};
-                    if (range[number_t{(int)k}]) {
-                        //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
-                        m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
-                        break;
-                    }
+    if (is_stack_p) {
+        if (!offset_singleton) {
+            for (auto const& k : m_stack.get_keys()) {
+                auto start = p_offset.lb();
+                auto end = p_offset.ub()+number_t{offset+width-1};
+                interval_t range{start, end};
+                if (range[number_t{(int)k}]) {
+                    //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
+                    m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
+                    break;
                 }
+            }
+            m_registers -= target_reg.v;
+        }
+        else {
+            if (width != 1 && width != 2 && width != 4 && width != 8) {
                 m_registers -= target_reg.v;
+                return;
             }
-            else {
-                if (width != 1 && width != 2 && width != 4 && width != 8) {
-                    m_registers -= target_reg.v;
-                    return;
-                }
-                auto ptr_offset = offset_singleton.value();
-                auto load_at = (uint64_t)(ptr_offset + offset);
+            auto ptr_offset = offset_singleton.value();
+            auto load_at = (uint64_t)(ptr_offset + offset);
 
-                auto ptr_or_mapfd_opt = m_stack.find(load_at);
-
-                if (!ptr_or_mapfd_opt) {
-                    // no field at loaded offset in stack
-                    m_registers -= target_reg.v;
-                    return;
-                }
-                auto type_loaded = ptr_or_mapfd_opt.value();
-
-                auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded.first);
+            auto loaded = m_stack.find(load_at);
+            if (!loaded) {
+                // no field at loaded offset in stack
+                m_registers -= target_reg.v;
+                return;
             }
-            break;
+
+            auto reg = reg_with_loc_t(target_reg.v, loc);
+            m_registers.insert(target_reg.v, reg, (*loaded).first);
         }
-        case crab::region_t::T_CTX: {
-
-            if (!offset_singleton) {
-                for (auto const& k : m_ctx->get_keys()) {
-                    auto start = p_offset.lb();
-                    auto end = p_offset.ub()+crab::bound_t{offset+width-1};
-                    interval_t range{start, end};
-                    if (range[number_t{(int)k}]) {
-                        //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
-                        m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
-                        break;
-                    }
+    }
+    else {
+        if (!offset_singleton) {
+            for (auto const& k : m_ctx->get_keys()) {
+                auto start = p_offset.lb();
+                auto end = p_offset.ub()+crab::bound_t{offset+width-1};
+                interval_t range{start, end};
+                if (range[number_t{(int)k}]) {
+                    //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
+                    m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
+                    break;
                 }
-                m_registers -= target_reg.v;
             }
-            else {
-                auto ptr_offset = offset_singleton.value();
-                auto load_at = (uint64_t)(ptr_offset + offset);
-                auto it = m_ctx->find(load_at);
-
-                if (!it) {
-                    // no field at loaded offset in ctx
-                    m_registers -= target_reg.v;
-                    return;
-                }
-                ptr_no_off_t type_loaded = it.value();
+            m_registers -= target_reg.v;
+        }
+        else {
+            auto ptr_offset = offset_singleton.value();
+            auto load_at = (uint64_t)(ptr_offset + offset);
 
-                auto reg = reg_with_loc_t(target_reg.v, loc);
-                m_registers.insert(target_reg.v, reg, type_loaded);
+            auto loaded = m_ctx->find(load_at);
+            if (!loaded) {
+                // no field at loaded offset in ctx
+                m_registers -= target_reg.v;
+                return;
             }
-            break;
-        }
 
-        default: {
-            assert(false);
+            auto reg = reg_with_loc_t(target_reg.v, loc);
+            m_registers.insert(target_reg.v, reg, *loaded);
         }
     }
 }
@@ -885,94 +859,45 @@ void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location
     Reg basereg = b.access.basereg;
     int width = b.access.width;
 
-    // TODO: move generic checks to type domain
     auto maybe_basereg_type = m_registers.find(basereg.v);
-    if (!maybe_basereg_type) {
-        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-        std::string desc = std::string("\tstoring at an unknown pointer, or from number - r") + s + "\n";
-        //std::cout << desc;
-        m_errors.push_back(desc);
-        return;
-    }
     auto basereg_type = maybe_basereg_type.value();
     auto targetreg_type = m_registers.find(target_reg.v);
 
-    if (std::holds_alternative<ptr_with_off_t>(basereg_type)) {
-        // base register is either CTX_P, STACK_P or SHARED_P
-        auto basereg_type_with_off = std::get<ptr_with_off_t>(basereg_type);
+    bool is_ctx_p = is_ctx_ptr(maybe_basereg_type);
+    bool is_shared_p = is_shared_ptr(maybe_basereg_type);
+    bool is_packet_p = is_packet_ptr(maybe_basereg_type);
+    bool is_mapfd = is_mapfd_type(maybe_basereg_type);
 
-        if (basereg_type_with_off.get_region() == crab::region_t::T_STACK) {
-            auto offset_singleton = basereg_type_with_off.get_offset().singleton();
-            if (!offset_singleton) {
-                //std::cout << "type error: storing to a pointer with unknown offset\n";
-                m_errors.push_back("storing to a pointer with unknown offset");
-                return;
-            }
-            auto store_at = (uint64_t)offset+(uint64_t)offset_singleton.value();
-            // type of basereg is STACK_P
-            auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
-            m_stack -= overlapping_cells;
-
-            // if targetreg_type is empty, we are storing a number
-            if (!targetreg_type) return;
-
-            auto type_to_store = targetreg_type.value();
-            m_stack.store(store_at, type_to_store, width);
-        }
-        else if (basereg_type_with_off.get_region() == crab::region_t::T_CTX) {
-            // type of basereg is CTX_P
-            if (targetreg_type) {
-                std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-                std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into ctx\n";
-                //std::cout << desc;
-                m_errors.push_back(desc);
-                return;
-            }
-        }
-        else {
-            // type of basereg is SHARED_P
-            if (targetreg_type) {
-                //std::cout << "type error: we cannot store a pointer into shared\n";
-                m_errors.push_back("we cannot store a pointer into shared");
-            }
-        }
+    if (is_mapfd) {
+        m_errors.push_back("storing into a mapfd register is not defined");
+        return;
     }
-    else if (std::holds_alternative<ptr_no_off_t>(basereg_type)) {
-        // base register type is a PACKET_P
+    if (is_shared_p || is_packet_p || is_ctx_p) {
         if (targetreg_type) {
-            std::string s = std::to_string(static_cast<unsigned int>(target_reg.v));
-            std::string desc = std::string("\twe cannot store a pointer, r") + s + ", into packet\n";
-            //std::cout << desc;
-            m_errors.push_back(desc);
+            m_errors.push_back("storing a pointer into a shared, packet or ctx pointer");
+            return;
+        }
+        else {
+            // storing a number into a region does not affect the region
             return;
         }
     }
-    else {
-        //std::cout << "type error: we cannot store a pointer into a mapfd\n";
-        m_errors.push_back("we cannot store a pointer into a mapfd");
-        return;
-    }
-}
 
-bool region_domain_t::is_ctx_pointer(register_t reg) const {
-    auto type = m_registers.find(reg);
-    if (!type) {    // not a pointer
-        return false;
+    // if the code reaches here, we are storing into a stack pointer
+    auto basereg_type_with_off = std::get<ptr_with_off_t>(basereg_type);
+    auto offset_singleton = basereg_type_with_off.get_offset().singleton();
+    if (!offset_singleton) {
+        //std::cout << "type error: storing to a pointer with unknown offset\n";
+        m_errors.push_back("storing to a pointer with unknown offset");
+        return;
     }
-    auto ptr_or_mapfd_type = type.value();
-    return (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type) &&
-            std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_CTX);
-}
-
+    auto store_at = (uint64_t)offset+(uint64_t)offset_singleton.value();
+    auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
+    m_stack -= overlapping_cells;
 
-bool region_domain_t::is_stack_pointer(register_t reg) const {
-    auto type = m_registers.find(reg);
-    if (!type) {    // not a pointer
-        return false;
-    }
-    auto ptr_or_mapfd_type = type.value();
-    return (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type) &&
-            std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_STACK);
+    // if targetreg_type is empty, we are storing a number
+    if (!targetreg_type) return;
+    m_stack.store(store_at, *targetreg_type, width);
 }
 
 void region_domain_t::adjust_bb_for_types(location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 370a80def..8bcefa56d 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -25,6 +25,9 @@ class ctx_t {
     std::optional<ptr_no_off_t> find(uint64_t key) const;
 };
 
+using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
+using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
+
 class stack_t {
     ptr_or_mapfd_types_t m_ptrs;
     bool m_is_bottom;
@@ -51,6 +54,9 @@ class stack_t {
     size_t size() const;
 };
 
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
+
 class register_types_t {
 
     live_registers_t m_cur_def;
@@ -156,7 +162,7 @@ class region_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_load(const Mem&, const Reg&, location_t);
+    void do_load(const Mem&, const Reg&, bool, location_t);
     void do_mem_store(const Mem&, const Reg&, location_t);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
@@ -171,8 +177,6 @@ class region_domain_t final {
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
-    bool is_stack_pointer(register_t) const;
-    bool is_ctx_pointer(register_t) const;
     void adjust_bb_for_types(location_t);
     void print_all_register_types() const;
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 02e16221a..90983e3d6 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -168,37 +168,14 @@ void type_domain_t::operator()(const Assert& u, location_t loc, int print) {
     std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
-static bool is_mapfd_type(const ptr_or_mapfd_t& ptr_or_mapfd) {
-    return (std::holds_alternative<mapfd_t>(ptr_or_mapfd));
-}
-
-static region_t get_region(const ptr_t& ptr) {
-    if (std::holds_alternative<ptr_with_off_t>(ptr)) {
-        return std::get<ptr_with_off_t>(ptr).get_region();
-    }
-    else {
-        return std::get<ptr_no_off_t>(ptr).get_region();
-    }
-}
-
 void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         // an extra check just to make sure registers are not labelled both ptrs and numbers
-        auto ptr_or_mapfd1 = maybe_ptr_or_mapfd1.value();
-        auto ptr_or_mapfd2 = maybe_ptr_or_mapfd1.value();
-        auto is_mapfd1 = is_mapfd_type(ptr_or_mapfd1);
-        auto is_mapfd2 = is_mapfd_type(ptr_or_mapfd2);
-        if (is_mapfd1 && is_mapfd2) return;
-        else if (!is_mapfd1 && !is_mapfd2) {
-            auto ptr1 = get_ptr(ptr_or_mapfd1);
-            auto ptr2 = get_ptr(ptr_or_mapfd2);
-            if (get_region(ptr1) == get_region(ptr2)) {
-                return;
-            }
-        }
+        if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
+        if (same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
     }
     else if (!maybe_ptr_or_mapfd1 && !maybe_ptr_or_mapfd2) {
         // all other cases when we do not have a ptr or mapfd, the type is a number
@@ -226,16 +203,15 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
     auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
     auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
-        auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
-        auto mapfd = maybe_mapfd.value();
-        if (is_mapfd_type(mapfd)) {
-            auto mapfd_type = std::get<mapfd_t>(mapfd);
+        if (is_mapfd_type(maybe_mapfd)) {
+            auto mapfd_type = std::get<mapfd_t>(*maybe_mapfd);
             if (u.key) {
                 width = (int)mapfd_type.get_key_size();
             }
             else {
                 width = (int)mapfd_type.get_value_size();
             }
+            auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
                 if (ptr_with_off.get_region() == region_t::T_STACK) {
@@ -308,21 +284,30 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
 }
 
-void type_domain_t::do_load(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-    m_region.do_load(b, target_reg, loc);
+void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
+        location_t loc, int print) {
+    m_region.do_load(b, target_reg, unknown_ptr, loc);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-
     m_region.do_mem_store(b, target_reg, loc);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     if (std::holds_alternative<Reg>(b.value)) {
+        auto basereg = std::get<Reg>(b.value);
+        auto ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
+        bool unknown_ptr = !ptr_or_mapfd_opt.has_value();
+        if (unknown_ptr) {
+            std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+            m_errors.push_back(
+                    std::string("load/store using an unknown pointer, or number - r") + s);
+        }
+
         if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value), loc, print);
-        } else {
-            do_mem_store(b, std::get<Reg>(b.value), loc, print);
+            do_load(b, basereg, unknown_ptr, loc, print);
+        } else if (!unknown_ptr) {
+            do_mem_store(b, basereg, loc, print);
         }
     } else {
         std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
@@ -357,7 +342,7 @@ void type_domain_t::print_ctx() const {
         auto ptr = m_region.find_in_ctx(k);
         if (ptr) {
             std::cout << "    " << k << ": ";
-            print_ptr_type(ptr.value());
+            print_ptr_type(std::cout, ptr_or_mapfd_t{ptr.value()});
             std::cout << ",\n";
         }
     }
@@ -374,7 +359,7 @@ void type_domain_t::print_stack() const {
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             std::cout << "    [" << k << "-" << k+width-1 << "] : ";
-            print_ptr_or_mapfd_type(ptr_or_mapfd);
+            print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd);
             std::cout << ",\n";
         }
     }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 0d67185ce..d27c29f80 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -86,7 +86,7 @@ class type_domain_t final {
 
   private:
 
-    void do_load(const Mem&, const Reg&, location_t, int print = 0);
+    void do_load(const Mem&, const Reg&, bool, location_t, int print = 0);
     void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
     void report_type_error(std::string, location_t);
     void print_registers() const;
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index c6057c12d..47c7e2001 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -3,31 +3,28 @@
 
 #include "crab/type_ostream.hpp"
 
-void print_ptr_type(const crab::ptr_t& ptr) {
+void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
-        crab::ptr_with_off_t ptr_with_off = std::get<crab::ptr_with_off_t>(ptr);
-        std::cout << ptr_with_off;
+        o << std::get<crab::ptr_with_off_t>(ptr);
     }
-    else {
-        crab::ptr_no_off_t ptr_no_off = std::get<crab::ptr_no_off_t>(ptr);
-        std::cout << ptr_no_off;
+    else if (std::holds_alternative<crab::ptr_no_off_t>(ptr)) {
+        o << std::get<crab::ptr_no_off_t>(ptr);
     }
 }
 
-void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
+void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
     if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
-        std::cout << std::get<crab::mapfd_t>(ptr_or_mapfd);
+        o << std::get<crab::mapfd_t>(ptr_or_mapfd);
     }
     else {
-        auto ptr = get_ptr(ptr_or_mapfd);
-        print_ptr_type(ptr);
+        print_ptr_type(o, ptr_or_mapfd);
     }
 }
 
-void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
-    std::cout << r << " : ";
+void print_register(std::ostream& o, Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
+    o << r << " : ";
     if (p) {
-        print_ptr_or_mapfd_type(p.value());
+        print_ptr_or_mapfd_type(o, p.value());
     }
 }
 
@@ -35,25 +32,25 @@ inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8
 
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(Reg{(uint8_t)R0_RETURN_VALUE}, p);
+    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p);
     o << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(b.dst, p);
+    print_register(o, b.dst, p);
     o << " " << b.op << "= " << b.v << "\n";
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(u.dst, p);
+    print_register(o, u.dst, p);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(std::get<Reg>(b.value), p);
+    print_register(o, std::get<Reg>(b.value), p);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
     int offset = std::abs(b.access.offset);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 87ebfe4ba..6761d9724 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -8,8 +8,8 @@
 #include "asm_ostream.hpp"
 #include "crab/common.hpp"
 
-void print_ptr_or_mapfd_type(const crab::ptr_or_mapfd_t&);
-void print_ptr_type(const crab::ptr_t& ptr);
+void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&);
+void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr);
 void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);

From 8401e6d8b31579e3932ccd81a599415c5a3c19be Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 15 Jul 2023 16:36:51 -0400
Subject: [PATCH 105/373] Fix an error in Mem operation that slipped during
 previous commit

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 90983e3d6..73f1806be 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -295,7 +295,8 @@ void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     if (std::holds_alternative<Reg>(b.value)) {
-        auto basereg = std::get<Reg>(b.value);
+        auto targetreg = std::get<Reg>(b.value);
+        auto basereg = b.access.basereg;
         auto ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
         bool unknown_ptr = !ptr_or_mapfd_opt.has_value();
         if (unknown_ptr) {
@@ -305,16 +306,12 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
         }
 
         if (b.is_load) {
-            do_load(b, basereg, unknown_ptr, loc, print);
+            do_load(b, targetreg, unknown_ptr, loc, print);
         } else if (!unknown_ptr) {
-            do_mem_store(b, basereg, loc, print);
+            do_mem_store(b, targetreg, loc, print);
         }
-    } else {
-        std::string s = std::to_string(static_cast<unsigned int>(std::get<Imm>(b.value).v));
-        std::string desc = std::string("\tEither loading to a number (not allowed) or storing a number (not allowed yet) - ") + s + "\n";
-        //std::cout << desc;
-        m_errors.push_back(desc);
     }
+    else {}
 }
 
 // the method does not work well as it requires info about the label of basic block we are in

From 46c198a5410ee4c2a9affc251adf85a6d3265dfe Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 16 Jul 2023 02:03:39 -0400
Subject: [PATCH 106/373] Better handling of map_fd

Much better handling for map_fd, that is closer to the PREVAIL implementation, in order to avoid possible errors;
Remove redundant implementation and code;
Fix joins with respect to map_fd

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp        |   8 +-
 src/crab/common.hpp        |  17 ++--
 src/crab/region_domain.cpp | 174 ++++++++++++++++++++++++++++---------
 src/crab/region_domain.hpp |   5 ++
 src/crab/type_domain.cpp   |   9 +-
 5 files changed, 148 insertions(+), 65 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index d0d2e31e0..f27047e92 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -37,8 +37,12 @@ bool ptr_no_off_t::operator!=(const ptr_no_off_t& other) const {
 }
 
 bool mapfd_t::operator==(const mapfd_t& other) const {
-    return (m_mapfd == other.m_mapfd && m_key_size == other.m_key_size
-            && m_value_size == other.m_value_size);
+    return (m_mapfd == other.m_mapfd);
+}
+
+mapfd_t mapfd_t::operator|(const mapfd_t& other) const {
+    auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
+    return mapfd_t(m_mapfd | other.m_mapfd, value_type);
 }
 
 interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 849ab624b..e3a3d5524 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -73,23 +73,18 @@ class ptr_with_off_t {
     bool operator!=(const ptr_with_off_t&) const;
 };
 
-using map_key_size_t = unsigned int;
-using map_value_size_t = unsigned int;
-
 class mapfd_t {
-    int m_mapfd;
+    interval_t m_mapfd;
     EbpfMapValueType m_value_type;
-    map_key_size_t m_key_size;
-    map_value_size_t m_value_size;
 
   public:
     mapfd_t(const mapfd_t&) = default;
     mapfd_t(mapfd_t&&) = default;
     mapfd_t &operator=(const mapfd_t&) = default;
     mapfd_t &operator=(mapfd_t&&) = default;
-    mapfd_t(int mapfd, EbpfMapValueType val_type, map_key_size_t key_size,
-            map_value_size_t value_size)
-        : m_mapfd(mapfd), m_value_type(val_type), m_key_size(key_size), m_value_size(value_size) {}
+    mapfd_t operator|(const mapfd_t&) const;
+    mapfd_t(interval_t mapfd, EbpfMapValueType val_type)
+        : m_mapfd(mapfd), m_value_type(val_type) {}
     friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
     bool operator==(const mapfd_t&) const;
     bool operator!=(const mapfd_t&) const;
@@ -97,9 +92,7 @@ class mapfd_t {
 
     bool has_type_map_programs() const;
     [[nodiscard]] EbpfMapValueType get_value_type() const { return m_value_type; }
-    [[nodiscard]] map_key_size_t get_key_size() const { return m_key_size; }
-    [[nodiscard]] map_value_size_t get_value_size() const { return m_value_size; }
-    [[nodiscard]] int get_mapfd() const { return m_mapfd; }
+    [[nodiscard]] interval_t get_mapfd() const { return m_mapfd; }
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index f74ad1f1f..426b13495 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -61,13 +61,23 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
             if (ptr_or_mapfd1 == ptr_or_mapfd2) {
                 out_vars[i] = m_cur_def[i];
             }
-            else if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
-                        && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
-                ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
-                ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
-                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                    out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
-                    (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
+            else { 
+                auto shared_reg = std::make_shared<reg_with_loc_t>(reg);
+                if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
+                            && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                    ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                    ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                    if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                        out_vars[i] = shared_reg;
+                        (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
+                    }
+                }
+                else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
+                        && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                    mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                    mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                    out_vars[i] = shared_reg;
+                    (*m_region_env)[reg] = std::move(mapfd1 | mapfd2);
                 }
             }
         }
@@ -160,7 +170,7 @@ stack_t stack_t::operator|(const stack_t& other) const {
         auto maybe_ptr_or_mapfd_cells = other.find(kv.first);
         if (maybe_ptr_or_mapfd_cells) {
             auto ptr_or_mapfd_cells1 = kv.second;
-            auto ptr_or_mapfd_cells2 = maybe_ptr_or_mapfd_cells.value();
+            auto ptr_or_mapfd_cells2 = *maybe_ptr_or_mapfd_cells;
             auto ptr_or_mapfd1 = ptr_or_mapfd_cells1.first;
             auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
             int width1 = ptr_or_mapfd_cells1.second;
@@ -178,6 +188,12 @@ stack_t stack_t::operator|(const stack_t& other) const {
                         = std::make_pair(ptr_with_off1 | ptr_with_off2, width_joined);
                 }
             }
+            else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                out_ptrs[kv.first] = std::make_pair(mapfd1 | mapfd2, width_joined);
+            }
         }
     }
     return stack_t(std::move(out_ptrs), false);
@@ -430,19 +446,95 @@ void region_domain_t::operator()(const ValidSize& u, location_t loc, int print)
     /* WARNING: The operation is not implemented yet.*/
 }
 
-void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
-    auto reg = u.dst.v;
-    auto reg_with_loc = reg_with_loc_t(reg, loc);
-    auto platform = global_program_info->platform;
-    const EbpfMapDescriptor& desc = platform->get_map_descriptor(u.mapfd);
+// Get the start and end of the range of possible map fd values.
+// In the future, it would be cleaner to use a set rather than an interval
+// for map fds.
+bool region_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, int32_t* end_fd) const {
+    auto maybe_type = m_registers.find(map_fd_reg.v);
+    if (!is_mapfd_type(maybe_type)) return false;
+    auto mapfd_type = std::get<mapfd_t>(*maybe_type);
+    const interval_t& mapfd_interval = mapfd_type.get_mapfd();
+    auto lb = mapfd_interval.lb().number();
+    auto ub = mapfd_interval.ub().number();
+    if (!lb || !lb->fits_sint32() || !ub || !ub->fits_sint32())
+        return false;
+    *start_fd = (int32_t)lb.value();
+    *end_fd = (int32_t)ub.value();
+
+    // Cap the maximum range we'll check.
+    const int max_range = 32;
+    return (*mapfd_interval.finite_size() < max_range);
+}
+
+// All maps in the range must have the same type for us to use it.
+std::optional<uint32_t> region_domain_t::get_map_type(const Reg& map_fd_reg) const {
+    int32_t start_fd, end_fd;
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+        return std::optional<uint32_t>();
+
+    std::optional<uint32_t> type;
+    for (int32_t map_fd = start_fd; map_fd <= end_fd; map_fd++) {
+        EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd);
+        if (map == nullptr)
+            return std::optional<uint32_t>();
+        if (!type.has_value())
+            type = map->type;
+        else if (map->type != *type)
+            return std::optional<uint32_t>();
+    }
+    return type;
+}
+
+// All maps in the range must have the same inner map fd for us to use it.
+std::optional<uint32_t> region_domain_t::get_map_inner_map_fd(const Reg& map_fd_reg) const {
+    int32_t start_fd, end_fd;
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+        return std::optional<uint32_t>();
+
+    std::optional<uint32_t> inner_map_fd;
+    for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
+        EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd);
+        if (map == nullptr)
+            return std::optional<uint32_t>();
+        if (!inner_map_fd.has_value())
+            inner_map_fd = map->inner_map_fd;
+        else if (map->type != *inner_map_fd)
+            return std::optional<uint32_t>();
+    }
+    return inner_map_fd;
+}
+
+// We can deal with a range of value sizes.
+interval_t region_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
+    int start_fd, end_fd;
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+        return interval_t::top();
+
+    interval_t result = crab::interval_t::bottom();
+    for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
+            result = result | crab::interval_t(number_t(map->value_size));
+        else
+            return interval_t::top();
+    }
+    return result;
+}
+
+void region_domain_t::do_load_mapfd(const register_t& dst_reg, int mapfd, location_t loc) {
+    auto reg_with_loc = reg_with_loc_t(dst_reg, loc);
+    const auto& platform = global_program_info->platform;
+    const EbpfMapDescriptor& desc = platform->get_map_descriptor(mapfd);
     const EbpfMapValueType& map_value_type = platform->get_map_type(desc.type).value_type;
-    map_key_size_t map_key_size = desc.key_size;
-    map_value_size_t map_value_size = desc.value_size;
-    auto type = mapfd_t(u.mapfd, map_value_type, map_key_size, map_value_size);
-    m_registers.insert(reg, reg_with_loc, type);
+    auto mapfd_interval = interval_t{number_t{mapfd}};
+    auto type = mapfd_t(mapfd_interval, map_value_type);
+    m_registers.insert(dst_reg, reg_with_loc, type);
+}
+
+void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+    do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
 }
 
-void region_domain_t::operator()(const Call &u, location_t loc, int print) {
+void region_domain_t::operator()(const Call& u, location_t loc, int print) {
     std::optional<Reg> maybe_fd_reg{};
     for (ArgSingle param : u.singles) {
         if (param.kind == ArgSingle::Kind::MAP_FD) maybe_fd_reg = param.reg;
@@ -451,38 +543,34 @@ void region_domain_t::operator()(const Call &u, location_t loc, int print) {
     register_t r0_reg{R0_RETURN_VALUE};
     auto r0 = reg_with_loc_t(r0_reg, loc);
     if (u.is_map_lookup) {
-        if (!maybe_fd_reg) {
-            m_registers -= r0_reg;
-            return;
-        }
-        auto ptr_or_mapfd = m_registers.find(maybe_fd_reg->v);
-        if (!ptr_or_mapfd || !std::holds_alternative<mapfd_t>(ptr_or_mapfd.value())) {
-            m_registers -= r0_reg;
-            return;
-        }
-        auto mapfd = std::get<mapfd_t>(ptr_or_mapfd.value());
-        auto platform = global_program_info->platform;
-        auto map_desc = platform->get_map_descriptor(mapfd.get_mapfd());
-        if (mapfd.get_value_type() == EbpfMapValueType::MAP) {
-            const EbpfMapDescriptor& inner_map_desc = platform->
-                get_map_descriptor(map_desc.inner_map_fd);
-            const EbpfMapValueType& inner_map_value_type = platform->
-                get_map_type(inner_map_desc.type).value_type;
-            map_key_size_t inner_map_key_size = inner_map_desc.key_size;
-            map_value_size_t inner_map_value_size = inner_map_desc.value_size;
-            auto type = mapfd_t(map_desc.inner_map_fd, inner_map_value_type,
-                    inner_map_key_size, inner_map_value_size);
-            m_registers.insert(r0_reg, r0, type);
+        if (maybe_fd_reg) {
+            if (auto map_type = get_map_type(*maybe_fd_reg)) {
+                if (global_program_info->platform->get_map_type(*map_type).value_type
+                        == EbpfMapValueType::MAP) {
+                    if (auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
+                        do_load_mapfd(r0_reg, (int)*inner_map_fd, loc);
+                        goto out;
+                    }
+                } else {
+                    auto type = ptr_with_off_t(crab::region_t::T_SHARED, interval_t{number_t{0}},
+                            get_map_value_size(*maybe_fd_reg));
+                    m_registers.insert(r0_reg, r0, type);
+                }
+            }
         }
         else {
-            auto type = ptr_with_off_t(crab::region_t::T_SHARED, interval_t{number_t{0}},
-                    interval_t{mapfd.get_value_size()});
+            auto type = ptr_with_off_t(
+                 crab::region_t::T_SHARED, interval_t{number_t{0}}, crab::interval_t::top());
             m_registers.insert(r0_reg, r0, type);
         }
     }
     else {
         m_registers -= r0_reg;
     }
+out:
+    if (u.reallocate_packet) {
+        // forget packet pointers
+    }
 }
 
 void region_domain_t::operator()(const Callx &u, location_t loc, int print) {
@@ -637,7 +725,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
                 || s.types == TypeGroup::mem_or_num)
             return;
     }
-    //std::cout << "type error: type constraint assert fail: " << s << "\n";
+    //std::cout << "type error: type constraint assert fail\n";
     m_errors.push_back("type constraint assert fail");
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 8bcefa56d..e4a4d44c8 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -162,6 +162,11 @@ class region_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
+    interval_t get_map_value_size(const Reg&) const;
+    bool get_map_fd_range(const Reg&, int32_t*, int32_t*) const;
+    std::optional<uint32_t> get_map_type(const Reg&) const;
+    std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
+    void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const Reg&, bool, location_t);
     void do_mem_store(const Mem&, const Reg&, location_t);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 73f1806be..d5d80813f 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -199,18 +199,10 @@ void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
 
-    int width;
     auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
     auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
         if (is_mapfd_type(maybe_mapfd)) {
-            auto mapfd_type = std::get<mapfd_t>(*maybe_mapfd);
-            if (u.key) {
-                width = (int)mapfd_type.get_key_size();
-            }
-            else {
-                width = (int)mapfd_type.get_value_size();
-            }
             auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
@@ -234,6 +226,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
                 // We do not check packet ptr accesses yet
                 return;
             }
+            m_errors.push_back("Only stack or packet can be used as a parameter");
         }
     }
     //std::cout << "type error: valid map key value assertion failed\n";

From 31fbb94384d909bd37723d9c7e941125dafb65ff Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 16 Jul 2023 02:20:53 -0400
Subject: [PATCH 107/373] Support for packet pointer invalidate

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 11 ++++++++++-
 src/crab/region_domain.hpp |  1 +
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 426b13495..a938d552b 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -37,6 +37,15 @@ std::optional<ptr_no_off_t> ctx_t::find(uint64_t key) const {
     return it->second;
 }
 
+void register_types_t::forget_packet_ptrs() {
+    for (auto r = register_t{0}; r <= register_t{10}; ++r) {
+        auto reg = find(r);
+        if (is_packet_ptr(reg)) {
+            operator-=(r);
+        }
+    }
+}
+
 register_types_t register_types_t::operator|(const register_types_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -569,7 +578,7 @@ void region_domain_t::operator()(const Call& u, location_t loc, int print) {
     }
 out:
     if (u.reallocate_packet) {
-        // forget packet pointers
+        m_registers.forget_packet_ptrs();
     }
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index e4a4d44c8..0a4759e03 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -83,6 +83,7 @@ class register_types_t {
     std::optional<ptr_or_mapfd_t> find(reg_with_loc_t reg) const;
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
     [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
+    void forget_packet_ptrs();
     void adjust_bb_for_registers(location_t loc);
     void print_all_register_types() const;
 };

From b77c3c1e56a562860dbb93f693324f15fdc93a02 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 16 Jul 2023 02:37:15 -0400
Subject: [PATCH 108/373] Fix undefined reference error for a function

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp  | 2 +-
 src/crab/type_ostream.cpp | 2 +-
 src/crab/type_ostream.hpp | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index d5d80813f..66029dfec 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -318,7 +318,7 @@ void type_domain_t::print_registers() const {
         auto maybe_ptr_or_mapfd_type = m_region.find_ptr_or_mapfd_type(reg);
         if (maybe_ptr_or_mapfd_type) {
             std::cout << "    ";
-            print_register(Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type);
+            print_register(std::cout, Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type);
             std::cout << "\n";
         }
     }
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 47c7e2001..041b4ca93 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -21,7 +21,7 @@ void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or
     }
 }
 
-void print_register(std::ostream& o, Reg r, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << r << " : ";
     if (p) {
         print_ptr_or_mapfd_type(o, p.value());
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 6761d9724..11e7e2303 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -10,7 +10,7 @@
 
 void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&);
 void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr);
-void print_register(Reg r, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);

From 8955fe6e3dbdfd2d11a58aace156047023b774b1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 30 Jun 2023 12:58:22 -0400
Subject: [PATCH 109/373] using mock_interval_t instead of interval_t

Changed from using interval_t to mock_interval_t due to issues with storing intervals directly, as the default constructor is by default private;
Made the default constructor for interval_t private, as it is in main PREVAIL
Refactoring needed for changes added;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp        | 22 +++++++++++++------
 src/crab/common.hpp        | 45 +++++++++++++++++++++++++++-----------
 src/crab/interval.hpp      |  4 ++--
 src/crab/region_domain.cpp | 23 +++++++++++--------
 src/crab/type_domain.cpp   |  4 ++--
 5 files changed, 65 insertions(+), 33 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index f27047e92..afd8000c0 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -19,6 +19,10 @@ namespace std {
 
 namespace crab {
 
+bool mock_interval_t::operator==(const mock_interval_t& other) const {
+    return (to_interval() == other.to_interval());
+}
+
 bool ptr_with_off_t::operator==(const ptr_with_off_t& other) const {
     return (m_r == other.m_r && m_offset == other.m_offset
             && m_region_size == other.m_region_size);
@@ -42,19 +46,23 @@ bool mapfd_t::operator==(const mapfd_t& other) const {
 
 mapfd_t mapfd_t::operator|(const mapfd_t& other) const {
     auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
-    return mapfd_t(m_mapfd | other.m_mapfd, value_type);
+    const auto& mock_i = mock_interval_t(m_mapfd.to_interval() | other.m_mapfd.to_interval());
+    return mapfd_t(std::move(mock_i), value_type);
 }
 
-interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
+mock_interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
 
-void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
+void ptr_with_off_t::set_offset(mock_interval_t off) { m_offset = off; }
 
-void ptr_with_off_t::set_region_size(interval_t region_sz) { m_region_size = region_sz; }
+void ptr_with_off_t::set_region_size(mock_interval_t region_sz) { m_region_size = region_sz; }
 
 void ptr_with_off_t::set_region(region_t r) { m_r = r; }
 
 ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
-    return ptr_with_off_t(m_r, m_offset | other.m_offset, m_region_size | other.m_region_size);
+    const auto& mock_o = mock_interval_t(m_offset.to_interval() | other.m_offset.to_interval());
+    const auto& mock_r_s = mock_interval_t(
+            m_region_size.to_interval() | other.m_region_size.to_interval());
+    return ptr_with_off_t(m_r, std::move(mock_o), std::move(mock_r_s));
 }
 
 void ptr_no_off_t::set_region(region_t r) { m_r = r; }
@@ -116,8 +124,8 @@ inline std::string get_reg_ptr(const region_t& r) {
 }
 
 void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r) << "<" << m_offset;
-    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size;
+    o << get_reg_ptr(m_r) << "<" << m_offset.to_interval();
+    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size.to_interval();
     o << ">";
 }
 
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index e3a3d5524..e7f21acc2 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -46,10 +46,30 @@ class ptr_no_off_t {
     bool operator!=(const ptr_no_off_t&) const;
 };
 
+class mock_interval_t {
+    bound_t _lb;
+    bound_t _ub;
+
+    public:
+        static mock_interval_t top() {
+            return mock_interval_t(bound_t::minus_infinity(), bound_t::plus_infinity());
+        }
+        [[nodiscard]] bound_t lb() const { return _lb; }
+        [[nodiscard]] bound_t ub() const { return _ub; }
+        mock_interval_t(bound_t lb, bound_t ub) : _lb(lb), _ub(ub) {};
+        mock_interval_t() : _lb(bound_t::minus_infinity()), _ub(bound_t::plus_infinity()) {}
+        mock_interval_t(const mock_interval_t& c) = default;
+        mock_interval_t(const bound_t& b) : _lb(b), _ub(b) {}
+        mock_interval_t& operator=(const mock_interval_t& o) = default;
+        bool operator==(const mock_interval_t& o) const;
+        mock_interval_t(const interval_t& i) : _lb(i.lb()), _ub(i.ub()) {}
+        interval_t to_interval() const { return std::move(interval_t(_lb, _ub)); }
+};
+
 class ptr_with_off_t {
     region_t m_r;
-    interval_t m_offset;
-    interval_t m_region_size = interval_t::top();
+    mock_interval_t m_offset;
+    mock_interval_t m_region_size = mock_interval_t::top();
 
   public:
     ptr_with_off_t() = default;
@@ -57,14 +77,15 @@ class ptr_with_off_t {
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region_t _r, interval_t _off, interval_t _region_sz)
+    ptr_with_off_t(region_t _r, mock_interval_t _off,
+            mock_interval_t _region_sz = mock_interval_t::top())
         : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
-    ptr_with_off_t(region_t _r, interval_t _off) : m_r(_r), m_offset(_off) {}
+    ptr_with_off_t(region_t _r, mock_interval_t _off) : m_r(_r), m_offset(_off) {}
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
-    interval_t get_region_size() const;
-    void set_region_size(interval_t);
-    [[nodiscard]] interval_t get_offset() const { return m_offset; }
-    void set_offset(interval_t);
+    mock_interval_t get_region_size() const;
+    void set_region_size(mock_interval_t);
+    [[nodiscard]] mock_interval_t get_offset() const { return m_offset; }
+    void set_offset(mock_interval_t);
     [[nodiscard]] region_t get_region() const { return m_r; }
     void set_region(region_t);
     void write(std::ostream&) const;
@@ -74,7 +95,7 @@ class ptr_with_off_t {
 };
 
 class mapfd_t {
-    interval_t m_mapfd;
+    mock_interval_t m_mapfd;
     EbpfMapValueType m_value_type;
 
   public:
@@ -83,7 +104,7 @@ class mapfd_t {
     mapfd_t &operator=(const mapfd_t&) = default;
     mapfd_t &operator=(mapfd_t&&) = default;
     mapfd_t operator|(const mapfd_t&) const;
-    mapfd_t(interval_t mapfd, EbpfMapValueType val_type)
+    mapfd_t(mock_interval_t mapfd, EbpfMapValueType val_type)
         : m_mapfd(mapfd), m_value_type(val_type) {}
     friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
     bool operator==(const mapfd_t&) const;
@@ -92,7 +113,7 @@ class mapfd_t {
 
     bool has_type_map_programs() const;
     [[nodiscard]] EbpfMapValueType get_value_type() const { return m_value_type; }
-    [[nodiscard]] interval_t get_mapfd() const { return m_mapfd; }
+    [[nodiscard]] mock_interval_t get_mapfd() const { return m_mapfd; }
 };
 
 using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
@@ -150,7 +171,6 @@ inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
     return o;
 }
 
-
 } // namespace crab
 
 
@@ -191,4 +211,3 @@ namespace std {
 
     //crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t);
 }
-
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 972f4f8bf..47878de00 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -232,8 +232,6 @@ class interval_t final {
     bound_t _ub;
 
   public:
-    interval_t() : _lb(number_t{0}), _ub(-1) {}
-
     static interval_t top() { return interval_t(bound_t::minus_infinity(), bound_t::plus_infinity()); }
 
     static interval_t bottom() { return interval_t(); }
@@ -241,6 +239,8 @@ class interval_t final {
     [[nodiscard]] std::optional<number_t> finite_size() const { return (_ub - _lb).number(); }
 
   private:
+    interval_t() : _lb(number_t{0}), _ub(-1) {}
+
     static number_t abs(const number_t& x) { return x < 0 ? -x : x; }
 
     static number_t max(const number_t& x, const number_t& y) { return x.operator<=(y) ? y : x; }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index a938d552b..8c9a2fd4a 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -462,7 +462,7 @@ bool region_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd,
     auto maybe_type = m_registers.find(map_fd_reg.v);
     if (!is_mapfd_type(maybe_type)) return false;
     auto mapfd_type = std::get<mapfd_t>(*maybe_type);
-    const interval_t& mapfd_interval = mapfd_type.get_mapfd();
+    const auto& mapfd_interval = mapfd_type.get_mapfd().to_interval();
     auto lb = mapfd_interval.lb().number();
     auto ub = mapfd_interval.ub().number();
     if (!lb || !lb->fits_sint32() || !ub || !ub->fits_sint32())
@@ -621,7 +621,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print
         if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
             auto reg_with_off_ptr_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
             auto offset = reg_with_off_ptr_type.get_offset();
-            auto offset_to_check = offset+interval_t{s.offset};
+            auto offset_to_check = offset.to_interval()+interval_t{s.offset};
             auto offset_lb = offset_to_check.lb();
             auto offset_plus_width_ub = offset_to_check.ub()+crab::bound_t{width};
             if (reg_with_off_ptr_type.get_region() == crab::region_t::T_STACK) {
@@ -678,9 +678,12 @@ region_domain_t&& region_domain_t::setup_entry() {
     auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
     auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
 
-    typ.insert(R1_ARG, r1, ptr_with_off_t(crab::region_t::T_CTX, interval_t{number_t{0}}));
+    typ.insert(R1_ARG, r1,
+            ptr_with_off_t(crab::region_t::T_CTX,
+                mock_interval_t{number_t{0}}, mock_interval_t{number_t{-1}}));
     typ.insert(R10_STACK_POINTER, r10,
-            ptr_with_off_t(crab::region_t::T_STACK, interval_t{number_t{512}}));
+            ptr_with_off_t(crab::region_t::T_STACK,
+                mock_interval_t{number_t{512}}, mock_interval_t{number_t{-1}}));
 
     static region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
     return std::move(inv);
@@ -743,7 +746,8 @@ void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const i
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
         auto offset = ptr_or_mapfd_with_off.get_offset();
-        auto updated_offset = change == interval_t::top() ? offset : offset + change;
+        auto updated_offset =
+            change == mock_interval_t::top() ? offset : offset.to_interval() + change;
         ptr_or_mapfd_with_off.set_offset(updated_offset);
         m_registers.insert(reg, reg_with_loc, ptr_or_mapfd_with_off);
     }
@@ -772,7 +776,7 @@ interval_t region_domain_t::do_bin(const Bin& bin,
         return interval_t::bottom();
 
     ptr_or_mapfd_t src_ptr_or_mapfd, dst_ptr_or_mapfd;
-    interval_t src_interval;
+    interval_t src_interval = interval_t::bottom();
     if (src_ptr_or_mapfd_opt) src_ptr_or_mapfd = std::move(src_ptr_or_mapfd_opt.value());
     if (dst_ptr_or_mapfd_opt) dst_ptr_or_mapfd = std::move(dst_ptr_or_mapfd_opt.value());
     if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
@@ -836,7 +840,8 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                             std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
                         auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
                         auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
-                        to_return = dst_ptr_with_off.get_offset() - src_ptr_with_off.get_offset();
+                        to_return =
+                            dst_ptr_with_off.get_offset().to_interval() - src_ptr_with_off.get_offset().to_interval();
                     }
                 }
                 else {
@@ -880,7 +885,7 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
 
     auto type_with_off = std::get<ptr_with_off_t>(*ptr_or_mapfd_opt);
     auto p_offset = type_with_off.get_offset();
-    auto offset_singleton = p_offset.singleton();
+    auto offset_singleton = p_offset.to_interval().singleton();
 
     if (is_stack_p) {
         if (!offset_singleton) {
@@ -982,7 +987,7 @@ void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location
 
     // if the code reaches here, we are storing into a stack pointer
     auto basereg_type_with_off = std::get<ptr_with_off_t>(basereg_type);
-    auto offset_singleton = basereg_type_with_off.get_offset().singleton();
+    auto offset_singleton = basereg_type_with_off.get_offset().to_interval().singleton();
     if (!offset_singleton) {
         //std::cout << "type error: storing to a pointer with unknown offset\n";
         m_errors.push_back("storing to a pointer with unknown offset");
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 66029dfec..bdb5d2e64 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -122,7 +122,7 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
                 if (ptr_with_off.get_region() == region_t::T_STACK) {
-                    auto offset_singleton = ptr_with_off.get_offset().singleton();
+                    auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
                     if (!offset_singleton) {
                         //std::cout << "type error: storing at an unknown offset in stack\n";
                         m_errors.push_back("storing at an unknown offset in stack");
@@ -207,7 +207,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
                 if (ptr_with_off.get_region() == region_t::T_STACK) {
-                    auto offset_singleton = ptr_with_off.get_offset().singleton();
+                    auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
                     if (!offset_singleton) {
                         //std::cout << "type error: reading the stack at an unknown offset\n";
                         m_errors.push_back("reading the stack at an unknown offset");

From 79623c27bb8f4b134ed4a2b362a43a05092570a2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 20 Jul 2023 14:51:34 -0400
Subject: [PATCH 110/373] Fix Comparable check according to how PREVAIL does

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index bdb5d2e64..379c9700c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -175,10 +175,12 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         // an extra check just to make sure registers are not labelled both ptrs and numbers
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
-        if (same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
+        if (!is_shared_ptr(maybe_ptr_or_mapfd1)
+                && same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
     }
-    else if (!maybe_ptr_or_mapfd1 && !maybe_ptr_or_mapfd2) {
-        // all other cases when we do not have a ptr or mapfd, the type is a number
+    else if (!maybe_ptr_or_mapfd2) {
+        // two numbers can be compared
+        // if r1 is a pointer, r2 must be a number
         return;
     }
     //std::cout << "type error: Non-comparable types\n";
@@ -363,7 +365,7 @@ void type_domain_t::adjust_bb_for_types(location_t loc) {
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
 
     if (print != 0) {
-        print_annotated(std::cout, *this, bb, print);
+        //print_annotated(std::cout, *this, bb, print);
         return;
     }
 

From 1dd59368e686d9f37a69add2df4c584b706f3d42 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 20 Jul 2023 15:22:08 -0400
Subject: [PATCH 111/373] A fix in memory store

A case was missing where a constant number is stored. Although it does not actually store anything in the region domain, we still need to forget overlapping cells

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 12 ++++++++----
 src/crab/region_domain.hpp |  2 +-
 src/crab/type_domain.cpp   | 35 ++++++++++++++++-------------------
 src/crab/type_domain.hpp   |  2 +-
 4 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 8c9a2fd4a..5f27c350a 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -955,15 +955,19 @@ void region_domain_t::operator()(const Mem& m, location_t loc, int print) {
     // nothing to do here
 }
 
-void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc) {
+void region_domain_t::do_mem_store(const Mem& b, location_t loc) {
 
+    std::optional<ptr_or_mapfd_t> targetreg_type = {};
+    bool target_is_reg = std::holds_alternative<Reg>(b.value);
+    if (target_is_reg) {
+        auto target_reg = std::get<Reg>(b.value);
+        targetreg_type = m_registers.find(target_reg.v);
+    }
     int offset = b.access.offset;
     Reg basereg = b.access.basereg;
     int width = b.access.width;
 
     auto maybe_basereg_type = m_registers.find(basereg.v);
-    auto basereg_type = maybe_basereg_type.value();
-    auto targetreg_type = m_registers.find(target_reg.v);
 
     bool is_ctx_p = is_ctx_ptr(maybe_basereg_type);
     bool is_shared_p = is_shared_ptr(maybe_basereg_type);
@@ -986,7 +990,7 @@ void region_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location
     }
 
     // if the code reaches here, we are storing into a stack pointer
-    auto basereg_type_with_off = std::get<ptr_with_off_t>(basereg_type);
+    auto basereg_type_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
     auto offset_singleton = basereg_type_with_off.get_offset().to_interval().singleton();
     if (!offset_singleton) {
         //std::cout << "type error: storing to a pointer with unknown offset\n";
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 0a4759e03..bde61cf82 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -169,7 +169,7 @@ class region_domain_t final {
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const Reg&, bool, location_t);
-    void do_mem_store(const Mem&, const Reg&, location_t);
+    void do_mem_store(const Mem&, location_t);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&, location_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 379c9700c..7dda3895b 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -284,29 +284,26 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_pt
     m_region.do_load(b, target_reg, unknown_ptr, loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, const Reg& target_reg, location_t loc, int print) {
-    m_region.do_mem_store(b, target_reg, loc);
+void type_domain_t::do_mem_store(const Mem& b, location_t loc, int print) {
+    m_region.do_mem_store(b, loc);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
-    if (std::holds_alternative<Reg>(b.value)) {
+    auto basereg = b.access.basereg;
+    auto ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
+    bool unknown_ptr = !ptr_or_mapfd_opt.has_value();
+    if (unknown_ptr) {
+        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
+        m_errors.push_back(
+                std::string("load/store using an unknown pointer, or number - r") + s);
+    }
+    if (!unknown_ptr && !b.is_load) {
+        do_mem_store(b, loc, print);
+    }
+    else if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
-        auto basereg = b.access.basereg;
-        auto ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
-        bool unknown_ptr = !ptr_or_mapfd_opt.has_value();
-        if (unknown_ptr) {
-            std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-            m_errors.push_back(
-                    std::string("load/store using an unknown pointer, or number - r") + s);
-        }
-
-        if (b.is_load) {
-            do_load(b, targetreg, unknown_ptr, loc, print);
-        } else if (!unknown_ptr) {
-            do_mem_store(b, targetreg, loc, print);
-        }
+        if (b.is_load) do_load(b, targetreg, unknown_ptr, loc, print);
     }
-    else {}
 }
 
 // the method does not work well as it requires info about the label of basic block we are in
@@ -365,7 +362,7 @@ void type_domain_t::adjust_bb_for_types(location_t loc) {
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
 
     if (print != 0) {
-        //print_annotated(std::cout, *this, bb, print);
+        print_annotated(std::cout, *this, bb, print);
         return;
     }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index d27c29f80..864b14be5 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -87,7 +87,7 @@ class type_domain_t final {
   private:
 
     void do_load(const Mem&, const Reg&, bool, location_t, int print = 0);
-    void do_mem_store(const Mem&, const Reg&, location_t, int print = 0);
+    void do_mem_store(const Mem&, location_t, int print = 0);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);

From 25ccc59089bcc3df086281d5ecf34fbcad9c7dc1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 21 Jul 2023 01:09:04 -0400
Subject: [PATCH 112/373] Add initial structure for Comparable

Many checks have not been implemented because either those require other domains not yet implemented, or require storing values for pointers

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp |  4 ++++
 src/crab/region_domain.hpp |  1 +
 src/crab/type_domain.cpp   | 23 +++++++++++++++++++++--
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 5f27c350a..330b126d3 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -321,6 +321,10 @@ std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_at_loc(const re
     return m_registers.find(reg);
 }
 
+void region_domain_t::set_registers_to_top() {
+    m_registers.set_to_top();
+}
+
 size_t region_domain_t::ctx_size() const {
     return m_ctx->get_size();
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index bde61cf82..86df05ebf 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -183,6 +183,7 @@ class region_domain_t final {
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
+    void set_registers_to_top();
     void adjust_bb_for_types(location_t);
     void print_all_register_types() const;
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7dda3895b..ac33c70df 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -148,8 +148,27 @@ void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_region(u, loc);
 }
 
-void type_domain_t::operator()(const Assume& u, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
+    Condition cond = s.cond;
+    auto right = cond.right;
+    const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
+    if (std::holds_alternative<Reg>(right)) {
+        const auto& right_reg = std::get<Reg>(right);
+        const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
+        if (maybe_left_type && maybe_right_type) {
+            // both pointers
+        }
+        else if (!maybe_left_type && !maybe_right_type) {
+            // both numbers
+        }
+        else {
+            // We should only reach here if `--assume-assert` is off
+            assert(!thread_local_options.assume_assertions || is_bottom());
+            // be sound in any case, it happens to flush out bugs:
+            m_region.set_registers_to_top();
+        }
+    }
+    else {}
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {

From de89bc6bf872c6ccbbc6cd825d1edfe2830be8f7 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 16 Aug 2023 00:19:56 -0400
Subject: [PATCH 113/373] Refactoring, and some required fixes

Removing redundant code related to printing not being used;
Fixing error reporting;
Some extra checks needed as interval domain has not been added yet;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 27 +++++++++++----------------
 src/crab/region_domain.hpp |  2 +-
 2 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 330b126d3..d3aefd20d 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -127,16 +127,6 @@ void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
-void register_types_t::print_all_register_types() const {
-    std::cout << "\tregion types: {\n";
-    for (auto const& kv : *m_region_env) {
-        std::cout << "\t\t" << kv.first << " : ";
-        print_ptr_or_mapfd_type(std::cout, kv.second);
-        std::cout << "\n";
-    }
-    std::cout << "\t}\n";
-}
-
 std::optional<ptr_or_mapfd_t> register_types_t::find(reg_with_loc_t reg) const {
     auto it = m_region_env->find(reg);
     if (it == m_region_env->end()) return {};
@@ -737,8 +727,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
     else {
         // if we don't know the type, we assume it is a number
         if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
-                || s.types == TypeGroup::non_map_fd || s.types == TypeGroup::ptr_or_num
-                || s.types == TypeGroup::mem_or_num)
+                || s.types == TypeGroup::non_map_fd || s.types == TypeGroup::mem_or_num)
             return;
     }
     //std::cout << "type error: type constraint assert fail\n";
@@ -827,6 +816,16 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                 update_ptr_or_mapfd(std::move(src_ptr_or_mapfd), interval_t::top(),
                         reg, bin.dst.v);
             }
+            else if (dst_ptr_or_mapfd_opt && !src_ptr_or_mapfd_opt) {
+                if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd)) {
+                    auto updated_type = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
+                    updated_type.set_offset(mock_interval_t::top());
+                    m_registers.insert(bin.dst.v, reg, updated_type);
+                }
+                else if (std::holds_alternative<ptr_no_off_t>(dst_ptr_or_mapfd)) {
+                    m_registers.insert(bin.dst.v, reg, dst_ptr_or_mapfd);
+                }
+            }
             break;
         }
         // ra -= b, where ra is a pointer/mapfd
@@ -1014,8 +1013,4 @@ void region_domain_t::adjust_bb_for_types(location_t loc) {
     m_registers.adjust_bb_for_registers(loc);
 }
 
-void region_domain_t::print_all_register_types() const {
-    m_registers.print_all_register_types();
-}
-
 } // namespace crab
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 86df05ebf..bdebaa29b 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -85,7 +85,6 @@ class register_types_t {
     [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
     void forget_packet_ptrs();
     void adjust_bb_for_registers(location_t loc);
-    void print_all_register_types() const;
 };
 
 class region_domain_t final {
@@ -187,6 +186,7 @@ class region_domain_t final {
     void adjust_bb_for_types(location_t);
     void print_all_register_types() const;
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+    void reset_errors() { m_errors.clear(); }
 }; // end region_domain_t
 
 } // namespace crab

From 971e046928c1941903737c947c0dc382ddca080b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 18 Aug 2023 02:14:11 -0400
Subject: [PATCH 114/373] Added support for computing width in ValidMapKeyValue

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 16 ++++++++++++++++
 src/crab/region_domain.hpp |  1 +
 src/crab/type_domain.cpp   | 19 +++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index d3aefd20d..d04381483 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -507,6 +507,22 @@ std::optional<uint32_t> region_domain_t::get_map_inner_map_fd(const Reg& map_fd_
     return inner_map_fd;
 }
 
+// We can deal with a range of key sizes.
+interval_t region_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
+    int start_fd, end_fd;
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+        return interval_t::top();
+
+    interval_t result = interval_t::bottom();
+    for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
+            result = result | interval_t(number_t(map->key_size));
+        else
+            return interval_t::top();
+    }
+    return result;
+}
+
 // We can deal with a range of value sizes.
 interval_t region_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index bdebaa29b..2b74607b1 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -164,6 +164,7 @@ class region_domain_t final {
 
     interval_t get_map_value_size(const Reg&) const;
     bool get_map_fd_range(const Reg&, int32_t*, int32_t*) const;
+    interval_t get_map_key_size(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void do_load_mapfd(const register_t&, int, location_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index ac33c70df..acf5eb0ad 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -220,6 +220,25 @@ void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
 
+    // TODO: move map-related function to common
+    //auto fd_type = m_region.get_map_type(u.map_fd_reg);
+
+    int width;
+    if (u.key) {
+        auto key_size = m_region.get_map_key_size(u.map_fd_reg).singleton();
+        if (!key_size.has_value()) {
+            m_errors.push_back("Map key size is not singleton");
+            return;
+        }
+        width = (int)key_size.value();
+    } else {
+        auto value_size = m_region.get_map_value_size(u.map_fd_reg).singleton();
+        if (!value_size.has_value()) {
+            m_errors.push_back("Map value size is not singleton");
+            return;
+        }
+        width = (int)value_size.value();
+    }
     auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
     auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {

From 74d5aa14d9cf78f135b0d469a27dfb82802d99fe Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 21 Jul 2023 01:09:04 -0400
Subject: [PATCH 115/373] Initial implementation for offset domain

Added all abstract transformers, including Bin, Mem, Assume, Assert;
Added join implementation;
Support for all types of packet pointers, including meta pointers;
Printing offsets of types from Type Domain
---
 src/config.hpp               |   2 +-
 src/crab/abstract_domain.cpp |   2 +
 src/crab/offset_domain.cpp   | 718 +++++++++++++++++++++++++++++++++++
 src/crab/offset_domain.hpp   | 235 ++++++++++++
 src/crab/type_domain.cpp     |  46 ++-
 src/crab/type_domain.hpp     |  12 +-
 src/crab_verifier.cpp        |   1 +
 7 files changed, 997 insertions(+), 19 deletions(-)
 create mode 100644 src/crab/offset_domain.cpp
 create mode 100644 src/crab/offset_domain.hpp

diff --git a/src/config.hpp b/src/config.hpp
index e0da39ee2..c425d8019 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN, REGION_DOMAIN };
+enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN };
 
 struct ebpf_verifier_options_t {
     bool check_termination;
diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index c5d18f8e2..392a130f0 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -2,6 +2,7 @@
 #include "ebpf_domain.hpp"
 #include "type_domain.hpp"
 #include "region_domain.hpp"
+#include "offset_domain.hpp"
 
 template <typename Domain>
 abstract_domain_t::abstract_domain_model<Domain>::abstract_domain_model(Domain abs_val)
@@ -294,3 +295,4 @@ std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
 template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::type_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::region_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::offset_domain_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
new file mode 100644
index 000000000..5b11590b0
--- /dev/null
+++ b/src/crab/offset_domain.cpp
@@ -0,0 +1,718 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/offset_domain.hpp"
+
+namespace crab {
+
+bool dist_t::operator==(const dist_t& d) const {
+    return (m_dist == d.m_dist && m_slack == d.m_slack);
+}
+
+void dist_t::write(std::ostream& o) const {
+    if (m_slack != -1)
+        o << "s" << m_slack << "+";
+    if (m_dist >= 0)
+        o << "begin+" << m_dist;
+    else if (m_dist >= -4098)
+        o << "meta";
+    else
+        o << "end-" << (-1)*m_dist-4099;
+}
+
+std::ostream& operator<<(std::ostream& o, const dist_t& d) {
+    d.write(o);
+    return o;
+}
+
+void registers_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const dist_t& dist) {
+    (*m_offset_env)[reg_with_loc] = dist;
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<dist_t> registers_state_t::find(reg_with_loc_t reg) const {
+    auto it = m_offset_env->find(reg);
+    if (it == m_offset_env->end()) return {};
+    return it->second;
+}
+
+std::optional<dist_t> registers_state_t::find(register_t key) const {
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    return find(reg);
+}
+
+void registers_state_t::set_to_top() {
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+void registers_state_t::set_to_bottom() {
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = true;
+}
+
+bool registers_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    if (m_offset_env == nullptr) return true;
+    for (auto &it : m_cur_def) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+bool registers_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+void registers_state_t::operator-=(register_t to_forget) {
+    if (is_bottom()) {
+        return;
+    }
+    m_cur_def[to_forget] = nullptr;
+}
+
+registers_state_t registers_state_t::operator|(const registers_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    live_registers_t out_vars;
+    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2) {
+            dist_t dist1 = it1.value(), dist2 = it2.value();
+            auto reg = reg_with_loc_t((register_t)i, loc);
+            if (dist1 == dist2) {
+                out_vars[i] = m_cur_def[i];
+            }
+        }
+    }
+    return registers_state_t(std::move(out_vars), m_offset_env, false);
+}
+
+void registers_state_t::adjust_bb_for_registers(location_t loc) {
+    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        auto new_reg = reg_with_loc_t((register_t)i, loc);
+        auto it = find((register_t)i);
+        if (!it) continue;
+        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
+        (*m_offset_env)[new_reg] = it.value();
+
+        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
+        if (*m_cur_def[i] == old_reg)
+            m_offset_env->erase(old_reg);
+    }
+}
+
+void stack_state_t::set_to_top() {
+    m_slot_dists.clear();
+    m_is_bottom = false;
+}
+
+void stack_state_t::set_to_bottom() {
+    m_slot_dists.clear();
+    m_is_bottom = true;
+}
+
+bool stack_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    return m_slot_dists.empty();
+}
+
+bool stack_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+stack_state_t stack_state_t::top() {
+    return stack_state_t(false);
+}
+
+std::optional<dist_t> stack_state_t::find(int key) const {
+    auto it = m_slot_dists.find(key);
+    if (it == m_slot_dists.end()) return {};
+    return it->second;
+}
+
+void stack_state_t::store(int key, dist_t d) {
+    m_slot_dists[key] = d;
+}
+
+void stack_state_t::operator-=(int to_erase) {
+    if (is_bottom()) {
+        return;
+    }
+    m_slot_dists.erase(to_erase);
+}
+
+stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    stack_slot_dists_t out_stack_dists;
+    for (auto const&kv: m_slot_dists) {
+        auto it = other.m_slot_dists.find(kv.first);
+        if (it != m_slot_dists.end() && kv.second == it->second)
+            out_stack_dists.insert(kv);
+    }
+    return stack_state_t(std::move(out_stack_dists), false);
+}
+
+void extra_constraints_t::set_to_top() {
+    add_equality(forward_and_backward_eq_t());
+    add_inequality(inequality_t());
+}
+
+void extra_constraints_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+bool extra_constraints_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_eq.m_forw.m_slack == -1 && m_ineq.m_slack == -1);
+}
+
+bool extra_constraints_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+void extra_constraints_t::add_equality(forward_and_backward_eq_t fabeq) {
+    m_eq = std::move(fabeq);
+}
+
+void extra_constraints_t::add_inequality(inequality_t ineq) {
+    m_ineq = std::move(ineq);
+}
+
+weight_t extra_constraints_t::get_limit() const {
+    return m_eq.m_forw.m_dist;
+}
+
+void extra_constraints_t::normalize() {
+    weight_t dist_forw = m_eq.m_forw.m_dist - m_eq.m_backw.m_dist - 4099;
+    weight_t dist_backw = -4099;
+    slack_var_t s = m_eq.m_forw.m_slack;
+    dist_forw += m_ineq.m_value;
+    weight_t ineq_val = 0;
+    rop_t ineq_rel = m_ineq.m_rel;
+
+    m_eq = forward_and_backward_eq_t(dist_t(dist_forw, s), dist_t(dist_backw));
+    m_ineq = inequality_t(s, ineq_rel, ineq_val);
+}
+
+extra_constraints_t extra_constraints_t::operator|(const extra_constraints_t& other) const {
+    //normalize();
+    //other.normalize();
+
+    weight_t dist1 = m_eq.m_forw.m_dist;
+    weight_t dist2 = other.m_eq.m_forw.m_dist;
+    slack_var_t s = m_eq.m_forw.m_slack;
+
+    dist_t f = dist_t(std::min(dist1, dist2), s);
+    dist_t b = dist_t(-4099);
+
+    forward_and_backward_eq_t out_eq(f, b);
+    inequality_t out_ineq(s, m_ineq.m_rel, 0);
+
+    return extra_constraints_t(std::move(out_eq), std::move(out_ineq), false);
+        // have to handle case for different slack vars
+}
+
+ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
+    if (desc->data != -1) {
+        m_dists[desc->data] = dist_t(0);
+    }
+    if (desc->end != -1) {
+        m_dists[desc->end] = dist_t(-4099);
+    }
+    if (desc->meta != -1) {
+        m_dists[desc->meta] = dist_t(-1);
+    }
+    m_size = desc->size;
+}
+
+int ctx_offsets_t::get_size() const {
+    return m_size;
+}
+
+std::optional<dist_t> ctx_offsets_t::find(int key) const {
+    auto it = m_dists.find(key);
+    if (it == m_dists.end()) return {};
+    return it->second;
+}
+
+offset_domain_t offset_domain_t::setup_entry() {
+    std::shared_ptr<ctx_offsets_t> ctx = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor);
+    std::shared_ptr<global_offset_env_t> all_types = std::make_shared<global_offset_env_t>();
+    registers_state_t regs(all_types);
+
+    offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
+    return off_d;
+}
+
+offset_domain_t offset_domain_t::bottom() {
+    offset_domain_t off;
+    off.set_to_bottom();
+    return off;
+}
+
+void offset_domain_t::set_to_top() {
+    m_reg_state.set_to_top();
+    m_stack_state.set_to_top();
+    m_extra_constraints.set_to_top();
+}
+
+void offset_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+bool offset_domain_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool offset_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_reg_state.is_top() && m_stack_state.is_top() && m_extra_constraints.is_top());
+}
+
+// inclusion
+bool offset_domain_t::operator<=(const offset_domain_t& other) const { return true; }
+
+// join
+void offset_domain_t::operator|=(const offset_domain_t& abs) {
+    offset_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void offset_domain_t::operator|=(offset_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return offset_domain_t(m_reg_state | other.m_reg_state, m_stack_state | other.m_stack_state, m_extra_constraints | other.m_extra_constraints, m_ctx_dists, std::max(m_slack, other.m_slack));
+}
+
+offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return offset_domain_t(m_reg_state | std::move(other.m_reg_state), m_stack_state | std::move(other.m_stack_state), m_extra_constraints | std::move(other.m_extra_constraints), m_ctx_dists, std::max(m_slack, other.m_slack));
+}
+
+// meet
+offset_domain_t offset_domain_t::operator&(const offset_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+// widening
+offset_domain_t offset_domain_t::widen(const offset_domain_t& other, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+// narrowing
+offset_domain_t offset_domain_t::narrow(const offset_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+//forget
+void offset_domain_t::operator-=(variable_t var) {}
+
+void offset_domain_t::write(std::ostream& os) const {}
+
+std::string offset_domain_t::domain_name() const {
+    return "offset_domain";
+}
+
+crab::bound_t offset_domain_t::get_loop_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
+}
+
+void offset_domain_t::initialize_loop_counter(const label_t& label) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+string_invariant offset_domain_t::to_set() { return string_invariant{}; }
+
+void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
+    Condition cond = b.cond;
+    if (cond.op == Condition::Op::LE) {
+        if (std::holds_alternative<Reg>(cond.right)) {
+            auto right_reg = std::get<Reg>(cond.right).v;
+            auto dist_left = m_reg_state.find(cond.left.v);
+            auto dist_right = m_reg_state.find(right_reg);
+            if (!dist_left && !dist_right) {
+                return;
+            }
+            else if (!dist_left || !dist_right) {
+                // this should not happen, comparison between a packet pointer and either
+                // other region's pointers or numbers; possibly raise type error
+                //exit(1);
+                std::cout << "type_error: one of the pointers being compared isn't packet pointer\n";
+                return;
+            }
+            dist_t left_reg_dist = dist_left.value();
+            dist_t right_reg_dist = dist_right.value();
+            slack_var_t s = m_slack++;
+            dist_t f = dist_t(left_reg_dist.m_dist, s);
+            dist_t b = dist_t(right_reg_dist.m_dist, slack_var_t{-1});
+            m_extra_constraints.add_equality(forward_and_backward_eq_t(f, b));
+            m_extra_constraints.add_inequality(inequality_t(s, rop_t::R_GE, 0));
+        }
+    }
+    else {}     //we do not need to deal with other cases
+}
+
+bool is_packet_pointer(std::optional<ptr_or_mapfd_t>& type) {
+    if (!type) {    // not a pointer
+        return false;
+    }
+    auto ptr_or_mapfd_type = type.value();
+    if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)
+        && std::get<ptr_no_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_PACKET) {
+        return true;
+    }
+    return false;
+}
+
+bool is_stack_pointer(std::optional<ptr_or_mapfd_t>& type) {
+    if (!type) {    // not a pointer
+        return false;
+    }
+    auto ptr_or_mapfd_type = type.value();
+    if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)
+        && std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_STACK) {
+        return true;
+    }
+    return false;
+}
+
+void offset_domain_t::do_bin(const Bin& bin, std::optional<int> src_const_value,
+        std::optional<ptr_or_mapfd_t> src_type, std::optional<ptr_or_mapfd_t> dst_type,
+        location_t loc) {
+    if (is_bottom()) return;
+
+    auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
+    if (std::holds_alternative<Reg>(bin.v)) {
+        Reg src = std::get<Reg>(bin.v);
+        switch (bin.op)
+        {
+            // ra = rb;
+            case Bin::Op::MOV: {
+                if (!is_packet_pointer(src_type)) {
+                    m_reg_state -= bin.dst.v;
+                    return;
+                }
+                auto it = m_reg_state.find(src.v);
+                if (!it) {
+                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                    //exit(1);
+                    return;
+                }
+                m_reg_state.insert(bin.dst.v, reg_with_loc, it.value());
+                //std::cout << "offset: " << (*m_reg_state.get(bin.dst.v)).m_dist << "\n";
+                break;
+            }
+            // ra += rb
+            case Bin::Op::ADD: {
+                if (!is_packet_pointer(dst_type)) {
+                    m_reg_state -= bin.dst.v;
+                    return;
+                }
+                auto it = m_reg_state.find(bin.dst.v);
+                if (!it) {
+                    std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
+                    //exit(1);
+                    return;
+                }
+                auto dst_dist = it.value();
+                if (src_const_value) {
+                    weight_t updated_dist;
+                    if (dst_dist.m_dist >= 0) {
+                        updated_dist = dst_dist.m_dist + src_const_value.value();
+                    }
+                    else if (dst_dist.m_dist >= -4098) {
+                        // TODO: special handling of meta pointer required
+                        updated_dist = dst_dist.m_dist - src_const_value.value();
+                    }
+                    else {
+                        updated_dist = dst_dist.m_dist - src_const_value.value();
+                    }
+                    m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t(updated_dist));
+                }
+                else {
+                    m_reg_state -= bin.dst.v;
+                }
+                break;
+            }
+
+            default: {
+                m_reg_state -= bin.dst.v;
+                break;
+            }
+        }
+    }
+    else {
+        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
+        auto it = m_reg_state.find(bin.dst.v);
+        switch (bin.op)
+        {
+            case Bin::Op::ADD: {
+                if (!is_packet_pointer(dst_type)) {
+                    m_reg_state -= bin.dst.v;
+                    return;
+                }
+                if (!it) {
+                    std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
+                    //exit(1);
+                    return;
+                }
+                auto dst_dist = it.value();
+
+                weight_t updated_dist;
+                if (dst_dist.m_dist >= 0) {
+                    updated_dist = dst_dist.m_dist + imm;
+                }
+                else if (dst_dist.m_dist >= -4098) {
+                    // TODO: special handling of meta pointer required
+                    updated_dist = dst_dist.m_dist - imm;
+                }
+                else {
+                    updated_dist = dst_dist.m_dist - imm;
+                }
+                m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t(updated_dist));
+                break;
+            }
+
+            default: {
+                m_reg_state -= bin.dst.v;
+                break;
+            }
+        }
+    }
+}
+
+void offset_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const Un& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
+    m_reg_state -= u.dst.v;
+}
+
+void offset_domain_t::operator()(const Call& u, location_t loc, int print) {
+    m_reg_state -= register_t{R0_RETURN_VALUE};
+}
+
+void offset_domain_t::operator()(const Exit& u, location_t loc, int print) {}
+
+void offset_domain_t::operator()(const Jmp& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const Packet& u, location_t loc, int print) {
+    m_reg_state -= register_t{R0_RETURN_VALUE};
+}
+
+void offset_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+    /* WARNING: This operation is not implemented yet. */
+}
+
+void offset_domain_t::operator()(const ValidAccess& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const Addable& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const TypeConstraint& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+    /* WARNING: This operation is not implemented yet. */
+}
+
+void offset_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+    /* WARNING: This operation is not implemented yet. */
+}
+
+void offset_domain_t::operator()(const ZeroCtxOffset&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::check_valid_access(const ValidAccess& s,
+        std::optional<ptr_or_mapfd_t>& reg_type) {
+    bool is_comparison_check = s.width == (Value)Imm{0};
+
+    if (std::holds_alternative<Reg>(s.width)) return;
+    int w = std::get<Imm>(s.width).v;
+    if (w == 0 || !reg_type) return;
+
+    m_extra_constraints.normalize();
+    if (std::holds_alternative<ptr_no_off_t>(*reg_type)) {
+        auto it = m_reg_state.find(s.reg.v);
+        int limit = m_extra_constraints.get_limit();
+        if (it) {
+            dist_t dist = it.value();
+            // TODO: handle meta and end pointers separately
+            if (dist.m_dist >= PACKET_BEGIN && dist.m_dist+w <= limit) return;
+        }
+    }
+    std::cout << "valid access assert fail\n";
+    //exit(1);
+}
+
+void offset_domain_t::operator()(const Assert &u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::operator()(const basic_block_t& bb, int print) {
+    // nothing to do here
+}
+
+void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_type) {
+    std::optional<ptr_or_mapfd_t> reg_type = {};
+    if (!std::holds_alternative<Reg>(b.value)) {
+        // remove the offset from the stack or nothing
+        return;
+    }
+    Reg target_reg = std::get<Reg>(b.value);
+
+    int offset = b.access.offset;
+    if (is_stack_pointer(basereg_type)) {
+        auto basereg_with_off = std::get<ptr_with_off_t>(*basereg_type);
+        auto basereg_off = basereg_with_off.get_offset().to_interval();
+        auto basereg_off_singleton = basereg_off.singleton();
+        if (!basereg_off_singleton) {
+            std::cout << "type_error: basereg offset is not a singleton\n";
+            return;
+        }
+        auto store_at = (int)(*basereg_off_singleton + offset);
+        //if (is_packet_pointer(targetreg_type)) {
+            auto it = m_reg_state.find(target_reg.v);
+            if (!it) {
+                std::cout << "type_error: register is a packet_pointer and no offset info found\n";
+                m_stack_state -= store_at;
+                return;
+            }
+            m_stack_state.store(store_at, it.value());
+        //}
+        //else {
+            //m_stack_state -= store_at;
+        //}
+    }
+    else {}  // in the rest cases, we do not store
+}
+
+void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
+        std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
+    if (!basereg_type) {
+        m_reg_state -= target_reg.v;
+        return;
+    }
+    auto basereg_ptr_type = basereg_type.value();
+    int offset = b.access.offset;
+    
+    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_type)) {
+        auto p_with_off = std::get<ptr_with_off_t>(basereg_ptr_type);
+        auto offset_singleton = p_with_off.get_offset().to_interval().singleton();
+        if (!offset_singleton) {
+            std::cout << "type_error: basereg offset is not a singleton\n";
+            m_reg_state -= target_reg.v;
+            return;
+        }
+        int to_load = (int)(*offset_singleton + offset);
+
+        if (p_with_off.get_region() == crab::region_t::T_CTX) {
+            auto it = m_ctx_dists->find(to_load);
+            if (!it) {
+                m_reg_state -= target_reg.v;
+                return;
+            }
+            dist_t d = it.value();
+            auto reg = reg_with_loc_t(target_reg.v, loc);
+            m_reg_state.insert(target_reg.v, reg, dist_t(d));
+        }
+        else if (p_with_off.get_region() == crab::region_t::T_STACK) {
+            auto it = m_stack_state.find(to_load);
+
+            if (!it) {
+                m_reg_state -= target_reg.v;
+                return;
+            }
+            dist_t d = it.value();
+            auto reg = reg_with_loc_t(target_reg.v, loc);
+            m_reg_state.insert(target_reg.v, reg, dist_t(d));
+        }
+    }
+    else {  // we are loading from packet or shared, or we have mapfd
+        m_reg_state -= target_reg.v;
+    }
+}
+
+void offset_domain_t::operator()(const Mem &b, location_t loc, int print) {
+}
+
+std::optional<dist_t> offset_domain_t::find_in_registers(const reg_with_loc_t reg) const {
+    return m_reg_state.find(reg);
+}
+
+std::optional<dist_t> offset_domain_t::find_in_ctx(int key) const {
+    return m_ctx_dists->find(key);
+}
+
+std::optional<dist_t> offset_domain_t::find_in_stack(int key) const {
+    return m_stack_state.find(key);
+}
+
+std::optional<dist_t> offset_domain_t::find_offset_info(register_t reg) const {
+    return m_reg_state.find(reg);
+}
+
+void offset_domain_t::adjust_bb_for_types(location_t loc) {
+    m_reg_state.adjust_bb_for_registers(loc);
+}
+
+} // namespace crab
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
new file mode 100644
index 000000000..16b8cf366
--- /dev/null
+++ b/src/crab/offset_domain.hpp
@@ -0,0 +1,235 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <unordered_map>
+
+#include <boost/optional/optional_io.hpp>
+#include "crab/abstract_domain.hpp"
+#include "crab/common.hpp"
+
+namespace crab {
+constexpr int STACK_BEGIN = 0;
+constexpr int CTX_BEGIN = 0;
+constexpr int PACKET_BEGIN = 0;
+
+using constant_t = int;   // define a domain for constants
+//using symbol_t = register_t;    // a register with unknown value
+using weight_t = constant_t; // should be constants + symbols
+using slack_var_t = int;
+
+enum class rop_t {
+    R_GT,
+    R_GE,
+    R_LT,
+    R_LE
+};
+
+struct dist_t {
+    slack_var_t m_slack;
+    weight_t m_dist;
+
+    dist_t(weight_t d, slack_var_t s = -1) : m_slack(s), m_dist(d) {}
+    dist_t() : m_slack(-1), m_dist(0) {}
+    bool operator==(const dist_t& d) const;
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream& o, const dist_t& d);
+};      // if dist is +ve, represents `begin+dist+slack;`, if dist is -ve, represents `end+dist+1`
+
+struct inequality_t {
+    slack_var_t m_slack;
+    rop_t m_rel;
+    weight_t m_value;
+
+    inequality_t(slack_var_t slack, rop_t rel, weight_t val) : m_slack(slack), m_rel(rel)
+                                                               , m_value(val) {}
+    inequality_t() = default;
+};    // represents `slack rel value;`, e.g., `s >= 0`
+
+struct forward_and_backward_eq_t {
+    dist_t m_forw;
+    dist_t m_backw;
+
+    forward_and_backward_eq_t(dist_t forw, dist_t backw) : m_forw(forw), m_backw(backw) {}
+    forward_and_backward_eq_t() = default;
+};  // represents constraint `p[0] = p[1];`, e.g., `begin+8+s = end`
+
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using global_offset_env_t = std::unordered_map<reg_with_loc_t, dist_t>;
+
+class registers_state_t {
+
+    live_registers_t m_cur_def;
+    std::shared_ptr<global_offset_env_t> m_offset_env;
+    bool m_is_bottom = false;
+
+    public:
+        registers_state_t(bool is_bottom = false) : m_offset_env(nullptr), m_is_bottom(is_bottom) {}
+        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env, bool is_bottom = false) : m_offset_env(offset_env), m_is_bottom(is_bottom) {}
+        explicit registers_state_t(live_registers_t&& vars, std::shared_ptr<global_offset_env_t>
+                offset_env, bool is_bottom = false)
+            : m_cur_def(std::move(vars)), m_offset_env(std::move(offset_env)), m_is_bottom(is_bottom) {}
+
+        registers_state_t operator|(const registers_state_t&) const;
+        void operator-=(register_t);
+        void set_to_top();
+        void set_to_bottom();
+        bool is_bottom() const;
+        bool is_top() const;
+        void insert(register_t, const reg_with_loc_t&, const dist_t&);
+        std::optional<dist_t> find(reg_with_loc_t reg) const;
+        std::optional<dist_t> find(register_t key) const;
+        friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
+        void adjust_bb_for_registers(location_t);
+};
+
+class stack_state_t {
+    using stack_slot_dists_t = std::unordered_map<int, dist_t>;    // represents `sp[n] = dist;`, where n \belongs [0,511], e.g., `sp[508] = begin+16`
+
+    stack_slot_dists_t m_slot_dists;
+    bool m_is_bottom = false;
+
+    public:
+        stack_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        std::optional<dist_t> find(int) const;
+        void store(int, dist_t);
+        void operator-=(int);
+        void set_to_top();
+        void set_to_bottom();
+        bool is_bottom() const;
+        bool is_top() const;
+        static stack_state_t top();
+        stack_state_t operator|(const stack_state_t&) const;
+        explicit stack_state_t(stack_slot_dists_t&& stack_dists, bool is_bottom = false)
+            : m_slot_dists(std::move(stack_dists)), m_is_bottom(is_bottom) {}
+};
+
+class extra_constraints_t {
+
+    forward_and_backward_eq_t m_eq;
+    inequality_t m_ineq;
+    bool m_is_bottom = false;
+
+    public:
+        extra_constraints_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        void set_to_top();
+        void set_to_bottom();
+        bool is_bottom() const;
+        bool is_top() const;
+        void add_equality(forward_and_backward_eq_t);
+        void add_inequality(inequality_t);
+        void normalize();
+        weight_t get_limit() const;
+        extra_constraints_t operator|(const extra_constraints_t&) const;
+        explicit extra_constraints_t(forward_and_backward_eq_t&& fabeq, inequality_t ineq, bool is_bottom = false) : m_eq(fabeq), m_ineq(ineq), m_is_bottom(is_bottom) {}
+};
+
+class ctx_offsets_t {
+    using ctx_dists_t = std::unordered_map<int, dist_t>;    // represents `cp[n] = dist;`
+    ctx_dists_t m_dists;
+    int m_size;
+
+    public:
+        ctx_offsets_t(const ebpf_context_descriptor_t* desc);
+        std::optional<dist_t> find(int) const;
+        int get_size() const;
+};
+
+
+class offset_domain_t final {
+
+    bool m_is_bottom = false;
+    registers_state_t m_reg_state;
+    stack_state_t m_stack_state;
+    extra_constraints_t m_extra_constraints;
+    std::shared_ptr<ctx_offsets_t> m_ctx_dists;
+    std::vector<std::string> m_errors;
+    slack_var_t m_slack = 0;
+
+  public:
+    offset_domain_t() = default;
+    offset_domain_t(offset_domain_t&& o) = default;
+    offset_domain_t(const offset_domain_t& o) = default;
+    offset_domain_t& operator=(offset_domain_t&& o) = default;
+    offset_domain_t& operator=(const offset_domain_t& o) = default;
+    explicit offset_domain_t(registers_state_t&& reg, stack_state_t&& stack,
+            extra_constraints_t extra, std::shared_ptr<ctx_offsets_t> ctx, slack_var_t s = 0)
+        : m_reg_state(std::move(reg)), m_stack_state(std::move(stack)),
+        m_extra_constraints(std::move(extra)), m_ctx_dists(ctx), m_slack(s) {}
+
+    explicit offset_domain_t(registers_state_t&& reg, stack_state_t&& stack,
+            std::shared_ptr<ctx_offsets_t> ctx, slack_var_t s = 0) : m_reg_state(std::move(reg)),
+    m_stack_state(std::move(stack)), m_ctx_dists(ctx), m_slack(s) {}
+
+    static offset_domain_t setup_entry();
+    // bottom/top
+    static offset_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const offset_domain_t& other) const;
+    // join
+    void operator|=(const offset_domain_t& abs);
+    void operator|=(offset_domain_t&& abs);
+    offset_domain_t operator|(const offset_domain_t& other) const;
+    offset_domain_t operator|(offset_domain_t&& abs) const;
+    // meet
+    offset_domain_t operator&(const offset_domain_t& other) const;
+    // widening
+    offset_domain_t widen(const offset_domain_t& other, bool);
+    // narrowing
+    offset_domain_t narrow(const offset_domain_t& other) const;
+    //forget
+    void operator-=(variable_t var);
+
+    //// abstract transformers
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
+    void operator()(const Un&, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
+    void operator()(const Atomic&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Call&, location_t loc = boost::none, int print = 0);
+    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
+    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
+    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0) {};
+    void operator()(const basic_block_t& bb, int print = 0);
+    void write(std::ostream& os) const;
+    std::string domain_name() const;
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t&);
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f) {}
+
+    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, location_t loc);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
+    void do_bin(const Bin&, std::optional<int>, std::optional<ptr_or_mapfd_t>,
+            std::optional<ptr_or_mapfd_t>, location_t);
+    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&);
+
+    std::optional<dist_t> find_in_ctx(int) const;
+    std::optional<dist_t> find_in_stack(int) const;
+    std::optional<dist_t> find_in_registers(const reg_with_loc_t) const;
+    std::optional<dist_t> find_offset_info(register_t reg) const;
+    void adjust_bb_for_types(location_t);
+    [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+}; // end offset_domain_t
+
+} // end namespace crab
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index acf5eb0ad..63f78834f 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -1,7 +1,7 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "type_domain.hpp"
+#include "crab/type_domain.hpp"
 
 namespace crab {
 
@@ -11,7 +11,7 @@ bool type_domain_t::is_bottom() const {
 
 bool type_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_region.is_top());
+    return (m_region.is_top() && m_offset.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -26,6 +26,7 @@ void type_domain_t::set_to_bottom() {
 
 void type_domain_t::set_to_top() {
     m_region.set_to_top();
+    m_offset.set_to_top();
 }
 
 bool type_domain_t::operator<=(const type_domain_t& abs) const {
@@ -59,7 +60,7 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | other.m_region);
+    return type_domain_t(m_region | other.m_region, m_offset | other.m_offset);
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
@@ -69,7 +70,7 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | std::move(other.m_region));
+    return type_domain_t(m_region | std::move(other.m_region), m_offset | std::move(m_offset));
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -95,7 +96,9 @@ string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {}
+void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+    // nothing to do here
+}
 
 void type_domain_t::operator()(const Un& u, location_t loc, int print) {
     /* WARNING: The operation is not implemented yet.*/
@@ -103,6 +106,7 @@ void type_domain_t::operator()(const Un& u, location_t loc, int print) {
 
 void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
     m_region(u, loc);
+    m_offset(u, loc);
 }
 
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
@@ -134,18 +138,22 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
         }
     }
     m_region(u, loc);
+    m_offset(u, loc);
 }
 
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Exit& u, location_t loc, int print) {}
+void type_domain_t::operator()(const Exit& u, location_t loc, int print) {
+    // nothing to do here
+}
 
 void type_domain_t::operator()(const Jmp& u, location_t loc, int print) {}
 
 void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_region(u, loc);
+    m_offset(u, loc);
 }
 
 void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
@@ -169,6 +177,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
         }
     }
     else {}
+    m_offset(s, loc, print);
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
@@ -177,6 +186,8 @@ void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print)
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
     m_region(s, loc);
+    auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
+    m_offset.check_valid_access(s, reg_type);
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
@@ -184,6 +195,7 @@ void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int prin
 }
 
 void type_domain_t::operator()(const Assert& u, location_t loc, int print) {
+    if (is_bottom()) return;
     std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
@@ -192,7 +204,6 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
-        // an extra check just to make sure registers are not labelled both ptrs and numbers
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
         if (!is_shared_ptr(maybe_ptr_or_mapfd1)
                 && same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
@@ -279,16 +290,18 @@ void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print
 
 type_domain_t type_domain_t::setup_entry() {
     auto&& reg = crab::region_domain_t::setup_entry();
-    type_domain_t typ(std::move(reg));
+    auto&& off = offset_domain_t::setup_entry();
+    type_domain_t typ(std::move(reg), std::move(off));
     return typ;
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
-
+    if (is_bottom()) return;
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
 
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
     std::optional<interval_t> src_interval;
+
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg r = std::get<Reg>(bin.v);
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
@@ -313,17 +326,20 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         m_region -= bin.dst.v;
         return;
     }
-
     m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+    m_offset.do_bin(bin, std::nullopt, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
-        location_t loc, int print) {
+        std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc, int print) {
     m_region.do_load(b, target_reg, unknown_ptr, loc);
+    m_offset.do_load(b, target_reg, basereg_opt, loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, location_t loc, int print) {
+void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt,
+        location_t loc, int print) {
     m_region.do_mem_store(b, loc);
+    m_offset.do_mem_store(b, basereg_opt);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
@@ -336,11 +352,11 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
                 std::string("load/store using an unknown pointer, or number - r") + s);
     }
     if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, loc, print);
+        do_mem_store(b, ptr_or_mapfd_opt, loc, print);
     }
     else if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
-        if (b.is_load) do_load(b, targetreg, unknown_ptr, loc, print);
+        if (b.is_load) do_load(b, targetreg, unknown_ptr, ptr_or_mapfd_opt, loc, print);
     }
 }
 
@@ -395,6 +411,7 @@ void type_domain_t::print_stack() const {
 
 void type_domain_t::adjust_bb_for_types(location_t loc) {
     m_region.adjust_bb_for_types(loc);
+    m_offset.adjust_bb_for_types(loc);
 }
 
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
@@ -416,6 +433,7 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
     }
 
     operator+=(m_region.get_errors());
+    operator+=(m_offset.get_errors());
 }
 
 std::optional<crab::ptr_or_mapfd_t>
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 864b14be5..89901e70b 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -5,12 +5,14 @@
 
 #include "crab/abstract_domain.hpp"
 #include "crab/region_domain.hpp"
+#include "crab/offset_domain.hpp"
 #include "crab/common.hpp"
 
 namespace crab {
 
 class type_domain_t final {
     crab::region_domain_t m_region;
+    crab::offset_domain_t m_offset;
     bool m_is_bottom = false;
     std::vector<std::string> m_errors;
 
@@ -19,8 +21,8 @@ class type_domain_t final {
     type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
-    explicit type_domain_t(crab::region_domain_t&& reg, bool is_bottom = false) :
-        m_region(reg), m_is_bottom(is_bottom) {}
+    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off, bool is_bottom = false) :
+        m_region(reg), m_offset(off), m_is_bottom(is_bottom) {}
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
@@ -86,14 +88,16 @@ class type_domain_t final {
 
   private:
 
-    void do_load(const Mem&, const Reg&, bool, location_t, int print = 0);
-    void do_mem_store(const Mem&, location_t, int print = 0);
+    void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
+            location_t, int print = 0);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&, location_t, int print = 0);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);
     void operator+=(std::vector<std::string>& errs) {
         m_errors.insert(m_errors.end(), errs.begin(), errs.end());
     }
+    void print_initial_registers() const;
 }; // end type_domain_t
 
 } // namespace crab
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 962ced1a7..7d48e573e 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -16,6 +16,7 @@
 #include "crab/ebpf_domain.hpp"
 #include "crab/type_domain.hpp"
 #include "crab/region_domain.hpp"
+#include "crab/offset_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 

From 256d3d83e29b6f4640c5f607676aa74d9552b0d2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 28 Jul 2023 15:20:33 -0400
Subject: [PATCH 116/373] Some fixes/additions

Added support for intervals in offset domain instead of constants;
Fixes in valid access assertion checks;
Better handling in Bin operation: 1) Initial imprecise support for pointer subtraction, 2) Multiple sanity checks added (TODO: precise handling of subtraction for packet pointers);
Better handling in Mem operations, especially in Load, when pointers do not have fixed offsets;
Support packet access check in ValidMapKeyValue assertion;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 571 ++++++++++++++++++++++++++-----------
 src/crab/offset_domain.hpp | 109 +++++--
 src/crab/type_domain.cpp   |  27 +-
 3 files changed, 508 insertions(+), 199 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 5b11590b0..27a95ca3a 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -9,15 +9,55 @@ bool dist_t::operator==(const dist_t& d) const {
     return (m_dist == d.m_dist && m_slack == d.m_slack);
 }
 
+weight_t dist_t::offset_from_reference() const {
+    if (is_meta_pointer()) {
+        return (-m_dist+interval_t{number_t{PACKET_META}});
+    }
+    if (is_backward_pointer()) {
+        return (m_dist-interval_t{number_t{PACKET_END}});
+    }
+    return m_dist;
+}
+
 void dist_t::write(std::ostream& o) const {
     if (m_slack != -1)
         o << "s" << m_slack << "+";
-    if (m_dist >= 0)
-        o << "begin+" << m_dist;
-    else if (m_dist >= -4098)
-        o << "meta";
-    else
-        o << "end-" << (-1)*m_dist-4099;
+    if (is_forward_pointer()) o << "begin+";
+    else if (is_meta_pointer()) o << "meta+";
+    else if (is_backward_pointer()) o << "end+";
+    auto offset = offset_from_reference();
+    auto singleton_val = offset.singleton();
+    if (singleton_val) o << singleton_val.value();
+    else o << offset;
+}
+
+bool dist_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_slack == -1 && m_dist.is_top());
+}
+
+bool dist_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+void dist_t::set_to_top() {
+    m_slack = -1;
+    m_dist = interval_t::top();
+    m_is_bottom = false;
+}
+
+void dist_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+bool dist_t::is_meta_pointer() const {
+    return (m_dist.lb() > number_t{PACKET_END} && m_dist.ub() <= number_t{PACKET_META});
+}
+bool dist_t::is_forward_pointer() const {
+    return (m_dist.lb() >= number_t{PACKET_BEGIN});
+}
+bool dist_t::is_backward_pointer() const {
+    return (m_dist.ub() <= number_t{PACKET_END});
 }
 
 std::ostream& operator<<(std::ostream& o, const dist_t& d) {
@@ -25,7 +65,68 @@ std::ostream& operator<<(std::ostream& o, const dist_t& d) {
     return o;
 }
 
-void registers_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc, const dist_t& dist) {
+bool inequality_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_slack == -1 && m_value.is_top());
+}
+
+bool inequality_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+void inequality_t::set_to_top() {
+    m_value = interval_t::top();
+    m_slack = -1;
+    m_is_bottom = false;
+}
+
+void inequality_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+
+std::ostream& operator<<(std::ostream& o, const inequality_t& ineq) {
+    ineq.write(o);
+    return o;
+}
+
+void inequality_t::write(std::ostream& o) const {
+    o << m_slack << (m_rel == rop_t::R_GT ? ">" :
+            m_rel == rop_t::R_GE ? ">=" :
+            m_rel == rop_t::R_LT ? "<" : "<=")
+        << m_value;
+}
+
+bool equality_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_lhs.is_top() && m_rhs.is_top());
+}
+
+bool equality_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+void equality_t::set_to_top() {
+    m_lhs.set_to_top();
+    m_rhs.set_to_top();
+    m_is_bottom = false;
+}
+
+void equality_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+std::ostream& operator<<(std::ostream& o, const equality_t& eq) {
+    eq.write(o);
+    return o;
+}
+
+void equality_t::write(std::ostream& o) const {
+    o << m_lhs << " = " << m_rhs;
+}
+
+void registers_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
+        const dist_t& dist) {
     (*m_offset_env)[reg_with_loc] = dist;
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
@@ -88,9 +189,10 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
         if (it1 && it2) {
             dist_t dist1 = it1.value(), dist2 = it2.value();
             auto reg = reg_with_loc_t((register_t)i, loc);
-            if (dist1 == dist2) {
-                out_vars[i] = m_cur_def[i];
-            }
+            if (dist1.m_slack != dist2.m_slack) continue;
+            auto dist_joined = dist_t(std::move(dist1.m_dist | dist2.m_dist), dist1.m_slack);
+            out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
+            (*m_offset_env)[reg] = dist_joined;
         }
     }
     return registers_state_t(std::move(out_vars), m_offset_env, false);
@@ -100,15 +202,25 @@ void registers_state_t::adjust_bb_for_registers(location_t loc) {
     location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
     for (size_t i = 0; i < m_cur_def.size(); i++) {
         auto new_reg = reg_with_loc_t((register_t)i, loc);
+        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
+
         auto it = find((register_t)i);
         if (!it) continue;
-        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
-        (*m_offset_env)[new_reg] = it.value();
 
-        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
         if (*m_cur_def[i] == old_reg)
             m_offset_env->erase(old_reg);
+
+        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
+        (*m_offset_env)[new_reg] = it.value();
+    }
+}
+
+void registers_state_t::print_all_register_types() const {
+    std::cout << "\toffset types: {\n";
+    for (auto const& kv : *m_offset_env) {
+        std::cout << "\t\t" << kv.first << " : " << kv.second << "\n";
     }
+    std::cout << "\t}\n";
 }
 
 void stack_state_t::set_to_top() {
@@ -166,77 +278,130 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
     return stack_state_t(std::move(out_stack_dists), false);
 }
 
-void extra_constraints_t::set_to_top() {
-    add_equality(forward_and_backward_eq_t());
-    add_inequality(inequality_t());
-}
-
-void extra_constraints_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
 bool extra_constraints_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_eq.m_forw.m_slack == -1 && m_ineq.m_slack == -1);
+    return (m_meta_and_begin.is_top() && m_begin_and_end.is_top());
 }
 
 bool extra_constraints_t::is_bottom() const {
     return m_is_bottom;
 }
 
-void extra_constraints_t::add_equality(forward_and_backward_eq_t fabeq) {
-    m_eq = std::move(fabeq);
+void extra_constraints_t::set_to_top() {
+    m_meta_and_begin.set_to_top();
+    m_begin_and_end.set_to_top();
+    m_is_bottom = false;
 }
 
-void extra_constraints_t::add_inequality(inequality_t ineq) {
-    m_ineq = std::move(ineq);
+void extra_constraints_t::set_to_bottom() {
+    m_is_bottom = true;
 }
 
-weight_t extra_constraints_t::get_limit() const {
-    return m_eq.m_forw.m_dist;
+void extra_constraints_t::add_meta_and_begin_constraint(equality_t&& eq,
+        inequality_t&& ineq) {
+    m_meta_and_begin = packet_constraint_t(std::move(eq), std::move(ineq), true);
 }
 
+void extra_constraints_t::add_begin_and_end_constraint(equality_t&& eq,
+        inequality_t&& ineq) {
+    m_begin_and_end = packet_constraint_t(std::move(eq), std::move(ineq), false);
+}
+/*
 void extra_constraints_t::normalize() {
-    weight_t dist_forw = m_eq.m_forw.m_dist - m_eq.m_backw.m_dist - 4099;
-    weight_t dist_backw = -4099;
-    slack_var_t s = m_eq.m_forw.m_slack;
-    dist_forw += m_ineq.m_value;
+    weight_t dist_lhs = m_eq.m_lhs.m_dist - m_eq.m_rhs.m_dist - 4099;
+    weight_t dist_rhs = -4099;
+    slack_var_t s = m_eq.m_lhs.m_slack;
+    dist_lhs += m_ineq.m_value;
     weight_t ineq_val = 0;
     rop_t ineq_rel = m_ineq.m_rel;
 
-    m_eq = forward_and_backward_eq_t(dist_t(dist_forw, s), dist_t(dist_backw));
+    m_eq = equality_t(dist_t(dist_lhs, s), dist_t(dist_rhs));
     m_ineq = inequality_t(s, ineq_rel, ineq_val);
 }
+*/
 
-extra_constraints_t extra_constraints_t::operator|(const extra_constraints_t& other) const {
+packet_constraint_t packet_constraint_t::operator|(const packet_constraint_t& other) const {
     //normalize();
     //other.normalize();
 
-    weight_t dist1 = m_eq.m_forw.m_dist;
-    weight_t dist2 = other.m_eq.m_forw.m_dist;
-    slack_var_t s = m_eq.m_forw.m_slack;
+    weight_t dist1 = m_eq.m_lhs.m_dist;
+    weight_t dist2 = other.m_eq.m_lhs.m_dist;
+    slack_var_t s = m_eq.m_lhs.m_slack;
 
-    dist_t f = dist_t(std::min(dist1, dist2), s);
-    dist_t b = dist_t(-4099);
+    dist_t lhs = dist_t(dist1 | dist2, s);
+    dist_t rhs;
+    if (m_is_meta_constraint) rhs = dist_t(weight_t{number_t{PACKET_BEGIN}});
+    else rhs = dist_t(weight_t{number_t{PACKET_END}});
 
-    forward_and_backward_eq_t out_eq(f, b);
-    inequality_t out_ineq(s, m_ineq.m_rel, 0);
-
-    return extra_constraints_t(std::move(out_eq), std::move(out_ineq), false);
+    equality_t out_eq(lhs, rhs);
+    inequality_t out_ineq(s, m_ineq.m_rel, weight_t{number_t{0}});
+    return packet_constraint_t(std::move(out_eq), std::move(out_ineq), m_is_meta_constraint);
         // have to handle case for different slack vars
 }
 
+std::ostream& operator<<(std::ostream& o, const packet_constraint_t& p) {
+    p.write(o);
+    return o;
+}
+
+void packet_constraint_t::write(std::ostream& o) const {
+    o << m_eq << "\n";
+    o << m_ineq << "\n";
+}
+
+void packet_constraint_t::set_to_top() {
+    m_eq.set_to_top();
+    m_ineq.set_to_top();
+    m_is_bottom = false;
+}
+
+void packet_constraint_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+bool packet_constraint_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_eq.is_top() && m_ineq.is_top());
+}
+
+bool packet_constraint_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+std::optional<bound_t> packet_constraint_t::get_limit() const {
+    // TODO: normalize constraint, if required
+    auto dist = m_eq.m_lhs.m_dist;
+    if (dist.is_top()) return {};
+    return dist.ub();
+}
+
+extra_constraints_t extra_constraints_t::operator|(const extra_constraints_t& other) const {
+    auto meta_and_begin = m_meta_and_begin | other.m_meta_and_begin;
+    auto begin_and_end = m_begin_and_end | other.m_begin_and_end;
+    return extra_constraints_t(std::move(meta_and_begin), std::move(begin_and_end), false);
+}
+
+std::optional<bound_t> extra_constraints_t::get_end_limit() const {
+    return m_begin_and_end.get_limit();
+}
+
+std::optional<bound_t> extra_constraints_t::get_meta_limit() const {
+    return m_meta_and_begin.get_limit();
+}
+
 ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
-    if (desc->data != -1) {
-        m_dists[desc->data] = dist_t(0);
+    if (desc->data >= 0) {
+        m_dists[desc->data] = dist_t(weight_t{number_t{PACKET_BEGIN}});
+    }
+    if (desc->end >= 0) {
+        m_dists[desc->end] = dist_t(weight_t{number_t{PACKET_END}});
     }
-    if (desc->end != -1) {
-        m_dists[desc->end] = dist_t(-4099);
+    if (desc->meta >= 0) {
+        m_dists[desc->meta] = dist_t(weight_t{number_t{PACKET_META}});
     }
-    if (desc->meta != -1) {
-        m_dists[desc->meta] = dist_t(-1);
+    if (desc->size >= 0) {
+        m_size = desc->size;
     }
-    m_size = desc->size;
 }
 
 int ctx_offsets_t::get_size() const {
@@ -366,9 +531,6 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
             auto dist_left = m_reg_state.find(cond.left.v);
             auto dist_right = m_reg_state.find(right_reg);
             if (!dist_left && !dist_right) {
-                return;
-            }
-            else if (!dist_left || !dist_right) {
                 // this should not happen, comparison between a packet pointer and either
                 // other region's pointers or numbers; possibly raise type error
                 //exit(1);
@@ -379,9 +541,15 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
             dist_t right_reg_dist = dist_right.value();
             slack_var_t s = m_slack++;
             dist_t f = dist_t(left_reg_dist.m_dist, s);
-            dist_t b = dist_t(right_reg_dist.m_dist, slack_var_t{-1});
-            m_extra_constraints.add_equality(forward_and_backward_eq_t(f, b));
-            m_extra_constraints.add_inequality(inequality_t(s, rop_t::R_GE, 0));
+            dist_t b = dist_t(right_reg_dist.m_dist);
+            auto eq = equality_t(f, b);
+            auto ineq = inequality_t(s, rop_t::R_GE, weight_t{number_t{0}});
+            if (f.is_meta_pointer() && b.is_forward_pointer()) {
+                m_extra_constraints.add_meta_and_begin_constraint(std::move(eq), std::move(ineq));
+            }
+            else if (f.is_forward_pointer() && b.is_backward_pointer()) {
+                m_extra_constraints.add_begin_and_end_constraint(std::move(eq), std::move(ineq));
+            }
         }
     }
     else {}     //we do not need to deal with other cases
@@ -411,109 +579,132 @@ bool is_stack_pointer(std::optional<ptr_or_mapfd_t>& type) {
     return false;
 }
 
-void offset_domain_t::do_bin(const Bin& bin, std::optional<int> src_const_value,
-        std::optional<ptr_or_mapfd_t> src_type, std::optional<ptr_or_mapfd_t> dst_type,
-        location_t loc) {
-    if (is_bottom()) return;
+void offset_domain_t::update_offset_info(const dist_t&& dist, const interval_t&& change,
+        const reg_with_loc_t& reg_with_loc, uint8_t reg, Bin::Op op) {
+    auto offset = dist.m_dist;
+    if (op == Bin::Op::ADD) {
+        if (dist.is_forward_pointer()) offset += change;
+        else if (dist.is_backward_pointer()) offset -= change;
+        else offset -= change;
+    }
+    else if (op == Bin::Op::SUB) {
+        // TODO: needs precise handling of subtraction
+        offset = interval_t::top();
+    }
+    m_reg_state.insert(reg, reg_with_loc, dist_t(offset));
+}
+
+interval_t offset_domain_t::do_bin(const Bin &bin,
+        const std::optional<interval_t>& src_interval_opt,
+        const std::optional<interval_t>& dst_interval_opt,
+        std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
+    using Op = Bin::Op;
+    // if both src and dst are numbers, nothing to do in offset domain
+    // if we are doing a move, where src is a number and dst is not set, nothing to do
+    if ((dst_interval_opt && src_interval_opt)
+            || (src_interval_opt && !dst_ptr_or_mapfd_opt && bin.op == Op::MOV))
+        return interval_t::bottom();
+    // offset domain only handles packet pointers
+    if (!is_packet_pointer(src_ptr_or_mapfd_opt) && !is_packet_pointer(dst_ptr_or_mapfd_opt))
+        return interval_t::bottom();
+
+    interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
+    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
+    if (dst_interval_opt) dst_interval = std::move(dst_interval_opt.value());
+
+    Reg src;
+    if (std::holds_alternative<Reg>(bin.v)) src = std::get<Reg>(bin.v);
 
     auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
-    if (std::holds_alternative<Reg>(bin.v)) {
-        Reg src = std::get<Reg>(bin.v);
-        switch (bin.op)
-        {
-            // ra = rb;
-            case Bin::Op::MOV: {
-                if (!is_packet_pointer(src_type)) {
-                    m_reg_state -= bin.dst.v;
-                    return;
-                }
-                auto it = m_reg_state.find(src.v);
-                if (!it) {
-                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
-                    //exit(1);
-                    return;
-                }
-                m_reg_state.insert(bin.dst.v, reg_with_loc, it.value());
-                //std::cout << "offset: " << (*m_reg_state.get(bin.dst.v)).m_dist << "\n";
-                break;
+    switch (bin.op)
+    {
+        // ra = rb;
+        case Op::MOV: {
+            if (!is_packet_pointer(src_ptr_or_mapfd_opt)) {
+                m_reg_state -= bin.dst.v;
+                return interval_t::bottom();
             }
-            // ra += rb
-            case Bin::Op::ADD: {
-                if (!is_packet_pointer(dst_type)) {
-                    m_reg_state -= bin.dst.v;
-                    return;
-                }
-                auto it = m_reg_state.find(bin.dst.v);
-                if (!it) {
+            auto src_offset_opt = m_reg_state.find(src.v);
+            if (!src_offset_opt) {
+                std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                return interval_t::bottom();
+            }
+            m_reg_state.insert(bin.dst.v, reg_with_loc, src_offset_opt.value());
+            break;
+        }
+        // ra += rb
+        case Op::ADD: {
+            dist_t dist_to_update;
+            interval_t interval_to_add = interval_t::bottom();
+            if (is_packet_pointer(dst_ptr_or_mapfd_opt)
+                    && is_packet_pointer(src_ptr_or_mapfd_opt)) {
+                m_reg_state -= bin.dst.v;
+                return interval_t::bottom();
+            }
+            else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
+                auto dst_offset_opt = m_reg_state.find(bin.dst.v);
+                if (!dst_offset_opt) {
                     std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    //exit(1);
-                    return;
-                }
-                auto dst_dist = it.value();
-                if (src_const_value) {
-                    weight_t updated_dist;
-                    if (dst_dist.m_dist >= 0) {
-                        updated_dist = dst_dist.m_dist + src_const_value.value();
-                    }
-                    else if (dst_dist.m_dist >= -4098) {
-                        // TODO: special handling of meta pointer required
-                        updated_dist = dst_dist.m_dist - src_const_value.value();
-                    }
-                    else {
-                        updated_dist = dst_dist.m_dist - src_const_value.value();
-                    }
-                    m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t(updated_dist));
+                    m_reg_state -= bin.dst.v;
+                    return interval_t::bottom();
                 }
-                else {
+                dist_to_update = std::move(dst_offset_opt.value());
+                interval_to_add = std::move(src_interval_opt.value());
+            }
+            else {
+                auto src_offset_opt = m_reg_state.find(src.v);
+                if (!src_offset_opt) {
+                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
                     m_reg_state -= bin.dst.v;
+                    return interval_t::bottom();
                 }
-                break;
+                dist_to_update = std::move(src_offset_opt.value());
+                interval_to_add = std::move(dst_interval_opt.value());
             }
-
-            default: {
+            update_offset_info(std::move(dist_to_update), std::move(interval_to_add),
+                    reg_with_loc, bin.dst.v, bin.op);
+            break;
+        }
+        // ra -= rb
+        case Op::SUB: {
+            dist_t dist_to_update;
+            interval_t interval_to_sub = interval_t::bottom();
+            if (is_packet_pointer(dst_ptr_or_mapfd_opt)
+                    && is_packet_pointer(src_ptr_or_mapfd_opt)) {
                 m_reg_state -= bin.dst.v;
-                break;
+                return interval_t::top();
             }
-        }
-    }
-    else {
-        int imm = static_cast<int>(std::get<Imm>(bin.v).v);
-        auto it = m_reg_state.find(bin.dst.v);
-        switch (bin.op)
-        {
-            case Bin::Op::ADD: {
-                if (!is_packet_pointer(dst_type)) {
-                    m_reg_state -= bin.dst.v;
-                    return;
-                }
-                if (!it) {
+            else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
+                auto dst_offset_opt = m_reg_state.find(bin.dst.v);
+                if (!dst_offset_opt) {
                     std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    //exit(1);
-                    return;
-                }
-                auto dst_dist = it.value();
-
-                weight_t updated_dist;
-                if (dst_dist.m_dist >= 0) {
-                    updated_dist = dst_dist.m_dist + imm;
-                }
-                else if (dst_dist.m_dist >= -4098) {
-                    // TODO: special handling of meta pointer required
-                    updated_dist = dst_dist.m_dist - imm;
-                }
-                else {
-                    updated_dist = dst_dist.m_dist - imm;
+                    m_reg_state -= bin.dst.v;
+                    return interval_t::bottom();
                 }
-                m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t(updated_dist));
-                break;
+                dist_to_update = std::move(dst_offset_opt.value());
+                interval_to_sub = std::move(src_interval_opt.value());
             }
-
-            default: {
-                m_reg_state -= bin.dst.v;
-                break;
+            else {
+                auto src_offset_opt = m_reg_state.find(src.v);
+                if (!src_offset_opt) {
+                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                    m_reg_state -= bin.dst.v;
+                    return interval_t::bottom();
+                }
+                dist_to_update = std::move(src_offset_opt.value());
+                interval_to_sub = std::move(dst_interval_opt.value());
             }
+            update_offset_info(std::move(dist_to_update), std::move(interval_to_sub),
+                    reg_with_loc, bin.dst.v, bin.op);
+            break;
+        }
+        default: {
+            m_reg_state -= bin.dst.v;
+            break;
         }
     }
+    return interval_t::bottom();
 }
 
 void offset_domain_t::operator()(const Bin& bin, location_t loc, int print) {
@@ -582,24 +773,64 @@ void offset_domain_t::operator()(const ZeroCtxOffset&, location_t loc, int print
     // nothing to do here
 }
 
-void offset_domain_t::check_valid_access(const ValidAccess& s,
-        std::optional<ptr_or_mapfd_t>& reg_type) {
-    bool is_comparison_check = s.width == (Value)Imm{0};
+bool offset_domain_t::lower_bound_satisfied(const dist_t& dist, int offset) const {
+    auto meta_limit = m_extra_constraints.get_meta_limit();
+    auto end_limit = m_extra_constraints.get_end_limit();
+
+    dist_t dist1 = dist;
+    if (dist.is_meta_pointer()) {
+        dist1 = dist_t(dist.offset_from_reference() + (meta_limit ?
+                    weight_t{*meta_limit-number_t{PACKET_META}} : weight_t{number_t{0}}));
+    }
+    if (dist.is_backward_pointer()) {
+        dist1 = dist_t(dist.offset_from_reference()
+                + (end_limit ? weight_t{*end_limit} : weight_t{number_t{0}}));
+    }
+
+    bound_t lb = meta_limit ? *meta_limit-number_t{PACKET_META} : bound_t{number_t{0}};
+    return (dist1.m_dist.lb()+number_t{offset} >= lb);
+}
+
+bool offset_domain_t::upper_bound_satisfied(const dist_t& dist, int offset, int width,
+        bool is_comparison_check) const {
+    auto meta_limit = m_extra_constraints.get_meta_limit();
+    auto end_limit = m_extra_constraints.get_end_limit();
 
+    dist_t dist1 = dist;
+    if (dist.is_meta_pointer()) {
+        dist1 = dist_t(dist.offset_from_reference() + (meta_limit ?
+                    weight_t{*meta_limit-number_t{PACKET_META}} : weight_t{number_t{0}}));
+    }
+    if (dist.is_backward_pointer()) {
+        dist1 = dist_t(dist.offset_from_reference()
+                + (end_limit ? weight_t{*end_limit} :
+                    weight_t{number_t{is_comparison_check ? MAX_PACKET_SIZE : 0}}));
+    }
+
+    bound_t ub = is_comparison_check ? bound_t{MAX_PACKET_SIZE}
+        : (end_limit ? *end_limit : number_t{0});
+    return (dist1.m_dist.ub()+number_t{offset+width} <= ub);
+}
+
+bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
+        bool is_comparison_check) const {
+    auto it = m_reg_state.find(r.v);
+    if (!it) return false;
+    dist_t dist = it.value();
+
+    return (lower_bound_satisfied(dist, offset)
+            && upper_bound_satisfied(dist, offset, width, is_comparison_check));
+}
+
+void offset_domain_t::check_valid_access(const ValidAccess& s,
+        std::optional<ptr_or_mapfd_t>& reg_type,
+        std::optional<interval_t>, std::optional<interval_t>) const {
     if (std::holds_alternative<Reg>(s.width)) return;
     int w = std::get<Imm>(s.width).v;
     if (w == 0 || !reg_type) return;
 
-    m_extra_constraints.normalize();
-    if (std::holds_alternative<ptr_no_off_t>(*reg_type)) {
-        auto it = m_reg_state.find(s.reg.v);
-        int limit = m_extra_constraints.get_limit();
-        if (it) {
-            dist_t dist = it.value();
-            // TODO: handle meta and end pointers separately
-            if (dist.m_dist >= PACKET_BEGIN && dist.m_dist+w <= limit) return;
-        }
-    }
+    bool is_comparison_check = s.width == (Value)Imm{0};
+    if (check_packet_access(s.reg, w, s.offset, is_comparison_check)) return;
     std::cout << "valid access assert fail\n";
     //exit(1);
 }
@@ -663,10 +894,14 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
             m_reg_state -= target_reg.v;
             return;
         }
-        int to_load = (int)(*offset_singleton + offset);
 
         if (p_with_off.get_region() == crab::region_t::T_CTX) {
-            auto it = m_ctx_dists->find(to_load);
+            if (!offset_singleton) {
+                m_reg_state -= target_reg.v;
+                return;
+            }
+            auto load_at = (uint64_t)offset_singleton.value() + (uint64_t)offset;
+            auto it = m_ctx_dists->find(load_at);
             if (!it) {
                 m_reg_state -= target_reg.v;
                 return;
@@ -676,7 +911,13 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
             m_reg_state.insert(target_reg.v, reg, dist_t(d));
         }
         else if (p_with_off.get_region() == crab::region_t::T_STACK) {
-            auto it = m_stack_state.find(to_load);
+            if (!offset_singleton) {
+                m_reg_state -= target_reg.v;
+                return;
+            }
+            auto ptr_offset = offset_singleton.value();
+            auto load_at = (uint64_t)(ptr_offset + offset);
+            auto it = m_stack_state.find(load_at);
 
             if (!it) {
                 m_reg_state -= target_reg.v;
@@ -686,16 +927,16 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
             auto reg = reg_with_loc_t(target_reg.v, loc);
             m_reg_state.insert(target_reg.v, reg, dist_t(d));
         }
+        else {  // shared
+            m_reg_state -= target_reg.v;
+        }
     }
-    else {  // we are loading from packet or shared, or we have mapfd
+    else {  // we are loading from packet, or we have mapfd
         m_reg_state -= target_reg.v;
     }
 }
 
-void offset_domain_t::operator()(const Mem &b, location_t loc, int print) {
-}
-
-std::optional<dist_t> offset_domain_t::find_in_registers(const reg_with_loc_t reg) const {
+std::optional<dist_t> offset_domain_t::find_offset_at_loc(const reg_with_loc_t reg) const {
     return m_reg_state.find(reg);
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 16b8cf366..cdfb33992 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -13,10 +13,12 @@ namespace crab {
 constexpr int STACK_BEGIN = 0;
 constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
+constexpr int SHARED_BEGIN = 0;
+constexpr int PACKET_END = -4100;
+constexpr int PACKET_META = -1;
+constexpr int MAX_PACKET_SIZE = 0xffff;
 
-using constant_t = int;   // define a domain for constants
-//using symbol_t = register_t;    // a register with unknown value
-using weight_t = constant_t; // should be constants + symbols
+using weight_t = interval_t;
 using slack_var_t = int;
 
 enum class rop_t {
@@ -29,32 +31,76 @@ enum class rop_t {
 struct dist_t {
     slack_var_t m_slack;
     weight_t m_dist;
+    bool m_is_bottom = false;
 
-    dist_t(weight_t d, slack_var_t s = -1) : m_slack(s), m_dist(d) {}
-    dist_t() : m_slack(-1), m_dist(0) {}
+    dist_t(weight_t d, slack_var_t s = -1, bool bottom = false)
+        : m_slack(s), m_dist(d), m_is_bottom(bottom) {}
+    dist_t() : m_slack(-1), m_dist(weight_t::top()), m_is_bottom(false) {}
     bool operator==(const dist_t& d) const;
     void write(std::ostream&) const;
+    bool is_top() const;
+    bool is_bottom() const;
+    void set_to_top();
+    void set_to_bottom();
     friend std::ostream& operator<<(std::ostream& o, const dist_t& d);
-};      // if dist is +ve, represents `begin+dist+slack;`, if dist is -ve, represents `end+dist+1`
+    bool is_meta_pointer() const;
+    bool is_forward_pointer() const;
+    bool is_backward_pointer() const;
+    weight_t offset_from_reference() const;
+};
 
 struct inequality_t {
     slack_var_t m_slack;
     rop_t m_rel;
     weight_t m_value;
+    bool m_is_bottom = false;
 
     inequality_t(slack_var_t slack, rop_t rel, weight_t val) : m_slack(slack), m_rel(rel)
                                                                , m_value(val) {}
-    inequality_t() = default;
+    inequality_t() : m_slack(-1), m_value(weight_t::top()) {}
+    bool is_top() const;
+    bool is_bottom() const;
+    void set_to_top();
+    void set_to_bottom();
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream&, const inequality_t&);
 };    // represents `slack rel value;`, e.g., `s >= 0`
 
-struct forward_and_backward_eq_t {
-    dist_t m_forw;
-    dist_t m_backw;
+struct equality_t {
+    dist_t m_lhs;
+    dist_t m_rhs;
+    bool m_is_bottom = false;
 
-    forward_and_backward_eq_t(dist_t forw, dist_t backw) : m_forw(forw), m_backw(backw) {}
-    forward_and_backward_eq_t() = default;
+    equality_t(dist_t lhs, dist_t rhs) : m_lhs(lhs), m_rhs(rhs) {}
+    equality_t() = default;
+    bool is_top() const;
+    bool is_bottom() const;
+    void set_to_top();
+    void set_to_bottom();
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream&, const equality_t&);
 };  // represents constraint `p[0] = p[1];`, e.g., `begin+8+s = end`
 
+struct packet_constraint_t {
+    equality_t m_eq;
+    inequality_t m_ineq;
+    bool m_is_meta_constraint;
+    bool m_is_bottom = false;
+
+    bool is_bottom() const;
+    bool is_top() const;
+    void set_to_bottom();
+    void set_to_top();
+    std::optional<bound_t> get_limit() const;
+    packet_constraint_t() = default;
+    packet_constraint_t(equality_t&& eq, inequality_t&& ineq, bool is_meta_constraint,
+            bool is_bottom = false) : m_eq(eq), m_ineq(ineq),
+    m_is_meta_constraint(is_meta_constraint), m_is_bottom(is_bottom) {}
+    packet_constraint_t operator|(const packet_constraint_t&) const;
+    void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream&, const packet_constraint_t&);
+};
+
 using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
 using global_offset_env_t = std::unordered_map<reg_with_loc_t, dist_t>;
 
@@ -82,6 +128,7 @@ class registers_state_t {
         std::optional<dist_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
         void adjust_bb_for_registers(location_t);
+        void print_all_register_types() const;
 };
 
 class stack_state_t {
@@ -107,22 +154,26 @@ class stack_state_t {
 
 class extra_constraints_t {
 
-    forward_and_backward_eq_t m_eq;
-    inequality_t m_ineq;
+    packet_constraint_t m_meta_and_begin;
+    packet_constraint_t m_begin_and_end;
     bool m_is_bottom = false;
 
     public:
         extra_constraints_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        void set_to_top();
-        void set_to_bottom();
         bool is_bottom() const;
         bool is_top() const;
-        void add_equality(forward_and_backward_eq_t);
-        void add_inequality(inequality_t);
+        void set_to_top();
+        void set_to_bottom();
         void normalize();
-        weight_t get_limit() const;
+        std::optional<bound_t> get_end_limit() const;
+        std::optional<bound_t> get_meta_limit() const;
+        void add_meta_and_begin_constraint(equality_t&&, inequality_t&&);
+        void add_begin_and_end_constraint(equality_t&&, inequality_t&&);
         extra_constraints_t operator|(const extra_constraints_t&) const;
-        explicit extra_constraints_t(forward_and_backward_eq_t&& fabeq, inequality_t ineq, bool is_bottom = false) : m_eq(fabeq), m_ineq(ineq), m_is_bottom(is_bottom) {}
+        explicit extra_constraints_t(packet_constraint_t&& meta_and_begin,
+                packet_constraint_t&& begin_and_end, bool is_bottom = false)
+            : m_meta_and_begin(meta_and_begin), m_begin_and_end(begin_and_end),
+            m_is_bottom(is_bottom) {}
 };
 
 class ctx_offsets_t {
@@ -184,6 +235,7 @@ class offset_domain_t final {
     offset_domain_t narrow(const offset_domain_t& other) const;
     //forget
     void operator-=(variable_t var);
+    void operator-=(register_t reg) { m_reg_state -= reg; }
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
@@ -220,14 +272,23 @@ class offset_domain_t final {
 
     void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, location_t loc);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
-    void do_bin(const Bin&, std::optional<int>, std::optional<ptr_or_mapfd_t>,
-            std::optional<ptr_or_mapfd_t>, location_t);
-    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&);
+    interval_t do_bin(const Bin&, const std::optional<interval_t>&,
+            const std::optional<interval_t>&,
+            std::optional<ptr_or_mapfd_t>&,
+            std::optional<ptr_or_mapfd_t>&, location_t);
+    bool upper_bound_satisfied(const dist_t&, int, int, bool) const;
+    bool lower_bound_satisfied(const dist_t&, int) const;
+    bool check_packet_access(const Reg&, int, int, bool) const;
+    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&,
+            std::optional<interval_t>, std::optional<interval_t>) const;
 
     std::optional<dist_t> find_in_ctx(int) const;
     std::optional<dist_t> find_in_stack(int) const;
-    std::optional<dist_t> find_in_registers(const reg_with_loc_t) const;
+    std::optional<dist_t> find_offset_at_loc(const reg_with_loc_t) const;
     std::optional<dist_t> find_offset_info(register_t reg) const;
+    void update_offset_info(const dist_t&&, const interval_t&&,
+        const reg_with_loc_t&, uint8_t, Bin::Op);
+    dist_t update_offset(const dist_t&, const weight_t&, const interval_t&, Bin::Op);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
 }; // end offset_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 63f78834f..22519b75d 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -70,7 +70,7 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | std::move(other.m_region), m_offset | std::move(m_offset));
+    return type_domain_t(m_region | std::move(other.m_region), m_offset | std::move(other.m_offset));
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -176,7 +176,6 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
             m_region.set_registers_to_top();
         }
     }
-    else {}
     m_offset(s, loc, print);
 }
 
@@ -187,7 +186,8 @@ void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print)
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
     m_region(s, loc);
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    m_offset.check_valid_access(s, reg_type);
+    std::optional<interval_t> width_interval = {};
+    m_offset.check_valid_access(s, reg_type, std::nullopt, width_interval);
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
@@ -253,7 +253,9 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
     auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
     auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
+        auto mapfd = maybe_mapfd.value();
         if (is_mapfd_type(maybe_mapfd)) {
+            // TODO: define width
             auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
@@ -274,10 +276,11 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
                 }
             }
             else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_basereg)) {
-                // We do not check packet ptr accesses yet
-                return;
+                if (m_offset.check_packet_access(u.access_reg, width, 0, true)) return;
+            }
+            else {
+                m_errors.push_back("Only stack or packet can be used as a parameter");
             }
-            m_errors.push_back("Only stack or packet can be used as a parameter");
         }
     }
     //std::cout << "type error: valid map key value assertion failed\n";
@@ -321,13 +324,17 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     // for all operations except mov, add, sub, the src and dst should be numbers
     if ((src_ptr_or_mapfd || dst_ptr_or_mapfd)
             && (bin.op != Op::MOV && bin.op != Op::ADD && bin.op != Op::SUB)) {
-        //std::cout << "type error: operation on pointers not allowed\n";
-        m_errors.push_back("operation on pointers not allowed");
+        std::cout << "type error: operation on pointers not allowed\n";
         m_region -= bin.dst.v;
+        m_offset -= bin.dst.v;
         return;
     }
-    m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
-    m_offset.do_bin(bin, std::nullopt, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+
+    interval_t subtracted_reg =
+        m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+    interval_t subtracted_off =
+        m_offset.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+    auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,

From 706bf396db39b0a47c0ba28d4157a9e04b388667 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 9 Aug 2023 16:47:13 -0400
Subject: [PATCH 117/373] Error reporting similar to how zoneCrab reports
 errors

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 33 +++++++++++++++++++++------------
 src/crab/offset_domain.hpp |  2 +-
 src/crab/type_domain.cpp   |  3 ++-
 3 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 27a95ca3a..34a21aa95 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -533,8 +533,8 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
             if (!dist_left && !dist_right) {
                 // this should not happen, comparison between a packet pointer and either
                 // other region's pointers or numbers; possibly raise type error
-                //exit(1);
-                std::cout << "type_error: one of the pointers being compared isn't packet pointer\n";
+                m_errors.push_back("one of the pointers being compared isn't packet pointer");
+                //std::cout << "type_error: one of the pointers being compared isn't packet pointer\n";
                 return;
             }
             dist_t left_reg_dist = dist_left.value();
@@ -627,7 +627,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             }
             auto src_offset_opt = m_reg_state.find(src.v);
             if (!src_offset_opt) {
-                std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                m_errors.push_back("src is a packet_pointer and no offset info found");
+                //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
                 return interval_t::bottom();
             }
             m_reg_state.insert(bin.dst.v, reg_with_loc, src_offset_opt.value());
@@ -645,7 +646,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
                 auto dst_offset_opt = m_reg_state.find(bin.dst.v);
                 if (!dst_offset_opt) {
-                    std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
+                    m_errors.push_back("dst is a packet_pointer and no offset info found");
+                    //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
                     m_reg_state -= bin.dst.v;
                     return interval_t::bottom();
                 }
@@ -655,7 +657,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             else {
                 auto src_offset_opt = m_reg_state.find(src.v);
                 if (!src_offset_opt) {
-                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                    m_errors.push_back("src is a packet_pointer and no offset info found");
+                    //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
                     m_reg_state -= bin.dst.v;
                     return interval_t::bottom();
                 }
@@ -678,7 +681,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
                 auto dst_offset_opt = m_reg_state.find(bin.dst.v);
                 if (!dst_offset_opt) {
-                    std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
+                    m_errors.push_back("dst is a packet_pointer and no offset info found");
+                    //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
                     m_reg_state -= bin.dst.v;
                     return interval_t::bottom();
                 }
@@ -688,7 +692,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             else {
                 auto src_offset_opt = m_reg_state.find(src.v);
                 if (!src_offset_opt) {
-                    std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+                    m_errors.push_back("src is a packet_pointer and no offset info found");
+                    //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
                     m_reg_state -= bin.dst.v;
                     return interval_t::bottom();
                 }
@@ -824,14 +829,15 @@ bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
         std::optional<ptr_or_mapfd_t>& reg_type,
-        std::optional<interval_t>, std::optional<interval_t>) const {
+        std::optional<interval_t>, std::optional<interval_t>) {
     if (std::holds_alternative<Reg>(s.width)) return;
     int w = std::get<Imm>(s.width).v;
     if (w == 0 || !reg_type) return;
 
     bool is_comparison_check = s.width == (Value)Imm{0};
     if (check_packet_access(s.reg, w, s.offset, is_comparison_check)) return;
-    std::cout << "valid access assert fail\n";
+    m_errors.push_back("valid access check failed");
+    //std::cout << "type_error: valid access assert fail\n";
     //exit(1);
 }
 
@@ -857,14 +863,16 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>&
         auto basereg_off = basereg_with_off.get_offset().to_interval();
         auto basereg_off_singleton = basereg_off.singleton();
         if (!basereg_off_singleton) {
-            std::cout << "type_error: basereg offset is not a singleton\n";
+            m_errors.push_back("basereg offset is not a singleton");
+            //std::cout << "type_error: basereg offset is not a singleton\n";
             return;
         }
         auto store_at = (int)(*basereg_off_singleton + offset);
         //if (is_packet_pointer(targetreg_type)) {
             auto it = m_reg_state.find(target_reg.v);
             if (!it) {
-                std::cout << "type_error: register is a packet_pointer and no offset info found\n";
+                m_errors.push_back("register is a packet_pointer and no offset info found");
+                //std::cout << "type_error: register is a packet_pointer and no offset info found\n";
                 m_stack_state -= store_at;
                 return;
             }
@@ -890,7 +898,8 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
         auto p_with_off = std::get<ptr_with_off_t>(basereg_ptr_type);
         auto offset_singleton = p_with_off.get_offset().to_interval().singleton();
         if (!offset_singleton) {
-            std::cout << "type_error: basereg offset is not a singleton\n";
+            m_errors.push_back("basereg offset is not a singleton");
+            //std::cout << "type_error: basereg offset is not a singleton\n";
             m_reg_state -= target_reg.v;
             return;
         }
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index cdfb33992..902fc48f2 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -280,7 +280,7 @@ class offset_domain_t final {
     bool lower_bound_satisfied(const dist_t&, int) const;
     bool check_packet_access(const Reg&, int, int, bool) const;
     void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&,
-            std::optional<interval_t>, std::optional<interval_t>) const;
+            std::optional<interval_t>, std::optional<interval_t>);
 
     std::optional<dist_t> find_in_ctx(int) const;
     std::optional<dist_t> find_in_stack(int) const;
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 22519b75d..af6c1b8ed 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -324,7 +324,8 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     // for all operations except mov, add, sub, the src and dst should be numbers
     if ((src_ptr_or_mapfd || dst_ptr_or_mapfd)
             && (bin.op != Op::MOV && bin.op != Op::ADD && bin.op != Op::SUB)) {
-        std::cout << "type error: operation on pointers not allowed\n";
+        m_errors.push_back("operation on pointers not allowed");
+        //std::cout << "type error: operation on pointers not allowed\n";
         m_region -= bin.dst.v;
         m_offset -= bin.dst.v;
         return;

From ca74001b966d900eaf9d86fa5d7bf2df5545346a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 10 Aug 2023 12:07:16 -0400
Subject: [PATCH 118/373] Better handling of stack in Offset domain, fixing
 some error handling

Support for widths in the stack, similar to Region domain;
Changed the stack to a map instead of an unordered_map, and support for forgetting overlapping cells;
Multiple fixes in transformers, related to access of Offset domain --
the execution was going into Offset domain even when packet pointers
were not involved, hence added checks

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 109 +++++++++++++++++++++++--------------
 src/crab/offset_domain.hpp |  16 ++++--
 src/crab/type_domain.cpp   |  30 ++++++----
 src/crab/type_domain.hpp   |   3 +-
 4 files changed, 100 insertions(+), 58 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 34a21aa95..2b97e3358 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -143,6 +143,27 @@ std::optional<dist_t> registers_state_t::find(register_t key) const {
     return find(reg);
 }
 
+std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int width) const {
+    std::vector<uint64_t> overlapping_cells;
+    auto it = m_slot_dists.begin();
+    while (it != m_slot_dists.end() && it->first < start) {
+        it++;
+    }
+    if (it != m_slot_dists.begin()) {
+        it--;
+        auto key = it->first;
+        auto width_key = it->second.second;
+        if (key < start && key+width_key > start) overlapping_cells.push_back(key);
+    }
+
+    for (; it != m_slot_dists.end(); it++) {
+        auto key = it->first;
+        if (key >= start && key < start+width) overlapping_cells.push_back(key);
+        if (key >= start+width) break;
+    }
+    return overlapping_cells;
+}
+
 void registers_state_t::set_to_top() {
     m_cur_def = live_registers_t{nullptr};
     m_is_bottom = false;
@@ -246,23 +267,29 @@ stack_state_t stack_state_t::top() {
     return stack_state_t(false);
 }
 
-std::optional<dist_t> stack_state_t::find(int key) const {
+std::optional<dist_cells_t> stack_state_t::find(uint64_t key) const {
     auto it = m_slot_dists.find(key);
     if (it == m_slot_dists.end()) return {};
     return it->second;
 }
 
-void stack_state_t::store(int key, dist_t d) {
-    m_slot_dists[key] = d;
+void stack_state_t::store(uint64_t key, dist_t d, int width) {
+    m_slot_dists[key] = std::make_pair(d, width);
 }
 
-void stack_state_t::operator-=(int to_erase) {
+void stack_state_t::operator-=(uint64_t to_erase) {
     if (is_bottom()) {
         return;
     }
     m_slot_dists.erase(to_erase);
 }
 
+void stack_state_t::operator-=(const std::vector<uint64_t>& keys) {
+    for (auto &key : keys) {
+       *this -= key;
+    }
+}
+
 stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -270,10 +297,20 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
         return *this;
     }
     stack_slot_dists_t out_stack_dists;
+    // We do not join dist cells because different dist values different types of offsets
     for (auto const&kv: m_slot_dists) {
-        auto it = other.m_slot_dists.find(kv.first);
-        if (it != m_slot_dists.end() && kv.second == it->second)
-            out_stack_dists.insert(kv);
+        auto maybe_dist_cells = other.find(kv.first);
+        if (maybe_dist_cells) {
+            auto dist_cells1 = kv.second;
+            auto dist_cells2 = *maybe_dist_cells;
+            auto dist1 = dist_cells1.first;
+            auto dist2 = dist_cells2.first;
+            int width1 = dist_cells1.second;
+            int width2 = dist_cells2.second;
+            if (dist1 == dist2 && width1 == width2) {
+                out_stack_dists.insert(kv);
+            }
+        }
     }
     return stack_state_t(std::move(out_stack_dists), false);
 }
@@ -530,7 +567,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
             auto right_reg = std::get<Reg>(cond.right).v;
             auto dist_left = m_reg_state.find(cond.left.v);
             auto dist_right = m_reg_state.find(right_reg);
-            if (!dist_left && !dist_right) {
+            if (!dist_left || !dist_right) {
                 // this should not happen, comparison between a packet pointer and either
                 // other region's pointers or numbers; possibly raise type error
                 m_errors.push_back("one of the pointers being compared isn't packet pointer");
@@ -849,40 +886,32 @@ void offset_domain_t::operator()(const basic_block_t& bb, int print) {
     // nothing to do here
 }
 
-void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_type) {
-    std::optional<ptr_or_mapfd_t> reg_type = {};
-    if (!std::holds_alternative<Reg>(b.value)) {
-        // remove the offset from the stack or nothing
-        return;
+void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> maybe_targetreg_type, std::optional<ptr_or_mapfd_t>& maybe_basereg_type) {
+    bool target_is_reg = std::holds_alternative<Reg>(b.value);
+    if (target_is_reg) {
     }
-    Reg target_reg = std::get<Reg>(b.value);
 
     int offset = b.access.offset;
-    if (is_stack_pointer(basereg_type)) {
-        auto basereg_with_off = std::get<ptr_with_off_t>(*basereg_type);
-        auto basereg_off = basereg_with_off.get_offset().to_interval();
-        auto basereg_off_singleton = basereg_off.singleton();
-        if (!basereg_off_singleton) {
-            m_errors.push_back("basereg offset is not a singleton");
-            //std::cout << "type_error: basereg offset is not a singleton\n";
-            return;
-        }
-        auto store_at = (int)(*basereg_off_singleton + offset);
-        //if (is_packet_pointer(targetreg_type)) {
-            auto it = m_reg_state.find(target_reg.v);
-            if (!it) {
-                m_errors.push_back("register is a packet_pointer and no offset info found");
-                //std::cout << "type_error: register is a packet_pointer and no offset info found\n";
-                m_stack_state -= store_at;
+    int width = b.access.width;
+
+    if (is_stack_pointer(maybe_basereg_type)) {
+        auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
+        auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
+        if (!basereg_off_singleton) return;
+        auto store_at = (uint64_t)(*basereg_off_singleton + offset);
+        auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
+        m_stack_state -= overlapping_cells;
+
+        if (!is_packet_pointer(maybe_targetreg_type)) return;
+        auto target_reg = std::get<Reg>(b.value);
+        auto offset_info = m_reg_state.find(target_reg.v);
+        if (!offset_info) {
+            m_errors.push_back("register is a packet_pointer and no offset info found");
+            //std::cout << "type_error: register is a packet_pointer and no offset info found\n";
                 return;
-            }
-            m_stack_state.store(store_at, it.value());
-        //}
-        //else {
-            //m_stack_state -= store_at;
-        //}
+        }
+        m_stack_state.store(store_at, *offset_info, width);
     }
-    else {}  // in the rest cases, we do not store
 }
 
 void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
@@ -932,9 +961,9 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
                 m_reg_state -= target_reg.v;
                 return;
             }
-            dist_t d = it.value();
+            dist_t d = it->first;
             auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_reg_state.insert(target_reg.v, reg, dist_t(d));
+            m_reg_state.insert(target_reg.v, reg, d);
         }
         else {  // shared
             m_reg_state -= target_reg.v;
@@ -953,7 +982,7 @@ std::optional<dist_t> offset_domain_t::find_in_ctx(int key) const {
     return m_ctx_dists->find(key);
 }
 
-std::optional<dist_t> offset_domain_t::find_in_stack(int key) const {
+std::optional<dist_cells_t> offset_domain_t::find_in_stack(int key) const {
     return m_stack_state.find(key);
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 902fc48f2..22267368d 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -131,17 +131,20 @@ class registers_state_t {
         void print_all_register_types() const;
 };
 
+using dist_cells_t = std::pair<dist_t, int>;
+using stack_slot_dists_t = std::map<uint64_t, dist_cells_t>;    // represents `sp[n] = dist;`, where n \belongs [0,511], e.g., `sp[508] = begin+16`
+
 class stack_state_t {
-    using stack_slot_dists_t = std::unordered_map<int, dist_t>;    // represents `sp[n] = dist;`, where n \belongs [0,511], e.g., `sp[508] = begin+16`
 
     stack_slot_dists_t m_slot_dists;
     bool m_is_bottom = false;
 
     public:
         stack_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        std::optional<dist_t> find(int) const;
-        void store(int, dist_t);
-        void operator-=(int);
+        std::optional<dist_cells_t> find(uint64_t) const;
+        void store(uint64_t, dist_t, int);
+        void operator-=(uint64_t);
+        void operator-=(const std::vector<uint64_t>&);
         void set_to_top();
         void set_to_bottom();
         bool is_bottom() const;
@@ -150,6 +153,7 @@ class stack_state_t {
         stack_state_t operator|(const stack_state_t&) const;
         explicit stack_state_t(stack_slot_dists_t&& stack_dists, bool is_bottom = false)
             : m_slot_dists(std::move(stack_dists)), m_is_bottom(is_bottom) {}
+        std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
 };
 
 class extra_constraints_t {
@@ -271,7 +275,7 @@ class offset_domain_t final {
     void set_require_check(check_require_func_t f) {}
 
     void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, location_t loc);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<interval_t>&,
             std::optional<ptr_or_mapfd_t>&,
@@ -283,7 +287,7 @@ class offset_domain_t final {
             std::optional<interval_t>, std::optional<interval_t>);
 
     std::optional<dist_t> find_in_ctx(int) const;
-    std::optional<dist_t> find_in_stack(int) const;
+    std::optional<dist_cells_t> find_in_stack(int) const;
     std::optional<dist_t> find_offset_at_loc(const reg_with_loc_t) const;
     std::optional<dist_t> find_offset_info(register_t reg) const;
     void update_offset_info(const dist_t&&, const interval_t&&,
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index af6c1b8ed..1de48d0a2 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -164,6 +164,9 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
         const auto& right_reg = std::get<Reg>(right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
         if (maybe_left_type && maybe_right_type) {
+            if (is_packet_ptr(maybe_left_type) && is_packet_ptr(maybe_right_type)) {
+                m_offset(s, loc, print);
+            }
             // both pointers
         }
         else if (!maybe_left_type && !maybe_right_type) {
@@ -176,7 +179,6 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
             m_region.set_registers_to_top();
         }
     }
-    m_offset(s, loc, print);
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
@@ -184,10 +186,14 @@ void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print)
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
-    m_region(s, loc);
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    std::optional<interval_t> width_interval = {};
-    m_offset.check_valid_access(s, reg_type, std::nullopt, width_interval);
+    if (reg_type) {
+        m_region(s, loc);
+        std::optional<interval_t> width_interval = {};
+        if (is_packet_ptr(reg_type)) {
+            m_offset.check_valid_access(s, reg_type, std::nullopt, width_interval);
+        }
+    }
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
@@ -344,10 +350,10 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_pt
     m_offset.do_load(b, target_reg, basereg_opt, loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt,
-        location_t loc, int print) {
+void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> target_opt,
+        std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc, int print) {
     m_region.do_mem_store(b, loc);
-    m_offset.do_mem_store(b, basereg_opt);
+    m_offset.do_mem_store(b, target_opt, basereg_opt);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
@@ -359,12 +365,14 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
         m_errors.push_back(
                 std::string("load/store using an unknown pointer, or number - r") + s);
     }
-    if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, ptr_or_mapfd_opt, loc, print);
-    }
-    else if (std::holds_alternative<Reg>(b.value)) {
+    if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
+        auto targetreg_type = m_region.find_ptr_or_mapfd_type(targetreg.v);
         if (b.is_load) do_load(b, targetreg, unknown_ptr, ptr_or_mapfd_opt, loc, print);
+        else if (!unknown_ptr) do_mem_store(b, targetreg_type, ptr_or_mapfd_opt, loc, print);
+    }
+    else if (!unknown_ptr && !b.is_load) {
+        do_mem_store(b, std::nullopt, ptr_or_mapfd_opt, loc, print);
     }
 }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 89901e70b..c7b944804 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -90,7 +90,8 @@ class type_domain_t final {
 
     void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
             location_t, int print = 0);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&, location_t, int print = 0);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&,
+            location_t, int print = 0);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);

From ba13e3ac6968e4e3a0ea14e0add81546a9415a8b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 10 Aug 2023 16:31:07 -0400
Subject: [PATCH 119/373] Adding Offset information into printing, and removing
 some redundant code

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 57 ++++++++++----------------------------
 src/crab/type_domain.cpp   | 36 ++++++++++++++++--------
 src/crab/type_domain.hpp   |  1 +
 src/crab/type_ostream.cpp  | 26 +++++++++--------
 src/crab/type_ostream.hpp  | 11 ++++----
 5 files changed, 60 insertions(+), 71 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 2b97e3358..a5cf1ebca 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -236,14 +236,6 @@ void registers_state_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
-void registers_state_t::print_all_register_types() const {
-    std::cout << "\toffset types: {\n";
-    for (auto const& kv : *m_offset_env) {
-        std::cout << "\t\t" << kv.first << " : " << kv.second << "\n";
-    }
-    std::cout << "\t}\n";
-}
-
 void stack_state_t::set_to_top() {
     m_slot_dists.clear();
     m_is_bottom = false;
@@ -592,30 +584,6 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
     else {}     //we do not need to deal with other cases
 }
 
-bool is_packet_pointer(std::optional<ptr_or_mapfd_t>& type) {
-    if (!type) {    // not a pointer
-        return false;
-    }
-    auto ptr_or_mapfd_type = type.value();
-    if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)
-        && std::get<ptr_no_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_PACKET) {
-        return true;
-    }
-    return false;
-}
-
-bool is_stack_pointer(std::optional<ptr_or_mapfd_t>& type) {
-    if (!type) {    // not a pointer
-        return false;
-    }
-    auto ptr_or_mapfd_type = type.value();
-    if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)
-        && std::get<ptr_with_off_t>(ptr_or_mapfd_type).get_region() == crab::region_t::T_STACK) {
-        return true;
-    }
-    return false;
-}
-
 void offset_domain_t::update_offset_info(const dist_t&& dist, const interval_t&& change,
         const reg_with_loc_t& reg_with_loc, uint8_t reg, Bin::Op op) {
     auto offset = dist.m_dist;
@@ -636,6 +604,7 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
         const std::optional<interval_t>& dst_interval_opt,
         std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
         std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
+
     using Op = Bin::Op;
     // if both src and dst are numbers, nothing to do in offset domain
     // if we are doing a move, where src is a number and dst is not set, nothing to do
@@ -643,7 +612,7 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             || (src_interval_opt && !dst_ptr_or_mapfd_opt && bin.op == Op::MOV))
         return interval_t::bottom();
     // offset domain only handles packet pointers
-    if (!is_packet_pointer(src_ptr_or_mapfd_opt) && !is_packet_pointer(dst_ptr_or_mapfd_opt))
+    if (!is_packet_ptr(src_ptr_or_mapfd_opt) && !is_packet_ptr(dst_ptr_or_mapfd_opt))
         return interval_t::bottom();
 
     interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
@@ -658,7 +627,7 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
     {
         // ra = rb;
         case Op::MOV: {
-            if (!is_packet_pointer(src_ptr_or_mapfd_opt)) {
+            if (!is_packet_ptr(src_ptr_or_mapfd_opt)) {
                 m_reg_state -= bin.dst.v;
                 return interval_t::bottom();
             }
@@ -675,12 +644,12 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
         case Op::ADD: {
             dist_t dist_to_update;
             interval_t interval_to_add = interval_t::bottom();
-            if (is_packet_pointer(dst_ptr_or_mapfd_opt)
-                    && is_packet_pointer(src_ptr_or_mapfd_opt)) {
+            if (is_packet_ptr(dst_ptr_or_mapfd_opt)
+                    && is_packet_ptr(src_ptr_or_mapfd_opt)) {
                 m_reg_state -= bin.dst.v;
                 return interval_t::bottom();
             }
-            else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
+            else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
                 auto dst_offset_opt = m_reg_state.find(bin.dst.v);
                 if (!dst_offset_opt) {
                     m_errors.push_back("dst is a packet_pointer and no offset info found");
@@ -710,12 +679,12 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
         case Op::SUB: {
             dist_t dist_to_update;
             interval_t interval_to_sub = interval_t::bottom();
-            if (is_packet_pointer(dst_ptr_or_mapfd_opt)
-                    && is_packet_pointer(src_ptr_or_mapfd_opt)) {
+            if (is_packet_ptr(dst_ptr_or_mapfd_opt)
+                    && is_packet_ptr(src_ptr_or_mapfd_opt)) {
                 m_reg_state -= bin.dst.v;
                 return interval_t::top();
             }
-            else if (is_packet_pointer(dst_ptr_or_mapfd_opt) && src_interval_opt) {
+            else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
                 auto dst_offset_opt = m_reg_state.find(bin.dst.v);
                 if (!dst_offset_opt) {
                     m_errors.push_back("dst is a packet_pointer and no offset info found");
@@ -894,7 +863,7 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> m
     int offset = b.access.offset;
     int width = b.access.width;
 
-    if (is_stack_pointer(maybe_basereg_type)) {
+    if (is_stack_ptr(maybe_basereg_type)) {
         auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
         auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
         if (!basereg_off_singleton) return;
@@ -902,7 +871,7 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> m
         auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
         m_stack_state -= overlapping_cells;
 
-        if (!is_packet_pointer(maybe_targetreg_type)) return;
+        if (!is_packet_ptr(maybe_targetreg_type)) return;
         auto target_reg = std::get<Reg>(b.value);
         auto offset_info = m_reg_state.find(target_reg.v);
         if (!offset_info) {
@@ -974,6 +943,10 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
     }
 }
 
+void offset_domain_t::operator()(const Mem& b, location_t loc, int print) {
+    // nothing to do here
+}
+
 std::optional<dist_t> offset_domain_t::find_offset_at_loc(const reg_with_loc_t reg) const {
     return m_reg_state.find(reg);
 }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 1de48d0a2..5ae9c018c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -376,18 +376,15 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     }
 }
 
-// the method does not work well as it requires info about the label of basic block we are in
-// this info is not available when we are only printing any state
-// but it is available when we are processing a basic block for all its instructions:w
-//
 void type_domain_t::print_registers() const {
     std::cout << "  register types: {\n";
     for (size_t i = 0; i < NUM_REGISTERS; i++) {
         register_t reg = (register_t)i;
         auto maybe_ptr_or_mapfd_type = m_region.find_ptr_or_mapfd_type(reg);
+        auto maybe_offset_info = m_offset.find_offset_info(reg);
         if (maybe_ptr_or_mapfd_type) {
             std::cout << "    ";
-            print_register(std::cout, Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type);
+            print_register(std::cout, Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type, maybe_offset_info);
             std::cout << "\n";
         }
     }
@@ -398,10 +395,11 @@ void type_domain_t::print_ctx() const {
     std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
     std::cout << "  ctx: {\n";
     for (auto const& k : ctx_keys) {
-        auto ptr = m_region.find_in_ctx(k);
-        if (ptr) {
+        auto maybe_ptr = m_region.find_in_ctx(k);
+        auto maybe_dist = m_offset.find_in_ctx(k);
+        if (maybe_ptr) {
             std::cout << "    " << k << ": ";
-            print_ptr_type(std::cout, ptr_or_mapfd_t{ptr.value()});
+            print_ptr_type(std::cout, *maybe_ptr, maybe_dist);
             std::cout << ",\n";
         }
     }
@@ -413,18 +411,25 @@ void type_domain_t::print_stack() const {
     std::cout << "  stack: {\n";
     for (auto const& k : stack_keys_region) {
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
+        auto maybe_dist_cells = m_offset.find_in_stack(k);
         if (maybe_ptr_or_mapfd_cells) {
-            auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
+            auto ptr_or_mapfd_cells = *maybe_ptr_or_mapfd_cells;
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
+            std::optional<dist_t> maybe_dist = maybe_dist_cells ?
+                std::optional<dist_t>{maybe_dist_cells->first} : std::nullopt;
             std::cout << "    [" << k << "-" << k+width-1 << "] : ";
-            print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd);
+            print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, maybe_dist);
             std::cout << ",\n";
         }
     }
     std::cout << "  }\n";
 }
 
+// the method does not work well as it requires info about the label of basic block we are in
+// this info is not available when we are only printing any state
+// but it is available when we are processing a basic block for all its instructions:w
+//
 void type_domain_t::adjust_bb_for_types(location_t loc) {
     m_region.adjust_bb_for_types(loc);
     m_offset.adjust_bb_for_types(loc);
@@ -457,6 +462,11 @@ type_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_region.find_ptr_or_mapfd_at_loc(loc);
 }
 
+std::optional<crab::dist_t>
+type_domain_t::find_offset_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_offset.find_offset_at_loc(loc);
+}
+
 std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
     typ.write(o);
     return o;
@@ -493,7 +503,8 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
             auto b = std::get<Bin>(statement);
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
-            print_annotated(o, b, region);
+            auto offset = typ.find_offset_at_loc(reg_with_loc);
+            print_annotated(o, b, region, offset);
         }
         else if (std::holds_alternative<Mem>(statement)) {
             auto u = std::get<Mem>(statement);
@@ -501,7 +512,8 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
                 auto target_reg = std::get<Reg>(u.value);
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
                 auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
-                print_annotated(o, u, region);
+                auto offset = typ.find_offset_at_loc(target_reg_loc);
+                print_annotated(o, u, region, offset);
             }
             else o << "  " << u << "\n";
         }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index c7b944804..42efb4493 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -85,6 +85,7 @@ class type_domain_t final {
     void print_ctx() const;
     void print_stack() const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::dist_t> find_offset_at_loc(const crab::reg_with_loc_t&) const;
 
   private:
 
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 041b4ca93..20e21adea 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -3,28 +3,28 @@
 
 #include "crab/type_ostream.hpp"
 
-void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr) {
+void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::ptr_no_off_t>(ptr)) {
-        o << std::get<crab::ptr_no_off_t>(ptr);
+        o << std::get<crab::ptr_no_off_t>(ptr) << "<" << (d ? *d : crab::dist_t{}) << ">";
     }
 }
 
-void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or_mapfd) {
+void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or_mapfd, std::optional<crab::dist_t> d) {
     if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
         o << std::get<crab::mapfd_t>(ptr_or_mapfd);
     }
     else {
-        print_ptr_type(o, ptr_or_mapfd);
+        print_ptr_type(o, ptr_or_mapfd, d);
     }
 }
 
-void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d) {
     o << r << " : ";
     if (p) {
-        print_ptr_or_mapfd_type(o, p.value());
+        print_ptr_or_mapfd_type(o, *p, d);
     }
 }
 
@@ -32,25 +32,27 @@ inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8
 
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p);
+    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, std::nullopt);
     o << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
+        std::optional<crab::dist_t>& d) {
     o << "  ";
-    print_register(o, b.dst, p);
+    print_register(o, b.dst, p, d);
     o << " " << b.op << "= " << b.v << "\n";
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(o, u.dst, p);
+    print_register(o, u.dst, p, std::nullopt);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
+        std::optional<crab::dist_t>& d) {
     o << "  ";
-    print_register(o, std::get<Reg>(b.value), p);
+    print_register(o, std::get<Reg>(b.value), p, d);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
     int offset = std::abs(b.access.offset);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 11e7e2303..b1427e504 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -7,11 +7,12 @@
 #include "asm_syntax.hpp"
 #include "asm_ostream.hpp"
 #include "crab/common.hpp"
+#include "crab/offset_domain.hpp"
 
-void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&);
-void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr);
-void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&, std::optional<crab::dist_t>);
+void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t>);
+void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>);
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&);
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p);
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&);

From 2e39d00c6b3fe1bdea92cbb168262b1ce3a9b0bb Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 15 Aug 2023 18:59:57 -0400
Subject: [PATCH 120/373] Multiple fixes and refactoring

Adding extra checks as interval domain has not been implemented yet;
Fixing shared region checks in Load operation;
Fixing error reporting, as it was previously wrongly copied to multiple
basic blocks;
Multiple refactorings;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 84 +++++++++++++++++---------------------
 src/crab/offset_domain.hpp |  1 +
 src/crab/type_domain.cpp   | 10 ++---
 src/crab/type_ostream.cpp  |  2 +-
 src/crab/type_ostream.hpp  |  2 +-
 5 files changed, 45 insertions(+), 54 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index a5cf1ebca..bbf335f59 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -660,7 +660,8 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
                 dist_to_update = std::move(dst_offset_opt.value());
                 interval_to_add = std::move(src_interval_opt.value());
             }
-            else {
+            // Condition might not be necessary once interval domain is added
+            else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_interval_opt) {
                 auto src_offset_opt = m_reg_state.find(src.v);
                 if (!src_offset_opt) {
                     m_errors.push_back("src is a packet_pointer and no offset info found");
@@ -671,6 +672,11 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
                 dist_to_update = std::move(src_offset_opt.value());
                 interval_to_add = std::move(dst_interval_opt.value());
             }
+            else if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
+                // this case is only needed till interval domain is added
+                m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t());
+                break;
+            }
             update_offset_info(std::move(dist_to_update), std::move(interval_to_add),
                     reg_with_loc, bin.dst.v, bin.op);
             break;
@@ -885,61 +891,45 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> m
 
 void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
         std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
-    if (!basereg_type) {
+
+    bool is_stack_p = is_stack_ptr(basereg_type);
+    bool is_ctx_p = is_ctx_ptr(basereg_type);
+
+    if (!is_stack_p && !is_ctx_p) {
         m_reg_state -= target_reg.v;
         return;
     }
-    auto basereg_ptr_type = basereg_type.value();
+
     int offset = b.access.offset;
-    
-    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_type)) {
-        auto p_with_off = std::get<ptr_with_off_t>(basereg_ptr_type);
-        auto offset_singleton = p_with_off.get_offset().to_interval().singleton();
-        if (!offset_singleton) {
-            m_errors.push_back("basereg offset is not a singleton");
-            //std::cout << "type_error: basereg offset is not a singleton\n";
+    auto type_with_off = std::get<ptr_with_off_t>(*basereg_type);
+    auto p_offset = type_with_off.get_offset();
+    auto offset_singleton = p_offset.to_interval().singleton();
+    if (!offset_singleton) {
+        m_reg_state -= target_reg.v;
+        return;
+    }
+    auto ptr_offset = *offset_singleton;
+    auto load_at = (uint64_t)(ptr_offset + offset);
+
+    if (is_stack_p) {
+        auto it = m_stack_state.find(load_at);
+        if (!it) {
             m_reg_state -= target_reg.v;
             return;
         }
-
-        if (p_with_off.get_region() == crab::region_t::T_CTX) {
-            if (!offset_singleton) {
-                m_reg_state -= target_reg.v;
-                return;
-            }
-            auto load_at = (uint64_t)offset_singleton.value() + (uint64_t)offset;
-            auto it = m_ctx_dists->find(load_at);
-            if (!it) {
-                m_reg_state -= target_reg.v;
-                return;
-            }
-            dist_t d = it.value();
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_reg_state.insert(target_reg.v, reg, dist_t(d));
-        }
-        else if (p_with_off.get_region() == crab::region_t::T_STACK) {
-            if (!offset_singleton) {
-                m_reg_state -= target_reg.v;
-                return;
-            }
-            auto ptr_offset = offset_singleton.value();
-            auto load_at = (uint64_t)(ptr_offset + offset);
-            auto it = m_stack_state.find(load_at);
-
-            if (!it) {
-                m_reg_state -= target_reg.v;
-                return;
-            }
-            dist_t d = it->first;
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_reg_state.insert(target_reg.v, reg, d);
-        }
-        else {  // shared
+        dist_t d = it->first;
+        auto reg = reg_with_loc_t(target_reg.v, loc);
+        m_reg_state.insert(target_reg.v, reg, d);
+    }
+    else if (is_ctx_p) {
+        auto it = m_ctx_dists->find(load_at);
+        if (!it) {
             m_reg_state -= target_reg.v;
+            return;
         }
-    }
-    else {  // we are loading from packet, or we have mapfd
-        m_reg_state -= target_reg.v;
+        dist_t d = it.value();
+        auto reg = reg_with_loc_t(target_reg.v, loc);
+        m_reg_state.insert(target_reg.v, reg, dist_t(d));
     }
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 22267368d..ada6aa1a8 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -295,6 +295,7 @@ class offset_domain_t final {
     dist_t update_offset(const dist_t&, const weight_t&, const interval_t&, Bin::Op);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+    void reset_errors() { m_errors.clear(); }
 }; // end offset_domain_t
 
 } // end namespace crab
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 5ae9c018c..caa623f33 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -340,7 +340,7 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     interval_t subtracted_reg =
         m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     interval_t subtracted_off =
-        m_offset.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+        m_offset.do_bin(bin, src_interval, std::nullopt, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
 }
 
@@ -426,10 +426,6 @@ void type_domain_t::print_stack() const {
     std::cout << "  }\n";
 }
 
-// the method does not work well as it requires info about the label of basic block we are in
-// this info is not available when we are only printing any state
-// but it is available when we are processing a basic block for all its instructions:w
-//
 void type_domain_t::adjust_bb_for_types(location_t loc) {
     m_region.adjust_bb_for_types(loc);
     m_offset.adjust_bb_for_types(loc);
@@ -441,6 +437,10 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
         print_annotated(std::cout, *this, bb, print);
         return;
     }
+    // A temporary fix to avoid printing errors for multiple basic blocks
+    m_errors.clear();
+    m_region.reset_errors();
+    m_offset.reset_errors();
 
     auto label = bb.label();
     uint32_t curr_pos = 0;
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 20e21adea..28eb6e139 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -21,7 +21,7 @@ void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or
     }
 }
 
-void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d) {
+void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d) {
     o << r << " : ";
     if (p) {
         print_ptr_or_mapfd_type(o, *p, d);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index b1427e504..5e8e10251 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -11,7 +11,7 @@
 
 void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&, std::optional<crab::dist_t>);
 void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t>);
-void print_register(std::ostream& o, const Reg& r, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>);
+void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>);
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&);
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);

From 2c6dc7c1dc4a262d390f550003a5a80c7c458d96 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 15 Aug 2023 23:47:20 -0400
Subject: [PATCH 121/373] Refactoring of redundant code

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index bbf335f59..ade57da3b 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -862,10 +862,6 @@ void offset_domain_t::operator()(const basic_block_t& bb, int print) {
 }
 
 void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> maybe_targetreg_type, std::optional<ptr_or_mapfd_t>& maybe_basereg_type) {
-    bool target_is_reg = std::holds_alternative<Reg>(b.value);
-    if (target_is_reg) {
-    }
-
     int offset = b.access.offset;
     int width = b.access.width;
 

From 141049287a8059181cbc533286d94b5491cce47c Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 19 Aug 2023 03:52:37 -0400
Subject: [PATCH 122/373] Initial implementation for interval propagation
 domain

Implemented transformers including Bin, Call, Mem, etc;
Implemented Assert and Assume checks;
Implemented correct representation of stack storing both intervals and their widths;
Implemented join operations;
Proper printing of intervals through the type domain;
Added error reporting;
Intervals are actually stored as mock_interval_t, instead of interval_t, since the default constructor of interval_t is, by default, private. Hence it creates issues when storing;
---
 src/crab/abstract_domain.cpp      |   5 +
 src/crab/interval_prop_domain.cpp | 789 ++++++++++++++++++++++++++++++
 src/crab/interval_prop_domain.hpp | 164 +++++++
 src/crab/type_domain.cpp          | 128 +++--
 src/crab/type_domain.hpp          |  12 +-
 src/crab/type_ostream.cpp         |  10 +
 src/crab/type_ostream.hpp         |   1 +
 src/crab_verifier.cpp             |   1 +
 8 files changed, 1063 insertions(+), 47 deletions(-)
 create mode 100644 src/crab/interval_prop_domain.cpp
 create mode 100644 src/crab/interval_prop_domain.hpp

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 392a130f0..6ab87d730 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -1,7 +1,11 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
 #include "abstract_domain.hpp"
 #include "ebpf_domain.hpp"
 #include "type_domain.hpp"
 #include "region_domain.hpp"
+#include "interval_prop_domain.hpp"
 #include "offset_domain.hpp"
 
 template <typename Domain>
@@ -296,3 +300,4 @@ template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::type_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::region_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::offset_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::interval_prop_domain_t);
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
new file mode 100644
index 000000000..60c482e98
--- /dev/null
+++ b/src/crab/interval_prop_domain.cpp
@@ -0,0 +1,789 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/interval_prop_domain.hpp"
+
+namespace crab {
+
+bool registers_cp_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool registers_cp_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    if (m_interval_env == nullptr) return true;
+    for (auto it : m_cur_def) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+void registers_cp_state_t::set_to_top() {
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+void registers_cp_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+void registers_cp_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
+        interval_t interval) {
+    (*m_interval_env)[reg_with_loc] = mock_interval_t(interval);
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<mock_interval_t> registers_cp_state_t::find(reg_with_loc_t reg) const {
+    auto it = m_interval_env->find(reg);
+    if (it == m_interval_env->end()) return {};
+    return it->second;
+}
+
+std::optional<mock_interval_t> registers_cp_state_t::find(register_t key) const {
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    return find(reg);
+}
+
+registers_cp_state_t registers_cp_state_t::operator|(const registers_cp_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    live_registers_t intervals_joined;
+    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2) {
+            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
+            auto reg = reg_with_loc_t((register_t)i, loc);
+            intervals_joined[i] = std::make_shared<reg_with_loc_t>(reg);
+            (*m_interval_env)[reg] = mock_interval_t(interval1 | interval2);
+        }
+    }
+    return registers_cp_state_t(std::move(intervals_joined), m_interval_env);
+}
+
+void registers_cp_state_t::adjust_bb_for_registers(location_t loc) {
+    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    for (size_t i = 0; i < m_cur_def.size(); i++) {
+        auto new_reg = reg_with_loc_t((register_t)i, loc);
+        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
+
+        auto it = find((register_t)i);
+        if (!it) continue;
+
+        if (*m_cur_def[i] == old_reg)
+            m_interval_env->erase(old_reg);
+
+        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
+        (*m_interval_env)[new_reg] = mock_interval_t(it.value());
+
+    }
+}
+
+void registers_cp_state_t::operator-=(register_t var) {
+    if (is_bottom()) {
+        return;
+    }
+    m_cur_def[var] = nullptr;
+}
+
+void registers_cp_state_t::print_all_register_types() const {
+    std::cout << "\tinterval types: {\n";
+    for (auto const& kv : *m_interval_env) {
+        std::cout << "\t\t" << kv.first << " : " << kv.second.to_interval() << "\n";
+    }
+    std::cout << "\t}\n";
+}
+
+bool stack_cp_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool stack_cp_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    return m_interval_values.empty();
+}
+
+void stack_cp_state_t::set_to_top() {
+    m_interval_values.clear();
+    m_is_bottom = false;
+}
+
+void stack_cp_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+stack_cp_state_t stack_cp_state_t::top() {
+    return stack_cp_state_t(false);
+}
+
+std::optional<interval_cells_t> stack_cp_state_t::find(uint64_t key) const {
+    auto it = m_interval_values.find(key);
+    if (it == m_interval_values.end()) return {};
+    return it->second;
+}
+
+void stack_cp_state_t::store(uint64_t key, mock_interval_t val, int width) {
+    m_interval_values[key] = std::make_pair(val, width);
+}
+
+void stack_cp_state_t::operator-=(uint64_t key) {
+    auto it = find(key);
+    if (it)
+        m_interval_values.erase(key);
+}
+
+bool stack_cp_state_t::all_numeric(uint64_t start_loc, int width) const {
+    auto overlapping_cells = find_overlapping_cells(start_loc, width);
+    if (overlapping_cells.empty()) return false;
+    for (std::size_t i = 0; i < overlapping_cells.size()-1; i++) {
+        int width_i = find(overlapping_cells[i]).value().second;
+        if (overlapping_cells[i]+width_i != overlapping_cells[i+1]) return false;
+    }
+    return true;
+}
+
+void stack_cp_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
+    for (auto& key : keys) {
+        auto type = find(key);
+        auto width_key = type.value().second;
+        if (key < start) {
+            int new_width = start-key;
+            store(key, interval_t::top(), new_width);
+        }
+        if (key+width_key > start+width) {
+            int new_width = key+width_key-(start+width);
+            store(start+width, interval_t::top(), new_width);
+        }
+        if (key >= start) *this -= key;
+    }
+}
+
+std::vector<uint64_t> stack_cp_state_t::find_overlapping_cells(uint64_t start, int width) const {
+    std::vector<uint64_t> overlapping_cells;
+    auto it = m_interval_values.begin();
+    while (it != m_interval_values.end() && it->first < start) {
+        it++;
+    }
+    if (it != m_interval_values.begin()) {
+        it--;
+        auto key = it->first;
+        auto width_key = it->second.second;
+        if (key < start && key+width_key > start) overlapping_cells.push_back(key);
+    }
+
+    for (; it != m_interval_values.end(); it++) {
+        auto key = it->first;
+        if (key >= start && key < start+width) overlapping_cells.push_back(key);
+        if (key >= start+width) break;
+    }
+    return overlapping_cells;
+}
+
+void join_stack(const stack_cp_state_t& stack1, uint64_t key1, int& loc1,
+        const stack_cp_state_t& stack2, uint64_t key2, int& loc2,
+        interval_values_stack_t& interval_values_joined) {
+    auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
+    auto& cells1 = type1.value();   auto& cells2 = type2.value();
+    int width1 = cells1.second; int width2 = cells2.second;
+    auto interval1 = cells1.first.to_interval();
+    auto interval2 = cells2.first.to_interval();
+    auto top_interval_mock = mock_interval_t(interval_t::top());
+    if (key1 == key2) {
+        if (width1 == width2) {
+            interval_values_joined[key1] = std::make_pair(
+                    mock_interval_t(interval1 | interval2), width1);
+            loc1++; loc2++;
+        }
+        else if (width1 < width2) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
+            loc2++;
+        }
+    }
+    else if (key1 > key2) {
+        if (key2+width2 > key1+width1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else if (key2+width2 > key1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
+            loc2++;
+        }
+        else loc2++;
+    }
+    else {
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
+    }
+}
+
+stack_cp_state_t stack_cp_state_t::operator|(const stack_cp_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    interval_values_stack_t interval_values_joined;
+    auto stack1_keys = get_keys();
+    auto stack2_keys = other.get_keys();
+    int i = 0, j = 0;
+    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
+        int key1 = stack1_keys[i], key2 = stack2_keys[j];
+        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
+    }
+    return stack_cp_state_t(std::move(interval_values_joined));
+}
+
+size_t stack_cp_state_t::size() const {
+    return m_interval_values.size();
+}
+
+std::vector<uint64_t> stack_cp_state_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(size());
+
+    for (auto const&kv : m_interval_values) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
+bool interval_prop_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
+    return (m_registers_interval_values.is_bottom() || m_stack_slots_interval_values.is_bottom());
+}
+
+bool interval_prop_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_registers_interval_values.is_top() && m_stack_slots_interval_values.is_top());
+}
+
+interval_prop_domain_t interval_prop_domain_t::bottom() {
+    interval_prop_domain_t cp;
+    cp.set_to_bottom();
+    return cp;
+}
+
+void interval_prop_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+void interval_prop_domain_t::set_to_top() {
+    m_registers_interval_values.set_to_top();
+    m_stack_slots_interval_values.set_to_top();
+}
+
+std::optional<mock_interval_t> interval_prop_domain_t::find_interval_value(register_t reg) const {
+    return m_registers_interval_values.find(reg);
+}
+
+std::optional<mock_interval_t> interval_prop_domain_t::find_interval_at_loc(
+        const reg_with_loc_t reg) const {
+    return m_registers_interval_values.find(reg);
+}
+
+bool interval_prop_domain_t::operator<=(const interval_prop_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return true;
+}
+
+void interval_prop_domain_t::operator|=(const interval_prop_domain_t& abs) {
+    interval_prop_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void interval_prop_domain_t::operator|=(interval_prop_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+interval_prop_domain_t interval_prop_domain_t::operator|(const interval_prop_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return interval_prop_domain_t(m_registers_interval_values | other.m_registers_interval_values,
+            m_stack_slots_interval_values | other.m_stack_slots_interval_values);
+}
+
+interval_prop_domain_t interval_prop_domain_t::operator|(interval_prop_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return interval_prop_domain_t(m_registers_interval_values | std::move(other.m_registers_interval_values),
+            m_stack_slots_interval_values | std::move(other.m_stack_slots_interval_values));
+}
+
+interval_prop_domain_t interval_prop_domain_t::operator&(const interval_prop_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+interval_prop_domain_t interval_prop_domain_t::widen(const interval_prop_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+interval_prop_domain_t interval_prop_domain_t::narrow(const interval_prop_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+void interval_prop_domain_t::write(std::ostream& os) const {}
+
+std::string interval_prop_domain_t::domain_name() const {
+    return "interval_prop_domain";
+}
+
+crab::bound_t interval_prop_domain_t::get_instruction_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
+}
+
+string_invariant interval_prop_domain_t::to_set() {
+    return string_invariant{};
+}
+
+interval_prop_domain_t interval_prop_domain_t::setup_entry() {
+    std::shared_ptr<global_interval_env_t> all_intervals = std::make_shared<global_interval_env_t>();
+    registers_cp_state_t registers(all_intervals);
+
+    interval_prop_domain_t cp(std::move(registers), stack_cp_state_t::top());
+    return cp;
+}
+
+void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print) {
+    auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
+    m_registers_interval_values.insert(u.dst.v, reg_with_loc, interval_t::top());
+}
+
+void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+    m_registers_interval_values -= u.dst.v;
+}
+
+void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc, int print) {
+    auto reg_v = m_registers_interval_values.find(s.reg.v);
+    if (reg_v) {
+        auto reg_value = reg_v.value();
+        if ((s.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
+                || (!s.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
+            return;
+        }
+    }
+    //std::cout << "type error: Valid Size assertion fail\n";
+    m_errors.push_back("Valid Size assertion fail");
+}
+
+void interval_prop_domain_t::do_call(const Call& u, const interval_values_stack_t& store_in_stack,
+        location_t loc) {
+
+    auto r0 = register_t{R0_RETURN_VALUE};
+    for (const auto& kv : store_in_stack) {
+        auto key = kv.first;
+        auto width = kv.second.second;
+        auto overlapping_cells
+            = m_stack_slots_interval_values.find_overlapping_cells(key, width);
+        m_stack_slots_interval_values.remove_overlap(overlapping_cells, key, width);
+        m_stack_slots_interval_values.store(kv.first, kv.second.first.to_interval(),
+                kv.second.second);
+    }
+    if (u.is_map_lookup) {
+        m_registers_interval_values -= r0;
+    }
+    else {
+        auto r0_with_loc = reg_with_loc_t(r0, loc);
+        m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
+    }
+}
+
+void interval_prop_domain_t::operator()(const Packet &u, location_t loc, int print) {
+    auto r0 = register_t{R0_RETURN_VALUE};
+    auto r0_with_loc = reg_with_loc_t(r0, loc);
+    m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
+}
+
+void interval_prop_domain_t::operator()(const Assume &s, location_t loc, int print) {
+    // TODO: generalize for intervals
+    using Op = Condition::Op;
+    Condition cond = s.cond;
+    int64_t imm = 0;
+    bool is_imm = false;
+    auto reg_with_loc = reg_with_loc_t(cond.left.v, loc);
+    auto left_reg_optional = m_registers_interval_values.find(cond.left.v);
+    if (!left_reg_optional) {
+        return;
+    }
+    auto left_value = left_reg_optional.value();
+    bound_t right_value = bound_t(-1);
+    if (std::holds_alternative<Reg>(cond.right)) {
+        auto reg = std::get<Reg>(cond.right).v;
+        auto right_reg_optional = m_registers_interval_values.find(reg);
+        if (!right_reg_optional) {
+            //std::cout << "type error: assumption for an unknown register\n";
+            m_errors.push_back("assumption for an unknown register");
+            return;
+        }
+        auto right_reg = right_reg_optional->to_interval();
+        auto right_reg_singleton = right_reg.singleton();
+        if (!right_reg_singleton) {
+            //std::cout << "type error: assumption for a non-singleton register\n";
+            m_errors.push_back("assumption for a non-singleton register");
+            return;
+        }
+        right_value = right_reg_singleton.value();
+    }
+    else {
+        imm = std::get<Imm>(cond.right).v;
+        is_imm = true;
+        right_value = bound_t(static_cast<int>(imm));
+    }
+    bool is_right_within_left_interval = left_value.lb() <= right_value
+        && right_value <= left_value.ub();
+    switch (cond.op) {
+        case Op::EQ: {
+            if (is_right_within_left_interval)
+                m_registers_interval_values.insert(cond.left.v, reg_with_loc, interval_t(right_value));
+            return;
+        }
+        case Op::NE: {
+            if (right_value <= left_value.lb() || right_value >= left_value.ub()) {
+                if (right_value == left_value.lb())
+                    m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                            interval_t(left_value.lb() + number_t{1}, left_value.ub()));
+                else if (right_value == left_value.ub())
+                    m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                            interval_t(left_value.lb(), left_value.ub() - number_t{1}));
+                return;
+            }
+            break;
+        }
+        case Op::SGE:
+        case Op::GE:
+        {
+            if (is_right_within_left_interval || right_value < left_value.lb()) {
+                if (is_right_within_left_interval) {
+                    if (cond.op == Op::GE && is_imm) {
+                        auto value = bound_t(static_cast<unsigned int>(imm));
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(value, left_value.ub()));
+                    }
+                    else {
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(right_value, left_value.ub()));
+                    }
+                }
+                return;
+            }
+            break;
+        }
+        case Op::SLE:
+        case Op::LE:
+        {
+            if (is_right_within_left_interval || right_value > left_value.ub()) {
+                if (is_right_within_left_interval) {
+                    if (cond.op == Op::LE && is_imm && left_value.lb() < number_t{0}) {
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(number_t{0}, right_value));
+                    }
+                    else {
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(left_value.lb(), right_value));
+                    }
+                }
+                return;
+            }
+            break;
+        }
+        case Op::SGT:
+        case Op::GT: {
+            auto right_value_plus_1 = right_value + bound_t(1);
+            bool is_right_plus_1_within_left_interval = left_value.lb() <= right_value_plus_1
+                && right_value_plus_1 <= left_value.ub();
+            if (is_right_plus_1_within_left_interval || right_value_plus_1 < left_value.lb()) {
+                if (is_right_plus_1_within_left_interval) {
+                    if (cond.op == Op::GT && is_imm) {
+                        auto value = bound_t(static_cast<unsigned int>(imm));
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(value + number_t{1}, left_value.ub()));
+                    }
+                    else {
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(right_value_plus_1, left_value.ub()));
+                    }
+                }
+                return;
+            }
+            break;
+        }
+        case Op::SLT:
+        case Op::LT: {
+            auto right_value_minus_1 = right_value - number_t{1};
+            bool is_right_minus_1_within_left_interval = left_value.lb() <= right_value_minus_1
+                && right_value_minus_1 <= left_value.ub();
+            if (is_right_minus_1_within_left_interval || right_value_minus_1 > left_value.ub()) {
+                if (is_right_minus_1_within_left_interval) {
+                    if (cond.op == Op::LT && is_imm) {
+                        auto value = bound_t(static_cast<unsigned int>(imm));
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(left_value.lb(), value - number_t{1}));
+                    }
+                    else {
+                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
+                                interval_t(left_value.lb(), right_value_minus_1));
+                    }
+                }
+                return;
+            }
+            break;
+        }
+        default: return;
+        m_registers_interval_values.insert(cond.left.v, reg_with_loc, interval_t::bottom());
+    }
+}
+
+void interval_prop_domain_t::do_bin(const Bin& bin,
+        const std::optional<interval_t>& src_interval_opt,
+        const std::optional<interval_t>& dst_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
+        const interval_t& subtract_interval, location_t loc) {
+    using Op = Bin::Op;
+    // if op is not MOV,
+        // we skip handling in this domain is when dst is pointer and src is numerical value
+    if (bin.op != Op::MOV && dst_ptr_or_mapfd_opt && src_interval_opt) return;
+    // if op is MOV,
+        // we skip handling in this domain is when both dst and src are pointers
+        // when dst is not known and src is pointer
+    if (bin.op == Op::MOV &&
+            ((dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt)
+             || (!dst_interval_opt && src_ptr_or_mapfd_opt)))
+        return;
+
+    uint64_t imm = std::holds_alternative<Imm>(bin.v) ? std::get<Imm>(bin.v).v : 0;
+    interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
+    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
+    if (dst_interval_opt) dst_interval = std::move(dst_interval_opt.value());
+
+    auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
+    switch (bin.op)
+    {
+        // ra = b
+        case Op::MOV: {
+            if (src_interval_opt)
+                dst_interval = src_interval;
+            else if (dst_interval_opt) {
+                m_registers_interval_values -= bin.dst.v;
+                return;
+            }
+            break;
+        }
+        // ra += b
+        case Op::ADD: {
+            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) return;
+            if (dst_interval_opt && src_interval_opt)
+                dst_interval += src_interval;
+            else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
+                m_registers_interval_values -= bin.dst.v;
+                return;
+            }
+            break;
+        }
+        // ra -= b
+        case Op::SUB: {
+            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt)
+                dst_interval = subtract_interval;
+            else if (dst_interval_opt && src_interval_opt)
+                dst_interval -= src_interval;
+            else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
+                m_registers_interval_values -= bin.dst.v;
+                return;
+            }
+            break;
+        }
+        // ra *= b
+        case Op::MUL: {
+            dst_interval *= src_interval;
+            break;
+        }
+        // ra /= b
+        case Op::UDIV: {
+            dst_interval /= src_interval;
+            break;
+        }
+        // ra %= b
+        case Op::UMOD: {
+            dst_interval = dst_interval.SRem(src_interval);
+            break;
+        }
+        // ra |= b
+        case Op::OR: {
+            dst_interval = dst_interval.Or(src_interval);
+            break;
+        }
+        // ra &= b
+        case Op::AND: {
+            dst_interval = dst_interval.And(src_interval);
+            if ((int32_t)imm > 0)
+                dst_interval = interval_t(number_t(0), number_t(static_cast<int>(imm)));
+            break;
+        }
+        // ra <<= b
+        case Op::LSH: {
+            dst_interval = dst_interval.Shl(src_interval);
+            break;
+        }
+        // ra >>= b
+        case Op::RSH: {
+            dst_interval = dst_interval.LShr(src_interval);
+            break;
+        }
+        // ra >>>= b
+        case Op::ARSH: {
+            dst_interval = dst_interval.AShr(src_interval);
+            break;
+        }
+        // ra ^= b
+        case Op::XOR: {
+            dst_interval = dst_interval.Xor(src_interval);
+            break;
+        }
+        default: {
+            dst_interval = interval_t::top();
+            break;
+        }
+    }
+    m_registers_interval_values.insert(bin.dst.v, reg_with_loc, dst_interval);
+}
+
+
+void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
+        std::optional<ptr_or_mapfd_t> basereg_type, std::optional<ptr_or_mapfd_t> targetreg_type,
+        location_t loc) {
+    if (!basereg_type) {
+        m_registers_interval_values -= target_reg.v;
+        return;
+    }
+
+    auto basereg_ptr_or_mapfd_type = basereg_type.value();
+    int offset = b.access.offset;
+    int width = b.access.width;
+
+    auto reg_with_loc = reg_with_loc_t(target_reg.v, loc);
+    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_or_mapfd_type)) {
+        auto p_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
+        if (p_with_off.get_region() == crab::region_t::T_STACK) {
+            auto ptr_offset = p_with_off.get_offset();
+            auto load_at_interval = ptr_offset.to_interval() + interval_t{number_t(static_cast<int>(offset))};
+            auto load_at_singleton = load_at_interval.singleton();
+            if (load_at_singleton) {
+                auto load_at = load_at_singleton.value();
+                auto loaded = m_stack_slots_interval_values.find((uint64_t)load_at);
+                if (loaded) {
+                    auto loaded_cells = loaded.value();
+                    m_registers_interval_values.insert(target_reg.v, reg_with_loc,
+                            loaded_cells.first.to_interval());
+                    return;
+                }
+            }
+            auto load_at_lb_opt = load_at_interval.lb().number();
+            auto load_at_ub_opt = load_at_interval.ub().number();
+            if (!load_at_lb_opt || !load_at_ub_opt) {
+                m_registers_interval_values -= target_reg.v;
+                //std::cout << "type error: missing offset information\n";
+                m_errors.push_back("missing offset information");
+                return;
+            }
+            auto load_at_lb = load_at_lb_opt.value();
+            auto load_at_ub = load_at_ub_opt.value();
+            auto start = (uint64_t)load_at_lb;
+            auto width_to_check = (int)(load_at_ub+number_t(width)-load_at_lb);
+
+            if (m_stack_slots_interval_values.all_numeric(start, width_to_check)) {
+                m_registers_interval_values.insert(target_reg.v, reg_with_loc,
+                        interval_t::top());
+            }
+            else {
+                m_registers_interval_values -= target_reg.v;
+            }
+            return;
+        }
+    }
+    // we check targetreg_type because in case we already loaded a pointer from ctx,
+        // we then do not store a number
+    if (!targetreg_type) {  // we are loading from ctx, packet or shared
+        m_registers_interval_values.insert(target_reg.v, reg_with_loc, interval_t::top());
+    }
+    else {
+        m_registers_interval_values -= target_reg.v;
+    }
+}
+
+void interval_prop_domain_t::do_mem_store(const Mem& b, const Reg& target_reg,
+        std::optional<ptr_or_mapfd_t> basereg_type) {
+    int offset = b.access.offset;
+    int width = b.access.width;
+
+    if (!basereg_type) {
+        return;
+    }
+    auto basereg_ptr_or_mapfd_type = basereg_type.value();
+    auto targetreg_type = m_registers_interval_values.find(target_reg.v);
+    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_or_mapfd_type)) {
+        auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
+        auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
+        if (!offset_singleton) {
+            //std::cout << "type error: doing a store with unknown offset\n";
+            m_errors.push_back("doing a store with unknown offset");
+            return;
+        }
+        auto store_at = (uint64_t)offset_singleton.value() + (uint64_t)offset;
+        if (basereg_ptr_with_off_type.get_region() == crab::region_t::T_STACK) {
+            auto overlapping_cells
+                = m_stack_slots_interval_values.find_overlapping_cells(store_at, width);
+            m_stack_slots_interval_values.remove_overlap(overlapping_cells, store_at, width);
+
+            // if targetreg_type is empty, we are storing a pointer
+            if (!targetreg_type) return;
+
+            auto type_to_store = targetreg_type.value();
+            m_stack_slots_interval_values.store(store_at, type_to_store, width);
+        }
+    }
+    else {}
+}
+
+void interval_prop_domain_t::set_require_check(check_require_func_t f) {}
+
+std::optional<interval_cells_t> interval_prop_domain_t::find_in_stack(uint64_t key) const {
+    return m_stack_slots_interval_values.find(key);
+}
+
+void interval_prop_domain_t::adjust_bb_for_types(location_t loc) {
+    m_registers_interval_values.adjust_bb_for_registers(loc);
+}
+
+std::vector<uint64_t> interval_prop_domain_t::get_stack_keys() const {
+    return m_stack_slots_interval_values.get_keys();
+}
+
+bool interval_prop_domain_t::all_numeric_in_stack(uint64_t start_loc, int width) const {
+    return m_stack_slots_interval_values.all_numeric(start_loc, width);
+}
+
+} // namespace crab
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
new file mode 100644
index 000000000..fe527714e
--- /dev/null
+++ b/src/crab/interval_prop_domain.hpp
@@ -0,0 +1,164 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <unordered_map>
+#include <map>
+
+#include "crab/abstract_domain.hpp"
+#include "crab/region_domain.hpp"
+#include "crab/cfg.hpp"
+#include "linear_constraint.hpp"
+#include "string_constraints.hpp"
+#include "crab/common.hpp"
+
+namespace crab {
+
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
+
+class registers_cp_state_t {
+
+    live_registers_t m_cur_def;
+    std::shared_ptr<global_interval_env_t> m_interval_env;
+    bool m_is_bottom = false;
+
+    public:
+        bool is_bottom() const;
+        bool is_top() const;
+        void set_to_bottom();
+        void set_to_top();
+        std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
+        std::optional<mock_interval_t> find(register_t key) const;
+        void insert(register_t, const reg_with_loc_t&, interval_t);
+        void operator-=(register_t);
+        registers_cp_state_t operator|(const registers_cp_state_t& other) const;
+        registers_cp_state_t(bool is_bottom = false) : m_interval_env(nullptr),
+            m_is_bottom(is_bottom) {}
+        explicit registers_cp_state_t(live_registers_t&& vars,
+                std::shared_ptr<global_interval_env_t> interval_env, bool is_bottom = false)
+            : m_cur_def(std::move(vars)), m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+        explicit registers_cp_state_t(std::shared_ptr<global_interval_env_t> interval_env,
+                bool is_bottom = false)
+            : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+        void adjust_bb_for_registers(location_t);
+        void print_all_register_types() const;
+};
+
+using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
+using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
+
+class stack_cp_state_t {
+
+    interval_values_stack_t m_interval_values;
+    bool m_is_bottom = false;
+
+    public:
+        bool is_bottom() const;
+        bool is_top() const;
+        void set_to_bottom();
+        void set_to_top();
+        static stack_cp_state_t top();
+        std::optional<interval_cells_t> find(uint64_t) const;
+        void store(uint64_t, mock_interval_t, int);
+        void operator-=(uint64_t);
+        bool all_numeric(uint64_t, int) const;
+        stack_cp_state_t operator|(const stack_cp_state_t& other) const;
+        stack_cp_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        explicit stack_cp_state_t(interval_values_stack_t&& interval_values, bool is_bottom = false)
+            : m_interval_values(std::move(interval_values)), m_is_bottom(is_bottom) {}
+        std::vector<uint64_t> get_keys() const;
+        size_t size() const;
+        std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
+        void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
+};
+
+class interval_prop_domain_t final {
+    registers_cp_state_t m_registers_interval_values;
+    stack_cp_state_t m_stack_slots_interval_values;
+    std::vector<std::string> m_errors;
+    bool m_is_bottom = false;
+
+  public:
+
+    interval_prop_domain_t() = default;
+    interval_prop_domain_t(interval_prop_domain_t&& o) = default;
+    interval_prop_domain_t(const interval_prop_domain_t& o) = default;
+    explicit interval_prop_domain_t(registers_cp_state_t&& consts_regs,
+            stack_cp_state_t&& interval_stack_slots, bool is_bottom = false) :
+        m_registers_interval_values(std::move(consts_regs)), m_stack_slots_interval_values(std::move(interval_stack_slots)),
+        m_is_bottom(is_bottom) {}
+    interval_prop_domain_t& operator=(interval_prop_domain_t&& o) = default;
+    interval_prop_domain_t& operator=(const interval_prop_domain_t& o) = default;
+    // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+    static interval_prop_domain_t setup_entry();
+    // bottom/top
+    static interval_prop_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const interval_prop_domain_t& other) const;
+    // join
+    void operator|=(const interval_prop_domain_t& abs);
+    void operator|=(interval_prop_domain_t&& abs);
+    interval_prop_domain_t operator|(const interval_prop_domain_t& other) const;
+    interval_prop_domain_t operator|(interval_prop_domain_t&& abs) const;
+    // meet
+    interval_prop_domain_t operator&(const interval_prop_domain_t& other) const;
+    // widening
+    interval_prop_domain_t widen(const interval_prop_domain_t& other) const;
+    // narrowing
+    interval_prop_domain_t narrow(const interval_prop_domain_t& other) const;
+    //forget
+    void operator-=(variable_t var);
+    void operator-=(register_t reg) { m_registers_interval_values -= reg; }
+
+    //// abstract transformers
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Un&, location_t loc = boost::none, int print = 0);
+    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
+    void operator()(const Call&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
+    void operator()(const LockAdd&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const basic_block_t& bb, bool check_termination, int print = 0) {}
+    void write(std::ostream& os) const;
+    std::string domain_name() const;
+    crab::bound_t get_instruction_count_upper_bound();
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
+
+    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>,
+            std::optional<ptr_or_mapfd_t>, location_t);
+    void do_mem_store(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>);
+    void do_call(const Call&, const interval_values_stack_t&, location_t);
+    void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
+            const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
+            const interval_t&, location_t);
+    std::optional<mock_interval_t> find_interval_value(register_t) const;
+    std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<interval_cells_t> find_in_stack(uint64_t) const;
+    void adjust_bb_for_types(location_t);
+    std::vector<uint64_t> get_stack_keys() const;
+    bool all_numeric_in_stack(uint64_t, int) const;
+    [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+    void reset_errors() { m_errors.clear(); }
+}; // end interval_prop_domain_t
+
+} // namespace crab
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index caa623f33..61b3c44f1 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -11,7 +11,7 @@ bool type_domain_t::is_bottom() const {
 
 bool type_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_region.is_top() && m_offset.is_top());
+    return (m_region.is_top() && m_offset.is_top() && m_interval.is_top());
 }
 
 type_domain_t type_domain_t::bottom() {
@@ -27,6 +27,7 @@ void type_domain_t::set_to_bottom() {
 void type_domain_t::set_to_top() {
     m_region.set_to_top();
     m_offset.set_to_top();
+    m_interval.set_to_top();
 }
 
 bool type_domain_t::operator<=(const type_domain_t& abs) const {
@@ -60,7 +61,8 @@ type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | other.m_region, m_offset | other.m_offset);
+    return type_domain_t(m_region | other.m_region, m_offset | other.m_offset,
+            m_interval | other.m_interval);
 }
 
 type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
@@ -70,7 +72,8 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | std::move(other.m_region), m_offset | std::move(other.m_offset));
+    return type_domain_t(m_region | std::move(other.m_region),
+            m_offset | std::move(other.m_offset), m_interval | std::move(other.m_interval));
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -107,6 +110,7 @@ void type_domain_t::operator()(const Un& u, location_t loc, int print) {
 void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
     m_region(u, loc);
     m_offset(u, loc);
+    m_interval(u, loc);
 }
 
 void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
@@ -118,11 +122,15 @@ void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, in
 
 void type_domain_t::operator()(const Call& u, location_t loc, int print) {
 
+    using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
+    interval_values_stack_t stack_values;
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
-            if (!maybe_ptr_or_mapfd) continue;
+            auto maybe_width_interval = m_interval.find_interval_value(param.size.v);
+            if (!maybe_ptr_or_mapfd || !maybe_width_interval) continue;
             auto ptr_or_mapfd = maybe_ptr_or_mapfd.value();
+            auto width_interval = maybe_width_interval->to_interval();
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
                 if (ptr_with_off.get_region() == region_t::T_STACK) {
@@ -133,12 +141,18 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
                         continue;
                     }
                     // TODO: forget the stack at [offset, offset+width]
+                    auto offset = (uint64_t)offset_singleton.value();
+                    if (auto single_width = width_interval.singleton(); single_width) {
+                        int width = (int)single_width.value();
+                        stack_values[offset] = std::make_pair(interval_t::top(), width);
+                    }
                 }
             }
         }
     }
     m_region(u, loc);
     m_offset(u, loc);
+    m_interval.do_call(u, stack_values, loc);
 }
 
 void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
@@ -154,6 +168,7 @@ void type_domain_t::operator()(const Jmp& u, location_t loc, int print) {}
 void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_region(u, loc);
     m_offset(u, loc);
+    m_interval(u, loc);
 }
 
 void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
@@ -171,6 +186,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
         }
         else if (!maybe_left_type && !maybe_right_type) {
             // both numbers
+            m_interval(s, loc);
         }
         else {
             // We should only reach here if `--assume-assert` is off
@@ -182,16 +198,28 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
-    m_region(s, loc);
+    /* WARNING: The operation is not implemented yet.*/
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
+    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
+    auto interval_type = 
+        mock_interval_type ? mock_interval_type->to_interval() : std::optional<interval_t>{};
     if (reg_type) {
         m_region(s, loc);
-        std::optional<interval_t> width_interval = {};
+        std::optional<mock_interval_t> width_mock_interval;
+        if (std::holds_alternative<Reg>(s.width)) {
+            width_mock_interval = m_interval.find_interval_value(std::get<Reg>(s.width).v);
+        }
+        else {
+            auto imm = std::get<Imm>(s.width); 
+            width_mock_interval = mock_interval_t{interval_t(number_t{imm.v}, number_t{imm.v})};
+        }
+        auto width_interval = 
+            width_mock_interval ? width_mock_interval->to_interval() : std::optional<interval_t>{};
         if (is_packet_ptr(reg_type)) {
-            m_offset.check_valid_access(s, reg_type, std::nullopt, width_interval);
+            m_offset.check_valid_access(s, reg_type, interval_type, width_interval);
         }
     }
 }
@@ -201,7 +229,6 @@ void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int prin
 }
 
 void type_domain_t::operator()(const Assert& u, location_t loc, int print) {
-    if (is_bottom()) return;
     std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
 }
 
@@ -209,12 +236,15 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
+    auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
+    auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
         if (!is_shared_ptr(maybe_ptr_or_mapfd1)
                 && same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
     }
     else if (!maybe_ptr_or_mapfd2) {
+        // TODO: interval check here
         // two numbers can be compared
         // if r1 is a pointer, r2 must be a number
         return;
@@ -232,7 +262,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+    m_interval(u, loc);
 }
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
@@ -273,6 +303,8 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
                         return;
                     }
                     auto offset_to_check = (uint64_t)offset_singleton.value();
+                    auto it = m_interval.all_numeric_in_stack(offset_to_check, width);
+                    if (it) return;
                     auto it2 = m_region.find_in_stack(offset_to_check);
                     if (it2) {
                         //std::cout << "type error: map update with a non-numerical value\n";
@@ -300,13 +332,16 @@ void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print
 type_domain_t type_domain_t::setup_entry() {
     auto&& reg = crab::region_domain_t::setup_entry();
     auto&& off = offset_domain_t::setup_entry();
-    type_domain_t typ(std::move(reg), std::move(off));
+    auto&& interval = interval_prop_domain_t::setup_entry();
+    type_domain_t typ(std::move(reg), std::move(off), std::move(interval));
     return typ;
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     if (is_bottom()) return;
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
+    auto dst_interval = m_interval.find_interval_value(bin.dst.v);
+    assert(!dst_ptr_or_mapfd || !dst_interval);
 
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
     std::optional<interval_t> src_interval;
@@ -314,6 +349,10 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg r = std::get<Reg>(bin.v);
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
+        auto src_mock_interval = m_interval.find_interval_value(r.v);
+        if (src_mock_interval) {
+            src_interval = src_mock_interval->to_interval();
+        }
     }
     else {
         int64_t imm;
@@ -323,8 +362,9 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         else {
             imm = static_cast<int>(std::get<Imm>(bin.v).v);
         }
-        src_interval = interval_t{crab::number_t{imm}};
+        src_interval = interval_t{number_t{imm}};
     }
+    //assert(!src_ptr_or_mapfd || !src_interval);
 
     using Op = Bin::Op;
     // for all operations except mov, add, sub, the src and dst should be numbers
@@ -334,25 +374,30 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         //std::cout << "type error: operation on pointers not allowed\n";
         m_region -= bin.dst.v;
         m_offset -= bin.dst.v;
+        m_interval -= bin.dst.v;
         return;
     }
 
     interval_t subtracted_reg =
         m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     interval_t subtracted_off =
-        m_offset.do_bin(bin, src_interval, std::nullopt, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+        m_offset.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
+    m_interval.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd,
+            subtracted, loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc, int print) {
     m_region.do_load(b, target_reg, unknown_ptr, loc);
     m_offset.do_load(b, target_reg, basereg_opt, loc);
+    m_interval.do_load(b, target_reg, basereg_opt, std::nullopt, loc);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> target_opt,
         std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc, int print) {
     m_region.do_mem_store(b, loc);
+    m_interval.do_mem_store(b, get<Reg>(b.value), basereg_opt);
     m_offset.do_mem_store(b, target_opt, basereg_opt);
 }
 
@@ -376,59 +421,56 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     }
 }
 
-void type_domain_t::print_registers() const {
-    std::cout << "  register types: {\n";
-    for (size_t i = 0; i < NUM_REGISTERS; i++) {
-        register_t reg = (register_t)i;
-        auto maybe_ptr_or_mapfd_type = m_region.find_ptr_or_mapfd_type(reg);
-        auto maybe_offset_info = m_offset.find_offset_info(reg);
-        if (maybe_ptr_or_mapfd_type) {
-            std::cout << "    ";
-            print_register(std::cout, Reg{(uint8_t)reg}, maybe_ptr_or_mapfd_type, maybe_offset_info);
-            std::cout << "\n";
-        }
-    }
-    std::cout << "  }\n";
-}
-
 void type_domain_t::print_ctx() const {
     std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
-    std::cout << "  ctx: {\n";
+    std::cout << "\tctx: {\n";
     for (auto const& k : ctx_keys) {
-        auto maybe_ptr = m_region.find_in_ctx(k);
-        auto maybe_dist = m_offset.find_in_ctx(k);
-        if (maybe_ptr) {
-            std::cout << "    " << k << ": ";
-            print_ptr_type(std::cout, *maybe_ptr, maybe_dist);
+        auto ptr = m_region.find_in_ctx(k);
+        auto dist = m_offset.find_in_ctx(k);
+        if (ptr) {
+            std::cout << "\t\t" << k << ": ";
+            print_ptr_type(std::cout, *ptr, dist);
             std::cout << ",\n";
         }
     }
-    std::cout << "  }\n";
+    std::cout << "\t}\n";
 }
 
 void type_domain_t::print_stack() const {
     std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
-    std::cout << "  stack: {\n";
+    std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
+    std::cout << "\tstack: {\n";
     for (auto const& k : stack_keys_region) {
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
-        auto maybe_dist_cells = m_offset.find_in_stack(k);
+        auto dist = m_offset.find_in_stack(k);
         if (maybe_ptr_or_mapfd_cells) {
-            auto ptr_or_mapfd_cells = *maybe_ptr_or_mapfd_cells;
+            auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
-            std::optional<dist_t> maybe_dist = maybe_dist_cells ?
-                std::optional<dist_t>{maybe_dist_cells->first} : std::nullopt;
-            std::cout << "    [" << k << "-" << k+width-1 << "] : ";
-            print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, maybe_dist);
+            std::cout << "\t\t[" << k << "-" << k+width-1 << "] : ";
+            if (dist) 
+                print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, dist->first);
+            else 
+                print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, std::nullopt);
+            std::cout << ",\n";
+        }
+    }
+    for (auto const& k : stack_keys_interval) {
+        auto maybe_interval_cells = m_interval.find_in_stack(k);
+        if (maybe_interval_cells) {
+            auto interval_cells = maybe_interval_cells.value();
+            std::cout << "\t\t" << "[" << k << "-" << k+interval_cells.second-1 << "] : ";
+            print_number(std::cout, interval_cells.first.to_interval());
             std::cout << ",\n";
         }
     }
-    std::cout << "  }\n";
+    std::cout << "\t}\n";
 }
 
 void type_domain_t::adjust_bb_for_types(location_t loc) {
     m_region.adjust_bb_for_types(loc);
     m_offset.adjust_bb_for_types(loc);
+    m_interval.adjust_bb_for_types(loc);
 }
 
 void type_domain_t::operator()(const basic_block_t& bb, int print) {
@@ -441,6 +483,7 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
     m_errors.clear();
     m_region.reset_errors();
     m_offset.reset_errors();
+    m_interval.reset_errors();
 
     auto label = bb.label();
     uint32_t curr_pos = 0;
@@ -455,6 +498,7 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
 
     operator+=(m_region.get_errors());
     operator+=(m_offset.get_errors());
+    operator+=(m_interval.get_errors());
 }
 
 std::optional<crab::ptr_or_mapfd_t>
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 42efb4493..754903b0d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -5,14 +5,16 @@
 
 #include "crab/abstract_domain.hpp"
 #include "crab/region_domain.hpp"
+#include "crab/interval_prop_domain.hpp"
 #include "crab/offset_domain.hpp"
 #include "crab/common.hpp"
 
 namespace crab {
 
 class type_domain_t final {
-    crab::region_domain_t m_region;
-    crab::offset_domain_t m_offset;
+    region_domain_t m_region;
+    offset_domain_t m_offset;
+    interval_prop_domain_t m_interval;
     bool m_is_bottom = false;
     std::vector<std::string> m_errors;
 
@@ -21,8 +23,9 @@ class type_domain_t final {
     type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
-    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off, bool is_bottom = false) :
-        m_region(reg), m_offset(off), m_is_bottom(is_bottom) {}
+    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off, interval_prop_domain_t&&
+            interval, bool is_bottom = false) :
+        m_region(reg), m_offset(off), m_interval(interval), m_is_bottom(is_bottom) {}
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
@@ -99,7 +102,6 @@ class type_domain_t final {
     void operator+=(std::vector<std::string>& errs) {
         m_errors.insert(m_errors.end(), errs.begin(), errs.end());
     }
-    void print_initial_registers() const;
 }; // end type_domain_t
 
 } // namespace crab
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 28eb6e139..34f8de6b7 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -12,6 +12,13 @@ void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr, std::optio
     }
 }
 
+void print_number(std::ostream& o, crab::interval_t n) {
+    o << "number";
+    if (!n.is_top()) {
+        o << "<" << n << ">";
+    }
+}
+
 void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or_mapfd, std::optional<crab::dist_t> d) {
     if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
         o << std::get<crab::mapfd_t>(ptr_or_mapfd);
@@ -26,6 +33,9 @@ void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr
     if (p) {
         print_ptr_or_mapfd_type(o, *p, d);
     }
+    else {
+        print_number(o, crab::interval_t::top());
+    }
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 5e8e10251..554a14e8e 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -10,6 +10,7 @@
 #include "crab/offset_domain.hpp"
 
 void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&, std::optional<crab::dist_t>);
+void print_number(std::ostream&, crab::interval_t);
 void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t>);
 void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>);
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 7d48e573e..bbab52b47 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -15,6 +15,7 @@
 #include "crab/abstract_domain.hpp"
 #include "crab/ebpf_domain.hpp"
 #include "crab/type_domain.hpp"
+#include "crab/interval_prop_domain.hpp"
 #include "crab/region_domain.hpp"
 #include "crab/offset_domain.hpp"
 #include "crab/fwd_analyzer.hpp"

From e1d68153d44753c64c2067496040c2c114484760 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 9 Sep 2023 14:40:09 -0400
Subject: [PATCH 123/373] Better handling of Assume for interval prop domain

Generalize the handling for intervals as well;
Have main implementation structure similar to ZoneCrab implementation, to minimize any corner cases or incorrect analysis

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 330 +++++++++++++++++++-----------
 src/crab/interval_prop_domain.hpp |   9 +
 src/crab/type_domain.cpp          |  13 +-
 3 files changed, 228 insertions(+), 124 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 60c482e98..5ccc549c1 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -418,145 +418,237 @@ void interval_prop_domain_t::operator()(const Packet &u, location_t loc, int pri
     m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
 }
 
-void interval_prop_domain_t::operator()(const Assume &s, location_t loc, int print) {
-    // TODO: generalize for intervals
-    using Op = Condition::Op;
-    Condition cond = s.cond;
-    int64_t imm = 0;
-    bool is_imm = false;
-    auto reg_with_loc = reg_with_loc_t(cond.left.v, loc);
-    auto left_reg_optional = m_registers_interval_values.find(cond.left.v);
-    if (!left_reg_optional) {
-        return;
-    }
-    auto left_value = left_reg_optional.value();
-    bound_t right_value = bound_t(-1);
-    if (std::holds_alternative<Reg>(cond.right)) {
-        auto reg = std::get<Reg>(cond.right).v;
-        auto right_reg_optional = m_registers_interval_values.find(reg);
-        if (!right_reg_optional) {
-            //std::cout << "type error: assumption for an unknown register\n";
-            m_errors.push_back("assumption for an unknown register");
-            return;
+void interval_prop_domain_t::assume_lt(bool strict, interval_t&& left_interval,
+        interval_t&& right_interval, register_t left, Value right, location_t loc) {
+    auto reg_with_loc_left = reg_with_loc_t(left, loc);
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+
+    auto ub = strict ? (right_interval.lb() - number_t{1}) : right_interval.lb();
+    if (lub >= rlb && llb < rlb) {
+        auto interval_to_insert = interval_t(llb, strict ? rlb - number_t{1} : rlb);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+    }
+    else if (right_interval <= left_interval && strict ? llb < rlb : llb <= rlb) {
+        auto interval_to_insert = interval_t(llb, strict ? rlb - number_t{1} : rlb);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+    }
+    else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub &&
+            std::holds_alternative<Reg>(right)) {
+        auto right_reg = std::get<Reg>(right).v;
+        auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
+        auto interval_to_insert = interval_t(strict ? lub + number_t{1} : lub, rub);
+        m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
+    }
+    else if (lub > rub && strict ? llb < rub : llb <= rub) {
+        auto interval_to_insert_left = interval_t(llb, strict ? rub - number_t{1} : rub);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
+        // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
+        // and set left to the rest of the interval < (or <=) of right
+        // a more sound analysis is needed
+        if (std::holds_alternative<Reg>(right)) {
+            auto right_reg = std::get<Reg>(right).v;
+            auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
+            m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_t(rub));
         }
-        auto right_reg = right_reg_optional->to_interval();
-        auto right_reg_singleton = right_reg.singleton();
-        if (!right_reg_singleton) {
-            //std::cout << "type error: assumption for a non-singleton register\n";
-            m_errors.push_back("assumption for a non-singleton register");
-            return;
+    }
+    else {
+        // TODO: verify if any legitimate case can fall into here
+        m_registers_interval_values.set_to_bottom();
+    }
+}
+
+void interval_prop_domain_t::assume_gt(bool strict, interval_t&& left_interval,
+        interval_t&& right_interval, register_t left, Value right, location_t loc) {
+    auto reg_with_loc_left = reg_with_loc_t(left, loc);
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+
+    if (llb <= rub && lub > rub) {
+        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+    }
+    else if (right_interval <= left_interval && strict ? lub > rub : lub >= rub) {
+        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+    }
+    else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb &&
+            std::holds_alternative<Reg>(right)) {
+        auto right_reg = std::get<Reg>(right).v;
+        auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
+        auto interval_to_insert = interval_t(rlb, strict ? llb - number_t{1} : llb);
+        m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
+    }
+    else if (llb < rlb && strict ? lub > rlb : lub >= rlb) {
+        auto interval_to_insert_left = interval_t(strict ? rlb + number_t{1} : rlb, lub);
+        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
+        // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
+        // and set left to the rest of the interval > (or >=) of right
+        // a more sound analysis is needed
+        if (std::holds_alternative<Reg>(right)) {
+            auto right_reg = std::get<Reg>(right).v;
+            auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
+            m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_t(rlb));
         }
-        right_value = right_reg_singleton.value();
     }
     else {
-        imm = std::get<Imm>(cond.right).v;
-        is_imm = true;
-        right_value = bound_t(static_cast<int>(imm));
-    }
-    bool is_right_within_left_interval = left_value.lb() <= right_value
-        && right_value <= left_value.ub();
-    switch (cond.op) {
-        case Op::EQ: {
-            if (is_right_within_left_interval)
-                m_registers_interval_values.insert(cond.left.v, reg_with_loc, interval_t(right_value));
-            return;
+        // TODO: verify if any legitimate case can fall into here
+        m_registers_interval_values.set_to_bottom();
+    }
+}
+
+void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt,
+        interval_t&& left_interval, interval_t&& right_interval, register_t left,
+        Value right, location_t loc) {
+
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        m_registers_interval_values.set_to_bottom();
+    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        m_registers_interval_values.set_to_bottom();
+    }
+    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        // TODO: verify if setting to top is the correct equivalent of returning linear cst true
+        m_registers_interval_values.set_to_top();
+    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        m_registers_interval_values.set_to_top();
+    }
+
+    if (is_lt)
+        assume_lt(strict, std::move(left_interval), std::move(right_interval), left, right, loc);
+    else
+        assume_gt(strict, std::move(left_interval), std::move(right_interval), left, right, loc);
+}
+
+void interval_prop_domain_t::assume_unsigned_cst_interval(Condition::Op op, bool is64,
+        interval_t&& left_interval, interval_t&& right_interval, register_t left, Value right,
+        location_t loc) {
+
+    for (interval_t* interval : {&left_interval, &right_interval}) {
+        if (!(*interval <= interval_t::unsigned_int(true))) {
+            *interval = interval->truncate_to_uint(true);
         }
-        case Op::NE: {
-            if (right_value <= left_value.lb() || right_value >= left_value.ub()) {
-                if (right_value == left_value.lb())
-                    m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                            interval_t(left_value.lb() + number_t{1}, left_value.ub()));
-                else if (right_value == left_value.ub())
-                    m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                            interval_t(left_value.lb(), left_value.ub() - number_t{1}));
+    }
+
+    // Handle uvalue != right.
+    if (op == Condition::Op::NE) {
+        if (auto rn = right_interval.singleton()) {
+            if (rn == left_interval.truncate_to_uint(is64).lb().number()) {
+                // "NE lower bound" is equivalent to "GT lower bound".
+                op = Condition::Op::GT;
+                right_interval = interval_t{left_interval.lb()};
+            } else if (rn == left_interval.ub().number()) {
+                // "NE upper bound" is equivalent to "LT upper bound".
+                op = Condition::Op::LT;
+                right_interval = interval_t{left_interval.ub()};
+            } else {
                 return;
             }
-            break;
+        } else {
+            return;
         }
-        case Op::SGE:
-        case Op::GE:
-        {
-            if (is_right_within_left_interval || right_value < left_value.lb()) {
-                if (is_right_within_left_interval) {
-                    if (cond.op == Op::GE && is_imm) {
-                        auto value = bound_t(static_cast<unsigned int>(imm));
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(value, left_value.ub()));
-                    }
-                    else {
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(right_value, left_value.ub()));
-                    }
-                }
-                return;
-            }
-            break;
+    }
+
+    const bool is_lt = op == Condition::Op::LT || op == Condition::Op::LE;
+    bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
+
+    assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
+            left, right, loc);
+}
+
+void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool is64,
+        interval_t&& left_interval, interval_t&& right_interval, register_t left, Value right,
+        location_t loc) {
+
+    for (interval_t* interval : {&left_interval, &right_interval}) {
+        if (!(*interval <= interval_t::signed_int(is64))) {
+            *interval = interval->truncate_to_sint(is64);
+        }
+    }
+
+    if (op == Condition::Op::EQ) {
+        auto eq_interval = right_interval & left_interval;
+        m_registers_interval_values.insert(left, reg_with_loc_t(left, loc), eq_interval);
+        if (std::holds_alternative<Reg>(right)) {
+            auto right_reg = std::get<Reg>(right).v;
+            m_registers_interval_values.insert(right_reg,
+                    reg_with_loc_t(right_reg, loc), eq_interval);
         }
+        return;
+    }
+
+    const bool is_lt = op == Condition::Op::SLT || op == Condition::Op::SLE;
+    bool strict = op == Condition::Op::SLT || op == Condition::Op::SGT;
+
+    assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
+            left, right, loc);
+}
+
+void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
+        Value right, location_t loc) {
+    using Op = Condition::Op;
+    auto left_mock_interval = m_registers_interval_values.find(left);
+    if (!left_mock_interval) return;
+    auto left_interval = left_mock_interval->to_interval();
+    interval_t right_interval = interval_t::bottom();
+    int64_t imm;
+    bool is_right_reg = std::holds_alternative<Reg>(right);
+    if (is_right_reg) {
+        auto right_mock_interval = m_registers_interval_values.find(std::get<Reg>(right).v);
+        if (!right_mock_interval) return;
+        right_interval = right_mock_interval->to_interval();
+    }
+    else {
+        imm = static_cast<int64_t>(std::get<Imm>(right).v);
+    }
+    if (left_interval.is_bottom() || (is_right_reg && right_interval.is_bottom())) {
+        m_registers_interval_values.set_to_bottom();
+        return;
+    }
+    switch (op) {
+        case Op::EQ:
+        case Op::SGE:
         case Op::SLE:
-        case Op::LE:
-        {
-            if (is_right_within_left_interval || right_value > left_value.ub()) {
-                if (is_right_within_left_interval) {
-                    if (cond.op == Op::LE && is_imm && left_value.lb() < number_t{0}) {
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(number_t{0}, right_value));
-                    }
-                    else {
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(left_value.lb(), right_value));
-                    }
-                }
-                return;
-            }
+        case Op::SGT:
+        case Op::SLT: {
+            assume_signed_cst_interval(op, is64, std::move(left_interval),
+                    is_right_reg ? std::move(right_interval) : interval_t(number_t{imm}),
+                    left, right, loc);
             break;
         }
-        case Op::SGT:
-        case Op::GT: {
-            auto right_value_plus_1 = right_value + bound_t(1);
-            bool is_right_plus_1_within_left_interval = left_value.lb() <= right_value_plus_1
-                && right_value_plus_1 <= left_value.ub();
-            if (is_right_plus_1_within_left_interval || right_value_plus_1 < left_value.lb()) {
-                if (is_right_plus_1_within_left_interval) {
-                    if (cond.op == Op::GT && is_imm) {
-                        auto value = bound_t(static_cast<unsigned int>(imm));
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(value + number_t{1}, left_value.ub()));
-                    }
-                    else {
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(right_value_plus_1, left_value.ub()));
-                    }
-                }
-                return;
-            }
+        case Op::SET:
+        case Op::NSET: {
+            // TODO: implement SET and NSET
             break;
         }
-        case Op::SLT:
+        case Op::NE:
+        case Op::GE:
+        case Op::LE:
+        case Op::GT:
         case Op::LT: {
-            auto right_value_minus_1 = right_value - number_t{1};
-            bool is_right_minus_1_within_left_interval = left_value.lb() <= right_value_minus_1
-                && right_value_minus_1 <= left_value.ub();
-            if (is_right_minus_1_within_left_interval || right_value_minus_1 > left_value.ub()) {
-                if (is_right_minus_1_within_left_interval) {
-                    if (cond.op == Op::LT && is_imm) {
-                        auto value = bound_t(static_cast<unsigned int>(imm));
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(left_value.lb(), value - number_t{1}));
-                    }
-                    else {
-                        m_registers_interval_values.insert(cond.left.v, reg_with_loc,
-                                interval_t(left_value.lb(), right_value_minus_1));
-                    }
-                }
-                return;
-            }
+            assume_unsigned_cst_interval(op, is64, std::move(left_interval),
+                    is_right_reg ? std::move(right_interval) : interval_t(number_t{(uint64_t)imm}),
+                    left, right, loc);
             break;
         }
-        default: return;
-        m_registers_interval_values.insert(cond.left.v, reg_with_loc, interval_t::bottom());
     }
 }
 
+void interval_prop_domain_t::operator()(const Assume& s, location_t loc, int print) {
+    // nothing to do here
+}
+
 void interval_prop_domain_t::do_bin(const Bin& bin,
         const std::optional<interval_t>& src_interval_opt,
         const std::optional<interval_t>& dst_interval_opt,
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index fe527714e..6e87513b7 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -151,6 +151,15 @@ class interval_prop_domain_t final {
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
             const interval_t&, location_t);
+    void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&, register_t,
+            Value, location_t);
+    void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&, register_t,
+            Value, location_t);
+    void assume_cst(Condition::Op, bool, register_t, Value, location_t);
+    void assume_lt(bool, interval_t&&, interval_t&&, register_t, Value, location_t);
+    void assume_gt(bool, interval_t&&, interval_t&&, register_t, Value, location_t);
+    void assume_gt_and_lt(bool, bool, bool, interval_t&&, interval_t&&, register_t,
+            Value, location_t);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 61b3c44f1..26582c276 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -173,20 +173,20 @@ void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
 
 void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
     Condition cond = s.cond;
-    auto right = cond.right;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
-    if (std::holds_alternative<Reg>(right)) {
-        const auto& right_reg = std::get<Reg>(right);
+    if (std::holds_alternative<Reg>(cond.right)) {
+        const auto& right_reg = std::get<Reg>(cond.right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
         if (maybe_left_type && maybe_right_type) {
+            // both pointers
             if (is_packet_ptr(maybe_left_type) && is_packet_ptr(maybe_right_type)) {
                 m_offset(s, loc, print);
             }
-            // both pointers
         }
         else if (!maybe_left_type && !maybe_right_type) {
             // both numbers
-            m_interval(s, loc);
+            auto left_interval = m_interval.find_interval_value(cond.left.v);
+            m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right, loc);
         }
         else {
             // We should only reach here if `--assume-assert` is off
@@ -195,6 +195,9 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
             m_region.set_registers_to_top();
         }
     }
+    else {
+        m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right, loc);
+    }
 }
 
 void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {

From f8a6ede0c797ba19d419547f463cde9ad5bff618 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 11 Sep 2023 13:36:30 -0400
Subject: [PATCH 124/373] Fixes in printing intervals in the interval
 propagation domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp  | 14 +++++++++++---
 src/crab/type_domain.hpp  |  1 +
 src/crab/type_ostream.cpp | 28 +++++++++++++++++-----------
 src/crab/type_ostream.hpp |  8 ++++----
 4 files changed, 33 insertions(+), 18 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 26582c276..77a6e3ed3 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -514,6 +514,11 @@ type_domain_t::find_offset_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_offset.find_offset_at_loc(loc);
 }
 
+std::optional<crab::mock_interval_t>
+type_domain_t::find_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_interval.find_interval_at_loc(loc);
+}
+
 std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
     typ.write(o);
     return o;
@@ -544,14 +549,16 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
         if (std::holds_alternative<Call>(statement)) {
             auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(r0_reg);
-            print_annotated(o, std::get<Call>(statement), region);
+            auto interval = typ.find_interval_at_loc(r0_reg);
+            print_annotated(o, std::get<Call>(statement), region, interval);
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
             auto offset = typ.find_offset_at_loc(reg_with_loc);
-            print_annotated(o, b, region, offset);
+            auto interval = typ.find_interval_at_loc(reg_with_loc);
+            print_annotated(o, b, region, offset, interval);
         }
         else if (std::holds_alternative<Mem>(statement)) {
             auto u = std::get<Mem>(statement);
@@ -560,7 +567,8 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
                 auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
                 auto offset = typ.find_offset_at_loc(target_reg_loc);
-                print_annotated(o, u, region, offset);
+                auto interval = typ.find_interval_at_loc(target_reg_loc);
+                print_annotated(o, u, region, offset, interval);
             }
             else o << "  " << u << "\n";
         }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 754903b0d..c6b0c23aa 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -89,6 +89,7 @@ class type_domain_t final {
     void print_stack() const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::dist_t> find_offset_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::mock_interval_t> find_interval_at_loc(const crab::reg_with_loc_t&) const;
 
   private:
 
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 34f8de6b7..09c35b45b 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -15,7 +15,12 @@ void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr, std::optio
 void print_number(std::ostream& o, crab::interval_t n) {
     o << "number";
     if (!n.is_top()) {
-        o << "<" << n << ">";
+        if (auto n_singleton = n.singleton()) {
+            o << "<" << *n_singleton << ">";
+        }
+        else {
+            o << "<" << n << ">";
+        }
     }
 }
 
@@ -28,41 +33,42 @@ void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or
     }
 }
 
-void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d) {
+void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d, std::optional<crab::mock_interval_t> n) {
     o << r << " : ";
     if (p) {
         print_ptr_or_mapfd_type(o, *p, d);
     }
-    else {
-        print_number(o, crab::interval_t::top());
+    else if (n) {
+        print_number(o, n->to_interval());
     }
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p,
+        std::optional<crab::mock_interval_t>& n) {
     o << "  ";
-    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, std::nullopt);
+    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, std::nullopt, n);
     o << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::dist_t>& d) {
+        std::optional<crab::dist_t>& d, std::optional<crab::mock_interval_t>& n) {
     o << "  ";
-    print_register(o, b.dst, p, d);
+    print_register(o, b.dst, p, d, n);
     o << " " << b.op << "= " << b.v << "\n";
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(o, u.dst, p, std::nullopt);
+    print_register(o, u.dst, p, std::nullopt, std::nullopt);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::dist_t>& d) {
+        std::optional<crab::dist_t>& d, std::optional<crab::mock_interval_t>& n) {
     o << "  ";
-    print_register(o, std::get<Reg>(b.value), p, d);
+    print_register(o, std::get<Reg>(b.value), p, d, n);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
     int offset = std::abs(b.access.offset);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 554a14e8e..0040f4ed2 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -12,8 +12,8 @@
 void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&, std::optional<crab::dist_t>);
 void print_number(std::ostream&, crab::interval_t);
 void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t>);
-void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>);
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&);
+void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::mock_interval_t>&);
+void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&);
+void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);

From 9eb343e655438cfa46d36b7b183169b956f86c04 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 13 Sep 2023 00:01:11 -0400
Subject: [PATCH 125/373] Fixes and refactor in Bin, Call, Assume, and Mem
 transformers

Better handling of certain Bin operations: LSH, LSHR, ASHR, AND;
In Call, added support for removing overlap from the stack before
storing numbers in Call;
Fixes in Assume, w.r.t., GT, GE, LT, LE, NEQ
Some fixes in Bin and Assume that caused wrong modification of
intervals;
In Mem, fixing Load from stack when reading a part of number, rather
than the whole number;
In Mem, some additions/fixes related to separate handling of ctx,
packet, and shared when loading a number;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 429 +++++++++++++++++++++---------
 src/crab/interval_prop_domain.hpp |  26 +-
 src/crab/type_domain.cpp          |  77 +++---
 src/crab/type_domain.hpp          |   4 +-
 4 files changed, 357 insertions(+), 179 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 5ccc549c1..9a9994af4 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -86,20 +86,10 @@ void registers_cp_state_t::adjust_bb_for_registers(location_t loc) {
 }
 
 void registers_cp_state_t::operator-=(register_t var) {
-    if (is_bottom()) {
-        return;
-    }
+    if (is_bottom()) return;
     m_cur_def[var] = nullptr;
 }
 
-void registers_cp_state_t::print_all_register_types() const {
-    std::cout << "\tinterval types: {\n";
-    for (auto const& kv : *m_interval_env) {
-        std::cout << "\t\t" << kv.first << " : " << kv.second.to_interval() << "\n";
-    }
-    std::cout << "\t}\n";
-}
-
 bool stack_cp_state_t::is_bottom() const {
     return m_is_bottom;
 }
@@ -418,32 +408,33 @@ void interval_prop_domain_t::operator()(const Packet &u, location_t loc, int pri
     m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
 }
 
-void interval_prop_domain_t::assume_lt(bool strict, interval_t&& left_interval,
-        interval_t&& right_interval, register_t left, Value right, location_t loc) {
+void interval_prop_domain_t::assume_lt(bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
+        register_t left, Value right, location_t loc) {
     auto reg_with_loc_left = reg_with_loc_t(left, loc);
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
     auto llb = left_interval.lb();
     auto lub = left_interval.ub();
+    auto rlb_orig = right_interval_orig.lb();
+    auto rub_orig = right_interval_orig.ub();
+    auto llb_orig = left_interval_orig.lb();
+    auto lub_orig = left_interval_orig.ub();
 
-    auto ub = strict ? (right_interval.lb() - number_t{1}) : right_interval.lb();
-    if (lub >= rlb && llb < rlb) {
-        auto interval_to_insert = interval_t(llb, strict ? rlb - number_t{1} : rlb);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
-    }
-    else if (right_interval <= left_interval && strict ? llb < rlb : llb <= rlb) {
-        auto interval_to_insert = interval_t(llb, strict ? rlb - number_t{1} : rlb);
+    if (strict ? llb < rlb : llb <= rlb && lub >= rlb) {
+        auto interval_to_insert = interval_t(llb_orig, strict ? rlb - number_t{1} : rlb);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
     }
     else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub &&
             std::holds_alternative<Reg>(right)) {
         auto right_reg = std::get<Reg>(right).v;
         auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
-        auto interval_to_insert = interval_t(strict ? lub + number_t{1} : lub, rub);
+        auto interval_to_insert = interval_t(strict ? lub + number_t{1} : lub, rub_orig);
         m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
     }
-    else if (lub > rub && strict ? llb < rub : llb <= rub) {
-        auto interval_to_insert_left = interval_t(llb, strict ? rub - number_t{1} : rub);
+    else if (lub >= rub && strict ? llb < rub : llb <= rub) {
+        auto interval_to_insert_left = interval_t(llb_orig, strict ? rub - number_t{1} : rub);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
         // and set left to the rest of the interval < (or <=) of right
@@ -460,31 +451,33 @@ void interval_prop_domain_t::assume_lt(bool strict, interval_t&& left_interval,
     }
 }
 
-void interval_prop_domain_t::assume_gt(bool strict, interval_t&& left_interval,
-        interval_t&& right_interval, register_t left, Value right, location_t loc) {
+void interval_prop_domain_t::assume_gt(bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
+        register_t left, Value right, location_t loc) {
     auto reg_with_loc_left = reg_with_loc_t(left, loc);
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
     auto llb = left_interval.lb();
     auto lub = left_interval.ub();
+    auto rlb_orig = right_interval_orig.lb();
+    auto rub_orig = right_interval_orig.ub();
+    auto llb_orig = left_interval_orig.lb();
+    auto lub_orig = left_interval_orig.ub();
 
-    if (llb <= rub && lub > rub) {
-        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
-    }
-    else if (right_interval <= left_interval && strict ? lub > rub : lub >= rub) {
-        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub);
+    if (strict ? lub > rub : lub >= rub && llb <= rub) {
+        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub_orig);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
     }
     else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb &&
             std::holds_alternative<Reg>(right)) {
         auto right_reg = std::get<Reg>(right).v;
         auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
-        auto interval_to_insert = interval_t(rlb, strict ? llb - number_t{1} : llb);
+        auto interval_to_insert = interval_t(rlb_orig, strict ? llb - number_t{1} : llb);
         m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
     }
-    else if (llb < rlb && strict ? lub > rlb : lub >= rlb) {
-        auto interval_to_insert_left = interval_t(strict ? rlb + number_t{1} : rlb, lub);
+    else if (llb <= rlb && strict ? lub > rlb : lub >= rlb) {
+        auto interval_to_insert_left = interval_t(strict ? rlb + number_t{1} : rlb, lub_orig);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
         // and set left to the rest of the interval > (or >=) of right
@@ -502,8 +495,9 @@ void interval_prop_domain_t::assume_gt(bool strict, interval_t&& left_interval,
 }
 
 void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt,
-        interval_t&& left_interval, interval_t&& right_interval, register_t left,
-        Value right, location_t loc) {
+        interval_t&& left_interval, interval_t&& right_interval,
+        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
+        register_t left, Value right, location_t loc) {
 
     auto llb = left_interval.lb();
     auto lub = left_interval.ub();
@@ -512,32 +506,39 @@ void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt
     if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
         // Left unsigned interval is lower than right unsigned interval.
         m_registers_interval_values.set_to_bottom();
+        return;
     } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
         // Left unsigned interval is higher than right unsigned interval.
         m_registers_interval_values.set_to_bottom();
+        return;
     }
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left unsigned interval is lower than right unsigned interval.
         // TODO: verify if setting to top is the correct equivalent of returning linear cst true
         m_registers_interval_values.set_to_top();
+        return;
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left unsigned interval is higher than right unsigned interval.
         m_registers_interval_values.set_to_top();
+        return;
     }
 
     if (is_lt)
-        assume_lt(strict, std::move(left_interval), std::move(right_interval), left, right, loc);
+        assume_lt(strict, std::move(left_interval), std::move(right_interval),
+                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
     else
-        assume_gt(strict, std::move(left_interval), std::move(right_interval), left, right, loc);
+        assume_gt(strict, std::move(left_interval), std::move(right_interval),
+                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
 }
 
 void interval_prop_domain_t::assume_unsigned_cst_interval(Condition::Op op, bool is64,
-        interval_t&& left_interval, interval_t&& right_interval, register_t left, Value right,
-        location_t loc) {
+        interval_t&& left_interval, interval_t&& right_interval,
+        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
+        register_t left, Value right, location_t loc) {
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::unsigned_int(true))) {
-            *interval = interval->truncate_to_uint(true);
+        if (!(*interval <= interval_t::unsigned_int(is64))) {
+            *interval = interval->truncate_to_uint(is64);
         }
     }
 
@@ -564,12 +565,13 @@ void interval_prop_domain_t::assume_unsigned_cst_interval(Condition::Op op, bool
     bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
 
     assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
-            left, right, loc);
+            std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
 }
 
 void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool is64,
-        interval_t&& left_interval, interval_t&& right_interval, register_t left, Value right,
-        location_t loc) {
+        interval_t&& left_interval, interval_t&& right_interval,
+        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
+        register_t left, Value right, location_t loc) {
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
         if (!(*interval <= interval_t::signed_int(is64))) {
@@ -592,6 +594,7 @@ void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool i
     bool strict = op == Condition::Op::SLT || op == Condition::Op::SGT;
 
     assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
+            std::move(left_interval_orig), std::move(right_interval_orig),
             left, right, loc);
 }
 
@@ -611,11 +614,14 @@ void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t
     }
     else {
         imm = static_cast<int64_t>(std::get<Imm>(right).v);
+        right_interval = is64 ? interval_t(number_t{imm}) : interval_t(number_t{(uint64_t)imm});
     }
     if (left_interval.is_bottom() || (is_right_reg && right_interval.is_bottom())) {
-        m_registers_interval_values.set_to_bottom();
         return;
     }
+    interval_t left_interval_orig = left_interval;
+    interval_t right_interval_orig = right_interval;
+
     switch (op) {
         case Op::EQ:
         case Op::SGE:
@@ -623,8 +629,8 @@ void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t
         case Op::SGT:
         case Op::SLT: {
             assume_signed_cst_interval(op, is64, std::move(left_interval),
-                    is_right_reg ? std::move(right_interval) : interval_t(number_t{imm}),
-                    left, right, loc);
+                    std::move(right_interval), std::move(left_interval_orig),
+                    std::move(right_interval_orig), left, right, loc);
             break;
         }
         case Op::SET:
@@ -638,8 +644,8 @@ void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t
         case Op::GT:
         case Op::LT: {
             assume_unsigned_cst_interval(op, is64, std::move(left_interval),
-                    is_right_reg ? std::move(right_interval) : interval_t(number_t{(uint64_t)imm}),
-                    left, right, loc);
+                    std::move(right_interval), std::move(left_interval_orig),
+                    std::move(right_interval_orig), left, right, loc);
             break;
         }
     }
@@ -660,13 +666,14 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
         // we skip handling in this domain is when dst is pointer and src is numerical value
     if (bin.op != Op::MOV && dst_ptr_or_mapfd_opt && src_interval_opt) return;
     // if op is MOV,
-        // we skip handling in this domain is when both dst and src are pointers
-        // when dst is not known and src is pointer
-    if (bin.op == Op::MOV &&
-            ((dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt)
-             || (!dst_interval_opt && src_ptr_or_mapfd_opt)))
+        // we skip handling in this domain is when src is pointer,
+        // additionally, we forget the dst pointer
+    if (bin.op == Op::MOV && src_ptr_or_mapfd_opt) {
+        m_registers_interval_values -= bin.dst.v;
         return;
+    }
 
+    int finite_width = bin.is64 ? 64 : 32;
     uint64_t imm = std::holds_alternative<Imm>(bin.v) ? std::get<Imm>(bin.v).v : 0;
     interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
     if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
@@ -677,9 +684,10 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
     {
         // ra = b
         case Op::MOV: {
-            if (src_interval_opt)
+            if (src_interval_opt) {
                 dst_interval = src_interval;
-            else if (dst_interval_opt) {
+            }
+            else {
                 m_registers_interval_values -= bin.dst.v;
                 return;
             }
@@ -730,24 +738,166 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
         }
         // ra &= b
         case Op::AND: {
+            if ((int32_t)imm > 0) {
+                dst_interval = interval_t(number_t{0}, number_t(static_cast<int>(imm)));
+                break;
+            }
+            if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
+                // TODO: This is only based on observation, need to verify this
+                // This is done because we do not track uvalues and svalues separately
+                // however, current implementation of eBPF using zoneCrab does
+                // this operation mimics uvalue being not set (i.e., TOP)
+                dst_interval = interval_t::top();
+            }
+            if (!(src_interval <= interval_t::unsigned_int(bin.is64))) {
+                // likewise explanation as above
+                src_interval = interval_t::top();
+            }
+            if (imm != 0) {
+                src_interval = interval_t(number_t{(uint64_t)imm});
+            }
             dst_interval = dst_interval.And(src_interval);
-            if ((int32_t)imm > 0)
-                dst_interval = interval_t(number_t(0), number_t(static_cast<int>(imm)));
             break;
         }
         // ra <<= b
         case Op::LSH: {
-            dst_interval = dst_interval.Shl(src_interval);
+            if (imm == 0) {
+                if (std::optional<number_t> sn = src_interval.singleton()) {
+                    // TODO: verify if this is correct
+                    if (bin.is64) {
+                        uint64_t imm_val = sn->cast_to_uint64() & 63;
+                        if (!(imm_val <= INT32_MAX)) return;
+                        imm = (int32_t)imm_val;
+                    }
+                    else {
+                        uint32_t imm_val = sn->cast_to_uint32() & 31;
+                        if (!(imm_val <= INT32_MAX)) return;
+                        imm = (int32_t)imm_val;
+                    }
+                }
+            }
+            if (imm != 0) {
+                // The BPF ISA requires masking the imm.
+                imm &= finite_width - 1;
+                if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
+                    // This is non-standard, but done to mimic uvalue being not set (i.e., TOP)
+                    dst_interval = interval_t::top();
+                }
+                if (dst_interval.finite_size()) {
+                    number_t lb = dst_interval.lb().number().value();
+                    number_t ub = dst_interval.ub().number().value();
+                    uint64_t lb_n = lb.cast_to_uint64();
+                    uint64_t ub_n = ub.cast_to_uint64();
+                    uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
+                    if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
+                        // The bits that will be shifted out to the left are different,
+                        // which means all combinations of remaining bits are possible.
+                        lb_n = 0;
+                        ub_n = (uint_max << imm) & uint_max;
+                    } else {
+                        // The bits that will be shifted out to the left are identical
+                        // for all values in the interval, so we can safely shift left
+                        // to get a new interval.
+                        lb_n = (lb_n << imm) & uint_max;
+                        ub_n = (ub_n << imm) & uint_max;
+                    }
+                    dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
+                }
+            }
+            else {
+                dst_interval = interval_t::top();
+            }
             break;
         }
         // ra >>= b
         case Op::RSH: {
-            dst_interval = dst_interval.LShr(src_interval);
+            if (imm == 0) {
+                if (std::optional<number_t> sn = src_interval.singleton()) {
+                    // TODO: verify if this is correct
+                    if (bin.is64) {
+                        uint64_t imm_val = sn->cast_to_uint64() & 63;
+                        if (!(imm_val <= INT32_MAX)) return;
+                        imm = (int32_t)imm_val;
+                    }
+                    else {
+                        uint32_t imm_val = sn->cast_to_uint32() & 31;
+                        if (!(imm_val <= INT32_MAX)) return;
+                        imm = (int32_t)imm_val;
+                    }
+                }
+            }
+            if (imm != 0) {
+                imm &= finite_width - 1;
+                number_t lb_n{0};
+                number_t ub_n{UINT64_MAX >> imm};
+                if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
+                    // This is done because we do not track uvalues and svalues separately
+                    // however, current implementation of eBPF using zoneCrab does
+                    // this operation mimics uvalue being not set (i.e., TOP)
+                    dst_interval = interval_t::top();
+                }
+                if (dst_interval.finite_size()) {
+                    number_t lb = dst_interval.lb().number().value();
+                    number_t ub = dst_interval.ub().number().value();
+                    if (finite_width == 64) {
+                        lb_n = lb.cast_to_uint64() >> imm;
+                        ub_n = ub.cast_to_uint64() >> imm;
+                    } else {
+                        number_t lb_w = lb.cast_to_signed_finite_width(finite_width);
+                        number_t ub_w = ub.cast_to_signed_finite_width(finite_width);
+                        lb_n = lb_w.cast_to_uint32() >> imm;
+                        ub_n = ub_w.cast_to_uint32() >> imm;
+
+                        // The interval must be valid since a signed range crossing 0
+                        // was earlier converted to a full unsigned range.
+                        assert(lb_n <= ub_n);
+                    }
+                }
+                if ((int64_t)ub_n >= (int64_t)lb_n) {
+                    dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
+                } else {
+                    dst_interval = interval_t::top();
+                }
+            }
+            else {
+                dst_interval = interval_t::top();
+            }
             break;
         }
         // ra >>>= b
         case Op::ARSH: {
-            dst_interval = dst_interval.AShr(src_interval);
+            for (interval_t* interval : {&dst_interval, &src_interval}) {
+                if (!(*interval <= interval_t::signed_int(finite_width == 64))) {
+                    *interval = interval->truncate_to_sint(finite_width == 64);
+                }
+            }
+
+            if (auto sn = src_interval.singleton()) {
+                // The BPF ISA requires masking the imm.
+                int64_t imm = sn->cast_to_sint64() & (finite_width - 1);
+
+                int64_t lb_n = INT64_MIN >> imm;
+                int64_t ub_n = INT64_MAX >> imm;
+                if (dst_interval.finite_size()) {
+                    number_t lb = dst_interval.lb().number().value();
+                    number_t ub = dst_interval.ub().number().value();
+                    if (finite_width == 64) {
+                        lb_n = lb.cast_to_sint64() >> imm;
+                        ub_n = ub.cast_to_sint64() >> imm;
+                    } else {
+                        number_t lb_w = lb.cast_to_signed_finite_width(finite_width) >> (int)imm;
+                        number_t ub_w = ub.cast_to_signed_finite_width(finite_width) >> (int)imm;
+                        if (lb_w.cast_to_uint32() <= ub_w.cast_to_uint32()) {
+                            lb_n = lb_w.cast_to_uint32();
+                            ub_n = ub_w.cast_to_uint32();
+                        }
+                    }
+                }
+                dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
+            }
+            else {
+                dst_interval = interval_t::top();
+            }
             break;
         }
         // ra ^= b
@@ -756,7 +906,7 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
             break;
         }
         default: {
-            dst_interval = interval_t::top();
+            dst_interval = interval_t::bottom();
             break;
         }
     }
@@ -765,99 +915,104 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
 
 
 void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
-        std::optional<ptr_or_mapfd_t> basereg_type, std::optional<ptr_or_mapfd_t> targetreg_type,
-        location_t loc) {
+        std::optional<ptr_or_mapfd_t> basereg_type, bool load_in_region, location_t loc) {
+
     if (!basereg_type) {
         m_registers_interval_values -= target_reg.v;
         return;
     }
 
-    auto basereg_ptr_or_mapfd_type = basereg_type.value();
-    int offset = b.access.offset;
+    auto reg_with_loc = reg_with_loc_t(target_reg.v, loc);
+    // we check if we already loaded a pointer from ctx or stack in region domain,
+        // we then do not store a number
+    if (load_in_region) {
+        m_registers_interval_values -= target_reg.v;
+        return;
+    }
     int width = b.access.width;
+    int offset = b.access.offset;
+    auto basereg_ptr_or_mapfd_type = basereg_type.value();
 
-    auto reg_with_loc = reg_with_loc_t(target_reg.v, loc);
-    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_or_mapfd_type)) {
-        auto p_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
-        if (p_with_off.get_region() == crab::region_t::T_STACK) {
-            auto ptr_offset = p_with_off.get_offset();
-            auto load_at_interval = ptr_offset.to_interval() + interval_t{number_t(static_cast<int>(offset))};
-            auto load_at_singleton = load_at_interval.singleton();
-            if (load_at_singleton) {
-                auto load_at = load_at_singleton.value();
-                auto loaded = m_stack_slots_interval_values.find((uint64_t)load_at);
-                if (loaded) {
-                    auto loaded_cells = loaded.value();
-                    m_registers_interval_values.insert(target_reg.v, reg_with_loc,
-                            loaded_cells.first.to_interval());
-                    return;
-                }
-            }
-            auto load_at_lb_opt = load_at_interval.lb().number();
-            auto load_at_ub_opt = load_at_interval.ub().number();
-            if (!load_at_lb_opt || !load_at_ub_opt) {
-                m_registers_interval_values -= target_reg.v;
-                //std::cout << "type error: missing offset information\n";
-                m_errors.push_back("missing offset information");
-                return;
-            }
-            auto load_at_lb = load_at_lb_opt.value();
-            auto load_at_ub = load_at_ub_opt.value();
-            auto start = (uint64_t)load_at_lb;
-            auto width_to_check = (int)(load_at_ub+number_t(width)-load_at_lb);
+    if (is_ctx_ptr(basereg_type)) {
+        m_registers_interval_values.insert(target_reg.v, reg_with_loc, interval_t::top());
+        return;
+    }
+    if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
+        interval_t to_insert = interval_t::top();
+        if (width == 1) to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
+        else if (width == 2) to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
+        m_registers_interval_values.insert(target_reg.v, reg_with_loc, to_insert);
+        return;
+    }
 
-            if (m_stack_slots_interval_values.all_numeric(start, width_to_check)) {
+    if (is_stack_ptr(basereg_type)) {
+        auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
+        auto p_offset = ptr_with_off.get_offset();
+        auto load_at = p_offset.to_interval() + interval_t(number_t{offset});
+        uint64_t start_offset = 0;
+        if (auto load_at_singleton = load_at.singleton()) {
+            start_offset = (uint64_t)(*load_at_singleton);
+            if (auto loaded = m_stack_slots_interval_values.find(start_offset)) {
                 m_registers_interval_values.insert(target_reg.v, reg_with_loc,
-                        interval_t::top());
+                        (*loaded).first.to_interval());
+                return;
             }
-            else {
-                m_registers_interval_values -= target_reg.v;
+        }
+        else {
+            auto load_at_lb = load_at.lb();
+            auto load_at_ub = load_at.ub();
+            if (auto finite_size = load_at.finite_size()) {
+                if (auto load_at_lb = load_at.lb().number()) {
+                    start_offset = (uint64_t)(*load_at_lb);
+                    width = (int)(*finite_size + number_t{width});
+                }
             }
+        }
+        if (m_stack_slots_interval_values.all_numeric(start_offset, width)) {
+            m_registers_interval_values.insert(target_reg.v, reg_with_loc,
+                    interval_t::top());
             return;
         }
     }
-    // we check targetreg_type because in case we already loaded a pointer from ctx,
-        // we then do not store a number
-    if (!targetreg_type) {  // we are loading from ctx, packet or shared
-        m_registers_interval_values.insert(target_reg.v, reg_with_loc, interval_t::top());
-    }
-    else {
-        m_registers_interval_values -= target_reg.v;
-    }
+    m_registers_interval_values -= target_reg.v;
 }
 
-void interval_prop_domain_t::do_mem_store(const Mem& b, const Reg& target_reg,
-        std::optional<ptr_or_mapfd_t> basereg_type) {
+void interval_prop_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> basereg_type) {
     int offset = b.access.offset;
     int width = b.access.width;
 
-    if (!basereg_type) {
+    if (!is_stack_ptr(basereg_type)) {
+        // we only store for stack pointers
         return;
     }
-    auto basereg_ptr_or_mapfd_type = basereg_type.value();
-    auto targetreg_type = m_registers_interval_values.find(target_reg.v);
-    if (std::holds_alternative<ptr_with_off_t>(basereg_ptr_or_mapfd_type)) {
-        auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
-        auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
-        if (!offset_singleton) {
-            //std::cout << "type error: doing a store with unknown offset\n";
-            m_errors.push_back("doing a store with unknown offset");
-            return;
-        }
-        auto store_at = (uint64_t)offset_singleton.value() + (uint64_t)offset;
-        if (basereg_ptr_with_off_type.get_region() == crab::region_t::T_STACK) {
-            auto overlapping_cells
-                = m_stack_slots_interval_values.find_overlapping_cells(store_at, width);
-            m_stack_slots_interval_values.remove_overlap(overlapping_cells, store_at, width);
-
-            // if targetreg_type is empty, we are storing a pointer
-            if (!targetreg_type) return;
 
-            auto type_to_store = targetreg_type.value();
-            m_stack_slots_interval_values.store(store_at, type_to_store, width);
+    auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(*basereg_type);
+    auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
+    if (!offset_singleton) {
+        //std::cout << "type error: doing a store with unknown offset\n";
+        m_errors.push_back("doing a store with unknown offset");
+        return;
+    }
+    auto store_at = (uint64_t)(*offset_singleton + offset);
+    auto overlapping_cells = m_stack_slots_interval_values.find_overlapping_cells(store_at, width);
+    m_stack_slots_interval_values.remove_overlap(overlapping_cells, store_at, width);
+
+    std::optional<interval_t> targetreg_type;
+    if (std::holds_alternative<Reg>(b.value)) {
+        auto target_reg = std::get<Reg>(b.value);
+        if (auto targetreg_mock_interval = m_registers_interval_values.find(target_reg.v)) {
+            targetreg_type = targetreg_mock_interval->to_interval();
         }
     }
-    else {}
+    else {
+        auto imm = static_cast<int64_t>(std::get<Imm>(b.value).v);
+        targetreg_type = interval_t(number_t{imm});
+    }
+
+    // if targetreg_type is empty, we are storing a pointer
+    // else, we store a number
+    if (targetreg_type)
+        m_stack_slots_interval_values.store(store_at, *targetreg_type, width);
 }
 
 void interval_prop_domain_t::set_require_check(check_require_func_t f) {}
@@ -878,4 +1033,14 @@ bool interval_prop_domain_t::all_numeric_in_stack(uint64_t start_loc, int width)
     return m_stack_slots_interval_values.all_numeric(start_loc, width);
 }
 
+std::vector<uint64_t> interval_prop_domain_t::find_overlapping_cells_in_stack(uint64_t start_loc,
+        int width) const {
+    return m_stack_slots_interval_values.find_overlapping_cells(start_loc, width);
+}
+
+void interval_prop_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_stack_slots_interval_values.remove_overlap(overlap, start_loc, width);
+}
+
 } // namespace crab
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 6e87513b7..844ecbbdf 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -43,7 +43,6 @@ class registers_cp_state_t {
                 bool is_bottom = false)
             : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
         void adjust_bb_for_registers(location_t);
-        void print_all_register_types() const;
 };
 
 using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
@@ -144,28 +143,31 @@ class interval_prop_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>,
-            std::optional<ptr_or_mapfd_t>, location_t);
-    void do_mem_store(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>);
+    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, bool, location_t);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const interval_values_stack_t&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
             const interval_t&, location_t);
-    void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&, register_t,
-            Value, location_t);
-    void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&, register_t,
-            Value, location_t);
+    void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
+            interval_t&&, interval_t&&, register_t, Value, location_t);
+    void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
+            interval_t&&, interval_t&&, register_t, Value, location_t);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
-    void assume_lt(bool, interval_t&&, interval_t&&, register_t, Value, location_t);
-    void assume_gt(bool, interval_t&&, interval_t&&, register_t, Value, location_t);
-    void assume_gt_and_lt(bool, bool, bool, interval_t&&, interval_t&&, register_t,
-            Value, location_t);
+    void assume_lt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
+            register_t, Value, location_t);
+    void assume_gt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
+            register_t, Value, location_t);
+    void assume_gt_and_lt(bool, bool, bool, interval_t&&, interval_t&&,
+            interval_t&&, interval_t&&, register_t, Value, location_t);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
     void adjust_bb_for_types(location_t);
     std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
+    std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
+    void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
 }; // end interval_prop_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 77a6e3ed3..a06bee2a4 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -129,23 +129,27 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
             auto maybe_width_interval = m_interval.find_interval_value(param.size.v);
             if (!maybe_ptr_or_mapfd || !maybe_width_interval) continue;
-            auto ptr_or_mapfd = maybe_ptr_or_mapfd.value();
-            auto width_interval = maybe_width_interval->to_interval();
-            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
-                auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
-                if (ptr_with_off.get_region() == region_t::T_STACK) {
-                    auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
-                    if (!offset_singleton) {
-                        //std::cout << "type error: storing at an unknown offset in stack\n";
-                        m_errors.push_back("storing at an unknown offset in stack");
-                        continue;
-                    }
-                    // TODO: forget the stack at [offset, offset+width]
-                    auto offset = (uint64_t)offset_singleton.value();
-                    if (auto single_width = width_interval.singleton(); single_width) {
-                        int width = (int)single_width.value();
-                        stack_values[offset] = std::make_pair(interval_t::top(), width);
-                    }
+            if (is_stack_ptr(maybe_ptr_or_mapfd)) {
+                auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
+                auto width_interval = maybe_width_interval->to_interval();
+
+                auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
+                if (!offset_singleton) {
+                    //std::cout << "type error: storing at an unknown offset in stack\n";
+                    m_errors.push_back("storing at an unknown offset in stack");
+                    continue;
+                }
+                auto offset = (uint64_t)offset_singleton.value();
+                if (auto single_width = width_interval.singleton()) {
+                    int width = (int)single_width.value();
+
+                    // Removing overlapping cells
+                    // TODO: do it for all domains
+                    auto overlapping_cells
+                        = m_interval.find_overlapping_cells_in_stack(offset, width);
+                    m_interval.remove_overlap_in_stack(overlapping_cells, offset, width);
+
+                    stack_values[offset] = std::make_pair(interval_t::top(), width);
                 }
             }
         }
@@ -342,10 +346,6 @@ type_domain_t type_domain_t::setup_entry() {
 
 void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     if (is_bottom()) return;
-    auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
-    auto dst_interval = m_interval.find_interval_value(bin.dst.v);
-    assert(!dst_ptr_or_mapfd || !dst_interval);
-
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
     std::optional<interval_t> src_interval;
 
@@ -367,7 +367,13 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
         }
         src_interval = interval_t{number_t{imm}};
     }
-    //assert(!src_ptr_or_mapfd || !src_interval);
+    assert(!src_ptr_or_mapfd || !src_interval);
+
+    auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
+    auto dst_mock_interval = m_interval.find_interval_value(bin.dst.v);
+    auto dst_interval = dst_mock_interval ? dst_mock_interval->to_interval() :
+        std::optional<interval_t>();
+    assert(!dst_ptr_or_mapfd.has_value() || !dst_interval.has_value());
 
     using Op = Bin::Op;
     // for all operations except mov, add, sub, the src and dst should be numbers
@@ -384,30 +390,34 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
     interval_t subtracted_reg =
         m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     interval_t subtracted_off =
-        m_offset.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+        m_offset.do_bin(bin, src_interval, dst_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
     auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
-    m_interval.do_bin(bin, src_interval, interval_t::top(), src_ptr_or_mapfd, dst_ptr_or_mapfd,
+    m_interval.do_bin(bin, src_interval, dst_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd,
             subtracted, loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
-        std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc, int print) {
+        std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
     m_region.do_load(b, target_reg, unknown_ptr, loc);
     m_offset.do_load(b, target_reg, basereg_opt, loc);
-    m_interval.do_load(b, target_reg, basereg_opt, std::nullopt, loc);
+    // TODO: replace with a bool value returned from region do_load
+    auto load_in_region = m_region.find_ptr_or_mapfd_type(target_reg.v).has_value();
+    m_interval.do_load(b, target_reg, basereg_opt, load_in_region, loc);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> target_opt,
-        std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc, int print) {
+        std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc) {
     m_region.do_mem_store(b, loc);
-    m_interval.do_mem_store(b, get<Reg>(b.value), basereg_opt);
+    m_interval.do_mem_store(b, basereg_opt);
+    // TODO: replace target_opt with a bool value representing whether we have a packet pointer,
+    // because that is the case target_opt is needed for
     m_offset.do_mem_store(b, target_opt, basereg_opt);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     auto basereg = b.access.basereg;
-    auto ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
-    bool unknown_ptr = !ptr_or_mapfd_opt.has_value();
+    auto base_ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
+    bool unknown_ptr = !base_ptr_or_mapfd_opt.has_value();
     if (unknown_ptr) {
         std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
         m_errors.push_back(
@@ -416,11 +426,11 @@ void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
         auto targetreg_type = m_region.find_ptr_or_mapfd_type(targetreg.v);
-        if (b.is_load) do_load(b, targetreg, unknown_ptr, ptr_or_mapfd_opt, loc, print);
-        else if (!unknown_ptr) do_mem_store(b, targetreg_type, ptr_or_mapfd_opt, loc, print);
+        if (b.is_load) do_load(b, targetreg, unknown_ptr, base_ptr_or_mapfd_opt, loc);
+        else if (!unknown_ptr) do_mem_store(b, targetreg_type, base_ptr_or_mapfd_opt, loc);
     }
     else if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, std::nullopt, ptr_or_mapfd_opt, loc, print);
+        do_mem_store(b, std::nullopt, base_ptr_or_mapfd_opt, loc);
     }
 }
 
@@ -482,6 +492,7 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
         print_annotated(std::cout, *this, bb, print);
         return;
     }
+
     // A temporary fix to avoid printing errors for multiple basic blocks
     m_errors.clear();
     m_region.reset_errors();
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index c6b0c23aa..5438a508e 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -94,9 +94,9 @@ class type_domain_t final {
   private:
 
     void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
-            location_t, int print = 0);
+            location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&,
-            location_t, int print = 0);
+            location_t);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);

From fdec8af3e5c41551b87bfd358c8ca2e0b2255aa6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Sep 2023 12:39:00 -0400
Subject: [PATCH 126/373] Implemented Un, fixed/improved multiple operations

Implemented Un (unary) operations for Interval Propagation domain;
Improved ValidSize, ValidStore, Addable, Comparable, TypeConstraint,
LoadMapFd for Interval Prop.;
Added implementation for ValidAccess for Interval Prop.;
Refactored other code;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 135 +++++++++++++++++++++++++++++-
 src/crab/interval_prop_domain.hpp |  32 +++----
 src/crab/type_domain.cpp          |  28 ++++++-
 3 files changed, 173 insertions(+), 22 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 9a9994af4..3cbfc3305 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 #include "crab/interval_prop_domain.hpp"
+#include "boost/endian/conversion.hpp"
 
 namespace crab {
 
@@ -359,8 +360,57 @@ interval_prop_domain_t interval_prop_domain_t::setup_entry() {
 }
 
 void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print) {
-    auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
-    m_registers_interval_values.insert(u.dst.v, reg_with_loc, interval_t::top());
+    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
+        if (std::optional<number_t> n = v.singleton()) {
+            if (n->fits_cast_to_int64()) {
+                input = (decltype(input))n.value().cast_to_sint64();
+                decltype(input) output = be_or_le(input);
+                auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
+                m_registers_interval_values.insert(u.dst.v, reg_with_loc,
+                        interval_t(number_t(output)));
+                return;
+            }
+        }
+        m_registers_interval_values -= u.dst.v;
+    };
+
+    auto mock_interval = m_registers_interval_values.find(u.dst.v);
+    if (!mock_interval) return;
+    interval_t interval = mock_interval->to_interval();
+
+    // Swap bytes.  For 64-bit types we need the weights to fit in a
+    // signed int64, but for smaller types we don't want sign extension,
+    // so we use unsigned which still fits in a signed int64.
+    switch (u.op) {
+    case Un::Op::BE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_big<uint16_t>);
+        break;
+    case Un::Op::BE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_big<uint32_t>);
+        break;
+    case Un::Op::BE64:
+        swap_endianness(std::move(interval), int64_t(0),
+                boost::endian::native_to_big<int64_t>);
+        break;
+    case Un::Op::LE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_little<uint16_t>);
+        break;
+    case Un::Op::LE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_little<uint32_t>);
+        break;
+    case Un::Op::LE64:
+        swap_endianness(std::move(interval), int64_t(0),
+                boost::endian::native_to_little<int64_t>);
+        break;
+    case Un::Op::NEG:
+        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
+        m_registers_interval_values.insert(u.dst.v, reg_with_loc, -interval);
+        break;
+    }
 }
 
 void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
@@ -383,7 +433,6 @@ void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc, int
 void interval_prop_domain_t::do_call(const Call& u, const interval_values_stack_t& store_in_stack,
         location_t loc) {
 
-    auto r0 = register_t{R0_RETURN_VALUE};
     for (const auto& kv : store_in_stack) {
         auto key = kv.first;
         auto width = kv.second.second;
@@ -393,6 +442,7 @@ void interval_prop_domain_t::do_call(const Call& u, const interval_values_stack_
         m_stack_slots_interval_values.store(kv.first, kv.second.first.to_interval(),
                 kv.second.second);
     }
+    auto r0 = register_t{R0_RETURN_VALUE};
     if (u.is_map_lookup) {
         m_registers_interval_values -= r0;
     }
@@ -402,10 +452,11 @@ void interval_prop_domain_t::do_call(const Call& u, const interval_values_stack_
     }
 }
 
-void interval_prop_domain_t::operator()(const Packet &u, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Packet& u, location_t loc, int print) {
     auto r0 = register_t{R0_RETURN_VALUE};
     auto r0_with_loc = reg_with_loc_t(r0, loc);
     m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
+    // TODO: scratch caller saved registers
 }
 
 void interval_prop_domain_t::assume_lt(bool strict,
@@ -1015,6 +1066,82 @@ void interval_prop_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_map
         m_stack_slots_interval_values.store(store_at, *targetreg_type, width);
 }
 
+void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+    bool is_comparison_check = s.width == (Value)Imm{0};
+    if (auto maybe_interval = m_registers_interval_values.find(s.reg.v)) {
+        if (!is_comparison_check) {
+            if (s.or_null) {
+                if (auto singleton = maybe_interval->to_interval().singleton()) {
+                    if (*singleton == number_t{0}) return;
+                }
+                m_errors.push_back("Non-null number");
+            }
+            else {
+                m_errors.push_back("Only pointers can be dereferenced");
+            }
+        }
+    }
+}
+
+void interval_prop_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Bin& b, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Call&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Exit&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Jmp&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Mem&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const LockAdd&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Assert&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Comparable&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const Addable&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const ValidStore&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const TypeConstraint&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const ValidMapKeyValue&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const ZeroCtxOffset&, location_t loc, int print) {
+    // nothing to do here
+}
+
+void interval_prop_domain_t::operator()(const basic_block_t& bb, bool check_termination, int print) {
+    // nothing to do here
+}
 void interval_prop_domain_t::set_require_check(check_require_func_t f) {}
 
 std::optional<interval_cells_t> interval_prop_domain_t::find_in_stack(uint64_t key) const {
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 844ecbbdf..ab8d0419b 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -116,27 +116,27 @@ class interval_prop_domain_t final {
     void operator-=(register_t reg) { m_registers_interval_values -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
+    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
     void operator()(const Un&, location_t loc = boost::none, int print = 0);
     void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Call&, location_t loc = boost::none, int print = 0);
+    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
+    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
+    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
     void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const LockAdd&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const LockAdd&, location_t loc = boost::none, int print = 0);
     void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
+    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
+    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
+    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
+    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const basic_block_t& bb, bool check_termination, int print = 0) {}
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
+    void operator()(const basic_block_t& bb, bool check_termination, int print = 0);
     void write(std::ostream& os) const;
     std::string domain_name() const;
     crab::bound_t get_instruction_count_upper_bound();
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index a06bee2a4..124eead8e 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -104,7 +104,7 @@ void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const Un& u, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+    m_interval(u, loc);
 }
 
 void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
@@ -229,9 +229,15 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
             m_offset.check_valid_access(s, reg_type, interval_type, width_interval);
         }
     }
+    else {
+        m_interval(s, loc);
+    }
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+    auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
+    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
+    assert(!reg_type || !mock_interval_type);
     m_region(s, loc);
 }
 
@@ -245,6 +251,8 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
     auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
     auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
+    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
+    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
         if (!is_shared_ptr(maybe_ptr_or_mapfd1)
@@ -261,14 +269,31 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const Addable& u, location_t loc, int print) {
+    auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.ptr.v);
+    auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.num.v);
+    auto maybe_num_type1 = m_interval.find_interval_value(u.ptr.v);
+    auto maybe_num_type2 = m_interval.find_interval_value(u.num.v);
+    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
+    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
     m_region(u, loc);
+    // TODO: move the definition from the region domain to the type domain
 }
 
 void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+    auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.mem.v);
+    auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.val.v);
+    auto maybe_num_type1 = m_interval.find_interval_value(u.mem.v);
+    auto maybe_num_type2 = m_interval.find_interval_value(u.val.v);
+    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
+    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
     m_region(u, loc);
+    // TODO: move the definition from the region domain to the type domain
 }
 
 void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+    auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
+    auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
+    assert(!maybe_ptr_or_mapfd || !maybe_num_type);
     m_interval(u, loc);
 }
 
@@ -298,7 +323,6 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
         auto mapfd = maybe_mapfd.value();
         if (is_mapfd_type(maybe_mapfd)) {
-            // TODO: define width
             auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);

From 1085e8eba0cf585c9603e6cd68c0395d0634ad04 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Sep 2023 13:47:46 -0400
Subject: [PATCH 127/373] Printing fix to fix unnecessary analysis

Fixed printing control that was causing unnecessary analysis to run, and
causing assert fails, when -v option not provided

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 16 ++++++----------
 src/crab/interval_prop_domain.hpp | 13 ++++++++-----
 src/crab_verifier.cpp             | 14 ++++++++------
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 3cbfc3305..73b48f9dc 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -326,7 +326,7 @@ interval_prop_domain_t interval_prop_domain_t::operator&(const interval_prop_dom
     return abs;
 }
 
-interval_prop_domain_t interval_prop_domain_t::widen(const interval_prop_domain_t& abs) const {
+interval_prop_domain_t interval_prop_domain_t::widen(const interval_prop_domain_t& abs, bool to_constants) {
     /* WARNING: The operation is not implemented yet.*/
     return abs;
 }
@@ -338,13 +338,13 @@ interval_prop_domain_t interval_prop_domain_t::narrow(const interval_prop_domain
 
 void interval_prop_domain_t::write(std::ostream& os) const {}
 
-std::string interval_prop_domain_t::domain_name() const {
-    return "interval_prop_domain";
+crab::bound_t interval_prop_domain_t::get_loop_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
 }
 
-crab::bound_t interval_prop_domain_t::get_instruction_count_upper_bound() {
+void interval_prop_domain_t::initialize_loop_counter(const label_t& label) {
     /* WARNING: The operation is not implemented yet.*/
-    return crab::bound_t{crab::number_t{0}};
 }
 
 string_invariant interval_prop_domain_t::to_set() {
@@ -1107,10 +1107,6 @@ void interval_prop_domain_t::operator()(const Mem&, location_t loc, int print) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const LockAdd&, location_t loc, int print) {
-    // nothing to do here
-}
-
 void interval_prop_domain_t::operator()(const Assert&, location_t loc, int print) {
     // nothing to do here
 }
@@ -1139,7 +1135,7 @@ void interval_prop_domain_t::operator()(const ZeroCtxOffset&, location_t loc, in
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const basic_block_t& bb, bool check_termination, int print) {
+void interval_prop_domain_t::operator()(const basic_block_t& bb, int print) {
     // nothing to do here
 }
 void interval_prop_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index ab8d0419b..482e963f9 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -108,7 +108,7 @@ class interval_prop_domain_t final {
     // meet
     interval_prop_domain_t operator&(const interval_prop_domain_t& other) const;
     // widening
-    interval_prop_domain_t widen(const interval_prop_domain_t& other) const;
+    interval_prop_domain_t widen(const interval_prop_domain_t& other, bool);
     // narrowing
     interval_prop_domain_t narrow(const interval_prop_domain_t& other) const;
     //forget
@@ -120,12 +120,13 @@ class interval_prop_domain_t final {
     void operator()(const Bin&, location_t loc = boost::none, int print = 0);
     void operator()(const Un&, location_t loc = boost::none, int print = 0);
     void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
+    void operator()(const Atomic&, location_t loc = boost::none, int print = 0) {}
     void operator()(const Call&, location_t loc = boost::none, int print = 0);
+    void operator()(const Callx&, location_t loc = boost::none, int print = 0) {}
     void operator()(const Exit&, location_t loc = boost::none, int print = 0);
     void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
     void operator()(const Mem&, location_t loc = boost::none, int print = 0);
     void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const LockAdd&, location_t loc = boost::none, int print = 0);
     void operator()(const Assume&, location_t loc = boost::none, int print = 0);
     void operator()(const Assert&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
@@ -136,10 +137,12 @@ class interval_prop_domain_t final {
     void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
     void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const basic_block_t& bb, bool check_termination, int print = 0);
+    void operator()(const FuncConstraint&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
-    std::string domain_name() const;
-    crab::bound_t get_instruction_count_upper_bound();
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t&);
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index bbab52b47..4c5d904f6 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -128,12 +128,14 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invarian
     checks_db db;
     if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN) {
         db = generate_report_type_domain(cfg, post_invariants);
-        auto exit_state = post_invariants.at(label_t::exit);
-        // only to print ctx and stack, fix later
-        exit_state(cfg.get_node(label_t::exit), -1);
-        for (const label_t& label : cfg.sorted_labels()) {
-            auto post_state = post_invariants.at(label);
-            post_state(cfg.get_node(label), thread_local_options.print_invariants);
+        if (thread_local_options.print_invariants) {
+            auto exit_state = post_invariants.at(label_t::exit);
+            // only to print ctx and stack, fix later
+            exit_state(cfg.get_node(label_t::exit), -1);
+            for (const label_t& label : cfg.sorted_labels()) {
+                auto post_state = post_invariants.at(label);
+                post_state(cfg.get_node(label), 1);
+            }
         }
     }
     else {

From e8289f225e512ab5b4a9d3bc3efea229b36e86ee Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 29 Sep 2023 13:27:23 -0400
Subject: [PATCH 128/373] Fixes with handling Assume

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 24 ++++++++++++++++++------
 src/crab/interval_prop_domain.hpp |  4 ++--
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 73b48f9dc..2edd36bce 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -462,7 +462,7 @@ void interval_prop_domain_t::operator()(const Packet& u, location_t loc, int pri
 void interval_prop_domain_t::assume_lt(bool strict,
         interval_t&& left_interval, interval_t&& right_interval,
         interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc) {
+        register_t left, Value right, location_t loc, bool is_signed) {
     auto reg_with_loc_left = reg_with_loc_t(left, loc);
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
@@ -474,7 +474,8 @@ void interval_prop_domain_t::assume_lt(bool strict,
     auto lub_orig = left_interval_orig.ub();
 
     if (strict ? llb < rlb : llb <= rlb && lub >= rlb) {
-        auto interval_to_insert = interval_t(llb_orig, strict ? rlb - number_t{1} : rlb);
+        auto lb = is_signed ? llb_orig : number_t{0};
+        auto interval_to_insert = interval_t(lb, strict ? rlb - number_t{1} : rlb);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
     }
     else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub &&
@@ -485,7 +486,8 @@ void interval_prop_domain_t::assume_lt(bool strict,
         m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
     }
     else if (lub >= rub && strict ? llb < rub : llb <= rub) {
-        auto interval_to_insert_left = interval_t(llb_orig, strict ? rub - number_t{1} : rub);
+        auto lb = is_signed ? llb_orig : number_t{0};
+        auto interval_to_insert_left = interval_t(lb, strict ? rub - number_t{1} : rub);
         m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
         // and set left to the rest of the interval < (or <=) of right
@@ -548,7 +550,7 @@ void interval_prop_domain_t::assume_gt(bool strict,
 void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt,
         interval_t&& left_interval, interval_t&& right_interval,
         interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc) {
+        register_t left, Value right, location_t loc, bool is_signed) {
 
     auto llb = left_interval.lb();
     auto lub = left_interval.ub();
@@ -572,11 +574,20 @@ void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt
         // Left unsigned interval is higher than right unsigned interval.
         m_registers_interval_values.set_to_top();
         return;
+    } else if (left_interval_orig.is_top() && right_interval_orig.is_top()) {
+        m_registers_interval_values.insert(left, reg_with_loc_t(left, loc), interval_t::top());
+        if (std::holds_alternative<Reg>(right)) {
+            auto right_reg = std::get<Reg>(right).v;
+            m_registers_interval_values.insert(right_reg, reg_with_loc_t(right_reg, loc),
+                    interval_t::top());
+        }
+        return;
     }
 
     if (is_lt)
         assume_lt(strict, std::move(left_interval), std::move(right_interval),
-                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
+                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc,
+                is_signed);
     else
         assume_gt(strict, std::move(left_interval), std::move(right_interval),
                 std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
@@ -616,7 +627,8 @@ void interval_prop_domain_t::assume_unsigned_cst_interval(Condition::Op op, bool
     bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
 
     assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
-            std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
+            std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc,
+            false);
 }
 
 void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool is64,
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 482e963f9..49ffb9e2a 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -158,11 +158,11 @@ class interval_prop_domain_t final {
             interval_t&&, interval_t&&, register_t, Value, location_t);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
     void assume_lt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
-            register_t, Value, location_t);
+            register_t, Value, location_t, bool);
     void assume_gt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
             register_t, Value, location_t);
     void assume_gt_and_lt(bool, bool, bool, interval_t&&, interval_t&&,
-            interval_t&&, interval_t&&, register_t, Value, location_t);
+            interval_t&&, interval_t&&, register_t, Value, location_t, bool = true);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;

From 45a97e46317c7ab82e5b9c9ae4aedfddd3442f71 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 6 Oct 2023 12:36:33 -0400
Subject: [PATCH 129/373] Implemented stack all numeric in valid access

Checking that stack is all numeric in certain location was needed in the
Valid Access check;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 39 +++++++++++++++++++++++++++----
 src/crab/interval_prop_domain.hpp |  2 ++
 src/crab/type_domain.cpp          | 18 ++++++++++----
 3 files changed, 50 insertions(+), 9 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 2edd36bce..1992c8938 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -1078,12 +1078,39 @@ void interval_prop_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_map
         m_stack_slots_interval_values.store(store_at, *targetreg_type, width);
 }
 
-void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
-    bool is_comparison_check = s.width == (Value)Imm{0};
-    if (auto maybe_interval = m_registers_interval_values.find(s.reg.v)) {
+void interval_prop_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
+        std::optional<interval_t> width_interval, bool check_stack_all_numeric) {
+
+    if (check_stack_all_numeric) {
+        uint64_t start_offset = 0;
+        int width = 0;
+        auto start_interval = interval + interval_t{number_t{s.offset}};
+        if (auto finite_size = start_interval.finite_size()) {
+            if (auto start_interval_lb = start_interval.lb().number()) {
+                start_offset = (uint64_t)(*start_interval_lb);
+                if (auto width_interval_ub = width_interval->ub().number()) {
+                    width = (int)(*finite_size + *width_interval_ub);
+                    if (!m_stack_slots_interval_values.all_numeric(start_offset, width)) {
+                        m_errors.push_back("Stack access not numeric");
+                    }
+                }
+                else {
+                    m_errors.push_back("Width information not available");
+                }
+            }
+            else {
+                m_errors.push_back("Offset information not available");
+            }
+        }
+        else {
+            m_errors.push_back("Register interval not finite for stack access");
+        }
+    }
+    else {
+        bool is_comparison_check = s.width == (Value)Imm{0};
         if (!is_comparison_check) {
             if (s.or_null) {
-                if (auto singleton = maybe_interval->to_interval().singleton()) {
+                if (auto singleton = interval.singleton()) {
                     if (*singleton == number_t{0}) return;
                 }
                 m_errors.push_back("Non-null number");
@@ -1095,6 +1122,10 @@ void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc, in
     }
 }
 
+void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+    // nothing to do here
+}
+
 void interval_prop_domain_t::operator()(const Undefined& u, location_t loc, int print) {
     // nothing to do here
 }
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 49ffb9e2a..9f674d9b7 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -152,6 +152,8 @@ class interval_prop_domain_t final {
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
             const interval_t&, location_t);
+    void check_valid_access(const ValidAccess&, interval_t&&, std::optional<interval_t>,
+            bool = false);
     void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
             interval_t&&, interval_t&&, register_t, Value, location_t);
     void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 124eead8e..087f2e8a7 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -218,19 +218,27 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
         std::optional<mock_interval_t> width_mock_interval;
         if (std::holds_alternative<Reg>(s.width)) {
             width_mock_interval = m_interval.find_interval_value(std::get<Reg>(s.width).v);
+            if (!width_mock_interval) {
+                m_errors.push_back("width is unknown for valid access");
+                return;
+            }
         }
         else {
             auto imm = std::get<Imm>(s.width); 
-            width_mock_interval = mock_interval_t{interval_t(number_t{imm.v}, number_t{imm.v})};
+            width_mock_interval = mock_interval_t{interval_t{number_t{imm.v}}};
         }
-        auto width_interval = 
-            width_mock_interval ? width_mock_interval->to_interval() : std::optional<interval_t>{};
+        auto width_interval = width_mock_interval->to_interval();
         if (is_packet_ptr(reg_type)) {
-            m_offset.check_valid_access(s, reg_type, interval_type, width_interval);
+            m_offset.check_valid_access(s, reg_type, interval_type, std::optional<interval_t>{});
+        }
+        if (s.access_type == AccessType::read && is_stack_ptr(reg_type)) {
+            auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
+            auto offset_ptr = stack_ptr.get_offset().to_interval();
+            m_interval.check_valid_access(s, std::move(offset_ptr), width_interval, true);
         }
     }
     else {
-        m_interval(s, loc);
+        m_interval.check_valid_access(s, std::move(*interval_type), std::nullopt);
     }
 }
 

From 63ddd8e80afc8fc1ab8f5870da3a369a90bd8e33 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 6 Oct 2023 13:59:46 -0400
Subject: [PATCH 130/373] Fixed issues with Valid Access for all domains

The Valid Access was not being checked correctly when width is stored in
a register, hence it passed the cases when it should fail;
For Region and Offset domain, added required implementations;
Refactoring and simplification in Type and Interval Propagation domains;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp | 17 +++++------------
 src/crab/interval_prop_domain.hpp |  3 +--
 src/crab/offset_domain.cpp        |  6 +-----
 src/crab/offset_domain.hpp        |  3 +--
 src/crab/region_domain.cpp        |  9 ++++++---
 src/crab/region_domain.hpp        |  1 +
 src/crab/type_domain.cpp          | 22 ++++++++++++++--------
 7 files changed, 29 insertions(+), 32 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 1992c8938..2000c3ffa 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -1079,23 +1079,16 @@ void interval_prop_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_map
 }
 
 void interval_prop_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
-        std::optional<interval_t> width_interval, bool check_stack_all_numeric) {
+        int width, bool check_stack_all_numeric) {
 
     if (check_stack_all_numeric) {
-        uint64_t start_offset = 0;
-        int width = 0;
         auto start_interval = interval + interval_t{number_t{s.offset}};
         if (auto finite_size = start_interval.finite_size()) {
             if (auto start_interval_lb = start_interval.lb().number()) {
-                start_offset = (uint64_t)(*start_interval_lb);
-                if (auto width_interval_ub = width_interval->ub().number()) {
-                    width = (int)(*finite_size + *width_interval_ub);
-                    if (!m_stack_slots_interval_values.all_numeric(start_offset, width)) {
-                        m_errors.push_back("Stack access not numeric");
-                    }
-                }
-                else {
-                    m_errors.push_back("Width information not available");
+                auto start_offset = (uint64_t)(*start_interval_lb);
+                int width_from_start = (int)(*finite_size) + width;
+                if (!m_stack_slots_interval_values.all_numeric(start_offset, width_from_start)) {
+                    m_errors.push_back("Stack access not numeric");
                 }
             }
             else {
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 9f674d9b7..7b3c9b093 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -152,8 +152,7 @@ class interval_prop_domain_t final {
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
             const interval_t&, location_t);
-    void check_valid_access(const ValidAccess&, interval_t&&, std::optional<interval_t>,
-            bool = false);
+    void check_valid_access(const ValidAccess&, interval_t&&, int, bool = false);
     void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
             interval_t&&, interval_t&&, register_t, Value, location_t);
     void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index ade57da3b..12f9a7f9b 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -840,17 +840,13 @@ bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
-        std::optional<ptr_or_mapfd_t>& reg_type,
-        std::optional<interval_t>, std::optional<interval_t>) {
-    if (std::holds_alternative<Reg>(s.width)) return;
-    int w = std::get<Imm>(s.width).v;
+        std::optional<ptr_or_mapfd_t>& reg_type, int w) {
     if (w == 0 || !reg_type) return;
 
     bool is_comparison_check = s.width == (Value)Imm{0};
     if (check_packet_access(s.reg, w, s.offset, is_comparison_check)) return;
     m_errors.push_back("valid access check failed");
     //std::cout << "type_error: valid access assert fail\n";
-    //exit(1);
 }
 
 void offset_domain_t::operator()(const Assert &u, location_t loc, int print) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index ada6aa1a8..8867b6f22 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -283,8 +283,7 @@ class offset_domain_t final {
     bool upper_bound_satisfied(const dist_t&, int, int, bool) const;
     bool lower_bound_satisfied(const dist_t&, int) const;
     bool check_packet_access(const Reg&, int, int, bool) const;
-    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&,
-            std::optional<interval_t>, std::optional<interval_t>);
+    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
 
     std::optional<dist_t> find_in_ctx(int) const;
     std::optional<dist_cells_t> find_in_stack(int) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index d04381483..5b82789ac 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -620,10 +620,8 @@ void region_domain_t::operator()(const Addable &u, location_t loc, int print) {
     m_errors.push_back("Addable assertion fail");
 }
 
-void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print) {
+void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
     bool is_comparison_check = s.width == (Value)Imm{0};
-    if (std::holds_alternative<Reg>(s.width)) return;
-    int width = std::get<Imm>(s.width).v;
 
     auto maybe_ptr_or_mapfd_type = m_registers.find(s.reg.v);
     if (maybe_ptr_or_mapfd_type) {
@@ -664,6 +662,11 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print
         //std::cout << "type error: valid access assert fail\n";
         m_errors.push_back("valid access assert fail");
     }
+
+}
+
+void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print) {
+    // nothing to do here
 }
 
 void region_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 2b74607b1..bf9f2d726 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -173,6 +173,7 @@ class region_domain_t final {
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&, location_t);
+    void check_valid_access(const ValidAccess &, int);
     void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
             const crab::reg_with_loc_t&, uint8_t);
 
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 087f2e8a7..05a7d3ad3 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -214,7 +214,6 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
     auto interval_type = 
         mock_interval_type ? mock_interval_type->to_interval() : std::optional<interval_t>{};
     if (reg_type) {
-        m_region(s, loc);
         std::optional<mock_interval_t> width_mock_interval;
         if (std::holds_alternative<Reg>(s.width)) {
             width_mock_interval = m_interval.find_interval_value(std::get<Reg>(s.width).v);
@@ -228,17 +227,24 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
             width_mock_interval = mock_interval_t{interval_t{number_t{imm.v}}};
         }
         auto width_interval = width_mock_interval->to_interval();
-        if (is_packet_ptr(reg_type)) {
-            m_offset.check_valid_access(s, reg_type, interval_type, std::optional<interval_t>{});
+        if (auto width_number = width_interval.ub().number()) {
+            int width = (int)*width_number;
+            m_region.check_valid_access(s, width);
+            if (is_packet_ptr(reg_type)) {
+                m_offset.check_valid_access(s, reg_type, width);
+            }
+            if (s.access_type == AccessType::read && is_stack_ptr(reg_type)) {
+                auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
+                auto offset_ptr = stack_ptr.get_offset().to_interval();
+                m_interval.check_valid_access(s, std::move(offset_ptr), width, true);
+            }
         }
-        if (s.access_type == AccessType::read && is_stack_ptr(reg_type)) {
-            auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
-            auto offset_ptr = stack_ptr.get_offset().to_interval();
-            m_interval.check_valid_access(s, std::move(offset_ptr), width_interval, true);
+        else {
+            m_errors.push_back("width is unknown for valid access");
         }
     }
     else {
-        m_interval.check_valid_access(s, std::move(*interval_type), std::nullopt);
+        m_interval.check_valid_access(s, std::move(*interval_type), -1);
     }
 }
 

From a9ffe771b412689bbff4668c6d8c0bbb36357f08 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 6 Oct 2023 16:27:36 -0400
Subject: [PATCH 131/373] Proper forgetting of registers and stack cells in
 Call and Un

In Un, the forgetting of the registers in Offset and Region domain was
added;
In Call, proper forgetting of stack cells in Offset and Region domain
was added;
Removed some redundant code in Type domain;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.hpp               |  2 ++
 src/crab/interval_prop_domain.cpp | 13 ++++++-------
 src/crab/interval_prop_domain.hpp |  2 +-
 src/crab/offset_domain.cpp        | 14 ++++++++++++--
 src/crab/offset_domain.hpp        |  2 +-
 src/crab/region_domain.cpp        | 16 ++++++++++++++--
 src/crab/region_domain.hpp        |  1 +
 src/crab/type_domain.cpp          | 16 ++++------------
 8 files changed, 41 insertions(+), 25 deletions(-)

diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index e7f21acc2..efb7a3291 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -171,6 +171,8 @@ inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
     return o;
 }
 
+using stack_cells_t = std::vector<std::pair<uint64_t, int>>;
+
 } // namespace crab
 
 
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 2000c3ffa..f2f2e485b 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -430,17 +430,16 @@ void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc, int
     m_errors.push_back("Valid Size assertion fail");
 }
 
-void interval_prop_domain_t::do_call(const Call& u, const interval_values_stack_t& store_in_stack,
+void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
         location_t loc) {
 
     for (const auto& kv : store_in_stack) {
-        auto key = kv.first;
-        auto width = kv.second.second;
+        auto offset = kv.first;
+        auto width = kv.second;
         auto overlapping_cells
-            = m_stack_slots_interval_values.find_overlapping_cells(key, width);
-        m_stack_slots_interval_values.remove_overlap(overlapping_cells, key, width);
-        m_stack_slots_interval_values.store(kv.first, kv.second.first.to_interval(),
-                kv.second.second);
+            = m_stack_slots_interval_values.find_overlapping_cells(offset, width);
+        m_stack_slots_interval_values.remove_overlap(overlapping_cells, offset, width);
+        m_stack_slots_interval_values.store(offset, interval_t::top(), width);
     }
     auto r0 = register_t{R0_RETURN_VALUE};
     if (u.is_map_lookup) {
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 7b3c9b093..ff51ec6ec 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -148,7 +148,7 @@ class interval_prop_domain_t final {
 
     void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, bool, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
-    void do_call(const Call&, const interval_values_stack_t&, location_t);
+    void do_call(const Call&, const stack_cells_t&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
             const interval_t&, location_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 12f9a7f9b..477a8941d 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -733,17 +733,27 @@ void offset_domain_t::operator()(const Undefined& u, location_t loc, int print)
 }
 
 void offset_domain_t::operator()(const Un& u, location_t loc, int print) {
-    // nothing to do here
+    m_reg_state -= u.dst.v;
 }
 
 void offset_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
     m_reg_state -= u.dst.v;
 }
 
-void offset_domain_t::operator()(const Call& u, location_t loc, int print) {
+void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
+    for (const auto& kv : cells) {
+        auto offset = kv.first;
+        auto width = kv.second;
+        auto overlapping_cells
+            = m_stack_state.find_overlapping_cells(offset, width);
+        m_stack_state -= overlapping_cells;
+    }
     m_reg_state -= register_t{R0_RETURN_VALUE};
 }
 
+void offset_domain_t::operator()(const Call& u, location_t loc, int print) {
+    // nothing to do here
+}
 void offset_domain_t::operator()(const Exit& u, location_t loc, int print) {}
 
 void offset_domain_t::operator()(const Jmp& u, location_t loc, int print) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 8867b6f22..c2c638022 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -191,7 +191,6 @@ class ctx_offsets_t {
         int get_size() const;
 };
 
-
 class offset_domain_t final {
 
     bool m_is_bottom = false;
@@ -280,6 +279,7 @@ class offset_domain_t final {
             const std::optional<interval_t>&,
             std::optional<ptr_or_mapfd_t>&,
             std::optional<ptr_or_mapfd_t>&, location_t);
+    void do_call(const Call&, const stack_cells_t&, location_t);
     bool upper_bound_satisfied(const dist_t&, int, int, bool) const;
     bool lower_bound_satisfied(const dist_t&, int) const;
     bool check_packet_access(const Reg&, int, int, bool) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 5b82789ac..b9f5b0d62 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -438,7 +438,7 @@ void region_domain_t::operator()(const basic_block_t& bb, int print) {
 }
 
 void region_domain_t::operator()(const Un& u, location_t loc, int print) {
-    // nothing to do here
+    m_registers -= u.dst.v;
 }
 
 void region_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
@@ -553,7 +553,14 @@ void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print)
     do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
 }
 
-void region_domain_t::operator()(const Call& u, location_t loc, int print) {
+void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
+    for (const auto& kv : cells) {
+        auto offset = kv.first;
+        auto width = kv.second;
+        auto overlapping_cells
+            = m_stack.find_overlapping_cells(offset, width);
+        m_stack -= overlapping_cells;
+    }
     std::optional<Reg> maybe_fd_reg{};
     for (ArgSingle param : u.singles) {
         if (param.kind == ArgSingle::Kind::MAP_FD) maybe_fd_reg = param.reg;
@@ -590,6 +597,11 @@ void region_domain_t::operator()(const Call& u, location_t loc, int print) {
     if (u.reallocate_packet) {
         m_registers.forget_packet_ptrs();
     }
+
+}
+
+void region_domain_t::operator()(const Call& u, location_t loc, int print) {
+    // nothing to do here
 }
 
 void region_domain_t::operator()(const Callx &u, location_t loc, int print) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index bf9f2d726..79f189a73 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -173,6 +173,7 @@ class region_domain_t final {
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&, location_t);
+    void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int);
     void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
             const crab::reg_with_loc_t&, uint8_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 05a7d3ad3..53a2df339 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -122,8 +122,7 @@ void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, in
 
 void type_domain_t::operator()(const Call& u, location_t loc, int print) {
 
-    using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
-    interval_values_stack_t stack_values;
+    stack_cells_t stack_values;
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
@@ -142,20 +141,13 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
                 auto offset = (uint64_t)offset_singleton.value();
                 if (auto single_width = width_interval.singleton()) {
                     int width = (int)single_width.value();
-
-                    // Removing overlapping cells
-                    // TODO: do it for all domains
-                    auto overlapping_cells
-                        = m_interval.find_overlapping_cells_in_stack(offset, width);
-                    m_interval.remove_overlap_in_stack(overlapping_cells, offset, width);
-
-                    stack_values[offset] = std::make_pair(interval_t::top(), width);
+                    stack_values.push_back(std::make_pair(offset, width));
                 }
             }
         }
     }
-    m_region(u, loc);
-    m_offset(u, loc);
+    m_region.do_call(u, stack_values, loc);
+    m_offset.do_call(u, stack_values, loc);
     m_interval.do_call(u, stack_values, loc);
 }
 

From 8d85ba708630e0cd5734df13d818c53e5f9d9e7a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 6 Oct 2023 16:50:06 -0400
Subject: [PATCH 132/373] Implementing scratch caller saved registers, and
 packet reallocate

In Call and Packet, scratch caller saved registers functionality is
added for all domains;
In Call, for the Offset domain, the packet pointer forgetting is added
(it is already implemented in Region domain but was missing in Offset);

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp |  9 ++++++++-
 src/crab/interval_prop_domain.hpp |  1 +
 src/crab/offset_domain.cpp        | 17 +++++++++++++++++
 src/crab/offset_domain.hpp        |  3 ++-
 src/crab/region_domain.cpp        | 11 +++++++++--
 src/crab/region_domain.hpp        |  1 +
 6 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index f2f2e485b..1d135497a 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -91,6 +91,12 @@ void registers_cp_state_t::operator-=(register_t var) {
     m_cur_def[var] = nullptr;
 }
 
+void registers_cp_state_t::scratch_caller_saved_registers() {
+    for (int i = R1_ARG; i <= R5_ARG; i++) {
+        operator-=(i);
+    }
+}
+
 bool stack_cp_state_t::is_bottom() const {
     return m_is_bottom;
 }
@@ -449,13 +455,14 @@ void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_i
         auto r0_with_loc = reg_with_loc_t(r0, loc);
         m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
     }
+    m_registers_interval_values.scratch_caller_saved_registers();
 }
 
 void interval_prop_domain_t::operator()(const Packet& u, location_t loc, int print) {
     auto r0 = register_t{R0_RETURN_VALUE};
     auto r0_with_loc = reg_with_loc_t(r0, loc);
     m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
-    // TODO: scratch caller saved registers
+    m_registers_interval_values.scratch_caller_saved_registers();
 }
 
 void interval_prop_domain_t::assume_lt(bool strict,
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index ff51ec6ec..a7c3d1422 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -43,6 +43,7 @@ class registers_cp_state_t {
                 bool is_bottom = false)
             : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
         void adjust_bb_for_registers(location_t);
+        void scratch_caller_saved_registers();
 };
 
 using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 477a8941d..d8fd1694b 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -236,6 +236,18 @@ void registers_state_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
+void registers_state_t::scratch_caller_saved_registers() {
+    for (int i = R1_ARG; i <= R5_ARG; i++) {
+        operator-=(i);
+    }
+}
+
+void registers_state_t::forget_packet_pointers() {
+    for (int i = register_t{0}; i <= register_t{10}; i++) {
+        operator-=(i);
+    }
+}
+
 void stack_state_t::set_to_top() {
     m_slot_dists.clear();
     m_is_bottom = false;
@@ -749,6 +761,10 @@ void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
         m_stack_state -= overlapping_cells;
     }
     m_reg_state -= register_t{R0_RETURN_VALUE};
+    m_reg_state.scratch_caller_saved_registers();
+    if (u.reallocate_packet) {
+        m_reg_state.forget_packet_pointers();
+    }
 }
 
 void offset_domain_t::operator()(const Call& u, location_t loc, int print) {
@@ -762,6 +778,7 @@ void offset_domain_t::operator()(const Jmp& u, location_t loc, int print) {
 
 void offset_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_reg_state -= register_t{R0_RETURN_VALUE};
+    m_reg_state.scratch_caller_saved_registers();
 }
 
 void offset_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index c2c638022..8f6743918 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -128,7 +128,8 @@ class registers_state_t {
         std::optional<dist_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
         void adjust_bb_for_registers(location_t);
-        void print_all_register_types() const;
+        void scratch_caller_saved_registers();
+        void forget_packet_pointers();
 };
 
 using dist_cells_t = std::pair<dist_t, int>;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b9f5b0d62..113fc0cb8 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -37,6 +37,12 @@ std::optional<ptr_no_off_t> ctx_t::find(uint64_t key) const {
     return it->second;
 }
 
+void register_types_t::scratch_caller_saved_registers() {
+    for (int i = R1_ARG; i <= R5_ARG; i++) {
+        operator-=(i);
+    }
+}
+
 void register_types_t::forget_packet_ptrs() {
     for (auto r = register_t{0}; r <= register_t{10}; ++r) {
         auto reg = find(r);
@@ -594,10 +600,10 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
         m_registers -= r0_reg;
     }
 out:
+    m_registers.scratch_caller_saved_registers();
     if (u.reallocate_packet) {
         m_registers.forget_packet_ptrs();
     }
-
 }
 
 void region_domain_t::operator()(const Call& u, location_t loc, int print) {
@@ -616,8 +622,9 @@ void region_domain_t::operator()(const Atomic &u, location_t loc, int print) {
     // WARNING: Not implemented yet.
 }
 
-void region_domain_t::operator()(const Packet &u, location_t loc, int print) {
+void region_domain_t::operator()(const Packet& u, location_t loc, int print) {
     m_registers -= register_t{R0_RETURN_VALUE};
+    m_registers.scratch_caller_saved_registers();
 }
 
 void region_domain_t::operator()(const Addable &u, location_t loc, int print) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 79f189a73..3ea870652 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -84,6 +84,7 @@ class register_types_t {
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
     [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
     void forget_packet_ptrs();
+    void scratch_caller_saved_registers();
     void adjust_bb_for_registers(location_t loc);
 };
 

From f044718b42b336084e422514a7349fccd2e5bad8 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 9 Oct 2023 14:47:32 -0400
Subject: [PATCH 133/373] Fixed an issue with Un, along with printing it

Previously, the value for dst in Un was being forgotten if certain
conditions did not meet, but that should have just stored a TOP number,
instead of forgetting;
Printing the Un operation;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp |  5 +++--
 src/crab/type_domain.cpp          |  6 ++++++
 src/crab/type_ostream.cpp         | 26 ++++++++++++++++++++++++++
 src/crab/type_ostream.hpp         |  1 +
 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 1d135497a..6e9393fc0 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -367,17 +367,18 @@ interval_prop_domain_t interval_prop_domain_t::setup_entry() {
 
 void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print) {
     auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
+        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
         if (std::optional<number_t> n = v.singleton()) {
             if (n->fits_cast_to_int64()) {
                 input = (decltype(input))n.value().cast_to_sint64();
                 decltype(input) output = be_or_le(input);
-                auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
                 m_registers_interval_values.insert(u.dst.v, reg_with_loc,
                         interval_t(number_t(output)));
                 return;
             }
         }
-        m_registers_interval_values -= u.dst.v;
+        m_registers_interval_values.insert(u.dst.v, reg_with_loc,
+                interval_t::top());
     };
 
     auto mock_interval = m_registers_interval_values.find(u.dst.v);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 53a2df339..e916be718 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -619,6 +619,12 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
             auto region = typ.find_ptr_or_mapfd_at_loc(reg);
             print_annotated(o, u, region);
         }
+        else if (std::holds_alternative<Un>(statement)) {
+            auto u = std::get<Un>(statement);
+            auto reg = crab::reg_with_loc_t(u.dst.v, loc);
+            auto interval = typ.find_interval_at_loc(reg);
+            print_annotated(o, u, interval);
+        }
         else o << "  " << statement << "\n";
     }
 
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 09c35b45b..d6efc2122 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -76,3 +76,29 @@ void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_m
     o << "(" << b.access.basereg << sign << offset << ")\n";
 }
 
+std::string op(Un::Op op) {
+    switch (op) {
+        case Un::Op::NEG:
+            return "-";
+        case Un::Op::BE16:
+            return "be16";
+        case Un::Op::BE32:
+            return "be32";
+        case Un::Op::BE64:
+            return "be64";
+        case Un::Op::LE16:
+            return "le16";
+        case Un::Op::LE32:
+            return "le32";
+        case Un::Op::LE64:
+            return "le64";
+        default:
+            return "unknown";
+    }
+}
+
+void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>& n) {
+    o << "  ";
+    print_register(o, b.dst, std::nullopt, std::nullopt, n);
+    o << " = " << op(b.op) << " " << b.dst << "\n";
+}
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 0040f4ed2..fa258e585 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -17,3 +17,4 @@ void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
+void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>&);

From ca7ff863feb7c150b237f32f71d9754f7d9749f9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 10 Oct 2023 05:24:29 -0400
Subject: [PATCH 134/373] Implemented ValidDivisor, refactored multiple

Implemented ValidDivisor, that was missed;
Refactored/Moved to Type domain from sub-domains the following:
ValidSize, Addable, ValidStore;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.hpp               |  5 +++
 src/crab/interval_prop_domain.cpp | 11 +----
 src/crab/region_domain.cpp        | 22 ++--------
 src/crab/type_domain.cpp          | 70 ++++++++++++++++++++++---------
 4 files changed, 60 insertions(+), 48 deletions(-)

diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index efb7a3291..951737401 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -134,6 +134,11 @@ class reg_with_loc_t {
 
 using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
 
+inline bool is_ptr_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
+    return (ptr_or_mapfd && (std::holds_alternative<ptr_with_off_t>(*ptr_or_mapfd)
+                || std::holds_alternative<ptr_no_off_t>(*ptr_or_mapfd)));
+}
+
 inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
     return (ptr_or_mapfd && std::holds_alternative<mapfd_t>(*ptr_or_mapfd));
 }
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 6e9393fc0..1dcedf7dd 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -425,16 +425,7 @@ void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc, int
 }
 
 void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc, int print) {
-    auto reg_v = m_registers_interval_values.find(s.reg.v);
-    if (reg_v) {
-        auto reg_value = reg_v.value();
-        if ((s.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
-                || (!s.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
-            return;
-        }
-    }
-    //std::cout << "type error: Valid Size assertion fail\n";
-    m_errors.push_back("Valid Size assertion fail");
+    // nothing to do here
 }
 
 void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 113fc0cb8..3f484f604 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -448,7 +448,7 @@ void region_domain_t::operator()(const Un& u, location_t loc, int print) {
 }
 
 void region_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+    // nothing to do here
 }
 
 void region_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
@@ -628,15 +628,7 @@ void region_domain_t::operator()(const Packet& u, location_t loc, int print) {
 }
 
 void region_domain_t::operator()(const Addable &u, location_t loc, int print) {
-
-    auto maybe_ptr_type1 = m_registers.find(u.ptr.v);
-    auto maybe_ptr_type2 = m_registers.find(u.num.v);
-    // a -> b <-> !a || b
-    if (!maybe_ptr_type1 || !maybe_ptr_type2) {
-        return;
-    }
-    //std::cout << "type error: Addable assertion fail\n";
-    m_errors.push_back("Addable assertion fail");
+    // nothing to do here
 }
 
 void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
@@ -689,15 +681,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print
 }
 
 void region_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
-
-    bool is_stack_p = is_stack_ptr(m_registers.find(u.val.v));
-    auto maybe_ptr_type2 = m_registers.find(u.val.v);
-
-    if (is_stack_p || !maybe_ptr_type2) {
-        return;
-    }
-    //std::cout << "type error: Valid store assertion fail\n";
-    m_errors.push_back("Valid store assertion fail");
+    // nothing to do here
 }
 
 region_domain_t&& region_domain_t::setup_entry() {
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index e916be718..ebfd33da5 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -196,8 +196,20 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
     }
 }
 
-void type_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
-    /* WARNING: The operation is not implemented yet.*/
+void type_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+    auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
+    auto maybe_num_type_reg = m_interval.find_interval_value(u.reg.v);
+    assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
+
+    if (is_ptr_type(maybe_ptr_or_mapfd_reg)) {
+        m_errors.push_back("Only numbers can be used as divisors");
+    }
+    else if (maybe_num_type_reg.has_value() && !thread_local_options.allow_division_by_zero) {
+        auto num_type_reg = maybe_num_type_reg->to_interval();
+        if (interval_t{number_t{0}} <= num_type_reg) {
+            m_errors.push_back("Possible division by zero");
+        }
+    }
 }
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
@@ -275,32 +287,52 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
 }
 
 void type_domain_t::operator()(const Addable& u, location_t loc, int print) {
-    auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.ptr.v);
-    auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.num.v);
-    auto maybe_num_type1 = m_interval.find_interval_value(u.ptr.v);
-    auto maybe_num_type2 = m_interval.find_interval_value(u.num.v);
-    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
-    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
-    m_region(u, loc);
-    // TODO: move the definition from the region domain to the type domain
+    auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
+    auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
+    auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
+    auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
+    assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
+    assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
+
+    // a -> b <-> !a || b
+    // is_ptr(ptr) -> is_num(num) <-> !is_ptr(ptr) || is_num(num)
+    if (!is_ptr_type(maybe_ptr_or_mapfd_ptr) ||
+      (!maybe_ptr_or_mapfd_num.has_value() || maybe_num_type_num.has_value())) {
+        return;
+    }
+    m_errors.push_back("Addable assertion fail");
 }
 
 void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
-    auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.mem.v);
-    auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.val.v);
-    auto maybe_num_type1 = m_interval.find_interval_value(u.mem.v);
-    auto maybe_num_type2 = m_interval.find_interval_value(u.val.v);
-    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
-    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
-    m_region(u, loc);
-    // TODO: move the definition from the region domain to the type domain
+    auto maybe_ptr_or_mapfd_mem = m_region.find_ptr_or_mapfd_type(u.mem.v);
+    auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
+    auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
+    auto maybe_num_type_val = m_interval.find_interval_value(u.val.v);
+    assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
+    assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
+
+    // a -> b <-> !a || b
+    // !is_stack_ptr(mem) -> is_num(val) <-> is_stack_ptr(mem) || is_num(val)
+    if (is_stack_ptr(maybe_ptr_or_mapfd_mem) ||
+            (!maybe_ptr_or_mapfd_val.has_value() || maybe_num_type_val.has_value())) {
+        return;
+    }
+    m_errors.push_back("Valid store assertion fail");
 }
 
 void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
     auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
     assert(!maybe_ptr_or_mapfd || !maybe_num_type);
-    m_interval(u, loc);
+
+    if (maybe_num_type) {
+        auto reg_value = maybe_num_type.value();
+        if ((u.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
+                || (!u.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
+            return;
+        }
+    }
+    m_errors.push_back("Valid Size assertion fail");
 }
 
 void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {

From 92c5d2657b097f50d7904732baa85e15e59883f8 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 17 Oct 2023 03:07:19 -0400
Subject: [PATCH 135/373] Refactoring in all domains

Multiple refactorings done in order to simplify operations, remove
redundant operations, and improve readability of the code;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp               |  22 ++--
 src/crab/common.hpp               |  47 ++++----
 src/crab/interval_prop_domain.cpp | 128 ++++++++------------
 src/crab/interval_prop_domain.hpp |   6 +-
 src/crab/offset_domain.cpp        | 127 ++++++++++----------
 src/crab/offset_domain.hpp        |  17 ++-
 src/crab/region_domain.cpp        | 192 +++++++++++++-----------------
 src/crab/region_domain.hpp        |  14 +--
 src/crab/type_domain.cpp          |   8 +-
 src/crab/type_ostream.cpp         |   4 +-
 10 files changed, 250 insertions(+), 315 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index afd8000c0..54dc2fe58 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -9,7 +9,7 @@ namespace std {
     return std::visit( overloaded
                {
                    []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
-                   []( const crab::ptr_no_off_t& x ){ return crab::ptr_t{x};},
+                   []( const crab::packet_ptr_t& x ){ return crab::ptr_t{x};},
                    []( auto& ) { return crab::ptr_t{};}
                 }, t
             );
@@ -32,11 +32,11 @@ bool ptr_with_off_t::operator!=(const ptr_with_off_t& other) const {
     return !(*this == other);
 }
 
-bool ptr_no_off_t::operator==(const ptr_no_off_t& other) const {
+bool packet_ptr_t::operator==(const packet_ptr_t& other) const {
     return (m_r == other.m_r);
 }
 
-bool ptr_no_off_t::operator!=(const ptr_no_off_t& other) const {
+bool packet_ptr_t::operator!=(const packet_ptr_t& other) const {
     return !(*this == other);
 }
 
@@ -65,8 +65,6 @@ ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
     return ptr_with_off_t(m_r, std::move(mock_o), std::move(mock_r_s));
 }
 
-void ptr_no_off_t::set_region(region_t r) { m_r = r; }
-
 std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
     m.write(o);
     return o;
@@ -116,10 +114,10 @@ inline std::string get_reg_ptr(const region_t& r) {
             return "ctx_p";
         case region_t::T_STACK:
             return "stack_p";
-        case region_t::T_PACKET:
-            return "packet_p";
-        default:
+        case region_t::T_SHARED:
             return "shared_p";
+        default:
+            return "packet_p";
     }
 }
 
@@ -134,12 +132,8 @@ std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
     return o;
 }
 
-void ptr_no_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(get_region());
-}
-
-std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p) {
-    p.write(o);
+std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p) {
+    o << "packet_p";
     return o;
 }
 
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 951737401..f4a96529d 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -11,15 +11,15 @@
 #include "string_constraints.hpp"
 #include "asm_syntax.hpp"
 
-constexpr int NUM_REGISTERS = 11;
+namespace crab {
+
+constexpr uint8_t NUM_REGISTERS = 11;
 
 constexpr int STACK_BEGIN = 0;
 constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
 constexpr int SHARED_BEGIN = 0;
 
-namespace crab {
-
 enum class region_t {
 	T_CTX,
 	T_STACK,
@@ -27,23 +27,19 @@ enum class region_t {
 	T_SHARED
 };
 
-class ptr_no_off_t {
-    region_t m_r;
+class packet_ptr_t {
+    region_t m_r = region_t::T_PACKET;
 
   public:
-    ptr_no_off_t() = default;
-    ptr_no_off_t(const ptr_no_off_t &) = default;
-    ptr_no_off_t(ptr_no_off_t &&) = default;
-    ptr_no_off_t &operator=(const ptr_no_off_t &) = default;
-    ptr_no_off_t &operator=(ptr_no_off_t &&) = default;
-    ptr_no_off_t(region_t _r) : m_r(_r) {}
-
-    [[nodiscard]] region_t get_region() const { return m_r; }
-    void set_region(region_t);
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream& o, const ptr_no_off_t& p);
-    bool operator==(const ptr_no_off_t&) const;
-    bool operator!=(const ptr_no_off_t&) const;
+    packet_ptr_t() = default;
+    packet_ptr_t(const packet_ptr_t &) = default;
+    packet_ptr_t(packet_ptr_t &&) = default;
+    packet_ptr_t &operator=(const packet_ptr_t &) = default;
+    packet_ptr_t &operator=(packet_ptr_t &&) = default;
+
+    friend std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p);
+    bool operator==(const packet_ptr_t&) const;
+    bool operator!=(const packet_ptr_t&) const;
 };
 
 class mock_interval_t {
@@ -80,7 +76,6 @@ class ptr_with_off_t {
     ptr_with_off_t(region_t _r, mock_interval_t _off,
             mock_interval_t _region_sz = mock_interval_t::top())
         : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
-    ptr_with_off_t(region_t _r, mock_interval_t _off) : m_r(_r), m_offset(_off) {}
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
     mock_interval_t get_region_size() const;
     void set_region_size(mock_interval_t);
@@ -116,7 +111,7 @@ class mapfd_t {
     [[nodiscard]] mock_interval_t get_mapfd() const { return m_mapfd; }
 };
 
-using ptr_t = std::variant<ptr_no_off_t, ptr_with_off_t>;
+using ptr_t = std::variant<packet_ptr_t, ptr_with_off_t>;
 using register_t = uint8_t;
 using location_t = boost::optional<std::pair<label_t, uint32_t>>;
 
@@ -132,11 +127,11 @@ class reg_with_loc_t {
     void write(std::ostream& ) const;
 };
 
-using ptr_or_mapfd_t = std::variant<ptr_with_off_t, ptr_no_off_t, mapfd_t>;
+using ptr_or_mapfd_t = std::variant<ptr_with_off_t, packet_ptr_t, mapfd_t>;
 
 inline bool is_ptr_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
     return (ptr_or_mapfd && (std::holds_alternative<ptr_with_off_t>(*ptr_or_mapfd)
-                || std::holds_alternative<ptr_no_off_t>(*ptr_or_mapfd)));
+                || std::holds_alternative<packet_ptr_t>(*ptr_or_mapfd)));
 }
 
 inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
@@ -144,7 +139,7 @@ inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
 }
 
 inline bool same_region(const ptr_or_mapfd_t& ptr1, const ptr_or_mapfd_t& ptr2) {
-    if (std::holds_alternative<ptr_no_off_t>(ptr1) && std::holds_alternative<ptr_no_off_t>(ptr2))
+    if (std::holds_alternative<packet_ptr_t>(ptr1) && std::holds_alternative<packet_ptr_t>(ptr2))
         return true;
     return (std::holds_alternative<ptr_with_off_t>(ptr1)
             && std::holds_alternative<ptr_with_off_t>(ptr2)
@@ -163,7 +158,7 @@ inline bool is_ctx_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
 }
 
 inline bool is_packet_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
-    return (ptr && std::holds_alternative<ptr_no_off_t>(*ptr));
+    return (ptr && std::holds_alternative<packet_ptr_t>(*ptr));
 }
 
 inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
@@ -194,7 +189,7 @@ namespace std {
             return std::visit( overloaded
                {
                    []( const crab::ptr_with_off_t& x, const crab::ptr_with_off_t& y ){ return x == y;},
-                   []( const crab::ptr_no_off_t& x, const crab::ptr_no_off_t& y ){ return x == y;},
+                   []( const crab::packet_ptr_t& x, const crab::packet_ptr_t& y ){ return x == y;},
                    []( auto& , auto& ) { return true;}
                 }, lhs, rhs
             );
@@ -208,7 +203,7 @@ namespace std {
             return std::visit( overloaded
                {
                    []( const crab::ptr_with_off_t& x, const crab::ptr_with_off_t& y ){ return x == y;},
-                   []( const crab::ptr_no_off_t& x, const crab::ptr_no_off_t& y ){ return x == y;},
+                   []( const crab::packet_ptr_t& x, const crab::packet_ptr_t& y ){ return x == y;},
                    []( const crab::mapfd_t& x, const crab::mapfd_t& y ){ return x == y;},
                    []( auto& , auto& ) { return true;}
                 }, lhs, rhs
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 1dcedf7dd..8dd8fcc29 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -28,9 +28,9 @@ void registers_cp_state_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void registers_cp_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
-        interval_t interval) {
-    (*m_interval_env)[reg_with_loc] = mock_interval_t(interval);
+void registers_cp_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+    auto reg_with_loc = reg_with_loc_t{reg, loc};
+    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
@@ -52,37 +52,27 @@ registers_cp_state_t registers_cp_state_t::operator|(const registers_cp_state_t&
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    live_registers_t intervals_joined;
+    auto intervals_env = std::make_shared<global_interval_env_t>();
+    registers_cp_state_t intervals_joined(intervals_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2) {
             auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
-            auto reg = reg_with_loc_t((register_t)i, loc);
-            intervals_joined[i] = std::make_shared<reg_with_loc_t>(reg);
-            (*m_interval_env)[reg] = mock_interval_t(interval1 | interval2);
+            intervals_joined.insert(register_t{i}, loc,
+                    std::move(interval1 | interval2));
         }
     }
-    return registers_cp_state_t(std::move(intervals_joined), m_interval_env);
+    return intervals_joined;
 }
 
 void registers_cp_state_t::adjust_bb_for_registers(location_t loc) {
-    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
-        auto new_reg = reg_with_loc_t((register_t)i, loc);
-        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
-
-        auto it = find((register_t)i);
-        if (!it) continue;
-
-        if (*m_cur_def[i] == old_reg)
-            m_interval_env->erase(old_reg);
-
-        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
-        (*m_interval_env)[new_reg] = mock_interval_t(it.value());
-
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (auto it = find(register_t{i})) {
+            insert(register_t{i}, loc, it->to_interval());
+        }
     }
 }
 
@@ -92,8 +82,8 @@ void registers_cp_state_t::operator-=(register_t var) {
 }
 
 void registers_cp_state_t::scratch_caller_saved_registers() {
-    for (int i = R1_ARG; i <= R5_ARG; i++) {
-        operator-=(i);
+    for (uint8_t i = R1_ARG; i <= R5_ARG; i++) {
+        operator-=(register_t{i});
     }
 }
 
@@ -323,7 +313,8 @@ interval_prop_domain_t interval_prop_domain_t::operator|(interval_prop_domain_t&
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return interval_prop_domain_t(m_registers_interval_values | std::move(other.m_registers_interval_values),
+    return interval_prop_domain_t(
+            m_registers_interval_values | std::move(other.m_registers_interval_values),
             m_stack_slots_interval_values | std::move(other.m_stack_slots_interval_values));
 }
 
@@ -358,27 +349,22 @@ string_invariant interval_prop_domain_t::to_set() {
 }
 
 interval_prop_domain_t interval_prop_domain_t::setup_entry() {
-    std::shared_ptr<global_interval_env_t> all_intervals = std::make_shared<global_interval_env_t>();
-    registers_cp_state_t registers(all_intervals);
-
+    registers_cp_state_t registers(std::make_shared<global_interval_env_t>());
     interval_prop_domain_t cp(std::move(registers), stack_cp_state_t::top());
     return cp;
 }
 
 void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print) {
     auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
-        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
         if (std::optional<number_t> n = v.singleton()) {
             if (n->fits_cast_to_int64()) {
                 input = (decltype(input))n.value().cast_to_sint64();
                 decltype(input) output = be_or_le(input);
-                m_registers_interval_values.insert(u.dst.v, reg_with_loc,
-                        interval_t(number_t(output)));
+                m_registers_interval_values.insert(u.dst.v, loc, interval_t{number_t{output}});
                 return;
             }
         }
-        m_registers_interval_values.insert(u.dst.v, reg_with_loc,
-                interval_t::top());
+        m_registers_interval_values.insert(u.dst.v, loc, interval_t::top());
     };
 
     auto mock_interval = m_registers_interval_values.find(u.dst.v);
@@ -415,7 +401,7 @@ void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print)
         break;
     case Un::Op::NEG:
         auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
-        m_registers_interval_values.insert(u.dst.v, reg_with_loc, -interval);
+        m_registers_interval_values.insert(u.dst.v, loc, -interval);
         break;
     }
 }
@@ -444,16 +430,14 @@ void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_i
         m_registers_interval_values -= r0;
     }
     else {
-        auto r0_with_loc = reg_with_loc_t(r0, loc);
-        m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
+        m_registers_interval_values.insert(r0, loc, interval_t::top());
     }
     m_registers_interval_values.scratch_caller_saved_registers();
 }
 
 void interval_prop_domain_t::operator()(const Packet& u, location_t loc, int print) {
     auto r0 = register_t{R0_RETURN_VALUE};
-    auto r0_with_loc = reg_with_loc_t(r0, loc);
-    m_registers_interval_values.insert(r0, r0_with_loc, interval_t::top());
+    m_registers_interval_values.insert(r0, loc, interval_t::top());
     m_registers_interval_values.scratch_caller_saved_registers();
 }
 
@@ -461,7 +445,6 @@ void interval_prop_domain_t::assume_lt(bool strict,
         interval_t&& left_interval, interval_t&& right_interval,
         interval_t&& left_interval_orig, interval_t&& right_interval_orig,
         register_t left, Value right, location_t loc, bool is_signed) {
-    auto reg_with_loc_left = reg_with_loc_t(left, loc);
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
     auto llb = left_interval.lb();
@@ -474,26 +457,24 @@ void interval_prop_domain_t::assume_lt(bool strict,
     if (strict ? llb < rlb : llb <= rlb && lub >= rlb) {
         auto lb = is_signed ? llb_orig : number_t{0};
         auto interval_to_insert = interval_t(lb, strict ? rlb - number_t{1} : rlb);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+        m_registers_interval_values.insert(left, loc, interval_to_insert);
     }
     else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub &&
             std::holds_alternative<Reg>(right)) {
         auto right_reg = std::get<Reg>(right).v;
-        auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
         auto interval_to_insert = interval_t(strict ? lub + number_t{1} : lub, rub_orig);
-        m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
+        m_registers_interval_values.insert(right_reg, loc, interval_to_insert);
     }
     else if (lub >= rub && strict ? llb < rub : llb <= rub) {
         auto lb = is_signed ? llb_orig : number_t{0};
         auto interval_to_insert_left = interval_t(lb, strict ? rub - number_t{1} : rub);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
+        m_registers_interval_values.insert(left, loc, interval_to_insert_left);
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
         // and set left to the rest of the interval < (or <=) of right
         // a more sound analysis is needed
         if (std::holds_alternative<Reg>(right)) {
             auto right_reg = std::get<Reg>(right).v;
-            auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
-            m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_t(rub));
+            m_registers_interval_values.insert(right_reg, loc, interval_t{rub});
         }
     }
     else {
@@ -506,7 +487,6 @@ void interval_prop_domain_t::assume_gt(bool strict,
         interval_t&& left_interval, interval_t&& right_interval,
         interval_t&& left_interval_orig, interval_t&& right_interval_orig,
         register_t left, Value right, location_t loc) {
-    auto reg_with_loc_left = reg_with_loc_t(left, loc);
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
     auto llb = left_interval.lb();
@@ -518,25 +498,23 @@ void interval_prop_domain_t::assume_gt(bool strict,
 
     if (strict ? lub > rub : lub >= rub && llb <= rub) {
         auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub_orig);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert);
+        m_registers_interval_values.insert(left, loc, interval_to_insert);
     }
     else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb &&
             std::holds_alternative<Reg>(right)) {
         auto right_reg = std::get<Reg>(right).v;
-        auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
         auto interval_to_insert = interval_t(rlb_orig, strict ? llb - number_t{1} : llb);
-        m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_to_insert);
+        m_registers_interval_values.insert(right_reg, loc, interval_to_insert);
     }
     else if (llb <= rlb && strict ? lub > rlb : lub >= rlb) {
         auto interval_to_insert_left = interval_t(strict ? rlb + number_t{1} : rlb, lub_orig);
-        m_registers_interval_values.insert(left, reg_with_loc_left, interval_to_insert_left);
+        m_registers_interval_values.insert(left, loc, interval_to_insert_left);
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
         // and set left to the rest of the interval > (or >=) of right
         // a more sound analysis is needed
         if (std::holds_alternative<Reg>(right)) {
             auto right_reg = std::get<Reg>(right).v;
-            auto reg_with_loc_right = reg_with_loc_t(right_reg, loc);
-            m_registers_interval_values.insert(right_reg, reg_with_loc_right, interval_t(rlb));
+            m_registers_interval_values.insert(right_reg, loc, interval_t{rlb});
         }
     }
     else {
@@ -573,11 +551,10 @@ void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt
         m_registers_interval_values.set_to_top();
         return;
     } else if (left_interval_orig.is_top() && right_interval_orig.is_top()) {
-        m_registers_interval_values.insert(left, reg_with_loc_t(left, loc), interval_t::top());
+        m_registers_interval_values.insert(left, loc, interval_t::top());
         if (std::holds_alternative<Reg>(right)) {
             auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg, reg_with_loc_t(right_reg, loc),
-                    interval_t::top());
+            m_registers_interval_values.insert(right_reg, loc, interval_t::top());
         }
         return;
     }
@@ -642,11 +619,10 @@ void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool i
 
     if (op == Condition::Op::EQ) {
         auto eq_interval = right_interval & left_interval;
-        m_registers_interval_values.insert(left, reg_with_loc_t(left, loc), eq_interval);
+        m_registers_interval_values.insert(left, loc, eq_interval);
         if (std::holds_alternative<Reg>(right)) {
             auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg,
-                    reg_with_loc_t(right_reg, loc), eq_interval);
+            m_registers_interval_values.insert(right_reg, loc, eq_interval);
         }
         return;
     }
@@ -729,8 +705,10 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
     // if op is MOV,
         // we skip handling in this domain is when src is pointer,
         // additionally, we forget the dst pointer
+
+    auto dst_register = register_t{bin.dst.v};
     if (bin.op == Op::MOV && src_ptr_or_mapfd_opt) {
-        m_registers_interval_values -= bin.dst.v;
+        m_registers_interval_values -= dst_register;
         return;
     }
 
@@ -740,7 +718,6 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
     if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
     if (dst_interval_opt) dst_interval = std::move(dst_interval_opt.value());
 
-    auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
     switch (bin.op)
     {
         // ra = b
@@ -749,7 +726,7 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
                 dst_interval = src_interval;
             }
             else {
-                m_registers_interval_values -= bin.dst.v;
+                m_registers_interval_values -= dst_register;
                 return;
             }
             break;
@@ -760,7 +737,7 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
             if (dst_interval_opt && src_interval_opt)
                 dst_interval += src_interval;
             else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
-                m_registers_interval_values -= bin.dst.v;
+                m_registers_interval_values -= dst_register;
                 return;
             }
             break;
@@ -772,7 +749,7 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
             else if (dst_interval_opt && src_interval_opt)
                 dst_interval -= src_interval;
             else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
-                m_registers_interval_values -= bin.dst.v;
+                m_registers_interval_values -= dst_register;
                 return;
             }
             break;
@@ -971,23 +948,22 @@ void interval_prop_domain_t::do_bin(const Bin& bin,
             break;
         }
     }
-    m_registers_interval_values.insert(bin.dst.v, reg_with_loc, dst_interval);
+    m_registers_interval_values.insert(dst_register, loc, dst_interval);
 }
 
 
-void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
+void interval_prop_domain_t::do_load(const Mem& b, const register_t& target_register,
         std::optional<ptr_or_mapfd_t> basereg_type, bool load_in_region, location_t loc) {
 
     if (!basereg_type) {
-        m_registers_interval_values -= target_reg.v;
+        m_registers_interval_values -= target_register;
         return;
     }
 
-    auto reg_with_loc = reg_with_loc_t(target_reg.v, loc);
     // we check if we already loaded a pointer from ctx or stack in region domain,
         // we then do not store a number
     if (load_in_region) {
-        m_registers_interval_values -= target_reg.v;
+        m_registers_interval_values -= target_register;
         return;
     }
     int width = b.access.width;
@@ -995,14 +971,14 @@ void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
     auto basereg_ptr_or_mapfd_type = basereg_type.value();
 
     if (is_ctx_ptr(basereg_type)) {
-        m_registers_interval_values.insert(target_reg.v, reg_with_loc, interval_t::top());
+        m_registers_interval_values.insert(target_register, loc, interval_t::top());
         return;
     }
     if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
         interval_t to_insert = interval_t::top();
         if (width == 1) to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
         else if (width == 2) to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
-        m_registers_interval_values.insert(target_reg.v, reg_with_loc, to_insert);
+        m_registers_interval_values.insert(target_register, loc, to_insert);
         return;
     }
 
@@ -1014,7 +990,7 @@ void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
         if (auto load_at_singleton = load_at.singleton()) {
             start_offset = (uint64_t)(*load_at_singleton);
             if (auto loaded = m_stack_slots_interval_values.find(start_offset)) {
-                m_registers_interval_values.insert(target_reg.v, reg_with_loc,
+                m_registers_interval_values.insert(target_register, loc,
                         (*loaded).first.to_interval());
                 return;
             }
@@ -1030,15 +1006,15 @@ void interval_prop_domain_t::do_load(const Mem& b, const Reg& target_reg,
             }
         }
         if (m_stack_slots_interval_values.all_numeric(start_offset, width)) {
-            m_registers_interval_values.insert(target_reg.v, reg_with_loc,
-                    interval_t::top());
+            m_registers_interval_values.insert(target_register, loc, interval_t::top());
             return;
         }
     }
-    m_registers_interval_values -= target_reg.v;
+    m_registers_interval_values -= target_register;
 }
 
-void interval_prop_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> basereg_type) {
+void interval_prop_domain_t::do_mem_store(const Mem& b,
+        std::optional<ptr_or_mapfd_t> basereg_type) {
     int offset = b.access.offset;
     int width = b.access.width;
 
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index a7c3d1422..2db62b793 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -15,7 +15,7 @@
 
 namespace crab {
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
 using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
 
 class registers_cp_state_t {
@@ -31,7 +31,7 @@ class registers_cp_state_t {
         void set_to_top();
         std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
         std::optional<mock_interval_t> find(register_t key) const;
-        void insert(register_t, const reg_with_loc_t&, interval_t);
+        void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
         registers_cp_state_t operator|(const registers_cp_state_t& other) const;
         registers_cp_state_t(bool is_bottom = false) : m_interval_env(nullptr),
@@ -147,7 +147,7 @@ class interval_prop_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, bool, location_t);
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index d8fd1694b..1c9e139f0 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -125,9 +125,9 @@ void equality_t::write(std::ostream& o) const {
     o << m_lhs << " = " << m_rhs;
 }
 
-void registers_state_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
-        const dist_t& dist) {
-    (*m_offset_env)[reg_with_loc] = dist;
+void registers_state_t::insert(register_t reg, const location_t& loc, dist_t&& dist) {
+    reg_with_loc_t reg_with_loc{reg, loc};
+    (*m_offset_env)[reg_with_loc] = std::move(dist);
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
@@ -139,8 +139,7 @@ std::optional<dist_t> registers_state_t::find(reg_with_loc_t reg) const {
 
 std::optional<dist_t> registers_state_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
-    return find(reg);
+    return find(*(m_cur_def[key]));
 }
 
 std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int width) const {
@@ -200,51 +199,42 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    live_registers_t out_vars;
+
+    auto region_env = std::make_shared<global_offset_env_t>();
+    registers_state_t joined_state(region_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
 
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2) {
-            dist_t dist1 = it1.value(), dist2 = it2.value();
-            auto reg = reg_with_loc_t((register_t)i, loc);
+            auto dist1 = *it1, dist2 = *it2;
             if (dist1.m_slack != dist2.m_slack) continue;
             auto dist_joined = dist_t(std::move(dist1.m_dist | dist2.m_dist), dist1.m_slack);
-            out_vars[i] = std::make_shared<reg_with_loc_t>(reg);
-            (*m_offset_env)[reg] = dist_joined;
+            joined_state.insert(register_t{i}, loc, std::move(dist_joined));
         }
     }
-    return registers_state_t(std::move(out_vars), m_offset_env, false);
+    return joined_state;
 }
 
 void registers_state_t::adjust_bb_for_registers(location_t loc) {
-    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
-        auto new_reg = reg_with_loc_t((register_t)i, loc);
-        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
-
-        auto it = find((register_t)i);
-        if (!it) continue;
-
-        if (*m_cur_def[i] == old_reg)
-            m_offset_env->erase(old_reg);
-
-        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
-        (*m_offset_env)[new_reg] = it.value();
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (auto it = find(register_t{i})) {
+            insert(register_t{i}, loc, std::move(*it));
+        }
     }
 }
 
 void registers_state_t::scratch_caller_saved_registers() {
-    for (int i = R1_ARG; i <= R5_ARG; i++) {
-        operator-=(i);
+    for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
+        operator-=(register_t{r});
     }
 }
 
 void registers_state_t::forget_packet_pointers() {
-    for (int i = register_t{0}; i <= register_t{10}; i++) {
-        operator-=(i);
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS; r++) {
+        operator-=(register_t{r});
     }
 }
 
@@ -300,6 +290,7 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
+
     stack_slot_dists_t out_stack_dists;
     // We do not join dist cells because different dist values different types of offsets
     for (auto const&kv: m_slot_dists) {
@@ -455,13 +446,13 @@ std::optional<dist_t> ctx_offsets_t::find(int key) const {
     return it->second;
 }
 
-offset_domain_t offset_domain_t::setup_entry() {
-    std::shared_ptr<ctx_offsets_t> ctx = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor);
-    std::shared_ptr<global_offset_env_t> all_types = std::make_shared<global_offset_env_t>();
-    registers_state_t regs(all_types);
+offset_domain_t&& offset_domain_t::setup_entry() {
+    std::shared_ptr<ctx_offsets_t> ctx
+        = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor);
+    registers_state_t regs(std::make_shared<global_offset_env_t>());
 
-    offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
-    return off_d;
+    static offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
+    return std::move(off_d);
 }
 
 offset_domain_t offset_domain_t::bottom() {
@@ -513,7 +504,12 @@ offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(m_reg_state | other.m_reg_state, m_stack_state | other.m_stack_state, m_extra_constraints | other.m_extra_constraints, m_ctx_dists, std::max(m_slack, other.m_slack));
+    return offset_domain_t(
+            m_reg_state | other.m_reg_state,
+            m_stack_state | other.m_stack_state,
+            m_extra_constraints | other.m_extra_constraints,
+            m_ctx_dists, std::max(m_slack, other.m_slack)
+    );
 }
 
 offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
@@ -523,7 +519,12 @@ offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(m_reg_state | std::move(other.m_reg_state), m_stack_state | std::move(other.m_stack_state), m_extra_constraints | std::move(other.m_extra_constraints), m_ctx_dists, std::max(m_slack, other.m_slack));
+    return offset_domain_t(
+            m_reg_state | std::move(other.m_reg_state),
+            m_stack_state | std::move(other.m_stack_state),
+            m_extra_constraints | std::move(other.m_extra_constraints),
+            m_ctx_dists, std::max(m_slack, other.m_slack)
+    );
 }
 
 // meet
@@ -597,7 +598,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
 }
 
 void offset_domain_t::update_offset_info(const dist_t&& dist, const interval_t&& change,
-        const reg_with_loc_t& reg_with_loc, uint8_t reg, Bin::Op op) {
+        const location_t& loc, uint8_t reg, Bin::Op op) {
     auto offset = dist.m_dist;
     if (op == Bin::Op::ADD) {
         if (dist.is_forward_pointer()) offset += change;
@@ -608,7 +609,7 @@ void offset_domain_t::update_offset_info(const dist_t&& dist, const interval_t&&
         // TODO: needs precise handling of subtraction
         offset = interval_t::top();
     }
-    m_reg_state.insert(reg, reg_with_loc, dist_t(offset));
+    m_reg_state.insert(reg, loc, dist_t(offset));
 }
 
 interval_t offset_domain_t::do_bin(const Bin &bin,
@@ -634,13 +635,13 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
     Reg src;
     if (std::holds_alternative<Reg>(bin.v)) src = std::get<Reg>(bin.v);
 
-    auto reg_with_loc = reg_with_loc_t(bin.dst.v, loc);
+    auto dst_register = register_t{bin.dst.v};
     switch (bin.op)
     {
         // ra = rb;
         case Op::MOV: {
             if (!is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                m_reg_state -= bin.dst.v;
+                m_reg_state -= dst_register;
                 return interval_t::bottom();
             }
             auto src_offset_opt = m_reg_state.find(src.v);
@@ -649,7 +650,7 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
                 //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
                 return interval_t::bottom();
             }
-            m_reg_state.insert(bin.dst.v, reg_with_loc, src_offset_opt.value());
+            m_reg_state.insert(dst_register, loc, std::move(*src_offset_opt));
             break;
         }
         // ra += rb
@@ -658,15 +659,15 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             interval_t interval_to_add = interval_t::bottom();
             if (is_packet_ptr(dst_ptr_or_mapfd_opt)
                     && is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                m_reg_state -= bin.dst.v;
+                m_reg_state -= dst_register;
                 return interval_t::bottom();
             }
             else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
-                auto dst_offset_opt = m_reg_state.find(bin.dst.v);
+                auto dst_offset_opt = m_reg_state.find(dst_register);
                 if (!dst_offset_opt) {
                     m_errors.push_back("dst is a packet_pointer and no offset info found");
                     //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    m_reg_state -= bin.dst.v;
+                    m_reg_state -= dst_register;
                     return interval_t::bottom();
                 }
                 dist_to_update = std::move(dst_offset_opt.value());
@@ -678,7 +679,7 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
                 if (!src_offset_opt) {
                     m_errors.push_back("src is a packet_pointer and no offset info found");
                     //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
-                    m_reg_state -= bin.dst.v;
+                    m_reg_state -= dst_register;
                     return interval_t::bottom();
                 }
                 dist_to_update = std::move(src_offset_opt.value());
@@ -686,11 +687,11 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             }
             else if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
                 // this case is only needed till interval domain is added
-                m_reg_state.insert(bin.dst.v, reg_with_loc, dist_t());
+                m_reg_state.insert(dst_register, loc, dist_t());
                 break;
             }
             update_offset_info(std::move(dist_to_update), std::move(interval_to_add),
-                    reg_with_loc, bin.dst.v, bin.op);
+                    loc, dst_register, bin.op);
             break;
         }
         // ra -= rb
@@ -699,15 +700,15 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
             interval_t interval_to_sub = interval_t::bottom();
             if (is_packet_ptr(dst_ptr_or_mapfd_opt)
                     && is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                m_reg_state -= bin.dst.v;
+                m_reg_state -= dst_register;
                 return interval_t::top();
             }
             else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
-                auto dst_offset_opt = m_reg_state.find(bin.dst.v);
+                auto dst_offset_opt = m_reg_state.find(dst_register);
                 if (!dst_offset_opt) {
                     m_errors.push_back("dst is a packet_pointer and no offset info found");
                     //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    m_reg_state -= bin.dst.v;
+                    m_reg_state -= dst_register;
                     return interval_t::bottom();
                 }
                 dist_to_update = std::move(dst_offset_opt.value());
@@ -718,18 +719,18 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
                 if (!src_offset_opt) {
                     m_errors.push_back("src is a packet_pointer and no offset info found");
                     //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
-                    m_reg_state -= bin.dst.v;
+                    m_reg_state -= dst_register;
                     return interval_t::bottom();
                 }
                 dist_to_update = std::move(src_offset_opt.value());
                 interval_to_sub = std::move(dst_interval_opt.value());
             }
             update_offset_info(std::move(dist_to_update), std::move(interval_to_sub),
-                    reg_with_loc, bin.dst.v, bin.op);
+                    loc, dst_register, bin.op);
             break;
         }
         default: {
-            m_reg_state -= bin.dst.v;
+            m_reg_state -= dst_register;
             break;
         }
     }
@@ -908,14 +909,14 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> m
     }
 }
 
-void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
+void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
         std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
 
     bool is_stack_p = is_stack_ptr(basereg_type);
     bool is_ctx_p = is_ctx_ptr(basereg_type);
 
     if (!is_stack_p && !is_ctx_p) {
-        m_reg_state -= target_reg.v;
+        m_reg_state -= target_register;
         return;
     }
 
@@ -924,7 +925,7 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
     auto p_offset = type_with_off.get_offset();
     auto offset_singleton = p_offset.to_interval().singleton();
     if (!offset_singleton) {
-        m_reg_state -= target_reg.v;
+        m_reg_state -= target_register;
         return;
     }
     auto ptr_offset = *offset_singleton;
@@ -933,22 +934,18 @@ void offset_domain_t::do_load(const Mem& b, const Reg& target_reg,
     if (is_stack_p) {
         auto it = m_stack_state.find(load_at);
         if (!it) {
-            m_reg_state -= target_reg.v;
+            m_reg_state -= target_register;
             return;
         }
-        dist_t d = it->first;
-        auto reg = reg_with_loc_t(target_reg.v, loc);
-        m_reg_state.insert(target_reg.v, reg, d);
+        m_reg_state.insert(target_register, loc, std::move(it->first));
     }
     else if (is_ctx_p) {
         auto it = m_ctx_dists->find(load_at);
         if (!it) {
-            m_reg_state -= target_reg.v;
+            m_reg_state -= target_register;
             return;
         }
-        dist_t d = it.value();
-        auto reg = reg_with_loc_t(target_reg.v, loc);
-        m_reg_state.insert(target_reg.v, reg, dist_t(d));
+        m_reg_state.insert(target_register, loc, std::move(*it));
     }
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 8f6743918..595f3835b 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -10,10 +10,7 @@
 #include "crab/common.hpp"
 
 namespace crab {
-constexpr int STACK_BEGIN = 0;
-constexpr int CTX_BEGIN = 0;
-constexpr int PACKET_BEGIN = 0;
-constexpr int SHARED_BEGIN = 0;
+
 constexpr int PACKET_END = -4100;
 constexpr int PACKET_META = -1;
 constexpr int MAX_PACKET_SIZE = 0xffff;
@@ -101,7 +98,7 @@ struct packet_constraint_t {
     friend std::ostream& operator<<(std::ostream&, const packet_constraint_t&);
 };
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
 using global_offset_env_t = std::unordered_map<reg_with_loc_t, dist_t>;
 
 class registers_state_t {
@@ -123,7 +120,7 @@ class registers_state_t {
         void set_to_bottom();
         bool is_bottom() const;
         bool is_top() const;
-        void insert(register_t, const reg_with_loc_t&, const dist_t&);
+        void insert(register_t, const location_t&, dist_t&&);
         std::optional<dist_t> find(reg_with_loc_t reg) const;
         std::optional<dist_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
@@ -217,7 +214,7 @@ class offset_domain_t final {
             std::shared_ptr<ctx_offsets_t> ctx, slack_var_t s = 0) : m_reg_state(std::move(reg)),
     m_stack_state(std::move(stack)), m_ctx_dists(ctx), m_slack(s) {}
 
-    static offset_domain_t setup_entry();
+    static offset_domain_t&& setup_entry();
     // bottom/top
     static offset_domain_t bottom();
     void set_to_top();
@@ -274,7 +271,7 @@ class offset_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>, location_t loc);
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t loc);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<interval_t>&,
@@ -290,8 +287,8 @@ class offset_domain_t final {
     std::optional<dist_cells_t> find_in_stack(int) const;
     std::optional<dist_t> find_offset_at_loc(const reg_with_loc_t) const;
     std::optional<dist_t> find_offset_info(register_t reg) const;
-    void update_offset_info(const dist_t&&, const interval_t&&,
-        const reg_with_loc_t&, uint8_t, Bin::Op);
+    void update_offset_info(const dist_t&&, const interval_t&&, const location_t&,
+            uint8_t, Bin::Op);
     dist_t update_offset(const dist_t&, const weight_t&, const interval_t&, Bin::Op);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 3f484f604..7ec4ec3a9 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -8,13 +8,13 @@ namespace crab {
 ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
 {
     if (desc->data >= 0) {
-        m_packet_ptrs[desc->data] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
+        m_packet_ptrs[desc->data] = std::move(crab::packet_ptr_t{});
     }
     if (desc->end >= 0) {
-        m_packet_ptrs[desc->end] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
+        m_packet_ptrs[desc->end] = std::move(crab::packet_ptr_t{});
     }
     if (desc->meta >= 0) {
-        m_packet_ptrs[desc->meta] = crab::ptr_no_off_t(crab::region_t::T_PACKET);
+        m_packet_ptrs[desc->meta] = std::move(crab::packet_ptr_t{});
     }
     if (desc->size >= 0) {
         size = desc->size;
@@ -31,23 +31,22 @@ std::vector<uint64_t> ctx_t::get_keys() const {
     return keys;
 }
 
-std::optional<ptr_no_off_t> ctx_t::find(uint64_t key) const {
+std::optional<packet_ptr_t> ctx_t::find(uint64_t key) const {
     auto it = m_packet_ptrs.find(key);
     if (it == m_packet_ptrs.end()) return {};
     return it->second;
 }
 
 void register_types_t::scratch_caller_saved_registers() {
-    for (int i = R1_ARG; i <= R5_ARG; i++) {
-        operator-=(i);
+    for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
+        operator-=(register_t{r});
     }
 }
 
 void register_types_t::forget_packet_ptrs() {
-    for (auto r = register_t{0}; r <= register_t{10}; ++r) {
-        auto reg = find(r);
-        if (is_packet_ptr(reg)) {
-            operator-=(r);
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS; r++) {
+        if (is_packet_ptr(find(register_t{r}))) {
+            operator-=(register_t{r});
         }
     }
 }
@@ -58,46 +57,44 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    live_registers_t out_vars;
+    auto region_env = std::make_shared<global_region_env_t>();
+    register_types_t joined_reg_types(region_env);
 
     // a hack to store region information at the start of a joined basic block
     // in join, we do not know the label of the bb, hence we store the information
     // at a bb that is not used anywhere else in the program, and later when we know
     // the bb label, we can fix
-    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    location_t loc = location_t{std::make_pair(label_t(-2, -2), 0)};
 
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(*(m_cur_def[i]));
         auto maybe_ptr2 = other.find(*(other.m_cur_def[i]));
         if (maybe_ptr1 && maybe_ptr2) {
-            ptr_or_mapfd_t ptr_or_mapfd1 = maybe_ptr1.value(), ptr_or_mapfd2 = maybe_ptr2.value();
-            auto reg = reg_with_loc_t((register_t)i, loc);
+            ptr_or_mapfd_t ptr_or_mapfd1 = *maybe_ptr1, ptr_or_mapfd2 = *maybe_ptr2;
             if (ptr_or_mapfd1 == ptr_or_mapfd2) {
-                out_vars[i] = m_cur_def[i];
+                joined_reg_types.insert(register_t{i}, loc, std::move(ptr_or_mapfd1));
             }
             else { 
-                auto shared_reg = std::make_shared<reg_with_loc_t>(reg);
                 if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
                             && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
                     ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
                     ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                     if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                        out_vars[i] = shared_reg;
-                        (*m_region_env)[reg] = std::move(ptr_with_off1 | ptr_with_off2);
+                        joined_reg_types.insert(register_t{i}, loc,
+                                std::move(ptr_with_off1 | ptr_with_off2));
                     }
                 }
                 else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
                         && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
                     mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                     mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
-                    out_vars[i] = shared_reg;
-                    (*m_region_env)[reg] = std::move(mapfd1 | mapfd2);
+                    joined_reg_types.insert(register_t{i}, loc, std::move(mapfd1 | mapfd2));
                 }
             }
         }
     }
-    return register_types_t(std::move(out_vars), m_region_env, false);
+    return joined_reg_types;
 }
 
 void register_types_t::operator-=(register_t var) {
@@ -127,8 +124,8 @@ bool register_types_t::is_top() const {
     return true;
 }
 
-void register_types_t::insert(register_t reg, const reg_with_loc_t& reg_with_loc,
-        const ptr_or_mapfd_t& type) {
+void register_types_t::insert(register_t reg, const location_t& loc, const ptr_or_mapfd_t& type) {
+    reg_with_loc_t reg_with_loc = reg_with_loc_t{reg, loc};
     (*m_region_env)[reg_with_loc] = type;
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
@@ -141,26 +138,14 @@ std::optional<ptr_or_mapfd_t> register_types_t::find(reg_with_loc_t reg) const {
 
 std::optional<ptr_or_mapfd_t> register_types_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
-    return find(reg);
+    return find(*(m_cur_def[key]));
 }
 
 void register_types_t::adjust_bb_for_registers(location_t loc) {
-    location_t old_loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (size_t i = 0; i < m_cur_def.size(); i++) {
-        auto new_reg = reg_with_loc_t((register_t)i, loc);
-        auto old_reg = reg_with_loc_t((register_t)i, old_loc);
-
-        auto it = find((register_t)i);
-        if (!it) continue;
-
-        if (*m_cur_def[i] == old_reg) {
-            m_region_env->erase(old_reg);
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (auto it = find(register_t{i})) {
+            insert(register_t{i}, loc, *it);
         }
-
-        m_cur_def[i] = std::make_shared<reg_with_loc_t>(new_reg);
-        (*m_region_env)[new_reg] = it.value();
-
     }
 }
 
@@ -170,7 +155,7 @@ stack_t stack_t::operator|(const stack_t& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    ptr_or_mapfd_types_t out_ptrs;
+    stack_t joined_stack;
     for (auto const&kv: m_ptrs) {
         auto maybe_ptr_or_mapfd_cells = other.find(kv.first);
         if (maybe_ptr_or_mapfd_cells) {
@@ -180,28 +165,28 @@ stack_t stack_t::operator|(const stack_t& other) const {
             auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
             int width1 = ptr_or_mapfd_cells1.second;
             int width2 = ptr_or_mapfd_cells2.second;
-            int width_joined = std::max(width1, width2);
+            int width_joined = std::min(width1, width2);
             if (ptr_or_mapfd1 == ptr_or_mapfd2) {
-                out_ptrs[kv.first] = std::make_pair(ptr_or_mapfd1, width_joined);
+                joined_stack.store(kv.first, ptr_or_mapfd1, width_joined);
             }
             else if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
                 auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
                 auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                 if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                    out_ptrs[kv.first]
-                        = std::make_pair(ptr_with_off1 | ptr_with_off2, width_joined);
+                    joined_stack.store(kv.first, std::move(ptr_with_off1 | ptr_with_off2),
+                            width_joined);
                 }
             }
             else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
                 auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                 auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
-                out_ptrs[kv.first] = std::make_pair(mapfd1 | mapfd2, width_joined);
+                joined_stack.store(kv.first, std::move(mapfd1 | mapfd2), width_joined);
             }
         }
     }
-    return stack_t(std::move(out_ptrs), false);
+    return joined_stack;
 }
 
 void stack_t::operator-=(uint64_t key) {
@@ -333,7 +318,7 @@ std::vector<uint64_t> region_domain_t::get_stack_keys() const {
     return m_stack.get_keys();
 }
 
-std::optional<ptr_no_off_t> region_domain_t::find_in_ctx(uint64_t key) const {
+std::optional<packet_ptr_t> region_domain_t::find_in_ctx(uint64_t key) const {
     return m_ctx->find(key);
 }
 
@@ -546,13 +531,12 @@ interval_t region_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
 }
 
 void region_domain_t::do_load_mapfd(const register_t& dst_reg, int mapfd, location_t loc) {
-    auto reg_with_loc = reg_with_loc_t(dst_reg, loc);
     const auto& platform = global_program_info->platform;
     const EbpfMapDescriptor& desc = platform->get_map_descriptor(mapfd);
     const EbpfMapValueType& map_value_type = platform->get_map_type(desc.type).value_type;
     auto mapfd_interval = interval_t{number_t{mapfd}};
     auto type = mapfd_t(mapfd_interval, map_value_type);
-    m_registers.insert(dst_reg, reg_with_loc, type);
+    m_registers.insert(dst_reg, loc, type);
 }
 
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
@@ -572,32 +556,31 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
         if (param.kind == ArgSingle::Kind::MAP_FD) maybe_fd_reg = param.reg;
         break;
     }
-    register_t r0_reg{R0_RETURN_VALUE};
-    auto r0 = reg_with_loc_t(r0_reg, loc);
+    register_t r0{R0_RETURN_VALUE};
     if (u.is_map_lookup) {
         if (maybe_fd_reg) {
             if (auto map_type = get_map_type(*maybe_fd_reg)) {
                 if (global_program_info->platform->get_map_type(*map_type).value_type
                         == EbpfMapValueType::MAP) {
                     if (auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
-                        do_load_mapfd(r0_reg, (int)*inner_map_fd, loc);
+                        do_load_mapfd(r0, (int)*inner_map_fd, loc);
                         goto out;
                     }
                 } else {
                     auto type = ptr_with_off_t(crab::region_t::T_SHARED, interval_t{number_t{0}},
                             get_map_value_size(*maybe_fd_reg));
-                    m_registers.insert(r0_reg, r0, type);
+                    m_registers.insert(r0, loc, type);
                 }
             }
         }
         else {
             auto type = ptr_with_off_t(
                  crab::region_t::T_SHARED, interval_t{number_t{0}}, crab::interval_t::top());
-            m_registers.insert(r0_reg, r0, type);
+            m_registers.insert(r0, loc, type);
         }
     }
     else {
-        m_registers -= r0_reg;
+        m_registers -= r0;
     }
 out:
     m_registers.scratch_caller_saved_registers();
@@ -638,29 +621,29 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
     if (maybe_ptr_or_mapfd_type) {
         auto reg_ptr_or_mapfd_type = *maybe_ptr_or_mapfd_type;
         if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
-            auto reg_with_off_ptr_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
-            auto offset = reg_with_off_ptr_type.get_offset();
+            auto ptr_with_off_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
+            auto offset = ptr_with_off_type.get_offset();
             auto offset_to_check = offset.to_interval()+interval_t{s.offset};
             auto offset_lb = offset_to_check.lb();
             auto offset_plus_width_ub = offset_to_check.ub()+crab::bound_t{width};
-            if (reg_with_off_ptr_type.get_region() == crab::region_t::T_STACK) {
+            if (ptr_with_off_type.get_region() == crab::region_t::T_STACK) {
                 if (crab::bound_t{STACK_BEGIN} <= offset_lb
                         && offset_plus_width_ub <= crab::bound_t{EBPF_STACK_SIZE})
                     return;
             }
-            else if (reg_with_off_ptr_type.get_region() == crab::region_t::T_CTX) {
+            else if (ptr_with_off_type.get_region() == crab::region_t::T_CTX) {
                 if (crab::bound_t{CTX_BEGIN} <= offset_lb
                         && offset_plus_width_ub <= crab::bound_t{ctx_size()})
                     return;
             }
             else { // shared
                 if (crab::bound_t{SHARED_BEGIN} <= offset_lb &&
-                        offset_plus_width_ub <= reg_with_off_ptr_type.get_region_size().lb()) return;
+                        offset_plus_width_ub <= ptr_with_off_type.get_region_size().lb()) return;
                 // TODO: check null access
                 //return;
             }
         }
-        else if (std::holds_alternative<ptr_no_off_t>(reg_ptr_or_mapfd_type)) {
+        else if (std::holds_alternative<packet_ptr_t>(reg_ptr_or_mapfd_type)) {
             // We do not handle packet ptr access in region domain
             return;
         }
@@ -686,20 +669,16 @@ void region_domain_t::operator()(const ValidStore& u, location_t loc, int print)
 
 region_domain_t&& region_domain_t::setup_entry() {
 
-    std::shared_ptr<ctx_t> ctx = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
-    std::shared_ptr<global_region_env_t> all_types = std::make_shared<global_region_env_t>();
+    std::shared_ptr<ctx_t> ctx
+        = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
 
-    register_types_t typ(all_types);
+    register_types_t typ(std::make_shared<global_region_env_t>());
 
-    auto r1 = reg_with_loc_t(R1_ARG, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
-    auto r10 = reg_with_loc_t(R10_STACK_POINTER, std::make_pair(label_t::entry, static_cast<unsigned int>(0)));
-
-    typ.insert(R1_ARG, r1,
-            ptr_with_off_t(crab::region_t::T_CTX,
-                mock_interval_t{number_t{0}}, mock_interval_t{number_t{-1}}));
-    typ.insert(R10_STACK_POINTER, r10,
-            ptr_with_off_t(crab::region_t::T_STACK,
-                mock_interval_t{number_t{512}}, mock_interval_t{number_t{-1}}));
+    auto loc = std::make_pair(label_t::entry, (unsigned int)0);
+    auto ctx_ptr_r1 = ptr_with_off_t(crab::region_t::T_CTX, mock_interval_t{number_t{0}});
+    auto stack_ptr_r10 = ptr_with_off_t(crab::region_t::T_STACK, mock_interval_t{number_t{512}});
+    typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
+    typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
     static region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
     return std::move(inv);
@@ -739,7 +718,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
                     }
                 }
             }
-            else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_type)) {
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd_type)) {
                 if (s.types == TypeGroup::singleton_ptr) return;
                 if (s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num) return;
                 if (s.types == TypeGroup::packet || s.types == TypeGroup::stack_or_packet) return;
@@ -757,17 +736,17 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int pr
 }
 
 void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const interval_t&& change,
-        const reg_with_loc_t& reg_with_loc, uint8_t reg) {
+        const location_t& loc, register_t reg) {
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
         auto offset = ptr_or_mapfd_with_off.get_offset();
         auto updated_offset =
             change == mock_interval_t::top() ? offset : offset.to_interval() + change;
         ptr_or_mapfd_with_off.set_offset(updated_offset);
-        m_registers.insert(reg, reg_with_loc, ptr_or_mapfd_with_off);
+        m_registers.insert(reg, loc, ptr_or_mapfd_with_off);
     }
-    else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd)) {
-        m_registers.insert(reg, reg_with_loc, ptr_or_mapfd);
+    else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd)) {
+        m_registers.insert(reg, loc, ptr_or_mapfd);
     }
     else {
         //std::cout << "type error: mapfd register cannot be incremented/decremented\n";
@@ -796,19 +775,18 @@ interval_t region_domain_t::do_bin(const Bin& bin,
     if (dst_ptr_or_mapfd_opt) dst_ptr_or_mapfd = std::move(dst_ptr_or_mapfd_opt.value());
     if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
 
-    auto reg = reg_with_loc_t(bin.dst.v, loc);
-    interval_t to_return = interval_t::bottom();
-
+    interval_t subtracted = interval_t::bottom();
+    auto dst_register = register_t{bin.dst.v};
     switch (bin.op)
     {
         // ra = b, where b is a pointer/mapfd, a numerical register, or a constant;
         case Op::MOV: {
             // b is a pointer/mapfd
             if (src_ptr_or_mapfd_opt)
-                m_registers.insert(bin.dst.v, reg, src_ptr_or_mapfd);
+                m_registers.insert(dst_register, loc, src_ptr_or_mapfd);
             // b is a numerical register, or constant
             else if (dst_ptr_or_mapfd_opt) {
-                m_registers -= bin.dst.v;
+                m_registers -= dst_register;
             }
             break;
         }
@@ -824,28 +802,28 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                     //std::cout << "type error: addition of two pointers\n";
                     m_errors.push_back("addition of two pointers");
                 }
-                m_registers -= bin.dst.v;
+                m_registers -= dst_register;
             }
             // ra is a pointer/mapfd
             // b is a numerical register, or a constant
             else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
                 update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
-                        reg, bin.dst.v);
+                        loc, dst_register);
             }
             // b is a pointer/mapfd
             // ra is a numerical register
             else if (src_ptr_or_mapfd_opt && !dst_ptr_or_mapfd_opt) {
                 update_ptr_or_mapfd(std::move(src_ptr_or_mapfd), interval_t::top(),
-                        reg, bin.dst.v);
+                        loc, dst_register);
             }
             else if (dst_ptr_or_mapfd_opt && !src_ptr_or_mapfd_opt) {
                 if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd)) {
                     auto updated_type = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
                     updated_type.set_offset(mock_interval_t::top());
-                    m_registers.insert(bin.dst.v, reg, updated_type);
+                    m_registers.insert(dst_register, loc, updated_type);
                 }
-                else if (std::holds_alternative<ptr_no_off_t>(dst_ptr_or_mapfd)) {
-                    m_registers.insert(bin.dst.v, reg, dst_ptr_or_mapfd);
+                else if (std::holds_alternative<packet_ptr_t>(dst_ptr_or_mapfd)) {
+                    m_registers.insert(dst_register, loc, dst_ptr_or_mapfd);
                 }
             }
             break;
@@ -865,33 +843,34 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                             std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
                         auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
                         auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
-                        to_return =
-                            dst_ptr_with_off.get_offset().to_interval() - src_ptr_with_off.get_offset().to_interval();
+                        subtracted =
+                            dst_ptr_with_off.get_offset().to_interval() -
+                            src_ptr_with_off.get_offset().to_interval();
                     }
                 }
                 else {
                     //std::cout << "type error: subtraction between pointers of different region\n";
                     m_errors.push_back("subtraction between pointers of different region");
                 }
-                m_registers -= bin.dst.v;
+                m_registers -= dst_register;
             }
             // b is a numerical register, or a constant
             else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
                 update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), -std::move(src_interval),
-                        reg, bin.dst.v);
+                        loc, dst_register);
             }
             break;
         }
         default: break;
     }
-    return to_return;
+    return subtracted;
 }
 
-void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
+void region_domain_t::do_load(const Mem& b, const register_t& target_register, bool unknown_ptr,
         location_t loc) {
 
     if (unknown_ptr) {
-        m_registers -= target_reg.v;
+        m_registers -= target_register;
         return;
     }
 
@@ -904,7 +883,7 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
     bool is_ctx_p = is_ctx_ptr(ptr_or_mapfd_opt);
     if (!is_ctx_p && !is_stack_p) {
         // loading from either packet or shared region or mapfd does not happen in region domain
-        m_registers -= target_reg.v;
+        m_registers -= target_register;
         return;
     }
 
@@ -924,11 +903,11 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
                     break;
                 }
             }
-            m_registers -= target_reg.v;
+            m_registers -= target_register;
         }
         else {
             if (width != 1 && width != 2 && width != 4 && width != 8) {
-                m_registers -= target_reg.v;
+                m_registers -= target_register;
                 return;
             }
             auto ptr_offset = offset_singleton.value();
@@ -937,12 +916,11 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
             auto loaded = m_stack.find(load_at);
             if (!loaded) {
                 // no field at loaded offset in stack
-                m_registers -= target_reg.v;
+                m_registers -= target_register;
                 return;
             }
 
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_registers.insert(target_reg.v, reg, (*loaded).first);
+            m_registers.insert(target_register, loc, (*loaded).first);
         }
     }
     else {
@@ -957,7 +935,7 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
                     break;
                 }
             }
-            m_registers -= target_reg.v;
+            m_registers -= target_register;
         }
         else {
             auto ptr_offset = offset_singleton.value();
@@ -966,12 +944,10 @@ void region_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_
             auto loaded = m_ctx->find(load_at);
             if (!loaded) {
                 // no field at loaded offset in ctx
-                m_registers -= target_reg.v;
+                m_registers -= target_register;
                 return;
             }
-
-            auto reg = reg_with_loc_t(target_reg.v, loc);
-            m_registers.insert(target_reg.v, reg, *loaded);
+            m_registers.insert(target_register, loc, *loaded);
         }
     }
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 3ea870652..7138d47e8 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -13,7 +13,7 @@
 namespace crab {
 
 class ctx_t {
-    using ptr_types_t = std::unordered_map<uint64_t, ptr_no_off_t>;
+    using ptr_types_t = std::unordered_map<uint64_t, packet_ptr_t>;
 
     ptr_types_t m_packet_ptrs;
     size_t size = 0;
@@ -22,7 +22,7 @@ class ctx_t {
     ctx_t(const ebpf_context_descriptor_t* desc);
     constexpr size_t get_size() const { return size; }
     std::vector<uint64_t> get_keys() const;
-    std::optional<ptr_no_off_t> find(uint64_t key) const;
+    std::optional<packet_ptr_t> find(uint64_t key) const;
 };
 
 using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
@@ -54,7 +54,7 @@ class stack_t {
     size_t size() const;
 };
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, 11>;
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
 using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
 
 class register_types_t {
@@ -79,7 +79,7 @@ class register_types_t {
     void set_to_top();
     bool is_bottom() const;
     bool is_top() const;
-    void insert(register_t reg, const reg_with_loc_t& reg_with_loc, const ptr_or_mapfd_t& type);
+    void insert(register_t, const location_t&, const ptr_or_mapfd_t&);
     std::optional<ptr_or_mapfd_t> find(reg_with_loc_t reg) const;
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
     [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
@@ -169,7 +169,7 @@ class region_domain_t final {
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void do_load_mapfd(const register_t&, int, location_t);
-    void do_load(const Mem&, const Reg&, bool, location_t);
+    void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&, location_t);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<crab::ptr_or_mapfd_t>&,
@@ -177,11 +177,11 @@ class region_domain_t final {
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int);
     void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
-            const crab::reg_with_loc_t&, uint8_t);
+            const crab::location_t&, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
     [[nodiscard]] size_t ctx_size() const;
-    std::optional<crab::ptr_no_off_t> find_in_ctx(uint64_t key) const;
+    std::optional<crab::packet_ptr_t> find_in_ctx(uint64_t key) const;
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index ebfd33da5..734794f67 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -382,7 +382,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
                     return;
                 }
             }
-            else if (std::holds_alternative<ptr_no_off_t>(ptr_or_mapfd_basereg)) {
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd_basereg)) {
                 if (m_offset.check_packet_access(u.access_reg, width, 0, true)) return;
             }
             else {
@@ -460,11 +460,11 @@ void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
-    m_region.do_load(b, target_reg, unknown_ptr, loc);
-    m_offset.do_load(b, target_reg, basereg_opt, loc);
+    m_region.do_load(b, register_t{target_reg.v}, unknown_ptr, loc);
+    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
     // TODO: replace with a bool value returned from region do_load
     auto load_in_region = m_region.find_ptr_or_mapfd_type(target_reg.v).has_value();
-    m_interval.do_load(b, target_reg, basereg_opt, load_in_region, loc);
+    m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, load_in_region, loc);
 }
 
 void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> target_opt,
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index d6efc2122..88f1fba50 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -7,8 +7,8 @@ void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr, std::optio
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << std::get<crab::ptr_with_off_t>(ptr);
     }
-    else if (std::holds_alternative<crab::ptr_no_off_t>(ptr)) {
-        o << std::get<crab::ptr_no_off_t>(ptr) << "<" << (d ? *d : crab::dist_t{}) << ">";
+    else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
+        o << std::get<crab::packet_ptr_t>(ptr) << "<" << (d ? *d : crab::dist_t{}) << ">";
     }
 }
 

From 90e633345b9f8da7179f9d015c2856bbf58cac8e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 17 Oct 2023 03:59:48 -0400
Subject: [PATCH 136/373] Refactoring: removing unnecessary print option not
 needed

print option was being passed to all transformers in all domains, since
previously prints were done in respective transformers;
it has been cleaned up;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp      | 66 +++++++++++++++---------------
 src/crab/abstract_domain.hpp      | 68 +++++++++++++++----------------
 src/crab/ebpf_domain.cpp          | 48 +++++++++++-----------
 src/crab/ebpf_domain.hpp          | 48 +++++++++++-----------
 src/crab/interval_prop_domain.cpp | 38 ++++++++---------
 src/crab/interval_prop_domain.hpp | 46 ++++++++++-----------
 src/crab/offset_domain.cpp        | 40 +++++++++---------
 src/crab/offset_domain.hpp        | 48 +++++++++++-----------
 src/crab/region_domain.cpp        | 47 ++++++++++-----------
 src/crab/region_domain.hpp        | 49 +++++++++++-----------
 src/crab/type_domain.cpp          | 53 ++++++++++++------------
 src/crab/type_domain.hpp          | 48 +++++++++++-----------
 12 files changed, 300 insertions(+), 299 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 6ab87d730..e6a865122 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -116,58 +116,58 @@ void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_bl
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Undefined& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Bin& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Un& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapFd& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Exit& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Jmp& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Mem& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Packet& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assume& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s, location_t loc, int print) {
-    m_abs_val.operator()(s, loc, print);
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
 }
 
 template <typename Domain>
@@ -256,27 +256,27 @@ void abstract_domain_t::operator()(const basic_block_t& bb, int print) {
     m_concept->operator()(bb, print);
 }
 
-void abstract_domain_t::operator()(const Undefined& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Undefined& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Bin& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Bin& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Un& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Un& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Call& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Call& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Exit& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Exit& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Jmp& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Jmp& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Mem& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Mem& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Packet& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Packet& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Assume& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Assume& s, location_t loc) { m_concept->operator()(s, loc); }
 
-void abstract_domain_t::operator()(const Assert& s, location_t loc, int print) { m_concept->operator()(s, loc, print); }
+void abstract_domain_t::operator()(const Assert& s, location_t loc) { m_concept->operator()(s, loc); }
 
 void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
 
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index 7b5f297ab..a35887816 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -31,18 +31,18 @@ class abstract_domain_t {
         virtual std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const = 0;
         virtual std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) = 0;
         virtual std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const = 0;
-        virtual void operator()(const basic_block_t&, int) = 0;
-        virtual void operator()(const Undefined&, location_t, int) = 0;
-        virtual void operator()(const Bin&, location_t, int) = 0;
-        virtual void operator()(const Un&, location_t, int) = 0;
-        virtual void operator()(const LoadMapFd&, location_t, int) = 0;
-        virtual void operator()(const Call&, location_t, int) = 0;
-        virtual void operator()(const Exit&, location_t, int) = 0;
-        virtual void operator()(const Jmp&, location_t, int) = 0;
-        virtual void operator()(const Mem&, location_t, int) = 0;
-        virtual void operator()(const Packet&, location_t, int) = 0;
-        virtual void operator()(const Assume&, location_t, int) = 0;
-        virtual void operator()(const Assert&, location_t, int) = 0;
+        virtual void operator()(const basic_block_t&, int print = 0) = 0;
+        virtual void operator()(const Undefined&, location_t) = 0;
+        virtual void operator()(const Bin&, location_t) = 0;
+        virtual void operator()(const Un&, location_t) = 0;
+        virtual void operator()(const LoadMapFd&, location_t) = 0;
+        virtual void operator()(const Call&, location_t) = 0;
+        virtual void operator()(const Exit&, location_t) = 0;
+        virtual void operator()(const Jmp&, location_t) = 0;
+        virtual void operator()(const Mem&, location_t) = 0;
+        virtual void operator()(const Packet&, location_t) = 0;
+        virtual void operator()(const Assume&, location_t) = 0;
+        virtual void operator()(const Assert&, location_t) = 0;
         virtual void write(std::ostream& os) const = 0;
 
         /* These operations are not very conventional for an abstract
@@ -75,17 +75,17 @@ class abstract_domain_t {
         std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
         std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
         void operator()(const basic_block_t& bb, int print = 0) override;
-        void operator()(const Undefined& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Bin& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Un& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const LoadMapFd& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Call& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Exit& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Jmp& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Mem& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Packet& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Assume& s, location_t loc = boost::none, int print = 0) override;
-        void operator()(const Assert& s, location_t loc = boost::none, int print = 0) override;
+        void operator()(const Undefined& s, location_t loc = boost::none) override;
+        void operator()(const Bin& s, location_t loc = boost::none) override;
+        void operator()(const Un& s, location_t loc = boost::none) override;
+        void operator()(const LoadMapFd& s, location_t loc = boost::none) override;
+        void operator()(const Call& s, location_t loc = boost::none) override;
+        void operator()(const Exit& s, location_t loc = boost::none) override;
+        void operator()(const Jmp& s, location_t loc = boost::none) override;
+        void operator()(const Mem& s, location_t loc = boost::none) override;
+        void operator()(const Packet& s, location_t loc = boost::none) override;
+        void operator()(const Assume& s, location_t loc = boost::none) override;
+        void operator()(const Assert& s, location_t loc = boost::none) override;
         void write(std::ostream& os) const override;
         void initialize_loop_counter(const label_t) override;
         crab::bound_t get_loop_count_upper_bound() override;
@@ -118,17 +118,17 @@ class abstract_domain_t {
     abstract_domain_t widen(const abstract_domain_t& abs, bool);
     abstract_domain_t narrow(const abstract_domain_t& abs) const;
     void operator()(const basic_block_t& bb, int print = 0);
-    void operator()(const Undefined& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Un& s, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Call& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume& s, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert& s, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined& s, location_t loc = boost::none);
+    void operator()(const Bin& s, location_t loc = boost::none);
+    void operator()(const Un& s, location_t loc = boost::none);
+    void operator()(const LoadMapFd& s, location_t loc = boost::none);
+    void operator()(const Call& s, location_t loc = boost::none);
+    void operator()(const Exit& s, location_t loc = boost::none);
+    void operator()(const Jmp& s, location_t loc = boost::none);
+    void operator()(const Mem& s, location_t loc = boost::none);
+    void operator()(const Packet& s, location_t loc = boost::none);
+    void operator()(const Assume& s, location_t loc = boost::none);
+    void operator()(const Assert& s, location_t loc = boost::none);
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 039849bec..c4aa65799 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1417,7 +1417,7 @@ void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expressi
     require(inv, ub <= region_size, std::string("Upper bound must be at most ") + region_size.name());
 }
 
-void ebpf_domain_t::operator()(const Assume& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     auto dst = reg_pack(cond.left);
     if (std::holds_alternative<Reg>(cond.right)) {
@@ -1450,9 +1450,9 @@ void ebpf_domain_t::operator()(const Assume& s, location_t loc, int print) {
     }
 }
 
-void ebpf_domain_t::operator()(const Undefined& a, location_t loc, int print) {}
+void ebpf_domain_t::operator()(const Undefined& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Un& stmt, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Un& stmt, location_t loc) {
     auto dst = reg_pack(stmt.dst);
     auto swap_endianness = [&](variable_t v, auto input, const auto& be_or_le) {
         if (m_inv.entail(type_is_number(stmt.dst))) {
@@ -1516,11 +1516,11 @@ void ebpf_domain_t::operator()(const Un& stmt, location_t loc, int print) {
     }
 }
 
-void ebpf_domain_t::operator()(const Exit& a, location_t loc, int print) {}
+void ebpf_domain_t::operator()(const Exit& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Jmp& a, location_t loc, int print) {}
+void ebpf_domain_t::operator()(const Jmp& a, location_t loc) {}
 
-void ebpf_domain_t::operator()(const Comparable& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Comparable& s, location_t loc) {
     using namespace crab::dsl_syntax;
     if (type_inv.same_type(m_inv, s.r1, s.r2)) {
         // Same type. If both are numbers, that's okay. Otherwise:
@@ -1541,12 +1541,12 @@ void ebpf_domain_t::operator()(const Comparable& s, location_t loc, int print) {
     };
 }
 
-void ebpf_domain_t::operator()(const Addable& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Addable& s, location_t loc) {
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be added to pointers");
 }
 
-void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg)))
@@ -1557,17 +1557,17 @@ void ebpf_domain_t::operator()(const ValidDivisor& s, location_t loc, int print)
     }
 }
 
-void ebpf_domain_t::operator()(const ValidStore& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ValidStore& s, location_t loc) {
     if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val)))
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be stored to externally-visible regions");
 }
 
-void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     if (!type_inv.is_in_group(m_inv, s.reg, s.types))
         require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
 }
 
-void ebpf_domain_t::operator()(const FuncConstraint& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const FuncConstraint& s, location_t loc) {
     // Look up the helper function id.
     const reg_pack_t& reg = reg_pack(s.reg);
     auto src_interval = m_inv.eval_interval(reg.svalue);
@@ -1589,7 +1589,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s, location_t loc, int prin
     require(m_inv, linear_constraint_t::FALSE(), "callx helper function id is not a valid singleton");
 }
 
-void ebpf_domain_t::operator()(const ValidSize& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ValidSize& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto r = reg_pack(s.reg);
     require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "Invalid size");
@@ -1698,7 +1698,7 @@ crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const
     return result;
 }
 
-void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc) {
     using namespace crab::dsl_syntax;
 
     auto fd_type = get_map_type(s.map_fd_reg);
@@ -1764,7 +1764,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s, location_t loc, int pr
     });
 }
 
-void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc) {
     using namespace crab::dsl_syntax;
 
     bool is_comparison_check = s.width == (Value)Imm{0};
@@ -1850,13 +1850,13 @@ void ebpf_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
     });
 }
 
-void ebpf_domain_t::operator()(const ZeroCtxOffset& s, location_t loc, int print) {
+void ebpf_domain_t::operator()(const ZeroCtxOffset& s, location_t loc) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     require(m_inv, reg.ctx_offset == 0, "Nonzero context offset");
 }
 
-void ebpf_domain_t::operator()(const Assert& stmt, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Assert& stmt, location_t loc) {
     if (check_require || thread_local_options.assume_assertions) {
         this->current_assertion = to_string(stmt.cst);
         std::visit(*this, stmt.cst);
@@ -1864,7 +1864,7 @@ void ebpf_domain_t::operator()(const Assert& stmt, location_t loc, int print) {
     }
 }
 
-void ebpf_domain_t::operator()(const Packet& a, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Packet& a, location_t loc) {
     auto reg = reg_pack(R0_RETURN_VALUE);
     Reg r0_reg{(uint8_t)R0_RETURN_VALUE};
     type_inv.assign_type(m_inv, r0_reg, T_NUM);
@@ -2119,7 +2119,7 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
     }
 }
 
-void ebpf_domain_t::operator()(const Mem& b, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Mem& b, location_t loc) {
     if (m_inv.is_bottom())
         return;
     if (std::holds_alternative<Reg>(b.value)) {
@@ -2175,7 +2175,7 @@ static Bin atomic_to_bin(const Atomic& a) {
     return bin;
 }
 
-void ebpf_domain_t::operator()(const Atomic& a, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Atomic& a, location_t loc) {
     if (m_inv.is_bottom())
         return;
     if (!m_inv.entail(type_is_pointer(reg_pack(a.access.basereg))) ||
@@ -2224,7 +2224,7 @@ void ebpf_domain_t::operator()(const Atomic& a, location_t loc, int print) {
     type_inv.havoc_type(m_inv, r11);
 }
 
-void ebpf_domain_t::operator()(const Call& call, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Call& call, location_t loc) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2321,7 +2321,7 @@ void ebpf_domain_t::operator()(const Call& call, location_t loc, int print) {
     }
 }
 
-void ebpf_domain_t::operator()(const Callx& callx, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Callx& callx, location_t loc) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
         return;
@@ -2356,7 +2356,7 @@ void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null
     assign_valid_ptr(dst_reg, maybe_null);
 }
 
-void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc, int print) { do_load_mapfd(ins.dst, ins.mapfd, false); }
+void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc) { do_load_mapfd(ins.dst, ins.mapfd, false); }
 
 void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
     using namespace crab::dsl_syntax;
@@ -2578,7 +2578,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
     havoc_offsets(dst_reg);
 }
 
-void ebpf_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+void ebpf_domain_t::operator()(const Bin& bin, location_t loc) {
     using namespace crab::dsl_syntax;
 
     auto dst = reg_pack(bin.dst);
@@ -3010,7 +3010,7 @@ bound_t ebpf_domain_t::get_loop_count_upper_bound() {
     return ub;
 }
 
-void ebpf_domain_t::operator()(const IncrementLoopCounter& ins, location_t loc, int print) {
+void ebpf_domain_t::operator()(const IncrementLoopCounter& ins, location_t loc) {
     this->add(variable_t::loop_counter(to_string(ins.name)), 1);
 }
 } // namespace crab
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 6ace2e9a9..d5b9928a5 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -58,30 +58,30 @@ class ebpf_domain_t final {
     // abstract transformers
     void operator()(const basic_block_t& bb, int print = 0);
 
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call&, location_t loc = boost::none, int print = 0);
-    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const Un&, location_t loc = boost::none, int print = 0);
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const FuncConstraint&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const ValidDivisor&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
 
     // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
     void write(std::ostream& o) const;
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 8dd8fcc29..3006c98fb 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -354,7 +354,7 @@ interval_prop_domain_t interval_prop_domain_t::setup_entry() {
     return cp;
 }
 
-void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Un& u, location_t loc) {
     auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
         if (std::optional<number_t> n = v.singleton()) {
             if (n->fits_cast_to_int64()) {
@@ -406,11 +406,11 @@ void interval_prop_domain_t::operator()(const Un& u, location_t loc, int print)
     }
 }
 
-void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     m_registers_interval_values -= u.dst.v;
 }
 
-void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc) {
     // nothing to do here
 }
 
@@ -435,7 +435,7 @@ void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_i
     m_registers_interval_values.scratch_caller_saved_registers();
 }
 
-void interval_prop_domain_t::operator()(const Packet& u, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Packet& u, location_t loc) {
     auto r0 = register_t{R0_RETURN_VALUE};
     m_registers_interval_values.insert(r0, loc, interval_t::top());
     m_registers_interval_values.scratch_caller_saved_registers();
@@ -688,7 +688,7 @@ void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t
     }
 }
 
-void interval_prop_domain_t::operator()(const Assume& s, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Assume& s, location_t loc) {
     // nothing to do here
 }
 
@@ -1089,59 +1089,59 @@ void interval_prop_domain_t::check_valid_access(const ValidAccess& s, interval_t
     }
 }
 
-void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Undefined& u, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Bin& b, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Bin& b, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Call&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Call&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Exit&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Exit&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Jmp&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Jmp&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Mem&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Mem&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Assert&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Assert&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Comparable&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Comparable&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const Addable&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const Addable&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const ValidStore&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const ValidStore&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const TypeConstraint&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const TypeConstraint&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const ValidMapKeyValue&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const ValidMapKeyValue&, location_t loc) {
     // nothing to do here
 }
 
-void interval_prop_domain_t::operator()(const ZeroCtxOffset&, location_t loc, int print) {
+void interval_prop_domain_t::operator()(const ZeroCtxOffset&, location_t loc) {
     // nothing to do here
 }
 
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 2db62b793..836cc6e48 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -117,29 +117,29 @@ class interval_prop_domain_t final {
     void operator-=(register_t reg) { m_registers_interval_values -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
-    void operator()(const Un&, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Atomic&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Call&, location_t loc = boost::none, int print = 0);
-    void operator()(const Callx&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0) {}
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none) {}
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none) {}
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const FuncConstraint&, location_t loc = boost::none) {}
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {}
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound();
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 1c9e139f0..bc7962700 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -565,7 +565,7 @@ void offset_domain_t::initialize_loop_counter(const label_t& label) {
 
 string_invariant offset_domain_t::to_set() { return string_invariant{}; }
 
-void offset_domain_t::operator()(const Assume &b, location_t loc, int print) {
+void offset_domain_t::operator()(const Assume &b, location_t loc) {
     Condition cond = b.cond;
     if (cond.op == Condition::Op::LE) {
         if (std::holds_alternative<Reg>(cond.right)) {
@@ -737,19 +737,19 @@ interval_t offset_domain_t::do_bin(const Bin &bin,
     return interval_t::bottom();
 }
 
-void offset_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+void offset_domain_t::operator()(const Bin& bin, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Undefined& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const Un& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Un& u, location_t loc) {
     m_reg_state -= u.dst.v;
 }
 
-void offset_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
+void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_reg_state -= u.dst.v;
 }
 
@@ -768,53 +768,53 @@ void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
     }
 }
 
-void offset_domain_t::operator()(const Call& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Call& u, location_t loc) {
     // nothing to do here
 }
-void offset_domain_t::operator()(const Exit& u, location_t loc, int print) {}
+void offset_domain_t::operator()(const Exit& u, location_t loc) {}
 
-void offset_domain_t::operator()(const Jmp& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Jmp& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const Packet& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Packet& u, location_t loc) {
     m_reg_state -= register_t{R0_RETURN_VALUE};
     m_reg_state.scratch_caller_saved_registers();
 }
 
-void offset_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+void offset_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     /* WARNING: This operation is not implemented yet. */
 }
 
-void offset_domain_t::operator()(const ValidAccess& u, location_t loc, int print) {
+void offset_domain_t::operator()(const ValidAccess& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Comparable& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const Addable& u, location_t loc, int print) {
+void offset_domain_t::operator()(const Addable& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+void offset_domain_t::operator()(const ValidStore& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const TypeConstraint& u, location_t loc, int print) {
+void offset_domain_t::operator()(const TypeConstraint& u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+void offset_domain_t::operator()(const ValidSize& u, location_t loc) {
     /* WARNING: This operation is not implemented yet. */
 }
 
-void offset_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+void offset_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
     /* WARNING: This operation is not implemented yet. */
 }
 
-void offset_domain_t::operator()(const ZeroCtxOffset&, location_t loc, int print) {
+void offset_domain_t::operator()(const ZeroCtxOffset&, location_t loc) {
     // nothing to do here
 }
 
@@ -877,7 +877,7 @@ void offset_domain_t::check_valid_access(const ValidAccess& s,
     //std::cout << "type_error: valid access assert fail\n";
 }
 
-void offset_domain_t::operator()(const Assert &u, location_t loc, int print) {
+void offset_domain_t::operator()(const Assert &u, location_t loc) {
     // nothing to do here
 }
 
@@ -949,7 +949,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
     }
 }
 
-void offset_domain_t::operator()(const Mem& b, location_t loc, int print) {
+void offset_domain_t::operator()(const Mem& b, location_t loc) {
     // nothing to do here
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 595f3835b..5710f50cd 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -239,30 +239,30 @@ class offset_domain_t final {
     void operator-=(register_t reg) { m_reg_state -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
-    void operator()(const Un&, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Atomic&, location_t loc = boost::none, int print = 0) {}
-    void operator()(const Call&, location_t loc = boost::none, int print = 0);
-    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0) {};
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none) {}
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const ValidDivisor&, location_t loc = boost::none);
+    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {};
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
     std::string domain_name() const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 7ec4ec3a9..9411376a9 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -392,29 +392,30 @@ string_invariant region_domain_t::to_set() {
     return string_invariant{};
 }
 
-void region_domain_t::operator()(const Undefined &u, location_t loc, int print) {}
+void region_domain_t::operator()(const Undefined &u, location_t loc) {}
 
-void region_domain_t::operator()(const Exit &u, location_t loc, int print) {}
+void region_domain_t::operator()(const Exit &u, location_t loc) {}
 
-void region_domain_t::operator()(const Jmp &u, location_t loc, int print) {}
+void region_domain_t::operator()(const Jmp &u, location_t loc) {}
 
-void region_domain_t::operator()(const Assume& u, location_t loc, int print) {
+
+void region_domain_t::operator()(const Assume& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Assert& u, location_t loc, int print) {
+void region_domain_t::operator()(const Assert& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+void region_domain_t::operator()(const Comparable& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
+void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
     if (is_ctx_ptr(maybe_ptr_or_mapfd)) {
         auto ctx_ptr = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
@@ -428,15 +429,15 @@ void region_domain_t::operator()(const basic_block_t& bb, int print) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Un& u, location_t loc, int print) {
+void region_domain_t::operator()(const Un& u, location_t loc) {
     m_registers -= u.dst.v;
 }
 
-void region_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+void region_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+void region_domain_t::operator()(const ValidSize& u, location_t loc) {
     /* WARNING: The operation is not implemented yet.*/
 }
 
@@ -539,7 +540,7 @@ void region_domain_t::do_load_mapfd(const register_t& dst_reg, int mapfd, locati
     m_registers.insert(dst_reg, loc, type);
 }
 
-void region_domain_t::operator()(const LoadMapFd &u, location_t loc, int print) {
+void region_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
 }
 
@@ -589,28 +590,28 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
     }
 }
 
-void region_domain_t::operator()(const Call& u, location_t loc, int print) {
+void region_domain_t::operator()(const Call& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Callx &u, location_t loc, int print) {
+void region_domain_t::operator()(const Callx &u, location_t loc) {
     // WARNING: Not implemented yet.
 }
 
-void region_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
+void region_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
     // WARNING: Not implemented yet.
 }
 
-void region_domain_t::operator()(const Atomic &u, location_t loc, int print) {
+void region_domain_t::operator()(const Atomic &u, location_t loc) {
     // WARNING: Not implemented yet.
 }
 
-void region_domain_t::operator()(const Packet& u, location_t loc, int print) {
+void region_domain_t::operator()(const Packet& u, location_t loc) {
     m_registers -= register_t{R0_RETURN_VALUE};
     m_registers.scratch_caller_saved_registers();
 }
 
-void region_domain_t::operator()(const Addable &u, location_t loc, int print) {
+void region_domain_t::operator()(const Addable &u, location_t loc) {
     // nothing to do here
 }
 
@@ -659,11 +660,11 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
 
 }
 
-void region_domain_t::operator()(const ValidAccess &s, location_t loc, int print) {
+void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+void region_domain_t::operator()(const ValidStore& u, location_t loc) {
     // nothing to do here
 }
 
@@ -684,7 +685,7 @@ region_domain_t&& region_domain_t::setup_entry() {
     return std::move(inv);
 }
 
-void region_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto ptr_or_mapfd_opt = m_registers.find(s.reg.v);
     if (ptr_or_mapfd_opt) {
         // it is a pointer or mapfd
@@ -755,7 +756,7 @@ void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const i
     }
 }
 
-void region_domain_t::operator()(const Bin& b, location_t loc, int print) {
+void region_domain_t::operator()(const Bin& b, location_t loc) {
     // nothing to do here
 }
 
@@ -952,7 +953,7 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
     }
 }
 
-void region_domain_t::operator()(const Mem& m, location_t loc, int print) {
+void region_domain_t::operator()(const Mem& m, location_t loc) {
     // nothing to do here
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 7138d47e8..33b5beb2a 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -131,30 +131,30 @@ class region_domain_t final {
     void operator-=(register_t var) { m_registers -= var; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
-    void operator()(const Un&, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call&, location_t loc = boost::none, int print = 0);
-    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const ValidDivisor&, location_t loc = boost::none);
+    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& o) const {}
     crab::bound_t get_loop_count_upper_bound();
@@ -188,7 +188,6 @@ class region_domain_t final {
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     void set_registers_to_top();
     void adjust_bb_for_types(location_t);
-    void print_all_register_types() const;
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
 }; // end region_domain_t
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 734794f67..7e22d03b2 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -99,28 +99,29 @@ string_invariant type_domain_t::to_set() {
     return string_invariant{};
 }
 
-void type_domain_t::operator()(const Undefined& u, location_t loc, int print) {
+void type_domain_t::operator()(const Undefined& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Un& u, location_t loc, int print) {
+void type_domain_t::operator()(const Un& u, location_t loc) {
     m_interval(u, loc);
 }
 
-void type_domain_t::operator()(const LoadMapFd& u, location_t loc, int print) {
+void type_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_region(u, loc);
     m_offset(u, loc);
     m_interval(u, loc);
 }
 
-void type_domain_t::operator()(const Atomic &u, location_t loc, int print) {
+void type_domain_t::operator()(const Atomic &u, location_t loc) {
     // WARNING: Not implemented yet
 }
-void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc, int print) {
+
+void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Call& u, location_t loc, int print) {
+void type_domain_t::operator()(const Call& u, location_t loc) {
 
     stack_cells_t stack_values;
     for (ArgPair param : u.pairs) {
@@ -151,23 +152,23 @@ void type_domain_t::operator()(const Call& u, location_t loc, int print) {
     m_interval.do_call(u, stack_values, loc);
 }
 
-void type_domain_t::operator()(const Callx &u, location_t loc, int print) {
+void type_domain_t::operator()(const Callx &u, location_t loc) {
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Exit& u, location_t loc, int print) {
+void type_domain_t::operator()(const Exit& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Jmp& u, location_t loc, int print) {}
+void type_domain_t::operator()(const Jmp& u, location_t loc) {}
 
-void type_domain_t::operator()(const Packet& u, location_t loc, int print) {
+void type_domain_t::operator()(const Packet& u, location_t loc) {
     m_region(u, loc);
     m_offset(u, loc);
     m_interval(u, loc);
 }
 
-void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
+void type_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
     if (std::holds_alternative<Reg>(cond.right)) {
@@ -176,7 +177,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
         if (maybe_left_type && maybe_right_type) {
             // both pointers
             if (is_packet_ptr(maybe_left_type) && is_packet_ptr(maybe_right_type)) {
-                m_offset(s, loc, print);
+                m_offset(s, loc);
             }
         }
         else if (!maybe_left_type && !maybe_right_type) {
@@ -196,7 +197,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc, int print) {
     }
 }
 
-void type_domain_t::operator()(const ValidDivisor& u, location_t loc, int print) {
+void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type_reg = m_interval.find_interval_value(u.reg.v);
     assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
@@ -212,7 +213,7 @@ void type_domain_t::operator()(const ValidDivisor& u, location_t loc, int print)
     }
 }
 
-void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print) {
+void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
     auto interval_type = 
@@ -252,18 +253,18 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc, int print)
     }
 }
 
-void type_domain_t::operator()(const TypeConstraint& s, location_t loc, int print) {
+void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
     assert(!reg_type || !mock_interval_type);
     m_region(s, loc);
 }
 
-void type_domain_t::operator()(const Assert& u, location_t loc, int print) {
-    std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, u.cst);
+void type_domain_t::operator()(const Assert& u, location_t loc) {
+    std::visit([this, loc](const auto& v) { std::apply(*this, std::make_tuple(v, loc)); }, u.cst);
 }
 
-void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
+void type_domain_t::operator()(const Comparable& u, location_t loc) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
@@ -286,7 +287,7 @@ void type_domain_t::operator()(const Comparable& u, location_t loc, int print) {
     m_errors.push_back("Non-comparable types");
 }
 
-void type_domain_t::operator()(const Addable& u, location_t loc, int print) {
+void type_domain_t::operator()(const Addable& u, location_t loc) {
     auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
     auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
     auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
@@ -303,7 +304,7 @@ void type_domain_t::operator()(const Addable& u, location_t loc, int print) {
     m_errors.push_back("Addable assertion fail");
 }
 
-void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
+void type_domain_t::operator()(const ValidStore& u, location_t loc) {
     auto maybe_ptr_or_mapfd_mem = m_region.find_ptr_or_mapfd_type(u.mem.v);
     auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
     auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
@@ -320,7 +321,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc, int print) {
     m_errors.push_back("Valid store assertion fail");
 }
 
-void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
+void type_domain_t::operator()(const ValidSize& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
     assert(!maybe_ptr_or_mapfd || !maybe_num_type);
@@ -335,7 +336,7 @@ void type_domain_t::operator()(const ValidSize& u, location_t loc, int print) {
     m_errors.push_back("Valid Size assertion fail");
 }
 
-void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int print) {
+void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
 
     // TODO: move map-related function to common
     //auto fd_type = m_region.get_map_type(u.map_fd_reg);
@@ -394,7 +395,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc, int pr
     m_errors.push_back("valid map key value assertion failed");
 }
 
-void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc, int print) {
+void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     m_region(u, loc);
 }
 
@@ -406,7 +407,7 @@ type_domain_t type_domain_t::setup_entry() {
     return typ;
 }
 
-void type_domain_t::operator()(const Bin& bin, location_t loc, int print) {
+void type_domain_t::operator()(const Bin& bin, location_t loc) {
     if (is_bottom()) return;
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
     std::optional<interval_t> src_interval;
@@ -476,7 +477,7 @@ void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> tar
     m_offset.do_mem_store(b, target_opt, basereg_opt);
 }
 
-void type_domain_t::operator()(const Mem& b, location_t loc, int print) {
+void type_domain_t::operator()(const Mem& b, location_t loc) {
     auto basereg = b.access.basereg;
     auto base_ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
     bool unknown_ptr = !base_ptr_or_mapfd_opt.has_value();
@@ -569,7 +570,7 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
 
     for (const Instruction& statement : bb) {
         loc = location_t(std::make_pair(label, ++curr_pos));
-        std::visit([this, loc, print](const auto& v) { std::apply(*this, std::make_tuple(v, loc, print)); }, statement);
+        std::visit([this, loc](const auto& v) { std::apply(*this, std::make_tuple(v, loc)); }, statement);
     }
 
     operator+=(m_region.get_errors());
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 5438a508e..482c3054c 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -53,30 +53,30 @@ class type_domain_t final {
     void operator-=(crab::variable_t var);
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none, int print = 0);
-    void operator()(const Bin&, location_t loc = boost::none, int print = 0);
-    void operator()(const Un&, location_t loc = boost::none, int print = 0);
-    void operator()(const LoadMapFd&, location_t loc = boost::none, int print = 0);
-    void operator()(const Atomic&, location_t loc = boost::none, int print = 0);
-    void operator()(const Call&, location_t loc = boost::none, int print = 0);
-    void operator()(const Callx&, location_t loc = boost::none, int print = 0);
-    void operator()(const Exit&, location_t loc = boost::none, int print = 0);
-    void operator()(const Jmp&, location_t loc = boost::none, int print = 0);
-    void operator()(const Mem&, location_t loc = boost::none, int print = 0);
-    void operator()(const Packet&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assume&, location_t loc = boost::none, int print = 0);
-    void operator()(const Assert&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidAccess&, location_t loc = boost::none, int print = 0);
-    void operator()(const Comparable&, location_t loc = boost::none, int print = 0);
-    void operator()(const Addable&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidStore&, location_t loc = boost::none, int print = 0);
-    void operator()(const TypeConstraint&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidSize&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none, int print = 0);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none, int print = 0);
-    void operator()(const ValidDivisor&, location_t loc = boost::none, int print = 0);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none, int print = 0) {};
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none, int print = 0);
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Atomic&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Callx&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const ValidAccess&, location_t loc = boost::none);
+    void operator()(const Comparable&, location_t loc = boost::none);
+    void operator()(const Addable&, location_t loc = boost::none);
+    void operator()(const ValidStore&, location_t loc = boost::none);
+    void operator()(const TypeConstraint&, location_t loc = boost::none);
+    void operator()(const ValidSize&, location_t loc = boost::none);
+    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
+    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
+    void operator()(const ValidDivisor&, location_t loc = boost::none);
+    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
+    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const {}
     friend std::ostream& operator<<(std::ostream& o, const type_domain_t& dom);

From 46b44a78c9d19a0ef94193bf79bd0d2d8a2632ec Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 20 Oct 2023 00:42:05 -0400
Subject: [PATCH 137/373] Better checks for Assume across multiple domains

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.hpp               | 11 ++++++++
 src/crab/interval_prop_domain.cpp | 20 +-------------
 src/crab/interval_prop_domain.hpp |  2 +-
 src/crab/type_domain.cpp          | 43 ++++++++++++++++++++++++-------
 4 files changed, 46 insertions(+), 30 deletions(-)

diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index f4a96529d..b7ea049e6 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -166,6 +166,17 @@ inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
             && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_SHARED);
 }
 
+inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
+        const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd2,
+        const std::optional<mock_interval_t>& interval1,
+        const std::optional<mock_interval_t>& interval2) {
+    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return true;
+    if (ptr_or_mapfd1 && ptr_or_mapfd2 && same_region(*ptr_or_mapfd1, *ptr_or_mapfd2))
+        return true;
+    if (interval1 && interval2) return true;
+    return false;
+}
+
 inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
     o << static_cast<std::underlying_type<region_t>::type>(t);
     return o;
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 3006c98fb..d9dc30ef1 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -636,26 +636,8 @@ void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool i
 }
 
 void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
-        Value right, location_t loc) {
+        Value right, interval_t&& left_interval, interval_t&& right_interval, location_t loc) {
     using Op = Condition::Op;
-    auto left_mock_interval = m_registers_interval_values.find(left);
-    if (!left_mock_interval) return;
-    auto left_interval = left_mock_interval->to_interval();
-    interval_t right_interval = interval_t::bottom();
-    int64_t imm;
-    bool is_right_reg = std::holds_alternative<Reg>(right);
-    if (is_right_reg) {
-        auto right_mock_interval = m_registers_interval_values.find(std::get<Reg>(right).v);
-        if (!right_mock_interval) return;
-        right_interval = right_mock_interval->to_interval();
-    }
-    else {
-        imm = static_cast<int64_t>(std::get<Imm>(right).v);
-        right_interval = is64 ? interval_t(number_t{imm}) : interval_t(number_t{(uint64_t)imm});
-    }
-    if (left_interval.is_bottom() || (is_right_reg && right_interval.is_bottom())) {
-        return;
-    }
     interval_t left_interval_orig = left_interval;
     interval_t right_interval_orig = right_interval;
 
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 836cc6e48..0ac2467df 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -158,7 +158,7 @@ class interval_prop_domain_t final {
             interval_t&&, interval_t&&, register_t, Value, location_t);
     void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
             interval_t&&, interval_t&&, register_t, Value, location_t);
-    void assume_cst(Condition::Op, bool, register_t, Value, location_t);
+    void assume_cst(Condition::Op, bool, register_t, Value, interval_t&&, interval_t&&, location_t);
     void assume_lt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
             register_t, Value, location_t, bool);
     void assume_gt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7e22d03b2..adcb359e8 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -171,19 +171,31 @@ void type_domain_t::operator()(const Packet& u, location_t loc) {
 void type_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
+    const auto& maybe_left_interval = m_interval.find_interval_value(cond.left.v);
+    assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
     if (std::holds_alternative<Reg>(cond.right)) {
         const auto& right_reg = std::get<Reg>(cond.right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
-        if (maybe_left_type && maybe_right_type) {
-            // both pointers
-            if (is_packet_ptr(maybe_left_type) && is_packet_ptr(maybe_right_type)) {
-                m_offset(s, loc);
+        const auto& maybe_right_interval = m_interval.find_interval_value(right_reg.v);
+        assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
+        if (same_type(maybe_left_type, maybe_right_type,
+                    maybe_left_interval, maybe_right_interval)) {
+            if (maybe_left_interval) {
+                // both numbers
+                auto left_interval = maybe_left_interval->to_interval();
+                auto right_interval = maybe_right_interval->to_interval();
+                m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right,
+                        std::move(left_interval), std::move(right_interval), loc);
+            }
+            else if (maybe_left_type) {
+                if (is_packet_ptr(maybe_left_type)) {
+                    // both packet pointers
+                    m_offset(s, loc);
+                }
+                else {
+                    // other cases, not implemented yet
+                }
             }
-        }
-        else if (!maybe_left_type && !maybe_right_type) {
-            // both numbers
-            auto left_interval = m_interval.find_interval_value(cond.left.v);
-            m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right, loc);
         }
         else {
             // We should only reach here if `--assume-assert` is off
@@ -193,7 +205,18 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
         }
     }
     else {
-        m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right, loc);
+        if (is_shared_ptr(maybe_left_type) || is_mapfd_type(maybe_left_type)) {
+            // left is a shared pointer, or a mapfd
+            // TODO: need to work with values
+        }
+        else if (maybe_left_interval) {
+            auto left_interval = maybe_left_interval->to_interval();
+            int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
+            auto right_interval = cond.is64
+                ? interval_t{number_t{imm}} : interval_t{number_t{(uint64_t)imm}};
+            m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right,
+                    std::move(left_interval), std::move(right_interval), loc);
+        }
     }
 }
 

From 4be6248882e378e6702300733964a6fa3713e819 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 20 Oct 2023 00:43:42 -0400
Subject: [PATCH 138/373] Disabling the asserts related to checking types

Temporarily disable all asserts that related to checking if the type of
a register is defined in both region and interval propagation domain;
These should not fail, but for certain benchmarks, these do (needs to be
checked later);
Some refactoring in the code of assert checks;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index adcb359e8..7894cf76b 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -172,12 +172,12 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
     const auto& maybe_left_interval = m_interval.find_interval_value(cond.left.v);
-    assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
+    //assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
     if (std::holds_alternative<Reg>(cond.right)) {
         const auto& right_reg = std::get<Reg>(cond.right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
         const auto& maybe_right_interval = m_interval.find_interval_value(right_reg.v);
-        assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
+        //assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
         if (same_type(maybe_left_type, maybe_right_type,
                     maybe_left_interval, maybe_right_interval)) {
             if (maybe_left_interval) {
@@ -223,7 +223,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
 void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type_reg = m_interval.find_interval_value(u.reg.v);
-    assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
+    //assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
 
     if (is_ptr_type(maybe_ptr_or_mapfd_reg)) {
         m_errors.push_back("Only numbers can be used as divisors");
@@ -279,7 +279,7 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
-    assert(!reg_type || !mock_interval_type);
+    //assert(!reg_type.has_value() || !mock_interval_type.has_value());
     m_region(s, loc);
 }
 
@@ -293,8 +293,8 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
     auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
     auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
-    assert(!maybe_ptr_or_mapfd1 || !maybe_num_type1);
-    assert(!maybe_ptr_or_mapfd2 || !maybe_num_type2);
+    //assert(!maybe_ptr_or_mapfd1.has_value() || !maybe_num_type1.has_value());
+    //assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
         if (!is_shared_ptr(maybe_ptr_or_mapfd1)
@@ -315,8 +315,8 @@ void type_domain_t::operator()(const Addable& u, location_t loc) {
     auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
     auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
     auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
-    assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
-    assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
+    //assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
+    //assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
 
     // a -> b <-> !a || b
     // is_ptr(ptr) -> is_num(num) <-> !is_ptr(ptr) || is_num(num)
@@ -332,8 +332,8 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc) {
     auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
     auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
     auto maybe_num_type_val = m_interval.find_interval_value(u.val.v);
-    assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
-    assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
+    //assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
+    //assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
 
     // a -> b <-> !a || b
     // !is_stack_ptr(mem) -> is_num(val) <-> is_stack_ptr(mem) || is_num(val)
@@ -347,7 +347,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc) {
 void type_domain_t::operator()(const ValidSize& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
-    assert(!maybe_ptr_or_mapfd || !maybe_num_type);
+    //assert(!maybe_ptr_or_mapfd || !maybe_num_type);
 
     if (maybe_num_type) {
         auto reg_value = maybe_num_type.value();
@@ -453,13 +453,13 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
         }
         src_interval = interval_t{number_t{imm}};
     }
-    assert(!src_ptr_or_mapfd || !src_interval);
+    //assert(!src_ptr_or_mapfd.has_value() || !src_interval.has_value());
 
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
     auto dst_mock_interval = m_interval.find_interval_value(bin.dst.v);
     auto dst_interval = dst_mock_interval ? dst_mock_interval->to_interval() :
         std::optional<interval_t>();
-    assert(!dst_ptr_or_mapfd.has_value() || !dst_interval.has_value());
+    //assert(!dst_ptr_or_mapfd.has_value() || !dst_interval.has_value());
 
     using Op = Bin::Op;
     // for all operations except mov, add, sub, the src and dst should be numbers

From c1b7082fd5d1157b34021bd6c8c70be1a839268d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Oct 2023 10:32:20 -0400
Subject: [PATCH 139/373] Support for null checks for shared ptrs

Added the concept of nullness of a pointer as MAYBE_NULL, NOT_NULL, and
_NULL;
Keeping track of pointer aliases for shared ptrs;
Support for Assume operation for shared ptrs, and null check for shared
ptrs in ValidAccess;
Better join, including join for shared ptr aliases;
Some refactoring, mainly related to join operations;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp        |  11 +-
 src/crab/common.hpp        |  16 ++-
 src/crab/offset_domain.hpp |   1 -
 src/crab/region_domain.cpp | 263 ++++++++++++++++++++++++++++++-------
 src/crab/region_domain.hpp |  11 +-
 src/crab/type_domain.cpp   |  10 +-
 6 files changed, 253 insertions(+), 59 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index 54dc2fe58..3db09febd 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -50,7 +50,9 @@ mapfd_t mapfd_t::operator|(const mapfd_t& other) const {
     return mapfd_t(std::move(mock_i), value_type);
 }
 
-mock_interval_t ptr_with_off_t::get_region_size() const { return m_region_size; }
+void ptr_with_off_t::set_nullness(nullness_t n) { m_nullness = n; }
+
+void ptr_with_off_t::set_id(int id) { m_id = id; }
 
 void ptr_with_off_t::set_offset(mock_interval_t off) { m_offset = off; }
 
@@ -59,10 +61,11 @@ void ptr_with_off_t::set_region_size(mock_interval_t region_sz) { m_region_size
 void ptr_with_off_t::set_region(region_t r) { m_r = r; }
 
 ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
-    const auto& mock_o = mock_interval_t(m_offset.to_interval() | other.m_offset.to_interval());
-    const auto& mock_r_s = mock_interval_t(
+    auto&& mock_o = mock_interval_t(m_offset.to_interval() | other.m_offset.to_interval());
+    auto&& mock_r_s = mock_interval_t(
             m_region_size.to_interval() | other.m_region_size.to_interval());
-    return ptr_with_off_t(m_r, std::move(mock_o), std::move(mock_r_s));
+    auto&& nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
+    return ptr_with_off_t(m_r, -1, std::move(mock_o), std::move(nullness), std::move(mock_r_s));
 }
 
 std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index b7ea049e6..082ecffa9 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -19,6 +19,7 @@ constexpr int STACK_BEGIN = 0;
 constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
 constexpr int SHARED_BEGIN = 0;
+constexpr int MAX_PACKET_SIZE = 0xffff;
 
 enum class region_t {
 	T_CTX,
@@ -27,6 +28,8 @@ enum class region_t {
 	T_SHARED
 };
 
+enum class nullness_t { MAYBE_NULL, NOT_NULL, _NULL };
+
 class packet_ptr_t {
     region_t m_r = region_t::T_PACKET;
 
@@ -64,7 +67,9 @@ class mock_interval_t {
 
 class ptr_with_off_t {
     region_t m_r;
+    int m_id;
     mock_interval_t m_offset;
+    nullness_t m_nullness = nullness_t::MAYBE_NULL;
     mock_interval_t m_region_size = mock_interval_t::top();
 
   public:
@@ -73,11 +78,16 @@ class ptr_with_off_t {
     ptr_with_off_t(ptr_with_off_t &&) = default;
     ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
     ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
-    ptr_with_off_t(region_t _r, mock_interval_t _off,
+    ptr_with_off_t(region_t _r, int _id, mock_interval_t _off,
+            nullness_t _nullness = nullness_t::MAYBE_NULL,
             mock_interval_t _region_sz = mock_interval_t::top())
-        : m_r(_r), m_offset(_off), m_region_size(_region_sz) {}
+        : m_r(_r), m_id(_id), m_offset(_off), m_nullness(_nullness), m_region_size(_region_sz) {}
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
-    mock_interval_t get_region_size() const;
+    [[nodiscard]] nullness_t get_nullness() const { return m_nullness; }
+    void set_nullness(nullness_t);
+    [[nodiscard]] int get_id() const { return m_id; }
+    void set_id(int);
+    [[nodiscard]] mock_interval_t get_region_size() const { return m_region_size; }
     void set_region_size(mock_interval_t);
     [[nodiscard]] mock_interval_t get_offset() const { return m_offset; }
     void set_offset(mock_interval_t);
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 5710f50cd..2754defb6 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -13,7 +13,6 @@ namespace crab {
 
 constexpr int PACKET_END = -4100;
 constexpr int PACKET_META = -1;
-constexpr int MAX_PACKET_SIZE = 0xffff;
 
 using weight_t = interval_t;
 using slack_var_t = int;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 9411376a9..32a88f38f 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -5,6 +5,49 @@
 
 namespace crab {
 
+static inline std::vector<std::set<int>> join_shared_ptr_aliases(
+        const std::vector<std::set<int>>& A, const std::vector<std::set<int>>& B) {
+    auto flattenSet = [](const std::vector<std::set<int>>& v) {
+        std::set<int> s;
+        for (const auto& x : v) {
+            s.insert(x.begin(), x.end());
+        }
+        return s;
+    };
+
+    std::set<int> a, b, intersect;
+    a = flattenSet(A);
+    b = flattenSet(B);
+
+    std::set_intersection(a.begin(), a.end(), b.begin(), b.end(),
+            std::inserter(intersect, intersect.begin()));
+
+    std::vector<std::set<int>> powerset;
+    powerset.push_back({});
+    for (int n : intersect) {
+        auto size = (size_t)powerset.size();
+        for (size_t i = 0; i < size; i++) {
+            auto newSet = powerset[(int)i];
+            newSet.insert(n);
+            powerset.push_back(newSet);
+        }
+    }
+
+    std::vector<std::set<int>> result;
+    for (const auto& s : powerset) {
+        auto foundInA = std::find(A.begin(), A.end(), s);
+        auto foundInB = std::find(B.begin(), B.end(), s);
+        if (foundInA != A.end() || foundInB != B.end()) {
+            result.push_back(s);
+        }
+        auto flattened = flattenSet(result);
+        if (flattened.size() == intersect.size()) {
+            break;
+        }
+    }
+    return result;
+}
+
 ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
 {
     if (desc->data >= 0) {
@@ -68,30 +111,29 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
 
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto maybe_ptr1 = find(*(m_cur_def[i]));
-        auto maybe_ptr2 = other.find(*(other.m_cur_def[i]));
+        auto maybe_ptr1 = find(register_t{i});
+        auto maybe_ptr2 = other.find(register_t{i});
         if (maybe_ptr1 && maybe_ptr2) {
             ptr_or_mapfd_t ptr_or_mapfd1 = *maybe_ptr1, ptr_or_mapfd2 = *maybe_ptr2;
-            if (ptr_or_mapfd1 == ptr_or_mapfd2) {
-                joined_reg_types.insert(register_t{i}, loc, std::move(ptr_or_mapfd1));
-            }
-            else { 
-                if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
-                            && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
-                    ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
-                    ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
-                    if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                        joined_reg_types.insert(register_t{i}, loc,
-                                std::move(ptr_with_off1 | ptr_with_off2));
-                    }
-                }
-                else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
-                        && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
-                    mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
-                    mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
-                    joined_reg_types.insert(register_t{i}, loc, std::move(mapfd1 | mapfd2));
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
+                        && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                    auto joined_ptr = ptr_with_off1 | ptr_with_off2;
+                    joined_reg_types.insert(register_t{i}, loc, std::move(joined_ptr));
                 }
             }
+            else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                joined_reg_types.insert(register_t{i}, loc, std::move(mapfd1 | mapfd2));
+            }
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+                joined_reg_types.insert(register_t{i}, loc, std::move(packet_ptr_t()));
+            }
         }
     }
     return joined_reg_types;
@@ -166,10 +208,7 @@ stack_t stack_t::operator|(const stack_t& other) const {
             int width1 = ptr_or_mapfd_cells1.second;
             int width2 = ptr_or_mapfd_cells2.second;
             int width_joined = std::min(width1, width2);
-            if (ptr_or_mapfd1 == ptr_or_mapfd2) {
-                joined_stack.store(kv.first, ptr_or_mapfd1, width_joined);
-            }
-            else if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
                 auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
                 auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
@@ -184,6 +223,10 @@ stack_t stack_t::operator|(const stack_t& other) const {
                 auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
                 joined_stack.store(kv.first, std::move(mapfd1 | mapfd2), width_joined);
             }
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+                joined_stack.store(kv.first, std::move(packet_ptr_t()), width_joined);
+            }
         }
     }
     return joined_stack;
@@ -351,7 +394,9 @@ region_domain_t region_domain_t::operator|(const region_domain_t& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx);
+    auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
+    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx,
+            std::move(aliases));
 }
 
 region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
@@ -361,7 +406,9 @@ region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return region_domain_t(m_registers | std::move(other.m_registers), m_stack | std::move(other.m_stack), other.m_ctx);
+    auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
+    return region_domain_t(m_registers | std::move(other.m_registers),
+            m_stack | std::move(other.m_stack), other.m_ctx, std::move(aliases));
 }
 
 region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
@@ -399,6 +446,70 @@ void region_domain_t::operator()(const Exit &u, location_t loc) {}
 void region_domain_t::operator()(const Jmp &u, location_t loc) {}
 
 
+void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t&& shared_ptr, int64_t imm,
+        register_t left, location_t loc) {
+    // we only reach here when the ptr is shared ptr
+    auto nullness = shared_ptr.get_nullness();
+    auto set_nullness = [this, loc, left](nullness_t n, int id) {
+        if (id == -1) {
+            for (size_t i = 0; i < m_shared_ptr_aliases.size(); i++) {
+                if (m_shared_ptr_aliases[i].count(left)) {
+                    id = i;
+                    break;
+                }
+            }
+        }
+        if (id == -1) return;
+        for (const auto& s : m_shared_ptr_aliases[id]) {
+            if (s <= 10) {
+                auto type = m_registers.find(register_t{(uint8_t)s});
+                if (is_shared_ptr(type)) {
+                    auto shared_ptr = std::get<ptr_with_off_t>(*type);
+                    shared_ptr.set_nullness(n);
+                    m_registers.insert(register_t{(uint8_t)s}, loc, shared_ptr);
+                }
+            }
+            else {
+                auto offset = s - 11;
+                auto type_with_width = m_stack.find(offset);
+                if (!type_with_width) continue;
+                auto type = type_with_width->first;
+                if (is_shared_ptr(type)) {
+                    auto shared_ptr = std::get<ptr_with_off_t>(type);
+                    shared_ptr.set_nullness(n);
+                    m_stack.store(offset, shared_ptr, type_with_width->second);
+                }
+            }
+        }
+    };
+    if (imm == 0) {
+        if (op == Condition::Op::EQ) {
+            if (nullness == nullness_t::_NULL) {
+                m_registers.set_to_top();
+            }
+            else if (nullness == nullness_t::NOT_NULL) {
+                m_registers.set_to_bottom();
+            }
+            else {
+                auto id = shared_ptr.get_id();
+                set_nullness(nullness_t::_NULL, id);
+            }
+        }
+        else if (op == Condition::Op::NE) {
+            if (nullness == nullness_t::NOT_NULL) {
+                m_registers.set_to_top();
+            }
+            else if (nullness == nullness_t::_NULL) {
+                m_registers.set_to_bottom();
+            }
+            else {
+                auto id = shared_ptr.get_id();
+                set_nullness(nullness_t::NOT_NULL, id);
+            }
+        }
+    }
+}
+
 void region_domain_t::operator()(const Assume& u, location_t loc) {
     // nothing to do here
 }
@@ -544,6 +655,31 @@ void region_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
 }
 
+void region_domain_t::set_aliases(int v, ptr_with_off_t& ptr) {
+    size_t i = 0;
+    for (; i < m_shared_ptr_aliases.size(); i++) {
+        if (m_shared_ptr_aliases[(int)i].count(v) > 0) {
+            break;
+        }
+    }
+    if (i < m_shared_ptr_aliases.size()) m_shared_ptr_aliases[(int)i].erase(v);
+    auto id = ptr.get_id();
+    /* NOTE: this check is supposed to be for newly generated pointers, but it could also be the
+     * case that an existing pointer has id == -1. This is because, at join of two ptr_with_off_t,
+     * we set id == -1 for simplicity. Some code for correcting this is in the assume_cst
+     * function, although it should work here as well but doesn't (ideally, may be not).
+     * In future, check this again.
+     */
+    if (id == -1) {
+        m_shared_ptr_aliases.push_back({v});
+        ptr.set_id(m_shared_ptr_aliases.size() - 1);
+    }
+    else {
+        m_shared_ptr_aliases[id].insert(v);
+        ptr.set_id(id);
+    }
+}
+
 void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
     for (const auto& kv : cells) {
         auto offset = kv.first;
@@ -568,15 +704,18 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                         goto out;
                     }
                 } else {
-                    auto type = ptr_with_off_t(crab::region_t::T_SHARED, interval_t{number_t{0}},
+                    auto type = ptr_with_off_t(region_t::T_SHARED, -1,
+                            interval_t{number_t{0}}, nullness_t::MAYBE_NULL,
                             get_map_value_size(*maybe_fd_reg));
+                    set_aliases((int)r0, type);
                     m_registers.insert(r0, loc, type);
                 }
             }
         }
         else {
-            auto type = ptr_with_off_t(
-                 crab::region_t::T_SHARED, interval_t{number_t{0}}, crab::interval_t::top());
+            auto type = ptr_with_off_t(region_t::T_SHARED, -1, interval_t{number_t{0}},
+                    nullness_t::MAYBE_NULL);
+            set_aliases((int)r0, type);
             m_registers.insert(r0, loc, type);
         }
     }
@@ -626,22 +765,29 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
             auto offset = ptr_with_off_type.get_offset();
             auto offset_to_check = offset.to_interval()+interval_t{s.offset};
             auto offset_lb = offset_to_check.lb();
-            auto offset_plus_width_ub = offset_to_check.ub()+crab::bound_t{width};
-            if (ptr_with_off_type.get_region() == crab::region_t::T_STACK) {
-                if (crab::bound_t{STACK_BEGIN} <= offset_lb
-                        && offset_plus_width_ub <= crab::bound_t{EBPF_STACK_SIZE})
+            auto offset_plus_width_ub = offset_to_check.ub()+bound_t{width};
+            if (ptr_with_off_type.get_region() == region_t::T_STACK) {
+                if (bound_t{STACK_BEGIN} <= offset_lb
+                        && offset_plus_width_ub <= bound_t{EBPF_STACK_SIZE})
                     return;
             }
-            else if (ptr_with_off_type.get_region() == crab::region_t::T_CTX) {
-                if (crab::bound_t{CTX_BEGIN} <= offset_lb
-                        && offset_plus_width_ub <= crab::bound_t{ctx_size()})
+            else if (ptr_with_off_type.get_region() == region_t::T_CTX) {
+                if (bound_t{CTX_BEGIN} <= offset_lb
+                        && offset_plus_width_ub <= bound_t{ctx_size()})
                     return;
             }
             else { // shared
                 if (crab::bound_t{SHARED_BEGIN} <= offset_lb &&
-                        offset_plus_width_ub <= ptr_with_off_type.get_region_size().lb()) return;
-                // TODO: check null access
-                //return;
+                        offset_plus_width_ub <= ptr_with_off_type.get_region_size().lb()) {
+                    if (!is_comparison_check && !s.or_null) {
+                        auto nullness = ptr_with_off_type.get_nullness();
+                        if (nullness != nullness_t::NOT_NULL) {
+                            m_errors.push_back("possible null access");
+                        }
+                        return;
+                    }
+                    return;
+                }
             }
         }
         else if (std::holds_alternative<packet_ptr_t>(reg_ptr_or_mapfd_type)) {
@@ -676,12 +822,12 @@ region_domain_t&& region_domain_t::setup_entry() {
     register_types_t typ(std::make_shared<global_region_env_t>());
 
     auto loc = std::make_pair(label_t::entry, (unsigned int)0);
-    auto ctx_ptr_r1 = ptr_with_off_t(crab::region_t::T_CTX, mock_interval_t{number_t{0}});
-    auto stack_ptr_r10 = ptr_with_off_t(crab::region_t::T_STACK, mock_interval_t{number_t{512}});
+    auto ctx_ptr_r1 = ptr_with_off_t(region_t::T_CTX, -1, mock_interval_t{number_t{0}});
+    auto stack_ptr_r10 = ptr_with_off_t(region_t::T_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    static region_domain_t inv(std::move(typ), crab::stack_t::top(), ctx);
+    static region_domain_t inv(std::move(typ), stack_t::top(), ctx);
     return std::move(inv);
 }
 
@@ -783,8 +929,16 @@ interval_t region_domain_t::do_bin(const Bin& bin,
         // ra = b, where b is a pointer/mapfd, a numerical register, or a constant;
         case Op::MOV: {
             // b is a pointer/mapfd
-            if (src_ptr_or_mapfd_opt)
-                m_registers.insert(dst_register, loc, src_ptr_or_mapfd);
+            if (src_ptr_or_mapfd_opt) {
+                if (is_shared_ptr(src_ptr_or_mapfd_opt)) {
+                    auto shared_ptr = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
+                    set_aliases(dst_register, shared_ptr);
+                    m_registers.insert(dst_register, loc, shared_ptr);
+                }
+                else {
+                    m_registers.insert(dst_register, loc, src_ptr_or_mapfd);
+                }
+            }
             // b is a numerical register, or constant
             else if (dst_ptr_or_mapfd_opt) {
                 m_registers -= dst_register;
@@ -920,8 +1074,15 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
                 m_registers -= target_register;
                 return;
             }
-
-            m_registers.insert(target_register, loc, (*loaded).first);
+            auto ptr_or_mapfd = loaded->first;
+            if (is_shared_ptr(ptr_or_mapfd)) {
+                auto shared_ptr = std::get<ptr_with_off_t>(ptr_or_mapfd);
+                set_aliases((int)target_register, shared_ptr);
+                m_registers.insert(target_register, loc, shared_ptr);
+            }
+            else {
+                m_registers.insert(target_register, loc, ptr_or_mapfd);
+            }
         }
     }
     else {
@@ -1005,7 +1166,15 @@ void region_domain_t::do_mem_store(const Mem& b, location_t loc) {
 
     // if targetreg_type is empty, we are storing a number
     if (!targetreg_type) return;
-    m_stack.store(store_at, *targetreg_type, width);
+    auto type = *targetreg_type;
+    if (is_shared_ptr(type)) {
+        auto shared_ptr = std::get<ptr_with_off_t>(type);
+        set_aliases(store_at+11, shared_ptr);
+        m_stack.store(store_at, shared_ptr, width);
+    }
+    else {
+        m_stack.store(store_at, type, width);
+    }
 }
 
 void region_domain_t::adjust_bb_for_types(location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 33b5beb2a..b78ad8c8a 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -12,6 +12,8 @@
 
 namespace crab {
 
+using shared_ptr_aliases_t = std::vector<std::set<int>>;
+
 class ctx_t {
     using ptr_types_t = std::unordered_map<uint64_t, packet_ptr_t>;
 
@@ -94,6 +96,7 @@ class region_domain_t final {
     crab::stack_t m_stack;
     crab::register_types_t m_registers;
     std::shared_ptr<crab::ctx_t> m_ctx;
+    shared_ptr_aliases_t m_shared_ptr_aliases;
     std::vector<std::string> m_errors;
 
   public:
@@ -103,8 +106,10 @@ class region_domain_t final {
     region_domain_t(const region_domain_t& o) = default;
     region_domain_t& operator=(region_domain_t&& o) = default;
     region_domain_t& operator=(const region_domain_t& o) = default;
-    region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st, std::shared_ptr<crab::ctx_t> _ctx)
-            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx) {}
+    region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st,
+            std::shared_ptr<crab::ctx_t> _ctx, shared_ptr_aliases_t&& _shared_ptr_aliases = {})
+            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx),
+            m_shared_ptr_aliases(std::move(_shared_ptr_aliases)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static region_domain_t&& setup_entry();
     // bottom/top
@@ -176,6 +181,7 @@ class region_domain_t final {
             const std::optional<crab::ptr_or_mapfd_t>&, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int);
+    void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
     void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
             const crab::location_t&, register_t);
 
@@ -185,6 +191,7 @@ class region_domain_t final {
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
+    void set_aliases(int, ptr_with_off_t&);
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     void set_registers_to_top();
     void adjust_bb_for_types(location_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7894cf76b..1d8a14364 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -205,8 +205,14 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
         }
     }
     else {
-        if (is_shared_ptr(maybe_left_type) || is_mapfd_type(maybe_left_type)) {
-            // left is a shared pointer, or a mapfd
+        if (is_shared_ptr(maybe_left_type)) {
+            // left is a shared pointer
+            int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
+            auto shared_ptr = std::get<ptr_with_off_t>(*maybe_left_type);
+            m_region.assume_cst(cond.op, std::move(shared_ptr), imm, cond.left.v, loc);
+        }
+        if (is_mapfd_type(maybe_left_type)) {
+            // left is  a mapfd
             // TODO: need to work with values
         }
         else if (maybe_left_interval) {

From cb55812b477c7c22ea7cfebc381b4a57d6b93e84 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 1 Nov 2023 21:53:19 -0400
Subject: [PATCH 140/373] Updated tests to add for type domain

Needs more work, some test cases might still not be added for type
domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/test/test_verify.cpp             |  38 +-
 src/test/test_verify_type_domain.cpp | 577 ---------------------------
 2 files changed, 33 insertions(+), 582 deletions(-)
 delete mode 100644 src/test/test_verify_type_domain.cpp

diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 32f90054e..3bf306364 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -48,17 +48,33 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     } while (0)
 
 #define TEST_SECTION(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
+    } \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
     }
 
 #define TEST_SECTION_REJECT(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
+    } \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
     }
 
 #define TEST_SECTION_REJECT_IF_STRICT(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
+        options.strict = true; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
+    } \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") { \
         ebpf_verifier_options_t options = ebpf_verifier_default_options; \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
         options.strict = true; \
@@ -66,15 +82,26 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     }
 
 #define TEST_SECTION_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section " --domain=zoneCrab", "[!shouldfail][verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
+    } \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section " --domain=type", "[!shouldfail][verify][samples][" project "][type]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
     }
 
 #define TEST_SECTION_REJECT_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section " --domain=zoneCrab", "[!shouldfail][verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
+    } \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section " --domain=type", "[!shouldfail][verify][samples][" project "][type]") { \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
+        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
     }
 
+// need these defined for type domain as well
 #define TEST_SECTION_LEGACY(dirname, filename, sectionname) \
     TEST_SECTION(dirname, filename, sectionname) \
     TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
@@ -87,6 +114,7 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
     }
 
+// Tests for zoneCrab domain
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "1/0xdc06")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/1")
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/3")
diff --git a/src/test/test_verify_type_domain.cpp b/src/test/test_verify_type_domain.cpp
deleted file mode 100644
index cadc10f24..000000000
--- a/src/test/test_verify_type_domain.cpp
+++ /dev/null
@@ -1,577 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#include <thread>
-#include <catch2/catch_all.hpp>
-#include "ebpf_verifier.hpp"
-
-#define FAIL_LOAD_ELF(dirname, filename, sectionname) \
-    TEST_CASE("Try loading nonexisting program: " dirname "/" filename, "[elf]") { \
-        try { \
-            read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
-            REQUIRE(false); \
-        } catch (const std::runtime_error&) { \
-        }\
-    }
-
-// Some intentional failures
-FAIL_LOAD_ELF("cilium", "not-found.o", "2/1")
-FAIL_LOAD_ELF("cilium", "bpf_lxc.o", "not-found")
-FAIL_LOAD_ELF("build", "badrelo.o", ".text")
-FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
-
-#define FAIL_UNMARSHAL(dirname, filename, sectionname) \
-    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename, "[unmarshal]") { \
-        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
-        REQUIRE(raw_progs.size() == 1); \
-        raw_program raw_prog = raw_progs.back(); \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-        REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
-    }
-
-// Some intentional unmarshal failures
-FAIL_UNMARSHAL("build", "wronghelper.o", "xdp")
-FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
-
-#define VERIFY_SECTION(dirname, filename, sectionname, options, pass) \
-    do { \
-        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
-        REQUIRE(raw_progs.size() == 1); \
-        raw_program raw_prog = raw_progs.back(); \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-        REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
-        auto& prog = std::get<InstructionSeq>(prog_or_error); \
-        crab_results res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
-        if (pass)                                            \
-	  REQUIRE(res.pass_verify());			     \
-        else                                                 \
-	  REQUIRE(!res.pass_verify());			     \
-    } while (0)
-
-#define TEST_SECTION(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
-        VERIFY_SECTION(project, filename, section, &options, true); \
-    }
-
-#define TEST_SECTION_REJECT(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
-        VERIFY_SECTION(project, filename, section, &options, false); \
-    }
-
-#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section) \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
-        VERIFY_SECTION(project, filename, section, &options, true); \
-        options.strict = true; \
-        VERIFY_SECTION(project, filename, section, &options, false); \
-    }
-
-#define TEST_SECTION_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
-        VERIFY_SECTION(project, filename, section, &options, true); \
-    }
-
-#define TEST_SECTION_REJECT_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN; \
-        VERIFY_SECTION(project, filename, section, &options, false); \
-    }
-
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "1/0xdc06")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/3")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/4")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/5")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/6")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "2/10")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "from-container")
-
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "1/0x1010")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/3")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/4")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/5")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/6")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DUNKNOWN.o", "from-container")
-
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "1/0x1010")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/3")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/4")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/5")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/6")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_lxc-DDROP_ALL.o", "from-container")
-
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/3")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/4")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/5")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_netdev.o", "from-netdev")
-
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/3")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/4")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/5")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "2/7")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "3/2")
-TEST_SECTION("bpf_cilium_test", "bpf_overlay.o", "from-overlay")
-
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L3.o", "from-netdev")
-
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DLB_L4.o", "from-netdev")
-
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "2/1")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "2/2")
-TEST_SECTION("bpf_cilium_test", "bpf_lb-DUNKNOWN.o", "from-netdev")
-
-TEST_SECTION("cilium", "bpf_lb.o", "2/1")
-TEST_SECTION("cilium", "bpf_lb.o", "from-netdev")
-
-TEST_SECTION("cilium", "bpf_lxc.o", "1/0x1010")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/1")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/3")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/4")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/5")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/6")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/7")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/8")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/9")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/10")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/11")
-TEST_SECTION("cilium", "bpf_lxc.o", "2/12")
-TEST_SECTION("cilium", "bpf_lxc.o", "from-container")
-
-TEST_SECTION("cilium", "bpf_netdev.o", "2/1")
-TEST_SECTION("cilium", "bpf_netdev.o", "2/3")
-TEST_SECTION("cilium", "bpf_netdev.o", "2/4")
-TEST_SECTION("cilium", "bpf_netdev.o", "2/5")
-TEST_SECTION("cilium", "bpf_netdev.o", "2/7")
-TEST_SECTION("cilium", "bpf_netdev.o", "from-netdev")
-
-TEST_SECTION("cilium", "bpf_overlay.o", "2/1")
-TEST_SECTION("cilium", "bpf_overlay.o", "2/3")
-TEST_SECTION("cilium", "bpf_overlay.o", "2/4")
-TEST_SECTION("cilium", "bpf_overlay.o", "2/5")
-TEST_SECTION("cilium", "bpf_overlay.o", "2/7")
-TEST_SECTION("cilium", "bpf_overlay.o", "from-overlay")
-
-TEST_SECTION("cilium", "bpf_xdp.o", "from-netdev")
-
-TEST_SECTION("cilium", "bpf_xdp_dsr_linux_v1_1.o", "from-netdev")
-TEST_SECTION("cilium", "bpf_xdp_dsr_linux.o", "2/1")
-TEST_SECTION("cilium", "bpf_xdp_dsr_linux.o", "from-netdev")
-
-TEST_SECTION("cilium", "bpf_xdp_snat_linux.o", "2/1")
-TEST_SECTION("cilium", "bpf_xdp_snat_linux.o", "from-netdev")
-
-TEST_SECTION("linux", "cpustat_kern.o", "tracepoint/power/cpu_frequency")
-TEST_SECTION("linux", "cpustat_kern.o", "tracepoint/power/cpu_idle")
-TEST_SECTION("linux", "lathist_kern.o", "kprobe/trace_preempt_off")
-TEST_SECTION("linux", "lathist_kern.o", "kprobe/trace_preempt_on")
-TEST_SECTION("linux", "lwt_len_hist_kern.o", "len_hist")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getegid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_geteuid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getgid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getpgid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getppid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_gettid")
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_getuid")
-TEST_SECTION("linux", "offwaketime_kern.o", "kprobe/try_to_wake_up")
-TEST_SECTION("linux", "offwaketime_kern.o", "tracepoint/sched/sched_switch")
-TEST_SECTION("linux", "sampleip_kern.o", "perf_event")
-TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock1")
-TEST_SECTION("linux", "sock_flags_kern.o", "cgroup/sock2")
-TEST_SECTION("linux", "sockex1_kern.o", "socket1")
-TEST_SECTION("linux", "sockex2_kern.o", "socket2")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/3")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/4")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/1")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/2")
-TEST_SECTION("linux", "sockex3_kern.o", "socket/0")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/__htab_percpu_map_update_elem")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_bh")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_irq")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_lock_irqsave")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_trylock_bh")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_trylock")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock_bh")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/_raw_spin_unlock_irqrestore")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/htab_map_alloc")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/htab_map_update_elem")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/mutex_spin_on_owner")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/rwsem_spin_on_owner")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_lock")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_unlock")
-TEST_SECTION("linux", "spintest_kern.o", "kprobe/spin_unlock_irqrestore")
-TEST_SECTION("linux", "syscall_tp_kern.o", "tracepoint/syscalls/sys_enter_open")
-TEST_SECTION("linux", "syscall_tp_kern.o", "tracepoint/syscalls/sys_exit_open")
-TEST_SECTION("linux", "task_fd_query_kern.o", "kprobe/blk_start_request")
-TEST_SECTION("linux", "task_fd_query_kern.o", "kretprobe/blk_account_io_completion")
-TEST_SECTION("linux", "tc_l2_redirect_kern.o", "drop_non_tun_vip")
-TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_ip6tun_ingress_redirect")
-TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_iptun_ingress_forward")
-TEST_SECTION("linux", "tc_l2_redirect_kern.o", "l2_to_iptun_ingress_redirect")
-TEST_SECTION("linux", "tcp_basertt_kern.o", "sockops")
-TEST_SECTION("linux", "tcp_bufs_kern.o", "sockops")
-TEST_SECTION("linux", "tcp_cong_kern.o", "sockops")
-TEST_SECTION("linux", "tcp_iw_kern.o", "sockops")
-TEST_SECTION("linux", "tcbpf1_kern.o", "classifier")
-TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_recv")
-TEST_SECTION("linux", "tcbpf1_kern.o", "clone_redirect_xmit")
-TEST_SECTION("linux", "tcbpf1_kern.o", "redirect_recv")
-TEST_SECTION("linux", "tcbpf1_kern.o", "redirect_xmit")
-TEST_SECTION("linux", "tcp_clamp_kern.o", "sockops")
-TEST_SECTION("linux", "tcp_rwnd_kern.o", "sockops")
-TEST_SECTION("linux", "tcp_synrto_kern.o", "sockops")
-TEST_SECTION("linux", "test_cgrp2_tc_kern.o", "filter")
-TEST_SECTION("linux", "test_current_task_under_cgroup_kern.o", "kprobe/sys_sync")
-TEST_SECTION("linux", "test_overhead_kprobe_kern.o", "kprobe/__set_task_comm")
-TEST_SECTION("linux", "test_overhead_kprobe_kern.o", "kprobe/urandom_read")
-TEST_SECTION("linux", "test_overhead_raw_tp_kern.o", "raw_tracepoint/task_rename")
-TEST_SECTION("linux", "test_overhead_raw_tp_kern.o", "raw_tracepoint/urandom_read")
-TEST_SECTION("linux", "test_overhead_tp_kern.o", "tracepoint/random/urandom_read")
-TEST_SECTION("linux", "test_overhead_tp_kern.o", "tracepoint/task/task_rename")
-TEST_SECTION("linux", "test_probe_write_user_kern.o", "kprobe/sys_connect")
-TEST_SECTION("linux", "trace_event_kern.o", "perf_event")
-TEST_SECTION("linux", "trace_output_kern.o", "kprobe/sys_write")
-TEST_SECTION("linux", "tracex1_kern.o", "kprobe/__netif_receive_skb_core")
-TEST_SECTION("linux", "tracex2_kern.o", "kprobe/kfree_skb")
-TEST_SECTION("linux", "tracex2_kern.o", "kprobe/sys_write")
-TEST_SECTION("linux", "tracex3_kern.o", "kprobe/blk_account_io_completion")
-TEST_SECTION("linux", "tracex3_kern.o", "kprobe/blk_start_request")
-TEST_SECTION("linux", "tracex4_kern.o", "kprobe/kmem_cache_free")
-TEST_SECTION("linux", "tracex4_kern.o", "kretprobe/kmem_cache_alloc_node")
-TEST_SECTION("linux", "tracex5_kern.o", "kprobe/__seccomp_filter")
-TEST_SECTION("linux", "tracex5_kern.o", "kprobe/0")
-TEST_SECTION("linux", "tracex5_kern.o", "kprobe/1")
-TEST_SECTION("linux", "tracex5_kern.o", "kprobe/9")
-TEST_SECTION("linux", "tracex6_kern.o", "kprobe/htab_map_get_next_key")
-TEST_SECTION("linux", "tracex6_kern.o", "kprobe/htab_map_lookup_elem")
-TEST_SECTION("linux", "tracex7_kern.o", "kprobe/open_ctree")
-TEST_SECTION("linux", "xdp_adjust_tail_kern.o", "xdp_icmp")
-TEST_SECTION("linux", "xdp_fwd_kern.o", "xdp_fwd")
-TEST_SECTION("linux", "xdp_fwd_kern.o", "xdp_fwd_direct")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_devmap_xmit")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_exception")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_err")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map")
-TEST_SECTION("linux", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map0")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map1_touch_data")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map2_round_robin")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map3_proto_separate")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map4_ddos_filter_pktgen")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "xdp_cpu_map5_lb_hash_ip_pairs")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_exception")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_err")
-TEST_SECTION("linux", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
-TEST_SECTION("linux", "xdp_redirect_kern.o", "xdp_redirect")
-TEST_SECTION("linux", "xdp_redirect_kern.o", "xdp_redirect_dummy")
-TEST_SECTION("linux", "xdp_redirect_map_kern.o", "xdp_redirect_dummy")
-TEST_SECTION("linux", "xdp_redirect_map_kern.o", "xdp_redirect_map")
-TEST_SECTION("linux", "xdp_router_ipv4_kern.o", "xdp_router_ipv4")
-TEST_SECTION("linux", "xdp_rxq_info_kern.o", "xdp_prog0")
-TEST_SECTION("linux", "xdp_sample_pkts_kern.o", "xdp_sample")
-TEST_SECTION("linux", "xdp_tx_iptunnel_kern.o", "xdp_tx_iptunnel")
-TEST_SECTION("linux", "xdp1_kern.o", "xdp1")
-TEST_SECTION("linux", "xdp2_kern.o", "xdp1")
-TEST_SECTION("linux", "xdp2skb_meta_kern.o", "tc_mark")
-TEST_SECTION("linux", "xdp2skb_meta_kern.o", "xdp_mark")
-TEST_SECTION("linux", "xdpsock_kern.o", "xdp_sock")
-// Finally passes; still requires double-check
-TEST_SECTION("linux", "map_perf_test_kern.o", "kprobe/sys_connect")
-
-TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_entry")
-TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_exit")
-TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/irq/softirq_raise")
-TEST_SECTION("prototype-kernel", "napi_monitor_kern.o", "tracepoint/napi/napi_poll")
-TEST_SECTION("prototype-kernel", "tc_bench01_redirect_kern.o", "ingress_redirect")
-TEST_SECTION("prototype-kernel", "xdp_bench01_mem_access_cost_kern.o", "xdp_bench01")
-TEST_SECTION("prototype-kernel", "xdp_bench02_drop_pattern_kern.o", "xdp_bench02")
-TEST_SECTION("prototype-kernel", "xdp_ddos01_blacklist_kern.o", "xdp_prog")
-TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect")
-TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_err")
-TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
-TEST_SECTION("prototype-kernel", "xdp_monitor_kern.o", "tracepoint/xdp/xdp_redirect_map")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map0")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map2_round_robin")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_enqueue")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_cpumap_kthread")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_exception")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_err")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "tracepoint/xdp/xdp_redirect_map_err")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map1_touch_data")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map3_proto_separate")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map4_ddos_filter_pktgen")
-TEST_SECTION("prototype-kernel", "xdp_redirect_cpu_kern.o", "xdp_cpu_map5_ip_l3_flow_hash")
-TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_dummy")
-TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_map")
-TEST_SECTION("prototype-kernel", "xdp_redirect_err_kern.o", "xdp_redirect_map_rr")
-TEST_SECTION("prototype-kernel", "xdp_tcpdump_kern.o", "xdp_tcpdump_to_perf_ring")
-TEST_SECTION("prototype-kernel", "xdp_ttl_kern.o", "xdp_ttl")
-TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "tc_vlan_push")
-TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_drop_vlan_4011")
-TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_change")
-TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_remove_outer")
-TEST_SECTION("prototype-kernel", "xdp_vlan01_kern.o", "xdp_vlan_remove_outer2")
-
-TEST_SECTION("ovs", "datapath.o", "tail-0")
-TEST_SECTION("ovs", "datapath.o", "tail-1")
-TEST_SECTION("ovs", "datapath.o", "tail-2")
-TEST_SECTION("ovs", "datapath.o", "tail-3")
-TEST_SECTION("ovs", "datapath.o", "tail-4")
-TEST_SECTION("ovs", "datapath.o", "tail-5")
-TEST_SECTION("ovs", "datapath.o", "tail-7")
-TEST_SECTION("ovs", "datapath.o", "tail-8")
-TEST_SECTION("ovs", "datapath.o", "tail-11")
-TEST_SECTION("ovs", "datapath.o", "tail-12")
-TEST_SECTION("ovs", "datapath.o", "tail-13")
-TEST_SECTION("ovs", "datapath.o", "tail-32")
-TEST_SECTION("ovs", "datapath.o", "tail-33")
-TEST_SECTION("ovs", "datapath.o", "tail-35")
-TEST_SECTION("ovs", "datapath.o", "af_xdp")
-TEST_SECTION("ovs", "datapath.o", "downcall")
-TEST_SECTION("ovs", "datapath.o", "egress")
-TEST_SECTION("ovs", "datapath.o", "ingress")
-TEST_SECTION("ovs", "datapath.o", "xdp")
-
-TEST_SECTION("suricata", "bypass_filter.o", "filter")
-TEST_SECTION("suricata", "lb.o", "loadbalancer")
-TEST_SECTION("suricata", "filter.o", "filter")
-TEST_SECTION("suricata", "vlan_filter.o", "filter")
-TEST_SECTION("suricata", "xdp_filter.o", "xdp")
-
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_accept4_e")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_empty")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_pread64_e")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_preadv64_e")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_pwrite64_e")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_single_x")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/sys_sysdigevent_e")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/filler/terminate_filler")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/page_fault_kernel")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/page_fault_user")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/sched_switch")
-TEST_SECTION("falco", "probe.o", "raw_tracepoint/signal_deliver")
-
-// Test some programs that should pass verification except when the strict flag is set.
-TEST_SECTION_REJECT_IF_STRICT("build", "mapoverflow.o", ".text")
-TEST_SECTION_REJECT_IF_STRICT("build", "mapunderflow.o", ".text")
-
-/*
- * These programs contain "call -1" instruction and cannot be verified:
-TEST_SECTION("raw_tracepoint/filler/sys_access_e")
-TEST_SECTION("raw_tracepoint/filler/sys_bpf_x")
-TEST_SECTION("raw_tracepoint/filler/sys_brk_munmap_mmap_x")
-TEST_SECTION("raw_tracepoint/filler/sys_eventfd_e")
-TEST_SECTION("raw_tracepoint/filler/sys_execve_e")
-TEST_SECTION("raw_tracepoint/filler/sys_generic")
-TEST_SECTION("raw_tracepoint/filler/sys_getrlimit_setrlimit_e")
-TEST_SECTION("raw_tracepoint/filler/sys_getrlimit_setrlrimit_x")
-TEST_SECTION("raw_tracepoint/filler/sys_mount_e")
-TEST_SECTION("raw_tracepoint/filler/sys_nanosleep_e")
-TEST_SECTION("raw_tracepoint/filler/sys_pagefault_e")
-TEST_SECTION("raw_tracepoint/filler/sys_procexit_e")
-TEST_SECTION("raw_tracepoint/filler/sys_single")
-TEST_SECTION("raw_tracepoint/filler/sys_unshare_e")
-TEST_SECTION("raw_tracepoint/sched_process_exit")
-TEST_SECTION("raw_tracepoint/filler/sys_chmod_x")
-TEST_SECTION("raw_tracepoint/filler/sys_fchmod_x")
-TEST_SECTION("raw_tracepoint/filler/sys_fcntl_e")
-TEST_SECTION("raw_tracepoint/filler/sys_flock_e")
-TEST_SECTION("raw_tracepoint/filler/sys_poll_x")
-TEST_SECTION("raw_tracepoint/filler/sys_prlimit_e")
-TEST_SECTION("raw_tracepoint/filler/sys_prlimit_x")
-TEST_SECTION("raw_tracepoint/filler/sys_ptrace_e")
-TEST_SECTION("raw_tracepoint/filler/sys_quotactl_e")
-TEST_SECTION("raw_tracepoint/filler/sys_semop_x")
-TEST_SECTION("raw_tracepoint/filler/sys_send_e")
-TEST_SECTION("raw_tracepoint/filler/sys_sendfile_x")
-TEST_SECTION("raw_tracepoint/filler/sys_setns_e")
-TEST_SECTION("raw_tracepoint/filler/sys_shutdown_e")
-TEST_SECTION("raw_tracepoint/filler/sys_fchmodat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_futex_e")
-TEST_SECTION("raw_tracepoint/filler/sys_lseek_e")
-TEST_SECTION("raw_tracepoint/filler/sys_mkdirat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_poll_e")
-TEST_SECTION("raw_tracepoint/filler/sys_ptrace_x")
-TEST_SECTION("raw_tracepoint/filler/sys_quotactl_x")
-TEST_SECTION("raw_tracepoint/filler/sys_semget_e")
-TEST_SECTION("raw_tracepoint/filler/sys_signaldeliver_e")
-TEST_SECTION("raw_tracepoint/filler/sys_symlinkat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_unlinkat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_writev_e")
-TEST_SECTION("raw_tracepoint/filler/sys_llseek_e")
-TEST_SECTION("raw_tracepoint/filler/sys_ppoll_e")
-TEST_SECTION("raw_tracepoint/filler/sys_pwritev_e")
-TEST_SECTION("raw_tracepoint/filler/sys_renameat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_semctl_e")
-TEST_SECTION("raw_tracepoint/filler/sched_switch_e")
-TEST_SECTION("raw_tracepoint/filler/sys_getsockopt_x")
-TEST_SECTION("raw_tracepoint/filler/sys_linkat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_renameat2_x")
-TEST_SECTION("raw_tracepoint/filler/sys_sendfile_e")
-TEST_SECTION("raw_tracepoint/filler/sys_setsockopt_x")
-TEST_SECTION("raw_tracepoint/filler/sys_getresuid_and_gid_x")
-TEST_SECTION("raw_tracepoint/filler/sys_mmap_e")
-TEST_SECTION("raw_tracepoint/filler/sys_socket_bind_x")
-TEST_SECTION("raw_tracepoint/filler/sys_socket_x")
-TEST_SECTION("raw_tracepoint/sys_enter")
-TEST_SECTION("raw_tracepoint/sys_exit")
-TEST_SECTION("raw_tracepoint/filler/sys_pipe_x")
-TEST_SECTION("raw_tracepoint/filler/sys_socketpair_x")
-TEST_SECTION("raw_tracepoint/filler/sys_creat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_open_x")
-TEST_SECTION("raw_tracepoint/filler/sys_openat_x")
-TEST_SECTION("raw_tracepoint/filler/sys_autofill")
-TEST_SECTION("raw_tracepoint/filler/proc_startupdate")
-TEST_SECTION("raw_tracepoint/filler/sys_recvmsg_x_2")
-TEST_SECTION("raw_tracepoint/filler/sys_sendmsg_e")
-TEST_SECTION("raw_tracepoint/filler/sys_connect_x")
-TEST_SECTION("raw_tracepoint/filler/sys_sendto_e")
-TEST_SECTION("raw_tracepoint/filler/sys_accept_x")
-TEST_SECTION("raw_tracepoint/filler/sys_read_x")
-TEST_SECTION("raw_tracepoint/filler/sys_recv_x")
-TEST_SECTION("raw_tracepoint/filler/sys_recvmsg_x")
-TEST_SECTION("raw_tracepoint/filler/sys_send_x")
-TEST_SECTION("raw_tracepoint/filler/proc_startupdate_3")
-TEST_SECTION("raw_tracepoint/filler/sys_readv_preadv_x")
-TEST_SECTION("raw_tracepoint/filler/sys_write_x")
-TEST_SECTION("raw_tracepoint/filler/sys_writev_pwritev_x")
-TEST_SECTION("raw_tracepoint/filler/sys_sendmsg_x")
-TEST_SECTION("raw_tracepoint/filler/proc_startupdate_2")
-TEST_SECTION("raw_tracepoint/filler/sys_recvfrom_x")
-*/
-TEST_SECTION("build", "byteswap.o", ".text")
-TEST_SECTION("build", "stackok.o", ".text")
-TEST_SECTION("build", "packet_start_ok.o", "xdp")
-TEST_SECTION("build", "packet_access.o", "xdp")
-TEST_SECTION("build", "tail_call.o", "xdp_prog")
-TEST_SECTION("build", "map_in_map.o", ".text")
-TEST_SECTION("build", "map_in_map_legacy.o", ".text")
-TEST_SECTION("build", "twomaps.o", ".text");
-TEST_SECTION("build", "twostackvars.o", ".text");
-TEST_SECTION("build", "twotypes.o", ".text");
-
-// Test some programs that ought to fail verification.
-TEST_SECTION_REJECT("build", "badhelpercall.o", ".text")
-TEST_SECTION_REJECT("build", "ctxoffset.o", "sockops")
-TEST_SECTION_REJECT("build", "badmapptr.o", "test")
-TEST_SECTION_REJECT("build", "exposeptr.o", ".text")
-TEST_SECTION_REJECT("build", "exposeptr2.o", ".text")
-TEST_SECTION_REJECT("build", "mapvalue-overrun.o", ".text")
-TEST_SECTION_REJECT("build", "nullmapref.o", "test")
-TEST_SECTION_REJECT("build", "packet_overflow.o", "xdp")
-TEST_SECTION_REJECT("build", "packet_reallocate.o", "socket_filter")
-TEST_SECTION_REJECT("build", "tail_call_bad.o", "xdp_prog")
-TEST_SECTION_REJECT("build", "ringbuf_uninit.o", ".text");
-
-// The following eBPF programs currently fail verification.
-// If the verifier is later updated to accept them, these should
-// be changed to TEST_SECTION().
-
-// Unsupported: ebpf-function
-TEST_SECTION_FAIL("prototype-kernel", "xdp_ddos01_blacklist_kern.o", ".text")
-
-// Unsupported: implications are lost in correlated branches
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/7")
-
-// Failure: 166:168: Upper bound must be at most packet_size (valid_access(r4.offset, width=2) for read)
-// This is the result of merging two branches, one with value 0 and another with value -22,
-// then checking that the result is != 0. The minor issue is not handling the int32 comparison precisely enough.
-// The bigger issue is that the convexity of the numerical domain means that precise handling would still get
-// [-22, -1] which is not sufficient (at most -2 is needed)
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/10")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/21")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/24")
-
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/15")
-
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/17")
-
-// Failure: trying to access r4 where r4.packet_offset=[0, 255] and packet_size=[54, 65534]
-// Root cause: r5.value=[0, 65535] 209: w5 >>= 8; clears r5 instead of yielding [0, 255]
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/18")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/10")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/18")
-
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/19")
-
-// Failure: 230: Upper bound must be at most packet_size (valid_access(r3.offset+32, width=8) for write)
-// r3.packet_offset=[0, 82] and packet_size=[34, 65534]
-// looks like a combination of misunderstanding the value passed to xdp_adjust_tail()
-// which is "r7.value=[0, 82]; w7 -= r9;" where r9.value where "r7.value-r9.value<=48"
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/20")
-
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/7")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/15")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/17")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/19")
-
-// Failure (&255): assert r5.type == number; w5 &= 255;
-// fails since in one branch (77) r5 is a number but in another (92:93) it is a packet
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/24")
-// Failure (&255): assert r3.type == number; w3 &= 255;
-TEST_SECTION_FAIL("cilium", "bpf_xdp_dsr_linux.o", "2/16")
-TEST_SECTION_FAIL("cilium", "bpf_xdp_snat_linux.o", "2/16")
-
-// False positive, unknown cause
-TEST_SECTION_FAIL("linux", "test_map_in_map_kern.o", "kprobe/sys_connect")
-
-void test_analyze_thread(cfg_t* cfg, program_info* info, bool* res) {
-    *res = run_ebpf_analysis(std::cout, *cfg, *info, nullptr, nullptr);
-}
-
-// Test multithreading
-TEST_CASE("multithreading", "[verify][multithreading]") {
-    auto raw_progs1 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/1", nullptr, &g_ebpf_platform_linux);
-    REQUIRE(raw_progs1.size() == 1);
-    raw_program raw_prog1 = raw_progs1.back();
-    std::variant<InstructionSeq, std::string> prog_or_error1 = unmarshal(raw_prog1);
-    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error1));
-    auto& prog1 = std::get<InstructionSeq>(prog_or_error1);
-    cfg_t cfg1 = prepare_cfg(prog1, raw_prog1.info, true);
-
-    auto raw_progs2 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/2", nullptr, &g_ebpf_platform_linux);
-    REQUIRE(raw_progs2.size() == 1);
-    raw_program raw_prog2 = raw_progs2.back();
-    std::variant<InstructionSeq, std::string> prog_or_error2 = unmarshal(raw_prog2);
-    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error2));
-    auto& prog2 = std::get<InstructionSeq>(prog_or_error2);
-    cfg_t cfg2 = prepare_cfg(prog2, raw_prog2.info, true);
-
-    bool res1, res2;
-    std::thread a(test_analyze_thread, &cfg1, &raw_prog1.info, &res1);
-    std::thread b(test_analyze_thread, &cfg2, &raw_prog2.info, &res2);
-    a.join();
-    b.join();
-
-    REQUIRE(res1);
-    REQUIRE(res2);
-}

From e389226c88fd055bb666ff19dd377f7b7a1413b1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 13 Nov 2023 21:00:05 -0500
Subject: [PATCH 141/373] Refactoring and simplifying printing functionality

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.cpp       | 63 +++++++++++++++++++++++----------
 src/crab/common.hpp       |  2 ++
 src/crab/type_domain.cpp  | 22 +++++++-----
 src/crab/type_ostream.cpp | 74 +++++++++++++++++++++++++++++----------
 src/crab/type_ostream.hpp | 29 ++++++++++-----
 5 files changed, 136 insertions(+), 54 deletions(-)

diff --git a/src/crab/common.cpp b/src/crab/common.cpp
index 3db09febd..443690a59 100644
--- a/src/crab/common.cpp
+++ b/src/crab/common.cpp
@@ -19,6 +19,20 @@ namespace std {
 
 namespace crab {
 
+inline std::string get_reg_ptr(const region_t& r) noexcept {
+    switch (r) {
+        case region_t::T_CTX:
+            return "ctx_p";
+        case region_t::T_STACK:
+            return "stack_p";
+        case region_t::T_SHARED:
+            return "shared_p";
+        default:
+            return "packet_p";
+    }
+    __builtin_unreachable();
+}
+
 bool mock_interval_t::operator==(const mock_interval_t& other) const {
     return (to_interval() == other.to_interval());
 }
@@ -79,10 +93,17 @@ bool mapfd_t::has_type_map_programs() const {
 
 void mapfd_t::write(std::ostream& o) const {
     if (has_type_map_programs()) {
-        o << "map_fd_programs";
+        o << "map_fd_programs ";
+    }
+    else {
+        o << "map_fd ";
+    }
+    auto mapfd = m_mapfd.to_interval();
+    if (auto mapfd_singleton = mapfd.singleton()) {
+        o << *mapfd_singleton;
     }
     else {
-        o << "map_fd";
+        o << mapfd;
     }
 }
 
@@ -111,23 +132,29 @@ std::size_t reg_with_loc_t::hash() const {
     return seed;
 }
 
-inline std::string get_reg_ptr(const region_t& r) {
-    switch (r) {
-        case region_t::T_CTX:
-            return "ctx_p";
-        case region_t::T_STACK:
-            return "stack_p";
-        case region_t::T_SHARED:
-            return "shared_p";
-        default:
-            return "packet_p";
-    }
-}
-
 void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r) << "<" << m_offset.to_interval();
-    if (m_region_size.lb() >= number_t{0}) o << "," << m_region_size.to_interval();
-    o << ">";
+    o << get_reg_ptr(m_r);
+    auto offset = m_offset.to_interval();
+    auto region_size = m_region_size.to_interval();
+    if (!offset.is_top()) {
+        o << "<";
+        if (auto off_singleton = offset.singleton()) {
+            o << *off_singleton;
+        }
+        else {
+            o << offset;
+        }
+        if (region_size.lb() >= number_t{0}) {
+            o << ",";
+            if (auto rs_singleton = region_size.singleton()) {
+                o << *rs_singleton;
+            }
+            else {
+                o << region_size;
+            }
+        }
+        o << ">";
+    }
 }
 
 std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 082ecffa9..0208bcb2e 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -28,6 +28,8 @@ enum class region_t {
 	T_SHARED
 };
 
+inline std::string get_reg_ptr(const region_t& r) noexcept;
+
 enum class nullness_t { MAYBE_NULL, NOT_NULL, _NULL };
 
 class packet_ptr_t {
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 1d8a14364..1cf1f3068 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -533,8 +533,8 @@ void type_domain_t::print_ctx() const {
         auto ptr = m_region.find_in_ctx(k);
         auto dist = m_offset.find_in_ctx(k);
         if (ptr) {
-            std::cout << "\t\t" << k << ": ";
-            print_ptr_type(std::cout, *ptr, dist);
+            std::cout << "\t\t";
+            print_non_numeric_memory_cell(std::cout, k, k+3, *ptr, dist);
             std::cout << ",\n";
         }
     }
@@ -552,11 +552,14 @@ void type_domain_t::print_stack() const {
             auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
-            std::cout << "\t\t[" << k << "-" << k+width-1 << "] : ";
-            if (dist) 
-                print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, dist->first);
-            else 
-                print_ptr_or_mapfd_type(std::cout, ptr_or_mapfd, std::nullopt);
+            std::cout << "\t\t";
+            if (dist) {
+                print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd,
+                        std::optional<dist_t>(dist->first));
+            }
+            else {
+                print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd);
+            }
             std::cout << ",\n";
         }
     }
@@ -564,8 +567,9 @@ void type_domain_t::print_stack() const {
         auto maybe_interval_cells = m_interval.find_in_stack(k);
         if (maybe_interval_cells) {
             auto interval_cells = maybe_interval_cells.value();
-            std::cout << "\t\t" << "[" << k << "-" << k+interval_cells.second-1 << "] : ";
-            print_number(std::cout, interval_cells.first.to_interval());
+            std::cout << "\t\t";
+            print_numeric_memory_cell(std::cout, k, k+interval_cells.second-1,
+                    interval_cells.first.to_interval());
             std::cout << ",\n";
         }
     }
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 88f1fba50..b1b7a99e1 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -3,46 +3,84 @@
 
 #include "crab/type_ostream.hpp"
 
-void print_ptr_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t> d) {
+void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
+        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
-        o << std::get<crab::ptr_with_off_t>(ptr);
+        o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
-        o << std::get<crab::packet_ptr_t>(ptr) << "<" << (d ? *d : crab::dist_t{}) << ">";
+        if (d) {
+            o << "[" << start << "-" << end << "] : " <<
+                std::get<crab::packet_ptr_t>(ptr) << "<" << *d << ">";
+        }
+        else {
+            o << "[" << start << "-" << end << "] : " << std::get<crab::packet_ptr_t>(ptr);
+        }
+    }
+    else {
+        o << "[" << start << "-" << end << "] : " << std::get<crab::mapfd_t>(ptr);
     }
 }
 
-void print_number(std::ostream& o, crab::interval_t n) {
-    o << "number";
-    if (!n.is_top()) {
+void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::interval_t n) {
+    if (n.is_top()) {
+        o << "[" << start << "-" << end << "] : number";
+    }
+    else {
         if (auto n_singleton = n.singleton()) {
-            o << "<" << *n_singleton << ">";
+            o << "[" << start << "-" << end << "] : number<" << *n_singleton << ">";
         }
         else {
-            o << "<" << n << ">";
+            o << "[" << start << "-" << end << "] : number<" << n << ">";
         }
     }
 }
 
-void print_ptr_or_mapfd_type(std::ostream& o, const crab::ptr_or_mapfd_t& ptr_or_mapfd, std::optional<crab::dist_t> d) {
-    if (std::holds_alternative<crab::mapfd_t>(ptr_or_mapfd)) {
-        o << std::get<crab::mapfd_t>(ptr_or_mapfd);
+void print_memory_cell(std::ostream& o, int start, int end,
+        const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d,
+        std::optional<crab::mock_interval_t> n) {
+    if (n) print_numeric_memory_cell(o, start, end, n->to_interval());
+    else if (p) print_non_numeric_memory_cell(o, start, end, *p, d);
+}
+
+void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd_t& ptr,
+        std::optional<crab::dist_t> d) {
+    if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
+        o << r << " : " << std::get<crab::ptr_with_off_t>(ptr);
+    }
+    else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
+        if (d) {
+            o << r << " : " << std::get<crab::packet_ptr_t>(ptr) << "<" << *d << ">";
+        }
+        else {
+            o << r << " : " << std::get<crab::packet_ptr_t>(ptr);
+        }
     }
     else {
-        print_ptr_type(o, ptr_or_mapfd, d);
+        o << r << " : " << std::get<crab::mapfd_t>(ptr);
     }
 }
 
-void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d, std::optional<crab::mock_interval_t> n) {
-    o << r << " : ";
-    if (p) {
-        print_ptr_or_mapfd_type(o, *p, d);
+void print_numeric_register(std::ostream& o, Reg r, crab::interval_t n) {
+    if (n.is_top()) {
+        o << r << " : number";
     }
-    else if (n) {
-        print_number(o, n->to_interval());
+    else {
+        if (auto n_singleton = n.singleton()) {
+            o << r << " : number<" << *n_singleton << ">";
+        }
+        else {
+            o << r << " : number<" << n << ">";
+        }
     }
 }
 
+void print_register(std::ostream& o, Reg r, const std::optional<crab::ptr_or_mapfd_t>& p,
+        std::optional<crab::dist_t> d, std::optional<crab::mock_interval_t> n) {
+    if (n) print_numeric_register(o, r, n->to_interval());
+    else if (p) print_non_numeric_register(o, r, *p, d);
+}
+
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p,
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index fa258e585..a1f34d709 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -9,12 +9,23 @@
 #include "crab/common.hpp"
 #include "crab/offset_domain.hpp"
 
-void print_ptr_or_mapfd_type(std::ostream&, const crab::ptr_or_mapfd_t&, std::optional<crab::dist_t>);
-void print_number(std::ostream&, crab::interval_t);
-void print_ptr_type(std::ostream&, const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t>);
-void print_register(std::ostream& o, const Reg& r, const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::mock_interval_t>&);
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
-void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p);
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
-void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>&);
+void print_numeric_register(std::ostream&, Reg, crab::interval_t);
+void print_numeric_memory_cell(std::ostream&, int, int, crab::interval_t);
+void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
+        std::optional<crab::dist_t> = std::nullopt);
+void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
+        std::optional<crab::dist_t> = std::nullopt);
+void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
+        std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
+void print_memory_cell(std::ostream&, int, int, const std::optional<crab::ptr_or_mapfd_t>&,
+        std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
+
+// Print select transformers
+void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
+        std::optional<crab::mock_interval_t>&);
+void print_annotated(std::ostream&, const Bin&, std::optional<crab::ptr_or_mapfd_t>&,
+        std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
+void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or_mapfd_t>&);
+void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
+        std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
+void print_annotated(std::ostream&, const Un&, std::optional<crab::mock_interval_t>&);

From 6f14855db888d8afec438f43f7443b57474d069d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 13 Nov 2023 22:39:40 -0500
Subject: [PATCH 142/373] Making setup_entry method parametric

Making setup_entry method in type domain, and region domain parametric,
to allow initialization of r1 as ctx ptr based on the scenario;
Some changes also made to crab_verifier, which defines those cases;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 8 +++++---
 src/crab/region_domain.hpp | 2 +-
 src/crab/type_domain.cpp   | 4 ++--
 src/crab/type_domain.hpp   | 2 +-
 src/crab_verifier.cpp      | 2 +-
 5 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 32a88f38f..d36bc50e1 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -814,7 +814,7 @@ void region_domain_t::operator()(const ValidStore& u, location_t loc) {
     // nothing to do here
 }
 
-region_domain_t&& region_domain_t::setup_entry() {
+region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
 
     std::shared_ptr<ctx_t> ctx
         = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
@@ -822,9 +822,11 @@ region_domain_t&& region_domain_t::setup_entry() {
     register_types_t typ(std::make_shared<global_region_env_t>());
 
     auto loc = std::make_pair(label_t::entry, (unsigned int)0);
-    auto ctx_ptr_r1 = ptr_with_off_t(region_t::T_CTX, -1, mock_interval_t{number_t{0}});
+    if (init_r1) {
+        auto ctx_ptr_r1 = ptr_with_off_t(region_t::T_CTX, -1, mock_interval_t{number_t{0}});
+        typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
+    }
     auto stack_ptr_r10 = ptr_with_off_t(region_t::T_STACK, -1,  mock_interval_t{number_t{512}});
-    typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
     static region_domain_t inv(std::move(typ), stack_t::top(), ctx);
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index b78ad8c8a..2f5b369c2 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -111,7 +111,7 @@ class region_domain_t final {
             : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx),
             m_shared_ptr_aliases(std::move(_shared_ptr_aliases)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static region_domain_t&& setup_entry();
+    static region_domain_t&& setup_entry(bool);
     // bottom/top
     static region_domain_t bottom();
     void set_to_top();
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 1cf1f3068..7b061ebb9 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -428,8 +428,8 @@ void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     m_region(u, loc);
 }
 
-type_domain_t type_domain_t::setup_entry() {
-    auto&& reg = crab::region_domain_t::setup_entry();
+type_domain_t type_domain_t::setup_entry(bool init_r1) {
+    auto&& reg = crab::region_domain_t::setup_entry(init_r1);
     auto&& off = offset_domain_t::setup_entry();
     auto&& interval = interval_prop_domain_t::setup_entry();
     type_domain_t typ(std::move(reg), std::move(off), std::move(interval));
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 482c3054c..61e6152e4 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -29,7 +29,7 @@ class type_domain_t final {
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static type_domain_t setup_entry();
+    static type_domain_t setup_entry(bool);
     // bottom/top
     static type_domain_t bottom();
     void set_to_top();
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 4c5d904f6..5b6297867 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -159,7 +159,7 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
         return abstract_domain_t(entry_inv);
     }
     case abstract_domain_kind::TYPE_DOMAIN: {
-        type_domain_t entry_inv = type_domain_t::setup_entry();
+        type_domain_t entry_inv = type_domain_t::setup_entry(true);
         return abstract_domain_t(entry_inv);
     }
     default:

From 0cc1fe5b0a3299aa8e8ccf2c04ec841b12ce48d6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 13 Nov 2023 23:10:13 -0500
Subject: [PATCH 143/373] Added implementation to support string_invariants

string_invariants are required to run the test cases in the prevail
framework, hence such support is added for type domain;
This includes support for creating the string invariant, and converting
it back to actual types;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp |   9 ++
 src/crab/interval_prop_domain.hpp |   2 +
 src/crab/offset_domain.cpp        |   8 +
 src/crab/offset_domain.hpp        |   2 +
 src/crab/region_domain.cpp        |   9 ++
 src/crab/region_domain.hpp        |   2 +
 src/crab/type_domain.cpp          | 251 +++++++++++++++++++++++++++++-
 src/crab/type_domain.hpp          |  11 +-
 8 files changed, 290 insertions(+), 4 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index d9dc30ef1..339ad6b1f 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -277,6 +277,15 @@ std::optional<mock_interval_t> interval_prop_domain_t::find_interval_at_loc(
     return m_registers_interval_values.find(reg);
 }
 
+void interval_prop_domain_t::insert_in_registers(register_t reg, location_t loc,
+        interval_t interval) {
+    m_registers_interval_values.insert(reg, loc, interval);
+}
+
+void interval_prop_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
+    m_stack_slots_interval_values.store(key, interval, width);
+}
+
 bool interval_prop_domain_t::operator<=(const interval_prop_domain_t& abs) const {
     /* WARNING: The operation is not implemented yet.*/
     return true;
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/interval_prop_domain.hpp
index 0ac2467df..64003cb96 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/interval_prop_domain.hpp
@@ -168,6 +168,8 @@ class interval_prop_domain_t final {
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
+    void insert_in_registers(register_t, location_t, interval_t);
+    void store_in_stack(uint64_t, mock_interval_t, int);
     void adjust_bb_for_types(location_t);
     std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index bc7962700..da7b6aa8d 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -969,6 +969,14 @@ std::optional<dist_t> offset_domain_t::find_offset_info(register_t reg) const {
     return m_reg_state.find(reg);
 }
 
+void offset_domain_t::insert_in_registers(register_t reg, location_t loc, dist_t dist) {
+    m_reg_state.insert(reg, loc, std::move(dist));
+}
+
+void offset_domain_t::store_in_stack(uint64_t key, dist_t d, int width) {
+    m_stack_state.store(key, d, width);
+}
+
 void offset_domain_t::adjust_bb_for_types(location_t loc) {
     m_reg_state.adjust_bb_for_registers(loc);
 }
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 2754defb6..f5754b5aa 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -289,6 +289,8 @@ class offset_domain_t final {
     void update_offset_info(const dist_t&&, const interval_t&&, const location_t&,
             uint8_t, Bin::Op);
     dist_t update_offset(const dist_t&, const weight_t&, const interval_t&, Bin::Op);
+    void insert_in_registers(register_t, location_t, dist_t);
+    void store_in_stack(uint64_t, dist_t, int);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index d36bc50e1..c2f742026 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -316,6 +316,15 @@ std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_type(register_t
     return m_registers.find(reg);
 }
 
+void region_domain_t::insert_in_registers(register_t reg, location_t loc,
+        const ptr_or_mapfd_t& ptr) {
+    m_registers.insert(reg, loc, ptr);
+}
+
+void region_domain_t::store_in_stack(uint64_t key, ptr_or_mapfd_t value, int width) {
+    m_stack.store(key, value, width);
+}
+
 bool region_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
     return (m_stack.is_bottom() || m_registers.is_bottom());
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 2f5b369c2..a6e3f681a 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -191,6 +191,8 @@ class region_domain_t final {
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
+    void insert_in_registers(register_t, location_t, const ptr_or_mapfd_t&);
+    void store_in_stack(uint64_t, ptr_or_mapfd_t, int);
     void set_aliases(int, ptr_with_off_t&);
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     void set_registers_to_top();
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7b061ebb9..decc43a64 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 #include "crab/type_domain.hpp"
+#include <regex>
 
 namespace crab {
 
@@ -95,8 +96,53 @@ crab::bound_t type_domain_t::get_loop_count_upper_bound() {
     return crab::bound_t{crab::number_t{0}};
 }
 
-string_invariant type_domain_t::to_set() {
-    return string_invariant{};
+string_invariant type_domain_t::to_set() const {
+    if (is_top()) return string_invariant::top();
+    std::set<std::string> result;
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        std::stringstream elem;
+        auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
+        auto maybe_width_interval = m_interval.find_interval_value(register_t{i});
+        auto maybe_offset = m_offset.find_offset_info(register_t{i});
+        if (maybe_ptr_or_mapfd.has_value() || maybe_width_interval.has_value()) {
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_offset, maybe_width_interval);
+            result.insert(elem.str());
+        }
+    }
+    std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
+    for (auto const& k : stack_keys_region) {
+        std::stringstream elem;
+        auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
+        auto dist = m_offset.find_in_stack(k);
+        if (maybe_ptr_or_mapfd_cells.has_value()) {
+            auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
+            int width = ptr_or_mapfd_cells.second;
+            auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
+            elem << "stack";
+            if (dist) {
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd,
+                        std::optional<dist_t>(dist->first));
+            }
+            else {
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd);
+            }
+        }
+        result.insert(elem.str());
+    }
+
+    std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
+    for (auto const& k : stack_keys_interval) {
+        std::stringstream elem;
+        auto maybe_interval_cells = m_interval.find_in_stack(k);
+        if (maybe_interval_cells.has_value()) {
+            auto interval_cells = maybe_interval_cells.value();
+            elem << "stack";
+            print_numeric_memory_cell(elem, k, k+interval_cells.second-1,
+                    interval_cells.first.to_interval());
+        }
+        result.insert(elem.str());
+    }
+    return string_invariant{result};
 }
 
 void type_domain_t::operator()(const Undefined& u, location_t loc) {
@@ -626,6 +672,207 @@ type_domain_t::find_interval_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_interval.find_interval_at_loc(loc);
 }
 
+static inline region_t string_to_region(const std::string& s) {
+    static std::map<std::string, region_t> string_to_region{
+        {std::string("ctx"), region_t::T_CTX},
+        {std::string("stack"), region_t::T_STACK},
+        {std::string("packet"), region_t::T_PACKET},
+        {std::string("shared"), region_t::T_SHARED},
+    };
+    if (string_to_region.count(s)) {
+        return string_to_region[s];
+    }
+    throw std::runtime_error(std::string("Unsupported region name: ") + s);
+}
+
+void type_domain_t::insert_in_registers_in_interval_domain(register_t r, location_t loc,
+        interval_t interval) {
+    m_interval.insert_in_registers(r, loc, interval);
+}
+
+void type_domain_t::store_in_stack_in_interval_domain(uint64_t key, mock_interval_t p, int width) {
+    m_interval.store_in_stack(key, p, width);
+}
+
+void type_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc, dist_t d) {
+    m_offset.insert_in_registers(r, loc, d);
+}
+
+void type_domain_t::store_in_stack_in_offset_domain(uint64_t key, dist_t d, int width) {
+    m_offset.store_in_stack(key, d, width);
+}
+
+void type_domain_t::insert_in_registers_in_region_domain(register_t r, location_t loc,
+        const ptr_or_mapfd_t& p) {
+    m_region.insert_in_registers(r, loc, p);
+}
+
+void type_domain_t::store_in_stack_in_region_domain(uint64_t key, ptr_or_mapfd_t p, int width) {
+    m_region.store_in_stack(key, p, width);
+}
+
+type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>& types,
+        bool setup_constraints) {
+    using std::regex;
+    using std::regex_match;
+
+    #define NUMERIC R"_(\s*\[?([-+]?(?:\d+|oo))(?:,\s*([-+]?(?:\d+|oo))\])?\s*)_"
+    #define NUMERIC_ENCLOSED "<" NUMERIC ">"
+    #define NUMERIC_NUMERIC_ENCLOSED "<" NUMERIC ",\\s*" NUMERIC ">"
+    #define REG R"_(\s*r(\d\d?)\s*)_"
+    #define STACK_CELL R"_(\s*stack\[(\d+)-(\d+)\]\s*)_"
+    #define SHARED_PTR "\\s*shared_p(?:" NUMERIC_NUMERIC_ENCLOSED ")?\\s*"
+    #define CTX_OR_STACK_PTR "\\s*(ctx|stack)_p(?:" NUMERIC_ENCLOSED ")?\\s*"
+    #define PACKET_PTR "\\s*packet_p(?:<(begin|end|meta)\\+" NUMERIC ">)?\\s*"
+    #define NUMBER "\\s*number(?:" NUMERIC_ENCLOSED ")?\\s*"
+    #define MAPFD "\\s*(map_fd|map_fd_programs)" NUMERIC "\\s*"
+
+    auto create_interval = [](std::string lb, std::string ub) {
+        if (lb == "" && ub == "") {
+            return crab::mock_interval_t::top();
+        }
+        bound_t lb_num = bound_t::minus_infinity();
+        if (lb != "-oo") {
+            try {
+                lb_num = bound_t{number_t{static_cast<int64_t>(std::stoll(lb))}};
+            } catch (std::out_of_range& e) {
+                // TODO: Separate handling for such cases
+                lb_num = bound_t{number_t{static_cast<uint64_t>(std::stoull(lb))}};
+            }
+        }
+        auto ub_num = lb_num;
+        if (ub != "" && ub != "+oo") {
+            try {
+                ub_num = bound_t{number_t{static_cast<int64_t>(std::stoll(ub))}};
+            }
+            catch (std::out_of_range& e) {
+                // TODO: Separate handling for such cases
+                ub_num = bound_t{number_t{static_cast<uint64_t>(std::stoull(ub))}};
+            }
+        }
+        else if (ub == "+oo") ub_num = bound_t::plus_infinity();
+        return crab::mock_interval_t{lb_num, ub_num};
+    };
+
+    auto create_ptr = [create_interval](std::string region, std::string off_lb,
+            std::string off_ub, std::string region_sz_lb = "", std::string region_sz_ub = "") {
+        auto region_type = string_to_region(region);
+        auto mock_offset = create_interval(off_lb, off_ub);
+        auto mock_region_size = create_interval(region_sz_lb, region_sz_ub);
+        return crab::ptr_with_off_t{region_type, -1, mock_offset, nullness_t::MAYBE_NULL,
+            mock_region_size};
+    };
+
+    auto create_mapfd = [create_interval](std::string mapfd_type, std::string lb_mapfd,
+            std::string ub_mapfd) {
+        auto interval = create_interval(lb_mapfd, ub_mapfd);
+        if (mapfd_type == "map_fd_programs") {
+            return crab::mapfd_t(interval, EbpfMapValueType::PROGRAM);
+        }
+        else {
+            return crab::mapfd_t(interval, EbpfMapValueType::MAP);
+        }
+    };
+
+    auto create_pkt_offset = [create_interval](std::string offset_type, std::string offset_lb,
+            std::string offset_ub) {
+        auto offset = create_interval(offset_lb, offset_ub).to_interval();
+        if (offset_type == "begin") {
+            return dist_t{offset};
+        }
+        else if (offset_type == "end") {
+            auto packet_end = crab::interval_t{number_t{PACKET_END}};
+            return dist_t{packet_end - offset};
+        }
+        else {
+            auto packet_meta = crab::interval_t{number_t{PACKET_META}};
+            return dist_t{packet_meta - offset};
+        }
+    };
+
+    type_domain_t typ;
+    if (setup_constraints) {
+        typ = type_domain_t::setup_entry(false);
+    }
+    auto loc = location_t{std::make_pair(label_t::entry, 0)};
+    for (const auto& t : types) {
+        std::cout << t << "\n";
+        std::smatch m;
+        if (regex_match(t, m, regex(REG ":" CTX_OR_STACK_PTR))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto ptr = create_ptr(m[2], m[3], m[4]);
+            typ.insert_in_registers_in_region_domain(reg, loc, ptr);
+        }
+        else if (regex_match(t, m, regex(REG ":" PACKET_PTR))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto ptr = packet_ptr_t{};
+            auto offset = create_pkt_offset(m[2], m[3], m[4]);
+            typ.insert_in_registers_in_region_domain(reg, loc, ptr);
+            typ.insert_in_registers_in_offset_domain(reg, loc, offset);
+        }
+        else if (regex_match(t, m, regex(REG ":" SHARED_PTR))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto ptr = create_ptr("shared", m[2], m[3], m[4], m[5]);
+            typ.insert_in_registers_in_region_domain(reg, loc, ptr);
+        }
+        else if (regex_match(t, m, regex(REG ":" NUMBER))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto num = create_interval(m[2], m[3]).to_interval();
+            typ.insert_in_registers_in_interval_domain(reg, loc, num);
+        }
+        else if (regex_match(t, m, regex(REG ":" MAPFD))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto mapfd = create_mapfd(m[2], m[3], m[4]);
+            typ.insert_in_registers_in_region_domain(reg, loc, mapfd);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" CTX_OR_STACK_PTR))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = static_cast<uint64_t>(std::stoul(m[2]));
+            auto ptr = create_ptr(m[3], m[4], m[5]);
+            typ.store_in_stack_in_region_domain(stack_cell_start, ptr,
+                    stack_cell_end-stack_cell_start);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" PACKET_PTR))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = std::stoi(m[2]);
+            auto ptr = packet_ptr_t{};
+            auto pkt_offset = create_pkt_offset(m[3], m[4], m[5]);
+            int width = stack_cell_end - stack_cell_start;
+            typ.store_in_stack_in_region_domain(stack_cell_start, ptr, width);
+            typ.store_in_stack_in_offset_domain(stack_cell_start, pkt_offset, width);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" SHARED_PTR))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = std::stoi(m[2]);
+            auto ptr = create_ptr("shared", m[3], m[4], m[5], m[6]);
+            typ.store_in_stack_in_region_domain(stack_cell_start, ptr,
+                    stack_cell_end-stack_cell_start);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" NUMBER))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = std::stoi(m[2]);
+            auto num = create_interval(m[3], m[4]);
+            typ.store_in_stack_in_interval_domain(stack_cell_start, num,
+                    stack_cell_end-stack_cell_start);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" MAPFD))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = std::stoi(m[2]);
+            auto mapfd = create_mapfd(m[3], m[4], m[5]);
+            typ.store_in_stack_in_region_domain(stack_cell_start, mapfd,
+                    stack_cell_end-stack_cell_start);
+        }
+        else {
+            std::cout << "type not recognized: " << t << "\n";
+        }
+    }
+    return typ;
+}
+
+void type_domain_t::write(std::ostream& os) const {
+    os << to_set();
+}
+
 std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
     typ.write(o);
     return o;
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 61e6152e4..af0ab4e2f 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -78,11 +78,11 @@ class type_domain_t final {
     void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
-    void write(std::ostream& os) const {}
+    void write(std::ostream& os) const;
     friend std::ostream& operator<<(std::ostream& o, const type_domain_t& dom);
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound();
-    string_invariant to_set();
+    string_invariant to_set() const;
     void set_require_check(check_require_func_t f) {}
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void print_ctx() const;
@@ -90,6 +90,13 @@ class type_domain_t final {
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::dist_t> find_offset_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_interval_at_loc(const crab::reg_with_loc_t&) const;
+    static type_domain_t from_predefined_types(const std::set<std::string>&, bool);
+    void insert_in_registers_in_region_domain(register_t, location_t, const ptr_or_mapfd_t&);
+    void store_in_stack_in_region_domain(uint64_t, ptr_or_mapfd_t, int);
+    void insert_in_registers_in_interval_domain(register_t, location_t, interval_t);
+    void store_in_stack_in_interval_domain(uint64_t, mock_interval_t, int);
+    void insert_in_registers_in_offset_domain(register_t, location_t, dist_t);
+    void store_in_stack_in_offset_domain(uint64_t, dist_t, int);
 
   private:
 

From a9a26b9698e8303bb8e06d028d43e0b1a9636ccd Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 27 Nov 2023 12:13:11 -0500
Subject: [PATCH 144/373] Added support for running tests for type domain

Support for running tests for both ebpf domain and type domain inside
the single framework;
Some refactoring in crab_verifier;
Some fixes added in each sub-domain for the tests;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_prop_domain.cpp |  1 +
 src/crab/offset_domain.cpp        |  1 +
 src/crab/region_domain.cpp        |  1 +
 src/crab/type_domain.cpp          |  4 ++-
 src/crab_verifier.cpp             | 18 ++++++-------
 src/crab_verifier.hpp             |  3 ++-
 src/ebpf_yaml.cpp                 |  9 ++++---
 src/ebpf_yaml.hpp                 |  3 ++-
 src/main/run_yaml.cpp             |  5 +++-
 src/test/test_yaml.cpp            | 44 +++++++++++++++----------------
 10 files changed, 51 insertions(+), 38 deletions(-)

diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
index 339ad6b1f..67c9a4d59 100644
--- a/src/crab/interval_prop_domain.cpp
+++ b/src/crab/interval_prop_domain.cpp
@@ -20,6 +20,7 @@ bool registers_cp_state_t::is_top() const {
 }
 
 void registers_cp_state_t::set_to_top() {
+    m_interval_env = std::make_shared<global_interval_env_t>();
     m_cur_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index da7b6aa8d..eabe3b537 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -164,6 +164,7 @@ std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int
 }
 
 void registers_state_t::set_to_top() {
+    m_offset_env = std::make_shared<global_offset_env_t>();
     m_cur_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index c2f742026..5fe19a038 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -151,6 +151,7 @@ void register_types_t::set_to_bottom() {
 }
 
 void register_types_t::set_to_top() {
+    m_region_env = std::make_shared<global_region_env_t>();
     m_cur_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index decc43a64..9f31c9adb 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -794,9 +794,11 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
     if (setup_constraints) {
         typ = type_domain_t::setup_entry(false);
     }
+    else {
+        typ.set_to_top();
+    }
     auto loc = location_t{std::make_pair(label_t::entry, 0)};
     for (const auto& t : types) {
-        std::cout << t << "\n";
         std::smatch m;
         if (regex_match(t, m, regex(REG ":" CTX_OR_STACK_PTR))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 5b6297867..4d1cf0038 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -15,9 +15,6 @@
 #include "crab/abstract_domain.hpp"
 #include "crab/ebpf_domain.hpp"
 #include "crab/type_domain.hpp"
-#include "crab/interval_prop_domain.hpp"
-#include "crab/region_domain.hpp"
-#include "crab/offset_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 
@@ -180,7 +177,10 @@ static abstract_domain_t make_initial(abstract_domain_kind abstract_domain, cons
         return abstract_domain_t(entry_inv);
     }
     case abstract_domain_kind::TYPE_DOMAIN: {
-        // TODO
+        type_domain_t entry_inv = entry_invariant.is_bottom()
+                                      ? type_domain_t::from_predefined_types({"false"}, setup_constraints)
+                                      : type_domain_t::from_predefined_types(entry_invariant.value(), setup_constraints);
+        return abstract_domain_t(entry_inv);
     }
     default:
         // FIXME: supported abstract domains should be checked in check.cpp
@@ -238,17 +238,17 @@ static string_invariant_map to_string_invariant_map(crab::invariant_table_t& inv
     return res;
 }
 
-std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog,
-                                                                 const string_invariant& entry_invariant,
-                                                                 const program_info& info,
-                                                                 const ebpf_verifier_options_t& options) {
+std::tuple<string_invariant, bool>
+ebpf_analyze_program_for_test(abstract_domain_kind domain, std::ostream& os, const InstructionSeq& prog,
+                              const string_invariant& entry_invariant, const program_info& info,
+                              const ebpf_verifier_options_t& options) {
     crab::domains::clear_global_state();
     crab::variable_t::clear_thread_local_state();
 
     thread_local_options = options;
     global_program_info = info;
     assert(!entry_invariant.is_bottom());
-    abstract_domain_t entry_inv = make_initial(abstract_domain_kind::EBPF_DOMAIN, entry_invariant, options.setup_constraints);
+    abstract_domain_t entry_inv = make_initial(domain, entry_invariant, options.setup_constraints);
     if (entry_inv.is_bottom())
         throw std::runtime_error("Entry invariant is inconsistent");
     cfg_t cfg = prepare_cfg(prog, info, !options.no_simplify, false);
diff --git a/src/crab_verifier.hpp b/src/crab_verifier.hpp
index 1e64f8e79..3e34bd794 100644
--- a/src/crab_verifier.hpp
+++ b/src/crab_verifier.hpp
@@ -72,7 +72,8 @@ crab_results ebpf_verify_program(
 
 using string_invariant_map = std::map<crab::label_t, string_invariant>;
 
-std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog,
+std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(abstract_domain_kind domain,
+                                                                 std::ostream& os, const InstructionSeq& prog,
                                                                  const string_invariant& entry_invariant,
                                                                  const program_info& info,
                                                                  const ebpf_verifier_options_t& options);
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index dee8d9e3b..9150721b5 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -232,7 +232,8 @@ static Diff<T> make_diff(const T& actual, const T& expected) {
     };
 }
 
-std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
+std::optional<Failure> run_yaml_test_case(abstract_domain_kind domain, TestCase test_case,
+        bool debug) {
     if (debug) {
         test_case.options.print_failures = true;
         test_case.options.print_invariants = true;
@@ -246,6 +247,7 @@ std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
 
     std::ostringstream ss;
     const auto& [actual_last_invariant, result] = ebpf_analyze_program_for_test(
+        domain,
         ss, test_case.instruction_seq,
         test_case.assumed_pre_invariant,
         info, test_case.options);
@@ -351,7 +353,8 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
     try {
         std::ostringstream null_stream;
         const auto& [actual_last_invariant, result] =
-            ebpf_analyze_program_for_test(null_stream, prog, pre_invariant, info, options);
+            ebpf_analyze_program_for_test(abstract_domain_kind::EBPF_DOMAIN, null_stream, prog,
+                    pre_invariant, info, options);
 
         for (const std::string& invariant : actual_last_invariant.value()) {
             if (invariant.rfind("r0.svalue=", 0) == 0) {
@@ -407,7 +410,7 @@ void print_failure(const Failure& failure, std::ostream& out) {
 bool all_suites(const string& path) {
     bool result = true;
     for (const TestCase& test_case: read_suite(path)) {
-        result = result && bool(run_yaml_test_case(test_case));
+        result = result && bool(run_yaml_test_case(abstract_domain_kind::EBPF_DOMAIN, test_case));
     }
     return result;
 }
diff --git a/src/ebpf_yaml.hpp b/src/ebpf_yaml.hpp
index 183ea3daa..f09194084 100644
--- a/src/ebpf_yaml.hpp
+++ b/src/ebpf_yaml.hpp
@@ -32,7 +32,8 @@ struct Failure {
 
 void print_failure(const Failure& failure, std::ostream& out);
 
-std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug = false);
+std::optional<Failure> run_yaml_test_case(abstract_domain_kind, TestCase test_case,
+        bool debug = false);
 
 struct ConformanceTestResult {
     bool success{};
diff --git a/src/main/run_yaml.cpp b/src/main/run_yaml.cpp
index 65a839a57..9ec50794f 100644
--- a/src/main/run_yaml.cpp
+++ b/src/main/run_yaml.cpp
@@ -24,12 +24,15 @@ int main(int argc, char** argv) {
 
     CLI11_PARSE(app, argc, argv);
     bool res = true;
+    bool tests_for_type_d = filename.find("types") != filename.npos;
+    auto domain = tests_for_type_d ? abstract_domain_kind::TYPE_DOMAIN :
+        abstract_domain_kind::EBPF_DOMAIN;
     foreach_suite(filename, [&](const TestCase& test_case) {
         if (!pattern.empty() && test_case.name.find(pattern) == test_case.name.npos) {
             return;
         }
         std::cout << test_case.name << ": " << std::flush;
-        const auto& maybe_failure = run_yaml_test_case(test_case, verbose);
+        const auto& maybe_failure = run_yaml_test_case(domain, test_case, verbose);
         if (!quiet && (verbose || maybe_failure)) {
             std::cout << "\n";
             std::cout << "Pre-invariant:" << test_case.assumed_pre_invariant << "\n";
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index da124a8bf..5d5a2518d 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -7,10 +7,10 @@
 
 // TODO: move out of this framework
 
-#define YAML_CASE(path) \
+#define YAML_CASE(path, domain) \
     TEST_CASE("YAML suite: " path, "[yaml]") { \
         foreach_suite(path, [&](const TestCase& test_case){ \
-            std::optional<Failure> failure = run_yaml_test_case(test_case); \
+            std::optional<Failure> failure = run_yaml_test_case(domain, test_case); \
             if (failure) { \
                 std::cout << "test case: " << test_case.name << "\n"; \
                 print_failure(*failure, std::cout); \
@@ -19,23 +19,23 @@
         }); \
     }
 
-YAML_CASE("test-data/add.yaml")
-YAML_CASE("test-data/assign.yaml")
-YAML_CASE("test-data/atomic.yaml")
-YAML_CASE("test-data/bitop.yaml")
-YAML_CASE("test-data/call.yaml")
-YAML_CASE("test-data/callx.yaml")
-YAML_CASE("test-data/udivmod.yaml")
-YAML_CASE("test-data/sdivmod.yaml")
-YAML_CASE("test-data/full64.yaml")
-YAML_CASE("test-data/jump.yaml")
-YAML_CASE("test-data/loop.yaml")
-YAML_CASE("test-data/movsx.yaml")
-YAML_CASE("test-data/packet.yaml")
-YAML_CASE("test-data/parse.yaml")
-YAML_CASE("test-data/sext.yaml")
-YAML_CASE("test-data/shift.yaml")
-YAML_CASE("test-data/stack.yaml")
-YAML_CASE("test-data/subtract.yaml")
-YAML_CASE("test-data/unop.yaml")
-YAML_CASE("test-data/unsigned.yaml")
+YAML_CASE("test-data/add.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/assign.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/atomic.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/bitop.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/call.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/callx.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/udivmod.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/sdivmod.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/full64.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/jump.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/loop.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/movsx.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/packet.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/parse.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/sext.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/shift.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/stack.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/subtract.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/unop.yaml", abstract_domain_kind::EBPF_DOMAIN)
+YAML_CASE("test-data/unsigned.yaml", abstract_domain_kind::EBPF_DOMAIN)

From 78c536bf743302286f6e5fc7a477921d32fdc841 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 27 Nov 2023 12:23:23 -0500
Subject: [PATCH 145/373] Added some test cases for type domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 test-data/add_types.yaml    | 120 ++++++++++++++++++++++++++++
 test-data/assign_types.yaml | 155 ++++++++++++++++++++++++++++++++++++
 test-data/bitop_types.yaml  |  94 ++++++++++++++++++++++
 test-data/call_types.yaml   |  44 ++++++++++
 4 files changed, 413 insertions(+)
 create mode 100644 test-data/add_types.yaml
 create mode 100644 test-data/assign_types.yaml
 create mode 100644 test-data/bitop_types.yaml
 create mode 100644 test-data/call_types.yaml

diff --git a/test-data/add_types.yaml b/test-data/add_types.yaml
new file mode 100644
index 000000000..fcc9c4de8
--- /dev/null
+++ b/test-data/add_types.yaml
@@ -0,0 +1,120 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: add immediate to large singleton number
+
+pre: ["r0 : number<2147483647>"]
+
+code:
+  <start>: |
+    r0 += 2 ; make sure value does not become a negative 64 bit number
+
+post: ["r0 : number<2147483649>"]
+
+---
+
+test-case: add immediate to large number range
+
+pre: ["r0 : number<[2147483645, 2147483647]>"]
+
+code:
+  <start>: |
+    r0 += 4 ; make sure value does not become a negative 64 bit number
+
+post: ["r0 : number<[2147483649, 2147483651]>"]
+
+---
+
+test-case: add immediate to unknown number
+
+pre: ["r1 : number"]
+
+code:
+  <start>: |
+    r1 += 0
+
+post: ["r1 : number"]
+
+---
+
+test-case: add number register to unknown number
+
+pre: ["r1 : number", "r2 : number"]
+
+code:
+  <start>: |
+    r1 += r2
+
+post: ["r1 : number", "r2 : number"]
+
+---
+
+test-case: add immediate to singleton number
+
+pre: ["r1 : number<5>"]
+
+code:
+  <start>: |
+    r1 += 3
+
+post: ["r1 : number<8>"]
+
+---
+
+test-case: add constant register to singleton number
+
+pre: ["r1 : number<5>", "r2 : number<7>"]
+
+code:
+  <start>: |
+    r1 += r2
+
+post: ["r1 : number<12>", "r2 : number<7>"]
+
+---
+
+test-case: add immediate to finite interval number
+
+pre: ["r1 : number<[5, 10]>"]
+
+code:
+  <start>: |
+    r1 += 5
+
+post: ["r1 : number<[10, 15]>"]
+
+---
+
+test-case: add constant register number to finite interval number
+
+pre: ["r1 : number<[5, 10]>", "r2 : number<5>"]
+
+code:
+  <start>: |
+    r1 += r2
+
+post: ["r1 : number<[10, 15]>", "r2 : number<5>"]
+
+---
+
+test-case: add interval number register to constant register pointer
+
+pre: ["r2 : packet_p<begin+0>", "r7 : number<[3, 5]>"]
+
+code:
+  <start>: |
+    r2 += r7
+
+post: ["r2 : packet_p<begin+[3, 5]>", "r7 : number<[3, 5]>"]
+
+---
+
+test-case: add constant register pointer to interval number
+
+pre: ["r2 : packet_p<begin+0>", "r7 : number<[3, 5]>"]
+
+code:
+  <start>: |
+    r7 += r2
+
+post: ["r2 : packet_p<begin+0>", "r7 : packet_p<begin+[3, 5]>"]
diff --git a/test-data/assign_types.yaml b/test-data/assign_types.yaml
new file mode 100644
index 000000000..209fb3c30
--- /dev/null
+++ b/test-data/assign_types.yaml
@@ -0,0 +1,155 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: assign immediate
+
+pre: []
+
+code:
+  <start>: |
+    r1 = 0
+
+post: ["r1 : number<0>"]
+
+---
+
+test-case: assign register
+
+pre: []
+
+code:
+  <start>: |
+    r1 = r2;
+
+post: []
+
+---
+
+test-case: re-assign immediate
+
+pre: ["r1 : number<5>"]
+
+code:
+  <start>: |
+    r1 = 0
+
+post: ["r1 : number<0>"]
+
+---
+
+test-case: re-assign register
+
+pre: ["r1 : number<[-3, 5]>"]
+
+code:
+  <start>: |
+    r1 = 0
+
+post: ["r1 : number<0>"]
+
+---
+
+test-case: stack assign immediate
+
+pre: ["r10 : stack_p<512>"]
+
+code:
+  <start>: |
+    *(u64 *)(r10 - 8) = 0
+
+post: ["r10 : stack_p<512>", "stack[504-511] : number<0>"]
+
+---
+test-case: stack assign number register
+
+pre: ["r10 : stack_p<512>", "r1 : number<0>"]
+
+code:
+  <start>: |
+    *(u64 *)(r10 - 8) = r1
+
+post: ["r10 : stack_p<512>", "r1 : number<0>", "stack[504-511] : number<0>"]
+
+---
+
+test-case: stack assign packet register
+
+pre: ["r10 : stack_p<512>", "r1 : packet_p<begin+0>"]
+
+code:
+  <start>: |
+    *(u64 *)(r10 - 8) = r1
+
+post: ["r10 : stack_p<512>", "r1 : packet_p<begin+0>", "stack[504-511] : packet_p<begin+0>"]
+
+---
+
+test-case: stack extend numeric range
+
+pre: ["r10 : stack_p<512>", "stack[500-507] : number"]
+
+code:
+  <start>: |
+    *(u64 *)(r10 - 8) = 0
+
+post: ["r10 : stack_p<512>", "stack[500-503] : number", "stack[504-511] : number<0>"]
+
+---
+
+test-case: stack narrow numeric range
+
+pre: ["r10 : stack_p<512>", "r1 : packet_p<begin+0>", "stack[500-507] : number"]
+
+code:
+  <start>: |
+    *(u64 *)(r10 - 8) = r1
+
+post: ["r10 : stack_p<512>", "r1 : packet_p<begin+0>", "stack[500-503] : number", "stack[504-511] : packet_p<begin+0>"]
+
+---
+
+test-case: assign register number value
+
+pre: ["r1 : number<0>"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post: ["r1 : number<0>", "r2 : number<0>"]
+
+---
+
+test-case: assign register stack value
+
+pre: ["r1 : stack_p<0>"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post: ["r1 : stack_p<0>", "r2 : stack_p<0>"]
+
+---
+
+test-case: assign register shared value
+
+pre: ["r1 : shared_p<0,16>"]
+
+code:
+  <start>: |
+    r2 = r1
+
+post: ["r1 : shared_p<0,16>", "r2 : shared_p<0,16>"]
+
+---
+
+test-case: 32-bit indirect assignment from context
+
+pre: ["r1 : ctx_p<0>"]
+
+code:
+  <start>: |
+    r2 = *(u32 *)(r1 + 8)
+
+post: ["r1 : ctx_p<0>", "r2 : packet_p"]
diff --git a/test-data/bitop_types.yaml b/test-data/bitop_types.yaml
new file mode 100644
index 000000000..8821bf2d1
--- /dev/null
+++ b/test-data/bitop_types.yaml
@@ -0,0 +1,94 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: Bitwise OR imm
+
+pre: ["r1 : number<-9223372036854775808>"]
+
+code:
+  <start>: |
+    r1 |= 1 ; 0x8000000000000000 | 1
+
+post: ["r1 : number<-9223372036854775807>"]
+
+---
+
+test-case: Bitwise OR reg
+
+pre: ["r1 : number<-9223372036854775808>", "r2 : number<1>"]
+
+code:
+  <start>: |
+    r1 |= r2 ; 0x8000000000000000 | 1
+
+post: ["r1 : number<-9223372036854775807>", "r2 : number<1>"]
+
+---
+
+test-case: Bitwise XOR imm
+
+pre: ["r1 : number<-9223372036854775807>"]
+
+code:
+  <start>: |
+    r1 ^= 3 ; 0x8000000000000001 ^ 3
+
+post: ["r1 : number<-9223372036854775806>"]
+
+---
+
+test-case: Bitwise XOR reg
+
+pre: ["r1 : number<-9223372036854775807>", "r2 : number<3>"]
+
+code:
+  <start>: |
+    r1 ^= r2 ; 0x8000000000000001 ^ 3
+
+post: ["r1 : number<-9223372036854775806>", "r2 : number<3>"]
+
+---
+
+test-case: Bitwise AND imm
+
+pre: ["r1 : number<-9223372036854775805>"]
+
+code:
+  <start>: |
+    r1 &= 5 ; 0x8000000000000003 & 5
+
+post: ["r1 : number<1>"]
+
+---
+
+test-case: Bitwise AND reg
+
+pre: ["r1 : number<-9223372036854775805>", "r2 : number<-9223372036854775803>"]
+
+code:
+  <start>: |
+    r1 &= r2 ; 0x8000000000000003 & 0x8000000000000005 = 0x8000000000000001
+
+post: ["r1 : number<-9223372036854775807>", "r2 : number<-9223372036854775803>"]
+
+---
+
+test-case: Bitwise [-1, 1] AND 0 == 0
+
+pre: ["r1 : number<[-1,1]>"]
+
+code:
+  <start>: |
+    r1 &= 0
+
+post: ["r1 : number<0>"]
+---
+test-case: Bitwise 2 AND 1 == 0
+
+pre: ["r1 : number<2>"]
+
+code:
+  <start>: |
+    r1 &= 1
+
+post: ["r1 : number<0>"]
diff --git a/test-data/call_types.yaml b/test-data/call_types.yaml
new file mode 100644
index 000000000..56c57cc8e
--- /dev/null
+++ b/test-data/call_types.yaml
@@ -0,0 +1,44 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: bpf_map_lookup_elem
+
+pre: ["r1 : map_fd 1", "r2 : stack_p<504>", "stack[504-511] : number"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post: ["r0 : shared_p<0,4>", "stack[504-511] : number"]
+
+---
+
+test-case: bpf_map_lookup_elem with non-numeric stack key
+
+pre: ["r1 : map_fd 1", "r2 : stack_p"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post: ["r0 : shared_p<0,4>"]
+
+messages:
+  - "0: Illegal map update with a non-numerical value [-oo-oo) (within stack(r2:key_size(r1)))"
+
+---
+
+test-case: bpf_map_update_elem with non-numeric stack value
+
+pre: ["r1 : map_fd 1", "r2 : stack_p<504>", "r3 : stack_p<496>", "r4 : number",
+    "stack[504-511] : number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post: ["r0 : number", "stack[504-511] : number"]
+
+messages:
+  - "0: Illegal map update with a non-numerical value [496-500) (within stack(r3:value_size(r1)))"
+

From 0830919ad616042b0e74c26325e8c315f42cb024 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 27 Nov 2023 15:25:26 -0500
Subject: [PATCH 146/373] Correctly computing limits for packet region

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index eabe3b537..9a03bfd1e 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -405,7 +405,7 @@ std::optional<bound_t> packet_constraint_t::get_limit() const {
     // TODO: normalize constraint, if required
     auto dist = m_eq.m_lhs.m_dist;
     if (dist.is_top()) return {};
-    return dist.ub();
+    return dist.lb();
 }
 
 extra_constraints_t extra_constraints_t::operator|(const extra_constraints_t& other) const {
@@ -581,9 +581,12 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                 return;
             }
             dist_t left_reg_dist = dist_left.value();
+            // keep only the upper bound to generate the constraint
+            auto ub = left_reg_dist.m_dist.ub();
+            auto left = weight_t{ub};
             dist_t right_reg_dist = dist_right.value();
             slack_var_t s = m_slack++;
-            dist_t f = dist_t(left_reg_dist.m_dist, s);
+            dist_t f = dist_t(left, s);
             dist_t b = dist_t(right_reg_dist.m_dist);
             auto eq = equality_t(f, b);
             auto ineq = inequality_t(s, rop_t::R_GE, weight_t{number_t{0}});

From bef2f5533433dc89d9f2798214e095864740079f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Dec 2023 06:01:36 -0500
Subject: [PATCH 147/373] Split interval domain into signed and unsigned

Previously, the interval propagation domain handled the intervals in a
similar manner for both signed and unsigned operations, with some
specific cases handled for unsigned separately, which is unsound;
Currently, signed interval domain handles signed operations, and
unsigned intervals handles unsigned, while the interval domain manages
both using 'reduction';
Some cleanup/refactoring, and better handling of dependencies;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp                  |    8 +-
 src/crab/common.hpp                           |    3 +
 src/crab/interval_domain.cpp                  | 1621 +++++++++++++++++
 src/crab/interval_domain.hpp                  |  139 ++
 src/crab/interval_prop_domain.cpp             | 1171 ------------
 src/crab/offset_domain.cpp                    |  233 +--
 src/crab/offset_domain.hpp                    |   12 +-
 src/crab/region_domain.cpp                    |  213 ++-
 src/crab/region_domain.hpp                    |   10 +-
 src/crab/signed_interval_domain.cpp           |  588 ++++++
 ..._domain.hpp => signed_interval_domain.hpp} |  114 +-
 src/crab/type_domain.cpp                      |  149 +-
 src/crab/type_domain.hpp                      |   17 +-
 src/crab/type_ostream.hpp                     |    3 -
 src/crab/unsigned_interval_domain.cpp         |  507 ++++++
 src/crab/unsigned_interval_domain.hpp         |  143 ++
 16 files changed, 3397 insertions(+), 1534 deletions(-)
 create mode 100644 src/crab/interval_domain.cpp
 create mode 100644 src/crab/interval_domain.hpp
 delete mode 100644 src/crab/interval_prop_domain.cpp
 create mode 100644 src/crab/signed_interval_domain.cpp
 rename src/crab/{interval_prop_domain.hpp => signed_interval_domain.hpp} (50%)
 create mode 100644 src/crab/unsigned_interval_domain.cpp
 create mode 100644 src/crab/unsigned_interval_domain.hpp

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index e6a865122..62e55cb74 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -5,7 +5,9 @@
 #include "ebpf_domain.hpp"
 #include "type_domain.hpp"
 #include "region_domain.hpp"
-#include "interval_prop_domain.hpp"
+#include "interval_domain.hpp"
+#include "signed_interval_domain.hpp"
+#include "unsigned_interval_domain.hpp"
 #include "offset_domain.hpp"
 
 template <typename Domain>
@@ -300,4 +302,6 @@ template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::type_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::region_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::offset_domain_t);
-template abstract_domain_t::abstract_domain_t(crab::interval_prop_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::interval_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::signed_interval_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::unsigned_interval_domain_t);
diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 0208bcb2e..1dfbf1148 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -7,12 +7,15 @@
 #include <functional>
 #include <optional>
 #include <vector>
+#include <unordered_map>
 
 #include "string_constraints.hpp"
 #include "asm_syntax.hpp"
+#include "array_domain.hpp"
 
 namespace crab {
 
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 constexpr uint8_t NUM_REGISTERS = 11;
 
 constexpr int STACK_BEGIN = 0;
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
new file mode 100644
index 000000000..8805fcd43
--- /dev/null
+++ b/src/crab/interval_domain.cpp
@@ -0,0 +1,1621 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/interval_domain.hpp"
+#include "boost/endian/conversion.hpp"
+
+namespace crab {
+
+bool interval_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
+    return (m_signed.is_bottom() || m_unsigned.is_bottom());
+}
+
+bool interval_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_signed.is_top() && m_unsigned.is_top());
+}
+
+interval_domain_t interval_domain_t::bottom() {
+    interval_domain_t interval;
+    interval.set_to_bottom();
+    return interval;
+}
+
+void interval_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+    m_signed.set_to_bottom();
+    m_unsigned.set_to_bottom();
+}
+
+void interval_domain_t::set_to_top() {
+    m_is_bottom = false;
+    m_signed.set_to_top();
+    m_unsigned.set_to_top();
+}
+
+void interval_domain_t::set_registers_to_bottom() {
+    m_signed.set_registers_to_bottom();
+    m_unsigned.set_registers_to_bottom();
+}
+
+void interval_domain_t::set_registers_to_top() {
+    m_signed.set_registers_to_top();
+    m_unsigned.set_registers_to_top();
+}
+
+std::optional<interval_cells_t> interval_domain_t::find_in_stack_signed(uint64_t key) const {
+    return m_signed.find_in_stack(key);
+}
+
+std::optional<interval_cells_t> interval_domain_t::find_in_stack_unsigned(uint64_t key) const {
+    return m_unsigned.find_in_stack(key);
+}
+
+void interval_domain_t::adjust_bb_for_types(location_t loc) {
+    m_signed.adjust_bb_for_types(loc);
+    m_unsigned.adjust_bb_for_types(loc);
+}
+
+std::vector<uint64_t> interval_domain_t::get_stack_keys() const {
+    // likewise for both domains, so just use signed
+    return m_signed.get_stack_keys();
+}
+
+bool interval_domain_t::all_numeric_in_stack(uint64_t start_loc, int width) const {
+    // likewise for both domains, so just use signed
+    return m_signed.all_numeric_in_stack(start_loc, width);
+}
+
+std::vector<uint64_t> interval_domain_t::find_overlapping_cells_in_stack(uint64_t start_loc,
+        int width) const {
+    // likewise for both domains, so just use signed
+    return m_signed.find_overlapping_cells_in_stack(start_loc, width);
+}
+
+void interval_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_signed.remove_overlap_in_stack(overlap, start_loc, width);
+    m_unsigned.remove_overlap_in_stack(overlap, start_loc, width);
+}
+
+void interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_signed.fill_values_in_stack(overlap, start_loc, width);
+    m_unsigned.fill_values_in_stack(overlap, start_loc, width);
+}
+
+std::optional<mock_interval_t> interval_domain_t::find_interval_value(register_t reg) const {
+    // in this case, it does not matter which domain we look into, hence we look into the signed one
+    return m_signed.find_interval_value(reg);
+}
+
+std::optional<mock_interval_t> interval_domain_t::find_signed_interval_value(register_t reg) const {
+    return m_signed.find_interval_value(reg);
+}
+
+std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_value(register_t reg) const {
+    return m_unsigned.find_interval_value(reg);
+}
+
+std::optional<mock_interval_t> interval_domain_t::find_signed_interval_at_loc(
+        const reg_with_loc_t reg) const {
+    return m_signed.find_interval_at_loc(reg);
+}
+
+std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_at_loc(
+        const reg_with_loc_t reg) const {
+    return m_unsigned.find_interval_at_loc(reg);
+}
+
+void interval_domain_t::insert_in_registers(register_t reg, location_t loc, interval_t interval) {
+    insert_in_registers_unsigned(reg, loc, interval);
+    insert_in_registers_signed(reg, loc, interval);
+}
+
+void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
+        interval_t interval) {
+    m_signed.insert_in_registers(reg, loc, interval);
+}
+
+void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
+        interval_t interval) {
+    m_unsigned.insert_in_registers(reg, loc, interval);
+}
+
+void interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
+    store_in_stack_signed(key, interval, width);
+    store_in_stack_unsigned(key, interval, width);
+}
+
+void interval_domain_t::store_in_stack_signed(uint64_t key, mock_interval_t interval, int width) {
+    m_signed.store_in_stack(key, interval, width);
+}
+
+void interval_domain_t::store_in_stack_unsigned(uint64_t key, mock_interval_t interval, int width) {
+    m_unsigned.store_in_stack(key, interval, width);
+}
+
+bool interval_domain_t::operator<=(const interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return true;
+}
+
+void interval_domain_t::operator|=(const interval_domain_t& abs) {
+    interval_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void interval_domain_t::operator|=(interval_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+interval_domain_t interval_domain_t::operator|(const interval_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return interval_domain_t(m_signed | other.m_signed, m_unsigned | other.m_unsigned);
+}
+
+interval_domain_t interval_domain_t::operator|(interval_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return interval_domain_t(
+            m_signed | std::move(other.m_signed), m_unsigned | std::move(other.m_unsigned));
+}
+
+interval_domain_t interval_domain_t::operator&(const interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+interval_domain_t interval_domain_t::widen(const interval_domain_t& abs, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+interval_domain_t interval_domain_t::narrow(const interval_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+crab::bound_t interval_domain_t::get_loop_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
+}
+
+void interval_domain_t::initialize_loop_counter(const label_t& label) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+string_invariant interval_domain_t::to_set() {
+    return string_invariant{};
+}
+
+interval_domain_t interval_domain_t::setup_entry() {
+    auto&& _signed = signed_interval_domain_t::setup_entry();
+    auto&& _unsigned = unsigned_interval_domain_t::setup_entry();
+    interval_domain_t interval(std::move(_signed), std::move(_unsigned));
+    return interval;
+}
+
+void interval_domain_t::operator()(const Un& u, location_t loc) {
+    m_signed(u, loc);
+    m_unsigned(u, loc);
+}
+
+void interval_domain_t::operator()(const LoadMapFd& u, location_t loc) {
+    operator-=(register_t{u.dst.v});
+}
+
+void interval_domain_t::scratch_caller_saved_registers() {
+    for (uint8_t i = R1_ARG; i <= R5_ARG; i++) {
+        operator-=(register_t{i});
+    }
+}
+
+void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
+        location_t loc) {
+    for (const auto& kv : store_in_stack) {
+        auto offset = kv.first;
+        auto width = kv.second;
+        auto overlapping_cells = find_overlapping_cells_in_stack(offset, width);
+        if (overlapping_cells.empty()) {
+            m_signed.store_in_stack(offset, interval_t::top(), width);
+            m_unsigned.store_in_stack(offset, interval_t::top(), width);
+        }
+        else {
+            fill_values_in_stack(overlapping_cells, offset, width);
+        }
+        //remove_overlap_in_stack(overlapping_cells, offset, width);
+        //m_signed.store_in_stack(offset, interval_t::top(), width);
+        //m_unsigned.store_in_stack(offset, interval_t::top(), width);
+    }
+    auto r0 = register_t{R0_RETURN_VALUE};
+    if (u.is_map_lookup) {
+        operator-=(r0);
+    }
+    else {
+        insert_in_registers(r0, loc, interval_t::top());
+    }
+    scratch_caller_saved_registers();
+}
+
+void interval_domain_t::operator()(const Packet& u, location_t loc) {
+    auto r0 = register_t{R0_RETURN_VALUE};
+    insert_in_registers(r0, loc, interval_t::top());
+    scratch_caller_saved_registers();
+}
+
+// Given left and right values, get the left and right intervals
+static void get_unsigned_intervals(bool is64, const interval_t& dst_signed,
+        const interval_t& dst_unsigned, const interval_t& src_unsigned,
+        interval_t& left_interval, interval_t& right_interval) {
+
+    // Get intervals as 32-bit or 64-bit as appropriate.
+    left_interval = dst_unsigned;
+    right_interval = src_unsigned;
+    if (!is64) {
+        for (interval_t* interval : {&left_interval, &right_interval}) {
+            if (!(*interval <= interval_t::unsigned_int(false))) {
+                *interval = interval->truncate_to_uint(false);
+            }
+        }
+    }
+
+    if (left_interval.is_top()) {
+        left_interval = dst_signed;
+        if (left_interval.is_top()) {
+            left_interval = interval_t::unsigned_int(is64);
+        }
+        else {
+            // make left interval as union of two intervals:
+                // [0, left_interval.ub()] truncated to uint
+                // [left_interval.lb(), -1] truncated to uint, as negative_int <=> unsigned_high
+            left_interval = interval_t{number_t{0}, left_interval.ub()}.truncate_to_uint(true) |
+                    interval_t{left_interval.lb(), number_t{-1}}.truncate_to_uint(true);
+        }
+    }
+
+    for (interval_t* interval : {&left_interval, &right_interval}) {
+        if (!(*interval <= interval_t::unsigned_int(true))) {
+            *interval = interval->truncate_to_uint(true);
+        }
+    }
+}
+
+void interval_domain_t::assume_unsigned_lt(bool is64, bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
+    if (right_interval <= interval_t::nonnegative_int(is64)) {
+        // Both left_interval and right_interval fit in [0, INT_MAX],
+        // and can be treated as both signed and unsigned values
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, std::move(positive), std::move(positive), true, true, false, false);
+    }
+    else if (left_interval <= interval_t::unsigned_int(is64) &&
+            right_interval <= interval_t::unsigned_int(is64)) {
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), std::move(positive), true, true, false, false);
+    }
+    else if (left_interval <= interval_t::unsigned_int(is64)) {
+        // interval can only be represented as uvalue
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), interval_t::top(),
+                false, true, false, false);
+        insert_in_registers_signed(left, loc, interval_t::top());
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers_signed(std::get<Reg>(right).v, loc, interval_t::top());
+        }
+    }
+    // possibly redundant case, since when left interval is negative, it is converted to
+    // unsigned high representation, while right interval likely is not negative
+    /*
+    else if (left_signed <= interval_t::negative_int(is64) &&
+            right_signed <= interval_t::negative_int(is64)) {
+        // right_signed and left_signed fit in [INT_MIN, -1], and can be treated as
+        // both signed and unsigned, since [INT_MIN, -1] <=> [INT_MAX+1, UINT_MAX]
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::negative_int(is64),
+                interval_t::unsigned_high(is64), true, true);
+    }
+    */
+    else {
+        // interval can only be represented as uvalue
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), std::move(positive), false, true, false, false);
+        insert_in_registers_signed(left, loc, interval_t::top());
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers_signed(std::get<Reg>(right).v, loc, interval_t::top());
+        }
+    }
+}
+
+void interval_domain_t::assume_unsigned_gt(bool is64, bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
+    if (left_interval <= interval_t::unsigned_int(is64) &&
+            right_interval <= interval_t::unsigned_int(is64)) {
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), std::move(positive), true, true, false, false);
+    }
+    // possibly redundant analysis, see unsigned_lt
+    /*
+    else if (right_signed <= interval_t::negative_int(is64)
+            && left_signed <= interval_t::negative_int(is64)) {
+        // Both left_signed and right_signed fit in [INT_MIN, -1], and can be treated as both
+        // signed and unsigned values since [INT_MIN, -1] <=> [INT_MAX+1, UINT_MAX]
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::negative_int(is64),
+                interval_t::unsigned_high(is64), true, true);
+    }
+    */
+    else {
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), std::move(positive), false, true, false, false);
+        insert_in_registers_signed(left, loc, interval_t::top());
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers(std::get<Reg>(right).v, loc, interval_t::top());
+        }
+    }
+}
+
+void interval_domain_t::assume_unsigned_cst(Condition::Op op, bool is64,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto left_interval = interval_t::bottom();
+    auto right_interval = interval_t::bottom();
+    get_unsigned_intervals(is64, left_signed, left_unsigned, right_unsigned,
+            left_interval, right_interval);
+
+    // Handle uvalue != right.
+    if (op == Condition::Op::NE) {
+        if (auto rn = right_interval.singleton()) {
+            if (rn == left_interval.truncate_to_uint(is64).lb().number()) {
+                // "NE lower bound" is equivalent to "GT lower bound".
+                op = Condition::Op::GT;
+                right_interval = interval_t{left_interval.lb()};
+            } else if (rn == left_interval.ub().number()) {
+                // "NE upper bound" is equivalent to "LT upper bound".
+                op = Condition::Op::LT;
+                right_interval = interval_t{left_interval.ub()};
+            } else {
+                return;
+            }
+        } else {
+            return;
+        }
+    }
+    const bool is_lt = op == Condition::Op::LT || op == Condition::Op::LE;
+    bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
+
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        set_registers_to_bottom();
+        return;
+    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        set_registers_to_bottom();
+        return;
+    }
+    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        // TODO: verify if setting to top is the correct equivalent of returning linear cst true
+        set_registers_to_top();
+        return;
+    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        set_registers_to_top();
+        return;
+    }
+
+    if (is_lt)
+        assume_unsigned_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc);
+    else
+        assume_unsigned_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc);
+}
+
+// Given left and right values, get the left and right intervals
+static void get_signed_intervals(bool is64, const interval_t& dst_signed,
+        const interval_t& dst_unsigned, const interval_t& src_signed,
+        interval_t& left_interval, interval_t& right_interval) {
+
+    // Get intervals as 32-bit or 64-bit as appropriate.
+    left_interval = dst_signed;
+    right_interval = src_signed;
+    if (!is64) {
+        for (interval_t* interval : {&left_interval, &right_interval}) {
+            if (!(*interval <= interval_t::signed_int(false))) {
+                *interval = interval->truncate_to_sint(false);
+            }
+        }
+    }
+
+    if (left_interval.is_top()) {
+        left_interval = dst_unsigned;
+        if (left_interval.is_top()) {
+            left_interval = interval_t::signed_int(is64);
+        }
+        else {
+            auto low = (left_interval & interval_t::unsigned_high(is64)).truncate_to_sint(true);
+            auto high = (left_interval & interval_t::nonnegative_int(is64)).truncate_to_sint(true);
+            left_interval = low | high;
+        }
+    }
+
+    for (interval_t* interval : {&left_interval, &right_interval}) {
+        if (!(*interval <= interval_t::signed_int(true))) {
+            *interval = interval->truncate_to_sint(true);
+        }
+    }
+}
+
+void interval_domain_t::update_lt(bool is64, bool strict, interval_t&& left_interval,
+        interval_t&& right_interval, const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc,
+        interval_t&& restrict_signed, interval_t&& restrict_unsigned,
+        bool update_signed, bool update_unsigned, bool mk_equal_unsigned, bool is_signed) {
+
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+    auto llbs = left_signed.lb();
+    auto lubs = left_signed.ub();
+    auto rlbs = right_signed.lb();
+    auto rubs = right_signed.ub();
+    auto llbu = left_unsigned.lb();
+    auto lubu = left_unsigned.ub();
+    auto rlbu = right_unsigned.lb();
+    auto rubu = right_unsigned.ub();
+
+    bool holds_reg = std::holds_alternative<Reg>(right);
+
+    if (strict ? llb < rlb : llb <= rlb && lub >= rlb) {
+        if (update_signed) {
+            auto to_insert_signed = interval_t{llbs, strict ? rlbs - number_t{1} : rlbs};
+            to_insert_signed = to_insert_signed & restrict_signed;
+            insert_in_registers_signed(left, loc, to_insert_signed);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(left, loc, to_insert_signed);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_unsigned = interval_t{llbu, strict ? rlbu - number_t{1} : rlbu};
+            to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
+            insert_in_registers_unsigned(left, loc, to_insert_unsigned);
+        }
+    }
+    else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub && holds_reg) {
+        auto right_reg = std::get<Reg>(right).v;
+        if (update_signed) {
+            auto to_insert_signed = interval_t{strict ? lubs + number_t{1} : lubs, rubs};
+            to_insert_signed = to_insert_signed & restrict_signed;
+            insert_in_registers_signed(right_reg, loc, to_insert_signed);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(right_reg, loc, to_insert_signed);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_unsigned = interval_t{strict ? lubu + number_t{1} : lubu, rubu};
+            to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
+            insert_in_registers_unsigned(right_reg, loc, to_insert_unsigned);
+        }
+    }
+    else if (lub >= rub && strict ? llb < rub : llb <= rub) {
+        if (update_signed) {
+            auto to_insert_left_signed = interval_t{llbs, strict ? rubs - number_t{1} : rubs};
+            to_insert_left_signed = to_insert_left_signed & restrict_signed;
+            insert_in_registers_signed(left, loc, to_insert_left_signed);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(left, loc, to_insert_left_signed);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_left_unsigned = interval_t{llbu, strict ? rubu - number_t{1} : rubu};
+            to_insert_left_unsigned = to_insert_left_unsigned & restrict_unsigned;
+            insert_in_registers_unsigned(left, loc, to_insert_left_unsigned);
+        }
+
+        // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
+        // and set left to the rest of the interval < (or <=) of right
+        // a more sound analysis is needed
+        if (holds_reg) {
+            auto right_reg = std::get<Reg>(right).v;
+            if (update_signed) {
+                auto to_insert_right_signed = interval_t{rubs} & restrict_signed;
+                insert_in_registers_signed(right_reg, loc, to_insert_right_signed);
+                if (mk_equal_unsigned && !is_signed) {
+                    insert_in_registers_unsigned(right_reg, loc, to_insert_right_signed);
+                }
+            }
+            if (update_unsigned && !is_signed) {
+                insert_in_registers_unsigned(right_reg, loc, interval_t{rubu} & restrict_unsigned);
+            }
+        }
+    }
+    else {
+        // TODO: verify if any legitimate case can fall into here
+        set_registers_to_bottom();
+    }
+    if (is_signed) {
+        insert_in_registers_unsigned(left, loc, left_unsigned);
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+        }
+    }
+}
+
+void interval_domain_t::assume_signed_lt(bool is64, bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
+    if (right_interval <= interval_t::negative_int(is64)) {
+        // right_interval fits in [INT_MIN, -1], and can be treated as both signed and unsigned
+        // since [INT_MIN, -1] <=> [INT_MAX+1, UINT_MAX]
+        // likewise for left_interval, as it is not > right_interval, and truncated to signed int
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), interval_t::unsigned_high(is64), true, true, false, true);
+    }
+    else if (left_interval <= interval_t::nonnegative_int(is64) &&
+            right_interval <= interval_t::nonnegative_int(is64)) {
+        // Both left_interval and right_interval fit in [0, INT_MAX],
+        // and can be treated as both signed and unsigned values
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, std::move(positive), std::move(positive), true, false, true, true);
+    }
+    else  {
+        // left_interval and right_interval can be treated as signed values only
+        update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), interval_t::top(), true, false, false, false);
+        insert_in_registers_unsigned(left, loc, left_unsigned);
+        if (std::holds_alternative<Reg>(right)) {
+            auto right_reg = std::get<Reg>(right).v;
+            insert_in_registers_unsigned(right_reg, loc, right_unsigned);
+        }
+    }
+}
+
+void interval_domain_t::update_gt(bool is64, bool strict, interval_t&& left_interval,
+        interval_t&& right_interval, const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc, interval_t&& restrict_signed,
+        interval_t&& restrict_unsigned, bool update_signed, bool update_unsigned,
+        bool mk_equal_unsigned, bool is_signed) {
+
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+    auto llbs = left_signed.lb();
+    auto lubs = left_signed.ub();
+    auto rlbs = right_signed.lb();
+    auto rubs = right_signed.ub();
+    auto llbu = left_unsigned.lb();
+    auto lubu = left_unsigned.ub();
+    auto rlbu = right_unsigned.lb();
+    auto rubu = right_unsigned.ub();
+
+    bool holds_reg = std::holds_alternative<Reg>(right);
+
+    if (strict ? lub > rub : lub >= rub && llb <= rub) {
+        if (update_signed) {
+            auto to_insert_signed = interval_t{strict ? rubs + number_t{1} : rubs, lubs};
+            to_insert_signed = to_insert_signed & restrict_signed;
+            insert_in_registers_signed(left, loc, to_insert_signed);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(left, loc, to_insert_signed);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_unsigned = interval_t{strict ? rubu + number_t{1} : rubu, lubu};
+            to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
+            insert_in_registers_unsigned(left, loc, to_insert_unsigned);
+        }
+    }
+    else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb && holds_reg) {
+        auto right_reg = std::get<Reg>(right).v;
+        if (update_signed) {
+            auto to_insert_signed = interval_t{rlbs, strict ? llbs - number_t{1} : llbs};
+            to_insert_signed = to_insert_signed & restrict_signed;
+            insert_in_registers_signed(right_reg, loc, to_insert_signed);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(right_reg, loc, to_insert_signed);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_unsigned = interval_t{rlbu, strict ? llbu - number_t{1} : llbu};
+            to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
+            insert_in_registers_unsigned(right_reg, loc, to_insert_unsigned);
+        }
+    }
+    else if (llb <= rlb && strict ? lub > rlb : lub >= rlb) {
+        if (update_signed) {
+            auto to_insert_signed_left = interval_t{strict ? rlbs + number_t{1} : rlbs, lubs};
+            to_insert_signed_left = to_insert_signed_left & restrict_signed;
+            insert_in_registers_signed(left, loc, to_insert_signed_left);
+            if (mk_equal_unsigned && !is_signed) {
+                insert_in_registers_unsigned(left, loc, to_insert_signed_left);
+            }
+        }
+
+        if (update_unsigned && !is_signed) {
+            auto to_insert_unsigned_left = interval_t{strict ? rlbu + number_t{1} : rlbu, lubu};
+            to_insert_unsigned_left = to_insert_unsigned_left & restrict_unsigned;
+            insert_in_registers_unsigned(left, loc, to_insert_unsigned_left);
+        }
+
+        // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
+        // and set left to the rest of the interval > (or >=) of right
+        // a more sound analysis is needed
+        if (holds_reg) {
+            auto right_reg = std::get<Reg>(right).v;
+            if (update_signed) {
+                auto to_insert_signed_right = interval_t{rlbs} & restrict_signed;
+                insert_in_registers_signed(right_reg, loc, to_insert_signed_right);
+                if (mk_equal_unsigned && !is_signed) {
+                    insert_in_registers_unsigned(right_reg, loc, to_insert_signed_right);
+                }
+            }
+            if (update_unsigned && !is_signed) {
+                insert_in_registers_unsigned(right_reg, loc, interval_t{rlbu} & restrict_unsigned);
+            }
+        }
+    }
+    else {
+        // TODO: verify if any legitimate case can fall into here
+        set_registers_to_bottom();
+    }
+    if (is_signed) {
+        insert_in_registers_unsigned(left, loc, left_unsigned);
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+        }
+    }
+}
+
+void interval_domain_t::assume_signed_gt(bool is64, bool strict,
+        interval_t&& left_interval, interval_t&& right_interval,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
+    if (right_interval <= interval_t::nonnegative_int(is64)) {
+        // right_interval fits in [0, INT_MAX], and can be treated as both signed and unsigned
+        // likewise fits in [0, UINT_MAX], as it is not < right_interval,
+        // and truncated to signed int
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, std::move(positive), std::move(positive), true, false, true, true);
+    }
+    else if (right_interval <= interval_t::negative_int(is64)
+            && left_interval <= interval_t::negative_int(is64)) {
+        // Both left_interval and right_interval fit in [INT_MIN, -1], and can be treated as both
+        // signed and unsigned values since [INT_MIN, -1] <=> [INT_MAX+1, UINT_MAX]
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), interval_t::unsigned_high(is64),
+                true, true, false, true);
+    }
+    else {
+        // left_interval and right_interval can be treated as signed values only
+        update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc, interval_t::top(), interval_t::top(), true, false, false, true);
+        insert_in_registers_unsigned(left, loc, left_unsigned);
+        if (std::holds_alternative<Reg>(right)) {
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+        }
+    }
+}
+
+void interval_domain_t::assume_signed_cst(Condition::Op op, bool is64,
+        const interval_t& left_signed, const interval_t& left_unsigned,
+        const interval_t& right_signed, const interval_t& right_unsigned,
+        register_t left, Value right, location_t loc) {
+
+    auto left_interval = interval_t::bottom();
+    auto right_interval = interval_t::bottom();
+    get_signed_intervals(is64, left_signed, left_unsigned, right_signed,
+            left_interval, right_interval);
+
+    const bool is_lt = op == Condition::Op::SLT || op == Condition::Op::SLE;
+    bool strict = op == Condition::Op::SLT || op == Condition::Op::SGT;
+
+    auto llb = left_interval.lb();
+    auto lub = left_interval.ub();
+    auto rlb = right_interval.lb();
+    auto rub = right_interval.ub();
+    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        set_registers_to_bottom();
+        return;
+    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        set_registers_to_bottom();
+        return;
+    }
+    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
+        // Left unsigned interval is lower than right unsigned interval.
+        // TODO: verify if setting to top is the correct equivalent of returning linear cst true
+        set_registers_to_top();
+        return;
+    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
+        // Left unsigned interval is higher than right unsigned interval.
+        set_registers_to_top();
+        return;
+    }
+
+    if (is_lt)
+        assume_signed_lt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc);
+    else
+        assume_signed_gt(is64, strict, std::move(left_interval), std::move(right_interval),
+                left_signed, left_unsigned, right_signed, right_unsigned,
+                left, right, loc);
+}
+
+void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
+        Value right, location_t loc) {
+    using Op = Condition::Op;
+
+    auto left_signed = find_signed_interval_value(left)->to_interval();
+    auto left_unsigned = find_unsigned_interval_value(left)->to_interval();
+    auto right_signed = interval_t::bottom();
+    auto right_unsigned = interval_t::bottom();
+    if (std::holds_alternative<Reg>(right)) {
+        auto right_reg = register_t{std::get<Reg>(right).v};
+        right_signed = find_signed_interval_value(right_reg)->to_interval();
+        right_unsigned = find_unsigned_interval_value(right_reg)->to_interval();
+    } else if (std::holds_alternative<Imm>(right)) {
+        auto right_imm = std::get<Imm>(right).v;
+        right_signed = interval_t{number_t{right_imm}};
+        right_unsigned = interval_t(number_t{(uint64_t)right_imm});
+    }
+
+    switch (op) {
+        case Op::EQ: {
+            auto interval_signed = left_signed & right_signed;
+            auto interval_unsigned = left_unsigned & right_unsigned;
+            insert_in_registers_signed(left, loc, interval_signed);
+            insert_in_registers_unsigned(left, loc, interval_unsigned);
+            if (std::holds_alternative<Reg>(right)) {
+                auto right_reg = std::get<Reg>(right).v;
+                insert_in_registers_signed(right_reg, loc, interval_signed);
+                insert_in_registers_unsigned(right_reg, loc, interval_unsigned);
+            }
+            break;
+        }
+        case Op::SGE:
+        case Op::SLE:
+        case Op::SGT:
+        case Op::SLT: {
+            assume_signed_cst(op, is64, left_signed, left_unsigned, right_signed,
+                    right_unsigned, left, right, loc);
+            break;
+        }
+        case Op::SET:
+        case Op::NSET: {
+            // TODO: implement SET and NSET
+            break;
+        }
+        case Op::NE:
+        case Op::GE:
+        case Op::LE:
+        case Op::GT:
+        case Op::LT: {
+            assume_unsigned_cst(op, is64, left_signed, left_unsigned, right_signed,
+                    right_unsigned, left, right, loc);
+            break;
+        }
+    }
+}
+
+void interval_domain_t::operator()(const Assume& s, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator-=(register_t reg) {
+    m_signed.operator-=(reg);
+    m_unsigned.operator-=(reg);
+}
+
+bool interval_domain_t::load_from_stack(register_t reg, interval_t load_at, int width,
+        location_t loc) {
+    uint64_t start_offset = 0;
+    if (auto load_at_singleton = load_at.singleton()) {
+        start_offset = (uint64_t)(*load_at_singleton);
+        bool loaded_signed = m_signed.load_from_stack(reg, start_offset, loc);
+        bool loaded_unsigned = m_unsigned.load_from_stack(reg, start_offset, loc);
+        if (loaded_signed && loaded_unsigned) return true;
+    }
+    else {
+        auto load_at_lb = load_at.lb();
+        auto load_at_ub = load_at.ub();
+        if (auto finite_size = load_at.finite_size()) {
+            if (auto load_at_lb = load_at.lb().number()) {
+                start_offset = (uint64_t)(*load_at_lb);
+                width = (int)(*finite_size + number_t{width});
+            }
+        }
+    }
+    if (all_numeric_in_stack(start_offset, width)) {
+        insert_in_registers(reg, loc, interval_t::top());
+        return true;
+    }
+    return false;
+}
+
+void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
+        std::optional<ptr_or_mapfd_t> basereg_type, bool load_in_region, location_t loc) {
+
+    if (!basereg_type) {
+        operator-=(target_register);
+        return;
+    }
+
+    // we check if we already loaded a pointer from ctx or stack in region domain,
+        // we then do not store a number
+    if (load_in_region) {
+        operator-=(target_register);
+        return;
+    }
+    int width = b.access.width;
+    int offset = b.access.offset;
+    auto basereg_ptr_or_mapfd_type = basereg_type.value();
+
+    if (is_ctx_ptr(basereg_type)) {
+        insert_in_registers(target_register, loc, interval_t::top());
+        return;
+    }
+    if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
+        if (width == 1) {
+            interval_t to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
+            insert_in_registers(target_register, loc, to_insert);
+        }
+        else if (width == 2) {
+            interval_t to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
+            insert_in_registers(target_register, loc, to_insert);
+        }
+        else {
+            insert_in_registers(target_register, loc, interval_t::top());
+        }
+        return;
+    }
+
+    if (is_stack_ptr(basereg_type)) {
+        auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
+        auto p_offset = ptr_with_off.get_offset();
+        auto load_at = p_offset.to_interval() + interval_t(number_t{offset});
+        if (load_from_stack(target_register, load_at, width, loc)) return;
+    }
+    operator-=(target_register);
+}
+
+void interval_domain_t::store_in_stack(const Mem& b, uint64_t store_at, int width) {
+    m_signed.store_in_stack(b, store_at, width);
+    m_unsigned.store_in_stack(b, store_at, width);
+}
+
+void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> basereg_type) {
+    int offset = b.access.offset;
+    int width = b.access.width;
+
+    if (!is_stack_ptr(basereg_type)) {
+        // we only store for stack pointers
+        return;
+    }
+
+    auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(*basereg_type);
+    auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
+    if (!offset_singleton) {
+        m_errors.push_back("doing a store with unknown offset");
+        return;
+    }
+    auto store_at = (uint64_t)(*offset_singleton + offset);
+    auto overlapping_cells = find_overlapping_cells_in_stack(store_at, width);
+    remove_overlap_in_stack(overlapping_cells, store_at, width);
+    store_in_stack(b, store_at, width);
+}
+
+void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
+        int width, bool check_stack_all_numeric) {
+    // access can be checked only in the signed domain
+    m_signed.check_valid_access(s, std::move(interval), width, check_stack_all_numeric);
+}
+
+static void overflow_bounds(interval_t& interval, number_t span, int finite_width,
+        bool issigned) {
+    if (interval.ub() - interval.lb() >= span) {
+        // Interval covers the full space.
+        interval = interval_t::top();
+        return;
+    }
+    if (interval.is_bottom()) {
+        interval = interval_t::top();
+        return;
+    }
+    number_t lb_value = interval.lb().number().value();
+    number_t ub_value = interval.ub().number().value();
+
+    // Compute the interval, taking overflow into account.
+    // For a signed result, we need to ensure the signed and unsigned results match
+    // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
+    // a sign extended negative one.
+    number_t lb = lb_value.truncate_to_unsigned_finite_width(finite_width);
+    number_t ub = ub_value.truncate_to_unsigned_finite_width(finite_width);
+    if (issigned) {
+        lb = lb.truncate_to_sint64();
+        ub = ub.truncate_to_sint64();
+    }
+    if (lb > ub) {
+        // Range wraps in the middle, so we cannot represent as an unsigned interval.
+        interval = interval_t::top();
+        return;
+    }
+    interval = crab::interval_t{lb, ub};
+}
+
+static void overflow_unsigned(interval_t& interval, int finite_width) {
+    auto span{finite_width == 64   ? crab::z_number{std::numeric_limits<uint64_t>::max()}
+        : finite_width == 32 ? crab::z_number{std::numeric_limits<uint32_t>::max()}
+                                   : throw std::exception()};
+    overflow_bounds(interval, span, finite_width, false);
+}
+
+static void overflow_signed(interval_t& interval, int finite_width) {
+    auto span{finite_width == 64   ? crab::z_number{std::numeric_limits<int64_t>::max()}
+        : finite_width == 32 ? crab::z_number{std::numeric_limits<int32_t>::max()}
+                                   : throw std::exception()};
+    overflow_bounds(interval, span, finite_width, true);
+}
+
+static void apply_unsigned(interval_t& dst_signed, interval_t& dst_unsigned,
+        const interval_t& src, int finite_width, const interval_t& updated_interval, Bin::Op op) {
+    switch (op) {
+        case Bin::Op::UDIV: {
+            // this hack is required because UDiv call returns [+oo, +oo], at least in case when 
+            // updated_interval is top,
+            // which causes the error: CRAB ERROR: Bound: undefined operation -oo + +oo
+            // SplitDBM (possibly) uses a normalize() to avoid this issue,
+            // but we don't have that here
+            // TODO: fix this
+            if (updated_interval.is_top()) {
+                dst_unsigned = interval_t::top();
+                dst_signed = interval_t::top();
+                return;
+            }
+            dst_unsigned = updated_interval.UDiv(src);
+            break;
+        }
+        case Bin::Op::UMOD: {
+            dst_unsigned = updated_interval.URem(src);
+            break;
+        }
+        case Bin::Op::AND: {
+            dst_unsigned = updated_interval.And(src);
+            break;
+        }
+        case Bin::Op::OR: {
+            dst_unsigned = updated_interval.Or(src);
+            break;
+        }
+        case Bin::Op::XOR: {
+            dst_unsigned = updated_interval.Xor(src);
+            break;
+        }
+        case Bin::Op::LSH: {
+            dst_unsigned = updated_interval.Shl(src);
+            break;
+        }
+        case Bin::Op::RSH: {
+            dst_unsigned = updated_interval.LShr(src);
+            break;
+        }
+        case Bin::Op::ARSH: {
+            dst_unsigned = updated_interval.AShr(src);
+            break;
+        }
+        default: {
+            break;
+        }
+    }
+    if (finite_width) {
+        dst_signed = dst_unsigned;
+        overflow_unsigned(dst_unsigned, finite_width);
+        overflow_signed(dst_signed, finite_width);
+    }
+}
+
+static void apply_signed(interval_t& dst_signed, interval_t& dst_unsigned, const interval_t& src,
+        int finite_width, const interval_t& updated_interval, Bin::Op op) {
+    switch (op) {
+        case Bin::Op::ADD: {
+            dst_signed = updated_interval + src;
+            break;
+        }
+        case Bin::Op::SUB: {
+            dst_signed = updated_interval - src;
+            break;
+        }
+        case Bin::Op::MUL: {
+            dst_signed = updated_interval * src;
+            break;
+        }
+        default: {
+            break;
+        }
+    }
+    if (finite_width) {
+        dst_unsigned = dst_signed;
+        overflow_signed(dst_signed, finite_width);
+        overflow_unsigned(dst_unsigned, finite_width);
+    }
+}
+
+static void shl(register_t reg, int imm, int finite_width,
+        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
+    // The BPF ISA requires masking the imm.
+    imm &= finite_width - 1;
+
+    if (dst_unsigned.finite_size()) {
+        number_t lb = dst_unsigned.lb().number().value();
+        number_t ub = dst_unsigned.ub().number().value();
+        uint64_t lb_n = lb.cast_to_uint64();
+        uint64_t ub_n = ub.cast_to_uint64();
+        uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
+        if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
+            // The bits that will be shifted out to the left are different,
+            // which means all combinations of remaining bits are possible.
+            lb_n = 0;
+            ub_n = (uint_max << imm) & uint_max;
+        } else {
+            // The bits that will be shifted out to the left are identical
+            // for all values in the interval, so we can safely shift left
+            // to get a new interval.
+            lb_n = (lb_n << imm) & uint_max;
+            ub_n = (ub_n << imm) & uint_max;
+        }
+        dst_unsigned = interval_t{number_t{lb_n}, number_t{ub_n}};
+        dst_signed = interval_t::top();
+        if ((int64_t)ub_n >= (int64_t)lb_n) {
+            dst_signed = dst_unsigned;
+        }
+        return;
+    }
+    apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{imm}}, 64,
+            dst_unsigned, Bin::Op::LSH);
+}
+
+static void lshr(register_t reg, int imm, int finite_width,
+        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
+    // The BPF ISA requires masking the imm.
+    imm &= finite_width - 1;
+
+    number_t lb_n{0};
+    number_t ub_n{UINT64_MAX >> imm};
+    if (dst_unsigned.finite_size()) {
+        number_t lb = dst_unsigned.lb().number().value();
+        number_t ub = dst_unsigned.ub().number().value();
+        if (finite_width == 64) {
+            lb_n = lb.cast_to_uint64() >> imm;
+            ub_n = ub.cast_to_uint64() >> imm;
+        } else {
+            number_t lb_w = lb.cast_to_signed_finite_width(finite_width);
+            number_t ub_w = ub.cast_to_signed_finite_width(finite_width);
+            lb_n = lb_w.cast_to_uint32() >> imm;
+            ub_n = ub_w.cast_to_uint32() >> imm;
+
+            // The interval must be valid since a signed range crossing 0
+            // was earlier converted to a full unsigned range.
+            assert(lb_n <= ub_n);
+        }
+    }
+    dst_unsigned = interval_t{lb_n, ub_n};
+    if ((int64_t)ub_n >= (int64_t)lb_n) {
+        dst_signed = dst_unsigned;
+    } else {
+        dst_signed = interval_t::top();
+    }
+    return;
+}
+
+static void ashr(register_t reg, interval_t src, int finite_width,
+        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
+    interval_t left_interval = interval_t::bottom();
+    interval_t right_interval = interval_t::bottom();
+    get_signed_intervals(finite_width == 64, dst_signed, dst_unsigned,
+            src, left_interval, right_interval);
+    if (auto sn = right_interval.singleton()) {
+        // The BPF ISA requires masking the imm.
+        int64_t imm = sn->cast_to_sint64() & (finite_width - 1);
+
+        int64_t lb_n = INT64_MIN >> imm;
+        int64_t ub_n = INT64_MAX >> imm;
+        if (left_interval.finite_size()) {
+            number_t lb = left_interval.lb().number().value();
+            number_t ub = left_interval.ub().number().value();
+            if (finite_width == 64) {
+                lb_n = lb.cast_to_sint64() >> imm;
+                ub_n = ub.cast_to_sint64() >> imm;
+            } else {
+                number_t lb_w = lb.cast_to_signed_finite_width(finite_width) >> (int)imm;
+                number_t ub_w = ub.cast_to_signed_finite_width(finite_width) >> (int)imm;
+                if (lb_w.cast_to_uint32() <= ub_w.cast_to_uint32()) {
+                    lb_n = lb_w.cast_to_uint32();
+                    ub_n = ub_w.cast_to_uint32();
+                }
+            }
+        }
+        dst_signed = interval_t{number_t{lb_n}, number_t{ub_n}};
+        dst_unsigned = interval_t::top();
+        if ((uint64_t)ub_n >= (uint64_t)lb_n) {
+            dst_unsigned = dst_signed;
+        }
+        return;
+    }
+    dst_signed = interval_t::top();
+    dst_unsigned = interval_t::top();
+}
+
+void interval_domain_t::do_bin(const Bin& bin,
+        const std::optional<interval_t>& src_signed_interval_opt,
+        const std::optional<interval_t>& src_unsigned_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        const std::optional<interval_t>& dst_signed_interval_opt,
+        const std::optional<interval_t>& dst_unsigned_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
+        const interval_t& subtracted, location_t loc) {
+    
+    using Op = Bin::Op;
+
+    auto dst_register = register_t{bin.dst.v};
+    auto finite_width = (bin.is64 ? 64 : 32);
+
+    interval_t dst_signed = subtracted;
+    interval_t dst_unsigned = subtracted;
+    if (subtracted != interval_t::bottom()) {
+        if (!(dst_signed <= interval_t::signed_int(bin.is64))) {
+            dst_signed = dst_signed.truncate_to_sint(bin.is64);
+        }
+        insert_in_registers_signed(dst_register, loc, dst_signed);
+        if (!(dst_unsigned <= interval_t::unsigned_int(bin.is64))) {
+            dst_unsigned = dst_unsigned.truncate_to_uint(bin.is64);
+        }
+        insert_in_registers_unsigned(dst_register, loc, dst_unsigned);
+        return;
+    }
+    if (dst_signed_interval_opt) dst_signed = std::move(*dst_signed_interval_opt);
+    if (dst_unsigned_interval_opt) dst_unsigned = std::move(*dst_unsigned_interval_opt);
+
+    if (std::holds_alternative<Imm>(bin.v)) {
+        int64_t imm;
+        if (bin.is64) {
+            // Use the full signed value.
+            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+        } else {
+            // Use only the low 32 bits of the value.
+            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+            if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{UINT32_MAX}},
+                        64, dst_unsigned, Op::AND);
+            }
+        }
+        auto imm_number = number_t{imm};
+        auto imm_interval = interval_t{imm_number};
+        auto imm_unsigned_interval = interval_t{number_t{imm_number.cast_to_uint64()}};
+        auto imm_int_interval = interval_t{number_t{(int)imm}};
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = imm
+                dst_signed = imm_interval;
+                overflow_unsigned(imm_interval, (bin.is64 ? 64 : 32));
+                dst_unsigned = imm_interval;
+                break;
+            }
+            case Op::ADD: {
+                // ra += imm
+                if (imm == 0) {
+                    return;
+                }
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
+                    apply_signed(dst_signed, dst_unsigned, imm_int_interval, finite_width,
+                            interval, Op::ADD);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::SUB: {
+                // ra -= imm
+                if (imm == 0) {
+                    return;
+                }
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
+                    apply_signed(dst_signed, dst_unsigned, imm_int_interval, finite_width,
+                            interval, Op::SUB);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::MUL: {
+                // ra *= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_signed(dst_signed, dst_unsigned, imm_interval, finite_width, dst_signed,
+                            Op::MUL);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::UDIV: {
+                // ra /= imm
+                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, imm_interval, finite_width,
+                            dst_unsigned, Op::UDIV);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::UMOD: {
+                // ra %= imm
+                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, imm_interval, finite_width,
+                            dst_unsigned, Op::UMOD);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::AND: {
+                // ra &= imm
+                // might or might not be needed, but some case occurred where left was negative
+                dst_unsigned = dst_unsigned.truncate_to_uint(finite_width);
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
+                            dst_unsigned, Op::AND);
+                    if ((int32_t)imm > 0) {
+                        // AND with immediate is only a 32-bit operation so svalue and uvalue
+                        // are the same.
+                        dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
+                        dst_unsigned = dst_unsigned & interval_t{number_t{0}, number_t{imm}};
+                    }
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::OR: {
+                // ra |= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
+                            dst_unsigned, Op::OR);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::XOR: {
+                // ra ^= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
+                            dst_unsigned, Op::XOR);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::LSH: {
+                // ra <<= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    shl(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::RSH: {
+                // ra >>= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    lshr(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::ARSH: {
+                // ra >>>= imm
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    ashr(dst_register, interval_t{number_t{(int32_t)imm}}, finite_width,
+                            dst_signed, dst_unsigned, loc);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            default: {
+                break;
+            }
+        }
+    }
+    else {
+        if (!src_signed_interval_opt || !src_unsigned_interval_opt) {
+            operator-=(dst_register);
+            return;
+        }
+        interval_t src_signed = *src_signed_interval_opt;
+        interval_t src_unsigned = *src_unsigned_interval_opt;
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = rb
+                dst_signed = src_signed;
+                dst_unsigned = src_unsigned;
+                break;
+            }
+            case Op::ADD: {
+                // ra += rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
+                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, interval,
+                            Op::ADD);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::SUB: {
+                // ra -= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
+                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, interval,
+                            Op::SUB);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::MUL: {
+                // ra *= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, dst_signed,
+                            Op::MUL);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::UDIV: {
+                // ra /= rb
+                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
+                            dst_unsigned, Op::UDIV);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::UMOD: {
+                // ra %= rb
+                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
+                            dst_unsigned, Op::UMOD);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::AND: {
+                // ra &= rb
+                // might or might not be needed
+                dst_unsigned = dst_unsigned.truncate_to_uint(finite_width);
+                src_unsigned = src_unsigned.truncate_to_uint(finite_width);
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
+                            dst_unsigned, Op::AND);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::OR: {
+                // ra |= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
+                            dst_unsigned, Op::OR);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::XOR: {
+                // ra ^= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
+                            dst_unsigned, Op::XOR);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::LSH: {
+                // ra <<= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    if (std::optional<number_t> sn = src_unsigned.singleton()) {
+                        uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
+                        if (imm <= INT32_MAX) {
+                            if (!bin.is64) {
+                                // Use only the low 32 bits of the value.
+                                dst_signed = dst_signed & interval_t{number_t{UINT32_MAX}};
+                                dst_unsigned = dst_unsigned & interval_t{number_t{UINT32_MAX}};
+                            }
+                            shl(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                            break;
+                        }
+                    }
+                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, 64,
+                            dst_unsigned, Op::LSH);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::RSH: {
+                // ra >>= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    if (std::optional<number_t> sn = src_unsigned.singleton()) {
+                        uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
+                        if (imm <= INT32_MAX) {
+                            if (!bin.is64) {
+                                // Use only the low 32 bits of the value.
+                                dst_signed = dst_signed & interval_t{number_t{UINT32_MAX}};
+                                dst_unsigned = dst_unsigned & interval_t{number_t{UINT32_MAX}};
+                            }
+                            lshr(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                            break;
+                        }
+                    }
+                    dst_signed = interval_t::top();
+                    dst_unsigned = interval_t::top();
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            case Op::ARSH: {
+                // ra >>>= rb
+                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                    ashr(dst_register, src_signed, finite_width, dst_signed, dst_unsigned, loc);
+                }
+                else {
+                    operator-=(dst_register);
+                }
+                break;
+            }
+            default: {
+                break;
+            }
+        }
+    }
+    if (!dst_signed.is_bottom() && !dst_unsigned.is_bottom()) {
+        if (!bin.is64) {
+            apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{UINT32_MAX}},
+                    finite_width, dst_unsigned, Op::AND);
+        }
+        insert_in_registers_signed(dst_register, loc, dst_signed);
+        insert_in_registers_unsigned(dst_register, loc, dst_unsigned);
+    }
+    else {
+        operator-=(dst_register);
+    }
+}
+
+void interval_domain_t::operator()(const Undefined& u, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Bin& b, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Call&, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Exit&, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Jmp&, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Mem&, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const Assert&, location_t loc) {
+    // nothing to do here
+}
+
+void interval_domain_t::operator()(const basic_block_t& bb, int print) {
+    // nothing to do here
+}
+void interval_domain_t::set_require_check(check_require_func_t f) {}
+
+} // namespace crab
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
new file mode 100644
index 000000000..8431f3b3c
--- /dev/null
+++ b/src/crab/interval_domain.hpp
@@ -0,0 +1,139 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "crab/common.hpp"
+#include "crab/signed_interval_domain.hpp"
+#include "crab/unsigned_interval_domain.hpp"
+
+namespace crab {
+
+class interval_domain_t final {
+    signed_interval_domain_t m_signed;
+    unsigned_interval_domain_t m_unsigned;
+    std::vector<std::string> m_errors;
+    bool m_is_bottom = false;
+
+  public:
+
+    interval_domain_t() = default;
+    interval_domain_t(interval_domain_t&& o) = default;
+    interval_domain_t(const interval_domain_t& o) = default;
+    explicit interval_domain_t(signed_interval_domain_t&& signed_domain,
+            unsigned_interval_domain_t&& unsigned_domain, bool is_bottom = false) :
+        m_signed(std::move(signed_domain)), m_unsigned(std::move(unsigned_domain)),
+        m_is_bottom(is_bottom) {}
+    interval_domain_t& operator=(interval_domain_t&& o) = default;
+    interval_domain_t& operator=(const interval_domain_t& o) = default;
+    // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+    static interval_domain_t setup_entry();
+    // bottom/top
+    static interval_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    void set_registers_to_bottom();
+    void set_registers_to_top();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const interval_domain_t& other) const;
+    // join
+    void operator|=(const interval_domain_t& abs);
+    void operator|=(interval_domain_t&& abs);
+    interval_domain_t operator|(const interval_domain_t& other) const;
+    interval_domain_t operator|(interval_domain_t&& abs) const;
+    // meet
+    interval_domain_t operator&(const interval_domain_t& other) const;
+    // widening
+    interval_domain_t widen(const interval_domain_t& other, bool);
+    // narrowing
+    interval_domain_t narrow(const interval_domain_t& other) const;
+    void operator-=(register_t reg);
+
+    //// abstract transformers
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const basic_block_t& bb, int print = 0);
+    void write(std::ostream& os) const {}
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t&);
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
+
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, location_t);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
+    void do_call(const Call&, const stack_cells_t&, location_t);
+    void do_bin(const Bin&, const std::optional<interval_t>&,
+            const std::optional<interval_t>&, const std::optional<ptr_or_mapfd_t>&,
+            const std::optional<interval_t>&, const std::optional<interval_t>&,
+            const std::optional<ptr_or_mapfd_t>&, const interval_t&, location_t);
+    void check_valid_access(const ValidAccess&, interval_t&&, int = -1, bool = false);
+    void assume_cst(Condition::Op, bool, register_t, Value, location_t);
+    void assume_signed_cst(Condition::Op, bool, const interval_t&, const interval_t&,
+            const interval_t&, const interval_t&, register_t, Value, location_t);
+    void assume_signed_lt(bool, bool, interval_t&&, interval_t&&, const interval_t&,
+            const interval_t&, const interval_t&, const interval_t&, register_t, Value, location_t);
+    void assume_signed_gt(bool, bool, interval_t&&, interval_t&&, const interval_t&,
+            const interval_t&, const interval_t&, const interval_t&, register_t, Value, location_t);
+    void assume_unsigned_cst(Condition::Op, bool, const interval_t&, const interval_t&,
+            const interval_t&, const interval_t&, register_t, Value, location_t);
+    void assume_unsigned_lt(bool, bool, interval_t&&, interval_t&&, const interval_t&,
+            const interval_t&, const interval_t&, const interval_t&, register_t, Value, location_t);
+    void assume_unsigned_gt(bool, bool, interval_t&&, interval_t&&, const interval_t&,
+            const interval_t&, const interval_t&, const interval_t&, register_t, Value, location_t);
+    void update_gt(bool, bool, interval_t&&, interval_t&&, const interval_t&, const interval_t&,
+            const interval_t&, const interval_t&, register_t, Value, location_t,
+            interval_t&&, interval_t&&, bool, bool, bool, bool);
+    void update_lt(bool, bool, interval_t&&, interval_t&&, const interval_t&, const interval_t&,
+            const interval_t&, const interval_t&, register_t, Value, location_t,
+            interval_t&&, interval_t&&, bool, bool, bool, bool);
+    std::optional<mock_interval_t> find_interval_value(register_t) const;
+    std::optional<mock_interval_t> find_signed_interval_value(register_t) const;
+    std::optional<mock_interval_t> find_unsigned_interval_value(register_t) const;
+    std::optional<mock_interval_t> find_signed_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<mock_interval_t> find_unsigned_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<interval_cells_t> find_in_stack_signed(uint64_t) const;
+    std::optional<interval_cells_t> find_in_stack_unsigned(uint64_t) const;
+    void insert_in_registers(register_t, location_t, interval_t);
+    void insert_in_registers_signed(register_t, location_t, interval_t);
+    void insert_in_registers_unsigned(register_t, location_t, interval_t);
+    void store_in_stack(uint64_t, mock_interval_t, int);
+    void store_in_stack_signed(uint64_t, mock_interval_t, int);
+    void store_in_stack_unsigned(uint64_t, mock_interval_t, int);
+    void adjust_bb_for_types(location_t);
+    std::vector<uint64_t> get_stack_keys() const;
+    bool all_numeric_in_stack(uint64_t, int) const;
+    std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
+    void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    [[nodiscard]] std::vector<std::string>& get_errors() {
+        operator+=(m_signed.get_errors());
+        operator+=(m_unsigned.get_errors());
+        return m_errors;
+    }
+    void reset_errors() { 
+        m_errors.clear();
+        m_signed.reset_errors();
+        m_unsigned.reset_errors();
+    }
+    void operator+=(std::vector<std::string>& errs) {
+        m_errors.insert(m_errors.end(), errs.begin(), errs.end());
+    }
+
+  private:
+    void scratch_caller_saved_registers();
+    bool load_from_stack(register_t, interval_t, int, location_t);
+    void store_in_stack(const Mem&, uint64_t, int);
+}; // end interval_domain_t
+
+} // namespace crab
diff --git a/src/crab/interval_prop_domain.cpp b/src/crab/interval_prop_domain.cpp
deleted file mode 100644
index 67c9a4d59..000000000
--- a/src/crab/interval_prop_domain.cpp
+++ /dev/null
@@ -1,1171 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-
-#include "crab/interval_prop_domain.hpp"
-#include "boost/endian/conversion.hpp"
-
-namespace crab {
-
-bool registers_cp_state_t::is_bottom() const {
-    return m_is_bottom;
-}
-
-bool registers_cp_state_t::is_top() const {
-    if (m_is_bottom) return false;
-    if (m_interval_env == nullptr) return true;
-    for (auto it : m_cur_def) {
-        if (it != nullptr) return false;
-    }
-    return true;
-}
-
-void registers_cp_state_t::set_to_top() {
-    m_interval_env = std::make_shared<global_interval_env_t>();
-    m_cur_def = live_registers_t{nullptr};
-    m_is_bottom = false;
-}
-
-void registers_cp_state_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-void registers_cp_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
-    auto reg_with_loc = reg_with_loc_t{reg, loc};
-    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
-}
-
-std::optional<mock_interval_t> registers_cp_state_t::find(reg_with_loc_t reg) const {
-    auto it = m_interval_env->find(reg);
-    if (it == m_interval_env->end()) return {};
-    return it->second;
-}
-
-std::optional<mock_interval_t> registers_cp_state_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
-    return find(reg);
-}
-
-registers_cp_state_t registers_cp_state_t::operator|(const registers_cp_state_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    } else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    auto intervals_env = std::make_shared<global_interval_env_t>();
-    registers_cp_state_t intervals_joined(intervals_env);
-    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
-        if (it1 && it2) {
-            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
-            intervals_joined.insert(register_t{i}, loc,
-                    std::move(interval1 | interval2));
-        }
-    }
-    return intervals_joined;
-}
-
-void registers_cp_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
-        if (auto it = find(register_t{i})) {
-            insert(register_t{i}, loc, it->to_interval());
-        }
-    }
-}
-
-void registers_cp_state_t::operator-=(register_t var) {
-    if (is_bottom()) return;
-    m_cur_def[var] = nullptr;
-}
-
-void registers_cp_state_t::scratch_caller_saved_registers() {
-    for (uint8_t i = R1_ARG; i <= R5_ARG; i++) {
-        operator-=(register_t{i});
-    }
-}
-
-bool stack_cp_state_t::is_bottom() const {
-    return m_is_bottom;
-}
-
-bool stack_cp_state_t::is_top() const {
-    if (m_is_bottom) return false;
-    return m_interval_values.empty();
-}
-
-void stack_cp_state_t::set_to_top() {
-    m_interval_values.clear();
-    m_is_bottom = false;
-}
-
-void stack_cp_state_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-stack_cp_state_t stack_cp_state_t::top() {
-    return stack_cp_state_t(false);
-}
-
-std::optional<interval_cells_t> stack_cp_state_t::find(uint64_t key) const {
-    auto it = m_interval_values.find(key);
-    if (it == m_interval_values.end()) return {};
-    return it->second;
-}
-
-void stack_cp_state_t::store(uint64_t key, mock_interval_t val, int width) {
-    m_interval_values[key] = std::make_pair(val, width);
-}
-
-void stack_cp_state_t::operator-=(uint64_t key) {
-    auto it = find(key);
-    if (it)
-        m_interval_values.erase(key);
-}
-
-bool stack_cp_state_t::all_numeric(uint64_t start_loc, int width) const {
-    auto overlapping_cells = find_overlapping_cells(start_loc, width);
-    if (overlapping_cells.empty()) return false;
-    for (std::size_t i = 0; i < overlapping_cells.size()-1; i++) {
-        int width_i = find(overlapping_cells[i]).value().second;
-        if (overlapping_cells[i]+width_i != overlapping_cells[i+1]) return false;
-    }
-    return true;
-}
-
-void stack_cp_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
-    for (auto& key : keys) {
-        auto type = find(key);
-        auto width_key = type.value().second;
-        if (key < start) {
-            int new_width = start-key;
-            store(key, interval_t::top(), new_width);
-        }
-        if (key+width_key > start+width) {
-            int new_width = key+width_key-(start+width);
-            store(start+width, interval_t::top(), new_width);
-        }
-        if (key >= start) *this -= key;
-    }
-}
-
-std::vector<uint64_t> stack_cp_state_t::find_overlapping_cells(uint64_t start, int width) const {
-    std::vector<uint64_t> overlapping_cells;
-    auto it = m_interval_values.begin();
-    while (it != m_interval_values.end() && it->first < start) {
-        it++;
-    }
-    if (it != m_interval_values.begin()) {
-        it--;
-        auto key = it->first;
-        auto width_key = it->second.second;
-        if (key < start && key+width_key > start) overlapping_cells.push_back(key);
-    }
-
-    for (; it != m_interval_values.end(); it++) {
-        auto key = it->first;
-        if (key >= start && key < start+width) overlapping_cells.push_back(key);
-        if (key >= start+width) break;
-    }
-    return overlapping_cells;
-}
-
-void join_stack(const stack_cp_state_t& stack1, uint64_t key1, int& loc1,
-        const stack_cp_state_t& stack2, uint64_t key2, int& loc2,
-        interval_values_stack_t& interval_values_joined) {
-    auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
-    auto& cells1 = type1.value();   auto& cells2 = type2.value();
-    int width1 = cells1.second; int width2 = cells2.second;
-    auto interval1 = cells1.first.to_interval();
-    auto interval2 = cells2.first.to_interval();
-    auto top_interval_mock = mock_interval_t(interval_t::top());
-    if (key1 == key2) {
-        if (width1 == width2) {
-            interval_values_joined[key1] = std::make_pair(
-                    mock_interval_t(interval1 | interval2), width1);
-            loc1++; loc2++;
-        }
-        else if (width1 < width2) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
-            loc1++;
-        }
-        else {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
-            loc2++;
-        }
-    }
-    else if (key1 > key2) {
-        if (key2+width2 > key1+width1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
-            loc1++;
-        }
-        else if (key2+width2 > key1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
-            loc2++;
-        }
-        else loc2++;
-    }
-    else {
-        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
-    }
-}
-
-stack_cp_state_t stack_cp_state_t::operator|(const stack_cp_state_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    } else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    interval_values_stack_t interval_values_joined;
-    auto stack1_keys = get_keys();
-    auto stack2_keys = other.get_keys();
-    int i = 0, j = 0;
-    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
-        int key1 = stack1_keys[i], key2 = stack2_keys[j];
-        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
-    }
-    return stack_cp_state_t(std::move(interval_values_joined));
-}
-
-size_t stack_cp_state_t::size() const {
-    return m_interval_values.size();
-}
-
-std::vector<uint64_t> stack_cp_state_t::get_keys() const {
-    std::vector<uint64_t> keys;
-    keys.reserve(size());
-
-    for (auto const&kv : m_interval_values) {
-        keys.push_back(kv.first);
-    }
-    return keys;
-}
-
-bool interval_prop_domain_t::is_bottom() const {
-    if (m_is_bottom) return true;
-    return (m_registers_interval_values.is_bottom() || m_stack_slots_interval_values.is_bottom());
-}
-
-bool interval_prop_domain_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_registers_interval_values.is_top() && m_stack_slots_interval_values.is_top());
-}
-
-interval_prop_domain_t interval_prop_domain_t::bottom() {
-    interval_prop_domain_t cp;
-    cp.set_to_bottom();
-    return cp;
-}
-
-void interval_prop_domain_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-void interval_prop_domain_t::set_to_top() {
-    m_registers_interval_values.set_to_top();
-    m_stack_slots_interval_values.set_to_top();
-}
-
-std::optional<mock_interval_t> interval_prop_domain_t::find_interval_value(register_t reg) const {
-    return m_registers_interval_values.find(reg);
-}
-
-std::optional<mock_interval_t> interval_prop_domain_t::find_interval_at_loc(
-        const reg_with_loc_t reg) const {
-    return m_registers_interval_values.find(reg);
-}
-
-void interval_prop_domain_t::insert_in_registers(register_t reg, location_t loc,
-        interval_t interval) {
-    m_registers_interval_values.insert(reg, loc, interval);
-}
-
-void interval_prop_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
-    m_stack_slots_interval_values.store(key, interval, width);
-}
-
-bool interval_prop_domain_t::operator<=(const interval_prop_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
-}
-
-void interval_prop_domain_t::operator|=(const interval_prop_domain_t& abs) {
-    interval_prop_domain_t tmp{abs};
-    operator|=(std::move(tmp));
-}
-
-void interval_prop_domain_t::operator|=(interval_prop_domain_t&& abs) {
-    if (is_bottom()) {
-        *this = abs;
-        return;
-    }
-    *this = *this | std::move(abs);
-}
-
-interval_prop_domain_t interval_prop_domain_t::operator|(const interval_prop_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    return interval_prop_domain_t(m_registers_interval_values | other.m_registers_interval_values,
-            m_stack_slots_interval_values | other.m_stack_slots_interval_values);
-}
-
-interval_prop_domain_t interval_prop_domain_t::operator|(interval_prop_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
-        return std::move(other);
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    return interval_prop_domain_t(
-            m_registers_interval_values | std::move(other.m_registers_interval_values),
-            m_stack_slots_interval_values | std::move(other.m_stack_slots_interval_values));
-}
-
-interval_prop_domain_t interval_prop_domain_t::operator&(const interval_prop_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
-}
-
-interval_prop_domain_t interval_prop_domain_t::widen(const interval_prop_domain_t& abs, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
-}
-
-interval_prop_domain_t interval_prop_domain_t::narrow(const interval_prop_domain_t& other) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return other;
-}
-
-void interval_prop_domain_t::write(std::ostream& os) const {}
-
-crab::bound_t interval_prop_domain_t::get_loop_count_upper_bound() {
-    /* WARNING: The operation is not implemented yet.*/
-    return crab::bound_t{crab::number_t{0}};
-}
-
-void interval_prop_domain_t::initialize_loop_counter(const label_t& label) {
-    /* WARNING: The operation is not implemented yet.*/
-}
-
-string_invariant interval_prop_domain_t::to_set() {
-    return string_invariant{};
-}
-
-interval_prop_domain_t interval_prop_domain_t::setup_entry() {
-    registers_cp_state_t registers(std::make_shared<global_interval_env_t>());
-    interval_prop_domain_t cp(std::move(registers), stack_cp_state_t::top());
-    return cp;
-}
-
-void interval_prop_domain_t::operator()(const Un& u, location_t loc) {
-    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
-        if (std::optional<number_t> n = v.singleton()) {
-            if (n->fits_cast_to_int64()) {
-                input = (decltype(input))n.value().cast_to_sint64();
-                decltype(input) output = be_or_le(input);
-                m_registers_interval_values.insert(u.dst.v, loc, interval_t{number_t{output}});
-                return;
-            }
-        }
-        m_registers_interval_values.insert(u.dst.v, loc, interval_t::top());
-    };
-
-    auto mock_interval = m_registers_interval_values.find(u.dst.v);
-    if (!mock_interval) return;
-    interval_t interval = mock_interval->to_interval();
-
-    // Swap bytes.  For 64-bit types we need the weights to fit in a
-    // signed int64, but for smaller types we don't want sign extension,
-    // so we use unsigned which still fits in a signed int64.
-    switch (u.op) {
-    case Un::Op::BE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_big<uint16_t>);
-        break;
-    case Un::Op::BE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_big<uint32_t>);
-        break;
-    case Un::Op::BE64:
-        swap_endianness(std::move(interval), int64_t(0),
-                boost::endian::native_to_big<int64_t>);
-        break;
-    case Un::Op::LE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_little<uint16_t>);
-        break;
-    case Un::Op::LE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_little<uint32_t>);
-        break;
-    case Un::Op::LE64:
-        swap_endianness(std::move(interval), int64_t(0),
-                boost::endian::native_to_little<int64_t>);
-        break;
-    case Un::Op::NEG:
-        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
-        m_registers_interval_values.insert(u.dst.v, loc, -interval);
-        break;
-    }
-}
-
-void interval_prop_domain_t::operator()(const LoadMapFd &u, location_t loc) {
-    m_registers_interval_values -= u.dst.v;
-}
-
-void interval_prop_domain_t::operator()(const ValidSize& s, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
-        location_t loc) {
-
-    for (const auto& kv : store_in_stack) {
-        auto offset = kv.first;
-        auto width = kv.second;
-        auto overlapping_cells
-            = m_stack_slots_interval_values.find_overlapping_cells(offset, width);
-        m_stack_slots_interval_values.remove_overlap(overlapping_cells, offset, width);
-        m_stack_slots_interval_values.store(offset, interval_t::top(), width);
-    }
-    auto r0 = register_t{R0_RETURN_VALUE};
-    if (u.is_map_lookup) {
-        m_registers_interval_values -= r0;
-    }
-    else {
-        m_registers_interval_values.insert(r0, loc, interval_t::top());
-    }
-    m_registers_interval_values.scratch_caller_saved_registers();
-}
-
-void interval_prop_domain_t::operator()(const Packet& u, location_t loc) {
-    auto r0 = register_t{R0_RETURN_VALUE};
-    m_registers_interval_values.insert(r0, loc, interval_t::top());
-    m_registers_interval_values.scratch_caller_saved_registers();
-}
-
-void interval_prop_domain_t::assume_lt(bool strict,
-        interval_t&& left_interval, interval_t&& right_interval,
-        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc, bool is_signed) {
-    auto rlb = right_interval.lb();
-    auto rub = right_interval.ub();
-    auto llb = left_interval.lb();
-    auto lub = left_interval.ub();
-    auto rlb_orig = right_interval_orig.lb();
-    auto rub_orig = right_interval_orig.ub();
-    auto llb_orig = left_interval_orig.lb();
-    auto lub_orig = left_interval_orig.ub();
-
-    if (strict ? llb < rlb : llb <= rlb && lub >= rlb) {
-        auto lb = is_signed ? llb_orig : number_t{0};
-        auto interval_to_insert = interval_t(lb, strict ? rlb - number_t{1} : rlb);
-        m_registers_interval_values.insert(left, loc, interval_to_insert);
-    }
-    else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub &&
-            std::holds_alternative<Reg>(right)) {
-        auto right_reg = std::get<Reg>(right).v;
-        auto interval_to_insert = interval_t(strict ? lub + number_t{1} : lub, rub_orig);
-        m_registers_interval_values.insert(right_reg, loc, interval_to_insert);
-    }
-    else if (lub >= rub && strict ? llb < rub : llb <= rub) {
-        auto lb = is_signed ? llb_orig : number_t{0};
-        auto interval_to_insert_left = interval_t(lb, strict ? rub - number_t{1} : rub);
-        m_registers_interval_values.insert(left, loc, interval_to_insert_left);
-        // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
-        // and set left to the rest of the interval < (or <=) of right
-        // a more sound analysis is needed
-        if (std::holds_alternative<Reg>(right)) {
-            auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg, loc, interval_t{rub});
-        }
-    }
-    else {
-        // TODO: verify if any legitimate case can fall into here
-        m_registers_interval_values.set_to_bottom();
-    }
-}
-
-void interval_prop_domain_t::assume_gt(bool strict,
-        interval_t&& left_interval, interval_t&& right_interval,
-        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc) {
-    auto rlb = right_interval.lb();
-    auto rub = right_interval.ub();
-    auto llb = left_interval.lb();
-    auto lub = left_interval.ub();
-    auto rlb_orig = right_interval_orig.lb();
-    auto rub_orig = right_interval_orig.ub();
-    auto llb_orig = left_interval_orig.lb();
-    auto lub_orig = left_interval_orig.ub();
-
-    if (strict ? lub > rub : lub >= rub && llb <= rub) {
-        auto interval_to_insert = interval_t(strict ? rub + number_t{1} : rub, lub_orig);
-        m_registers_interval_values.insert(left, loc, interval_to_insert);
-    }
-    else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb &&
-            std::holds_alternative<Reg>(right)) {
-        auto right_reg = std::get<Reg>(right).v;
-        auto interval_to_insert = interval_t(rlb_orig, strict ? llb - number_t{1} : llb);
-        m_registers_interval_values.insert(right_reg, loc, interval_to_insert);
-    }
-    else if (llb <= rlb && strict ? lub > rlb : lub >= rlb) {
-        auto interval_to_insert_left = interval_t(strict ? rlb + number_t{1} : rlb, lub_orig);
-        m_registers_interval_values.insert(left, loc, interval_to_insert_left);
-        // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
-        // and set left to the rest of the interval > (or >=) of right
-        // a more sound analysis is needed
-        if (std::holds_alternative<Reg>(right)) {
-            auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg, loc, interval_t{rlb});
-        }
-    }
-    else {
-        // TODO: verify if any legitimate case can fall into here
-        m_registers_interval_values.set_to_bottom();
-    }
-}
-
-void interval_prop_domain_t::assume_gt_and_lt(bool is64, bool strict, bool is_lt,
-        interval_t&& left_interval, interval_t&& right_interval,
-        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc, bool is_signed) {
-
-    auto llb = left_interval.lb();
-    auto lub = left_interval.ub();
-    auto rlb = right_interval.lb();
-    auto rub = right_interval.ub();
-    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
-        // Left unsigned interval is lower than right unsigned interval.
-        m_registers_interval_values.set_to_bottom();
-        return;
-    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
-        // Left unsigned interval is higher than right unsigned interval.
-        m_registers_interval_values.set_to_bottom();
-        return;
-    }
-    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
-        // Left unsigned interval is lower than right unsigned interval.
-        // TODO: verify if setting to top is the correct equivalent of returning linear cst true
-        m_registers_interval_values.set_to_top();
-        return;
-    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
-        // Left unsigned interval is higher than right unsigned interval.
-        m_registers_interval_values.set_to_top();
-        return;
-    } else if (left_interval_orig.is_top() && right_interval_orig.is_top()) {
-        m_registers_interval_values.insert(left, loc, interval_t::top());
-        if (std::holds_alternative<Reg>(right)) {
-            auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg, loc, interval_t::top());
-        }
-        return;
-    }
-
-    if (is_lt)
-        assume_lt(strict, std::move(left_interval), std::move(right_interval),
-                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc,
-                is_signed);
-    else
-        assume_gt(strict, std::move(left_interval), std::move(right_interval),
-                std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc);
-}
-
-void interval_prop_domain_t::assume_unsigned_cst_interval(Condition::Op op, bool is64,
-        interval_t&& left_interval, interval_t&& right_interval,
-        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc) {
-
-    for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::unsigned_int(is64))) {
-            *interval = interval->truncate_to_uint(is64);
-        }
-    }
-
-    // Handle uvalue != right.
-    if (op == Condition::Op::NE) {
-        if (auto rn = right_interval.singleton()) {
-            if (rn == left_interval.truncate_to_uint(is64).lb().number()) {
-                // "NE lower bound" is equivalent to "GT lower bound".
-                op = Condition::Op::GT;
-                right_interval = interval_t{left_interval.lb()};
-            } else if (rn == left_interval.ub().number()) {
-                // "NE upper bound" is equivalent to "LT upper bound".
-                op = Condition::Op::LT;
-                right_interval = interval_t{left_interval.ub()};
-            } else {
-                return;
-            }
-        } else {
-            return;
-        }
-    }
-
-    const bool is_lt = op == Condition::Op::LT || op == Condition::Op::LE;
-    bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
-
-    assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
-            std::move(left_interval_orig), std::move(right_interval_orig), left, right, loc,
-            false);
-}
-
-void interval_prop_domain_t::assume_signed_cst_interval(Condition::Op op, bool is64,
-        interval_t&& left_interval, interval_t&& right_interval,
-        interval_t&& left_interval_orig, interval_t&& right_interval_orig,
-        register_t left, Value right, location_t loc) {
-
-    for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::signed_int(is64))) {
-            *interval = interval->truncate_to_sint(is64);
-        }
-    }
-
-    if (op == Condition::Op::EQ) {
-        auto eq_interval = right_interval & left_interval;
-        m_registers_interval_values.insert(left, loc, eq_interval);
-        if (std::holds_alternative<Reg>(right)) {
-            auto right_reg = std::get<Reg>(right).v;
-            m_registers_interval_values.insert(right_reg, loc, eq_interval);
-        }
-        return;
-    }
-
-    const bool is_lt = op == Condition::Op::SLT || op == Condition::Op::SLE;
-    bool strict = op == Condition::Op::SLT || op == Condition::Op::SGT;
-
-    assume_gt_and_lt(is64, strict, is_lt, std::move(left_interval), std::move(right_interval),
-            std::move(left_interval_orig), std::move(right_interval_orig),
-            left, right, loc);
-}
-
-void interval_prop_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
-        Value right, interval_t&& left_interval, interval_t&& right_interval, location_t loc) {
-    using Op = Condition::Op;
-    interval_t left_interval_orig = left_interval;
-    interval_t right_interval_orig = right_interval;
-
-    switch (op) {
-        case Op::EQ:
-        case Op::SGE:
-        case Op::SLE:
-        case Op::SGT:
-        case Op::SLT: {
-            assume_signed_cst_interval(op, is64, std::move(left_interval),
-                    std::move(right_interval), std::move(left_interval_orig),
-                    std::move(right_interval_orig), left, right, loc);
-            break;
-        }
-        case Op::SET:
-        case Op::NSET: {
-            // TODO: implement SET and NSET
-            break;
-        }
-        case Op::NE:
-        case Op::GE:
-        case Op::LE:
-        case Op::GT:
-        case Op::LT: {
-            assume_unsigned_cst_interval(op, is64, std::move(left_interval),
-                    std::move(right_interval), std::move(left_interval_orig),
-                    std::move(right_interval_orig), left, right, loc);
-            break;
-        }
-    }
-}
-
-void interval_prop_domain_t::operator()(const Assume& s, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::do_bin(const Bin& bin,
-        const std::optional<interval_t>& src_interval_opt,
-        const std::optional<interval_t>& dst_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
-        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
-        const interval_t& subtract_interval, location_t loc) {
-    using Op = Bin::Op;
-    // if op is not MOV,
-        // we skip handling in this domain is when dst is pointer and src is numerical value
-    if (bin.op != Op::MOV && dst_ptr_or_mapfd_opt && src_interval_opt) return;
-    // if op is MOV,
-        // we skip handling in this domain is when src is pointer,
-        // additionally, we forget the dst pointer
-
-    auto dst_register = register_t{bin.dst.v};
-    if (bin.op == Op::MOV && src_ptr_or_mapfd_opt) {
-        m_registers_interval_values -= dst_register;
-        return;
-    }
-
-    int finite_width = bin.is64 ? 64 : 32;
-    uint64_t imm = std::holds_alternative<Imm>(bin.v) ? std::get<Imm>(bin.v).v : 0;
-    interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
-    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
-    if (dst_interval_opt) dst_interval = std::move(dst_interval_opt.value());
-
-    switch (bin.op)
-    {
-        // ra = b
-        case Op::MOV: {
-            if (src_interval_opt) {
-                dst_interval = src_interval;
-            }
-            else {
-                m_registers_interval_values -= dst_register;
-                return;
-            }
-            break;
-        }
-        // ra += b
-        case Op::ADD: {
-            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) return;
-            if (dst_interval_opt && src_interval_opt)
-                dst_interval += src_interval;
-            else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
-                m_registers_interval_values -= dst_register;
-                return;
-            }
-            break;
-        }
-        // ra -= b
-        case Op::SUB: {
-            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt)
-                dst_interval = subtract_interval;
-            else if (dst_interval_opt && src_interval_opt)
-                dst_interval -= src_interval;
-            else if (dst_interval_opt && src_ptr_or_mapfd_opt) {
-                m_registers_interval_values -= dst_register;
-                return;
-            }
-            break;
-        }
-        // ra *= b
-        case Op::MUL: {
-            dst_interval *= src_interval;
-            break;
-        }
-        // ra /= b
-        case Op::UDIV: {
-            dst_interval /= src_interval;
-            break;
-        }
-        // ra %= b
-        case Op::UMOD: {
-            dst_interval = dst_interval.SRem(src_interval);
-            break;
-        }
-        // ra |= b
-        case Op::OR: {
-            dst_interval = dst_interval.Or(src_interval);
-            break;
-        }
-        // ra &= b
-        case Op::AND: {
-            if ((int32_t)imm > 0) {
-                dst_interval = interval_t(number_t{0}, number_t(static_cast<int>(imm)));
-                break;
-            }
-            if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
-                // TODO: This is only based on observation, need to verify this
-                // This is done because we do not track uvalues and svalues separately
-                // however, current implementation of eBPF using zoneCrab does
-                // this operation mimics uvalue being not set (i.e., TOP)
-                dst_interval = interval_t::top();
-            }
-            if (!(src_interval <= interval_t::unsigned_int(bin.is64))) {
-                // likewise explanation as above
-                src_interval = interval_t::top();
-            }
-            if (imm != 0) {
-                src_interval = interval_t(number_t{(uint64_t)imm});
-            }
-            dst_interval = dst_interval.And(src_interval);
-            break;
-        }
-        // ra <<= b
-        case Op::LSH: {
-            if (imm == 0) {
-                if (std::optional<number_t> sn = src_interval.singleton()) {
-                    // TODO: verify if this is correct
-                    if (bin.is64) {
-                        uint64_t imm_val = sn->cast_to_uint64() & 63;
-                        if (!(imm_val <= INT32_MAX)) return;
-                        imm = (int32_t)imm_val;
-                    }
-                    else {
-                        uint32_t imm_val = sn->cast_to_uint32() & 31;
-                        if (!(imm_val <= INT32_MAX)) return;
-                        imm = (int32_t)imm_val;
-                    }
-                }
-            }
-            if (imm != 0) {
-                // The BPF ISA requires masking the imm.
-                imm &= finite_width - 1;
-                if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
-                    // This is non-standard, but done to mimic uvalue being not set (i.e., TOP)
-                    dst_interval = interval_t::top();
-                }
-                if (dst_interval.finite_size()) {
-                    number_t lb = dst_interval.lb().number().value();
-                    number_t ub = dst_interval.ub().number().value();
-                    uint64_t lb_n = lb.cast_to_uint64();
-                    uint64_t ub_n = ub.cast_to_uint64();
-                    uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
-                    if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
-                        // The bits that will be shifted out to the left are different,
-                        // which means all combinations of remaining bits are possible.
-                        lb_n = 0;
-                        ub_n = (uint_max << imm) & uint_max;
-                    } else {
-                        // The bits that will be shifted out to the left are identical
-                        // for all values in the interval, so we can safely shift left
-                        // to get a new interval.
-                        lb_n = (lb_n << imm) & uint_max;
-                        ub_n = (ub_n << imm) & uint_max;
-                    }
-                    dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
-                }
-            }
-            else {
-                dst_interval = interval_t::top();
-            }
-            break;
-        }
-        // ra >>= b
-        case Op::RSH: {
-            if (imm == 0) {
-                if (std::optional<number_t> sn = src_interval.singleton()) {
-                    // TODO: verify if this is correct
-                    if (bin.is64) {
-                        uint64_t imm_val = sn->cast_to_uint64() & 63;
-                        if (!(imm_val <= INT32_MAX)) return;
-                        imm = (int32_t)imm_val;
-                    }
-                    else {
-                        uint32_t imm_val = sn->cast_to_uint32() & 31;
-                        if (!(imm_val <= INT32_MAX)) return;
-                        imm = (int32_t)imm_val;
-                    }
-                }
-            }
-            if (imm != 0) {
-                imm &= finite_width - 1;
-                number_t lb_n{0};
-                number_t ub_n{UINT64_MAX >> imm};
-                if (!(dst_interval <= interval_t::unsigned_int(bin.is64))) {
-                    // This is done because we do not track uvalues and svalues separately
-                    // however, current implementation of eBPF using zoneCrab does
-                    // this operation mimics uvalue being not set (i.e., TOP)
-                    dst_interval = interval_t::top();
-                }
-                if (dst_interval.finite_size()) {
-                    number_t lb = dst_interval.lb().number().value();
-                    number_t ub = dst_interval.ub().number().value();
-                    if (finite_width == 64) {
-                        lb_n = lb.cast_to_uint64() >> imm;
-                        ub_n = ub.cast_to_uint64() >> imm;
-                    } else {
-                        number_t lb_w = lb.cast_to_signed_finite_width(finite_width);
-                        number_t ub_w = ub.cast_to_signed_finite_width(finite_width);
-                        lb_n = lb_w.cast_to_uint32() >> imm;
-                        ub_n = ub_w.cast_to_uint32() >> imm;
-
-                        // The interval must be valid since a signed range crossing 0
-                        // was earlier converted to a full unsigned range.
-                        assert(lb_n <= ub_n);
-                    }
-                }
-                if ((int64_t)ub_n >= (int64_t)lb_n) {
-                    dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
-                } else {
-                    dst_interval = interval_t::top();
-                }
-            }
-            else {
-                dst_interval = interval_t::top();
-            }
-            break;
-        }
-        // ra >>>= b
-        case Op::ARSH: {
-            for (interval_t* interval : {&dst_interval, &src_interval}) {
-                if (!(*interval <= interval_t::signed_int(finite_width == 64))) {
-                    *interval = interval->truncate_to_sint(finite_width == 64);
-                }
-            }
-
-            if (auto sn = src_interval.singleton()) {
-                // The BPF ISA requires masking the imm.
-                int64_t imm = sn->cast_to_sint64() & (finite_width - 1);
-
-                int64_t lb_n = INT64_MIN >> imm;
-                int64_t ub_n = INT64_MAX >> imm;
-                if (dst_interval.finite_size()) {
-                    number_t lb = dst_interval.lb().number().value();
-                    number_t ub = dst_interval.ub().number().value();
-                    if (finite_width == 64) {
-                        lb_n = lb.cast_to_sint64() >> imm;
-                        ub_n = ub.cast_to_sint64() >> imm;
-                    } else {
-                        number_t lb_w = lb.cast_to_signed_finite_width(finite_width) >> (int)imm;
-                        number_t ub_w = ub.cast_to_signed_finite_width(finite_width) >> (int)imm;
-                        if (lb_w.cast_to_uint32() <= ub_w.cast_to_uint32()) {
-                            lb_n = lb_w.cast_to_uint32();
-                            ub_n = ub_w.cast_to_uint32();
-                        }
-                    }
-                }
-                dst_interval = interval_t(number_t{lb_n}, number_t{ub_n});
-            }
-            else {
-                dst_interval = interval_t::top();
-            }
-            break;
-        }
-        // ra ^= b
-        case Op::XOR: {
-            dst_interval = dst_interval.Xor(src_interval);
-            break;
-        }
-        default: {
-            dst_interval = interval_t::bottom();
-            break;
-        }
-    }
-    m_registers_interval_values.insert(dst_register, loc, dst_interval);
-}
-
-
-void interval_prop_domain_t::do_load(const Mem& b, const register_t& target_register,
-        std::optional<ptr_or_mapfd_t> basereg_type, bool load_in_region, location_t loc) {
-
-    if (!basereg_type) {
-        m_registers_interval_values -= target_register;
-        return;
-    }
-
-    // we check if we already loaded a pointer from ctx or stack in region domain,
-        // we then do not store a number
-    if (load_in_region) {
-        m_registers_interval_values -= target_register;
-        return;
-    }
-    int width = b.access.width;
-    int offset = b.access.offset;
-    auto basereg_ptr_or_mapfd_type = basereg_type.value();
-
-    if (is_ctx_ptr(basereg_type)) {
-        m_registers_interval_values.insert(target_register, loc, interval_t::top());
-        return;
-    }
-    if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
-        interval_t to_insert = interval_t::top();
-        if (width == 1) to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
-        else if (width == 2) to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
-        m_registers_interval_values.insert(target_register, loc, to_insert);
-        return;
-    }
-
-    if (is_stack_ptr(basereg_type)) {
-        auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
-        auto p_offset = ptr_with_off.get_offset();
-        auto load_at = p_offset.to_interval() + interval_t(number_t{offset});
-        uint64_t start_offset = 0;
-        if (auto load_at_singleton = load_at.singleton()) {
-            start_offset = (uint64_t)(*load_at_singleton);
-            if (auto loaded = m_stack_slots_interval_values.find(start_offset)) {
-                m_registers_interval_values.insert(target_register, loc,
-                        (*loaded).first.to_interval());
-                return;
-            }
-        }
-        else {
-            auto load_at_lb = load_at.lb();
-            auto load_at_ub = load_at.ub();
-            if (auto finite_size = load_at.finite_size()) {
-                if (auto load_at_lb = load_at.lb().number()) {
-                    start_offset = (uint64_t)(*load_at_lb);
-                    width = (int)(*finite_size + number_t{width});
-                }
-            }
-        }
-        if (m_stack_slots_interval_values.all_numeric(start_offset, width)) {
-            m_registers_interval_values.insert(target_register, loc, interval_t::top());
-            return;
-        }
-    }
-    m_registers_interval_values -= target_register;
-}
-
-void interval_prop_domain_t::do_mem_store(const Mem& b,
-        std::optional<ptr_or_mapfd_t> basereg_type) {
-    int offset = b.access.offset;
-    int width = b.access.width;
-
-    if (!is_stack_ptr(basereg_type)) {
-        // we only store for stack pointers
-        return;
-    }
-
-    auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(*basereg_type);
-    auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
-    if (!offset_singleton) {
-        //std::cout << "type error: doing a store with unknown offset\n";
-        m_errors.push_back("doing a store with unknown offset");
-        return;
-    }
-    auto store_at = (uint64_t)(*offset_singleton + offset);
-    auto overlapping_cells = m_stack_slots_interval_values.find_overlapping_cells(store_at, width);
-    m_stack_slots_interval_values.remove_overlap(overlapping_cells, store_at, width);
-
-    std::optional<interval_t> targetreg_type;
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto target_reg = std::get<Reg>(b.value);
-        if (auto targetreg_mock_interval = m_registers_interval_values.find(target_reg.v)) {
-            targetreg_type = targetreg_mock_interval->to_interval();
-        }
-    }
-    else {
-        auto imm = static_cast<int64_t>(std::get<Imm>(b.value).v);
-        targetreg_type = interval_t(number_t{imm});
-    }
-
-    // if targetreg_type is empty, we are storing a pointer
-    // else, we store a number
-    if (targetreg_type)
-        m_stack_slots_interval_values.store(store_at, *targetreg_type, width);
-}
-
-void interval_prop_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
-        int width, bool check_stack_all_numeric) {
-
-    if (check_stack_all_numeric) {
-        auto start_interval = interval + interval_t{number_t{s.offset}};
-        if (auto finite_size = start_interval.finite_size()) {
-            if (auto start_interval_lb = start_interval.lb().number()) {
-                auto start_offset = (uint64_t)(*start_interval_lb);
-                int width_from_start = (int)(*finite_size) + width;
-                if (!m_stack_slots_interval_values.all_numeric(start_offset, width_from_start)) {
-                    m_errors.push_back("Stack access not numeric");
-                }
-            }
-            else {
-                m_errors.push_back("Offset information not available");
-            }
-        }
-        else {
-            m_errors.push_back("Register interval not finite for stack access");
-        }
-    }
-    else {
-        bool is_comparison_check = s.width == (Value)Imm{0};
-        if (!is_comparison_check) {
-            if (s.or_null) {
-                if (auto singleton = interval.singleton()) {
-                    if (*singleton == number_t{0}) return;
-                }
-                m_errors.push_back("Non-null number");
-            }
-            else {
-                m_errors.push_back("Only pointers can be dereferenced");
-            }
-        }
-    }
-}
-
-void interval_prop_domain_t::operator()(const ValidAccess& s, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Undefined& u, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Bin& b, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Call&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Exit&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Jmp&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Mem&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Assert&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Comparable&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const Addable&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const ValidStore&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const TypeConstraint&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const ValidMapKeyValue&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const ZeroCtxOffset&, location_t loc) {
-    // nothing to do here
-}
-
-void interval_prop_domain_t::operator()(const basic_block_t& bb, int print) {
-    // nothing to do here
-}
-void interval_prop_domain_t::set_require_check(check_require_func_t f) {}
-
-std::optional<interval_cells_t> interval_prop_domain_t::find_in_stack(uint64_t key) const {
-    return m_stack_slots_interval_values.find(key);
-}
-
-void interval_prop_domain_t::adjust_bb_for_types(location_t loc) {
-    m_registers_interval_values.adjust_bb_for_registers(loc);
-}
-
-std::vector<uint64_t> interval_prop_domain_t::get_stack_keys() const {
-    return m_stack_slots_interval_values.get_keys();
-}
-
-bool interval_prop_domain_t::all_numeric_in_stack(uint64_t start_loc, int width) const {
-    return m_stack_slots_interval_values.all_numeric(start_loc, width);
-}
-
-std::vector<uint64_t> interval_prop_domain_t::find_overlapping_cells_in_stack(uint64_t start_loc,
-        int width) const {
-    return m_stack_slots_interval_values.find_overlapping_cells(start_loc, width);
-}
-
-void interval_prop_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
-        uint64_t start_loc, int width) {
-    m_stack_slots_interval_values.remove_overlap(overlap, start_loc, width);
-}
-
-} // namespace crab
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 9a03bfd1e..f9e88229a 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -601,141 +601,158 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
     else {}     //we do not need to deal with other cases
 }
 
-void offset_domain_t::update_offset_info(const dist_t&& dist, const interval_t&& change,
-        const location_t& loc, uint8_t reg, Bin::Op op) {
+void offset_domain_t::update_offset_info(dist_t&& dist, interval_t&& change,
+        const location_t& loc, register_t reg) {
     auto offset = dist.m_dist;
-    if (op == Bin::Op::ADD) {
-        if (dist.is_forward_pointer()) offset += change;
-        else if (dist.is_backward_pointer()) offset -= change;
-        else offset -= change;
-    }
-    else if (op == Bin::Op::SUB) {
-        // TODO: needs precise handling of subtraction
-        offset = interval_t::top();
-    }
-    m_reg_state.insert(reg, loc, dist_t(offset));
+    if (dist.is_forward_pointer()) offset += change;
+    else if (dist.is_backward_pointer()) offset -= change;
+    else offset -= change;
+    m_reg_state.insert(reg, loc, dist_t{offset});
 }
 
-interval_t offset_domain_t::do_bin(const Bin &bin,
-        const std::optional<interval_t>& src_interval_opt,
-        const std::optional<interval_t>& dst_interval_opt,
-        std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
-        std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
+interval_t offset_domain_t::do_bin(const Bin& bin,
+        const std::optional<interval_t>& src_signed_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        const std::optional<interval_t>& dst_signed_interval_opt,
+        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
 
-    using Op = Bin::Op;
-    // if both src and dst are numbers, nothing to do in offset domain
-    // if we are doing a move, where src is a number and dst is not set, nothing to do
-    if ((dst_interval_opt && src_interval_opt)
-            || (src_interval_opt && !dst_ptr_or_mapfd_opt && bin.op == Op::MOV))
-        return interval_t::bottom();
     // offset domain only handles packet pointers
     if (!is_packet_ptr(src_ptr_or_mapfd_opt) && !is_packet_ptr(dst_ptr_or_mapfd_opt))
         return interval_t::bottom();
 
-    interval_t src_interval = interval_t::bottom(), dst_interval = interval_t::bottom();
-    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
-    if (dst_interval_opt) dst_interval = std::move(dst_interval_opt.value());
-
-    Reg src;
-    if (std::holds_alternative<Reg>(bin.v)) src = std::get<Reg>(bin.v);
+    using Op = Bin::Op;
 
     auto dst_register = register_t{bin.dst.v};
-    switch (bin.op)
-    {
-        // ra = rb;
-        case Op::MOV: {
-            if (!is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                m_reg_state -= dst_register;
-                return interval_t::bottom();
-            }
-            auto src_offset_opt = m_reg_state.find(src.v);
-            if (!src_offset_opt) {
-                m_errors.push_back("src is a packet_pointer and no offset info found");
-                //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
-                return interval_t::bottom();
-            }
-            m_reg_state.insert(dst_register, loc, std::move(*src_offset_opt));
-            break;
+
+    if (std::holds_alternative<Imm>(bin.v)) {
+        int64_t imm;
+        if (bin.is64) {
+            // Use the full signed value.
+            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+        } else {
+            // Use only the low 32 bits of the value.
+            imm = static_cast<int>(std::get<Imm>(bin.v).v);
         }
-        // ra += rb
-        case Op::ADD: {
-            dist_t dist_to_update;
-            interval_t interval_to_add = interval_t::bottom();
-            if (is_packet_ptr(dst_ptr_or_mapfd_opt)
-                    && is_packet_ptr(src_ptr_or_mapfd_opt)) {
+        auto imm_interval = interval_t{number_t{imm}};
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = imm, we forget the type in the offset domain
                 m_reg_state -= dst_register;
-                return interval_t::bottom();
+                break;
             }
-            else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
-                auto dst_offset_opt = m_reg_state.find(dst_register);
-                if (!dst_offset_opt) {
-                    m_errors.push_back("dst is a packet_pointer and no offset info found");
-                    //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    m_reg_state -= dst_register;
-                    return interval_t::bottom();
+            case Op::ADD: {
+                // ra += imm
+                if (imm == 0) break;
+                if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
+                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
+                        update_offset_info(std::move(*dst_offset_opt), std::move(imm_interval),
+                                loc, dst_register);
+                        return interval_t::bottom();
+                    }
                 }
-                dist_to_update = std::move(dst_offset_opt.value());
-                interval_to_add = std::move(src_interval_opt.value());
+                m_reg_state -= dst_register;
+                break;
             }
-            // Condition might not be necessary once interval domain is added
-            else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_interval_opt) {
-                auto src_offset_opt = m_reg_state.find(src.v);
-                if (!src_offset_opt) {
-                    m_errors.push_back("src is a packet_pointer and no offset info found");
-                    //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
-                    m_reg_state -= dst_register;
-                    return interval_t::bottom();
+            case Op::SUB: {
+                // ra -= imm
+                if (imm == 0) break;
+                if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
+                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
+                        update_offset_info(std::move(*dst_offset_opt), -std::move(imm_interval),
+                                loc, dst_register);
+                        return interval_t::bottom();
+                    }
                 }
-                dist_to_update = std::move(src_offset_opt.value());
-                interval_to_add = std::move(dst_interval_opt.value());
+                m_reg_state -= dst_register;
+                break;
             }
-            else if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
-                // this case is only needed till interval domain is added
-                m_reg_state.insert(dst_register, loc, dist_t());
+            default: {
+                // no other operations supported for offset domain
+                m_reg_state -= dst_register;
                 break;
             }
-            update_offset_info(std::move(dist_to_update), std::move(interval_to_add),
-                    loc, dst_register, bin.op);
-            break;
         }
-        // ra -= rb
-        case Op::SUB: {
-            dist_t dist_to_update;
-            interval_t interval_to_sub = interval_t::bottom();
-            if (is_packet_ptr(dst_ptr_or_mapfd_opt)
-                    && is_packet_ptr(src_ptr_or_mapfd_opt)) {
+    }
+    else {
+        auto src = std::get<Reg>(bin.v);
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = rb
+                if (is_packet_ptr(src_ptr_or_mapfd_opt)) {
+                    if (auto src_offset_opt = m_reg_state.find(src.v)) {
+                        m_reg_state.insert(dst_register, loc, std::move(*src_offset_opt));
+                        return interval_t::bottom();
+                    }
+                }
                 m_reg_state -= dst_register;
-                return interval_t::top();
+                break;
             }
-            else if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_interval_opt) {
-                auto dst_offset_opt = m_reg_state.find(dst_register);
-                if (!dst_offset_opt) {
-                    m_errors.push_back("dst is a packet_pointer and no offset info found");
-                    //std::cout << "type_error: dst is a packet_pointer and no offset info found\n";
-                    m_reg_state -= dst_register;
-                    return interval_t::bottom();
+            case Op::ADD: {
+                // ra += rb
+                if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_signed_interval_opt) {
+                    auto src_signed = std::move(*src_signed_interval_opt);
+                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
+                        update_offset_info(std::move(*dst_offset_opt),
+                                std::move(src_signed), loc, dst_register);
+                        return interval_t::bottom();
+                    }
+                }
+                else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_signed_interval_opt) {
+                    auto dst_signed = std::move(*dst_signed_interval_opt);
+                    if (auto src_offset_opt = m_reg_state.find(src.v)) {
+                        update_offset_info(std::move(*src_offset_opt),
+                                std::move(dst_signed), loc, dst_register);
+                        return interval_t::bottom();
+                    }
                 }
-                dist_to_update = std::move(dst_offset_opt.value());
-                interval_to_sub = std::move(src_interval_opt.value());
+                else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                    // we do not deal with numbers in offset domain
+                }
+                else {
+                    // possibly adding two pointers
+                    set_to_bottom();
+                }
+                m_reg_state -= dst_register;
+                break;
             }
-            else {
-                auto src_offset_opt = m_reg_state.find(src.v);
-                if (!src_offset_opt) {
-                    m_errors.push_back("src is a packet_pointer and no offset info found");
-                    //std::cout << "type_error: src is a packet_pointer and no offset info found\n";
+            case Op::SUB: {
+                // ra -= rb
+                if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_signed_interval_opt) {
+                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
+                        update_offset_info(std::move(*dst_offset_opt),
+                                -std::move(*src_signed_interval_opt), loc, dst_register);
+                        return interval_t::bottom();
+                    }
+                }
+                else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_signed_interval_opt) {
                     m_reg_state -= dst_register;
-                    return interval_t::bottom();
                 }
-                dist_to_update = std::move(src_offset_opt.value());
-                interval_to_sub = std::move(dst_interval_opt.value());
+                else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                    // we do not deal with numbers in region domain
+                }
+                else {
+                    // ptr -= ptr
+                    // TODO: be precise with ptr -= ptr, especially for packet end
+                    if (is_packet_ptr(dst_ptr_or_mapfd_opt), is_packet_ptr(src_ptr_or_mapfd_opt)) {
+                        m_reg_state -= dst_register;
+                        return interval_t::top();
+                        /*
+                        if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
+                            if (auto src_offset_opt = m_reg_state.find(src.v)) {
+                                return (dst_offset_opt->m_dist - src_offset_opt->m_dist);
+                            }
+                        }
+                        */
+                    }
+                }
+                m_reg_state -= dst_register;
+                break;
+            }
+            default: {
+                // no other operations supported for offset domain
+                m_reg_state -= dst_register;
+                break;
             }
-            update_offset_info(std::move(dist_to_update), std::move(interval_to_sub),
-                    loc, dst_register, bin.op);
-            break;
-        }
-        default: {
-            m_reg_state -= dst_register;
-            break;
         }
     }
     return interval_t::bottom();
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index f5754b5aa..afc319890 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -3,10 +3,6 @@
 
 #pragma once
 
-#include <unordered_map>
-
-#include <boost/optional/optional_io.hpp>
-#include "crab/abstract_domain.hpp"
 #include "crab/common.hpp"
 
 namespace crab {
@@ -273,9 +269,9 @@ class offset_domain_t final {
     void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t loc);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
+            const std::optional<ptr_or_mapfd_t>&,
             const std::optional<interval_t>&,
-            std::optional<ptr_or_mapfd_t>&,
-            std::optional<ptr_or_mapfd_t>&, location_t);
+            const std::optional<ptr_or_mapfd_t>&, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     bool upper_bound_satisfied(const dist_t&, int, int, bool) const;
     bool lower_bound_satisfied(const dist_t&, int) const;
@@ -286,9 +282,7 @@ class offset_domain_t final {
     std::optional<dist_cells_t> find_in_stack(int) const;
     std::optional<dist_t> find_offset_at_loc(const reg_with_loc_t) const;
     std::optional<dist_t> find_offset_info(register_t reg) const;
-    void update_offset_info(const dist_t&&, const interval_t&&, const location_t&,
-            uint8_t, Bin::Op);
-    dist_t update_offset(const dist_t&, const weight_t&, const interval_t&, Bin::Op);
+    void update_offset_info(dist_t&&, interval_t&&, const location_t&, register_t);
     void insert_in_registers(register_t, location_t, dist_t);
     void store_in_stack(uint64_t, dist_t, int);
     void adjust_bb_for_types(location_t);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 5fe19a038..59a9c4a77 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -894,13 +894,12 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     m_errors.push_back("type constraint assert fail");
 }
 
-void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const interval_t&& change,
+void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, interval_t&& change,
         const location_t& loc, register_t reg) {
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
         auto offset = ptr_or_mapfd_with_off.get_offset();
-        auto updated_offset =
-            change == mock_interval_t::top() ? offset : offset.to_interval() + change;
+        auto updated_offset = offset.to_interval() + change;
         ptr_or_mapfd_with_off.set_offset(updated_offset);
         m_registers.insert(reg, loc, ptr_or_mapfd_with_off);
     }
@@ -908,7 +907,6 @@ void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, const i
         m_registers.insert(reg, loc, ptr_or_mapfd);
     }
     else {
-        //std::cout << "type error: mapfd register cannot be incremented/decremented\n";
         m_errors.push_back("mapfd register cannot be incremented/decremented");
         m_registers -= reg;
     }
@@ -919,118 +917,155 @@ void region_domain_t::operator()(const Bin& b, location_t loc) {
 }
 
 interval_t region_domain_t::do_bin(const Bin& bin,
-        const std::optional<interval_t>& src_interval_opt,
+        const std::optional<interval_t>& src_signed_interval_opt,
         const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
+        const std::optional<interval_t>& dst_signed_interval_opt,
         const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
 
     using Op = Bin::Op;
-    // if we are doing a move, where src is a number and dst is not set, nothing to do
-    if (src_interval_opt && !dst_ptr_or_mapfd_opt && bin.op == Op::MOV)
-        return interval_t::bottom();
 
-    ptr_or_mapfd_t src_ptr_or_mapfd, dst_ptr_or_mapfd;
-    interval_t src_interval = interval_t::bottom();
-    if (src_ptr_or_mapfd_opt) src_ptr_or_mapfd = std::move(src_ptr_or_mapfd_opt.value());
-    if (dst_ptr_or_mapfd_opt) dst_ptr_or_mapfd = std::move(dst_ptr_or_mapfd_opt.value());
-    if (src_interval_opt) src_interval = std::move(src_interval_opt.value());
-
-    interval_t subtracted = interval_t::bottom();
     auto dst_register = register_t{bin.dst.v};
-    switch (bin.op)
-    {
-        // ra = b, where b is a pointer/mapfd, a numerical register, or a constant;
-        case Op::MOV: {
-            // b is a pointer/mapfd
-            if (src_ptr_or_mapfd_opt) {
-                if (is_shared_ptr(src_ptr_or_mapfd_opt)) {
-                    auto shared_ptr = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
-                    set_aliases(dst_register, shared_ptr);
-                    m_registers.insert(dst_register, loc, shared_ptr);
+
+    if (std::holds_alternative<Imm>(bin.v)) {
+        int64_t imm;
+        if (bin.is64) {
+            // Use the full signed value.
+            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+        } else {
+            // Use only the low 32 bits of the value.
+            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+        }
+        auto imm_interval = interval_t{number_t{imm}};
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = imm, we forget the type in the region domain
+                m_registers -= dst_register;
+                break;
+            }
+            case Op::ADD: {
+                // ra += imm
+                if (imm == 0) break;
+                if (dst_ptr_or_mapfd_opt) {
+                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
+                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
+                            std::move(imm_interval), loc, dst_register);
+                }
+                else {
+                    m_registers -= dst_register;
+                }
+                break;
+            }
+            case Op::SUB: {
+                // ra -= imm
+                if (imm == 0) break;
+                if (dst_ptr_or_mapfd_opt) {
+                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
+                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
+                            -std::move(imm_interval), loc, dst_register);
                 }
                 else {
-                    m_registers.insert(dst_register, loc, src_ptr_or_mapfd);
+                    m_registers -= dst_register;
                 }
+                break;
             }
-            // b is a numerical register, or constant
-            else if (dst_ptr_or_mapfd_opt) {
+            default: {
+                // no other operations supported for region domain
                 m_registers -= dst_register;
+                break;
             }
-            break;
         }
-        // ra += b, where ra is a pointer/mapfd, or a numerical register,
-        // b is a pointer/mapfd, a numerical register, or a constant;
-        case Op::ADD: {
-            // adding pointer to another
-            if (src_ptr_or_mapfd_opt && dst_ptr_or_mapfd_opt) {
-                if (is_stack_ptr(dst_ptr_or_mapfd))
-                    m_stack.set_to_top();
+    }
+    else {
+        switch (bin.op) {
+            case Op::MOV: {
+                // ra = rb
+                if (src_ptr_or_mapfd_opt) {
+                    auto src_ptr_or_mapfd = std::move(*src_ptr_or_mapfd_opt);
+                    if (is_shared_ptr(src_ptr_or_mapfd)) {
+                        auto shared_ptr = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
+                        set_aliases(dst_register, shared_ptr);
+                        m_registers.insert(dst_register, loc, shared_ptr);
+                    }
+                    else {
+                        m_registers.insert(dst_register, loc, *src_ptr_or_mapfd_opt);
+                    }
+                }
                 else {
-                    // TODO: handle other cases properly
-                    //std::cout << "type error: addition of two pointers\n";
-                    m_errors.push_back("addition of two pointers");
+                    m_registers -= dst_register;
                 }
-                m_registers -= dst_register;
+                break;
             }
-            // ra is a pointer/mapfd
-            // b is a numerical register, or a constant
-            else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
-                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), std::move(src_interval),
-                        loc, dst_register);
-            }
-            // b is a pointer/mapfd
-            // ra is a numerical register
-            else if (src_ptr_or_mapfd_opt && !dst_ptr_or_mapfd_opt) {
-                update_ptr_or_mapfd(std::move(src_ptr_or_mapfd), interval_t::top(),
-                        loc, dst_register);
-            }
-            else if (dst_ptr_or_mapfd_opt && !src_ptr_or_mapfd_opt) {
-                if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd)) {
-                    auto updated_type = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
-                    updated_type.set_offset(mock_interval_t::top());
-                    m_registers.insert(dst_register, loc, updated_type);
+            case Op::ADD: {
+                // ra += rb
+                if (dst_ptr_or_mapfd_opt && src_signed_interval_opt) {
+                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
+                    auto src_signed = std::move(*src_signed_interval_opt);
+                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
+                            std::move(src_signed), loc, dst_register);
+                }
+                else if (src_ptr_or_mapfd_opt && dst_signed_interval_opt) {
+                    auto src_ptr_or_mapfd = std::move(*src_ptr_or_mapfd_opt);
+                    auto dst_signed = std::move(*dst_signed_interval_opt);
+                    update_ptr_or_mapfd(std::move(src_ptr_or_mapfd),
+                            std::move(dst_signed), loc, dst_register);
                 }
-                else if (std::holds_alternative<packet_ptr_t>(dst_ptr_or_mapfd)) {
-                    m_registers.insert(dst_register, loc, dst_ptr_or_mapfd);
+                else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                    // we do not deal with numbers in region domain
+                    m_registers -= dst_register;
+                }
+                else {
+                    // possibly adding two pointers
+                    set_to_bottom();
                 }
+                break;
             }
-            break;
-        }
-        // ra -= b, where ra is a pointer/mapfd
-        // b is a pointer/mapfd, numerical register, or a constant;
-        case Op::SUB: {
-            // b is a pointer/mapfd
-            if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) {
-                if (std::holds_alternative<mapfd_t>(dst_ptr_or_mapfd) &&
-                        std::holds_alternative<mapfd_t>(src_ptr_or_mapfd)) {
-                    //std::cout << "type error: mapfd registers subtraction not defined\n";
-                    m_errors.push_back("mapfd registers subtraction not defined");
+            case Op::SUB: {
+                // ra -= rb
+                if (dst_ptr_or_mapfd_opt && src_signed_interval_opt) {
+                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
+                    auto src_signed = std::move(*src_signed_interval_opt);
+                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
+                            -std::move(src_signed), loc, dst_register);
                 }
-                else if (same_region(dst_ptr_or_mapfd, src_ptr_or_mapfd)) {
-                    if (std::holds_alternative<ptr_with_off_t>(dst_ptr_or_mapfd) &&
-                            std::holds_alternative<ptr_with_off_t>(src_ptr_or_mapfd)) {
-                        auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr_or_mapfd);
-                        auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
-                        subtracted =
-                            dst_ptr_with_off.get_offset().to_interval() -
-                            src_ptr_with_off.get_offset().to_interval();
-                    }
+                else if (src_ptr_or_mapfd_opt && dst_signed_interval_opt) {
+                    m_registers -= dst_register;
+                }
+                else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                    // we do not deal with numbers in region domain
+                    m_registers -= dst_register;
                 }
                 else {
-                    //std::cout << "type error: subtraction between pointers of different region\n";
-                    m_errors.push_back("subtraction between pointers of different region");
+                    // ptr -= ptr
+                    if (std::holds_alternative<mapfd_t>(*dst_ptr_or_mapfd_opt) &&
+                            std::holds_alternative<mapfd_t>(*src_ptr_or_mapfd_opt)) {
+                        m_errors.push_back("mapfd registers subtraction not defined");
+                    }
+                    else if (same_region(*dst_ptr_or_mapfd_opt, *src_ptr_or_mapfd_opt)) {
+                        if (std::holds_alternative<ptr_with_off_t>(*dst_ptr_or_mapfd_opt) &&
+                                std::holds_alternative<ptr_with_off_t>(*src_ptr_or_mapfd_opt)) {
+                            auto dst_ptr_with_off = std::get<ptr_with_off_t>(*dst_ptr_or_mapfd_opt);
+                            auto src_ptr_with_off = std::get<ptr_with_off_t>(*src_ptr_or_mapfd_opt);
+                            return (dst_ptr_with_off.get_offset().to_interval() -
+                                src_ptr_with_off.get_offset().to_interval());
+                        }
+                    }
+                    else {
+                        // Assertions should make sure we only perform this on
+                        // non-shared pointers, hence this should not happen
+                        m_errors.push_back("subtraction between pointers of different region");
+                    }
+                    m_registers -= dst_register;
                 }
-                m_registers -= dst_register;
+                break;
             }
-            // b is a numerical register, or a constant
-            else if (dst_ptr_or_mapfd_opt && src_interval_opt) {
-                update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd), -std::move(src_interval),
-                        loc, dst_register);
+            default: {
+                // no other operations supported for region domain
+                m_registers -= dst_register;
+                break;
             }
-            break;
         }
-        default: break;
     }
-    return subtracted;
+    return interval_t::bottom();
 }
 
 void region_domain_t::do_load(const Mem& b, const register_t& target_register, bool unknown_ptr,
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index a6e3f681a..870f38f9c 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -3,10 +3,7 @@
 
 #pragma once
 
-#include "crab/abstract_domain.hpp"
 #include "crab/common.hpp"
-#include "crab/type_ostream.hpp"
-#include "crab/cfg.hpp"
 
 #include "platform.hpp"
 
@@ -177,12 +174,13 @@ class region_domain_t final {
     void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&, location_t);
     interval_t do_bin(const Bin&, const std::optional<interval_t>&,
-            const std::optional<crab::ptr_or_mapfd_t>&,
-            const std::optional<crab::ptr_or_mapfd_t>&, location_t);
+            const std::optional<ptr_or_mapfd_t>&,
+            const std::optional<interval_t>&,
+            const std::optional<ptr_or_mapfd_t>&, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int);
     void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
-    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, const interval_t&&,
+    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, interval_t&&,
             const crab::location_t&, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
new file mode 100644
index 000000000..73e3f9a05
--- /dev/null
+++ b/src/crab/signed_interval_domain.cpp
@@ -0,0 +1,588 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/signed_interval_domain.hpp"
+#include "boost/endian/conversion.hpp"
+
+namespace crab {
+
+bool registers_signed_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool registers_signed_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    if (m_interval_env == nullptr) return true;
+    for (auto it : m_cur_def) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+void registers_signed_state_t::set_to_top() {
+    m_interval_env = std::make_shared<global_interval_env_t>();
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+void registers_signed_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+void registers_signed_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+    auto reg_with_loc = reg_with_loc_t{reg, loc};
+    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<mock_interval_t> registers_signed_state_t::find(reg_with_loc_t reg) const {
+    auto it = m_interval_env->find(reg);
+    if (it == m_interval_env->end()) return {};
+    return it->second;
+}
+
+std::optional<mock_interval_t> registers_signed_state_t::find(register_t key) const {
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    return find(reg);
+}
+
+registers_signed_state_t registers_signed_state_t::operator|(const registers_signed_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    auto intervals_env = std::make_shared<global_interval_env_t>();
+    registers_signed_state_t intervals_joined(intervals_env);
+    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2) {
+            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
+            intervals_joined.insert(register_t{i}, loc,
+                    std::move(interval1 | interval2));
+        }
+    }
+    return intervals_joined;
+}
+
+void registers_signed_state_t::adjust_bb_for_registers(location_t loc) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (auto it = find(register_t{i})) {
+            insert(register_t{i}, loc, it->to_interval());
+        }
+    }
+}
+
+void registers_signed_state_t::operator-=(register_t var) {
+    if (is_bottom()) return;
+    m_cur_def[var] = nullptr;
+}
+
+bool stack_slots_signed_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool stack_slots_signed_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    return m_interval_values.empty();
+}
+
+void stack_slots_signed_state_t::set_to_top() {
+    m_interval_values.clear();
+    m_is_bottom = false;
+}
+
+void stack_slots_signed_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+stack_slots_signed_state_t stack_slots_signed_state_t::top() {
+    return stack_slots_signed_state_t(false);
+}
+
+std::optional<interval_cells_t> stack_slots_signed_state_t::find(uint64_t key) const {
+    auto it = m_interval_values.find(key);
+    if (it == m_interval_values.end()) return {};
+    return it->second;
+}
+
+void stack_slots_signed_state_t::store(uint64_t key, mock_interval_t val, int width) {
+    m_interval_values[key] = std::make_pair(val, width);
+}
+
+void stack_slots_signed_state_t::operator-=(uint64_t key) {
+    auto it = find(key);
+    if (it)
+        m_interval_values.erase(key);
+}
+
+bool stack_slots_signed_state_t::all_numeric(uint64_t start_loc, int width) const {
+    auto overlapping_cells = find_overlapping_cells(start_loc, width);
+    if (overlapping_cells.empty()) return false;
+    for (std::size_t i = 0; i < overlapping_cells.size()-1; i++) {
+        int width_i = find(overlapping_cells[i]).value().second;
+        if (overlapping_cells[i]+width_i != overlapping_cells[i+1]) return false;
+    }
+    return true;
+}
+
+void stack_slots_signed_state_t::fill_values(const std::vector<uint64_t>& keys,
+        uint64_t start, int width) {
+    if (keys[0] < start) {
+        auto type = find(keys[0]);
+        auto width_key = type.value().second;
+        store(keys[0], interval_t::top(), width_key);
+    }
+    if (keys[0] > start) {
+        store(start, interval_t::top(), keys[0]-start);
+    }
+    for (size_t i = 0; i < keys.size()-1; i++) {
+        auto type = find(keys[i]);
+        auto width_key = type.value().second;
+        if (keys[i]+width_key != keys[i+1]) {
+            store(keys[i]+width_key, interval_t::top(), keys[i+1]-(keys[i]+width_key));
+        }
+    }
+    auto type = find(keys[keys.size()-1]);
+    auto width_key = type.value().second;
+    if (keys[keys.size()-1]+width_key < start+width) {
+        store(keys[keys.size()-1]+width_key, interval_t::top(),
+                start+width-(keys[keys.size()-1]+width_key));
+    }
+    if (keys[keys.size()-1]+width_key > start+width) {
+        store(keys[keys.size()-1], interval_t::top(), width_key);
+    }
+}
+
+void stack_slots_signed_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start,
+        int width) {
+    for (auto& key : keys) {
+        auto type = find(key);
+        auto width_key = type.value().second;
+        if (key < start) {
+            int new_width = start-key;
+            store(key, interval_t::top(), new_width);
+        }
+        if (key+width_key > start+width) {
+            int new_width = key+width_key-(start+width);
+            store(start+width, interval_t::top(), new_width);
+        }
+        if (key >= start) *this -= key;
+    }
+}
+
+std::vector<uint64_t> stack_slots_signed_state_t::find_overlapping_cells(uint64_t start, int width) const {
+    std::vector<uint64_t> overlapping_cells;
+    auto it = m_interval_values.begin();
+    while (it != m_interval_values.end() && it->first < start) {
+        it++;
+    }
+    if (it != m_interval_values.begin()) {
+        it--;
+        auto key = it->first;
+        auto width_key = it->second.second;
+        if (key < start && key+width_key > start) overlapping_cells.push_back(key);
+    }
+
+    for (; it != m_interval_values.end(); it++) {
+        auto key = it->first;
+        if (key >= start && key < start+width) overlapping_cells.push_back(key);
+        if (key >= start+width) break;
+    }
+    return overlapping_cells;
+}
+
+static inline void join_stack(const stack_slots_signed_state_t& stack1, uint64_t key1, int& loc1,
+        const stack_slots_signed_state_t& stack2, uint64_t key2, int& loc2,
+        interval_values_stack_t& interval_values_joined) {
+    auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
+    auto& cells1 = type1.value();   auto& cells2 = type2.value();
+    int width1 = cells1.second; int width2 = cells2.second;
+    auto interval1 = cells1.first.to_interval();
+    auto interval2 = cells2.first.to_interval();
+    auto top_interval_mock = mock_interval_t(interval_t::top());
+    if (key1 == key2) {
+        if (width1 == width2) {
+            interval_values_joined[key1] = std::make_pair(
+                    mock_interval_t(interval1 | interval2), width1);
+            loc1++; loc2++;
+        }
+        else if (width1 < width2) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
+            loc2++;
+        }
+    }
+    else if (key1 > key2) {
+        if (key2+width2 > key1+width1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else if (key2+width2 > key1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
+            loc2++;
+        }
+        else loc2++;
+    }
+    else {
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
+    }
+}
+
+stack_slots_signed_state_t stack_slots_signed_state_t::operator|(const stack_slots_signed_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    interval_values_stack_t interval_values_joined;
+    auto stack1_keys = get_keys();
+    auto stack2_keys = other.get_keys();
+    int i = 0, j = 0;
+    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
+        int key1 = stack1_keys[i], key2 = stack2_keys[j];
+        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
+    }
+    return stack_slots_signed_state_t(std::move(interval_values_joined));
+}
+
+size_t stack_slots_signed_state_t::size() const {
+    return m_interval_values.size();
+}
+
+std::vector<uint64_t> stack_slots_signed_state_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(size());
+
+    for (auto const&kv : m_interval_values) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
+bool signed_interval_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
+    return (m_registers_values.is_bottom() || m_stack_slots_values.is_bottom());
+}
+
+bool signed_interval_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_registers_values.is_top() && m_stack_slots_values.is_top());
+}
+
+signed_interval_domain_t signed_interval_domain_t::bottom() {
+    signed_interval_domain_t interval;
+    interval.set_to_bottom();
+    return interval;
+}
+
+void signed_interval_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+    m_registers_values.set_to_bottom();
+    m_stack_slots_values.set_to_bottom();
+}
+
+void signed_interval_domain_t::set_registers_to_bottom() {
+    m_registers_values.set_to_bottom();
+}
+
+void signed_interval_domain_t::set_registers_to_top() {
+    m_registers_values.set_to_top();
+}
+
+void signed_interval_domain_t::set_to_top() {
+    m_is_bottom = false;
+    m_registers_values.set_to_top();
+    m_stack_slots_values.set_to_top();
+}
+
+std::optional<interval_cells_t> signed_interval_domain_t::find_in_stack(uint64_t key) const {
+    return m_stack_slots_values.find(key);
+}
+
+void signed_interval_domain_t::adjust_bb_for_types(location_t loc) {
+    m_registers_values.adjust_bb_for_registers(loc);
+}
+
+std::vector<uint64_t> signed_interval_domain_t::get_stack_keys() const {
+    return m_stack_slots_values.get_keys();
+}
+
+bool signed_interval_domain_t::all_numeric_in_stack(uint64_t start_loc, int width) const {
+    return m_stack_slots_values.all_numeric(start_loc, width);
+}
+
+std::vector<uint64_t> signed_interval_domain_t::find_overlapping_cells_in_stack(uint64_t start_loc,
+        int width) const {
+    return m_stack_slots_values.find_overlapping_cells(start_loc, width);
+}
+
+void signed_interval_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_stack_slots_values.remove_overlap(overlap, start_loc, width);
+}
+
+void signed_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_stack_slots_values.fill_values(overlap, start_loc, width);
+}
+
+std::optional<mock_interval_t> signed_interval_domain_t::find_interval_value(register_t reg) const {
+    return m_registers_values.find(reg);
+}
+
+std::optional<mock_interval_t> signed_interval_domain_t::find_interval_at_loc(
+        const reg_with_loc_t reg) const {
+    return m_registers_values.find(reg);
+}
+
+void signed_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
+        interval_t interval) {
+    m_registers_values.insert(reg, loc, interval);
+}
+
+void signed_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
+    m_stack_slots_values.store(key, interval, width);
+}
+
+bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return true;
+}
+
+void signed_interval_domain_t::operator|=(const signed_interval_domain_t& abs) {
+    signed_interval_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void signed_interval_domain_t::operator|=(signed_interval_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interval_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return signed_interval_domain_t(m_registers_values | other.m_registers_values,
+            m_stack_slots_values | other.m_stack_slots_values);
+}
+
+signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return signed_interval_domain_t(
+            m_registers_values | std::move(other.m_registers_values),
+            m_stack_slots_values | std::move(other.m_stack_slots_values));
+}
+
+signed_interval_domain_t signed_interval_domain_t::operator&(const signed_interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+signed_interval_domain_t signed_interval_domain_t::widen(const signed_interval_domain_t& abs, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+signed_interval_domain_t signed_interval_domain_t::narrow(const signed_interval_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+crab::bound_t signed_interval_domain_t::get_loop_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
+}
+
+void signed_interval_domain_t::initialize_loop_counter(const label_t& label) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+string_invariant signed_interval_domain_t::to_set() {
+    return string_invariant{};
+}
+
+signed_interval_domain_t signed_interval_domain_t::setup_entry() {
+    registers_signed_state_t registers(std::make_shared<global_interval_env_t>());
+    signed_interval_domain_t interval(std::move(registers), stack_slots_signed_state_t::top());
+    return interval;
+}
+
+void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
+    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
+        if (std::optional<number_t> n = v.singleton()) {
+            if (n->fits_cast_to_int64()) {
+                input = (decltype(input))n.value().cast_to_sint64();
+                decltype(input) output = be_or_le(input);
+                m_registers_values.insert(u.dst.v, loc, interval_t{number_t{output}});
+                return;
+            }
+        }
+        m_registers_values.insert(u.dst.v, loc, interval_t::top());
+    };
+
+    auto mock_interval = m_registers_values.find(u.dst.v);
+    if (!mock_interval) return;
+    interval_t interval = mock_interval->to_interval();
+
+    // Swap bytes.  For 64-bit types we need the weights to fit in a
+    // signed int64, but for smaller types we don't want sign extension,
+    // so we use unsigned which still fits in a signed int64.
+    switch (u.op) {
+    case Un::Op::BE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_big<uint16_t>);
+        break;
+    case Un::Op::BE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_big<uint32_t>);
+        break;
+    case Un::Op::BE64:
+        swap_endianness(std::move(interval), int64_t(0),
+                boost::endian::native_to_big<int64_t>);
+        break;
+    case Un::Op::LE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_little<uint16_t>);
+        break;
+    case Un::Op::LE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_little<uint32_t>);
+        break;
+    case Un::Op::LE64:
+        swap_endianness(std::move(interval), int64_t(0),
+                boost::endian::native_to_little<int64_t>);
+        break;
+    case Un::Op::NEG:
+        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
+        m_registers_values.insert(u.dst.v, loc, -interval);
+        break;
+    }
+}
+
+void signed_interval_domain_t::operator()(const LoadMapFd& u, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Packet& u, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Assume& s, location_t loc) {
+    // nothing to do here
+}
+
+bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
+    if (auto loaded = m_stack_slots_values.find(offset)) {
+        m_registers_values.insert(reg, loc, (*loaded).first.to_interval());
+        return true;
+    }
+    return false;
+}
+
+void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
+    if (std::holds_alternative<Reg>(b.value)) {
+        auto target_reg = std::get<Reg>(b.value);
+        if (auto targetreg_mock_interval = m_registers_values.find(target_reg.v)) {
+            auto targetreg_type = targetreg_mock_interval->to_interval();
+            m_stack_slots_values.store(offset, targetreg_type, width);
+        }
+    }
+    else {
+        auto imm = (int64_t)std::get<Imm>(b.value).v;
+        auto targetreg_type = interval_t{number_t{imm}};
+        m_stack_slots_values.store(offset, targetreg_type, width);
+    }
+}
+
+void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
+        int width, bool check_stack_all_numeric) {
+
+    if (check_stack_all_numeric) {
+        auto start_interval = interval + interval_t{number_t{s.offset}};
+        if (auto finite_size = start_interval.finite_size()) {
+            if (auto start_interval_lb = start_interval.lb().number()) {
+                auto start_offset = (uint64_t)(*start_interval_lb);
+                int width_from_start = (int)(*finite_size) + width;
+                if (!m_stack_slots_values.all_numeric(start_offset, width_from_start)) {
+                    m_errors.push_back("Stack access not numeric");
+                }
+            }
+            else {
+                m_errors.push_back("Offset information not available");
+            }
+        }
+        else {
+            m_errors.push_back("Register interval not finite for stack access");
+        }
+    }
+    else {
+        bool is_comparison_check = s.width == (Value)Imm{0};
+        if (!is_comparison_check) {
+            if (s.or_null) {
+                if (auto singleton = interval.singleton()) {
+                    if (*singleton == number_t{0}) return;
+                }
+                m_errors.push_back("Non-null number");
+            }
+            else {
+                m_errors.push_back("Only pointers can be dereferenced");
+            }
+        }
+    }
+}
+
+void signed_interval_domain_t::operator()(const Undefined& u, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Bin& b, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Call&, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Exit&, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Jmp&, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Mem&, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const Assert&, location_t loc) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::operator()(const basic_block_t& bb, int print) {
+    // nothing to do here
+}
+
+void signed_interval_domain_t::set_require_check(check_require_func_t f) {}
+
+} // namespace crab
diff --git a/src/crab/interval_prop_domain.hpp b/src/crab/signed_interval_domain.hpp
similarity index 50%
rename from src/crab/interval_prop_domain.hpp
rename to src/crab/signed_interval_domain.hpp
index 64003cb96..52de2e1a2 100644
--- a/src/crab/interval_prop_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -3,14 +3,6 @@
 
 #pragma once
 
-#include <unordered_map>
-#include <map>
-
-#include "crab/abstract_domain.hpp"
-#include "crab/region_domain.hpp"
-#include "crab/cfg.hpp"
-#include "linear_constraint.hpp"
-#include "string_constraints.hpp"
 #include "crab/common.hpp"
 
 namespace crab {
@@ -18,7 +10,7 @@ namespace crab {
 using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
 using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
 
-class registers_cp_state_t {
+class registers_signed_state_t {
 
     live_registers_t m_cur_def;
     std::shared_ptr<global_interval_env_t> m_interval_env;
@@ -29,27 +21,27 @@ class registers_cp_state_t {
         bool is_top() const;
         void set_to_bottom();
         void set_to_top();
+        void set_registers_to_bottom();
         std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
         std::optional<mock_interval_t> find(register_t key) const;
         void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
-        registers_cp_state_t operator|(const registers_cp_state_t& other) const;
-        registers_cp_state_t(bool is_bottom = false) : m_interval_env(nullptr),
+        registers_signed_state_t operator|(const registers_signed_state_t& other) const;
+        registers_signed_state_t(bool is_bottom = false) : m_interval_env(nullptr),
             m_is_bottom(is_bottom) {}
-        explicit registers_cp_state_t(live_registers_t&& vars,
+        explicit registers_signed_state_t(live_registers_t&& vars,
                 std::shared_ptr<global_interval_env_t> interval_env, bool is_bottom = false)
             : m_cur_def(std::move(vars)), m_interval_env(interval_env), m_is_bottom(is_bottom) {}
-        explicit registers_cp_state_t(std::shared_ptr<global_interval_env_t> interval_env,
+        explicit registers_signed_state_t(std::shared_ptr<global_interval_env_t> interval_env,
                 bool is_bottom = false)
             : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
         void adjust_bb_for_registers(location_t);
-        void scratch_caller_saved_registers();
 };
 
 using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
 using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
 
-class stack_cp_state_t {
+class stack_slots_signed_state_t {
 
     interval_values_stack_t m_interval_values;
     bool m_is_bottom = false;
@@ -59,62 +51,65 @@ class stack_cp_state_t {
         bool is_top() const;
         void set_to_bottom();
         void set_to_top();
-        static stack_cp_state_t top();
+        static stack_slots_signed_state_t top();
         std::optional<interval_cells_t> find(uint64_t) const;
         void store(uint64_t, mock_interval_t, int);
         void operator-=(uint64_t);
         bool all_numeric(uint64_t, int) const;
-        stack_cp_state_t operator|(const stack_cp_state_t& other) const;
-        stack_cp_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        explicit stack_cp_state_t(interval_values_stack_t&& interval_values, bool is_bottom = false)
+        stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
+        stack_slots_signed_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        explicit stack_slots_signed_state_t(interval_values_stack_t&& interval_values,
+                bool is_bottom = false)
             : m_interval_values(std::move(interval_values)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> get_keys() const;
         size_t size() const;
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
         void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
+        void fill_values(const std::vector<uint64_t>&, uint64_t, int);
 };
 
-class interval_prop_domain_t final {
-    registers_cp_state_t m_registers_interval_values;
-    stack_cp_state_t m_stack_slots_interval_values;
+class signed_interval_domain_t final {
+    registers_signed_state_t m_registers_values;
+    stack_slots_signed_state_t m_stack_slots_values;
     std::vector<std::string> m_errors;
     bool m_is_bottom = false;
 
   public:
 
-    interval_prop_domain_t() = default;
-    interval_prop_domain_t(interval_prop_domain_t&& o) = default;
-    interval_prop_domain_t(const interval_prop_domain_t& o) = default;
-    explicit interval_prop_domain_t(registers_cp_state_t&& consts_regs,
-            stack_cp_state_t&& interval_stack_slots, bool is_bottom = false) :
-        m_registers_interval_values(std::move(consts_regs)), m_stack_slots_interval_values(std::move(interval_stack_slots)),
+    signed_interval_domain_t() = default;
+    signed_interval_domain_t(signed_interval_domain_t&& o) = default;
+    signed_interval_domain_t(const signed_interval_domain_t& o) = default;
+    explicit signed_interval_domain_t(registers_signed_state_t&& consts_regs,
+            stack_slots_signed_state_t&& interval_stack_slots, bool is_bottom = false) :
+        m_registers_values(std::move(consts_regs)), m_stack_slots_values(std::move(interval_stack_slots)),
         m_is_bottom(is_bottom) {}
-    interval_prop_domain_t& operator=(interval_prop_domain_t&& o) = default;
-    interval_prop_domain_t& operator=(const interval_prop_domain_t& o) = default;
+    signed_interval_domain_t& operator=(signed_interval_domain_t&& o) = default;
+    signed_interval_domain_t& operator=(const signed_interval_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static interval_prop_domain_t setup_entry();
+    static signed_interval_domain_t setup_entry();
     // bottom/top
-    static interval_prop_domain_t bottom();
+    static signed_interval_domain_t bottom();
     void set_to_top();
     void set_to_bottom();
+    void set_registers_to_bottom();
+    void set_registers_to_top();
     bool is_bottom() const;
     bool is_top() const;
     // inclusion
-    bool operator<=(const interval_prop_domain_t& other) const;
+    bool operator<=(const signed_interval_domain_t& other) const;
     // join
-    void operator|=(const interval_prop_domain_t& abs);
-    void operator|=(interval_prop_domain_t&& abs);
-    interval_prop_domain_t operator|(const interval_prop_domain_t& other) const;
-    interval_prop_domain_t operator|(interval_prop_domain_t&& abs) const;
+    void operator|=(const signed_interval_domain_t& abs);
+    void operator|=(signed_interval_domain_t&& abs);
+    signed_interval_domain_t operator|(const signed_interval_domain_t& other) const;
+    signed_interval_domain_t operator|(signed_interval_domain_t&& abs) const;
     // meet
-    interval_prop_domain_t operator&(const interval_prop_domain_t& other) const;
+    signed_interval_domain_t operator&(const signed_interval_domain_t& other) const;
     // widening
-    interval_prop_domain_t widen(const interval_prop_domain_t& other, bool);
+    signed_interval_domain_t widen(const signed_interval_domain_t& other, bool);
     // narrowing
-    interval_prop_domain_t narrow(const interval_prop_domain_t& other) const;
+    signed_interval_domain_t narrow(const signed_interval_domain_t& other) const;
     //forget
-    void operator-=(variable_t var);
-    void operator-=(register_t reg) { m_registers_interval_values -= reg; }
+    void operator-=(register_t reg) { m_registers_values -= reg; }
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = boost::none);
@@ -130,41 +125,15 @@ class interval_prop_domain_t final {
     void operator()(const Packet&, location_t loc = boost::none);
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const FuncConstraint&, location_t loc = boost::none) {}
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {}
     void operator()(const basic_block_t& bb, int print = 0);
-    void write(std::ostream& os) const;
+    void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound();
     void initialize_loop_counter(const label_t&);
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, location_t);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
-    void do_call(const Call&, const stack_cells_t&, location_t);
-    void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&, const std::optional<ptr_or_mapfd_t>&,
-            const interval_t&, location_t);
-    void check_valid_access(const ValidAccess&, interval_t&&, int, bool = false);
-    void assume_unsigned_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
-            interval_t&&, interval_t&&, register_t, Value, location_t);
-    void assume_signed_cst_interval(Condition::Op, bool, interval_t&&, interval_t&&,
-            interval_t&&, interval_t&&, register_t, Value, location_t);
-    void assume_cst(Condition::Op, bool, register_t, Value, interval_t&&, interval_t&&, location_t);
-    void assume_lt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
-            register_t, Value, location_t, bool);
-    void assume_gt(bool, interval_t&&, interval_t&&, interval_t&&, interval_t&&,
-            register_t, Value, location_t);
-    void assume_gt_and_lt(bool, bool, bool, interval_t&&, interval_t&&,
-            interval_t&&, interval_t&&, register_t, Value, location_t, bool = true);
+    void check_valid_access(const ValidAccess&, interval_t&&, int, bool);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
@@ -175,8 +144,11 @@ class interval_prop_domain_t final {
     bool all_numeric_in_stack(uint64_t, int) const;
     std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
-}; // end interval_prop_domain_t
+    bool load_from_stack(register_t, uint64_t, location_t);
+    void store_in_stack(const Mem&, uint64_t, int);
+}; // end signed_interval_domain_t
 
 } // namespace crab
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 9f31c9adb..e99c23b7f 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -74,7 +74,8 @@ type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
         return *this;
     }
     return type_domain_t(m_region | std::move(other.m_region),
-            m_offset | std::move(other.m_offset), m_interval | std::move(other.m_interval));
+            m_offset | std::move(other.m_offset),
+            m_interval | std::move(other.m_interval));
 }
 
 type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
@@ -102,10 +103,12 @@ string_invariant type_domain_t::to_set() const {
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         std::stringstream elem;
         auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
-        auto maybe_width_interval = m_interval.find_interval_value(register_t{i});
+        // TODO: Only allowing signed intervals for now, because otherwise parsing needs to be
+        // changed; support unsigned intervals
+        auto maybe_signed_interval = m_interval.find_signed_interval_value(register_t{i});
         auto maybe_offset = m_offset.find_offset_info(register_t{i});
-        if (maybe_ptr_or_mapfd.has_value() || maybe_width_interval.has_value()) {
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_offset, maybe_width_interval);
+        if (maybe_ptr_or_mapfd.has_value() || maybe_signed_interval.has_value()) {
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_offset, maybe_signed_interval);
             result.insert(elem.str());
         }
     }
@@ -133,9 +136,11 @@ string_invariant type_domain_t::to_set() const {
     std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
     for (auto const& k : stack_keys_interval) {
         std::stringstream elem;
-        auto maybe_interval_cells = m_interval.find_in_stack(k);
-        if (maybe_interval_cells.has_value()) {
-            auto interval_cells = maybe_interval_cells.value();
+        // TODO: Only allowing signed intervals for now, because otherwise parsing needs to be
+        // changed; support unsigned intervals
+        auto maybe_interval_cells_signed = m_interval.find_in_stack_signed(k);
+        if (maybe_interval_cells_signed.has_value()) {
+            auto interval_cells = maybe_interval_cells_signed.value();
             elem << "stack";
             print_numeric_memory_cell(elem, k, k+interval_cells.second-1,
                     interval_cells.first.to_interval());
@@ -150,6 +155,8 @@ void type_domain_t::operator()(const Undefined& u, location_t loc) {
 }
 
 void type_domain_t::operator()(const Un& u, location_t loc) {
+    m_region(u, loc);
+    m_offset(u, loc);
     m_interval(u, loc);
 }
 
@@ -173,7 +180,7 @@ void type_domain_t::operator()(const Call& u, location_t loc) {
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
-            auto maybe_width_interval = m_interval.find_interval_value(param.size.v);
+            auto maybe_width_interval = m_interval.find_signed_interval_value(param.size.v);
             if (!maybe_ptr_or_mapfd || !maybe_width_interval) continue;
             if (is_stack_ptr(maybe_ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
@@ -228,10 +235,8 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
                     maybe_left_interval, maybe_right_interval)) {
             if (maybe_left_interval) {
                 // both numbers
-                auto left_interval = maybe_left_interval->to_interval();
-                auto right_interval = maybe_right_interval->to_interval();
-                m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right,
-                        std::move(left_interval), std::move(right_interval), loc);
+                m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v},
+                        cond.right, loc);
             }
             else if (maybe_left_type) {
                 if (is_packet_ptr(maybe_left_type)) {
@@ -262,19 +267,14 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
             // TODO: need to work with values
         }
         else if (maybe_left_interval) {
-            auto left_interval = maybe_left_interval->to_interval();
-            int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
-            auto right_interval = cond.is64
-                ? interval_t{number_t{imm}} : interval_t{number_t{(uint64_t)imm}};
-            m_interval.assume_cst(cond.op, cond.is64, cond.left.v, cond.right,
-                    std::move(left_interval), std::move(right_interval), loc);
+            m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v}, cond.right, loc);
         }
     }
 }
 
 void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
-    auto maybe_num_type_reg = m_interval.find_interval_value(u.reg.v);
+    auto maybe_num_type_reg = m_interval.find_unsigned_interval_value(u.reg.v);
     //assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
 
     if (is_ptr_type(maybe_ptr_or_mapfd_reg)) {
@@ -290,9 +290,6 @@ void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
 
 void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
-    auto interval_type = 
-        mock_interval_type ? mock_interval_type->to_interval() : std::optional<interval_t>{};
     if (reg_type) {
         std::optional<mock_interval_t> width_mock_interval;
         if (std::holds_alternative<Reg>(s.width)) {
@@ -324,7 +321,13 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
         }
     }
     else {
-        m_interval.check_valid_access(s, std::move(*interval_type), -1);
+        auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
+        if (mock_interval_type) {
+            m_interval.check_valid_access(s, std::move(mock_interval_type->to_interval()));
+        }
+        else {
+            m_errors.push_back("valid access on unknown register");
+        }
     }
 }
 
@@ -477,61 +480,41 @@ void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
 type_domain_t type_domain_t::setup_entry(bool init_r1) {
     auto&& reg = crab::region_domain_t::setup_entry(init_r1);
     auto&& off = offset_domain_t::setup_entry();
-    auto&& interval = interval_prop_domain_t::setup_entry();
+    auto&& interval = interval_domain_t::setup_entry();
     type_domain_t typ(std::move(reg), std::move(off), std::move(interval));
     return typ;
 }
 
 void type_domain_t::operator()(const Bin& bin, location_t loc) {
-    if (is_bottom()) return;
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
-    std::optional<interval_t> src_interval;
+    std::optional<interval_t> src_signed_interval, src_unsigned_interval;
 
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg r = std::get<Reg>(bin.v);
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
-        auto src_mock_interval = m_interval.find_interval_value(r.v);
-        if (src_mock_interval) {
-            src_interval = src_mock_interval->to_interval();
+        if (auto src_mock_signed_interval = m_interval.find_signed_interval_value(r.v)) {
+            src_signed_interval = src_mock_signed_interval->to_interval();
         }
-    }
-    else {
-        int64_t imm;
-        if (bin.is64) {
-            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+        if (auto src_mock_unsigned_interval = m_interval.find_unsigned_interval_value(r.v)) {
+            src_unsigned_interval = src_mock_unsigned_interval->to_interval();
         }
-        else {
-            imm = static_cast<int>(std::get<Imm>(bin.v).v);
-        }
-        src_interval = interval_t{number_t{imm}};
     }
-    //assert(!src_ptr_or_mapfd.has_value() || !src_interval.has_value());
-
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
-    auto dst_mock_interval = m_interval.find_interval_value(bin.dst.v);
-    auto dst_interval = dst_mock_interval ? dst_mock_interval->to_interval() :
-        std::optional<interval_t>();
-    //assert(!dst_ptr_or_mapfd.has_value() || !dst_interval.has_value());
-
-    using Op = Bin::Op;
-    // for all operations except mov, add, sub, the src and dst should be numbers
-    if ((src_ptr_or_mapfd || dst_ptr_or_mapfd)
-            && (bin.op != Op::MOV && bin.op != Op::ADD && bin.op != Op::SUB)) {
-        m_errors.push_back("operation on pointers not allowed");
-        //std::cout << "type error: operation on pointers not allowed\n";
-        m_region -= bin.dst.v;
-        m_offset -= bin.dst.v;
-        m_interval -= bin.dst.v;
-        return;
+    std::optional<interval_t> dst_signed_interval, dst_unsigned_interval;
+    if (auto dst_mock_signed_interval = m_interval.find_signed_interval_value(bin.dst.v)) {
+        dst_signed_interval = dst_mock_signed_interval->to_interval();
+    }
+    if (auto dst_mock_unsigned_interval = m_interval.find_unsigned_interval_value(bin.dst.v)) {
+        dst_unsigned_interval = dst_mock_unsigned_interval->to_interval();
     }
 
-    interval_t subtracted_reg =
-        m_region.do_bin(bin, src_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
-    interval_t subtracted_off =
-        m_offset.do_bin(bin, src_interval, dst_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd, loc);
+    interval_t subtracted_reg = m_region.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
+            dst_signed_interval, dst_ptr_or_mapfd, loc);
+    interval_t subtracted_off = m_offset.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
+            dst_signed_interval, dst_ptr_or_mapfd, loc);
     auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
-    m_interval.do_bin(bin, src_interval, dst_interval, src_ptr_or_mapfd, dst_ptr_or_mapfd,
-            subtracted, loc);
+    m_interval.do_bin(bin, src_signed_interval, src_unsigned_interval, src_ptr_or_mapfd,
+            dst_signed_interval, dst_unsigned_interval, dst_ptr_or_mapfd, subtracted, loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
@@ -610,7 +593,8 @@ void type_domain_t::print_stack() const {
         }
     }
     for (auto const& k : stack_keys_interval) {
-        auto maybe_interval_cells = m_interval.find_in_stack(k);
+        auto maybe_interval_cells = m_interval.find_in_stack_signed(k);
+        // TODO: also handle unsigned intervals
         if (maybe_interval_cells) {
             auto interval_cells = maybe_interval_cells.value();
             std::cout << "\t\t";
@@ -668,8 +652,13 @@ type_domain_t::find_offset_at_loc(const crab::reg_with_loc_t& loc) const {
 }
 
 std::optional<crab::mock_interval_t>
-type_domain_t::find_interval_at_loc(const crab::reg_with_loc_t& loc) const {
-    return m_interval.find_interval_at_loc(loc);
+type_domain_t::find_signed_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_interval.find_signed_interval_at_loc(loc);
+}
+
+std::optional<crab::mock_interval_t>
+type_domain_t::find_unsigned_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_interval.find_unsigned_interval_at_loc(loc);
 }
 
 static inline region_t string_to_region(const std::string& s) {
@@ -690,10 +679,30 @@ void type_domain_t::insert_in_registers_in_interval_domain(register_t r, locatio
     m_interval.insert_in_registers(r, loc, interval);
 }
 
+void type_domain_t::insert_in_registers_in_signed_interval_domain(register_t r, location_t loc,
+        interval_t interval) {
+    m_interval.insert_in_registers_signed(r, loc, interval);
+}
+
+void type_domain_t::insert_in_registers_in_unsigned_interval_domain(register_t r, location_t loc,
+        interval_t interval) {
+    m_interval.insert_in_registers_unsigned(r, loc, interval);
+}
+
 void type_domain_t::store_in_stack_in_interval_domain(uint64_t key, mock_interval_t p, int width) {
     m_interval.store_in_stack(key, p, width);
 }
 
+void type_domain_t::store_in_stack_in_signed_interval_domain(uint64_t key, mock_interval_t p,
+        int width) {
+    m_interval.store_in_stack_signed(key, p, width);
+}
+
+void type_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, mock_interval_t p,
+        int width) {
+    m_interval.store_in_stack_unsigned(key, p, width);
+}
+
 void type_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc, dist_t d) {
     m_offset.insert_in_registers(r, loc, d);
 }
@@ -820,6 +829,7 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
         else if (regex_match(t, m, regex(REG ":" NUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto num = create_interval(m[2], m[3]).to_interval();
+            // TODO: support separately for signed and unsigned intervals
             typ.insert_in_registers_in_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" MAPFD))) {
@@ -898,14 +908,15 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
 
     o << bb.label() << ":\n";
     uint32_t curr_pos = 0;
+    // TODO: add support for printing unsigned intervals as well
     for (const Instruction& statement : bb) {
         ++curr_pos;
-        location_t loc = location_t(std::make_pair(bb.label(), curr_pos));
+        crab::location_t loc = crab::location_t(std::make_pair(bb.label(), curr_pos));
         o << "   " << curr_pos << ".";
         if (std::holds_alternative<Call>(statement)) {
             auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(r0_reg);
-            auto interval = typ.find_interval_at_loc(r0_reg);
+            auto interval = typ.find_signed_interval_at_loc(r0_reg);
             print_annotated(o, std::get<Call>(statement), region, interval);
         }
         else if (std::holds_alternative<Bin>(statement)) {
@@ -913,7 +924,7 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
             auto offset = typ.find_offset_at_loc(reg_with_loc);
-            auto interval = typ.find_interval_at_loc(reg_with_loc);
+            auto interval = typ.find_signed_interval_at_loc(reg_with_loc);
             print_annotated(o, b, region, offset, interval);
         }
         else if (std::holds_alternative<Mem>(statement)) {
@@ -923,7 +934,7 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
                 auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
                 auto offset = typ.find_offset_at_loc(target_reg_loc);
-                auto interval = typ.find_interval_at_loc(target_reg_loc);
+                auto interval = typ.find_signed_interval_at_loc(target_reg_loc);
                 print_annotated(o, u, region, offset, interval);
             }
             else o << "  " << u << "\n";
@@ -937,7 +948,7 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
         else if (std::holds_alternative<Un>(statement)) {
             auto u = std::get<Un>(statement);
             auto reg = crab::reg_with_loc_t(u.dst.v, loc);
-            auto interval = typ.find_interval_at_loc(reg);
+            auto interval = typ.find_signed_interval_at_loc(reg);
             print_annotated(o, u, interval);
         }
         else o << "  " << statement << "\n";
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index af0ab4e2f..ddd7972ec 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -3,18 +3,18 @@
 
 #pragma once
 
-#include "crab/abstract_domain.hpp"
 #include "crab/region_domain.hpp"
-#include "crab/interval_prop_domain.hpp"
+#include "crab/interval_domain.hpp"
 #include "crab/offset_domain.hpp"
 #include "crab/common.hpp"
+#include "crab/type_ostream.hpp"
 
 namespace crab {
 
 class type_domain_t final {
     region_domain_t m_region;
     offset_domain_t m_offset;
-    interval_prop_domain_t m_interval;
+    interval_domain_t m_interval;
     bool m_is_bottom = false;
     std::vector<std::string> m_errors;
 
@@ -23,8 +23,8 @@ class type_domain_t final {
     type_domain_t() = default;
     type_domain_t(type_domain_t&& o) = default;
     type_domain_t(const type_domain_t& o) = default;
-    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off, interval_prop_domain_t&&
-            interval, bool is_bottom = false) :
+    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off,
+            interval_domain_t&& interval, bool is_bottom = false) :
         m_region(reg), m_offset(off), m_interval(interval), m_is_bottom(is_bottom) {}
     type_domain_t& operator=(type_domain_t&& o) = default;
     type_domain_t& operator=(const type_domain_t& o) = default;
@@ -89,12 +89,17 @@ class type_domain_t final {
     void print_stack() const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::dist_t> find_offset_at_loc(const crab::reg_with_loc_t&) const;
-    std::optional<crab::mock_interval_t> find_interval_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::reg_with_loc_t&) const;
     static type_domain_t from_predefined_types(const std::set<std::string>&, bool);
     void insert_in_registers_in_region_domain(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack_in_region_domain(uint64_t, ptr_or_mapfd_t, int);
     void insert_in_registers_in_interval_domain(register_t, location_t, interval_t);
+    void insert_in_registers_in_signed_interval_domain(register_t, location_t, interval_t);
+    void insert_in_registers_in_unsigned_interval_domain(register_t, location_t, interval_t);
     void store_in_stack_in_interval_domain(uint64_t, mock_interval_t, int);
+    void store_in_stack_in_signed_interval_domain(uint64_t, mock_interval_t, int);
+    void store_in_stack_in_unsigned_interval_domain(uint64_t, mock_interval_t, int);
     void insert_in_registers_in_offset_domain(register_t, location_t, dist_t);
     void store_in_stack_in_offset_domain(uint64_t, dist_t, int);
 
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index a1f34d709..7dcbb8a8c 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -3,9 +3,6 @@
 
 #pragma once
 
-#include "string_constraints.hpp"
-#include "asm_syntax.hpp"
-#include "asm_ostream.hpp"
 #include "crab/common.hpp"
 #include "crab/offset_domain.hpp"
 
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
new file mode 100644
index 000000000..b6c105d82
--- /dev/null
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -0,0 +1,507 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "crab/unsigned_interval_domain.hpp"
+#include "boost/endian/conversion.hpp"
+
+namespace crab {
+
+bool registers_unsigned_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool registers_unsigned_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    if (m_interval_env == nullptr) return true;
+    for (auto it : m_cur_def) {
+        if (it != nullptr) return false;
+    }
+    return true;
+}
+
+void registers_unsigned_state_t::set_to_top() {
+    m_interval_env = std::make_shared<global_interval_env_t>();
+    m_cur_def = live_registers_t{nullptr};
+    m_is_bottom = false;
+}
+
+void registers_unsigned_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+void registers_unsigned_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+    auto reg_with_loc = reg_with_loc_t{reg, loc};
+    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
+    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+}
+
+std::optional<mock_interval_t> registers_unsigned_state_t::find(reg_with_loc_t reg) const {
+    auto it = m_interval_env->find(reg);
+    if (it == m_interval_env->end()) return {};
+    return it->second;
+}
+
+std::optional<mock_interval_t> registers_unsigned_state_t::find(register_t key) const {
+    if (m_cur_def[key] == nullptr) return {};
+    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    return find(reg);
+}
+
+registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers_unsigned_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    auto intervals_env = std::make_shared<global_interval_env_t>();
+    registers_unsigned_state_t intervals_joined(intervals_env);
+    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2) {
+            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
+            intervals_joined.insert(register_t{i}, loc,
+                    std::move(interval1 | interval2));
+        }
+    }
+    return intervals_joined;
+}
+
+void registers_unsigned_state_t::adjust_bb_for_registers(location_t loc) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (auto it = find(register_t{i})) {
+            insert(register_t{i}, loc, it->to_interval());
+        }
+    }
+}
+
+void registers_unsigned_state_t::operator-=(register_t var) {
+    if (is_bottom()) return;
+    m_cur_def[var] = nullptr;
+}
+
+bool stack_slots_unsigned_state_t::is_bottom() const {
+    return m_is_bottom;
+}
+
+bool stack_slots_unsigned_state_t::is_top() const {
+    if (m_is_bottom) return false;
+    return m_interval_values.empty();
+}
+
+void stack_slots_unsigned_state_t::set_to_top() {
+    m_interval_values.clear();
+    m_is_bottom = false;
+}
+
+void stack_slots_unsigned_state_t::set_to_bottom() {
+    m_is_bottom = true;
+}
+
+stack_slots_unsigned_state_t stack_slots_unsigned_state_t::top() {
+    return stack_slots_unsigned_state_t(false);
+}
+
+std::optional<interval_cells_t> stack_slots_unsigned_state_t::find(uint64_t key) const {
+    auto it = m_interval_values.find(key);
+    if (it == m_interval_values.end()) return {};
+    return it->second;
+}
+
+void stack_slots_unsigned_state_t::store(uint64_t key, mock_interval_t val, int width) {
+    m_interval_values[key] = std::make_pair(val, width);
+}
+
+void stack_slots_unsigned_state_t::operator-=(uint64_t key) {
+    auto it = find(key);
+    if (it)
+        m_interval_values.erase(key);
+}
+
+void stack_slots_unsigned_state_t::fill_values(const std::vector<uint64_t>& keys,
+        uint64_t start, int width) {
+    if (keys[0] < start) {
+        auto type = find(keys[0]);
+        auto width_key = type.value().second;
+        store(keys[0], interval_t::top(), width_key);
+    }
+    if (keys[0] > start) {
+        store(start, interval_t::top(), keys[0]-start);
+    }
+    for (size_t i = 0; i < keys.size()-1; i++) {
+        auto type = find(keys[i]);
+        auto width_key = type.value().second;
+        if (keys[i]+width_key != keys[i+1]) {
+            store(keys[i]+width_key, interval_t::top(), keys[i+1]-(keys[i]+width_key));
+        }
+    }
+    auto type = find(keys[keys.size()-1]);
+    auto width_key = type.value().second;
+    if (keys[keys.size()-1]+width_key < start+width) {
+        store(keys[keys.size()-1]+width_key, interval_t::top(),
+                start+width-(keys[keys.size()-1]+width_key));
+    }
+    if (keys[keys.size()-1]+width_key > start+width) {
+        store(keys[keys.size()-1], interval_t::top(), width_key);
+    }
+}
+
+void stack_slots_unsigned_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
+    for (auto& key : keys) {
+        auto type = find(key);
+        auto width_key = type.value().second;
+        if (key < start) {
+            int new_width = start-key;
+            store(key, interval_t::top(), new_width);
+        }
+        if (key+width_key > start+width) {
+            int new_width = key+width_key-(start+width);
+            store(start+width, interval_t::top(), new_width);
+        }
+        if (key >= start) *this -= key;
+    }
+}
+
+static inline void join_stack(const stack_slots_unsigned_state_t& stack1, uint64_t key1, int& loc1,
+        const stack_slots_unsigned_state_t& stack2, uint64_t key2, int& loc2,
+        interval_values_stack_t& interval_values_joined) {
+    auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
+    auto& cells1 = type1.value();   auto& cells2 = type2.value();
+    int width1 = cells1.second; int width2 = cells2.second;
+    auto interval1 = cells1.first.to_interval();
+    auto interval2 = cells2.first.to_interval();
+    auto top_interval_mock = mock_interval_t(interval_t::top());
+    if (key1 == key2) {
+        if (width1 == width2) {
+            interval_values_joined[key1] = std::make_pair(
+                    mock_interval_t(interval1 | interval2), width1);
+            loc1++; loc2++;
+        }
+        else if (width1 < width2) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
+            loc2++;
+        }
+    }
+    else if (key1 > key2) {
+        if (key2+width2 > key1+width1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            loc1++;
+        }
+        else if (key2+width2 > key1) {
+            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
+            loc2++;
+        }
+        else loc2++;
+    }
+    else {
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
+    }
+}
+
+stack_slots_unsigned_state_t stack_slots_unsigned_state_t::operator|(const stack_slots_unsigned_state_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    interval_values_stack_t interval_values_joined;
+    auto stack1_keys = get_keys();
+    auto stack2_keys = other.get_keys();
+    int i = 0, j = 0;
+    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
+        int key1 = stack1_keys[i], key2 = stack2_keys[j];
+        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
+    }
+    return stack_slots_unsigned_state_t(std::move(interval_values_joined));
+}
+
+size_t stack_slots_unsigned_state_t::size() const {
+    return m_interval_values.size();
+}
+
+std::vector<uint64_t> stack_slots_unsigned_state_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(size());
+
+    for (auto const&kv : m_interval_values) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
+bool unsigned_interval_domain_t::is_bottom() const {
+    if (m_is_bottom) return true;
+    return (m_registers_values.is_bottom() || m_stack_slots_values.is_bottom());
+}
+
+bool unsigned_interval_domain_t::is_top() const {
+    if (m_is_bottom) return false;
+    return (m_registers_values.is_top() && m_stack_slots_values.is_top());
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::bottom() {
+    unsigned_interval_domain_t cp;
+    cp.set_to_bottom();
+    return cp;
+}
+
+void unsigned_interval_domain_t::set_to_bottom() {
+    m_is_bottom = true;
+    m_registers_values.set_to_bottom();
+    m_stack_slots_values.set_to_bottom();
+}
+
+void unsigned_interval_domain_t::set_registers_to_bottom() {
+    m_registers_values.set_to_bottom();
+}
+
+void unsigned_interval_domain_t::set_registers_to_top() {
+    m_registers_values.set_to_top();
+}
+
+void unsigned_interval_domain_t::set_to_top() {
+    m_registers_values.set_to_top();
+    m_stack_slots_values.set_to_top();
+}
+
+std::optional<interval_cells_t> unsigned_interval_domain_t::find_in_stack(uint64_t key) const {
+    return m_stack_slots_values.find(key);
+}
+
+void unsigned_interval_domain_t::adjust_bb_for_types(location_t loc) {
+    m_registers_values.adjust_bb_for_registers(loc);
+}
+
+void unsigned_interval_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_stack_slots_values.remove_overlap(overlap, start_loc, width);
+}
+
+void unsigned_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overlap,
+        uint64_t start_loc, int width) {
+    m_stack_slots_values.fill_values(overlap, start_loc, width);
+}
+
+std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_value(register_t reg) const {
+    return m_registers_values.find(reg);
+}
+
+std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_at_loc(
+        const reg_with_loc_t reg) const {
+    return m_registers_values.find(reg);
+}
+
+void unsigned_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
+        interval_t interval) {
+    m_registers_values.insert(reg, loc, interval);
+}
+
+void unsigned_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
+    m_stack_slots_values.store(key, interval, width);
+}
+
+bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return true;
+}
+
+void unsigned_interval_domain_t::operator|=(const unsigned_interval_domain_t& abs) {
+    unsigned_interval_domain_t tmp{abs};
+    operator|=(std::move(tmp));
+}
+
+void unsigned_interval_domain_t::operator|=(unsigned_interval_domain_t&& abs) {
+    if (is_bottom()) {
+        *this = abs;
+        return;
+    }
+    *this = *this | std::move(abs);
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_interval_domain_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return unsigned_interval_domain_t(m_registers_values | other.m_registers_values,
+            m_stack_slots_values | other.m_stack_slots_values);
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interval_domain_t&& other) const {
+    if (is_bottom() || other.is_top()) {
+        return std::move(other);
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return unsigned_interval_domain_t(
+            m_registers_values | std::move(other.m_registers_values),
+            m_stack_slots_values | std::move(other.m_stack_slots_values));
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::operator&(const unsigned_interval_domain_t& abs) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::widen(const unsigned_interval_domain_t& abs, bool to_constants) {
+    /* WARNING: The operation is not implemented yet.*/
+    return abs;
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::narrow(const unsigned_interval_domain_t& other) const {
+    /* WARNING: The operation is not implemented yet.*/
+    return other;
+}
+
+void unsigned_interval_domain_t::write(std::ostream& os) const {}
+
+crab::bound_t unsigned_interval_domain_t::get_loop_count_upper_bound() {
+    /* WARNING: The operation is not implemented yet.*/
+    return crab::bound_t{crab::number_t{0}};
+}
+
+void unsigned_interval_domain_t::initialize_loop_counter(const label_t& head) {
+    /* WARNING: The operation is not implemented yet.*/
+}
+
+string_invariant unsigned_interval_domain_t::to_set() {
+    return string_invariant{};
+}
+
+unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry() {
+    registers_unsigned_state_t registers(std::make_shared<global_interval_env_t>());
+    unsigned_interval_domain_t interval(std::move(registers), stack_slots_unsigned_state_t::top());
+    return interval;
+}
+
+void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
+    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
+        if (std::optional<number_t> n = v.singleton()) {
+            if (n->fits_cast_to_int64()) {
+                input = (decltype(input))n.value().cast_to_sint64();
+                decltype(input) output = be_or_le(input);
+                m_registers_values.insert(u.dst.v, loc, interval_t{number_t{output}});
+                return;
+            }
+        }
+        m_registers_values.insert(u.dst.v, loc, interval_t::top());
+    };
+
+    auto mock_interval = m_registers_values.find(u.dst.v);
+    if (!mock_interval) return;
+    interval_t interval = mock_interval->to_interval();
+
+    // Swap bytes.  For 64-bit types we need the weights to fit in a
+    // signed int64, but for smaller types we don't want sign extension,
+    // so we use unsigned which still fits in a signed int64.
+    switch (u.op) {
+    case Un::Op::BE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_big<uint16_t>);
+        break;
+    case Un::Op::BE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_big<uint32_t>);
+        break;
+    case Un::Op::BE64:
+        swap_endianness(std::move(interval), uint64_t(0),
+                boost::endian::native_to_big<uint64_t>);
+        break;
+    case Un::Op::LE16:
+        swap_endianness(std::move(interval), uint16_t(0),
+                boost::endian::native_to_little<uint16_t>);
+        break;
+    case Un::Op::LE32:
+        swap_endianness(std::move(interval), uint32_t(0),
+                boost::endian::native_to_little<uint32_t>);
+        break;
+    case Un::Op::LE64:
+        swap_endianness(std::move(interval), uint64_t(0),
+                boost::endian::native_to_little<uint64_t>);
+        break;
+    case Un::Op::NEG:
+        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
+        m_registers_values.insert(u.dst.v, loc, -interval);
+        break;
+    }
+}
+
+void unsigned_interval_domain_t::operator()(const LoadMapFd &u, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Packet& u, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Assume& s, location_t loc) {
+    // nothing to do here
+}
+
+bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
+    if (auto loaded = m_stack_slots_values.find(offset)) {
+        m_registers_values.insert(reg, loc, (*loaded).first.to_interval());
+        return true;
+    }
+    return false;
+}
+
+void unsigned_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
+    if (std::holds_alternative<Reg>(b.value)) {
+        auto target_reg = std::get<Reg>(b.value);
+        if (auto targetreg_mock_interval = m_registers_values.find(target_reg.v)) {
+            auto targetreg_type = targetreg_mock_interval->to_interval();
+            m_stack_slots_values.store(offset, targetreg_type, width);
+        }
+    }
+    else {
+        auto imm = (uint64_t)std::get<Imm>(b.value).v;
+        auto targetreg_type = interval_t{number_t{imm}};
+        m_stack_slots_values.store(offset, targetreg_type, width);
+    }
+}
+
+void unsigned_interval_domain_t::operator()(const Undefined& u, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Bin& b, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Call&, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Exit&, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Jmp&, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Mem&, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const Assert&, location_t loc) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::operator()(const basic_block_t& bb, int print) {
+    // nothing to do here
+}
+
+void unsigned_interval_domain_t::set_require_check(check_require_func_t f) {}
+
+} // namespace crab
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
new file mode 100644
index 000000000..6620810c3
--- /dev/null
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -0,0 +1,143 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "crab/common.hpp"
+
+namespace crab {
+
+using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
+using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
+
+class registers_unsigned_state_t {
+
+    live_registers_t m_cur_def;
+    std::shared_ptr<global_interval_env_t> m_interval_env;
+    bool m_is_bottom = false;
+
+    public:
+        bool is_bottom() const;
+        bool is_top() const;
+        void set_to_bottom();
+        void set_to_top();
+        std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
+        std::optional<mock_interval_t> find(register_t key) const;
+        void insert(register_t, const location_t&, interval_t);
+        void operator-=(register_t);
+        registers_unsigned_state_t operator|(const registers_unsigned_state_t& other) const;
+        registers_unsigned_state_t(bool is_bottom = false) : m_interval_env(nullptr),
+            m_is_bottom(is_bottom) {}
+        explicit registers_unsigned_state_t(live_registers_t&& vars,
+                std::shared_ptr<global_interval_env_t> interval_env, bool is_bottom = false)
+            : m_cur_def(std::move(vars)), m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+        explicit registers_unsigned_state_t(std::shared_ptr<global_interval_env_t> interval_env,
+                bool is_bottom = false)
+            : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+        void adjust_bb_for_registers(location_t);
+};
+
+using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
+using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
+
+class stack_slots_unsigned_state_t {
+
+    interval_values_stack_t m_interval_values;
+    bool m_is_bottom = false;
+
+    public:
+        bool is_bottom() const;
+        bool is_top() const;
+        void set_to_bottom();
+        void set_to_top();
+        static stack_slots_unsigned_state_t top();
+        std::optional<interval_cells_t> find(uint64_t) const;
+        void store(uint64_t, mock_interval_t, int);
+        void operator-=(uint64_t);
+        stack_slots_unsigned_state_t operator|(const stack_slots_unsigned_state_t& other) const;
+        stack_slots_unsigned_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        explicit stack_slots_unsigned_state_t(interval_values_stack_t&& interval_values, bool is_bottom = false)
+            : m_interval_values(std::move(interval_values)), m_is_bottom(is_bottom) {}
+        std::vector<uint64_t> get_keys() const;
+        size_t size() const;
+        void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
+        void fill_values(const std::vector<uint64_t>&, uint64_t, int);
+};
+
+class unsigned_interval_domain_t final {
+    registers_unsigned_state_t m_registers_values;
+    stack_slots_unsigned_state_t m_stack_slots_values;
+    std::vector<std::string> m_errors;
+    bool m_is_bottom = false;
+
+  public:
+
+    unsigned_interval_domain_t() = default;
+    unsigned_interval_domain_t(unsigned_interval_domain_t&& o) = default;
+    unsigned_interval_domain_t(const unsigned_interval_domain_t& o) = default;
+    explicit unsigned_interval_domain_t(registers_unsigned_state_t&& consts_regs,
+            stack_slots_unsigned_state_t&& interval_stack_slots, bool is_bottom = false) :
+        m_registers_values(std::move(consts_regs)), m_stack_slots_values(std::move(interval_stack_slots)),
+        m_is_bottom(is_bottom) {}
+    unsigned_interval_domain_t& operator=(unsigned_interval_domain_t&& o) = default;
+    unsigned_interval_domain_t& operator=(const unsigned_interval_domain_t& o) = default;
+    // eBPF initialization: R1 points to ctx, R10 to stack, etc.
+    static unsigned_interval_domain_t setup_entry();
+    // bottom/top
+    static unsigned_interval_domain_t bottom();
+    void set_to_top();
+    void set_to_bottom();
+    void set_registers_to_bottom();
+    void set_registers_to_top();
+    bool is_bottom() const;
+    bool is_top() const;
+    // inclusion
+    bool operator<=(const unsigned_interval_domain_t& other) const;
+    // join
+    void operator|=(const unsigned_interval_domain_t& abs);
+    void operator|=(unsigned_interval_domain_t&& abs);
+    unsigned_interval_domain_t operator|(const unsigned_interval_domain_t& other) const;
+    unsigned_interval_domain_t operator|(unsigned_interval_domain_t&& abs) const;
+    // meet
+    unsigned_interval_domain_t operator&(const unsigned_interval_domain_t& other) const;
+    // widening
+    unsigned_interval_domain_t widen(const unsigned_interval_domain_t& other, bool);
+    // narrowing
+    unsigned_interval_domain_t narrow(const unsigned_interval_domain_t& other) const;
+    //forget
+    void operator-=(register_t reg) { m_registers_values -= reg; }
+
+    //// abstract transformers
+    void operator()(const Undefined&, location_t loc = boost::none);
+    void operator()(const Bin&, location_t loc = boost::none);
+    void operator()(const Un&, location_t loc = boost::none);
+    void operator()(const LoadMapFd&, location_t loc = boost::none);
+    void operator()(const Call&, location_t loc = boost::none);
+    void operator()(const Exit&, location_t loc = boost::none);
+    void operator()(const Jmp&, location_t loc = boost::none);
+    void operator()(const Mem&, location_t loc = boost::none);
+    void operator()(const Packet&, location_t loc = boost::none);
+    void operator()(const Assume&, location_t loc = boost::none);
+    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const basic_block_t& bb, int print = 0);
+    void write(std::ostream& os) const;
+    crab::bound_t get_loop_count_upper_bound();
+    void initialize_loop_counter(const label_t&);
+    string_invariant to_set();
+    void set_require_check(check_require_func_t f);
+
+    std::optional<mock_interval_t> find_interval_value(register_t) const;
+    std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<interval_cells_t> find_in_stack(uint64_t) const;
+    void insert_in_registers(register_t, location_t, interval_t);
+    void store_in_stack(uint64_t, mock_interval_t, int);
+    void adjust_bb_for_types(location_t);
+    void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
+    void reset_errors() { m_errors.clear(); }
+    bool load_from_stack(register_t, uint64_t, location_t);
+    void store_in_stack(const Mem&, uint64_t, int);
+}; // end unsigned_interval_domain_t
+
+} // namespace crab

From f71651754be4451bc4134a14b55238f90dfa43ce Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Dec 2023 06:13:35 -0500
Subject: [PATCH 148/373] Better handling for bottom/top for multiple domains

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 17 +++++++++++++----
 src/crab/region_domain.cpp |  3 +++
 src/crab/type_domain.cpp   | 11 +++++++++--
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index f9e88229a..a9859ec42 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -37,7 +37,8 @@ bool dist_t::is_top() const {
 }
 
 bool dist_t::is_bottom() const {
-    return m_is_bottom;
+    if (m_is_bottom) return true;
+    return (m_slack == -1 && m_dist.is_bottom());
 }
 
 void dist_t::set_to_top() {
@@ -71,7 +72,8 @@ bool inequality_t::is_top() const {
 }
 
 bool inequality_t::is_bottom() const {
-    return m_is_bottom;
+    if (m_is_bottom) return true;
+    return (m_slack == -1 && m_value.is_bottom());
 }
 
 void inequality_t::set_to_top() {
@@ -103,7 +105,8 @@ bool equality_t::is_top() const {
 }
 
 bool equality_t::is_bottom() const {
-    return m_is_bottom;
+    if (m_is_bottom) return true;
+    return (m_lhs.is_bottom() || m_rhs.is_bottom());
 }
 
 void equality_t::set_to_top() {
@@ -466,14 +469,20 @@ void offset_domain_t::set_to_top() {
     m_reg_state.set_to_top();
     m_stack_state.set_to_top();
     m_extra_constraints.set_to_top();
+    m_is_bottom = false;
 }
 
 void offset_domain_t::set_to_bottom() {
     m_is_bottom = true;
+    m_reg_state.set_to_bottom();
+    m_stack_state.set_to_bottom();
+    m_extra_constraints.set_to_bottom();
 }
 
 bool offset_domain_t::is_bottom() const {
-    return m_is_bottom;
+    if (m_is_bottom) return true;
+    return (m_reg_state.is_bottom() || m_stack_state.is_bottom()
+            || m_extra_constraints.is_bottom());
 }
 
 bool offset_domain_t::is_top() const {
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 59a9c4a77..ae075695b 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -344,9 +344,12 @@ region_domain_t region_domain_t::bottom() {
 
 void region_domain_t::set_to_bottom() {
     m_is_bottom = true;
+    m_stack.set_to_bottom();
+    m_registers.set_to_bottom();
 }
 
 void region_domain_t::set_to_top() {
+    m_is_bottom = false;
     m_stack.set_to_top();
     m_registers.set_to_top();
 }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index e99c23b7f..7c0cfe9b7 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -7,7 +7,8 @@
 namespace crab {
 
 bool type_domain_t::is_bottom() const {
-    return m_is_bottom;
+    if (m_is_bottom) return true;
+    return (m_region.is_bottom() || m_offset.is_bottom() || m_interval.is_bottom());
 }
 
 bool type_domain_t::is_top() const {
@@ -23,9 +24,13 @@ type_domain_t type_domain_t::bottom() {
 
 void type_domain_t::set_to_bottom() {
     m_is_bottom = true;
+    m_region.set_to_bottom();
+    m_offset.set_to_bottom();
+    m_interval.set_to_bottom();
 }
 
 void type_domain_t::set_to_top() {
+    m_is_bottom = false;
     m_region.set_to_top();
     m_offset.set_to_top();
     m_interval.set_to_top();
@@ -213,7 +218,9 @@ void type_domain_t::operator()(const Exit& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Jmp& u, location_t loc) {}
+void type_domain_t::operator()(const Jmp& u, location_t loc) {
+    // nothing to do here
+}
 
 void type_domain_t::operator()(const Packet& u, location_t loc) {
     m_region(u, loc);

From 32d0ce0d926148a8614fc289057755f3d309b17f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Dec 2023 06:15:28 -0500
Subject: [PATCH 149/373] Refactoring, and simplifying a check in stack

Some cleanup of redundant code and transformers;
Commenting some code related to assertions in the code, since those
assertions are commented for now, activate later;
Simplifying a check related to stack all numeric in ValidMapKeyValue;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 39 ---------------------------------
 src/crab/offset_domain.hpp | 11 ----------
 src/crab/region_domain.cpp | 24 ---------------------
 src/crab/region_domain.hpp |  8 -------
 src/crab/type_domain.cpp   | 44 +++++++++++++++-----------------------
 src/crab/type_domain.hpp   |  2 --
 6 files changed, 17 insertions(+), 111 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index a9859ec42..7704bbb8d 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -555,9 +555,6 @@ offset_domain_t offset_domain_t::narrow(const offset_domain_t& other) const {
     return other;
 }
 
-//forget
-void offset_domain_t::operator-=(variable_t var) {}
-
 void offset_domain_t::write(std::ostream& os) const {}
 
 std::string offset_domain_t::domain_name() const {
@@ -812,42 +809,6 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
     m_reg_state.scratch_caller_saved_registers();
 }
 
-void offset_domain_t::operator()(const ValidDivisor& u, location_t loc) {
-    /* WARNING: This operation is not implemented yet. */
-}
-
-void offset_domain_t::operator()(const ValidAccess& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::operator()(const Comparable& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::operator()(const Addable& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::operator()(const ValidStore& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::operator()(const TypeConstraint& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::operator()(const ValidSize& u, location_t loc) {
-    /* WARNING: This operation is not implemented yet. */
-}
-
-void offset_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
-    /* WARNING: This operation is not implemented yet. */
-}
-
-void offset_domain_t::operator()(const ZeroCtxOffset&, location_t loc) {
-    // nothing to do here
-}
-
 bool offset_domain_t::lower_bound_satisfied(const dist_t& dist, int offset) const {
     auto meta_limit = m_extra_constraints.get_meta_limit();
     auto end_limit = m_extra_constraints.get_end_limit();
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index afc319890..e116af30f 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -230,7 +230,6 @@ class offset_domain_t final {
     // narrowing
     offset_domain_t narrow(const offset_domain_t& other) const;
     //forget
-    void operator-=(variable_t var);
     void operator-=(register_t reg) { m_reg_state -= reg; }
 
     //// abstract transformers
@@ -247,16 +246,6 @@ class offset_domain_t final {
     void operator()(const Packet&, location_t loc = boost::none);
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {};
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index ae075695b..5b2a0e343 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -531,14 +531,6 @@ void region_domain_t::operator()(const Assert& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Comparable& u, location_t loc) {
-    // nothing to do here
-}
-
-void region_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
-    // nothing to do here
-}
-
 void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
     if (is_ctx_ptr(maybe_ptr_or_mapfd)) {
@@ -557,14 +549,6 @@ void region_domain_t::operator()(const Un& u, location_t loc) {
     m_registers -= u.dst.v;
 }
 
-void region_domain_t::operator()(const ValidDivisor& u, location_t loc) {
-    // nothing to do here
-}
-
-void region_domain_t::operator()(const ValidSize& u, location_t loc) {
-    /* WARNING: The operation is not implemented yet.*/
-}
-
 // Get the start and end of the range of possible map fd values.
 // In the future, it would be cleaner to use a set rather than an interval
 // for map fds.
@@ -763,10 +747,6 @@ void region_domain_t::operator()(const Packet& u, location_t loc) {
     m_registers.scratch_caller_saved_registers();
 }
 
-void region_domain_t::operator()(const Addable &u, location_t loc) {
-    // nothing to do here
-}
-
 void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
     bool is_comparison_check = s.width == (Value)Imm{0};
 
@@ -823,10 +803,6 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const ValidStore& u, location_t loc) {
-    // nothing to do here
-}
-
 region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
 
     std::shared_ptr<ctx_t> ctx
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 870f38f9c..cb2f912c0 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -129,7 +129,6 @@ class region_domain_t final {
     // narrowing
     region_domain_t narrow(const region_domain_t& other) const;
     //forget
-    void operator-=(crab::variable_t var);
     void operator-=(register_t var) { m_registers -= var; }
 
     //// abstract transformers
@@ -147,15 +146,8 @@ class region_domain_t final {
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
     void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
     void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& o) const {}
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7c0cfe9b7..c49c2daee 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -339,8 +339,8 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
-    auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
+    //auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
+    //auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
     //assert(!reg_type.has_value() || !mock_interval_type.has_value());
     m_region(s, loc);
 }
@@ -353,8 +353,8 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
-    auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
-    auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
+    //auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
+    //auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
     //assert(!maybe_ptr_or_mapfd1.has_value() || !maybe_num_type1.has_value());
     //assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
@@ -375,7 +375,7 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
 void type_domain_t::operator()(const Addable& u, location_t loc) {
     auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
     auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
-    auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
+    //auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
     auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
     //assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
     //assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
@@ -392,7 +392,7 @@ void type_domain_t::operator()(const Addable& u, location_t loc) {
 void type_domain_t::operator()(const ValidStore& u, location_t loc) {
     auto maybe_ptr_or_mapfd_mem = m_region.find_ptr_or_mapfd_type(u.mem.v);
     auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
-    auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
+    //auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
     auto maybe_num_type_val = m_interval.find_interval_value(u.val.v);
     //assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
     //assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
@@ -447,28 +447,19 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
         auto mapfd = maybe_mapfd.value();
         if (is_mapfd_type(maybe_mapfd)) {
-            auto ptr_or_mapfd_basereg = maybe_ptr_or_mapfd_basereg.value();
-            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_basereg)) {
-                auto ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_basereg);
-                if (ptr_with_off.get_region() == region_t::T_STACK) {
-                    auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
-                    if (!offset_singleton) {
-                        //std::cout << "type error: reading the stack at an unknown offset\n";
-                        m_errors.push_back("reading the stack at an unknown offset");
-                        return;
-                    }
-                    auto offset_to_check = (uint64_t)offset_singleton.value();
-                    auto it = m_interval.all_numeric_in_stack(offset_to_check, width);
-                    if (it) return;
-                    auto it2 = m_region.find_in_stack(offset_to_check);
-                    if (it2) {
-                        //std::cout << "type error: map update with a non-numerical value\n";
-                        m_errors.push_back("map update with a non-numerical value");
-                    }
+            if (is_stack_ptr(maybe_ptr_or_mapfd_basereg)) {
+                auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd_basereg);
+                auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
+                if (!offset_singleton) {
+                    //std::cout << "type error: reading the stack at an unknown offset\n";
+                    m_errors.push_back("reading the stack at an unknown offset");
                     return;
                 }
+                auto offset_to_check = (uint64_t)offset_singleton.value();
+                auto it = m_interval.all_numeric_in_stack(offset_to_check, width);
+                if (it) return;
             }
-            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd_basereg)) {
+            else if (is_packet_ptr(maybe_ptr_or_mapfd_basereg)) {
                 if (m_offset.check_packet_access(u.access_reg, width, 0, true)) return;
             }
             else {
@@ -476,8 +467,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
             }
         }
     }
-    //std::cout << "type error: valid map key value assertion failed\n";
-    m_errors.push_back("valid map key value assertion failed");
+    m_errors.push_back("map update with a non-numerical value");
 }
 
 void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index ddd7972ec..79442d52d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -49,8 +49,6 @@ class type_domain_t final {
     type_domain_t widen(const type_domain_t& other, bool);
     // narrowing
     type_domain_t narrow(const type_domain_t& other) const;
-    //forget
-    void operator-=(crab::variable_t var);
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = boost::none);

From a88419a77108704fddede6e6959acdc1f78c4db1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 26 Dec 2023 06:20:50 -0500
Subject: [PATCH 150/373] Avoid setting to top when handling assume for shared
 pointers

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 5b2a0e343..f85b92f14 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -498,7 +498,7 @@ void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t&& shared_ptr,
     if (imm == 0) {
         if (op == Condition::Op::EQ) {
             if (nullness == nullness_t::_NULL) {
-                m_registers.set_to_top();
+                //m_registers.set_to_top();
             }
             else if (nullness == nullness_t::NOT_NULL) {
                 m_registers.set_to_bottom();
@@ -510,7 +510,7 @@ void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t&& shared_ptr,
         }
         else if (op == Condition::Op::NE) {
             if (nullness == nullness_t::NOT_NULL) {
-                m_registers.set_to_top();
+                //m_registers.set_to_top();
             }
             else if (nullness == nullness_t::_NULL) {
                 m_registers.set_to_bottom();

From 7ac4485913b1bd2d9f2bacc182c84b93bc579991 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 18:39:31 -0400
Subject: [PATCH 151/373] Added a definition of symbols for offset domain

Added implementation to represent begin, end, meta, and other slack
variables a_0, a_1, ... for offset domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/symbol.hpp         | 49 +++++++++++++++++++++++++++++++++++++
 src/crab/symbol_factory.cpp | 34 +++++++++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 src/crab/symbol.hpp
 create mode 100644 src/crab/symbol_factory.cpp

diff --git a/src/crab/symbol.hpp b/src/crab/symbol.hpp
new file mode 100644
index 000000000..efd645102
--- /dev/null
+++ b/src/crab/symbol.hpp
@@ -0,0 +1,49 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <iostream>
+#include <vector>
+
+namespace crab {
+
+using index_t = int64_t;
+
+class symbol_t final {
+    index_t _id;
+
+    explicit symbol_t(index_t id) : _id(id) {}
+
+  public:
+    [[nodiscard]] std::size_t hash() const { return (size_t)_id; }
+    bool operator==(symbol_t o) const { return _id == o._id; }
+    bool operator!=(symbol_t o) const { return (!(operator==(o))); }
+    bool operator<(symbol_t o) const { return _id < o._id; }
+    bool operator>(symbol_t o) const { return _id > o._id; }
+
+  private:
+    static int64_t count;
+
+  public:
+    static symbol_t begin()     { return symbol_t(0); }
+    static symbol_t end()       { return symbol_t(1); }
+    static symbol_t meta()      { return symbol_t(2); }
+    static symbol_t nu()        { return symbol_t(3); }
+    static symbol_t pkt_symbol()     { return symbol_t(4); }
+    static symbol_t make()      { count++;  return symbol_t(count); }
+    bool is_nu() const { return *this == symbol_t::nu(); }
+    bool is_pkt_symbol() const { return *this == symbol_t::pkt_symbol(); }
+    bool is_meta() const { return *this == symbol_t::meta(); }
+    bool is_end() const { return *this == symbol_t::end(); }
+    bool is_begin() const { return *this == symbol_t::begin(); }
+    bool is_slack() const { return _id >= 5; }
+    void write(std::ostream& o) const;
+
+    struct Hasher {
+        std::size_t operator()(const symbol_t& s) const { return s.hash(); }
+    };
+};  // class symbol_t
+
+std::ostream& operator<<(std::ostream& o, const symbol_t& s);
+
+} // namespace crab
diff --git a/src/crab/symbol_factory.cpp b/src/crab/symbol_factory.cpp
new file mode 100644
index 000000000..b931dcd7a
--- /dev/null
+++ b/src/crab/symbol_factory.cpp
@@ -0,0 +1,34 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+/*
+ * Factories for symbol names.
+ */
+
+#include "crab/symbol.hpp"
+
+namespace crab {
+
+int64_t symbol_t::count = 4;
+
+void symbol_t::write(std::ostream& o) const {
+    if (is_begin()) {
+        o << "begin";
+    } else if (is_end()) {
+        o << "end";
+    } else if (is_meta()) {
+        o << "meta";
+    } else if (is_nu()) {
+        o << "v";
+    } else if (is_pkt_symbol()) {
+        o << "i";
+    } else {
+        o << "a_" << ((int)_id-4);
+    }
+}
+
+std::ostream& operator<<(std::ostream& o, const symbol_t& s) {
+    s.write(o);
+    return o;
+}
+
+} // namespace crab

From e5096fa203842d87805fad14b11b47214f78bc64 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 18:40:51 -0400
Subject: [PATCH 152/373] Added a definition for expression for offset domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.cpp | 132 ++++++++++++++++++++++++++++++++++++++++
 src/crab/expression.hpp |  78 ++++++++++++++++++++++++
 2 files changed, 210 insertions(+)
 create mode 100644 src/crab/expression.cpp
 create mode 100644 src/crab/expression.hpp

diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
new file mode 100644
index 000000000..a47b8df38
--- /dev/null
+++ b/src/crab/expression.cpp
@@ -0,0 +1,132 @@
+
+#include "expression.hpp"
+
+namespace crab {
+
+std::ostream& operator<<(std::ostream& o, const expression_t& e) {
+    e.write(o);
+    return o;
+}
+
+bool expression_t::operator==(const expression_t &other) const {
+    return _symbol_terms == other._symbol_terms && _interval == other._interval;
+}
+
+bool expression_t::operator<(const expression_t &other) const {
+    return _symbol_terms == other._symbol_terms && _interval.ub() < other._interval.lb();
+}
+
+bool expression_t::operator<=(const expression_t &other) const {
+    return _symbol_terms == other._symbol_terms && _interval.ub() <= other._interval.lb();
+}
+
+bool expression_t::operator>(const expression_t &other) const {
+    return _symbol_terms == other._symbol_terms && _interval.lb() > other._interval.ub();
+}
+
+bool expression_t::is_singleton() const {
+    return _symbol_terms.size() == 1 && _interval == interval_t{0};
+}
+
+bool expression_t::contains(const symbol_t &s) const {
+    return _symbol_terms.find(s) != _symbol_terms.end();
+}
+
+symbol_t expression_t::get_singleton() const {
+    if (!is_singleton()) {
+        throw std::runtime_error("expression does not contain a single symbol");
+    }
+    return _symbol_terms.begin()->first;
+}
+
+static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv) {
+    if (terms.find(kv.first) != terms.end()) {
+        terms[kv.first] += kv.second;
+    } else {
+        terms[kv.first] = kv.second;
+    }
+}
+
+expression_t expression_t::substitute(const symbol_t &from, const expression_t &to) const {
+    expression_t result = *this;
+    auto it = result._symbol_terms.find(from);
+    if (it != result._symbol_terms.end()) {
+        result._symbol_terms.erase(it);
+        result = result + to;
+    }
+    return result;
+}
+
+expression_t expression_t::negate() const {
+    symbol_terms_t new_terms;
+    for (const auto &term : _symbol_terms) {
+        new_terms[term.first] = -term.second;
+    }
+    return expression_t(new_terms, -_interval);
+}
+
+expression_t expression_t::operator+(const expression_t &other) const {
+    auto new_terms = _symbol_terms;
+    for (const auto &term : other._symbol_terms) {
+        insert(new_terms, term);
+    }
+    return expression_t(new_terms, _interval + other._interval);
+}
+
+expression_t expression_t::operator+(interval_t interval) const {
+    return expression_t(_symbol_terms, _interval + interval);
+}
+
+expression_t expression_t::operator+(int n) const {
+    return operator+(interval_t{n});
+}
+
+expression_t expression_t::operator|(const expression_t &other) const {
+    if (_symbol_terms.size() != other._symbol_terms.size()) {
+        return expression_t();
+    }
+    symbol_terms_t new_terms;
+    for (auto &term : _symbol_terms) {
+        auto it = other._symbol_terms.find(term.first);
+        if (it == other._symbol_terms.end()) {
+            // we need to know what is the other slack, but it's not accesible directly
+            //if (term.first.is_slack() && it->first.is_slack()) {
+                auto new_slack = symbol_t::make();
+                new_terms[new_slack] = 1;
+            //}
+            //else {
+            //    return expression_t();
+            //}
+        }
+        else {
+            // TODO: some complex logic is needed here
+            new_terms[term.first] = term.second;
+        }
+    }
+    interval_t new_interval = _interval | other._interval;
+    return expression_t(new_terms, new_interval);
+}
+
+void expression_t::write(std::ostream &o) const {
+    size_t i = 0;
+    for (const auto &term : _symbol_terms) {
+        if (term.second != 1) {
+            o << (int)term.second << " * ";
+        }
+        o << term.first;
+        if (i < _symbol_terms.size() - 1) {
+            o << " + ";
+        }
+        i++;
+    }
+    if (auto s = _interval.singleton()) {
+        if ((int)*s != 0 || _symbol_terms.empty()) {
+            if (!_symbol_terms.empty()) o << " + ";
+            o <<  *s;
+        }
+    } else {
+        o << " + " << _interval;
+    }
+}
+
+}  // namespace crab
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
new file mode 100644
index 000000000..cc17b4642
--- /dev/null
+++ b/src/crab/expression.hpp
@@ -0,0 +1,78 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <map>
+#include <cassert>
+#include "symbol.hpp"
+#include "interval.hpp"
+
+namespace crab {
+// An expression is of form: Ax + By + Cz + ... + I.
+// x, y, z, ... are symbols, and A, B, C, ... are coefficients.
+// I is an interval.
+    
+using symbol_terms_t = std::map<symbol_t, int8_t>;
+class expression_t {
+  private:
+    symbol_terms_t _symbol_terms;
+    interval_t _interval;
+
+  public:
+    expression_t() : _interval(interval_t::top()) {};
+    expression_t(symbol_terms_t symbol_terms, interval_t interval = interval_t{0})
+        : _symbol_terms(symbol_terms), _interval(interval) {}
+    expression_t(symbol_t symbol) : _interval(interval_t{0}) {
+        _symbol_terms[symbol] = 1;
+    }
+    expression_t(interval_t interval)
+        : _symbol_terms(symbol_terms_t{}), _interval(interval) {}
+    expression_t(int n)
+        : _symbol_terms(symbol_terms_t{}), _interval(interval_t{n}) {}
+    bool operator==(const expression_t &other) const;
+    bool operator<(const expression_t &other) const;
+    bool operator<=(const expression_t &other) const;
+    bool operator>(const expression_t &other) const;
+    void operator-=(const symbol_t& s) { _symbol_terms.erase(s); }
+    bool is_constant() const { return _symbol_terms.empty(); }
+    expression_t negate() const;
+    expression_t operator+(const expression_t &other) const;
+    expression_t operator+(interval_t) const;
+    expression_t operator+(int n) const;
+    expression_t operator|(const expression_t &other) const;
+    void write(std::ostream &o) const;
+    symbol_terms_t get_symbol_terms() const { return _symbol_terms; }
+    bool is_singleton() const;
+    expression_t substitute(const symbol_t &, const expression_t &) const;
+    bool contains(const symbol_t &s) const;
+    symbol_t get_singleton() const;
+    interval_t get_interval() const { return _interval; }
+
+    static expression_t begin() {
+        return expression_t({std::make_pair(symbol_t::begin(), 1)});
+    }
+
+    static expression_t end() {
+        return expression_t({std::make_pair(symbol_t::end(), 1)});
+    }
+
+    static expression_t meta() {
+        return expression_t({std::make_pair(symbol_t::meta(), 1)});
+    }
+
+    static expression_t nu() {
+        return expression_t({std::make_pair(symbol_t::nu(), 1)});
+    }
+
+    static expression_t pkt_symbol() {
+        return expression_t({std::make_pair(symbol_t::pkt_symbol(), 1)});
+    }
+
+    static expression_t make_slack() {
+        return expression_t({std::make_pair(symbol_t::make(), 1)});
+    }
+};
+
+std::ostream& operator<<(std::ostream &, const expression_t&);
+
+}  // namespace crab

From 9d2c0f86beb85da69ce6fd63bbc522ffc6f52ea3 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 18:41:37 -0400
Subject: [PATCH 153/373] Added a definition for constraint for offset domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp | 50 +++++++++++++++++++++++++++++++++++++++++
 src/crab/constraint.hpp | 42 ++++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 src/crab/constraint.cpp
 create mode 100644 src/crab/constraint.hpp

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
new file mode 100644
index 000000000..4fd3eba22
--- /dev/null
+++ b/src/crab/constraint.cpp
@@ -0,0 +1,50 @@
+
+#include "constraint.hpp"
+
+namespace crab {
+
+std::ostream &operator<<(std::ostream &o, const constraint_t &c) {
+    c.write(o);
+    return o;
+}
+
+void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
+    auto neg = _expression_rhs.negate();
+    _expression_lhs = _expression_lhs + _expression_rhs.negate();
+    _expression_rhs = expression_t(0);
+    for (auto &e : _expression_lhs.get_symbol_terms()) {
+        if (e.second == 0) {
+            _expression_lhs -= e.first;
+        }
+        else if (e.first.is_slack()) {
+            auto val = slacks->find(e.first);
+            if (val != slacks->end()) {
+                _expression_lhs -= e.first;
+                _expression_lhs = _expression_lhs +
+                    val->second.to_interval() * interval_t{(int)e.second};
+            }
+        }
+    }
+}
+
+bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
+    simplify(slacks);
+    if (!_expression_lhs.is_constant()) {
+        return false;
+    }
+    auto constant = _expression_lhs.get_interval();
+    //auto interval_0 = _expression_rhs.get_interval();
+    return (bound_t{number_t{0}} < constant.lb());
+    //return (constant.ub() > interval_0.lb()) && ((constant & interval_0) == interval_t::bottom());
+}
+
+constraint_t constraint_t::negate() const {
+    // neg(x <= y) -> x > y -> y < x -> y <= x - 1
+    return constraint_t(_expression_rhs, _expression_lhs + (-1));
+}
+
+void constraint_t::write(std::ostream &o) const {
+    o << _expression_lhs << " <= " << _expression_rhs;
+}
+
+} // namespace crab
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
new file mode 100644
index 000000000..c70cad2d8
--- /dev/null
+++ b/src/crab/constraint.hpp
@@ -0,0 +1,42 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "expression.hpp"
+#include "common.hpp"
+
+namespace crab {
+
+using slacks_t = std::map<symbol_t, mock_interval_t>;
+
+// represents a constraint of the form lhs <= rhs
+class constraint_t {
+  private:
+    expression_t _expression_lhs;
+    expression_t _expression_rhs;
+
+  public:
+    constraint_t(expression_t lhs, expression_t rhs)
+        : _expression_lhs(lhs), _expression_rhs(rhs) {}
+
+    bool is_bottom(std::shared_ptr<slacks_t>);
+
+    expression_t get_lhs() const { return _expression_lhs; }
+    expression_t get_rhs() const { return _expression_rhs; }
+
+    constraint_t operator+(const constraint_t&) const;    
+    constraint_t operator+(int) const;
+    constraint_t operator+(interval_t) const;
+    constraint_t operator-(const constraint_t&) const;
+    constraint_t operator|(const constraint_t&) const;
+    constraint_t operator<=(const constraint_t&) const;
+    constraint_t operator>(const constraint_t&) const;
+    bool is_equality() const;
+    void simplify(std::shared_ptr<slacks_t>);
+    [[nodiscard]] constraint_t negate() const;
+    void write(std::ostream&) const;
+};
+
+std::ostream& operator<<(std::ostream &, const constraint_t&);
+
+} // namespace crab

From d9f00140f7b8dd476713dfdcd5d8e7148dc10d82 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 18:42:25 -0400
Subject: [PATCH 154/373] Added a definition for refinement types

Refinement type represents types in the offset domain and interval
domain

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 218 ++++++++++++++++++++++++++++++++++++++++
 src/crab/refinement.hpp |  63 ++++++++++++
 2 files changed, 281 insertions(+)
 create mode 100644 src/crab/refinement.cpp
 create mode 100644 src/crab/refinement.hpp

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
new file mode 100644
index 000000000..6a137bc01
--- /dev/null
+++ b/src/crab/refinement.cpp
@@ -0,0 +1,218 @@
+
+#include "refinement.hpp"
+
+namespace crab {
+
+constexpr int PROPAGATE_INEQUALITIES = 2;
+
+static void propagate_inequalities(std::vector<constraint_t>& constraints_to_check) {
+    std::vector<constraint_t> new_constraints;
+    for (int i = 0; i < (int)constraints_to_check.size()-1; i++) {
+        for (int j = i + 1; j < (int)constraints_to_check.size(); j++) {
+            auto c1 = constraints_to_check[i];
+            auto c2 = constraints_to_check[j];
+            expression_t lhs1 = c1.get_lhs();
+            expression_t rhs1 = c1.get_rhs();
+            expression_t lhs2 = c2.get_lhs();
+            expression_t rhs2 = c2.get_rhs();
+            if (rhs1.is_singleton()) {
+                symbol_t y = rhs1.get_singleton();
+                if (lhs2.contains(y)) {
+                    expression_t new_lhs2 = lhs2.substitute(y, lhs1);
+                    new_constraints.push_back(constraint_t(new_lhs2, rhs2));
+                }
+            }
+            if (rhs2.is_singleton()) {
+                symbol_t y = rhs2.get_singleton();
+                if (lhs1.contains(y)) {
+                    expression_t new_lhs1 = lhs1.substitute(y, lhs2);
+                    new_constraints.push_back(constraint_t(new_lhs1, rhs1));
+                }
+            }
+        }
+    }
+    constraints_to_check.insert(constraints_to_check.end(),
+            new_constraints.begin(), new_constraints.end());
+}
+
+std::ostream& operator<<(std::ostream& o, const refinement_t& r) {
+    r.write(o);
+    return o;
+}
+
+bool refinement_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
+    std::vector<constraint_t> constraints_to_check = _constraints;
+    int i = 0;
+    while (i <= PROPAGATE_INEQUALITIES) {
+        for (constraint_t c : constraints_to_check) {
+            if (c.is_bottom(slacks)) {
+                return true;
+            }
+        }
+        if (i < PROPAGATE_INEQUALITIES) {
+            propagate_inequalities(constraints_to_check);
+        }
+        i++;
+    }
+    return false;
+}
+
+bool refinement_t::has_value(refinement_t&& other) const {
+    return (_type == other._type && _value == other._value);
+}
+
+void refinement_t::write(std::ostream& o) const {
+    symbol_t nu = symbol_t::nu();
+    symbol_t i = symbol_t::pkt_symbol();
+    o << "{" << nu << " : ";
+    if (_type == data_type_t::NUM) {
+        o << "num | " << nu << " = ";
+    }
+    else if (_type == data_type_t::PACKET) {
+        o << "pkt<" << i << "> | " << i << " = ";
+    }
+    else {
+        o << "_";
+    }
+    o << _value;
+    if (_constraints.size() > 0) {
+        o << " & ";
+        for (size_t i = 0; i < _constraints.size(); i++) {
+            o << _constraints[i];
+            if (i < _constraints.size() - 1) {
+                o << " & ";
+            }
+        }
+    }
+    o << "}";
+}
+
+void refinement_t::simplify() {
+    std::set<int> to_remove;
+    std::vector<crab::constraint_t> constraints;
+    for (int i = 0; i < (int)_constraints.size()-1; i++) {
+        for (int j = i+1; j < (int)_constraints.size(); j++) {
+            auto c = _constraints[i];
+            auto c1 = _constraints[j];
+            if (c.get_rhs() == c1.get_rhs()) {
+                if (c.get_lhs() < c1.get_lhs()) {
+                    to_remove.insert(i);
+                }
+                else if (c1.get_lhs() < c.get_lhs()) {
+                    to_remove.insert(j);
+                }
+            }
+        }
+    }
+    for (size_t i = 0; i < _constraints.size(); i++) {
+        if (to_remove.find(i) == to_remove.end()) {
+            constraints.push_back(_constraints[i]);
+        }
+    }
+    _constraints = constraints;
+}
+
+refinement_t refinement_t::operator+(interval_t i) const {
+    expression_t added_value = _value + i;
+    return refinement_t(_type, added_value, _constraints);
+}
+
+refinement_t refinement_t::operator+(int n) const {
+    return operator+(interval_t{n});
+}
+
+refinement_t refinement_t::operator+(const refinement_t &other) const {
+    expression_t new_value = _value + other._value;
+    std::vector<crab::constraint_t> new_constraints;
+    new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
+    new_constraints.insert(new_constraints.end(),
+            other._constraints.begin(), other._constraints.end());
+    data_type_t new_type = (_type == other._type) ? _type
+        : (_type == data_type_t::PACKET || other._type == data_type_t::PACKET) ? data_type_t::PACKET
+        : data_type_t::ANY;
+    return refinement_t(new_type, new_value, new_constraints);
+}
+
+refinement_t refinement_t::operator-(const refinement_t &other) const {
+    // TODO: Handle subtraction between packet pointers
+    expression_t new_value = _value + other._value.negate();
+    std::vector<crab::constraint_t> new_constraints;
+    new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
+    new_constraints.insert(new_constraints.end(),
+            other._constraints.begin(), other._constraints.end());
+    data_type_t new_type = (_type == other._type) ? data_type_t::NUM
+        : (_type == data_type_t::PACKET || other._type == data_type_t::PACKET) ? data_type_t::PACKET
+        : data_type_t::ANY;
+    return refinement_t(new_type, new_value, new_constraints);
+}
+
+bool refinement_t::same_type(const refinement_t &other) const {
+    return _type == other._type;
+}
+
+refinement_t refinement_t::operator|(const refinement_t &other) const {
+    assert(same_type(other));
+    auto joined_value = _value | other._value;
+    std::vector<crab::constraint_t> new_constraints;
+    std::set<int> to_keep, to_keep1;
+    for (size_t i = 0; i < _constraints.size(); i++) {
+        for (size_t j = 0; j < other._constraints.size(); j++) {
+            auto c = _constraints[i];
+            auto c1 = other._constraints[j];
+            if (c.get_lhs() == c1.get_lhs() && c.get_rhs() == c1.get_rhs()) {
+                to_keep.insert(i);
+            }
+            else if (c.get_rhs() == c1.get_rhs() && c.get_lhs() < c1.get_lhs()) {
+                to_keep.insert(i);
+            }
+            else if (c.get_rhs() == c1.get_rhs() && c1.get_lhs() < c.get_lhs()) {
+                to_keep1.insert(j);
+            }
+        }
+    }
+    for (size_t i = 0; i < _constraints.size(); i++) {
+        if (to_keep.find(i) != to_keep.end()) {
+            new_constraints.push_back(_constraints[i]);
+        }
+    }
+    for (size_t i = 0; i < other._constraints.size(); i++) {
+        if (to_keep1.find(i) != to_keep1.end()) {
+            new_constraints.push_back(other._constraints[i]);
+        }
+    }
+    return refinement_t(_type, joined_value, new_constraints);
+}
+
+constraint_t refinement_t::operator<=(const refinement_t &other) const {
+    assert(same_type(other));
+    return constraint_t(_value, other._value);
+}
+
+constraint_t refinement_t::operator>(const refinement_t &other) const {
+    assert(same_type(other));
+    return constraint_t(other._value, _value + (-1));
+}
+
+void refinement_t::add_constraint(const constraint_t& c) {
+    _constraints.push_back(c);
+}
+
+bool refinement_t::is_safe_with(refinement_t begin, std::shared_ptr<slacks_t> slacks,
+        bool is_comparison_check) const {
+    refinement_t check_lb = begin;
+    auto lb = constraint_t(expression_t::meta(), _value);
+    constraint_t neg_lb = lb.negate();
+    check_lb.add_constraint(neg_lb);
+    bool lb_satisfied = check_lb.is_bottom(slacks);
+
+    refinement_t check_ub = std::move(begin);
+    auto ub = is_comparison_check ? constraint_t(_value, expression_t(interval_t{MAX_PACKET_SIZE}))
+        : constraint_t(_value, expression_t::end());
+    constraint_t neg_ub = ub.negate();
+    check_ub.add_constraint(neg_ub);
+    bool ub_satisfied = check_ub.is_bottom(slacks);
+
+    return lb_satisfied && ub_satisfied;
+}
+
+} // namespace crab
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
new file mode 100644
index 000000000..b9ec68ce2
--- /dev/null
+++ b/src/crab/refinement.hpp
@@ -0,0 +1,63 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include "constraint.hpp"
+
+namespace crab {
+
+enum class data_type_t {
+    NUM,
+    PACKET,
+    ANY
+};
+
+class refinement_t {
+    data_type_t _type;
+    expression_t _value;
+    std::vector<crab::constraint_t> _constraints;
+
+  public:
+    explicit refinement_t(data_type_t type, expression_t value,
+            std::vector<crab::constraint_t> constraints = {})
+        : _type(type), _value(value), _constraints(constraints) {}
+    refinement_t() : _type(data_type_t::ANY) {}
+ 
+    bool is_bottom(std::shared_ptr<slacks_t>);
+    [[nodiscard]] data_type_t get_type() const { return _type; }
+    [[nodiscard]] std::vector<crab::constraint_t> get_constraints() const { return _constraints; }
+    [[nodiscard]] expression_t get_value() const { return _value; }
+    refinement_t operator+(int n) const;
+    refinement_t operator+(interval_t) const;
+    refinement_t operator+(const refinement_t &other) const;
+    refinement_t operator-(const refinement_t &other) const;
+    refinement_t operator|(const refinement_t &other) const;
+    constraint_t operator<=(const refinement_t &other) const;
+    constraint_t operator>(const refinement_t &other) const;
+    bool has_value(refinement_t&&) const;
+    void write(std::ostream &o) const;
+    bool same_type(const refinement_t &other) const;
+    void add_constraint(const constraint_t&);
+    void simplify();
+    bool is_safe_with(refinement_t, std::shared_ptr<slacks_t>, bool) const;
+
+    static refinement_t begin() {
+        return refinement_t(data_type_t::PACKET, expression_t::begin());
+    }
+
+    static refinement_t end() {
+        return refinement_t(data_type_t::PACKET, expression_t::end());
+    }
+
+    static refinement_t meta() {
+        return refinement_t(data_type_t::PACKET, expression_t::meta());
+    }
+
+    static refinement_t make_slack() {
+        return refinement_t(data_type_t::NUM, expression_t::make_slack());
+    }
+};
+
+std::ostream &operator<<(std::ostream &, const refinement_t&);
+
+} // namespace crab

From 684be059d5871154b0da38f668bc52a0e6c149bd Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 18:51:52 -0400
Subject: [PATCH 155/373] Better printing for offset and interval domains

In offset domain, now we keep track of refinements, that should be
printed;
In interval domain, we distinguish between signed and unsigned numbers

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_ostream.cpp | 104 ++++++++++++++++++++++++++++----------
 src/crab/type_ostream.hpp |  20 ++++----
 2 files changed, 86 insertions(+), 38 deletions(-)

diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index b1b7a99e1..d0aa03dc8 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -4,14 +4,13 @@
 #include "crab/type_ostream.hpp"
 
 void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
-        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::dist_t> d) {
+        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
-            o << "[" << start << "-" << end << "] : " <<
-                std::get<crab::packet_ptr_t>(ptr) << "<" << *d << ">";
+            o << "[" << start << "-" << end << "] : " << *d;
         }
         else {
             o << "[" << start << "-" << end << "] : " << std::get<crab::packet_ptr_t>(ptr);
@@ -22,35 +21,57 @@ void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
     }
 }
 
-void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::interval_t n) {
+void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::interval_t n,
+        bool is_signed) {
     if (n.is_top()) {
-        o << "[" << start << "-" << end << "] : number";
+        if (is_signed) {
+            o << "[" << start << "-" << end << "] : snumber";
+        }
+        else {
+            o << "[" << start << "-" << end << "] : unumber";
+        }
     }
     else {
         if (auto n_singleton = n.singleton()) {
-            o << "[" << start << "-" << end << "] : number<" << *n_singleton << ">";
+            if (is_signed) {
+                o << "[" << start << "-" << end << "] : snumber<" << *n_singleton << ">";
+            }
+            else {
+                o << "[" << start << "-" << end << "] : unumber<" << *n_singleton << ">";
+            }
         }
         else {
-            o << "[" << start << "-" << end << "] : number<" << n << ">";
+            if (is_signed) {
+                o << "[" << start << "-" << end << "] : snumber<" << n << ">";
+            }
+            else {
+                o << "[" << start << "-" << end << "] : unumber<" << n << ">";
+            }
         }
     }
 }
 
 void print_memory_cell(std::ostream& o, int start, int end,
-        const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::dist_t> d,
-        std::optional<crab::mock_interval_t> n) {
-    if (n) print_numeric_memory_cell(o, start, end, n->to_interval());
+        const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t> d
+        , std::optional<crab::mock_interval_t> signed_interval,
+        std::optional<crab::mock_interval_t> unsigned_interval) {
+    if (signed_interval) {
+        print_numeric_memory_cell(o, start, end, signed_interval->to_interval(), true);
+    }
+    if (unsigned_interval) {
+        print_numeric_memory_cell(o, start, end, unsigned_interval->to_interval(), false);
+    }
     else if (p) print_non_numeric_memory_cell(o, start, end, *p, d);
 }
 
 void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::dist_t> d) {
+        std::optional<crab::refinement_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << r << " : " << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
-            o << r << " : " << std::get<crab::packet_ptr_t>(ptr) << "<" << *d << ">";
+            o << r << " : " << *d;
         }
         else {
             o << r << " : " << std::get<crab::packet_ptr_t>(ptr);
@@ -61,57 +82,83 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
     }
 }
 
-void print_numeric_register(std::ostream& o, Reg r, crab::interval_t n) {
+void print_numeric_register(std::ostream& o, Reg r, crab::interval_t n, bool is_signed) {
     if (n.is_top()) {
-        o << r << " : number";
+        if (is_signed) {
+            o << r << " : snumber";
+        }
+        else {
+            o << r << " : unumber";
+        }
     }
     else {
         if (auto n_singleton = n.singleton()) {
-            o << r << " : number<" << *n_singleton << ">";
+            if (is_signed) {
+                o << r << " : snumber<" << *n_singleton << ">";
+            }
+            else {
+                o << r << " : unumber<" << *n_singleton << ">";
+            }
         }
         else {
-            o << r << " : number<" << n << ">";
+            if (is_signed) {
+                o << r << " : snumber<" << n << ">";
+            }
+            else {
+                o << r << " : unumber<" << n << ">";
+            }
         }
     }
 }
 
 void print_register(std::ostream& o, Reg r, const std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::dist_t> d, std::optional<crab::mock_interval_t> n) {
-    if (n) print_numeric_register(o, r, n->to_interval());
+        std::optional<crab::refinement_t> d, std::optional<crab::mock_interval_t> interval,
+        bool is_signed) {
+    if (interval) print_numeric_register(o, r, interval->to_interval(), is_signed);
     else if (p) print_non_numeric_register(o, r, *p, d);
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::mock_interval_t>& n) {
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t>& d,
+        std::optional<crab::mock_interval_t>& n, bool is_signed) {
     o << "  ";
-    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, std::nullopt, n);
+    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, d, n, is_signed);
     o << " = " << call.name << ":" << call.func << "(...)\n";
+    if (d) {
+        o << "  " << *d << "\n";
+    }
 }
 
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::dist_t>& d, std::optional<crab::mock_interval_t>& n) {
+        std::optional<crab::refinement_t>& d, std::optional<crab::mock_interval_t>& n,
+        bool is_signed) {
     o << "  ";
-    print_register(o, b.dst, p, d, n);
+    print_register(o, b.dst, p, d, n, is_signed);
     o << " " << b.op << "= " << b.v << "\n";
+    if (d) {
+        o << "  " << *d << "\n";
+    }
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(o, u.dst, p, std::nullopt, std::nullopt);
+    print_register(o, u.dst, p, std::nullopt, std::nullopt, false);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::dist_t>& d, std::optional<crab::mock_interval_t>& n) {
+        std::optional<crab::refinement_t>& d, std::optional<crab::mock_interval_t>& n, bool is_signed) {
     o << "  ";
-    print_register(o, std::get<Reg>(b.value), p, d, n);
+    print_register(o, std::get<Reg>(b.value), p, d, n, is_signed);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
     int offset = std::abs(b.access.offset);
     o << "*(" << size_(b.access.width) << " *)";
     o << "(" << b.access.basereg << sign << offset << ")\n";
+    if (d) {
+        o << "  " << *d << "\n";
+    }
 }
 
 std::string op(Un::Op op) {
@@ -135,8 +182,9 @@ std::string op(Un::Op op) {
     }
 }
 
-void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>& n) {
+void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>& n,
+        bool is_signed) {
     o << "  ";
-    print_register(o, b.dst, std::nullopt, std::nullopt, n);
+    print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed);
     o << " = " << op(b.op) << " " << b.dst << "\n";
 }
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 7dcbb8a8c..b2bb1dd52 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -6,23 +6,23 @@
 #include "crab/common.hpp"
 #include "crab/offset_domain.hpp"
 
-void print_numeric_register(std::ostream&, Reg, crab::interval_t);
-void print_numeric_memory_cell(std::ostream&, int, int, crab::interval_t);
+void print_numeric_register(std::ostream&, Reg, crab::interval_t, bool);
+void print_numeric_memory_cell(std::ostream&, int, int, crab::interval_t, bool);
 void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::dist_t> = std::nullopt);
+        std::optional<crab::refinement_t> = std::nullopt);
 void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::dist_t> = std::nullopt);
+        std::optional<crab::refinement_t> = std::nullopt);
 void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
+        std::optional<crab::refinement_t>, std::optional<crab::mock_interval_t>, bool);
 void print_memory_cell(std::ostream&, int, int, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::dist_t>, std::optional<crab::mock_interval_t>);
+        std::optional<crab::refinement_t>, std::optional<crab::mock_interval_t>);
 
 // Print select transformers
 void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::mock_interval_t>&);
+        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
 void print_annotated(std::ostream&, const Bin&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
+        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
 void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or_mapfd_t>&);
 void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::dist_t>&, std::optional<crab::mock_interval_t>&);
-void print_annotated(std::ostream&, const Un&, std::optional<crab::mock_interval_t>&);
+        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
+void print_annotated(std::ostream&, const Un&, std::optional<crab::mock_interval_t>&, bool);

From 6907f7a29eafca28f623a6287ce3a4e76db43715 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 19:03:50 -0400
Subject: [PATCH 156/373] Some fixes in the interval domain

Keeping consistency in signed and unsigned domain, where if we do not
store something in one domain but do in another, we should store top in
former;
Fixed wrongly setting registers to top in Assume;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 8805fcd43..7dc66d6c9 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -116,11 +116,19 @@ void interval_domain_t::insert_in_registers(register_t reg, location_t loc, inte
 void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
         interval_t interval) {
     m_signed.insert_in_registers(reg, loc, interval);
+    auto v = m_unsigned.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    if (!v) {
+        m_unsigned.insert_in_registers(reg, loc, interval_t::top());
+    }
 }
 
 void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
         interval_t interval) {
     m_unsigned.insert_in_registers(reg, loc, interval);
+    auto v = m_signed.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    if (!v) {
+        m_signed.insert_in_registers(reg, loc, interval_t::top());
+    }
 }
 
 void interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
@@ -243,6 +251,7 @@ void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_sta
         //m_unsigned.store_in_stack(offset, interval_t::top(), width);
     }
     auto r0 = register_t{R0_RETURN_VALUE};
+    // TODO: Check if packet_reallocate() function call needs handling separately
     if (u.is_map_lookup) {
         operator-=(r0);
     }
@@ -434,11 +443,11 @@ void interval_domain_t::assume_unsigned_cst(Condition::Op op, bool is64,
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left unsigned interval is lower than right unsigned interval.
         // TODO: verify if setting to top is the correct equivalent of returning linear cst true
-        set_registers_to_top();
+        // set_registers_to_top();
         return;
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left unsigned interval is higher than right unsigned interval.
-        set_registers_to_top();
+        // set_registers_to_top();
         return;
     }
 
@@ -788,11 +797,11 @@ void interval_domain_t::assume_signed_cst(Condition::Op op, bool is64,
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left unsigned interval is lower than right unsigned interval.
         // TODO: verify if setting to top is the correct equivalent of returning linear cst true
-        set_registers_to_top();
+        // set_registers_to_top();
         return;
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left unsigned interval is higher than right unsigned interval.
-        set_registers_to_top();
+        // set_registers_to_top();
         return;
     }
 

From 7c27531e3e106ae4ec8090ac4b5190627e97d9d1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 23:26:16 -0400
Subject: [PATCH 157/373] Added a new offset domain

An offset domain added based on keeping track of refinements for packet
pointers, and for numeric values;
Some code fixed related to printing of values;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 741 +++++++++++++++----------------------
 src/crab/offset_domain.hpp | 221 ++++-------
 src/crab/region_domain.cpp |  51 +--
 src/crab/region_domain.hpp |   2 +-
 src/crab/type_domain.cpp   | 212 ++++++++---
 src/crab/type_domain.hpp   |   9 +-
 6 files changed, 545 insertions(+), 691 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 7704bbb8d..0a4c9dcf8 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -5,160 +5,47 @@
 
 namespace crab {
 
-bool dist_t::operator==(const dist_t& d) const {
-    return (m_dist == d.m_dist && m_slack == d.m_slack);
-}
-
-weight_t dist_t::offset_from_reference() const {
-    if (is_meta_pointer()) {
-        return (-m_dist+interval_t{number_t{PACKET_META}});
-    }
-    if (is_backward_pointer()) {
-        return (m_dist-interval_t{number_t{PACKET_END}});
-    }
-    return m_dist;
-}
-
-void dist_t::write(std::ostream& o) const {
-    if (m_slack != -1)
-        o << "s" << m_slack << "+";
-    if (is_forward_pointer()) o << "begin+";
-    else if (is_meta_pointer()) o << "meta+";
-    else if (is_backward_pointer()) o << "end+";
-    auto offset = offset_from_reference();
-    auto singleton_val = offset.singleton();
-    if (singleton_val) o << singleton_val.value();
-    else o << offset;
-}
-
-bool dist_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_slack == -1 && m_dist.is_top());
-}
-
-bool dist_t::is_bottom() const {
-    if (m_is_bottom) return true;
-    return (m_slack == -1 && m_dist.is_bottom());
-}
-
-void dist_t::set_to_top() {
-    m_slack = -1;
-    m_dist = interval_t::top();
-    m_is_bottom = false;
-}
-
-void dist_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-bool dist_t::is_meta_pointer() const {
-    return (m_dist.lb() > number_t{PACKET_END} && m_dist.ub() <= number_t{PACKET_META});
-}
-bool dist_t::is_forward_pointer() const {
-    return (m_dist.lb() >= number_t{PACKET_BEGIN});
-}
-bool dist_t::is_backward_pointer() const {
-    return (m_dist.ub() <= number_t{PACKET_END});
-}
-
-std::ostream& operator<<(std::ostream& o, const dist_t& d) {
-    d.write(o);
-    return o;
-}
-
-bool inequality_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_slack == -1 && m_value.is_top());
-}
-
-bool inequality_t::is_bottom() const {
-    if (m_is_bottom) return true;
-    return (m_slack == -1 && m_value.is_bottom());
-}
-
-void inequality_t::set_to_top() {
-    m_value = interval_t::top();
-    m_slack = -1;
-    m_is_bottom = false;
-}
-
-void inequality_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-
-std::ostream& operator<<(std::ostream& o, const inequality_t& ineq) {
-    ineq.write(o);
-    return o;
-}
-
-void inequality_t::write(std::ostream& o) const {
-    o << m_slack << (m_rel == rop_t::R_GT ? ">" :
-            m_rel == rop_t::R_GE ? ">=" :
-            m_rel == rop_t::R_LT ? "<" : "<=")
-        << m_value;
-}
-
-bool equality_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_lhs.is_top() && m_rhs.is_top());
-}
-
-bool equality_t::is_bottom() const {
-    if (m_is_bottom) return true;
-    return (m_lhs.is_bottom() || m_rhs.is_bottom());
-}
-
-void equality_t::set_to_top() {
-    m_lhs.set_to_top();
-    m_rhs.set_to_top();
-    m_is_bottom = false;
-}
-
-void equality_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-std::ostream& operator<<(std::ostream& o, const equality_t& eq) {
-    eq.write(o);
-    return o;
-}
-
-void equality_t::write(std::ostream& o) const {
-    o << m_lhs << " = " << m_rhs;
-}
-
-void registers_state_t::insert(register_t reg, const location_t& loc, dist_t&& dist) {
+void registers_state_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
     reg_with_loc_t reg_with_loc{reg, loc};
-    (*m_offset_env)[reg_with_loc] = std::move(dist);
+    (*m_offset_env)[reg_with_loc] = std::move(rf);
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
 
-std::optional<dist_t> registers_state_t::find(reg_with_loc_t reg) const {
+void registers_state_t::insert_slack_value(symbol_t sym, mock_interval_t in) {
+    (*m_slacks)[sym] = std::move(in);
+}
+
+std::optional<refinement_t> registers_state_t::find(reg_with_loc_t reg) const {
     auto it = m_offset_env->find(reg);
     if (it == m_offset_env->end()) return {};
     return it->second;
 }
 
-std::optional<dist_t> registers_state_t::find(register_t key) const {
+std::optional<mock_interval_t> registers_state_t::find_slack_value(symbol_t sym) const {
+    auto it = m_slacks->find(sym);
+    if (it == m_slacks->end()) return {};
+    return it->second;
+}
+
+std::optional<refinement_t> registers_state_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
     return find(*(m_cur_def[key]));
 }
 
 std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int width) const {
     std::vector<uint64_t> overlapping_cells;
-    auto it = m_slot_dists.begin();
-    while (it != m_slot_dists.end() && it->first < start) {
+    auto it = m_slot_rfs.begin();
+    while (it != m_slot_rfs.end() && it->first < start) {
         it++;
     }
-    if (it != m_slot_dists.begin()) {
+    if (it != m_slot_rfs.begin()) {
         it--;
         auto key = it->first;
         auto width_key = it->second.second;
         if (key < start && key+width_key > start) overlapping_cells.push_back(key);
     }
 
-    for (; it != m_slot_dists.end(); it++) {
+    for (; it != m_slot_rfs.end(); it++) {
         auto key = it->first;
         if (key >= start && key < start+width) overlapping_cells.push_back(key);
         if (key >= start+width) break;
@@ -168,12 +55,12 @@ std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int
 
 void registers_state_t::set_to_top() {
     m_offset_env = std::make_shared<global_offset_env_t>();
-    m_cur_def = live_registers_t{nullptr};
+    m_cur_def = live_refinements_t{nullptr};
     m_is_bottom = false;
 }
 
 void registers_state_t::set_to_bottom() {
-    m_cur_def = live_registers_t{nullptr};
+    m_cur_def = live_refinements_t{nullptr};
     m_is_bottom = true;
 }
 
@@ -204,8 +91,7 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
         return *this;
     }
 
-    auto region_env = std::make_shared<global_offset_env_t>();
-    registers_state_t joined_state(region_env);
+    registers_state_t joined_state(m_offset_env, m_slacks);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
 
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
@@ -213,17 +99,65 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2) {
-            auto dist1 = *it1, dist2 = *it2;
-            if (dist1.m_slack != dist2.m_slack) continue;
-            auto dist_joined = dist_t(std::move(dist1.m_dist | dist2.m_dist), dist1.m_slack);
-            joined_state.insert(register_t{i}, loc, std::move(dist_joined));
+            auto rf1 = *it1, rf2 = *it2;
+            if (rf1.same_type(rf2)) {
+                expression_t rf1_value = rf1.get_value();
+                expression_t rf2_value = rf2.get_value();
+                if (rf1_value == rf2_value) {
+                    joined_state.insert(register_t{i}, loc, std::move(rf1));
+                }
+                else {
+                    //joined_state.insert(register_t{i}, loc, std::move(rf1 | rf2));
+                    symbol_t s = symbol_t::make();
+                    symbol_terms_t terms;
+                    bool added = false;
+                    auto symbol_terms1 = rf1_value.get_symbol_terms();
+                    auto symbol_terms2 = rf2_value.get_symbol_terms();
+                    auto interval_rf1_value = rf1_value.get_interval();
+                    auto interval_rf2_value = rf2_value.get_interval();
+                    for (auto it = symbol_terms1.begin(); it != symbol_terms1.end(); it++) {
+                        // assuming slack variables are at same position in both states
+                        if (!added && it->first.is_slack()) {
+                            auto slack1 = it->first;
+                            auto dist = std::distance(symbol_terms1.begin(), it);
+                            auto it2 = std::next(symbol_terms2.begin(), dist);
+                            auto slack2 = it2->first;
+                            auto slack1_value = find_slack_value(slack1);
+                            auto slack2_value = other.find_slack_value(slack2);
+                            if (slack1_value && slack2_value) {
+                                auto interval1 = slack1_value->to_interval() + interval_rf1_value;
+                                auto interval2 = slack2_value->to_interval() + interval_rf2_value;
+                                auto interval = interval1 | interval2;
+                                terms[s] = 1;
+                                (*m_slacks)[s] = mock_interval_t{interval};
+                                added = true;
+                                continue;
+                            }
+                        }
+                        terms[it->first] = it->second;
+                    }
+                    auto rf = refinement_t(rf1.get_type(), expression_t(terms));
+                    joined_state.insert(register_t{i}, loc, std::move(rf));
+                }
+            }
+        }
+    }
+    // need special handling for the registers v_begin, v_end, and v_meta
+    for (uint8_t i = NUM_REGISTERS; i < NUM_REGISTERS+3; i++) {
+        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_def[i]));
+        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (it1 && it2) {
+            auto rf1 = *it1, rf2 = *it2;
+            auto rf_joined = rf1 | rf2;
+            joined_state.insert(register_t{i}, loc, std::move(rf_joined));
         }
     }
     return joined_state;
 }
 
 void registers_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS+3; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, std::move(*it));
         }
@@ -236,25 +170,31 @@ void registers_state_t::scratch_caller_saved_registers() {
     }
 }
 
-void registers_state_t::forget_packet_pointers() {
+void registers_state_t::forget_packet_pointers(location_t loc) {
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS; r++) {
-        operator-=(register_t{r});
+        if (auto it = find(register_t{r})) {
+            if (it->get_type() == data_type_t::PACKET) {
+                operator-=(register_t{r});
+            }
+        }
     }
+    insert(register_t{11}, loc, refinement_t::begin());
+    // TODO: verify if this is all needed
 }
 
 void stack_state_t::set_to_top() {
-    m_slot_dists.clear();
+    m_slot_rfs.clear();
     m_is_bottom = false;
 }
 
 void stack_state_t::set_to_bottom() {
-    m_slot_dists.clear();
+    m_slot_rfs.clear();
     m_is_bottom = true;
 }
 
 bool stack_state_t::is_top() const {
     if (m_is_bottom) return false;
-    return m_slot_dists.empty();
+    return m_slot_rfs.empty();
 }
 
 bool stack_state_t::is_bottom() const {
@@ -265,21 +205,21 @@ stack_state_t stack_state_t::top() {
     return stack_state_t(false);
 }
 
-std::optional<dist_cells_t> stack_state_t::find(uint64_t key) const {
-    auto it = m_slot_dists.find(key);
-    if (it == m_slot_dists.end()) return {};
+std::optional<refinement_cells_t> stack_state_t::find(uint64_t key) const {
+    auto it = m_slot_rfs.find(key);
+    if (it == m_slot_rfs.end()) return {};
     return it->second;
 }
 
-void stack_state_t::store(uint64_t key, dist_t d, int width) {
-    m_slot_dists[key] = std::make_pair(d, width);
+void stack_state_t::store(uint64_t key, refinement_t d, int width) {
+    m_slot_rfs[key] = std::make_pair(d, width);
 }
 
 void stack_state_t::operator-=(uint64_t to_erase) {
     if (is_bottom()) {
         return;
     }
-    m_slot_dists.erase(to_erase);
+    m_slot_rfs.erase(to_erase);
 }
 
 void stack_state_t::operator-=(const std::vector<uint64_t>& keys) {
@@ -295,145 +235,36 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
         return *this;
     }
 
-    stack_slot_dists_t out_stack_dists;
-    // We do not join dist cells because different dist values different types of offsets
-    for (auto const&kv: m_slot_dists) {
-        auto maybe_dist_cells = other.find(kv.first);
-        if (maybe_dist_cells) {
-            auto dist_cells1 = kv.second;
-            auto dist_cells2 = *maybe_dist_cells;
-            auto dist1 = dist_cells1.first;
-            auto dist2 = dist_cells2.first;
-            int width1 = dist_cells1.second;
-            int width2 = dist_cells2.second;
-            if (dist1 == dist2 && width1 == width2) {
-                out_stack_dists.insert(kv);
+    stack_slot_refinements_t out_stack_rfs;
+    // We do not join rf cells because different rf values different types of offsets
+    for (auto const&kv: m_slot_rfs) {
+        auto maybe_rf_cells = other.find(kv.first);
+        if (maybe_rf_cells) {
+            auto rf_cells1 = kv.second;
+            auto rf_cells2 = *maybe_rf_cells;
+            auto rf1 = rf_cells1.first;
+            auto rf2 = rf_cells2.first;
+            int width1 = rf_cells1.second;
+            int width2 = rf_cells2.second;
+            // TODO: for numerical values, the width does not have to be the same
+            // hence, handle accordingly
+            if (rf1.same_type(rf2) && width1 == width2) {
+                out_stack_rfs.insert({kv.first, std::make_pair(rf1 | rf2, width1)});
             }
         }
     }
-    return stack_state_t(std::move(out_stack_dists), false);
-}
-
-bool extra_constraints_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_meta_and_begin.is_top() && m_begin_and_end.is_top());
-}
-
-bool extra_constraints_t::is_bottom() const {
-    return m_is_bottom;
-}
-
-void extra_constraints_t::set_to_top() {
-    m_meta_and_begin.set_to_top();
-    m_begin_and_end.set_to_top();
-    m_is_bottom = false;
-}
-
-void extra_constraints_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-void extra_constraints_t::add_meta_and_begin_constraint(equality_t&& eq,
-        inequality_t&& ineq) {
-    m_meta_and_begin = packet_constraint_t(std::move(eq), std::move(ineq), true);
-}
-
-void extra_constraints_t::add_begin_and_end_constraint(equality_t&& eq,
-        inequality_t&& ineq) {
-    m_begin_and_end = packet_constraint_t(std::move(eq), std::move(ineq), false);
-}
-/*
-void extra_constraints_t::normalize() {
-    weight_t dist_lhs = m_eq.m_lhs.m_dist - m_eq.m_rhs.m_dist - 4099;
-    weight_t dist_rhs = -4099;
-    slack_var_t s = m_eq.m_lhs.m_slack;
-    dist_lhs += m_ineq.m_value;
-    weight_t ineq_val = 0;
-    rop_t ineq_rel = m_ineq.m_rel;
-
-    m_eq = equality_t(dist_t(dist_lhs, s), dist_t(dist_rhs));
-    m_ineq = inequality_t(s, ineq_rel, ineq_val);
-}
-*/
-
-packet_constraint_t packet_constraint_t::operator|(const packet_constraint_t& other) const {
-    //normalize();
-    //other.normalize();
-
-    weight_t dist1 = m_eq.m_lhs.m_dist;
-    weight_t dist2 = other.m_eq.m_lhs.m_dist;
-    slack_var_t s = m_eq.m_lhs.m_slack;
-
-    dist_t lhs = dist_t(dist1 | dist2, s);
-    dist_t rhs;
-    if (m_is_meta_constraint) rhs = dist_t(weight_t{number_t{PACKET_BEGIN}});
-    else rhs = dist_t(weight_t{number_t{PACKET_END}});
-
-    equality_t out_eq(lhs, rhs);
-    inequality_t out_ineq(s, m_ineq.m_rel, weight_t{number_t{0}});
-    return packet_constraint_t(std::move(out_eq), std::move(out_ineq), m_is_meta_constraint);
-        // have to handle case for different slack vars
-}
-
-std::ostream& operator<<(std::ostream& o, const packet_constraint_t& p) {
-    p.write(o);
-    return o;
-}
-
-void packet_constraint_t::write(std::ostream& o) const {
-    o << m_eq << "\n";
-    o << m_ineq << "\n";
-}
-
-void packet_constraint_t::set_to_top() {
-    m_eq.set_to_top();
-    m_ineq.set_to_top();
-    m_is_bottom = false;
-}
-
-void packet_constraint_t::set_to_bottom() {
-    m_is_bottom = true;
-}
-
-bool packet_constraint_t::is_top() const {
-    if (m_is_bottom) return false;
-    return (m_eq.is_top() && m_ineq.is_top());
-}
-
-bool packet_constraint_t::is_bottom() const {
-    return m_is_bottom;
-}
-
-std::optional<bound_t> packet_constraint_t::get_limit() const {
-    // TODO: normalize constraint, if required
-    auto dist = m_eq.m_lhs.m_dist;
-    if (dist.is_top()) return {};
-    return dist.lb();
-}
-
-extra_constraints_t extra_constraints_t::operator|(const extra_constraints_t& other) const {
-    auto meta_and_begin = m_meta_and_begin | other.m_meta_and_begin;
-    auto begin_and_end = m_begin_and_end | other.m_begin_and_end;
-    return extra_constraints_t(std::move(meta_and_begin), std::move(begin_and_end), false);
-}
-
-std::optional<bound_t> extra_constraints_t::get_end_limit() const {
-    return m_begin_and_end.get_limit();
-}
-
-std::optional<bound_t> extra_constraints_t::get_meta_limit() const {
-    return m_meta_and_begin.get_limit();
+    return stack_state_t(std::move(out_stack_rfs));
 }
 
 ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
     if (desc->data >= 0) {
-        m_dists[desc->data] = dist_t(weight_t{number_t{PACKET_BEGIN}});
+        m_rfs[desc->data] = refinement_t::begin();
     }
     if (desc->end >= 0) {
-        m_dists[desc->end] = dist_t(weight_t{number_t{PACKET_END}});
+        m_rfs[desc->end] = refinement_t::end();
     }
     if (desc->meta >= 0) {
-        m_dists[desc->meta] = dist_t(weight_t{number_t{PACKET_META}});
+        m_rfs[desc->meta] = refinement_t::meta();
     }
     if (desc->size >= 0) {
         m_size = desc->size;
@@ -444,16 +275,17 @@ int ctx_offsets_t::get_size() const {
     return m_size;
 }
 
-std::optional<dist_t> ctx_offsets_t::find(int key) const {
-    auto it = m_dists.find(key);
-    if (it == m_dists.end()) return {};
+std::optional<refinement_t> ctx_offsets_t::find(int key) const {
+    auto it = m_rfs.find(key);
+    if (it == m_rfs.end()) return {};
     return it->second;
 }
 
 offset_domain_t&& offset_domain_t::setup_entry() {
     std::shared_ptr<ctx_offsets_t> ctx
         = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor);
-    registers_state_t regs(std::make_shared<global_offset_env_t>());
+    registers_state_t regs(std::make_shared<global_offset_env_t>(),
+            std::make_shared<slacks_t>(), global_program_info->type.context_descriptor);
 
     static offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
     return std::move(off_d);
@@ -468,7 +300,6 @@ offset_domain_t offset_domain_t::bottom() {
 void offset_domain_t::set_to_top() {
     m_reg_state.set_to_top();
     m_stack_state.set_to_top();
-    m_extra_constraints.set_to_top();
     m_is_bottom = false;
 }
 
@@ -476,18 +307,16 @@ void offset_domain_t::set_to_bottom() {
     m_is_bottom = true;
     m_reg_state.set_to_bottom();
     m_stack_state.set_to_bottom();
-    m_extra_constraints.set_to_bottom();
 }
 
 bool offset_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
-    return (m_reg_state.is_bottom() || m_stack_state.is_bottom()
-            || m_extra_constraints.is_bottom());
+    return (m_reg_state.is_bottom() || m_stack_state.is_bottom());
 }
 
 bool offset_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_reg_state.is_top() && m_stack_state.is_top() && m_extra_constraints.is_top());
+    return (m_reg_state.is_top() && m_stack_state.is_top());
 }
 
 // inclusion
@@ -517,8 +346,7 @@ offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
     return offset_domain_t(
             m_reg_state | other.m_reg_state,
             m_stack_state | other.m_stack_state,
-            m_extra_constraints | other.m_extra_constraints,
-            m_ctx_dists, std::max(m_slack, other.m_slack)
+            m_ctx_rfs
     );
 }
 
@@ -532,8 +360,7 @@ offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
     return offset_domain_t(
             m_reg_state | std::move(other.m_reg_state),
             m_stack_state | std::move(other.m_stack_state),
-            m_extra_constraints | std::move(other.m_extra_constraints),
-            m_ctx_dists, std::max(m_slack, other.m_slack)
+            m_ctx_rfs
     );
 }
 
@@ -574,62 +401,81 @@ string_invariant offset_domain_t::to_set() { return string_invariant{}; }
 
 void offset_domain_t::operator()(const Assume &b, location_t loc) {
     Condition cond = b.cond;
-    if (cond.op == Condition::Op::LE) {
-        if (std::holds_alternative<Reg>(cond.right)) {
-            auto right_reg = std::get<Reg>(cond.right).v;
-            auto dist_left = m_reg_state.find(cond.left.v);
-            auto dist_right = m_reg_state.find(right_reg);
-            if (!dist_left || !dist_right) {
-                // this should not happen, comparison between a packet pointer and either
-                // other region's pointers or numbers; possibly raise type error
-                m_errors.push_back("one of the pointers being compared isn't packet pointer");
-                //std::cout << "type_error: one of the pointers being compared isn't packet pointer\n";
-                return;
-            }
-            dist_t left_reg_dist = dist_left.value();
-            // keep only the upper bound to generate the constraint
-            auto ub = left_reg_dist.m_dist.ub();
-            auto left = weight_t{ub};
-            dist_t right_reg_dist = dist_right.value();
-            slack_var_t s = m_slack++;
-            dist_t f = dist_t(left, s);
-            dist_t b = dist_t(right_reg_dist.m_dist);
-            auto eq = equality_t(f, b);
-            auto ineq = inequality_t(s, rop_t::R_GE, weight_t{number_t{0}});
-            if (f.is_meta_pointer() && b.is_forward_pointer()) {
-                m_extra_constraints.add_meta_and_begin_constraint(std::move(eq), std::move(ineq));
+    if (std::holds_alternative<Reg>(cond.right)) {
+        auto right_reg = std::get<Reg>(cond.right).v;
+        auto rf_left = m_reg_state.find(cond.left.v);
+        auto rf_right = m_reg_state.find(right_reg);
+        if (!rf_left || !rf_right) {
+            // this should not happen, comparison between a packet pointer and either
+            // other region's pointers or numbers; possibly raise type error
+            m_errors.push_back("one of the pointers being compared isn't packet pointer");
+            return;
+        }
+        if (cond.op == Condition::Op::LE) {
+            auto b = m_reg_state.find(register_t{11});
+            auto le_rf = *rf_left <= *rf_right;
+            if (b) {
+                b->add_constraint(le_rf);
+                if (rf_right->has_value(refinement_t::end())) {
+                    b->add_constraint(refinement_t::meta() <= refinement_t::begin());
+                }
+                else if (rf_right->has_value(refinement_t::begin())) {
+                    b->add_constraint(refinement_t::begin() <= refinement_t::end());
+                }
+                b->simplify();
+                auto b_copy = *b;
+                if (b_copy.is_bottom(m_reg_state.get_slacks())) {
+                    set_to_bottom();
+                }
+                else {
+                    m_reg_state.insert(register_t{11}, loc, std::move(*b));
+                }
             }
-            else if (f.is_forward_pointer() && b.is_backward_pointer()) {
-                m_extra_constraints.add_begin_and_end_constraint(std::move(eq), std::move(ineq));
+        }
+        else if (cond.op == Condition::Op::GT) {
+            auto b = m_reg_state.find(register_t{11});
+            auto gt_rf = *rf_left > *rf_right;
+            if (b) {
+                b->add_constraint(gt_rf);
+                b->simplify();
+                auto b_copy = *b;
+                if (b_copy.is_bottom(m_reg_state.get_slacks())) {
+                    set_to_bottom();
+                }
+                else {
+                    m_reg_state.insert(register_t{11}, loc, std::move(*b));
+                }
             }
+
         }
+        // other comparisons not supported
     }
-    else {}     //we do not need to deal with other cases
 }
 
-void offset_domain_t::update_offset_info(dist_t&& dist, interval_t&& change,
-        const location_t& loc, register_t reg) {
-    auto offset = dist.m_dist;
-    if (dist.is_forward_pointer()) offset += change;
-    else if (dist.is_backward_pointer()) offset -= change;
-    else offset -= change;
-    m_reg_state.insert(reg, loc, dist_t{offset});
+static void create_numeric_refinement(registers_state_t& reg_state, mock_interval_t&& interval,
+        location_t loc, register_t reg) {
+    symbol_t s = symbol_t::make();
+    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s));
+    reg_state.insert(reg, loc, std::move(rf));
+    reg_state.insert_slack_value(s, std::move(interval));
 }
 
-interval_t offset_domain_t::do_bin(const Bin& bin,
+void offset_domain_t::do_bin(const Bin& bin,
         const std::optional<interval_t>& src_signed_interval_opt,
         const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
         const std::optional<interval_t>& dst_signed_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
-
-    // offset domain only handles packet pointers
-    if (!is_packet_ptr(src_ptr_or_mapfd_opt) && !is_packet_ptr(dst_ptr_or_mapfd_opt))
-        return interval_t::bottom();
+        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
+        mock_interval_t &&interval_result, location_t loc) {
 
     using Op = Bin::Op;
 
     auto dst_register = register_t{bin.dst.v};
 
+    //if (!is_packet_ptr(src_ptr_or_mapfd_opt) && !is_packet_ptr(dst_ptr_or_mapfd_opt) &&
+    //        (!src_signed_interval_opt && bin.op != Op::MOV) && !dst_signed_interval_opt) {
+    //    return interval_t::bottom();
+    //}
+
     if (std::holds_alternative<Imm>(bin.v)) {
         int64_t imm;
         if (bin.is64) {
@@ -643,38 +489,45 @@ interval_t offset_domain_t::do_bin(const Bin& bin,
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm, we forget the type in the offset domain
-                m_reg_state -= dst_register;
+                create_numeric_refinement(m_reg_state, std::move(interval_result),
+                        loc, dst_register);
                 break;
             }
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
-                if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
-                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
-                        update_offset_info(std::move(*dst_offset_opt), std::move(imm_interval),
-                                loc, dst_register);
-                        return interval_t::bottom();
-                    }
+                if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                    auto rf = *dst_rf_opt + imm;
+                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                }
+                else {
+                    m_reg_state -= dst_register;
                 }
-                m_reg_state -= dst_register;
                 break;
             }
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) break;
-                if (is_packet_ptr(dst_ptr_or_mapfd_opt)) {
-                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
-                        update_offset_info(std::move(*dst_offset_opt), -std::move(imm_interval),
-                                loc, dst_register);
-                        return interval_t::bottom();
-                    }
+                if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                    auto rf = *dst_rf_opt + (-imm);
+                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                }
+                else {
+                    m_reg_state -= dst_register;
                 }
-                m_reg_state -= dst_register;
                 break;
             }
             default: {
-                // no other operations supported for offset domain
-                m_reg_state -= dst_register;
+                if (dst_signed_interval_opt) {
+                    symbol_t s = symbol_t::make();
+                    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s));
+                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                    m_reg_state.insert_slack_value(s, interval_result);
+                }
+                else {
+                    // no other operations supported for packet pointers in the offset domain
+                    m_reg_state -= dst_register;
+                }
                 break;
             }
         }
@@ -684,84 +537,74 @@ interval_t offset_domain_t::do_bin(const Bin& bin,
         switch (bin.op) {
             case Op::MOV: {
                 // ra = rb
-                if (is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                    if (auto src_offset_opt = m_reg_state.find(src.v)) {
-                        m_reg_state.insert(dst_register, loc, std::move(*src_offset_opt));
-                        return interval_t::bottom();
-                    }
+                if (auto src_rf_opt = m_reg_state.find(src.v)) {
+                    auto rf = *src_rf_opt;
+                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                }
+                else {
+                    m_reg_state -= dst_register;
                 }
-                m_reg_state -= dst_register;
                 break;
             }
             case Op::ADD: {
                 // ra += rb
-                if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_signed_interval_opt) {
-                    auto src_signed = std::move(*src_signed_interval_opt);
-                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
-                        update_offset_info(std::move(*dst_offset_opt),
-                                std::move(src_signed), loc, dst_register);
-                        return interval_t::bottom();
-                    }
-                }
-                else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_signed_interval_opt) {
-                    auto dst_signed = std::move(*dst_signed_interval_opt);
-                    if (auto src_offset_opt = m_reg_state.find(src.v)) {
-                        update_offset_info(std::move(*src_offset_opt),
-                                std::move(dst_signed), loc, dst_register);
-                        return interval_t::bottom();
-                    }
-                }
-                else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                    // we do not deal with numbers in offset domain
-                }
-                else {
+                if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
-                m_reg_state -= dst_register;
+                else {
+                    if (auto src_rf_opt = m_reg_state.find(src.v)) {
+                        if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                            auto rf = *dst_rf_opt + *src_rf_opt;
+                            m_reg_state.insert(dst_register, loc, std::move(rf));
+                        }
+                        else {
+                            m_reg_state -= dst_register;
+                        }
+                    }
+                    else {
+                        m_reg_state -= dst_register;
+                    }
+                }
                 break;
             }
             case Op::SUB: {
                 // ra -= rb
-                if (is_packet_ptr(dst_ptr_or_mapfd_opt) && src_signed_interval_opt) {
-                    if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
-                        update_offset_info(std::move(*dst_offset_opt),
-                                -std::move(*src_signed_interval_opt), loc, dst_register);
-                        return interval_t::bottom();
-                    }
-                }
-                else if (is_packet_ptr(src_ptr_or_mapfd_opt) && dst_signed_interval_opt) {
-                    m_reg_state -= dst_register;
-                }
-                else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                    // we do not deal with numbers in region domain
+                // TODO: be precise with ptr -= ptr, and possibly assign a slack to the result
+                if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
+                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                            loc, dst_register);
+                    return;
                 }
                 else {
-                    // ptr -= ptr
-                    // TODO: be precise with ptr -= ptr, especially for packet end
-                    if (is_packet_ptr(dst_ptr_or_mapfd_opt), is_packet_ptr(src_ptr_or_mapfd_opt)) {
-                        m_reg_state -= dst_register;
-                        return interval_t::top();
-                        /*
-                        if (auto dst_offset_opt = m_reg_state.find(dst_register)) {
-                            if (auto src_offset_opt = m_reg_state.find(src.v)) {
-                                return (dst_offset_opt->m_dist - src_offset_opt->m_dist);
-                            }
+                    if (auto src_rf_opt = m_reg_state.find(src.v)) {
+                        if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                            auto rf = *dst_rf_opt - *src_rf_opt;
+                            m_reg_state.insert(dst_register, loc, std::move(rf));
                         }
-                        */
+                        else {
+                            m_reg_state -= dst_register;
+                        }
+                    }
+                    else {
+                        m_reg_state -= dst_register;
                     }
                 }
-                m_reg_state -= dst_register;
                 break;
             }
             default: {
-                // no other operations supported for offset domain
-                m_reg_state -= dst_register;
+                if (dst_ptr_or_mapfd_opt || src_ptr_or_mapfd_opt) {
+                    // no other operations supported for packet pointers in the offset domain
+                    m_reg_state -= dst_register;
+                }
+                else {
+                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                            loc, dst_register);
+                }
                 break;
             }
         }
     }
-    return interval_t::bottom();
 }
 
 void offset_domain_t::operator()(const Bin& bin, location_t loc) {
@@ -773,7 +616,16 @@ void offset_domain_t::operator()(const Undefined& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const Un& u, location_t loc) {
-    m_reg_state -= u.dst.v;
+    // nothing to do here
+}
+
+void offset_domain_t::do_un(const Un& u, interval_t interval, location_t loc) {
+    if (interval == interval_t::bottom()) {
+        m_reg_state -= u.dst.v;
+    }
+    else {
+        create_numeric_refinement(m_reg_state, std::move(interval), loc, register_t{u.dst.v});
+    }
 }
 
 void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
@@ -782,16 +634,23 @@ void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
 
 void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
     for (const auto& kv : cells) {
-        auto offset = kv.first;
+        auto rf = kv.first;
         auto width = kv.second;
-        auto overlapping_cells
-            = m_stack_state.find_overlapping_cells(offset, width);
+        auto overlapping_cells = m_stack_state.find_overlapping_cells(rf, width);
         m_stack_state -= overlapping_cells;
     }
-    m_reg_state -= register_t{R0_RETURN_VALUE};
     m_reg_state.scratch_caller_saved_registers();
+    register_t r0{R0_RETURN_VALUE};
     if (u.reallocate_packet) {
-        m_reg_state.forget_packet_pointers();
+        m_reg_state -= r0;
+        m_reg_state.forget_packet_pointers(loc);
+    }
+    else if (u.is_map_lookup) {
+        m_reg_state -= r0;
+    }
+    else {
+        // slack needs to be fixed, as it can have any value
+        create_numeric_refinement(m_reg_state, mock_interval_t::top(), loc, r0);
     }
 }
 
@@ -805,7 +664,8 @@ void offset_domain_t::operator()(const Jmp& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const Packet& u, location_t loc) {
-    m_reg_state -= register_t{R0_RETURN_VALUE};
+    create_numeric_refinement(m_reg_state, mock_interval_t::top(), loc,
+            register_t{R0_RETURN_VALUE});
     m_reg_state.scratch_caller_saved_registers();
 }
 
@@ -850,12 +710,12 @@ bool offset_domain_t::upper_bound_satisfied(const dist_t& dist, int offset, int
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
-    auto it = m_reg_state.find(r.v);
-    if (!it) return false;
-    dist_t dist = it.value();
-
-    return (lower_bound_satisfied(dist, offset)
-            && upper_bound_satisfied(dist, offset, width, is_comparison_check));
+    auto begin = m_reg_state.find(register_t{11});
+    if (!begin) return false;
+    auto reg = m_reg_state.find(r.v);
+    if (!reg) return false;
+    auto toCheck = *reg + (offset+width);
+    return toCheck.is_safe_with(*begin, m_reg_state.get_slacks(), is_comparison_check);
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
@@ -865,7 +725,6 @@ void offset_domain_t::check_valid_access(const ValidAccess& s,
     bool is_comparison_check = s.width == (Value)Imm{0};
     if (check_packet_access(s.reg, w, s.offset, is_comparison_check)) return;
     m_errors.push_back("valid access check failed");
-    //std::cout << "type_error: valid access assert fail\n";
 }
 
 void offset_domain_t::operator()(const Assert &u, location_t loc) {
@@ -876,10 +735,14 @@ void offset_domain_t::operator()(const basic_block_t& bb, int print) {
     // nothing to do here
 }
 
-void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> maybe_targetreg_type, std::optional<ptr_or_mapfd_t>& maybe_basereg_type) {
+void offset_domain_t::do_mem_store(const Mem& b,
+        std::optional<ptr_or_mapfd_t>& maybe_basereg_type) {
+    auto target_reg = std::get<Reg>(b.value);
+    auto rf_info = m_reg_state.find(target_reg.v);
+    if (!rf_info) return;
+
     int offset = b.access.offset;
     int width = b.access.width;
-
     if (is_stack_ptr(maybe_basereg_type)) {
         auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
         auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
@@ -888,23 +751,25 @@ void offset_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> m
         auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
         m_stack_state -= overlapping_cells;
 
-        if (!is_packet_ptr(maybe_targetreg_type)) return;
-        auto target_reg = std::get<Reg>(b.value);
-        auto offset_info = m_reg_state.find(target_reg.v);
-        if (!offset_info) {
-            m_errors.push_back("register is a packet_pointer and no offset info found");
-            //std::cout << "type_error: register is a packet_pointer and no offset info found\n";
-                return;
-        }
-        m_stack_state.store(store_at, *offset_info, width);
+        m_stack_state.store(store_at, *rf_info, width);
     }
 }
 
 void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
-        std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
+        std::optional<ptr_or_mapfd_t> basereg_type, interval_t &&interval_result, location_t loc) {
 
     bool is_stack_p = is_stack_ptr(basereg_type);
     bool is_ctx_p = is_ctx_ptr(basereg_type);
+    bool is_packet_p = is_packet_ptr(basereg_type);
+    bool is_shared_p = is_shared_ptr(basereg_type);
+
+    if (interval_result != interval_t::bottom()) {
+        if (is_ctx_p || is_shared_p || is_packet_p) {
+            create_numeric_refinement(m_reg_state, std::move(interval_result), loc,
+                    target_register);
+            return;
+        }
+    }
 
     if (!is_stack_p && !is_ctx_p) {
         m_reg_state -= target_register;
@@ -931,7 +796,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
         m_reg_state.insert(target_register, loc, std::move(it->first));
     }
     else if (is_ctx_p) {
-        auto it = m_ctx_dists->find(load_at);
+        auto it = m_ctx_rfs->find(load_at);
         if (!it) {
             m_reg_state -= target_register;
             return;
@@ -944,27 +809,27 @@ void offset_domain_t::operator()(const Mem& b, location_t loc) {
     // nothing to do here
 }
 
-std::optional<dist_t> offset_domain_t::find_offset_at_loc(const reg_with_loc_t reg) const {
+std::optional<refinement_t> offset_domain_t::find_refinement_at_loc(const reg_with_loc_t reg) const {
     return m_reg_state.find(reg);
 }
 
-std::optional<dist_t> offset_domain_t::find_in_ctx(int key) const {
-    return m_ctx_dists->find(key);
+std::optional<refinement_t> offset_domain_t::find_in_ctx(int key) const {
+    return m_ctx_rfs->find(key);
 }
 
-std::optional<dist_cells_t> offset_domain_t::find_in_stack(int key) const {
+std::optional<refinement_cells_t> offset_domain_t::find_in_stack(int key) const {
     return m_stack_state.find(key);
 }
 
-std::optional<dist_t> offset_domain_t::find_offset_info(register_t reg) const {
+std::optional<refinement_t> offset_domain_t::find_refinement_info(register_t reg) const {
     return m_reg_state.find(reg);
 }
 
-void offset_domain_t::insert_in_registers(register_t reg, location_t loc, dist_t dist) {
-    m_reg_state.insert(reg, loc, std::move(dist));
+void offset_domain_t::insert_in_registers(register_t reg, location_t loc, refinement_t rf) {
+    m_reg_state.insert(reg, loc, std::move(rf));
 }
 
-void offset_domain_t::store_in_stack(uint64_t key, dist_t d, int width) {
+void offset_domain_t::store_in_stack(uint64_t key, refinement_t d, int width) {
     m_stack_state.store(key, d, width);
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index e116af30f..1842e4040 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -3,111 +3,48 @@
 
 #pragma once
 
-#include "crab/common.hpp"
+#include "crab/refinement.hpp"
 
 namespace crab {
 
-constexpr int PACKET_END = -4100;
-constexpr int PACKET_META = -1;
-
-using weight_t = interval_t;
-using slack_var_t = int;
-
-enum class rop_t {
-    R_GT,
-    R_GE,
-    R_LT,
-    R_LE
-};
-
-struct dist_t {
-    slack_var_t m_slack;
-    weight_t m_dist;
-    bool m_is_bottom = false;
-
-    dist_t(weight_t d, slack_var_t s = -1, bool bottom = false)
-        : m_slack(s), m_dist(d), m_is_bottom(bottom) {}
-    dist_t() : m_slack(-1), m_dist(weight_t::top()), m_is_bottom(false) {}
-    bool operator==(const dist_t& d) const;
-    void write(std::ostream&) const;
-    bool is_top() const;
-    bool is_bottom() const;
-    void set_to_top();
-    void set_to_bottom();
-    friend std::ostream& operator<<(std::ostream& o, const dist_t& d);
-    bool is_meta_pointer() const;
-    bool is_forward_pointer() const;
-    bool is_backward_pointer() const;
-    weight_t offset_from_reference() const;
-};
-
-struct inequality_t {
-    slack_var_t m_slack;
-    rop_t m_rel;
-    weight_t m_value;
-    bool m_is_bottom = false;
-
-    inequality_t(slack_var_t slack, rop_t rel, weight_t val) : m_slack(slack), m_rel(rel)
-                                                               , m_value(val) {}
-    inequality_t() : m_slack(-1), m_value(weight_t::top()) {}
-    bool is_top() const;
-    bool is_bottom() const;
-    void set_to_top();
-    void set_to_bottom();
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream&, const inequality_t&);
-};    // represents `slack rel value;`, e.g., `s >= 0`
-
-struct equality_t {
-    dist_t m_lhs;
-    dist_t m_rhs;
-    bool m_is_bottom = false;
-
-    equality_t(dist_t lhs, dist_t rhs) : m_lhs(lhs), m_rhs(rhs) {}
-    equality_t() = default;
-    bool is_top() const;
-    bool is_bottom() const;
-    void set_to_top();
-    void set_to_bottom();
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream&, const equality_t&);
-};  // represents constraint `p[0] = p[1];`, e.g., `begin+8+s = end`
-
-struct packet_constraint_t {
-    equality_t m_eq;
-    inequality_t m_ineq;
-    bool m_is_meta_constraint;
-    bool m_is_bottom = false;
-
-    bool is_bottom() const;
-    bool is_top() const;
-    void set_to_bottom();
-    void set_to_top();
-    std::optional<bound_t> get_limit() const;
-    packet_constraint_t() = default;
-    packet_constraint_t(equality_t&& eq, inequality_t&& ineq, bool is_meta_constraint,
-            bool is_bottom = false) : m_eq(eq), m_ineq(ineq),
-    m_is_meta_constraint(is_meta_constraint), m_is_bottom(is_bottom) {}
-    packet_constraint_t operator|(const packet_constraint_t&) const;
-    void write(std::ostream&) const;
-    friend std::ostream& operator<<(std::ostream&, const packet_constraint_t&);
-};
-
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
-using global_offset_env_t = std::unordered_map<reg_with_loc_t, dist_t>;
+using live_refinements_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS+3>;
+using global_offset_env_t = std::unordered_map<reg_with_loc_t, refinement_t>;
 
 class registers_state_t {
 
-    live_registers_t m_cur_def;
+    live_refinements_t m_cur_def;
     std::shared_ptr<global_offset_env_t> m_offset_env;
+    std::shared_ptr<slacks_t> m_slacks;
     bool m_is_bottom = false;
 
     public:
-        registers_state_t(bool is_bottom = false) : m_offset_env(nullptr), m_is_bottom(is_bottom) {}
-        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env, bool is_bottom = false) : m_offset_env(offset_env), m_is_bottom(is_bottom) {}
-        explicit registers_state_t(live_registers_t&& vars, std::shared_ptr<global_offset_env_t>
-                offset_env, bool is_bottom = false)
-            : m_cur_def(std::move(vars)), m_offset_env(std::move(offset_env)), m_is_bottom(is_bottom) {}
+        registers_state_t(bool is_bottom = false) : m_offset_env(nullptr), m_slacks(nullptr),
+        m_is_bottom(is_bottom) {}
+        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env,
+                std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
+            : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {}
+        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env,
+                std::shared_ptr<slacks_t> slacks, const ebpf_context_descriptor_t* desc,
+                bool is_bottom = false)
+            : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {
+
+            auto loc = std::make_pair(label_t::entry, (unsigned int)0);
+            if (desc->data >= 0) {
+                insert(register_t{11}, loc, refinement_t::begin());
+            }
+            if (desc->end >= 0) {
+                insert(register_t{12}, loc, refinement_t::end());
+            }
+            if (desc->meta >= 0) {
+                insert(register_t{13}, loc, refinement_t::meta());
+            }
+        }
+
+        explicit registers_state_t(live_refinements_t&& vars,
+                std::shared_ptr<global_offset_env_t> offset_env,
+                std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
+            : m_cur_def(std::move(vars)), m_offset_env(offset_env), m_slacks(slacks),
+            m_is_bottom(is_bottom) {}
 
         registers_state_t operator|(const registers_state_t&) const;
         void operator-=(register_t);
@@ -115,27 +52,29 @@ class registers_state_t {
         void set_to_bottom();
         bool is_bottom() const;
         bool is_top() const;
-        void insert(register_t, const location_t&, dist_t&&);
-        std::optional<dist_t> find(reg_with_loc_t reg) const;
-        std::optional<dist_t> find(register_t key) const;
+        void insert(register_t, const location_t&, refinement_t&&);
+        void insert_slack_value(symbol_t, mock_interval_t);
+        std::shared_ptr<slacks_t> get_slacks() const { return m_slacks; }
+        std::optional<mock_interval_t> find_slack_value(symbol_t) const;
+        std::optional<refinement_t> find(reg_with_loc_t reg) const;
+        std::optional<refinement_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
         void adjust_bb_for_registers(location_t);
         void scratch_caller_saved_registers();
-        void forget_packet_pointers();
+        void forget_packet_pointers(location_t);
 };
 
-using dist_cells_t = std::pair<dist_t, int>;
-using stack_slot_dists_t = std::map<uint64_t, dist_cells_t>;    // represents `sp[n] = dist;`, where n \belongs [0,511], e.g., `sp[508] = begin+16`
-
+using refinement_cells_t = std::pair<refinement_t, int>;
+using stack_slot_refinements_t = std::map<uint64_t, refinement_cells_t>;
 class stack_state_t {
 
-    stack_slot_dists_t m_slot_dists;
+    stack_slot_refinements_t m_slot_rfs;
     bool m_is_bottom = false;
 
     public:
         stack_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        std::optional<dist_cells_t> find(uint64_t) const;
-        void store(uint64_t, dist_t, int);
+        std::optional<refinement_cells_t> find(uint64_t) const;
+        void store(uint64_t, refinement_t, int);
         void operator-=(uint64_t);
         void operator-=(const std::vector<uint64_t>&);
         void set_to_top();
@@ -144,43 +83,19 @@ class stack_state_t {
         bool is_top() const;
         static stack_state_t top();
         stack_state_t operator|(const stack_state_t&) const;
-        explicit stack_state_t(stack_slot_dists_t&& stack_dists, bool is_bottom = false)
-            : m_slot_dists(std::move(stack_dists)), m_is_bottom(is_bottom) {}
+        explicit stack_state_t(stack_slot_refinements_t&& stack_rfs, bool is_bottom = false)
+            : m_slot_rfs(std::move(stack_rfs)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
 };
 
-class extra_constraints_t {
-
-    packet_constraint_t m_meta_and_begin;
-    packet_constraint_t m_begin_and_end;
-    bool m_is_bottom = false;
-
-    public:
-        extra_constraints_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        bool is_bottom() const;
-        bool is_top() const;
-        void set_to_top();
-        void set_to_bottom();
-        void normalize();
-        std::optional<bound_t> get_end_limit() const;
-        std::optional<bound_t> get_meta_limit() const;
-        void add_meta_and_begin_constraint(equality_t&&, inequality_t&&);
-        void add_begin_and_end_constraint(equality_t&&, inequality_t&&);
-        extra_constraints_t operator|(const extra_constraints_t&) const;
-        explicit extra_constraints_t(packet_constraint_t&& meta_and_begin,
-                packet_constraint_t&& begin_and_end, bool is_bottom = false)
-            : m_meta_and_begin(meta_and_begin), m_begin_and_end(begin_and_end),
-            m_is_bottom(is_bottom) {}
-};
-
 class ctx_offsets_t {
-    using ctx_dists_t = std::unordered_map<int, dist_t>;    // represents `cp[n] = dist;`
-    ctx_dists_t m_dists;
+    using ctx_refinements_t = std::unordered_map<int, refinement_t>;    // represents `cp[n] = rf;`
+    ctx_refinements_t m_rfs;
     int m_size;
 
     public:
         ctx_offsets_t(const ebpf_context_descriptor_t* desc);
-        std::optional<dist_t> find(int) const;
+        std::optional<refinement_t> find(int) const;
         int get_size() const;
 };
 
@@ -189,10 +104,8 @@ class offset_domain_t final {
     bool m_is_bottom = false;
     registers_state_t m_reg_state;
     stack_state_t m_stack_state;
-    extra_constraints_t m_extra_constraints;
-    std::shared_ptr<ctx_offsets_t> m_ctx_dists;
+    std::shared_ptr<ctx_offsets_t> m_ctx_rfs;
     std::vector<std::string> m_errors;
-    slack_var_t m_slack = 0;
 
   public:
     offset_domain_t() = default;
@@ -201,13 +114,8 @@ class offset_domain_t final {
     offset_domain_t& operator=(offset_domain_t&& o) = default;
     offset_domain_t& operator=(const offset_domain_t& o) = default;
     explicit offset_domain_t(registers_state_t&& reg, stack_state_t&& stack,
-            extra_constraints_t extra, std::shared_ptr<ctx_offsets_t> ctx, slack_var_t s = 0)
-        : m_reg_state(std::move(reg)), m_stack_state(std::move(stack)),
-        m_extra_constraints(std::move(extra)), m_ctx_dists(ctx), m_slack(s) {}
-
-    explicit offset_domain_t(registers_state_t&& reg, stack_state_t&& stack,
-            std::shared_ptr<ctx_offsets_t> ctx, slack_var_t s = 0) : m_reg_state(std::move(reg)),
-    m_stack_state(std::move(stack)), m_ctx_dists(ctx), m_slack(s) {}
+            std::shared_ptr<ctx_offsets_t> ctx)
+        : m_reg_state(std::move(reg)), m_stack_state(std::move(stack)), m_ctx_rfs(ctx) {}
 
     static offset_domain_t&& setup_entry();
     // bottom/top
@@ -255,25 +163,24 @@ class offset_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t loc);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&);
-    interval_t do_bin(const Bin&, const std::optional<interval_t>&,
+    void do_un(const Un&, interval_t, location_t);
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, interval_t&&,
+            location_t);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
+    void do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&,
             const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&, location_t);
+            const std::optional<ptr_or_mapfd_t>&, mock_interval_t&&, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
-    bool upper_bound_satisfied(const dist_t&, int, int, bool) const;
-    bool lower_bound_satisfied(const dist_t&, int) const;
     bool check_packet_access(const Reg&, int, int, bool) const;
     void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
 
-    std::optional<dist_t> find_in_ctx(int) const;
-    std::optional<dist_cells_t> find_in_stack(int) const;
-    std::optional<dist_t> find_offset_at_loc(const reg_with_loc_t) const;
-    std::optional<dist_t> find_offset_info(register_t reg) const;
-    void update_offset_info(dist_t&&, interval_t&&, const location_t&, register_t);
-    void insert_in_registers(register_t, location_t, dist_t);
-    void store_in_stack(uint64_t, dist_t, int);
+    std::optional<refinement_t> find_in_ctx(int) const;
+    std::optional<refinement_cells_t> find_in_stack(int) const;
+    std::optional<refinement_t> find_refinement_at_loc(const reg_with_loc_t) const;
+    std::optional<refinement_t> find_refinement_info(register_t reg) const;
+    void insert_in_registers(register_t, location_t, refinement_t);
+    void store_in_stack(uint64_t, refinement_t, int);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index f85b92f14..cc618bc74 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -895,16 +895,21 @@ void region_domain_t::operator()(const Bin& b, location_t loc) {
     // nothing to do here
 }
 
-interval_t region_domain_t::do_bin(const Bin& bin,
+void region_domain_t::do_bin(const Bin& bin,
         const std::optional<interval_t>& src_signed_interval_opt,
         const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
         const std::optional<interval_t>& dst_signed_interval_opt,
         const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
 
-    using Op = Bin::Op;
-
     auto dst_register = register_t{bin.dst.v};
 
+    if (!dst_ptr_or_mapfd_opt && !src_ptr_or_mapfd_opt) {
+        m_registers -= dst_register;
+        return;
+    }
+
+    using Op = Bin::Op;
+
     if (std::holds_alternative<Imm>(bin.v)) {
         int64_t imm;
         if (bin.is64) {
@@ -988,11 +993,11 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                     update_ptr_or_mapfd(std::move(src_ptr_or_mapfd),
                             std::move(dst_signed), loc, dst_register);
                 }
-                else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                    // we do not deal with numbers in region domain
-                    m_registers -= dst_register;
-                }
-                else {
+                // else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                //     // we do not deal with numbers in region domain
+                //     m_registers -= dst_register;
+                // }
+                else if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
@@ -1009,31 +1014,13 @@ interval_t region_domain_t::do_bin(const Bin& bin,
                 else if (src_ptr_or_mapfd_opt && dst_signed_interval_opt) {
                     m_registers -= dst_register;
                 }
-                else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                    // we do not deal with numbers in region domain
-                    m_registers -= dst_register;
-                }
+                // else if (dst_signed_interval_opt && src_signed_interval_opt) {
+                //     // we do not deal with numbers in region domain
+                //     m_registers -= dst_register;
+                // }
                 else {
                     // ptr -= ptr
-                    if (std::holds_alternative<mapfd_t>(*dst_ptr_or_mapfd_opt) &&
-                            std::holds_alternative<mapfd_t>(*src_ptr_or_mapfd_opt)) {
-                        m_errors.push_back("mapfd registers subtraction not defined");
-                    }
-                    else if (same_region(*dst_ptr_or_mapfd_opt, *src_ptr_or_mapfd_opt)) {
-                        if (std::holds_alternative<ptr_with_off_t>(*dst_ptr_or_mapfd_opt) &&
-                                std::holds_alternative<ptr_with_off_t>(*src_ptr_or_mapfd_opt)) {
-                            auto dst_ptr_with_off = std::get<ptr_with_off_t>(*dst_ptr_or_mapfd_opt);
-                            auto src_ptr_with_off = std::get<ptr_with_off_t>(*src_ptr_or_mapfd_opt);
-                            return (dst_ptr_with_off.get_offset().to_interval() -
-                                src_ptr_with_off.get_offset().to_interval());
-                        }
-                    }
-                    else {
-                        // Assertions should make sure we only perform this on
-                        // non-shared pointers, hence this should not happen
-                        m_errors.push_back("subtraction between pointers of different region");
-                    }
-                    m_registers -= dst_register;
+                    // this case already handled in type domain
                 }
                 break;
             }
@@ -1044,7 +1031,7 @@ interval_t region_domain_t::do_bin(const Bin& bin,
             }
         }
     }
-    return interval_t::bottom();
+    return;
 }
 
 void region_domain_t::do_load(const Mem& b, const register_t& target_register, bool unknown_ptr,
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index cb2f912c0..5fdeb956a 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -165,7 +165,7 @@ class region_domain_t final {
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&, location_t);
-    interval_t do_bin(const Bin&, const std::optional<interval_t>&,
+    void do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&,
             const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&, location_t);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index c49c2daee..8f5e39345 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -106,14 +106,25 @@ string_invariant type_domain_t::to_set() const {
     if (is_top()) return string_invariant::top();
     std::set<std::string> result;
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
-        std::stringstream elem;
         auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
-        // TODO: Only allowing signed intervals for now, because otherwise parsing needs to be
-        // changed; support unsigned intervals
+        auto maybe_rf = m_offset.find_refinement_info(register_t{i});
+        if (maybe_ptr_or_mapfd.has_value()) {
+            std::stringstream elem;
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, std::nullopt, false);
+            result.insert(elem.str());
+        }
         auto maybe_signed_interval = m_interval.find_signed_interval_value(register_t{i});
-        auto maybe_offset = m_offset.find_offset_info(register_t{i});
-        if (maybe_ptr_or_mapfd.has_value() || maybe_signed_interval.has_value()) {
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_offset, maybe_signed_interval);
+        if (maybe_signed_interval.has_value()) {
+            std::stringstream elem;
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf,
+                    maybe_signed_interval, true);
+            result.insert(elem.str());
+        }
+        auto maybe_unsigned_interval = m_interval.find_unsigned_interval_value(register_t{i});
+        if (maybe_unsigned_interval.has_value()) {
+            std::stringstream elem;
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf,
+                    maybe_unsigned_interval, false);
             result.insert(elem.str());
         }
     }
@@ -121,15 +132,15 @@ string_invariant type_domain_t::to_set() const {
     for (auto const& k : stack_keys_region) {
         std::stringstream elem;
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
-        auto dist = m_offset.find_in_stack(k);
+        auto rf = m_offset.find_in_stack(k);
         if (maybe_ptr_or_mapfd_cells.has_value()) {
             auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             elem << "stack";
-            if (dist) {
+            if (rf) {
                 print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd,
-                        std::optional<dist_t>(dist->first));
+                        std::optional<refinement_t>(rf->first));
             }
             else {
                 print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd);
@@ -140,17 +151,24 @@ string_invariant type_domain_t::to_set() const {
 
     std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
     for (auto const& k : stack_keys_interval) {
-        std::stringstream elem;
-        // TODO: Only allowing signed intervals for now, because otherwise parsing needs to be
-        // changed; support unsigned intervals
         auto maybe_interval_cells_signed = m_interval.find_in_stack_signed(k);
         if (maybe_interval_cells_signed.has_value()) {
-            auto interval_cells = maybe_interval_cells_signed.value();
+            std::stringstream elem;
+            auto signed_interval_cells = maybe_interval_cells_signed.value();
             elem << "stack";
-            print_numeric_memory_cell(elem, k, k+interval_cells.second-1,
-                    interval_cells.first.to_interval());
+            print_numeric_memory_cell(elem, k, k+signed_interval_cells.second,
+                    signed_interval_cells.first.to_interval(), true);
+            result.insert(elem.str());
+        }
+        auto maybe_interval_cells_unsigned = m_interval.find_in_stack_unsigned(k);
+        if (maybe_interval_cells_unsigned.has_value()) {
+            std::stringstream elem;
+            auto unsigned_interval_cells = maybe_interval_cells_unsigned.value();
+            elem << "stack";
+            print_numeric_memory_cell(elem, k, k+unsigned_interval_cells.second,
+                    unsigned_interval_cells.first.to_interval(), false);
+            result.insert(elem.str());
         }
-        result.insert(elem.str());
     }
     return string_invariant{result};
 }
@@ -161,8 +179,12 @@ void type_domain_t::operator()(const Undefined& u, location_t loc) {
 
 void type_domain_t::operator()(const Un& u, location_t loc) {
     m_region(u, loc);
-    m_offset(u, loc);
     m_interval(u, loc);
+    // TODO: check if we need to get signed values in any case
+    auto mock_interval_opt = m_interval.find_unsigned_interval_value(u.dst.v);
+    auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
+        : interval_t::bottom();
+    m_offset.do_un(u, interval, loc);
 }
 
 void type_domain_t::operator()(const LoadMapFd& u, location_t loc) {
@@ -505,31 +527,68 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
         dst_unsigned_interval = dst_mock_unsigned_interval->to_interval();
     }
 
-    interval_t subtracted_reg = m_region.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
-            dst_signed_interval, dst_ptr_or_mapfd, loc);
-    interval_t subtracted_off = m_offset.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
-            dst_signed_interval, dst_ptr_or_mapfd, loc);
-    auto subtracted = subtracted_reg.is_bottom() ? subtracted_off : subtracted_reg;
+    auto dst_register = register_t{bin.dst.v};
+    interval_t subtracted = interval_t::bottom();
+    using Op = Bin::Op;
+    // ptr -= ptr
+    if (std::holds_alternative<Reg>(bin.v) && bin.op == Op::SUB) {
+        if (dst_ptr_or_mapfd && src_ptr_or_mapfd) {
+            auto dst_ptr = *dst_ptr_or_mapfd;
+            auto src_ptr = *src_ptr_or_mapfd;
+            if (std::holds_alternative<mapfd_t>(dst_ptr)
+                    && std::holds_alternative<mapfd_t>(src_ptr)) {
+                m_errors.push_back("mapfd registers subtraction not defined");
+            }
+            else if (same_region(dst_ptr, src_ptr)) {
+                if (std::holds_alternative<ptr_with_off_t>(dst_ptr)) {
+                    auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr);
+                    auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr);
+                    subtracted = dst_ptr_with_off.get_offset().to_interval() -
+                                src_ptr_with_off.get_offset().to_interval();
+                }
+                else if (std::holds_alternative<packet_ptr_t>(dst_ptr)) {
+                    subtracted = interval_t::top();
+                }
+                else {
+                    // Assertions should make sure we only perform this on
+                    // non-shared pointers, hence this should not happen
+                    m_errors.push_back("subtraction between pointers of different region");
+                }
+            }
+            m_region -= dst_register;
+            m_offset -= dst_register;
+        }
+    }
+
     m_interval.do_bin(bin, src_signed_interval, src_unsigned_interval, src_ptr_or_mapfd,
             dst_signed_interval, dst_unsigned_interval, dst_ptr_or_mapfd, subtracted, loc);
+    // TODO: check if we need to get signed values in any case
+    auto mock_interval_result = m_interval.find_unsigned_interval_value(dst_register);
+    auto interval_result = std::move(mock_interval_result ? *mock_interval_result
+        : mock_interval_t::top());
+    m_region.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
+            dst_signed_interval, dst_ptr_or_mapfd, loc);
+    m_offset.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
+            dst_signed_interval, dst_ptr_or_mapfd, std::move(interval_result), loc);
 }
 
 void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
     m_region.do_load(b, register_t{target_reg.v}, unknown_ptr, loc);
-    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
     // TODO: replace with a bool value returned from region do_load
     auto load_in_region = m_region.find_ptr_or_mapfd_type(target_reg.v).has_value();
     m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, load_in_region, loc);
+    auto mock_interval_opt = m_interval.find_unsigned_interval_value(target_reg.v);
+    auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
+        : interval_t::bottom();
+    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, std::move(interval), loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> target_opt,
-        std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc) {
+void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt,
+        location_t loc) {
     m_region.do_mem_store(b, loc);
     m_interval.do_mem_store(b, basereg_opt);
-    // TODO: replace target_opt with a bool value representing whether we have a packet pointer,
-    // because that is the case target_opt is needed for
-    m_offset.do_mem_store(b, target_opt, basereg_opt);
+    m_offset.do_mem_store(b, basereg_opt);
 }
 
 void type_domain_t::operator()(const Mem& b, location_t loc) {
@@ -543,12 +602,11 @@ void type_domain_t::operator()(const Mem& b, location_t loc) {
     }
     if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
-        auto targetreg_type = m_region.find_ptr_or_mapfd_type(targetreg.v);
         if (b.is_load) do_load(b, targetreg, unknown_ptr, base_ptr_or_mapfd_opt, loc);
-        else if (!unknown_ptr) do_mem_store(b, targetreg_type, base_ptr_or_mapfd_opt, loc);
+        else if (!unknown_ptr) do_mem_store(b, base_ptr_or_mapfd_opt, loc);
     }
     else if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, std::nullopt, base_ptr_or_mapfd_opt, loc);
+        do_mem_store(b, base_ptr_or_mapfd_opt, loc);
     }
 }
 
@@ -581,7 +639,7 @@ void type_domain_t::print_stack() const {
             std::cout << "\t\t";
             if (dist) {
                 print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd,
-                        std::optional<dist_t>(dist->first));
+                        std::optional<refinement_t>(dist->first));
             }
             else {
                 print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd);
@@ -590,13 +648,20 @@ void type_domain_t::print_stack() const {
         }
     }
     for (auto const& k : stack_keys_interval) {
-        auto maybe_interval_cells = m_interval.find_in_stack_signed(k);
-        // TODO: also handle unsigned intervals
-        if (maybe_interval_cells) {
-            auto interval_cells = maybe_interval_cells.value();
+        auto maybe_signed_interval_cells = m_interval.find_in_stack_signed(k);
+        if (maybe_signed_interval_cells) {
+            auto interval_cells = maybe_signed_interval_cells.value();
             std::cout << "\t\t";
             print_numeric_memory_cell(std::cout, k, k+interval_cells.second-1,
-                    interval_cells.first.to_interval());
+                    interval_cells.first.to_interval(), true);
+            std::cout << ",\n";
+        }
+        auto maybe_unsigned_interval_cells = m_interval.find_in_stack_unsigned(k);
+        if (maybe_unsigned_interval_cells) {
+            auto interval_cells = maybe_unsigned_interval_cells.value();
+            std::cout << "\t\t";
+            print_numeric_memory_cell(std::cout, k, k+interval_cells.second-1,
+                    interval_cells.first.to_interval(), false);
             std::cout << ",\n";
         }
     }
@@ -643,9 +708,9 @@ type_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_region.find_ptr_or_mapfd_at_loc(loc);
 }
 
-std::optional<crab::dist_t>
-type_domain_t::find_offset_at_loc(const crab::reg_with_loc_t& loc) const {
-    return m_offset.find_offset_at_loc(loc);
+std::optional<crab::refinement_t>
+type_domain_t::find_refinement_at_loc(const crab::reg_with_loc_t& loc) const {
+    return m_offset.find_refinement_at_loc(loc);
 }
 
 std::optional<crab::mock_interval_t>
@@ -700,11 +765,12 @@ void type_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, moc
     m_interval.store_in_stack_unsigned(key, p, width);
 }
 
-void type_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc, dist_t d) {
+void type_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc,
+        refinement_t d) {
     m_offset.insert_in_registers(r, loc, d);
 }
 
-void type_domain_t::store_in_stack_in_offset_domain(uint64_t key, dist_t d, int width) {
+void type_domain_t::store_in_stack_in_offset_domain(uint64_t key, refinement_t d, int width) {
     m_offset.store_in_stack(key, d, width);
 }
 
@@ -719,6 +785,8 @@ void type_domain_t::store_in_stack_in_region_domain(uint64_t key, ptr_or_mapfd_t
 
 type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>& types,
         bool setup_constraints) {
+    // TODO: redo the method according to the new offset domain
+    // also, need to store the intervals in the offset domain
     using std::regex;
     using std::regex_match;
 
@@ -730,7 +798,8 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
     #define SHARED_PTR "\\s*shared_p(?:" NUMERIC_NUMERIC_ENCLOSED ")?\\s*"
     #define CTX_OR_STACK_PTR "\\s*(ctx|stack)_p(?:" NUMERIC_ENCLOSED ")?\\s*"
     #define PACKET_PTR "\\s*packet_p(?:<(begin|end|meta)\\+" NUMERIC ">)?\\s*"
-    #define NUMBER "\\s*number(?:" NUMERIC_ENCLOSED ")?\\s*"
+    #define SNUMBER "\\s*snumber(?:" NUMERIC_ENCLOSED ")?\\s*"
+    #define UNUMBER "\\s*unumber(?:" NUMERIC_ENCLOSED ")?\\s*"
     #define MAPFD "\\s*(map_fd|map_fd_programs)" NUMERIC "\\s*"
 
     auto create_interval = [](std::string lb, std::string ub) {
@@ -780,6 +849,7 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
         }
     };
 
+    /*
     auto create_pkt_offset = [create_interval](std::string offset_type, std::string offset_lb,
             std::string offset_ub) {
         auto offset = create_interval(offset_lb, offset_ub).to_interval();
@@ -795,6 +865,7 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
             return dist_t{packet_meta - offset};
         }
     };
+    */
 
     type_domain_t typ;
     if (setup_constraints) {
@@ -812,22 +883,28 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
             typ.insert_in_registers_in_region_domain(reg, loc, ptr);
         }
         else if (regex_match(t, m, regex(REG ":" PACKET_PTR))) {
+            /*
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto ptr = packet_ptr_t{};
             auto offset = create_pkt_offset(m[2], m[3], m[4]);
             typ.insert_in_registers_in_region_domain(reg, loc, ptr);
             typ.insert_in_registers_in_offset_domain(reg, loc, offset);
+            */
         }
         else if (regex_match(t, m, regex(REG ":" SHARED_PTR))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto ptr = create_ptr("shared", m[2], m[3], m[4], m[5]);
             typ.insert_in_registers_in_region_domain(reg, loc, ptr);
         }
-        else if (regex_match(t, m, regex(REG ":" NUMBER))) {
+        else if (regex_match(t, m, regex(REG ":" SNUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto num = create_interval(m[2], m[3]).to_interval();
-            // TODO: support separately for signed and unsigned intervals
-            typ.insert_in_registers_in_interval_domain(reg, loc, num);
+            typ.insert_in_registers_in_signed_interval_domain(reg, loc, num);
+        }
+        else if (regex_match(t, m, regex(REG ":" UNUMBER))) {
+            auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
+            auto num = create_interval(m[2], m[3]).to_interval();
+            typ.insert_in_registers_in_unsigned_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" MAPFD))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
@@ -842,6 +919,7 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
                     stack_cell_end-stack_cell_start);
         }
         else if (regex_match(t, m, regex(STACK_CELL ":" PACKET_PTR))) {
+            /*
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
             auto stack_cell_end = std::stoi(m[2]);
             auto ptr = packet_ptr_t{};
@@ -849,6 +927,7 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
             int width = stack_cell_end - stack_cell_start;
             typ.store_in_stack_in_region_domain(stack_cell_start, ptr, width);
             typ.store_in_stack_in_offset_domain(stack_cell_start, pkt_offset, width);
+            */
         }
         else if (regex_match(t, m, regex(STACK_CELL ":" SHARED_PTR))) {
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
@@ -857,11 +936,18 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
             typ.store_in_stack_in_region_domain(stack_cell_start, ptr,
                     stack_cell_end-stack_cell_start);
         }
-        else if (regex_match(t, m, regex(STACK_CELL ":" NUMBER))) {
+        else if (regex_match(t, m, regex(STACK_CELL ":" SNUMBER))) {
+            auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
+            auto stack_cell_end = std::stoi(m[2]);
+            auto num = create_interval(m[3], m[4]);
+            typ.store_in_stack_in_signed_interval_domain(stack_cell_start, num,
+                    stack_cell_end-stack_cell_start);
+        }
+        else if (regex_match(t, m, regex(STACK_CELL ":" UNUMBER))) {
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
             auto stack_cell_end = std::stoi(m[2]);
             auto num = create_interval(m[3], m[4]);
-            typ.store_in_stack_in_interval_domain(stack_cell_start, num,
+            typ.store_in_stack_in_unsigned_interval_domain(stack_cell_start, num,
                     stack_cell_end-stack_cell_start);
         }
         else if (regex_match(t, m, regex(STACK_CELL ":" MAPFD))) {
@@ -910,19 +996,25 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
         ++curr_pos;
         crab::location_t loc = crab::location_t(std::make_pair(bb.label(), curr_pos));
         o << "   " << curr_pos << ".";
+        // TODO: print unsigned intervals in a proper way
         if (std::holds_alternative<Call>(statement)) {
             auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(r0_reg);
-            auto interval = typ.find_signed_interval_at_loc(r0_reg);
-            print_annotated(o, std::get<Call>(statement), region, interval);
+            auto rf = typ.find_refinement_at_loc(r0_reg);
+            auto signed_interval = typ.find_signed_interval_at_loc(r0_reg);
+            print_annotated(o, std::get<Call>(statement), region, rf, signed_interval, true);
+            auto unsigned_interval = typ.find_unsigned_interval_at_loc(r0_reg);
+            //print_annotated(o, std::get<Call>(statement), region, unsigned_interval, false);
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
             auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
-            auto offset = typ.find_offset_at_loc(reg_with_loc);
-            auto interval = typ.find_signed_interval_at_loc(reg_with_loc);
-            print_annotated(o, b, region, offset, interval);
+            auto rf = typ.find_refinement_at_loc(reg_with_loc);
+            auto signed_interval = typ.find_signed_interval_at_loc(reg_with_loc);
+            print_annotated(o, b, region, rf, signed_interval, true);
+            auto unsigned_interval = typ.find_unsigned_interval_at_loc(reg_with_loc);
+            //print_annotated(o, b, region, rf, unsigned_interval, false);
         }
         else if (std::holds_alternative<Mem>(statement)) {
             auto u = std::get<Mem>(statement);
@@ -930,9 +1022,11 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
                 auto target_reg = std::get<Reg>(u.value);
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
                 auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
-                auto offset = typ.find_offset_at_loc(target_reg_loc);
-                auto interval = typ.find_signed_interval_at_loc(target_reg_loc);
-                print_annotated(o, u, region, offset, interval);
+                auto rf = typ.find_refinement_at_loc(target_reg_loc);
+                auto signed_interval = typ.find_signed_interval_at_loc(target_reg_loc);
+                print_annotated(o, u, region, rf, signed_interval, true);
+                auto unsigned_interval = typ.find_unsigned_interval_at_loc(target_reg_loc);
+                //print_annotated(o, u, region, rf, unsigned_interval, false);
             }
             else o << "  " << u << "\n";
         }
@@ -945,8 +1039,10 @@ void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
         else if (std::holds_alternative<Un>(statement)) {
             auto u = std::get<Un>(statement);
             auto reg = crab::reg_with_loc_t(u.dst.v, loc);
-            auto interval = typ.find_signed_interval_at_loc(reg);
-            print_annotated(o, u, interval);
+            auto signed_interval = typ.find_signed_interval_at_loc(reg);
+            print_annotated(o, u, signed_interval, true);
+            auto unsigned_interval = typ.find_unsigned_interval_at_loc(reg);
+            print_annotated(o, u, unsigned_interval, false);
         }
         else o << "  " << statement << "\n";
     }
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index 79442d52d..d028af4d3 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -86,7 +86,7 @@ class type_domain_t final {
     void print_ctx() const;
     void print_stack() const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
-    std::optional<crab::dist_t> find_offset_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::refinement_t> find_refinement_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::reg_with_loc_t&) const;
     static type_domain_t from_predefined_types(const std::set<std::string>&, bool);
@@ -98,15 +98,14 @@ class type_domain_t final {
     void store_in_stack_in_interval_domain(uint64_t, mock_interval_t, int);
     void store_in_stack_in_signed_interval_domain(uint64_t, mock_interval_t, int);
     void store_in_stack_in_unsigned_interval_domain(uint64_t, mock_interval_t, int);
-    void insert_in_registers_in_offset_domain(register_t, location_t, dist_t);
-    void store_in_stack_in_offset_domain(uint64_t, dist_t, int);
+    void insert_in_registers_in_offset_domain(register_t, location_t, refinement_t);
+    void store_in_stack_in_offset_domain(uint64_t, refinement_t, int);
 
   private:
 
     void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
             location_t);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>, std::optional<ptr_or_mapfd_t>&,
-            location_t);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&, location_t);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);

From 27bf7cd9e1c62cf9f37185a1ebf7fb8c187b949d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 25 Mar 2024 23:28:18 -0400
Subject: [PATCH 158/373] Fixed initialization of registers state in domains

Domains seemed to not pass the information about global types in the
registers state, fixed it;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp            | 3 +--
 src/crab/signed_interval_domain.cpp   | 3 +--
 src/crab/unsigned_interval_domain.cpp | 3 +--
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index cc618bc74..b803a6bf2 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -100,8 +100,7 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    auto region_env = std::make_shared<global_region_env_t>();
-    register_types_t joined_reg_types(region_env);
+    register_types_t joined_reg_types(m_region_env);
 
     // a hack to store region information at the start of a joined basic block
     // in join, we do not know the label of the bb, hence we store the information
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 73e3f9a05..251af1e76 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -53,8 +53,7 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    auto intervals_env = std::make_shared<global_interval_env_t>();
-    registers_signed_state_t intervals_joined(intervals_env);
+    registers_signed_state_t intervals_joined(m_interval_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index b6c105d82..0dfa6c359 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -53,8 +53,7 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    auto intervals_env = std::make_shared<global_interval_env_t>();
-    registers_unsigned_state_t intervals_joined(intervals_env);
+    registers_unsigned_state_t intervals_joined(m_interval_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;

From 6ec70f6fa025f94c355ed6fc8bc95e1bf7f4fa3c Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 28 Mar 2024 00:51:00 -0400
Subject: [PATCH 159/373] Activated some run-time checks previously removed

Some checks to the type domain were added before, that check for whether
a register has value in both interval and region domain, in which case,
those should fail;
Those checks seemed to be violated before, and resulted in assert
errors;
Those seem to now work fine, hence activated;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 8f5e39345..2dd80ce19 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -254,12 +254,12 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
     const auto& maybe_left_interval = m_interval.find_interval_value(cond.left.v);
-    //assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
+    assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
     if (std::holds_alternative<Reg>(cond.right)) {
         const auto& right_reg = std::get<Reg>(cond.right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
         const auto& maybe_right_interval = m_interval.find_interval_value(right_reg.v);
-        //assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
+        assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
         if (same_type(maybe_left_type, maybe_right_type,
                     maybe_left_interval, maybe_right_interval)) {
             if (maybe_left_interval) {
@@ -304,7 +304,7 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
 void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type_reg = m_interval.find_unsigned_interval_value(u.reg.v);
-    //assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
+    assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
 
     if (is_ptr_type(maybe_ptr_or_mapfd_reg)) {
         m_errors.push_back("Only numbers can be used as divisors");
@@ -361,9 +361,9 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
 }
 
 void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
-    //auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    //auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
-    //assert(!reg_type.has_value() || !mock_interval_type.has_value());
+    auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
+    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
+    assert(!reg_type.has_value() || !mock_interval_type.has_value());
     m_region(s, loc);
 }
 
@@ -375,10 +375,10 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
-    //auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
-    //auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
-    //assert(!maybe_ptr_or_mapfd1.has_value() || !maybe_num_type1.has_value());
-    //assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
+    auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
+    auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
+    assert(!maybe_ptr_or_mapfd1.has_value() || !maybe_num_type1.has_value());
+    assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
         if (!is_shared_ptr(maybe_ptr_or_mapfd1)
@@ -397,10 +397,10 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
 void type_domain_t::operator()(const Addable& u, location_t loc) {
     auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
     auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
-    //auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
+    auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
     auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
-    //assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
-    //assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
+    assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
+    assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
 
     // a -> b <-> !a || b
     // is_ptr(ptr) -> is_num(num) <-> !is_ptr(ptr) || is_num(num)
@@ -414,10 +414,10 @@ void type_domain_t::operator()(const Addable& u, location_t loc) {
 void type_domain_t::operator()(const ValidStore& u, location_t loc) {
     auto maybe_ptr_or_mapfd_mem = m_region.find_ptr_or_mapfd_type(u.mem.v);
     auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
-    //auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
+    auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
     auto maybe_num_type_val = m_interval.find_interval_value(u.val.v);
-    //assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
-    //assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
+    assert(!maybe_ptr_or_mapfd_mem.has_value() || !maybe_num_type_mem.has_value());
+    assert(!maybe_ptr_or_mapfd_val.has_value() || !maybe_num_type_val.has_value());
 
     // a -> b <-> !a || b
     // !is_stack_ptr(mem) -> is_num(val) <-> is_stack_ptr(mem) || is_num(val)
@@ -431,7 +431,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc) {
 void type_domain_t::operator()(const ValidSize& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
-    //assert(!maybe_ptr_or_mapfd || !maybe_num_type);
+    assert(!maybe_ptr_or_mapfd || !maybe_num_type);
 
     if (maybe_num_type) {
         auto reg_value = maybe_num_type.value();

From f54cd8400402dcc71acd00bb835f81dc7d86071c Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 28 Mar 2024 17:51:43 -0400
Subject: [PATCH 160/373] Support for precise packet pointers subtraction

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp    |  4 +++
 src/crab/constraint.hpp    |  1 +
 src/crab/expression.cpp    |  3 ++
 src/crab/offset_domain.cpp | 26 ++++++++++++++--
 src/crab/offset_domain.hpp |  1 +
 src/crab/refinement.cpp    | 64 +++++++++++++++++++++++++++++++++++++-
 src/crab/refinement.hpp    |  2 ++
 src/crab/type_domain.cpp   | 12 ++++---
 8 files changed, 105 insertions(+), 8 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 4fd3eba22..294718ef5 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -8,6 +8,10 @@ std::ostream &operator<<(std::ostream &o, const constraint_t &c) {
     return o;
 }
 
+bool constraint_t::contains(const symbol_t &s) const {
+    return _expression_lhs.contains(s) || _expression_rhs.contains(s);
+}
+
 void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
     auto neg = _expression_rhs.negate();
     _expression_lhs = _expression_lhs + _expression_rhs.negate();
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index c70cad2d8..75a6ce9c8 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -32,6 +32,7 @@ class constraint_t {
     constraint_t operator<=(const constraint_t&) const;
     constraint_t operator>(const constraint_t&) const;
     bool is_equality() const;
+    bool contains(const symbol_t&) const;
     void simplify(std::shared_ptr<slacks_t>);
     [[nodiscard]] constraint_t negate() const;
     void write(std::ostream&) const;
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index a47b8df38..136b24c1a 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -42,6 +42,9 @@ symbol_t expression_t::get_singleton() const {
 static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv) {
     if (terms.find(kv.first) != terms.end()) {
         terms[kv.first] += kv.second;
+        if (terms[kv.first] == 0) {
+            terms.erase(kv.first);
+        }
     } else {
         terms[kv.first] = kv.second;
     }
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 0a4c9dcf8..623980795 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -452,6 +452,29 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
     }
 }
 
+interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_t src) const {
+    auto dst_rf = m_reg_state.find(dst);
+    auto src_rf = m_reg_state.find(src);
+    if (!dst_rf || !src_rf) return interval_t::bottom();
+    expression_t dst_expr = dst_rf->get_value();
+    expression_t src_expr = src_rf->get_value();
+    refinement_t result_rf = *dst_rf - *src_rf;
+    expression_t result_expr = result_rf.get_value();
+    if (result_expr.is_constant()) {
+        return result_expr.get_interval();
+    }
+    // with non-singleton expressions, we might be able to compute subtraction,
+    // but it might be complicated
+    if (!dst_expr.is_singleton() || !src_expr.is_singleton()) return interval_t::top();
+    auto dst_symbol = dst_expr.get_singleton();
+    auto src_symbol = src_expr.get_singleton();
+    std::optional<refinement_t> begin_rf = m_reg_state.find(register_t{11});
+    if (!begin_rf) return interval_t::top();
+    interval_t result_interval = result_rf.simplify_for_subtraction(dst_symbol, src_symbol,
+            begin_rf->get_constraints(), m_reg_state.get_slacks());
+    return result_interval;
+}
+
 static void create_numeric_refinement(registers_state_t& reg_state, mock_interval_t&& interval,
         location_t loc, register_t reg) {
     symbol_t s = symbol_t::make();
@@ -488,7 +511,7 @@ void offset_domain_t::do_bin(const Bin& bin,
         auto imm_interval = interval_t{number_t{imm}};
         switch (bin.op) {
             case Op::MOV: {
-                // ra = imm, we forget the type in the offset domain
+                // ra = imm
                 create_numeric_refinement(m_reg_state, std::move(interval_result),
                         loc, dst_register);
                 break;
@@ -570,7 +593,6 @@ void offset_domain_t::do_bin(const Bin& bin,
             }
             case Op::SUB: {
                 // ra -= rb
-                // TODO: be precise with ptr -= ptr, and possibly assign a slack to the result
                 if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
                     create_numeric_refinement(m_reg_state, std::move(interval_result),
                             loc, dst_register);
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 1842e4040..409fa852a 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -174,6 +174,7 @@ class offset_domain_t final {
     void do_call(const Call&, const stack_cells_t&, location_t);
     bool check_packet_access(const Reg&, int, int, bool) const;
     void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
+    interval_t compute_packet_subtraction(register_t, register_t) const;
 
     std::optional<refinement_t> find_in_ctx(int) const;
     std::optional<refinement_cells_t> find_in_stack(int) const;
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 6a137bc01..ea9e781f4 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -133,8 +133,70 @@ refinement_t refinement_t::operator+(const refinement_t &other) const {
     return refinement_t(new_type, new_value, new_constraints);
 }
 
+interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src,
+        const std::vector<constraint_t>& constraints, std::shared_ptr<slacks_t> slacks) const {
+    bound_t max_packet_size = bound_t{number_t{MAX_PACKET_SIZE}};
+    bound_t max_meta_size = bound_t{number_t{4098}};
+    bound_t zero = bound_t{number_t{0}};
+    symbol_t begin = symbol_t::begin();
+    symbol_t end = symbol_t::end();
+    symbol_t meta = symbol_t::meta();
+
+    if (src != begin && src != meta && src != end && dst != begin && dst != meta && dst != end) {
+        // We currently only support subtraction between begin, meta, and end
+        return interval_t::top();
+    }
+
+    // we can do better in case both end and meta are involved, but for now we should be okay
+    if (dst == end && src == meta) {
+        return interval_t{zero, max_meta_size + max_packet_size};
+    }
+    else if (dst == meta && src == end) {
+        return interval_t{-(max_meta_size + max_packet_size), zero};
+    }
+    // we only have cases (begin, meta), and (begin, end) left
+    bound_t max_size = (dst == meta || src == meta) ? max_meta_size : max_packet_size;
+
+    interval_t result = interval_t::top();
+    for (constraint_t c : constraints) {
+        c.simplify(slacks);
+        if (c.contains(dst) && c.contains(src)) {
+            expression_t lhs = c.get_lhs();
+            expression_t rhs = c.get_rhs();
+            lhs = lhs + rhs.negate();
+            rhs = expression_t{0};
+            if (lhs.contains(dst) && lhs.contains(src)) {
+                symbol_terms_t terms = lhs.get_symbol_terms();
+                if (terms.size() == 2) {
+                    if (terms[dst] == 1 && terms[src] == -1) {
+                        // dst - src + [lb, ub] <= 0 -> dst - src <= -lb
+                        interval_t lhs_interval = lhs.get_interval();
+                        result = result & interval_t{-max_size, -lhs_interval.lb()};
+                    }
+                    else if (terms[dst] == -1 && terms[src] == 1) {
+                        // src - dst + [lb, ub] <= 0 -> dst - src >= -lb
+                        interval_t lhs_interval = lhs.get_interval();
+                        result = result & interval_t{lhs_interval.lb(), max_size};
+                    }
+                }
+            }
+        }
+    }
+    // If no constraints were found, we can still infer some bounds
+    if (result == interval_t::top()) {
+        if (src == end)
+            result = interval_t{-max_packet_size, zero};
+        else if (dst == end)
+            result = interval_t{zero, max_packet_size};
+        else if (src == meta)
+            result = interval_t{zero, max_meta_size};
+        else if (dst == meta)
+            result = interval_t{-max_meta_size, zero};
+    }
+    return result;
+}
+
 refinement_t refinement_t::operator-(const refinement_t &other) const {
-    // TODO: Handle subtraction between packet pointers
     expression_t new_value = _value + other._value.negate();
     std::vector<crab::constraint_t> new_constraints;
     new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index b9ec68ce2..e01083909 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -40,6 +40,8 @@ class refinement_t {
     void add_constraint(const constraint_t&);
     void simplify();
     bool is_safe_with(refinement_t, std::shared_ptr<slacks_t>, bool) const;
+    interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
+            const std::vector<constraint_t>&, std::shared_ptr<slacks_t>) const;
 
     static refinement_t begin() {
         return refinement_t(data_type_t::PACKET, expression_t::begin());
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 2dd80ce19..6fc6c3537 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -547,7 +547,9 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
                                 src_ptr_with_off.get_offset().to_interval();
                 }
                 else if (std::holds_alternative<packet_ptr_t>(dst_ptr)) {
-                    subtracted = interval_t::top();
+                    register_t src_reg = std::get<Reg>(bin.v).v;
+                    register_t dst_reg = bin.dst.v;
+                    subtracted = m_offset.compute_packet_subtraction(dst_reg, src_reg);
                 }
                 else {
                     // Assertions should make sure we only perform this on
@@ -562,12 +564,12 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
 
     m_interval.do_bin(bin, src_signed_interval, src_unsigned_interval, src_ptr_or_mapfd,
             dst_signed_interval, dst_unsigned_interval, dst_ptr_or_mapfd, subtracted, loc);
-    // TODO: check if we need to get signed values in any case
-    auto mock_interval_result = m_interval.find_unsigned_interval_value(dst_register);
-    auto interval_result = std::move(mock_interval_result ? *mock_interval_result
-        : mock_interval_t::top());
     m_region.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
             dst_signed_interval, dst_ptr_or_mapfd, loc);
+
+    auto mock_interval_result = m_interval.find_signed_interval_value(dst_register);
+    auto interval_result = std::move(mock_interval_result ? *mock_interval_result
+        : mock_interval_t::top());
     m_offset.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
             dst_signed_interval, dst_ptr_or_mapfd, std::move(interval_result), loc);
 }

From 0d3feae6a4534a713c1d83f6839e78cc867d4181 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 28 Mar 2024 18:06:22 -0400
Subject: [PATCH 161/373] Better handling for mem_store in offset domain

When storing an immediate value, we did not construct a refinement type
to store into stack in offset domain, so later when loaded from stack,
we have a proper type;
This case does not seem to occur in current benchmarks, but good to keep
analysis consistent;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 32 ++++++++++++++++++++------------
 src/crab/region_domain.cpp |  2 +-
 src/crab/region_domain.hpp |  2 +-
 src/crab/type_domain.cpp   |  9 ++++-----
 src/crab/type_domain.hpp   |  2 +-
 5 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 623980795..764fcc4d4 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -759,22 +759,30 @@ void offset_domain_t::operator()(const basic_block_t& bb, int print) {
 
 void offset_domain_t::do_mem_store(const Mem& b,
         std::optional<ptr_or_mapfd_t>& maybe_basereg_type) {
-    auto target_reg = std::get<Reg>(b.value);
-    auto rf_info = m_reg_state.find(target_reg.v);
+    std::optional<refinement_t> rf_info = std::nullopt;
+    if (!is_stack_ptr(maybe_basereg_type)) return;
+
+    if (std::holds_alternative<Reg>(b.value)) {
+        auto target_reg = std::get<Reg>(b.value);
+        rf_info = m_reg_state.find(target_reg.v);
+    }
+    else {
+        symbol_t s = symbol_t::make();
+        rf_info = refinement_t(data_type_t::NUM, expression_t(s));
+        auto mock_interval = mock_interval_t{bound_t{(uint64_t)std::get<Imm>(b.value).v}};
+        m_reg_state.insert_slack_value(s, std::move(mock_interval));
+    }
     if (!rf_info) return;
 
     int offset = b.access.offset;
     int width = b.access.width;
-    if (is_stack_ptr(maybe_basereg_type)) {
-        auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
-        auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
-        if (!basereg_off_singleton) return;
-        auto store_at = (uint64_t)(*basereg_off_singleton + offset);
-        auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
-        m_stack_state -= overlapping_cells;
-
-        m_stack_state.store(store_at, *rf_info, width);
-    }
+    auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
+    auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
+    if (!basereg_off_singleton) return;
+    auto store_at = (uint64_t)(*basereg_off_singleton + offset);
+    auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
+    m_stack_state -= overlapping_cells;
+    m_stack_state.store(store_at, *rf_info, width);
 }
 
 void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b803a6bf2..2b29663ed 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1130,7 +1130,7 @@ void region_domain_t::operator()(const Mem& m, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::do_mem_store(const Mem& b, location_t loc) {
+void region_domain_t::do_mem_store(const Mem& b) {
 
     std::optional<ptr_or_mapfd_t> targetreg_type = {};
     bool target_is_reg = std::holds_alternative<Reg>(b.value);
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 5fdeb956a..9cdcc151c 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -164,7 +164,7 @@ class region_domain_t final {
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const register_t&, bool, location_t);
-    void do_mem_store(const Mem&, location_t);
+    void do_mem_store(const Mem&);
     void do_bin(const Bin&, const std::optional<interval_t>&,
             const std::optional<ptr_or_mapfd_t>&,
             const std::optional<interval_t>&,
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 6fc6c3537..6336b61d1 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -586,9 +586,8 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_pt
     m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, std::move(interval), loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt,
-        location_t loc) {
-    m_region.do_mem_store(b, loc);
+void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
+    m_region.do_mem_store(b);
     m_interval.do_mem_store(b, basereg_opt);
     m_offset.do_mem_store(b, basereg_opt);
 }
@@ -605,10 +604,10 @@ void type_domain_t::operator()(const Mem& b, location_t loc) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto targetreg = std::get<Reg>(b.value);
         if (b.is_load) do_load(b, targetreg, unknown_ptr, base_ptr_or_mapfd_opt, loc);
-        else if (!unknown_ptr) do_mem_store(b, base_ptr_or_mapfd_opt, loc);
+        else if (!unknown_ptr) do_mem_store(b, base_ptr_or_mapfd_opt);
     }
     else if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, base_ptr_or_mapfd_opt, loc);
+        do_mem_store(b, base_ptr_or_mapfd_opt);
     }
 }
 
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index d028af4d3..c99645b97 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -105,7 +105,7 @@ class type_domain_t final {
 
     void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
             location_t);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&, location_t);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);

From 78c8072c1c994d73ee5c81f11399f6caaf3ad9e6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 28 Mar 2024 18:36:40 -0400
Subject: [PATCH 162/373] Certain case when checking packet access fixed

When the packet access check is a comparison check (we check that the
access is within MAX_PACKET_SIZE, rather than end), we get constraints
like 65535 <= begin + c, which should be easily solvable, as begin is
assumed to be at offset 0, fixed it using an extra check;
It is possible other cases might also need such handling;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 294718ef5..fb4d48268 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -33,6 +33,11 @@ void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
 
 bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
     simplify(slacks);
+    symbol_terms_t terms = _expression_lhs.get_symbol_terms();
+    if (terms.size() == 1 && terms.begin()->first == symbol_t::begin()) {
+        // we can sometimes simplify if we have a single symbol begin, since it is always offset 0
+        _expression_lhs -= terms.begin()->first;
+    }
     if (!_expression_lhs.is_constant()) {
         return false;
     }

From fbed2cd49a30018c09f35e1d7c7969fc06542418 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 30 Mar 2024 01:24:27 -0400
Subject: [PATCH 163/373] Added a small heuristic for assume

Added a small heuristic for assume transformer, when both intervals are
top, then we can skip the computation;
There might be a sound analysis required here, but this will do for now;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 7dc66d6c9..8ce9cddd5 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -401,6 +401,11 @@ void interval_domain_t::assume_unsigned_cst(Condition::Op op, bool is64,
         const interval_t& right_signed, const interval_t& right_unsigned,
         register_t left, Value right, location_t loc) {
 
+    if (left_unsigned.is_top() && right_unsigned.is_top()) {
+        // this is a drastic heuristic
+        return;
+    }
+
     auto left_interval = interval_t::bottom();
     auto right_interval = interval_t::bottom();
     get_unsigned_intervals(is64, left_signed, left_unsigned, right_unsigned,
@@ -773,6 +778,11 @@ void interval_domain_t::assume_signed_cst(Condition::Op op, bool is64,
         const interval_t& right_signed, const interval_t& right_unsigned,
         register_t left, Value right, location_t loc) {
 
+    if (left_unsigned.is_top() && right_unsigned.is_top()) {
+        // this is a drastic heuristic
+        return;
+    }
+
     auto left_interval = interval_t::bottom();
     auto right_interval = interval_t::bottom();
     get_signed_intervals(is64, left_signed, left_unsigned, right_signed,

From 292ce6112a54aea01cf31bd4f2ec21a4b4303181 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 30 Mar 2024 01:26:21 -0400
Subject: [PATCH 164/373] Fixed assert type constraint for numbers

We were assuming that if a register is not a pointer, it is going to be
a number, which is not true always: added that check;
Fixed small error printing issue in ValidMapKeyValue;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 8 ++++++--
 src/crab/region_domain.hpp | 1 +
 src/crab/type_domain.cpp   | 3 ++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 2b29663ed..63eb6c7c4 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -822,6 +822,11 @@ region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
 }
 
 void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
+    // nothing to do here
+}
+
+void region_domain_t::check_type(const TypeConstraint& s,
+        std::optional<mock_interval_t> interval_opt) {
     auto ptr_or_mapfd_opt = m_registers.find(s.reg.v);
     if (ptr_or_mapfd_opt) {
         // it is a pointer or mapfd
@@ -862,8 +867,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
             }
         }
     }
-    else {
-        // if we don't know the type, we assume it is a number
+    else if (interval_opt) {
         if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
                 || s.types == TypeGroup::non_map_fd || s.types == TypeGroup::mem_or_num)
             return;
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 9cdcc151c..1ac9bd1c9 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -162,6 +162,7 @@ class region_domain_t final {
     interval_t get_map_key_size(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
+    void check_type(const TypeConstraint&, std::optional<mock_interval_t>);
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 6336b61d1..224d32641 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -364,7 +364,7 @@ void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
     assert(!reg_type.has_value() || !mock_interval_type.has_value());
-    m_region(s, loc);
+    m_region.check_type(s, mock_interval_type);
 }
 
 void type_domain_t::operator()(const Assert& u, location_t loc) {
@@ -486,6 +486,7 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
             }
             else {
                 m_errors.push_back("Only stack or packet can be used as a parameter");
+                return;
             }
         }
     }

From a3bb3a3aa55c1f369f7a928a8e8d1103f4eb0cf0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 1 Apr 2024 01:30:55 -0400
Subject: [PATCH 165/373] Removing redundant code from offset domain

Some code in offset domain related to the previous version of it was not
removed, which is done now;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 39 --------------------------------------
 1 file changed, 39 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 764fcc4d4..b1ebaf2d1 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -691,45 +691,6 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
     m_reg_state.scratch_caller_saved_registers();
 }
 
-bool offset_domain_t::lower_bound_satisfied(const dist_t& dist, int offset) const {
-    auto meta_limit = m_extra_constraints.get_meta_limit();
-    auto end_limit = m_extra_constraints.get_end_limit();
-
-    dist_t dist1 = dist;
-    if (dist.is_meta_pointer()) {
-        dist1 = dist_t(dist.offset_from_reference() + (meta_limit ?
-                    weight_t{*meta_limit-number_t{PACKET_META}} : weight_t{number_t{0}}));
-    }
-    if (dist.is_backward_pointer()) {
-        dist1 = dist_t(dist.offset_from_reference()
-                + (end_limit ? weight_t{*end_limit} : weight_t{number_t{0}}));
-    }
-
-    bound_t lb = meta_limit ? *meta_limit-number_t{PACKET_META} : bound_t{number_t{0}};
-    return (dist1.m_dist.lb()+number_t{offset} >= lb);
-}
-
-bool offset_domain_t::upper_bound_satisfied(const dist_t& dist, int offset, int width,
-        bool is_comparison_check) const {
-    auto meta_limit = m_extra_constraints.get_meta_limit();
-    auto end_limit = m_extra_constraints.get_end_limit();
-
-    dist_t dist1 = dist;
-    if (dist.is_meta_pointer()) {
-        dist1 = dist_t(dist.offset_from_reference() + (meta_limit ?
-                    weight_t{*meta_limit-number_t{PACKET_META}} : weight_t{number_t{0}}));
-    }
-    if (dist.is_backward_pointer()) {
-        dist1 = dist_t(dist.offset_from_reference()
-                + (end_limit ? weight_t{*end_limit} :
-                    weight_t{number_t{is_comparison_check ? MAX_PACKET_SIZE : 0}}));
-    }
-
-    bound_t ub = is_comparison_check ? bound_t{MAX_PACKET_SIZE}
-        : (end_limit ? *end_limit : number_t{0});
-    return (dist1.m_dist.ub()+number_t{offset+width} <= ub);
-}
-
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
     auto begin = m_reg_state.find(register_t{11});

From 898494f8462dec25577cd59b334d3eba50c3356d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 6 Apr 2024 16:52:13 +0000
Subject: [PATCH 166/373] Bump ebpf-samples from `ce6d479` to `5d65552`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `ce6d479` to `5d65552`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/ce6d4793d8b851683a86c6af675a02e39f91f0db...5d6555274119147c6ea69866712db3e4fa964423)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index ce6d4793d..5d6555274 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit ce6d4793d8b851683a86c6af675a02e39f91f0db
+Subproject commit 5d6555274119147c6ea69866712db3e4fa964423

From 934951e918ea3c72308b0908445c91c88989bd7a Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 21 Jan 2024 21:13:28 -0800
Subject: [PATCH 167/373] Stack memory tracking improvements

Fixes #566

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/crab/array_domain.cpp |  85 ++++++++++++++++++++++++--
 src/crab/array_domain.hpp |   4 ++
 test-data/stack.yaml      | 122 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 207 insertions(+), 4 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index ec5be435d..aedf17f20 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -110,9 +110,9 @@ class cell_t final {
         return {number_t{static_cast<int>(o)}, number_t{static_cast<int>(o)} + number_t{static_cast<int>(size - 1)}};
     }
 
+  public:
     [[nodiscard]] interval_t to_interval() const { return to_interval(_offset, _size); }
 
-  public:
     [[nodiscard]] bool is_null() const { return _offset == 0 && _size == 0; }
 
     [[nodiscard]] offset_t get_offset() const { return _offset; }
@@ -447,6 +447,72 @@ std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
     return o;
 }
 
+// Create a new cell that is a subset of an existing cell.
+void array_domain_t::split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len) {
+    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
+
+    // Get the values from the indicated stack range.
+    std::optional<linear_expression_t> svalue = load(inv, data_kind_t::svalues, number_t(cell_start_index), len);
+    std::optional<linear_expression_t> uvalue = load(inv, data_kind_t::uvalues, number_t(cell_start_index), len);
+
+    // Create a new cell for that range.
+    offset_map_t& offset_map = lookup_array_map(kind);
+    cell_t new_cell = offset_map.mk_cell(cell_start_index, len);
+    inv.assign(new_cell.get_scalar(data_kind_t::svalues), svalue);
+    inv.assign(new_cell.get_scalar(data_kind_t::uvalues), uvalue);
+}
+
+// Prepare to havoc bytes in the middle of a cell by potentially splitting the cell if it is numeric,
+// into the part to the left of the havoced portion, and the part to the right of the havoced portion.
+void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                                      const linear_expression_t& elem_size) {
+    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
+    offset_map_t& offset_map = lookup_array_map(kind);
+    interval_t ii = inv.eval_interval(i);
+    std::optional<number_t> n = ii.singleton();
+    if (!n) {
+        // We can only split a singleton offset.
+        return;
+    }
+    interval_t i_elem_size = inv.eval_interval(elem_size);
+    std::optional<number_t> n_bytes = i_elem_size.singleton();
+    if (!n_bytes) {
+        // We can only split a singleton size.
+        return;
+    }
+    auto size = static_cast<unsigned int>(*n_bytes);
+    offset_t o((uint64_t)*n);
+
+    std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
+    for (cell_t const& c : cells) {
+        interval_t intv = c.to_interval();
+        int cell_start_index = (int)*intv.lb().number();
+        int cell_end_index = (int)*intv.ub().number();
+
+        if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) || (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
+            // We can only split numeric cells of size 8 or less.
+            continue;
+        }
+
+        std::optional<number_t> old_number = inv.eval_interval(c.get_scalar(kind)).singleton();
+        if (!old_number) {
+            // We can only split cells with a singleton value.
+            continue;
+        }
+        int64_t old_sint = old_number->cast_to_sint64();
+        uint64_t old_uint = old_number->cast_to_uint64();
+
+        if (cell_start_index < o) {
+            // Use the bytes to the left of the specified range.
+            split_cell(inv, kind, cell_start_index, (unsigned int)(o - cell_start_index));
+        }
+        if (o + size - 1 < cell_end_index) {
+            // Use the bytes to the right of the specified range.
+            split_cell(inv, kind, (int)(o + size), (unsigned int)(cell_end_index - (o + size - 1)));
+        }
+    }
+}
+
 // we can only treat this as non-member because we use global state
 static std::optional<std::pair<offset_t, unsigned>>
 kill_and_find_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, const linear_expression_t& elem_size) {
@@ -622,11 +688,22 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
     return {};
 }
 
+// We are about to write to a given range of bytes on the stack.
+// Any cells covering that range need to be removed, and any cells that only
+// partially cover that range can be split such that any non-covered portions become new cells.
+static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
+    if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
+        array_domain.split_number_var(inv, kind, idx, elem_size);
+    }
+    return kill_and_find_var(inv, kind, idx, elem_size);
+}
+
+
 std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind,
                                                 const linear_expression_t& idx,
                                                 const linear_expression_t& elem_size,
                                                 const linear_expression_t& val) {
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -648,7 +725,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
                                                      const linear_expression_t& elem_size,
                                                      const linear_expression_t& val) {
     auto kind = data_kind_t::types;
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -671,7 +748,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
 }
 
 void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell && kind == data_kind_t::types) {
         auto [offset, size] = *maybe_cell;
         num_bytes.havoc(offset, size);
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index ee3808e9e..70525cb90 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -87,6 +87,10 @@ class array_domain_t final {
     // Perform array stores over an array segment
     void store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width);
 
+    void split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                          const linear_expression_t& elem_size);
+    void split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len);
+
     void initialize_numbers(int lb, int width);
 };
 
diff --git a/test-data/stack.yaml b/test-data/stack.yaml
index d1c4ab198..5bdaf8da7 100644
--- a/test-data/stack.yaml
+++ b/test-data/stack.yaml
@@ -1,6 +1,128 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
 ---
+test-case: stack load 16 bits across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=1", "s[504...504].uvalue=1",
+      "s[505...505].type=number", "s[505...505].svalue=2", "s[505...505].uvalue=2"]
+
+code:
+  <start>: |
+    r0 = *(u16 *)(r10 - 8) ; load 2 bytes spanning s[504...505]: 0x01 and 0x02 -> 0x0201
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...505].type=number
+  - s[504].svalue=1
+  - s[504].uvalue=1
+  - s[505].svalue=2
+  - s[505].uvalue=2
+  - r0.type=number
+  - r0.svalue=513
+  - r0.uvalue=513
+---
+test-case: stack load 32 bits across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...505].type=number", "s[504...505].svalue=22136", "s[504...505].uvalue=22136",
+      "s[506...507].type=number", "s[506...507].svalue=4660", "s[506...507].uvalue=4660"]
+
+code:
+  <start>: |
+    r0 = *(u32 *)(r10 - 8) ; load s[504...507]: 0x5678 and 0x1234 -> 0x12345678 on little-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...507].type=number
+  - s[504...505].svalue=22136
+  - s[504...505].uvalue=22136
+  - s[506...507].svalue=4660
+  - s[506...507].uvalue=4660
+  - r0.type=number
+  - r0.svalue=305419896
+  - r0.uvalue=305419896
+---
+test-case: stack load 64 bits across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...507].type=number", "s[504...507].svalue=2596069104", "s[504...507].uvalue=2596069104",
+      "s[508...511].type=number", "s[508...511].svalue=305419896", "s[508...511].uvalue=305419896"]
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 8) ; load s[504...511]: 0x9abcdef0 and 0x12345678 -> 0x123456789abcdef0 on little-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=2596069104
+  - s[504...507].uvalue=2596069104
+  - s[508...511].svalue=305419896
+  - s[508...511].uvalue=305419896
+  - r0.type=number
+  - r0.svalue=1311768467463790320
+  - r0.uvalue=1311768467463790320
+---
+test-case: stack re-assign immediate first
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 8) = 0 ; zero the first four bytes of 0x123456789abcdef0 -> 0x12345678 on little-endian machine
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=0
+  - s[504...507].uvalue=0
+  - s[508...511].svalue=305419896
+  - s[508...511].uvalue=305419896
+---
+test-case: stack re-assign immediate middle
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 6) = 0 ; zero the first four bytes of 0x123456789abcdef0
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...505].svalue=57072
+  - s[504...505].uvalue=57072
+  - s[506...509].svalue=0
+  - s[506...509].uvalue=0
+  - s[510...511].svalue=4660
+  - s[510...511].uvalue=4660
+---
+test-case: stack re-assign immediate last
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 4) = 0 ; zero the last four bytes of 0x123456789abcdef0
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=2596069104
+  - s[504...507].uvalue=2596069104
+  - s[508...511].svalue=0
+  - s[508...511].uvalue=0
+---
 test-case: set numeric size
 
 pre: ["r1.type=number",

From 28ce3eabf64f5782f1f25fdd49c361544001ec91 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 11 Apr 2024 13:16:48 +0300
Subject: [PATCH 168/373] Revert "Stack memory tracking improvements" (#613)

This reverts commit 934951e918ea3c72308b0908445c91c88989bd7a.
----
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp |  85 ++------------------------
 src/crab/array_domain.hpp |   4 --
 test-data/stack.yaml      | 122 --------------------------------------
 3 files changed, 4 insertions(+), 207 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index aedf17f20..ec5be435d 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -110,9 +110,9 @@ class cell_t final {
         return {number_t{static_cast<int>(o)}, number_t{static_cast<int>(o)} + number_t{static_cast<int>(size - 1)}};
     }
 
-  public:
     [[nodiscard]] interval_t to_interval() const { return to_interval(_offset, _size); }
 
+  public:
     [[nodiscard]] bool is_null() const { return _offset == 0 && _size == 0; }
 
     [[nodiscard]] offset_t get_offset() const { return _offset; }
@@ -447,72 +447,6 @@ std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
     return o;
 }
 
-// Create a new cell that is a subset of an existing cell.
-void array_domain_t::split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len) {
-    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
-
-    // Get the values from the indicated stack range.
-    std::optional<linear_expression_t> svalue = load(inv, data_kind_t::svalues, number_t(cell_start_index), len);
-    std::optional<linear_expression_t> uvalue = load(inv, data_kind_t::uvalues, number_t(cell_start_index), len);
-
-    // Create a new cell for that range.
-    offset_map_t& offset_map = lookup_array_map(kind);
-    cell_t new_cell = offset_map.mk_cell(cell_start_index, len);
-    inv.assign(new_cell.get_scalar(data_kind_t::svalues), svalue);
-    inv.assign(new_cell.get_scalar(data_kind_t::uvalues), uvalue);
-}
-
-// Prepare to havoc bytes in the middle of a cell by potentially splitting the cell if it is numeric,
-// into the part to the left of the havoced portion, and the part to the right of the havoced portion.
-void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
-                                      const linear_expression_t& elem_size) {
-    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
-    offset_map_t& offset_map = lookup_array_map(kind);
-    interval_t ii = inv.eval_interval(i);
-    std::optional<number_t> n = ii.singleton();
-    if (!n) {
-        // We can only split a singleton offset.
-        return;
-    }
-    interval_t i_elem_size = inv.eval_interval(elem_size);
-    std::optional<number_t> n_bytes = i_elem_size.singleton();
-    if (!n_bytes) {
-        // We can only split a singleton size.
-        return;
-    }
-    auto size = static_cast<unsigned int>(*n_bytes);
-    offset_t o((uint64_t)*n);
-
-    std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
-    for (cell_t const& c : cells) {
-        interval_t intv = c.to_interval();
-        int cell_start_index = (int)*intv.lb().number();
-        int cell_end_index = (int)*intv.ub().number();
-
-        if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) || (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
-            // We can only split numeric cells of size 8 or less.
-            continue;
-        }
-
-        std::optional<number_t> old_number = inv.eval_interval(c.get_scalar(kind)).singleton();
-        if (!old_number) {
-            // We can only split cells with a singleton value.
-            continue;
-        }
-        int64_t old_sint = old_number->cast_to_sint64();
-        uint64_t old_uint = old_number->cast_to_uint64();
-
-        if (cell_start_index < o) {
-            // Use the bytes to the left of the specified range.
-            split_cell(inv, kind, cell_start_index, (unsigned int)(o - cell_start_index));
-        }
-        if (o + size - 1 < cell_end_index) {
-            // Use the bytes to the right of the specified range.
-            split_cell(inv, kind, (int)(o + size), (unsigned int)(cell_end_index - (o + size - 1)));
-        }
-    }
-}
-
 // we can only treat this as non-member because we use global state
 static std::optional<std::pair<offset_t, unsigned>>
 kill_and_find_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, const linear_expression_t& elem_size) {
@@ -688,22 +622,11 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
     return {};
 }
 
-// We are about to write to a given range of bytes on the stack.
-// Any cells covering that range need to be removed, and any cells that only
-// partially cover that range can be split such that any non-covered portions become new cells.
-static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
-    if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
-        array_domain.split_number_var(inv, kind, idx, elem_size);
-    }
-    return kill_and_find_var(inv, kind, idx, elem_size);
-}
-
-
 std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind,
                                                 const linear_expression_t& idx,
                                                 const linear_expression_t& elem_size,
                                                 const linear_expression_t& val) {
-    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
+    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -725,7 +648,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
                                                      const linear_expression_t& elem_size,
                                                      const linear_expression_t& val) {
     auto kind = data_kind_t::types;
-    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
+    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -748,7 +671,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
 }
 
 void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
-    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
+    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
     if (maybe_cell && kind == data_kind_t::types) {
         auto [offset, size] = *maybe_cell;
         num_bytes.havoc(offset, size);
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index 70525cb90..ee3808e9e 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -87,10 +87,6 @@ class array_domain_t final {
     // Perform array stores over an array segment
     void store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width);
 
-    void split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
-                          const linear_expression_t& elem_size);
-    void split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len);
-
     void initialize_numbers(int lb, int width);
 };
 
diff --git a/test-data/stack.yaml b/test-data/stack.yaml
index 5bdaf8da7..d1c4ab198 100644
--- a/test-data/stack.yaml
+++ b/test-data/stack.yaml
@@ -1,128 +1,6 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
 ---
-test-case: stack load 16 bits across multiple variables
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...504].type=number", "s[504...504].svalue=1", "s[504...504].uvalue=1",
-      "s[505...505].type=number", "s[505...505].svalue=2", "s[505...505].uvalue=2"]
-
-code:
-  <start>: |
-    r0 = *(u16 *)(r10 - 8) ; load 2 bytes spanning s[504...505]: 0x01 and 0x02 -> 0x0201
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...505].type=number
-  - s[504].svalue=1
-  - s[504].uvalue=1
-  - s[505].svalue=2
-  - s[505].uvalue=2
-  - r0.type=number
-  - r0.svalue=513
-  - r0.uvalue=513
----
-test-case: stack load 32 bits across multiple variables
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...505].type=number", "s[504...505].svalue=22136", "s[504...505].uvalue=22136",
-      "s[506...507].type=number", "s[506...507].svalue=4660", "s[506...507].uvalue=4660"]
-
-code:
-  <start>: |
-    r0 = *(u32 *)(r10 - 8) ; load s[504...507]: 0x5678 and 0x1234 -> 0x12345678 on little-endian
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...507].type=number
-  - s[504...505].svalue=22136
-  - s[504...505].uvalue=22136
-  - s[506...507].svalue=4660
-  - s[506...507].uvalue=4660
-  - r0.type=number
-  - r0.svalue=305419896
-  - r0.uvalue=305419896
----
-test-case: stack load 64 bits across multiple variables
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...507].type=number", "s[504...507].svalue=2596069104", "s[504...507].uvalue=2596069104",
-      "s[508...511].type=number", "s[508...511].svalue=305419896", "s[508...511].uvalue=305419896"]
-
-code:
-  <start>: |
-    r0 = *(u64 *)(r10 - 8) ; load s[504...511]: 0x9abcdef0 and 0x12345678 -> 0x123456789abcdef0 on little-endian
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...511].type=number
-  - s[504...507].svalue=2596069104
-  - s[504...507].uvalue=2596069104
-  - s[508...511].svalue=305419896
-  - s[508...511].uvalue=305419896
-  - r0.type=number
-  - r0.svalue=1311768467463790320
-  - r0.uvalue=1311768467463790320
----
-test-case: stack re-assign immediate first
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
-
-code:
-  <start>: |
-    *(u32 *)(r10 - 8) = 0 ; zero the first four bytes of 0x123456789abcdef0 -> 0x12345678 on little-endian machine
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...511].type=number
-  - s[504...507].svalue=0
-  - s[504...507].uvalue=0
-  - s[508...511].svalue=305419896
-  - s[508...511].uvalue=305419896
----
-test-case: stack re-assign immediate middle
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
-
-code:
-  <start>: |
-    *(u32 *)(r10 - 6) = 0 ; zero the first four bytes of 0x123456789abcdef0
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...511].type=number
-  - s[504...505].svalue=57072
-  - s[504...505].uvalue=57072
-  - s[506...509].svalue=0
-  - s[506...509].uvalue=0
-  - s[510...511].svalue=4660
-  - s[510...511].uvalue=4660
----
-test-case: stack re-assign immediate last
-
-pre: ["r10.type=stack", "r10.stack_offset=512",
-      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
-
-code:
-  <start>: |
-    *(u32 *)(r10 - 4) = 0 ; zero the last four bytes of 0x123456789abcdef0
-
-post:
-  - r10.type=stack
-  - r10.stack_offset=512
-  - s[504...511].type=number
-  - s[504...507].svalue=2596069104
-  - s[504...507].uvalue=2596069104
-  - s[508...511].svalue=0
-  - s[508...511].uvalue=0
----
 test-case: set numeric size
 
 pre: ["r1.type=number",

From 079b18098ae8d2d22ace536cb4365a66df1b595e Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Fri, 19 Apr 2024 12:16:34 -0700
Subject: [PATCH 169/373] Gracefully handle a negative size

Prior to this, the verifier would crash due to an assert()
inside the all_num() function.

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/crab/array_domain.cpp |  7 +++++++
 test-data/call.yaml       | 15 +++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index ec5be435d..1746144aa 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -493,6 +493,13 @@ bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, c
     auto max_ub = inv.eval_interval(ub).ub().number();
     if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32())
         return false;
+
+    // The all_num() call requires a legal range. If we have an illegal range,
+    // we should have already generated an error about the invalid range so just
+    // return true now to avoid an extra error about a non-numeric range.
+    if (*min_lb >= *max_ub)
+        return true;
+
     return this->num_bytes.all_num((int32_t)*min_lb, (int32_t)*max_ub);
 }
 
diff --git a/test-data/call.yaml b/test-data/call.yaml
index 47beb799f..8c9eeea38 100644
--- a/test-data/call.yaml
+++ b/test-data/call.yaml
@@ -176,3 +176,18 @@ code:
 
 post:
   - r0.type=number
+---
+test-case: bpf_trace_printk with negative size buffer
+
+pre: ["r1.type=stack", "r1.stack_offset=504",
+      "r2.type=number", "r2.svalue=-13", "r2.uvalue=18446744073709551603"]
+
+code:
+  <start>: |
+    call 6; bpf_trace_printk
+
+post:
+  - r0.type=number
+
+messages:
+  - "0: Invalid size (r2.value > 0)"

From 9796b15550c91fbfba0539493f43deecce03ed86 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Apr 2024 16:48:49 +0000
Subject: [PATCH 170/373] Bump external/libbtf from `6e28ce2` to `8536d31`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `6e28ce2` to `8536d31`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/6e28ce2813e6a9fe7d1448298ba058531dd81adb...8536d31262e5e5c2edb78d9cf26cf74d0b073dd7)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 6e28ce281..8536d3126 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 6e28ce2813e6a9fe7d1448298ba058531dd81adb
+Subproject commit 8536d31262e5e5c2edb78d9cf26cf74d0b073dd7

From 4944945f8ba9071ef59240aabc37f0edbeae82c1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Apr 2024 16:48:46 +0000
Subject: [PATCH 171/373] Bump external/bpf_conformance from `73b6ea3` to
 `41ec319`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `73b6ea3` to `41ec319`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/73b6ea325b8b48ebdb17f2382c25ec38183154f8...41ec319242a4e598850650158dbaa91397df45a4)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 73b6ea325..41ec31924 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 73b6ea325b8b48ebdb17f2382c25ec38183154f8
+Subproject commit 41ec319242a4e598850650158dbaa91397df45a4

From e107ff701e73bbb2a0aba267390e003a65955456 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 22 Apr 2024 16:54:17 -0400
Subject: [PATCH 172/373] Only allow aligned loads from stack

Previously, unaligned accesses were allowed in the tool, which resulted
in the benchmark build/stackok.o to pass;
We allow only aligned accesses, i.e., either the whole cell is loaded,
or if part of the cell is to be loaded, it has to be a number, not a
pointer;
PREVAIL still allows misaligned accesses, hence the benchmark passes the
verifier;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 8ce9cddd5..139a28f5c 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -909,9 +909,13 @@ bool interval_domain_t::load_from_stack(register_t reg, interval_t load_at, int
             }
         }
     }
-    if (all_numeric_in_stack(start_offset, width)) {
-        insert_in_registers(reg, loc, interval_t::top());
-        return true;
+    auto overlapping_cells = find_overlapping_cells_in_stack(start_offset, width);
+    if (overlapping_cells.size() == 1) {
+        // only allow loading from a single cell
+        if (all_numeric_in_stack(start_offset, width)) {
+            insert_in_registers(reg, loc, interval_t::top());
+            return true;
+        }
     }
     return false;
 }

From 67ffc1c263dca47687630998252fe2fe500f39ca Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 25 Apr 2024 10:09:16 -0400
Subject: [PATCH 173/373] Adding support for Atomic operation

Atomic operations are supported as a sequence of Bin and Mem operations,
as atomicity of the operation is not relevant for verification;
Atomic operation requires a pseudo-register (r11), such that Bin and Mem
operations update r11, if needed;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.hpp                   |  4 +-
 src/crab/offset_domain.cpp            | 18 +++----
 src/crab/offset_domain.hpp            |  6 +--
 src/crab/region_domain.cpp            |  6 +--
 src/crab/signed_interval_domain.cpp   |  4 +-
 src/crab/type_domain.cpp              | 68 ++++++++++++++++++++++++++-
 src/crab/unsigned_interval_domain.cpp |  4 +-
 7 files changed, 89 insertions(+), 21 deletions(-)

diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 1dfbf1148..30f0ca43e 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -16,7 +16,9 @@
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-constexpr uint8_t NUM_REGISTERS = 11;
+
+// 11 registers for the eBPF ISA, and 1 pseudo-register for the atomic operations
+constexpr uint8_t NUM_REGISTERS = 12;
 
 constexpr int STACK_BEGIN = 0;
 constexpr int CTX_BEGIN = 0;
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index b1ebaf2d1..46ae20180 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -94,7 +94,7 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
     registers_state_t joined_state(m_offset_env, m_slacks);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
 
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -171,14 +171,14 @@ void registers_state_t::scratch_caller_saved_registers() {
 }
 
 void registers_state_t::forget_packet_pointers(location_t loc) {
-    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS; r++) {
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-1; r++) {
         if (auto it = find(register_t{r})) {
             if (it->get_type() == data_type_t::PACKET) {
                 operator-=(register_t{r});
             }
         }
     }
-    insert(register_t{11}, loc, refinement_t::begin());
+    insert(register_t{12}, loc, refinement_t::begin());
     // TODO: verify if this is all needed
 }
 
@@ -412,7 +412,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             return;
         }
         if (cond.op == Condition::Op::LE) {
-            auto b = m_reg_state.find(register_t{11});
+            auto b = m_reg_state.find(register_t{12});
             auto le_rf = *rf_left <= *rf_right;
             if (b) {
                 b->add_constraint(le_rf);
@@ -428,12 +428,12 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                     set_to_bottom();
                 }
                 else {
-                    m_reg_state.insert(register_t{11}, loc, std::move(*b));
+                    m_reg_state.insert(register_t{12}, loc, std::move(*b));
                 }
             }
         }
         else if (cond.op == Condition::Op::GT) {
-            auto b = m_reg_state.find(register_t{11});
+            auto b = m_reg_state.find(register_t{12});
             auto gt_rf = *rf_left > *rf_right;
             if (b) {
                 b->add_constraint(gt_rf);
@@ -443,7 +443,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                     set_to_bottom();
                 }
                 else {
-                    m_reg_state.insert(register_t{11}, loc, std::move(*b));
+                    m_reg_state.insert(register_t{12}, loc, std::move(*b));
                 }
             }
 
@@ -468,7 +468,7 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     if (!dst_expr.is_singleton() || !src_expr.is_singleton()) return interval_t::top();
     auto dst_symbol = dst_expr.get_singleton();
     auto src_symbol = src_expr.get_singleton();
-    std::optional<refinement_t> begin_rf = m_reg_state.find(register_t{11});
+    std::optional<refinement_t> begin_rf = m_reg_state.find(register_t{12});
     if (!begin_rf) return interval_t::top();
     interval_t result_interval = result_rf.simplify_for_subtraction(dst_symbol, src_symbol,
             begin_rf->get_constraints(), m_reg_state.get_slacks());
@@ -693,7 +693,7 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
-    auto begin = m_reg_state.find(register_t{11});
+    auto begin = m_reg_state.find(register_t{12});
     if (!begin) return false;
     auto reg = m_reg_state.find(r.v);
     if (!reg) return false;
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 409fa852a..f9b2d1793 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -30,13 +30,13 @@ class registers_state_t {
 
             auto loc = std::make_pair(label_t::entry, (unsigned int)0);
             if (desc->data >= 0) {
-                insert(register_t{11}, loc, refinement_t::begin());
+                insert(register_t{12}, loc, refinement_t::begin());
             }
             if (desc->end >= 0) {
-                insert(register_t{12}, loc, refinement_t::end());
+                insert(register_t{13}, loc, refinement_t::end());
             }
             if (desc->meta >= 0) {
-                insert(register_t{13}, loc, refinement_t::meta());
+                insert(register_t{14}, loc, refinement_t::meta());
             }
         }
 
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 63eb6c7c4..afcb956d3 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -87,7 +87,7 @@ void register_types_t::scratch_caller_saved_registers() {
 }
 
 void register_types_t::forget_packet_ptrs() {
-    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS; r++) {
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-1; r++) {
         if (is_packet_ptr(find(register_t{r}))) {
             operator-=(register_t{r});
         }
@@ -108,7 +108,7 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     // the bb label, we can fix
     location_t loc = location_t{std::make_pair(label_t(-2, -2), 0)};
 
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(register_t{i});
         auto maybe_ptr2 = other.find(register_t{i});
@@ -184,7 +184,7 @@ std::optional<ptr_or_mapfd_t> register_types_t::find(register_t key) const {
 }
 
 void register_types_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, *it);
         }
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 251af1e76..493be2ffe 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -55,7 +55,7 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
     }
     registers_signed_state_t intervals_joined(m_interval_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -69,7 +69,7 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
 }
 
 void registers_signed_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
         }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 224d32641..28688933c 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -105,7 +105,7 @@ crab::bound_t type_domain_t::get_loop_count_upper_bound() {
 string_invariant type_domain_t::to_set() const {
     if (is_top()) return string_invariant::top();
     std::set<std::string> result;
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
         auto maybe_rf = m_offset.find_refinement_info(register_t{i});
         if (maybe_ptr_or_mapfd.has_value()) {
@@ -193,8 +193,74 @@ void type_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_interval(u, loc);
 }
 
+// Construct a Bin operation that does the main operation that a given Atomic operation does atomically.
+static Bin atomic_to_bin(const Atomic& a) {
+    Bin bin{
+        .dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = (a.access.width == sizeof(uint64_t)), .lddw = false};
+    switch (a.op) {
+    case Atomic::Op::ADD: bin.op = Bin::Op::ADD; break;
+    case Atomic::Op::OR: bin.op = Bin::Op::OR; break;
+    case Atomic::Op::AND: bin.op = Bin::Op::AND; break;
+    case Atomic::Op::XOR: bin.op = Bin::Op::XOR; break;
+    case Atomic::Op::XCHG:
+    case Atomic::Op::CMPXCHG: bin.op = Bin::Op::MOV; break;
+    default: throw std::exception();
+    }
+    return bin;
+}
+
 void type_domain_t::operator()(const Atomic &u, location_t loc) {
     // WARNING: Not implemented yet
+    if (is_bottom()) return;
+    std::optional<ptr_or_mapfd_t> base_reg_opt
+        = m_region.find_ptr_or_mapfd_type(u.access.basereg.v);
+    std::optional<mock_interval_t> value_reg_opt = m_interval.find_interval_value(u.valreg.v);
+    if (!base_reg_opt || !value_reg_opt) return;
+    if (is_stack_ptr(base_reg_opt)) {
+        if (u.op == Atomic::Op::CMPXCHG) {
+            m_region -= register_t{R0_RETURN_VALUE};
+            m_offset -= register_t{R0_RETURN_VALUE};
+            insert_in_registers_in_interval_domain(register_t{R0_RETURN_VALUE},
+                    loc, interval_t::top());
+        }
+        else if (u.fetch) {
+            insert_in_registers_in_interval_domain(u.valreg.v, loc, interval_t::top());
+        }
+        return;
+    }
+    // Fetch the current value into the R11 pseudo-register.
+    const Reg r11{11};
+    (*this)(Mem{.access = u.access, .value = r11, .is_load = true});
+
+    // Compute the new value in R11.
+    (*this)(atomic_to_bin(u));
+
+    if (u.op == Atomic::Op::CMPXCHG) {
+        // For CMPXCHG, store the original value in r0.
+        (*this)(Mem{.access = u.access, .value = Reg{R0_RETURN_VALUE}, .is_load = true});
+
+        // For the destination, there are 3 possibilities:
+        // 1) dst.value == r0.value : set R11 to valreg
+        // 2) dst.value != r0.value : don't modify R11
+        // 3) dst.value may or may not == r0.value : set R11 to the union of R11 and valreg
+        // For now we just havoc the value of R11.
+        m_region -= register_t{11};
+        m_offset -= register_t{11};
+        insert_in_registers_in_interval_domain(register_t{11}, loc, interval_t::top());
+    } else if (u.fetch) {
+        // For other FETCH operations, store the original value in the src register.
+        (*this)(Mem{.access = u.access, .value = u.valreg, .is_load = true});
+    }
+
+    // Store the new value back in the original shared memory location.
+    // Note that do_mem_store() currently doesn't track shared memory values,
+    // but stack memory values are tracked and are legal here.
+    (*this)(Mem{.access = u.access, .value = r11, .is_load = false});
+
+    // Clear the R11 pseudo-register.
+    m_region -= register_t{11};
+    m_offset -= register_t{11};
+    m_interval -= register_t{11};
 }
 
 void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 0dfa6c359..ac97663ed 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -55,7 +55,7 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
     }
     registers_unsigned_state_t intervals_joined(m_interval_env);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -69,7 +69,7 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
 }
 
 void registers_unsigned_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
         }

From 9b37971dacce87f1abef591c3727db15e632d109 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Thu, 2 May 2024 08:19:28 -0700
Subject: [PATCH 174/373] Set the /fsanitize=fuzzer for the compiler

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 CMakeLists.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3b0f1a6ac..40f43ef5a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -30,8 +30,8 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
       FORCE)
   set(CMAKE_EXE_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}")
   set(CMAKE_SHARED_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}")
-  set(CMAKE_C_FLAGS_FUZZERDEBUG "${CMAKE_C_FLAGS_DEBUG} /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
-  set(CMAKE_CXX_FLAGS_FUZZERDEBUG "${CMAKE_CXX_FLAGS_DEBUG} /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
+  set(CMAKE_C_FLAGS_FUZZERDEBUG "${CMAKE_C_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
+  set(CMAKE_CXX_FLAGS_FUZZERDEBUG "${CMAKE_CXX_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
 
   find_program(NUGET nuget)
   if (NOT NUGET)

From b8ac6af135297d426c71165eab11774f454998ad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 27 Apr 2024 16:56:10 +0000
Subject: [PATCH 175/373] Bump external/libbtf from `8536d31` to `ada4e96`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `8536d31` to `ada4e96`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/8536d31262e5e5c2edb78d9cf26cf74d0b073dd7...ada4e964fb3a8331968ca728d65be5766ccba5e6)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 8536d3126..ada4e964f 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 8536d31262e5e5c2edb78d9cf26cf74d0b073dd7
+Subproject commit ada4e964fb3a8331968ca728d65be5766ccba5e6

From 366b208067e487de267c05fab73e6bd4253bcb9e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 4 May 2024 16:41:29 +0000
Subject: [PATCH 176/373] Bump external/libbtf from `ada4e96` to `5ae35c7`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `ada4e96` to `5ae35c7`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/ada4e964fb3a8331968ca728d65be5766ccba5e6...5ae35c7f3495d2aea9f3dad911acc2505acc2747)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index ada4e964f..5ae35c7f3 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit ada4e964fb3a8331968ca728d65be5766ccba5e6
+Subproject commit 5ae35c7f3495d2aea9f3dad911acc2505acc2747

From edf88e2bed6d281657a032dc38fa6e4983ab0478 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Tue, 7 May 2024 11:58:19 -0700
Subject: [PATCH 177/373] Pickup latest bpf_conformance (#629)

* Pickup latest bpf_conformance
* Add test for jump with signed immediate value
---------
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 external/bpf_conformance      | 2 +-
 src/test/test_conformance.cpp | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 41ec31924..35201b4f0 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 41ec319242a4e598850650158dbaa91397df45a4
+Subproject commit 35201b4f065683f26d1b4ddab130788135d09b33
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index b1f2dce57..5faca7769 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -90,6 +90,7 @@ TEST_CONFORMANCE("div64-negative-reg.data")
 TEST_CONFORMANCE("div64-reg.data")
 TEST_CONFORMANCE("exit-not-last.data")
 TEST_CONFORMANCE("exit.data")
+TEST_CONFORMANCE("j-signed-imm.data")
 TEST_CONFORMANCE("ja32.data")
 TEST_CONFORMANCE("jeq-imm.data")
 TEST_CONFORMANCE("jeq-reg.data")

From e382b39b42bba468145a037fd741c8b8cacb490f Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Thu, 9 May 2024 12:29:58 -0700
Subject: [PATCH 178/373] Add checks for malformed EbpfHelperPrototype

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/asm_unmarshal.cpp | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index d331b40d0..f906db2f7 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -464,11 +464,24 @@ struct Unmarshaller {
             case EBPF_ARGUMENT_TYPE_PTR_TO_CTX:
                 res.singles.push_back({toArgSingleKind(args[i]), Reg{(uint8_t)i}});
                 break;
-            case EBPF_ARGUMENT_TYPE_CONST_SIZE: assert(false); continue;
-            case EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: assert(false); continue;
+            case EBPF_ARGUMENT_TYPE_CONST_SIZE: {
+                // Sanity check: This argument should never be seen in isolation.
+                throw std::runtime_error(std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE: ") + proto.name);
+            }
+            case EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO:{
+                // Sanity check: This argument should never be seen in isolation.
+                throw std::runtime_error(std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+            }
             case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL:
             case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM:
             case EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM:
+                // Sanity check: This argument must be followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO.
+                if (args.size() - i < 2) {
+                    throw std::runtime_error(std::string("missing EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+                }
+                if (args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE && args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO) {
+                    throw std::runtime_error(std::string("Pointer argument not followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+                }
                 bool can_be_zero = (args[i + 1] == EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO);
                 res.pairs.push_back({toArgPairKind(args[i]), Reg{(uint8_t)i}, Reg{(uint8_t)(i + 1)}, can_be_zero});
                 i++;

From 69d15382a31915c85259a44e438482216e5ae750 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Thu, 9 May 2024 16:02:13 -0700
Subject: [PATCH 179/373] Add test for issue620 (#621)

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
---
 ebpf-samples             | 2 +-
 src/test/test_verify.cpp | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 5d6555274..038fa4770 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 5d6555274119147c6ea69866712db3e4fa964423
+Subproject commit 038fa47700bf270624b5fc059dea4c17e91a20c6
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index c5bf67fb5..817744710 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -502,6 +502,10 @@ TEST_SECTION_REJECT("build", "ringbuf_uninit.o", ".text");
 // If the verifier is later updated to accept them, these should
 // be changed to TEST_SECTION().
 
+// Issue: https://github.com/vbpf/ebpf-verifier/issues/620
+// Inserting value from map 1 into map 2 should be supported, but fails.
+TEST_SECTION_FAIL("build", "store_map_value_in_map.o", ".text")
+
 // Unsupported: ebpf-function
 TEST_SECTION_FAIL("prototype-kernel", "xdp_ddos01_blacklist_kern.o", ".text")
 

From 42e9991232a5d9ef7fee79d55130c4bec28919d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Dantas?= <viniciusdantas@bct.ect.ufrn.br>
Date: Mon, 18 Mar 2024 10:27:42 -0400
Subject: [PATCH 180/373] Add git and ca-certificates to the docker image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Vinícius Dantas <vinicius.gppcom@gmail.com>
---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index f412529d9..618d605e2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,8 @@ FROM ubuntu:20.04
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt update
 RUN apt -yq --no-install-suggests --no-install-recommends install build-essential cmake \
-    libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev
+    libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev git \
+    ca-certificates
 WORKDIR /verifier
 COPY . /verifier/
 RUN mkdir build

From 64ab8c034eb2fa563bbf4c6d181a482259b9f8eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Dantas?= <viniciusdantas@bct.ect.ufrn.br>
Date: Thu, 9 May 2024 19:04:37 -0400
Subject: [PATCH 181/373] Add MacOS instructions to the README file (#606)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add MacOS instructions
* Move env vars to an explicit assignment before calling cmake
---------
Signed-off-by: Vinícius Dantas <vinicius.gppcom@gmail.com>
---
 README.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/README.md b/README.md
index 372dc1ba8..89d5d6561 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,12 @@ sudo apt install libboost-filesystem-dev libboost-program-options-dev
 * Install [Visual Studio Build Tools 2022](https://aka.ms/vs/17/release/vs_buildtools.exe) and choose the "C++ build tools" workload (Visual Studio Build Tools 2022 has support for CMake Version 3.25).
 * Install [nuget.exe](https://www.nuget.org/downloads)
 
+### Dependencies from MacOS
+```bash
+brew install llvm cmake boost yaml-cpp
+```
+The system llvm currently comes with Clang 15, which isn't enough to compile the ebpf-verifier as it depends on C++20. Brew's llvm comes with Clang 17.
+
 ### Installation
 Clone:
 ```
@@ -40,6 +46,13 @@ cmake -B build
 cmake --build build --config Release
 ```
 
+Make on MacOS:
+```
+export CPATH=$(brew --prefix)/include LIBRARY_PATH=$(brew --prefix)/lib CMAKE_PREFIX_PATH=$(brew --prefix)
+cmake -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=$(brew --prefix llvm)/bin/clang -DCMAKE_CXX_COMPILER=$(brew --prefix llvm)/bin/clang++
+cmake --build build
+```
+
 ### Running with Docker
 Build and run:
 ```bash

From 917fd17099299f2f0eb0fcc5c2d94c8ca4980066 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 11 May 2024 16:14:57 +0000
Subject: [PATCH 182/373] Bump external/bpf_conformance from `35201b4` to
 `7c2ef8b`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `35201b4` to `7c2ef8b`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/35201b4f065683f26d1b4ddab130788135d09b33...7c2ef8b77679089f3949cf48137ec2246358fb3f)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 35201b4f0..7c2ef8b77 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 35201b4f065683f26d1b4ddab130788135d09b33
+Subproject commit 7c2ef8b77679089f3949cf48137ec2246358fb3f

From ef17f7a0fa03748de5d0b0924a2e590083176804 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 11 May 2024 16:14:55 +0000
Subject: [PATCH 183/373] Bump ebpf-samples from `038fa47` to `5d65552`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `038fa47` to `5d65552`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/038fa47700bf270624b5fc059dea4c17e91a20c6...5d6555274119147c6ea69866712db3e4fa964423)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 038fa4770..5d6555274 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 038fa47700bf270624b5fc059dea4c17e91a20c6
+Subproject commit 5d6555274119147c6ea69866712db3e4fa964423

From 78a6c824bfcf7683f1fcea307ae6a6bfc64a51d1 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 12 May 2024 10:13:23 -0700
Subject: [PATCH 184/373] Stack memory tracking improvements (#614)

* Stack memory tracking improvements, fixes #566
* Expand byteswap tests to test big and little endian platforms
* Update conformance test expected results to be more precise
---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/config.cpp                |   1 +
 src/config.hpp                |   1 +
 src/crab/array_domain.cpp     | 118 ++++++++++++-
 src/crab/array_domain.hpp     |   4 +
 src/crab/ebpf_domain.cpp      |  56 ++++--
 src/ebpf_yaml.cpp             |   8 +
 src/test/test_conformance.cpp |  16 +-
 test-data/stack.yaml          | 316 ++++++++++++++++++++++++++++++++++
 test-data/unop.yaml           | 196 +++++++++++++++++++--
 9 files changed, 677 insertions(+), 39 deletions(-)

diff --git a/src/config.cpp b/src/config.cpp
index 3849162c5..00ccab43b 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -13,4 +13,5 @@ const ebpf_verifier_options_t ebpf_verifier_default_options = {
     .print_line_info = false,
     .allow_division_by_zero = true,
     .setup_constraints = true,
+    .big_endian = false,
 };
diff --git a/src/config.hpp b/src/config.hpp
index cf3065fd9..93d787f3b 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -18,6 +18,7 @@ struct ebpf_verifier_options_t {
     bool print_line_info;
     bool allow_division_by_zero;
     bool setup_constraints;
+    bool big_endian;
 
     bool dump_btf_types_json;
 };
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 1746144aa..9a51ba668 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -8,10 +8,13 @@
 #include <utility>
 #include <vector>
 
+#include "boost/endian/conversion.hpp"
+
 #include "radix_tree/radix_tree.hpp"
 #include "crab/array_domain.hpp"
 
 #include "asm_ostream.hpp"
+#include "config.hpp"
 #include "dsl_syntax.hpp"
 #include "spec_type_descriptors.hpp"
 
@@ -110,9 +113,9 @@ class cell_t final {
         return {number_t{static_cast<int>(o)}, number_t{static_cast<int>(o)} + number_t{static_cast<int>(size - 1)}};
     }
 
+  public:
     [[nodiscard]] interval_t to_interval() const { return to_interval(_offset, _size); }
 
-  public:
     [[nodiscard]] bool is_null() const { return _offset == 0 && _size == 0; }
 
     [[nodiscard]] offset_t get_offset() const { return _offset; }
@@ -447,6 +450,68 @@ std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
     return o;
 }
 
+// Create a new cell that is a subset of an existing cell.
+void array_domain_t::split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len) {
+    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
+
+    // Get the values from the indicated stack range.
+    std::optional<linear_expression_t> svalue = load(inv, data_kind_t::svalues, number_t(cell_start_index), len);
+    std::optional<linear_expression_t> uvalue = load(inv, data_kind_t::uvalues, number_t(cell_start_index), len);
+
+    // Create a new cell for that range.
+    offset_map_t& offset_map = lookup_array_map(kind);
+    cell_t new_cell = offset_map.mk_cell(cell_start_index, len);
+    inv.assign(new_cell.get_scalar(data_kind_t::svalues), svalue);
+    inv.assign(new_cell.get_scalar(data_kind_t::uvalues), uvalue);
+}
+
+// Prepare to havoc bytes in the middle of a cell by potentially splitting the cell if it is numeric,
+// into the part to the left of the havoced portion, and the part to the right of the havoced portion.
+void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                                      const linear_expression_t& elem_size) {
+    assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
+    offset_map_t& offset_map = lookup_array_map(kind);
+    interval_t ii = inv.eval_interval(i);
+    std::optional<number_t> n = ii.singleton();
+    if (!n) {
+        // We can only split a singleton offset.
+        return;
+    }
+    interval_t i_elem_size = inv.eval_interval(elem_size);
+    std::optional<number_t> n_bytes = i_elem_size.singleton();
+    if (!n_bytes) {
+        // We can only split a singleton size.
+        return;
+    }
+    auto size = static_cast<unsigned int>(*n_bytes);
+    offset_t o((uint64_t)*n);
+
+    std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
+    for (cell_t const& c : cells) {
+        interval_t intv = c.to_interval();
+        int cell_start_index = (int)*intv.lb().number();
+        int cell_end_index = (int)*intv.ub().number();
+
+        if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) || (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
+            // We can only split numeric cells of size 8 or less.
+            continue;
+        }
+
+        if (!inv.eval_interval(c.get_scalar(kind)).is_singleton()) {
+            // We can only split cells with a singleton value.
+            continue;
+        }
+        if (cell_start_index < o) {
+            // Use the bytes to the left of the specified range.
+            split_cell(inv, kind, cell_start_index, (unsigned int)(o - cell_start_index));
+        }
+        if (o + size - 1 < cell_end_index) {
+            // Use the bytes to the right of the specified range.
+            split_cell(inv, kind, (int)(o + size), (unsigned int)(cell_end_index - (o + size - 1)));
+        }
+    }
+}
+
 // we can only treat this as non-member because we use global state
 static std::optional<std::pair<offset_t, unsigned>>
 kill_and_find_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, const linear_expression_t& elem_size) {
@@ -522,6 +587,28 @@ std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width)
         return {};
     }
     uint64_t n = t->cast_to_uint64();
+
+    // Convert value to bytes of the appropriate endian-ness.
+    switch (width) {
+    case sizeof(uint16_t):
+        if (thread_local_options.big_endian)
+            n = boost::endian::native_to_big<uint16_t>(n);
+        else
+            n = boost::endian::native_to_little<uint16_t>(n);
+        break;
+    case sizeof(uint32_t):
+        if (thread_local_options.big_endian)
+            n = boost::endian::native_to_big<uint32_t>(n);
+        else
+            n = boost::endian::native_to_little<uint32_t>(n);
+        break;
+    case sizeof(uint64_t):
+        if (thread_local_options.big_endian)
+            n = boost::endian::native_to_big<uint64_t>(n);
+        else
+            n = boost::endian::native_to_little<uint64_t>(n);
+        break;
+    }
     uint8_t* bytes = (uint8_t*)&n;
     return bytes[o % width];
 }
@@ -578,14 +665,26 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
                 }
                 if (size == 2) {
                     uint16_t b = *(uint16_t*)result_buffer;
+                    if (thread_local_options.big_endian)
+                        b = boost::endian::native_to_big<uint16_t>(b);
+                    else
+                        b = boost::endian::native_to_little<uint16_t>(b);
                     return number_t{b};
                 }
                 if (size == 4) {
                     uint32_t b = *(uint32_t*)result_buffer;
+                    if (thread_local_options.big_endian)
+                        b = boost::endian::native_to_big<uint32_t>(b);
+                    else
+                        b = boost::endian::native_to_little<uint32_t>(b);
                     return number_t{b};
                 }
                 if (size == 8) {
                     uint64_t b = *(uint64_t*)result_buffer;
+                    if (thread_local_options.big_endian)
+                        b = boost::endian::native_to_big<uint64_t>(b);
+                    else
+                        b = boost::endian::native_to_little<uint64_t>(b);
                     return (kind == data_kind_t::uvalues) ? number_t(b) : number_t((int64_t)b);
                 }
             }
@@ -629,11 +728,22 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
     return {};
 }
 
+// We are about to write to a given range of bytes on the stack.
+// Any cells covering that range need to be removed, and any cells that only
+// partially cover that range can be split such that any non-covered portions become new cells.
+static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
+    if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
+        array_domain.split_number_var(inv, kind, idx, elem_size);
+    }
+    return kill_and_find_var(inv, kind, idx, elem_size);
+}
+
+
 std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind,
                                                 const linear_expression_t& idx,
                                                 const linear_expression_t& elem_size,
                                                 const linear_expression_t& val) {
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -655,7 +765,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
                                                      const linear_expression_t& elem_size,
                                                      const linear_expression_t& val) {
     auto kind = data_kind_t::types;
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
@@ -678,7 +788,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
 }
 
 void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
-    auto maybe_cell = kill_and_find_var(inv, kind, idx, elem_size);
+    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell && kind == data_kind_t::types) {
         auto [offset, size] = *maybe_cell;
         num_bytes.havoc(offset, size);
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index ee3808e9e..70525cb90 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -87,6 +87,10 @@ class array_domain_t final {
     // Perform array stores over an array segment
     void store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width);
 
+    void split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                          const linear_expression_t& elem_size);
+    void split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len);
+
     void initialize_numbers(int lb, int width);
 };
 
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index a8c9e1f01..a6be102ae 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1447,6 +1447,12 @@ void ebpf_domain_t::operator()(const Assume& s) {
 
 void ebpf_domain_t::operator()(const Undefined& a) {}
 
+// Simple truncation function usable with swap_endianness().
+template <class T>
+BOOST_CONSTEXPR T truncate(T x) BOOST_NOEXCEPT {
+    return x;
+}
+
 void ebpf_domain_t::operator()(const Un& stmt) {
     auto dst = reg_pack(stmt.dst);
     auto swap_endianness = [&](variable_t v, auto input, const auto& be_or_le) {
@@ -1464,33 +1470,57 @@ void ebpf_domain_t::operator()(const Un& stmt) {
         havoc(v);
         havoc_offsets(stmt.dst);
     };
-    // Swap bytes.  For 64-bit types we need the weights to fit in a
+    // Swap bytes if needed.  For 64-bit types we need the weights to fit in a
     // signed int64, but for smaller types we don't want sign extension,
     // so we use unsigned which still fits in a signed int64.
     switch (stmt.op) {
     case Un::Op::BE16:
-        swap_endianness(dst.svalue, uint16_t(0), boost::endian::native_to_big<uint16_t>);
-        swap_endianness(dst.uvalue, uint16_t(0), boost::endian::native_to_big<uint16_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(dst.svalue, uint16_t(0), truncate<uint16_t>);
+            swap_endianness(dst.uvalue, uint16_t(0), truncate<uint16_t>);
+        }
         break;
     case Un::Op::BE32:
-        swap_endianness(dst.svalue, uint32_t(0), boost::endian::native_to_big<uint32_t>);
-        swap_endianness(dst.uvalue, uint32_t(0), boost::endian::native_to_big<uint32_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(dst.svalue, uint32_t(0), truncate<uint32_t>);
+            swap_endianness(dst.uvalue, uint32_t(0), truncate<uint32_t>);
+        }
         break;
     case Un::Op::BE64:
-        swap_endianness(dst.svalue, int64_t(0), boost::endian::native_to_big<int64_t>);
-        swap_endianness(dst.uvalue, uint64_t(0), boost::endian::native_to_big<uint64_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
+            swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+        }
         break;
     case Un::Op::LE16:
-        swap_endianness(dst.svalue, uint16_t(0), boost::endian::native_to_little<uint16_t>);
-        swap_endianness(dst.uvalue, uint16_t(0), boost::endian::native_to_little<uint16_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(dst.svalue, uint16_t(0), truncate<uint16_t>);
+            swap_endianness(dst.uvalue, uint16_t(0), truncate<uint16_t>);
+        }
         break;
     case Un::Op::LE32:
-        swap_endianness(dst.svalue, uint32_t(0), boost::endian::native_to_little<uint32_t>);
-        swap_endianness(dst.uvalue, uint32_t(0), boost::endian::native_to_little<uint32_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(dst.svalue, uint32_t(0), truncate<uint32_t>);
+            swap_endianness(dst.uvalue, uint32_t(0), truncate<uint32_t>);
+        }
         break;
     case Un::Op::LE64:
-        swap_endianness(dst.svalue, int64_t(0), boost::endian::native_to_little<int64_t>);
-        swap_endianness(dst.svalue, uint64_t(0), boost::endian::native_to_little<uint64_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
+            swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+        }
         break;
     case Un::Op::SWAP16:
         swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 50378f5a8..dfdf6ef3e 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 #include <algorithm>
+#include <bit>
 #include <iostream>
 #include <set>
 #include <variant>
@@ -177,6 +178,9 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
     options.no_simplify = true;
     options.setup_constraints = false;
 
+    // Default to the machine's native endianness.
+    options.big_endian = (std::endian::native == std::endian::big);
+
     for (const string& name : raw_options) {
         if (name == "!allow_division_by_zero") {
             options.allow_division_by_zero = false;
@@ -184,6 +188,10 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
             options.check_termination = true;
         } else if (name == "strict") {
             options.strict = true;
+        } else if (name == "big_endian") {
+            options.big_endian = true;
+        } else if (name == "!big_endian") {
+            options.big_endian = false;
         } else {
             throw std::runtime_error("Unknown option: " + name);
         }
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index 5faca7769..0680e0b2d 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -151,25 +151,25 @@ TEST_CONFORMANCE("le16.data")
 TEST_CONFORMANCE("le32.data")
 TEST_CONFORMANCE("le64.data")
 TEST_CONFORMANCE("lock_add.data")
-TEST_CONFORMANCE_RANGE("lock_add32.data", "[0, 1311768467463790321]")
+TEST_CONFORMANCE("lock_add32.data")
 TEST_CONFORMANCE("lock_and.data")
-TEST_CONFORMANCE_TOP("lock_and32.data")
+TEST_CONFORMANCE("lock_and32.data")
 TEST_CONFORMANCE_TOP("lock_cmpxchg.data")
 TEST_CONFORMANCE_TOP("lock_cmpxchg32.data")
 TEST_CONFORMANCE("lock_fetch_add.data")
-TEST_CONFORMANCE_RANGE("lock_fetch_add32.data", "[0, 1311768467463790321]")
+TEST_CONFORMANCE("lock_fetch_add32.data")
 TEST_CONFORMANCE("lock_fetch_and.data")
-TEST_CONFORMANCE_TOP("lock_fetch_and32.data")
+TEST_CONFORMANCE("lock_fetch_and32.data")
 TEST_CONFORMANCE("lock_fetch_or.data")
-TEST_CONFORMANCE_TOP("lock_fetch_or32.data")
+TEST_CONFORMANCE("lock_fetch_or32.data")
 TEST_CONFORMANCE("lock_fetch_xor.data")
-TEST_CONFORMANCE_TOP("lock_fetch_xor32.data")
+TEST_CONFORMANCE("lock_fetch_xor32.data")
 TEST_CONFORMANCE("lock_or.data")
-TEST_CONFORMANCE_TOP("lock_or32.data")
+TEST_CONFORMANCE("lock_or32.data")
 TEST_CONFORMANCE("lock_xchg.data")
 TEST_CONFORMANCE("lock_xchg32.data")
 TEST_CONFORMANCE("lock_xor.data")
-TEST_CONFORMANCE_TOP("lock_xor32.data")
+TEST_CONFORMANCE("lock_xor32.data")
 TEST_CONFORMANCE("lsh32-imm.data")
 TEST_CONFORMANCE("lsh32-imm-high.data")
 TEST_CONFORMANCE("lsh32-imm-neg.data")
diff --git a/test-data/stack.yaml b/test-data/stack.yaml
index d1c4ab198..68fd3e866 100644
--- a/test-data/stack.yaml
+++ b/test-data/stack.yaml
@@ -1,6 +1,322 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
 ---
+test-case: stack load 16 bits little-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=1", "s[504...504].uvalue=1",
+      "s[505...505].type=number", "s[505...505].svalue=2", "s[505...505].uvalue=2"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u16 *)(r10 - 8) ; load 2 bytes spanning s[504...505]: 0x01 and 0x02 -> 0x0201
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...505].type=number
+  - s[504].svalue=1
+  - s[504].uvalue=1
+  - s[505].svalue=2
+  - s[505].uvalue=2
+  - r0.type=number
+  - r0.svalue=513
+  - r0.uvalue=513
+---
+test-case: stack load 16 bits big-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=2", "s[504...504].uvalue=2",
+      "s[505...505].type=number", "s[505...505].svalue=1", "s[505...505].uvalue=1"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u16 *)(r10 - 8) ; load 2 bytes spanning s[504...505]: 0x02 and 0x01 -> 0x0201
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...505].type=number
+  - s[504].svalue=2
+  - s[504].uvalue=2
+  - s[505].svalue=1
+  - s[505].uvalue=1
+  - r0.type=number
+  - r0.svalue=513
+  - r0.uvalue=513
+---
+test-case: stack load 32 bits little-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=120", "s[504...504].uvalue=120",
+      "s[505...505].type=number", "s[505...505].svalue=86", "s[505...505].uvalue=86",
+      "s[506...506].type=number", "s[506...506].svalue=52", "s[506...506].uvalue=52",
+      "s[507...507].type=number", "s[507...507].svalue=18", "s[507...507].uvalue=18"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u32 *)(r10 - 8) ; load s[504...507]: 0x12345678 on little-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...507].type=number
+  - s[504].svalue=120
+  - s[504].uvalue=120
+  - s[505].svalue=86
+  - s[505].uvalue=86
+  - s[506].svalue=52
+  - s[506].uvalue=52
+  - s[507].svalue=18
+  - s[507].uvalue=18
+  - r0.type=number
+  - r0.svalue=305419896
+  - r0.uvalue=305419896
+---
+test-case: stack load 32 bits big-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=18", "s[504...504].uvalue=18",
+      "s[505...505].type=number", "s[505...505].svalue=52", "s[505...505].uvalue=52",
+      "s[506...506].type=number", "s[506...506].svalue=86", "s[506...506].uvalue=86",
+      "s[507...507].type=number", "s[507...507].svalue=120", "s[507...507].uvalue=120"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u32 *)(r10 - 8) ; load s[504...507]: 0x12345678 on big-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...507].type=number
+  - s[504].svalue=18
+  - s[504].uvalue=18
+  - s[505].svalue=52
+  - s[505].uvalue=52
+  - s[506].svalue=86
+  - s[506].uvalue=86
+  - s[507].svalue=120
+  - s[507].uvalue=120
+  - r0.type=number
+  - r0.svalue=305419896
+  - r0.uvalue=305419896
+---
+test-case: stack load 64 bits little-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=240", "s[504...504].uvalue=240",
+      "s[505...505].type=number", "s[505...505].svalue=222", "s[505...505].uvalue=222",
+      "s[506...506].type=number", "s[506...506].svalue=188", "s[506...506].uvalue=188",
+      "s[507...507].type=number", "s[507...507].svalue=154", "s[507...507].uvalue=154",
+      "s[508...508].type=number", "s[508...508].svalue=120", "s[508...508].uvalue=120",
+      "s[509...509].type=number", "s[509...509].svalue=86", "s[509...509].uvalue=86",
+      "s[510...510].type=number", "s[510...510].svalue=52", "s[510...510].uvalue=52",
+      "s[511...511].type=number", "s[511...511].svalue=18", "s[511...511].uvalue=18"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 8) ; load s[504...511]: 0x9abcdef0 and 0x12345678 -> 0x123456789abcdef0 on little-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504].svalue=240
+  - s[504].uvalue=240
+  - s[505].svalue=222
+  - s[505].uvalue=222
+  - s[506].svalue=188
+  - s[506].uvalue=188
+  - s[507].svalue=154
+  - s[507].uvalue=154
+  - s[508].svalue=120
+  - s[508].uvalue=120
+  - s[509].svalue=86
+  - s[509].uvalue=86
+  - s[510].svalue=52
+  - s[510].uvalue=52
+  - s[511].svalue=18
+  - s[511].uvalue=18
+  - r0.type=number
+  - r0.svalue=1311768467463790320
+  - r0.uvalue=1311768467463790320
+---
+test-case: stack load 64 bits big-endian across multiple variables
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...504].type=number", "s[504...504].svalue=18", "s[504...504].uvalue=18",
+      "s[505...505].type=number", "s[505...505].svalue=52", "s[505...505].uvalue=52",
+      "s[506...506].type=number", "s[506...506].svalue=86", "s[506...506].uvalue=86",
+      "s[507...507].type=number", "s[507...507].svalue=120", "s[507...507].uvalue=120",
+      "s[508...508].type=number", "s[508...508].svalue=154", "s[508...508].uvalue=154",
+      "s[509...509].type=number", "s[509...509].svalue=188", "s[509...509].uvalue=188",
+      "s[510...510].type=number", "s[510...510].svalue=222", "s[510...510].uvalue=222",
+      "s[511...511].type=number", "s[511...511].svalue=240", "s[511...511].uvalue=240"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 8) ; load s[504...511]: 0x123456789abcdef0 on big-endian
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504].svalue=18
+  - s[504].uvalue=18
+  - s[505].svalue=52
+  - s[505].uvalue=52
+  - s[506].svalue=86
+  - s[506].uvalue=86
+  - s[507].svalue=120
+  - s[507].uvalue=120
+  - s[508].svalue=154
+  - s[508].uvalue=154
+  - s[509].svalue=188
+  - s[509].uvalue=188
+  - s[510].svalue=222
+  - s[510].uvalue=222
+  - s[511].svalue=240
+  - s[511].uvalue=240
+  - r0.type=number
+  - r0.svalue=1311768467463790320
+  - r0.uvalue=1311768467463790320
+---
+test-case: stack re-assign little-endian immediate first
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 8) = 0 ; zero the first four bytes of 0x123456789abcdef0 -> 0x12345678 on little-endian machine
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=0
+  - s[504...507].uvalue=0
+  - s[508...511].svalue=305419896
+  - s[508...511].uvalue=305419896
+---
+test-case: stack re-assign big-endian immediate first
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 8) = 0 ; zero the first four bytes of 0x123456789abcdef0 -> 0x9abcdef0 on big-endian machine
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=0
+  - s[504...507].uvalue=0
+  - s[508...511].svalue=2596069104
+  - s[508...511].uvalue=2596069104
+---
+test-case: stack re-assign little-endian immediate middle
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 6) = 0 ; zero the middle four bytes of 0x123456789abcdef0
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...505].svalue=57072
+  - s[504...505].uvalue=57072
+  - s[506...509].svalue=0
+  - s[506...509].uvalue=0
+  - s[510...511].svalue=4660
+  - s[510...511].uvalue=4660
+---
+test-case: stack re-assign big-endian immediate middle
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 6) = 0 ; zero the middle four bytes of 0x123456789abcdef0
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...505].svalue=4660
+  - s[504...505].uvalue=4660
+  - s[506...509].svalue=0
+  - s[506...509].uvalue=0
+  - s[510...511].svalue=57072
+  - s[510...511].uvalue=57072
+---
+test-case: stack re-assign little-endian immediate last
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 4) = 0 ; zero the last four bytes of 0x123456789abcdef0 -> 0x9abcdef0
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=2596069104
+  - s[504...507].uvalue=2596069104
+  - s[508...511].svalue=0
+  - s[508...511].uvalue=0
+---
+test-case: stack re-assign big-endian immediate last
+
+pre: ["r10.type=stack", "r10.stack_offset=512",
+      "s[504...511].type=number", "s[504...511].svalue=1311768467463790320", "s[504...511].uvalue=1311768467463790320"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    *(u32 *)(r10 - 4) = 0 ; zero the last four bytes of 0x123456789abcdef0 -> 0x12345678
+
+post:
+  - r10.type=stack
+  - r10.stack_offset=512
+  - s[504...511].type=number
+  - s[504...507].svalue=305419896
+  - s[504...507].uvalue=305419896
+  - s[508...511].svalue=0
+  - s[508...511].uvalue=0
+---
 test-case: set numeric size
 
 pre: ["r1.type=number",
diff --git a/test-data/unop.yaml b/test-data/unop.yaml
index 180ff41ca..124f33fe6 100644
--- a/test-data/unop.yaml
+++ b/test-data/unop.yaml
@@ -41,120 +41,288 @@ code:
 
 post: ["r1.type=number", "r1.svalue=[-5, 5]"]
 ---
-test-case: be16 singleton
+test-case: be16 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = be16 r1 ; 0x654321 -> 0x2143
 
 post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
 ---
-test-case: be32 singleton
+test-case: be16 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; 0x654321 -> 0x4321
+
+post: ["r1.type=number", "r1.svalue=17185", "r1.uvalue=17185"]
+---
+test-case: be32 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = be32 r1 ; 0x0987654321 -> 0x21436587
 
 post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
 ---
-test-case: be64 singleton
+test-case: be32 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be32 r1 ; 0x0987654321 -> 0x87654321
+
+post: ["r1.type=number", "r1.svalue=2271560481", "r1.uvalue=2271560481"]
+---
+test-case: be64 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = be64 r1 ; 0x0987654321 -> 0x2143658709000000
 
 post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
 ---
-test-case: be16 range
+test-case: be64 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be64 r1 ; nop
+
+post: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+---
+test-case: be16 range on little-endian
 
 pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = be16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
 
 post: ["r1.type=number"]
 ---
-test-case: le16 singleton
+test-case: be16 range on big-endian
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; nop. this could preserve the range but we don't support that yet
+
+post: ["r1.type=number"]
+---
+test-case: le16 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = le16 r1 ; 0x654321 -> 0x4321
 
 post: ["r1.type=number", "r1.svalue=17185", "r1.uvalue=17185"]
 ---
-test-case: le32 singleton
+test-case: le16 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
+---
+test-case: le32 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = le32 r1 ; 0x0987654321 -> 0x87654321
 
 post: ["r1.type=number", "r1.svalue=2271560481", "r1.uvalue=2271560481"]
 ---
-test-case: le64 singleton
+test-case: le32 singleton on big-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["big_endian"]
+
 code:
   <start>: |
-    r1 = le64 r1 ; 0x0987654321 -> 0x2143658709000000
+    r1 = le32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
+---
+test-case: le64 singleton on little-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le64 r1 ; nop
 
 post: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 ---
-test-case: le16 range
+test-case: le64 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = le64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
+---
+test-case: le16 range on little-endian
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; nop. this could preserve the range but we don't support that yet
+
+post: ["r1.type=number"]
+---
+test-case: le16 range on big-endian
 
 pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
-    r1 = le16 r1 ; this could preserve the range but we don't support that yet
+    r1 = le16 r1
 
 post: ["r1.type=number"]
 ---
-test-case: swap16 singleton
+test-case: swap16 singleton on little-endian
+
+pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
+---
+test-case: swap16 singleton on big-endian
 
 pre: ["r1.type=number", "r1.svalue=6636321", "r1.uvalue=6636321"]
 
+options: ["big_endian"]
+
 code:
   <start>: |
     r1 = swap16 r1 ; 0x654321 -> 0x2143
 
 post: ["r1.type=number", "r1.svalue=8515", "r1.uvalue=8515"]
 ---
-test-case: swap32 singleton
+test-case: swap32 singleton on little-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = swap32 r1 ; 0x0987654321 -> 0x21436587
 
 post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
 ---
-test-case: swap64 singleton
+test-case: swap32 singleton on big-endian
 
 pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
 
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1.type=number", "r1.svalue=558065031", "r1.uvalue=558065031"]
+---
+test-case: swap64 singleton on little-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["!big_endian"]
+
 code:
   <start>: |
     r1 = swap64 r1 ; 0x0987654321 -> 0x2143658709000000
 
 post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
 ---
-test-case: swap16 range
+test-case: swap64 singleton on big-endian
+
+pre: ["r1.type=number", "r1.svalue=40926266145", "r1.uvalue=40926266145"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1.type=number", "r1.svalue=2396871057337221120", "r1.uvalue=2396871057337221120"]
+---
+test-case: swap16 range on little-endian
 
 pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
 
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1.type=number"]
+---
+test-case: swap16 range on big-endian
+
+pre: ["r1.type=number", "r1.svalue=[0, 2]", "r1.uvalue=[0, 2]", "r1.svalue=r1.uvalue"]
+
+options: ["big_endian"]
+
 code:
   <start>: |
     r1 = swap16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range

From 07620ad5d30f2361443579d59185414d965e4ef1 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Sun, 12 May 2024 11:13:50 -0700
Subject: [PATCH 185/373] Permit shared region as key or value for map (#623)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/assertions.cpp       |   2 +-
 src/crab/ebpf_domain.cpp |   6 +
 test-data/call.yaml      | 211 +++++++++++++++++++++++++++++++-
 test-data/callx.yaml     | 253 ++++++++++++++++++++++++++++++++++++++-
 4 files changed, 469 insertions(+), 3 deletions(-)

diff --git a/src/assertions.cpp b/src/assertions.cpp
index c3e090134..e64a683c4 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -70,7 +70,7 @@ class AssertExtractor {
             case ArgSingle::Kind::PTR_TO_MAP_KEY:
             case ArgSingle::Kind::PTR_TO_MAP_VALUE:
                 assert(map_fd_reg);
-                res.emplace_back(TypeConstraint{arg.reg, TypeGroup::stack_or_packet});
+                res.emplace_back(TypeConstraint{arg.reg, TypeGroup::mem});
                 res.emplace_back(ValidMapKeyValue{arg.reg, *map_fd_reg,
                                                   arg.kind == ArgSingle::Kind::PTR_TO_MAP_KEY});
                 break;
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index a6be102ae..200c6b469 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1783,6 +1783,12 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             linear_expression_t ub = lb + width;
             check_access_packet(inv, lb, ub, {});
             // Packet memory is both readable and writable.
+        } else if (access_reg_type == T_SHARED) {
+            variable_t lb = access_reg.shared_offset;
+            linear_expression_t ub = lb + width;
+            check_access_shared(inv, lb, ub, access_reg.shared_region_size);
+            require(inv, access_reg.svalue > 0, "Possible null access");
+            // Shared memory is zero-initialized when created so is safe to read and write.
         } else {
             require(inv, linear_constraint_t::FALSE(), "Only stack or packet can be used as a parameter");
         }
diff --git a/test-data/call.yaml b/test-data/call.yaml
index 8c9eeea38..e7c81c31b 100644
--- a/test-data/call.yaml
+++ b/test-data/call.yaml
@@ -20,6 +20,104 @@ post:
   - r0.svalue=r0.uvalue
   - s[504...511].type=number
 ---
+test-case: bpf_map_lookup_elem shared key
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+---
+test-case: bpf_map_lookup_elem packet key
+
+pre: [ "meta_offset=0",
+      "r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=packet", "r2.packet_offset=0", "packet_size=4"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - meta_offset=0
+  - packet_size=4
+---
+test-case: bpf_map_lookup_elem shared key - maybe null
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=4", "r2.svalue=[0, 2147418112]", "r2.uvalue=[0, 2147418112]"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+
+messages:
+  - "0: Possible null access (within stack(r2:key_size(r1)))"
+
+---
+test-case: bpf_map_lookup_elem shared key - too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=2", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+
+messages:
+  - "0: Upper bound must be at most r2.shared_region_size (within stack(r2:key_size(r1)))"
+---
+test-case: bpf_map_lookup_elem shared key - too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=-2", "r2.shared_region_size=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]"]
+
+code:
+  <start>: |
+    call 1; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+
+messages:
+  - "0: Lower bound must be at least 0 (within stack(r2:key_size(r1)))"
+---
 test-case: bpf_map_lookup_elem with non-numeric stack key
 
 pre: ["r1.type=map_fd", "r1.map_fd=1",
@@ -40,6 +138,117 @@ post:
 messages:
   - "0: Illegal map update with a non-numerical value [-oo-oo) (within stack(r2:key_size(r1)))"
 ---
+test-case: bpf_map_update_elem with numeric stack value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=stack", "r3.stack_offset=496",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+
+---
+test-case: bpf_map_update_elem with shared value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=4", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+
+---
+test-case: bpf_map_update_elem with shared value too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=2", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+
+messages:
+  - "0: Upper bound must be at most r3.shared_region_size (within stack(r3:value_size(r1)))"
+
+---
+test-case: bpf_map_update_elem with shared value larger than target region
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=64", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+
+---
+test-case: bpf_map_update_elem with shared value may be null
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=4", "r3.svalue=[0, 2147418112]", "r3.uvalue=[0, 2147418112]",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+
+messages:
+  -  "0: Possible null access (within stack(r3:value_size(r1)))"
+
+---
+test-case: bpf_map_update_elem with packet value
+
+pre: ["meta_offset=0",
+      "r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=packet", "r3.packet_offset=0", "packet_size=4",
+      "r4.type=number",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    call 2; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - meta_offset=0
+  - packet_size=4
+
+---
 test-case: bpf_map_update_elem with non-numeric stack value
 
 pre: ["r1.type=map_fd", "r1.map_fd=1",
@@ -76,7 +285,7 @@ post:
   - s[504...511].type=number
 
 messages:
-  - "0: Invalid type (r3.type in {stack, packet})"
+  - "0: Invalid type (r3.type in {stack, packet, shared})"
   - "0: Only stack or packet can be used as a parameter (within stack(r3:value_size(r1)))"
 ---
 test-case: bpf_ringbuf_output with numeric stack value
diff --git a/test-data/callx.yaml b/test-data/callx.yaml
index d262aafde..45da0f9a9 100644
--- a/test-data/callx.yaml
+++ b/test-data/callx.yaml
@@ -24,6 +24,123 @@ post:
   - r8.uvalue=1
   - s[504...511].type=number
 ---
+test-case: callx bpf_map_lookup_elem shared key
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+---
+test-case: callx bpf_map_lookup_elem packet key
+
+pre: [ "meta_offset=0",
+      "r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=packet", "r2.packet_offset=0", "packet_size=4",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - meta_offset=0
+  - packet_size=4
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+---
+test-case: callx bpf_map_lookup_elem shared key - maybe null
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=4", "r2.svalue=[0, 2147418112]", "r2.uvalue=[0, 2147418112]",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+
+messages:
+  - "0: Possible null access (within stack(r2:key_size(r1)))"
+---
+test-case: callx bpf_map_lookup_elem shared key - too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=0", "r2.shared_region_size=2", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+
+messages:
+  - "0: Upper bound must be at most r2.shared_region_size (within stack(r2:key_size(r1)))"
+---
+test-case: callx bpf_map_lookup_elem shared key - too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=shared", "r2.shared_offset=-2", "r2.shared_region_size=4", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]",
+      "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_lookup_elem
+
+post:
+  - r0.type=shared
+  - r0.shared_offset=0
+  - r0.shared_region_size=4
+  - r0.svalue=[0, 2147418112]
+  - r0.uvalue=[0, 2147418112]
+  - r0.svalue=r0.uvalue
+  - r8.type=number
+  - r8.svalue=1
+  - r8.uvalue=1
+
+messages:
+  - "0: Lower bound must be at least 0 (within stack(r2:key_size(r1)))"
+---
 test-case: callx 0
 
 pre: ["r8.type=number", "r8.svalue=1000", "r8.uvalue=1000"]
@@ -96,6 +213,140 @@ post:
 messages:
   - "0: Illegal map update with a non-numerical value [-oo-oo) (within stack(r2:key_size(r1)))"
 ---
+test-case: callx bpf_map_update_elem with numeric stack value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=stack", "r3.stack_offset=496",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+---
+test-case: callx bpf_map_update_elem with shared value
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=4", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+---
+test-case: callx bpf_map_update_elem with shared value too small
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=2", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+messages:
+  - "0: Upper bound must be at most r3.shared_region_size (within stack(r3:value_size(r1)))"
+
+---
+test-case: callx bpf_map_update_elem with shared value larger than target region
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=64", "r3.svalue=[1, 2147418112]", "r3.uvalue=[1, 2147418112]",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+---
+test-case: callx bpf_map_update_elem with shared value may be null
+
+pre: ["r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=shared", "r3.shared_offset=0", "r3.shared_region_size=4", "r3.svalue=[0, 2147418112]", "r3.uvalue=[0, 2147418112]",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+
+messages:
+  -  "0: Possible null access (within stack(r3:value_size(r1)))"
+
+---
+test-case: callx bpf_map_update_elem with packet value
+
+pre: ["meta_offset=0",
+      "r1.type=map_fd", "r1.map_fd=1",
+      "r2.type=stack", "r2.stack_offset=504",
+      "r3.type=packet", "r3.packet_offset=0", "packet_size=4",
+      "r4.type=number",
+      "r8.type=number", "r8.svalue=2", "r8.uvalue=2",
+      "s[496...511].type=number"]
+
+code:
+  <start>: |
+    callx r8; bpf_map_update_elem
+
+post:
+  - r0.type=number
+  - s[496...511].type=number
+  - meta_offset=0
+  - packet_size=4
+  - r8.type=number
+  - r8.svalue=2
+  - r8.uvalue=2
+---
 test-case: callx bpf_map_update_elem with non-numeric stack value
 
 pre: ["r1.type=map_fd", "r1.map_fd=1",
@@ -140,7 +391,7 @@ post:
   - r8.uvalue=2
 
 messages:
-  - "0: Invalid type (r3.type in {stack, packet})"
+  - "0: Invalid type (r3.type in {stack, packet, shared})"
   - "0: Only stack or packet can be used as a parameter (within stack(r3:value_size(r1)))"
 ---
 test-case: callx bpf_ringbuf_output with numeric stack value

From 400f0a747c7aa15ac089da24962dd22f2bdb3bcf Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sun, 12 May 2024 18:30:26 -0700
Subject: [PATCH 186/373] Add CI/CD workflow to validate YAML files (#618)

* Add CI/CD workflow to validate YAML files
* Fix YAML issues found by yamllint
---------
Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 .github/workflows/codeql-analysis.yml |  70 +++++------
 .github/workflows/coverage.yml        |  14 +--
 .github/workflows/validate-yaml.yml   |  29 +++++
 .yamllint.yml                         |  10 ++
 test-data/atomic.yaml                 |  74 +++++------
 test-data/full64.yaml                 |  42 +++----
 test-data/packet.yaml                 | 172 ++++++++++----------------
 test-data/unsigned.yaml               |  26 ++--
 8 files changed, 218 insertions(+), 219 deletions(-)
 create mode 100644 .github/workflows/validate-yaml.yml
 create mode 100644 .yamllint.yml

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0522fc057..3a8a2f613 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ main ]
+    branches: [main]
   schedule:
     - cron: '43 12 * * 2'
 
@@ -28,46 +28,46 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'cpp' ]
+        language: ['cpp']
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
         # Learn more:
         # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        submodules: 'recursive'
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    # - name: Autobuild
-    #  uses: github/codeql-action/autobuild@v1
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      # - name: Autobuild
+      #  uses: github/codeql-action/autobuild@v1
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
 
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-    - name: Install dependencies
-      run: |
-        sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev
-        
-    - run: |
-        mkdir build
-        cmake -B build -DCMAKE_BUILD_TYPE=Debug
-        cmake --build build -j $(nproc)
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+      - name: Install dependencies
+        run: |
+          sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      - run: |
+          mkdir build
+          cmake -B build -DCMAKE_BUILD_TYPE=Debug
+          cmake --build build -j $(nproc)
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 5874a3ae1..2765caabb 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -5,9 +5,9 @@ name: CPP Code Coverage
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 jobs:
   build_ubuntu:
@@ -55,8 +55,8 @@ jobs:
     needs: build_ubuntu
     runs-on: ubuntu-20.04
     steps:
-    - name: Coveralls Finished
-      uses: coverallsapp/github-action@master
-      with:
-        github-token: ${{ secrets.github_token }}
-        parallel-finished: true
+      - name: Coveralls Finished
+        uses: coverallsapp/github-action@master
+        with:
+          github-token: ${{ secrets.github_token }}
+          parallel-finished: true
diff --git a/.github/workflows/validate-yaml.yml b/.github/workflows/validate-yaml.yml
new file mode 100644
index 000000000..7f7fc048e
--- /dev/null
+++ b/.github/workflows/validate-yaml.yml
@@ -0,0 +1,29 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+#
+# For documentation on the github environment, see
+# https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners
+#
+# For documentation on the syntax of this file, see
+# https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+name: Validate-YAML
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate-yaml:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout GEDCOM.io
+        uses: actions/checkout@v4
+
+      - name: Validate YAML
+        run: yamllint . .github .github/workflows test-data
diff --git a/.yamllint.yml b/.yamllint.yml
new file mode 100644
index 000000000..9b63738a3
--- /dev/null
+++ b/.yamllint.yml
@@ -0,0 +1,10 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+#
+# Configuration file for yamllint.  For documentation, see
+# https://yamllint.readthedocs.io/en/stable/configuration.html
+
+extends: default
+
+rules:
+  line-length: disable
diff --git a/test-data/atomic.yaml b/test-data/atomic.yaml
index 2e4787ef3..d0e4e15ab 100644
--- a/test-data/atomic.yaml
+++ b/test-data/atomic.yaml
@@ -271,8 +271,8 @@ code:
     lock *(u32 *)(r2 + 4) += r1
 
 post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
 ---
 test-case: atomic 32-bit ADD and fetch stack
 
@@ -285,8 +285,8 @@ code:
     lock *(u32 *)(r2 + 4) += r1 fetch
 
 post: ["r1.type=number", "r1.svalue=1", "r1.uvalue=1",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=3", "s[4...7].uvalue=3"]
 ---
 test-case: atomic 64-bit ADD stack
 
@@ -299,8 +299,8 @@ code:
     lock *(u64 *)(r2 + 4) += r1
 
 post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
 ---
 test-case: atomic 64-bit ADD and fetch stack
 
@@ -313,8 +313,8 @@ code:
     lock *(u64 *)(r2 + 4) += r1 fetch
 
 post: ["r1.type=number", "r1.svalue=1", "r1.uvalue=1",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=3", "s[4...11].uvalue=3"]
 ---
 test-case: atomic 32-bit AND stack
 
@@ -327,8 +327,8 @@ code:
     lock *(u32 *)(r2 + 4) &= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
 ---
 test-case: atomic 32-bit AND and fetch stack
 
@@ -341,8 +341,8 @@ code:
     lock *(u32 *)(r2 + 4) &= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=1", "s[4...7].uvalue=1"]
 ---
 test-case: atomic 64-bit AND stack
 
@@ -355,8 +355,8 @@ code:
     lock *(u64 *)(r2 + 4) &= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
 ---
 test-case: atomic 64-bit AND and fetch stack
 
@@ -369,8 +369,8 @@ code:
     lock *(u64 *)(r2 + 4) &= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=1", "s[4...11].uvalue=1"]
 ---
 test-case: atomic 32-bit OR stack
 
@@ -383,8 +383,8 @@ code:
     lock *(u32 *)(r2 + 4) |= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
 ---
 test-case: atomic 32-bit OR and fetch stack
 
@@ -397,8 +397,8 @@ code:
     lock *(u32 *)(r2 + 4) |= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=7", "s[4...7].uvalue=7"]
 ---
 test-case: atomic 64-bit OR stack
 
@@ -411,8 +411,8 @@ code:
     lock *(u64 *)(r2 + 4) |= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
 ---
 test-case: atomic 64-bit OR and fetch stack
 
@@ -425,8 +425,8 @@ code:
     lock *(u64 *)(r2 + 4) |= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=7", "s[4...11].uvalue=7"]
 ---
 test-case: atomic 32-bit XOR stack
 
@@ -439,8 +439,8 @@ code:
     lock *(u32 *)(r2 + 4) ^= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
 ---
 test-case: atomic 32-bit XOR and fetch stack
 
@@ -453,8 +453,8 @@ code:
     lock *(u32 *)(r2 + 4) ^= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=6", "s[4...7].uvalue=6"]
 ---
 test-case: atomic 64-bit XOR stack
 
@@ -467,8 +467,8 @@ code:
     lock *(u64 *)(r2 + 4) ^= r1
 
 post: ["r1.type=number", "r1.svalue=3", "r1.uvalue=3",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
 ---
 test-case: atomic 64-bit XOR and fetch stack
 
@@ -481,8 +481,8 @@ code:
     lock *(u64 *)(r2 + 4) ^= r1 fetch
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=6", "s[4...11].uvalue=6"]
 ---
 test-case: atomic 32-bit XCHG stack
 
@@ -495,8 +495,8 @@ code:
     lock *(u32 *)(r2 + 4) x= r1
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...7].type=number", "s[4...7].svalue=2", "s[4...7].uvalue=2"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...7].type=number", "s[4...7].svalue=2", "s[4...7].uvalue=2"]
 ---
 test-case: atomic 64-bit XCHG stack
 
@@ -509,8 +509,8 @@ code:
     lock *(u64 *)(r2 + 4) x= r1
 
 post: ["r1.type=number", "r1.svalue=5", "r1.uvalue=5",
-      "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
-      "s[4...11].type=number", "s[4...11].svalue=2", "s[4...11].uvalue=2"]
+       "r2.type=stack", "r2.stack_offset=0", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue",
+       "s[4...11].type=number", "s[4...11].svalue=2", "s[4...11].uvalue=2"]
 ---
 test-case: atomic 32-bit CMPXCHG stack
 
@@ -554,7 +554,7 @@ code:
     lock *(u32 *)(r2 + 4) += r1
 
 post: ["r1.type=number", "r1.svalue=2", "r1.uvalue=2",
-      "r2.type=number", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
+       "r2.type=number", "r2.svalue=[1, 2147418112]", "r2.uvalue=[1, 2147418112]", "r2.svalue=r2.uvalue"]
 
 messages:
   - "0: Invalid type (r2.type in {ctx, stack, packet, shared})"
diff --git a/test-data/full64.yaml b/test-data/full64.yaml
index bd4642c18..b004151d9 100644
--- a/test-data/full64.yaml
+++ b/test-data/full64.yaml
@@ -174,9 +174,9 @@ code:
      assume r1 == 1
 
 post:
-   - r1.type=number
-   - r1.svalue=1
-   - r1.uvalue=1
+  - r1.type=number
+  - r1.svalue=1
+  - r1.uvalue=1
 ---
 test-case: equals reg
 
@@ -187,12 +187,12 @@ code:
      assume r1 == 1
 
 post:
-   - r1.type=number
-   - r1.svalue=1
-   - r1.uvalue=1
-   - r2.type=number
-   - r2.svalue=1
-   - r2.uvalue=1
+  - r1.type=number
+  - r1.svalue=1
+  - r1.uvalue=1
+  - r2.type=number
+  - r2.svalue=1
+  - r2.uvalue=1
 ---
 test-case: equals positive interval
 
@@ -204,15 +204,15 @@ code:
      assume r1 == r2
 
 post:
-   - r1.type=number
-   - r1.svalue=[1, 2]
-   - r1.uvalue=[1, 2]
-   - r1.svalue=r1.uvalue
-   - r2.type=number
-   - r2.svalue=[1, 2]
-   - r2.uvalue=[1, 2]
-   - r2.svalue=r2.uvalue
-   - r1.svalue=r2.svalue
-   - r1.svalue=r2.uvalue
-   - r1.uvalue=r2.svalue
-   - r1.uvalue=r2.uvalue
+  - r1.type=number
+  - r1.svalue=[1, 2]
+  - r1.uvalue=[1, 2]
+  - r1.svalue=r1.uvalue
+  - r2.type=number
+  - r2.svalue=[1, 2]
+  - r2.uvalue=[1, 2]
+  - r2.svalue=r2.uvalue
+  - r1.svalue=r2.svalue
+  - r1.svalue=r2.uvalue
+  - r1.uvalue=r2.svalue
+  - r1.uvalue=r2.uvalue
diff --git a/test-data/packet.yaml b/test-data/packet.yaml
index 57c31c203..682665dee 100644
--- a/test-data/packet.yaml
+++ b/test-data/packet.yaml
@@ -3,56 +3,46 @@
 ---
 test-case: simple invalid write
 
-pre: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset", "packet_size=[0, 65534]"
-]
+pre: ["meta_offset=0",
+      "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+      "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset", "packet_size=[0, 65534]"]
 
 code:
   <start>: |
     r4 = 0
     *(u64 *)(r1 + 0) = r4
 
-post: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
-    "packet_size=[0, 65534]", "r4.type=number", "r4.svalue=0", "r4.uvalue=0"
-]
+post: ["meta_offset=0",
+       "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+       "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
+       "packet_size=[0, 65534]", "r4.type=number", "r4.svalue=0", "r4.uvalue=0"]
 messages:
   - "1: Upper bound must be at most packet_size (valid_access(r1.offset, width=8) for write)"
 
 ---
 test-case: simple invalid read
 
-pre: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset", "packet_size=[0, 65534]"
-]
+pre: ["meta_offset=0",
+      "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+      "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset", "packet_size=[0, 65534]"]
 
 code:
   <start>: |
     r4 = *(u64 *)(r1 + 0)
 
-post: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
-    "packet_size=[0, 65534]", "r4.type=number"
-]
+post: ["meta_offset=0",
+       "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+       "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
+       "packet_size=[0, 65534]", "r4.type=number"]
 messages:
   - "0: Upper bound must be at most packet_size (valid_access(r1.offset, width=8) for read)"
 
 ---
 test-case: writing 8 bytes when packet size is 4
 
-pre: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset"
-]
+pre: ["meta_offset=0",
+      "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+      "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset"]
 
 code:
   <start>: |
@@ -64,27 +54,23 @@ code:
   <out>: |
     r5=r5
 
-post: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
-    "r3.type=packet", "r3.packet_offset=4", "r3.svalue=[4102, 2147418116]", "r3.uvalue=[4102, 2147418116]",
-    "r3.svalue=r3.uvalue",
-    "packet_size-r3.packet_offset<=65530", "packet_size=[0, 65534]",
-    "r3.packet_offset-packet_size<=4", "r3.svalue=r1.svalue+4", "r3.uvalue=r1.svalue+4",
-    "r2.packet_offset-r3.packet_offset<=65530", "r3.packet_offset-r2.packet_offset<=4"
-]
+post: ["meta_offset=0",
+       "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+       "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
+       "r3.type=packet", "r3.packet_offset=4", "r3.svalue=[4102, 2147418116]", "r3.uvalue=[4102, 2147418116]",
+       "r3.svalue=r3.uvalue",
+       "packet_size-r3.packet_offset<=65530", "packet_size=[0, 65534]",
+       "r3.packet_offset-packet_size<=4", "r3.svalue=r1.svalue+4", "r3.uvalue=r1.svalue+4",
+       "r2.packet_offset-r3.packet_offset<=65530", "r3.packet_offset-r2.packet_offset<=4"]
 messages:
   - "4: Upper bound must be at most packet_size (valid_access(r1.offset, width=8) for write)"
 
 ---
 test-case: simple valid access
 
-pre: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
-]
+pre: ["meta_offset=0",
+      "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+      "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset"]
 
 code:
   <start>: |
@@ -96,115 +82,89 @@ code:
   <out>: |
     r5=r5
 
-post: [
-    "meta_offset=0",
-    "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
-    "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
-    "r3.type=packet", "r3.packet_offset=8", "r3.svalue=[4106, 2147418120]", "r3.uvalue=[4106, 2147418120]",
-    "packet_size-r3.packet_offset<=65526", "packet_size=[0, 65534]",
-    "r3.packet_offset-packet_size<=8", "r3.svalue=r1.svalue+8", "r3.uvalue=r1.svalue+8",
-    "r3.svalue=r3.uvalue",
-    "r2.packet_offset-r3.packet_offset<=65526", "r3.packet_offset-r2.packet_offset<=8"
-]
+post: ["meta_offset=0",
+       "r1.type=packet", "r1.packet_offset=0", "r1.svalue=[4098, 2147418112]", "r1.uvalue=[4098, 2147418112]",
+       "r2.type=packet", "r2.packet_offset=[0, 65534]", "packet_size=r2.packet_offset",
+       "r3.type=packet", "r3.packet_offset=8", "r3.svalue=[4106, 2147418120]", "r3.uvalue=[4106, 2147418120]",
+       "packet_size-r3.packet_offset<=65526", "packet_size=[0, 65534]",
+       "r3.packet_offset-packet_size<=8", "r3.svalue=r1.svalue+8", "r3.uvalue=r1.svalue+8",
+       "r3.svalue=r3.uvalue",
+       "r2.packet_offset-r3.packet_offset<=65526", "r3.packet_offset-r2.packet_offset<=8"]
 ---
 test-case: legacy 1 byte packet access imm
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0"]
 
 code:
   <start>: |
     r0 = *(u8 *)skb[23]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0"]
 ---
 test-case: legacy 2 byte packet access imm
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0"]
 
 code:
   <start>: |
     r0 = *(u16 *)skb[23]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0"]
 ---
 test-case: legacy 4 byte packet access imm
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0"]
 
 code:
   <start>: |
     r0 = *(u32 *)skb[23]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0"]
 ---
 test-case: legacy 1 byte packet access reg
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0",
+      "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
 
 code:
   <start>: |
     r0 = *(u8 *)skb[r7]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0",
+       "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
 ---
 test-case: legacy 2 byte packet access reg
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0",
+      "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
 
 code:
   <start>: |
     r0 = *(u16 *)skb[r7]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0",
+       "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
 ---
 test-case: legacy 4 byte packet access reg
 
-pre: [
-    "r1.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+pre: ["r1.type=number",
+      "r6.type=ctx", "r6.ctx_offset=0",
+      "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
 
 code:
   <start>: |
     r0 = *(u32 *)skb[r7]
 
-post: [
-    "r0.type=number",
-    "r6.type=ctx", "r6.ctx_offset=0",
-    "r7.type=number", "r7.svalue=23", "r7.uvalue=23"
-]
+post: ["r0.type=number",
+       "r6.type=ctx", "r6.ctx_offset=0",
+       "r7.type=number", "r7.svalue=23", "r7.uvalue=23"]
diff --git a/test-data/unsigned.yaml b/test-data/unsigned.yaml
index 159aa0a48..d2b9b0521 100644
--- a/test-data/unsigned.yaml
+++ b/test-data/unsigned.yaml
@@ -360,7 +360,7 @@ messages:
 test-case: "assume INT_MIN+1 < 0 implies bottom"
 pre: []
 code:
-  <start>:  |
+  <start>: |
     r1 = -9223372036854775807ll
     assume r1 < 0
 post: []
@@ -370,7 +370,7 @@ messages:
 test-case: "assume INT_MIN+1 w< 0 implies bottom"
 pre: []
 code:
-  <start>:  |
+  <start>: |
     r1 = -9223372036854775807ll
     assume w1 < 0
 post: []
@@ -380,7 +380,7 @@ messages:
 test-case: "assume INT_MIN+1 w< 2 nop"
 pre: []
 code:
-  <start>:  |
+  <start>: |
     r1 = -9223372036854775807ll
     assume w1 < 2
 post: ["r1.type=number", "r1.svalue=-9223372036854775807", "r1.uvalue=9223372036854775809"]
@@ -396,7 +396,7 @@ messages:
 test-case: "assume [INT32_MIN, -1] w< 0 implies bottom"
 pre: ["r1.type=number", "r1.svalue=[-2147483648, -1]", "r1.uvalue=[18446744071562067968, 18446744073709551615]"]
 code:
-  <start>:  |
+  <start>: |
     assume w1 < 0
 post: []
 messages:
@@ -405,7 +405,7 @@ messages:
 test-case: "assume something w< 0 implies bottom"
 pre: ["r1.type=number", "r1.svalue=-4294967298", "r1.uvalue=18446744069414584318"]
 code:
-  <start>:  |
+  <start>: |
     assume w1 < 0
 post: []
 messages:
@@ -703,11 +703,11 @@ code:
     r2 = 9223372036854775803ll
     assume r1 >= r2
 post: ["r1.type=number", "r1.svalue=9223372036854775803", "r1.uvalue=9223372036854775803", "r1.svalue=r1.uvalue",
-        "r2.type=number", "r2.svalue=9223372036854775803", "r2.uvalue=9223372036854775803",
-        "r2.uvalue-r1.svalue<=0",  # missing: r1.svalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
-        "r2.svalue-r1.svalue<=0",  # missing: r1.svalue-r2.svalue<=0; probably avoiding overflow in SplitDBM
-        "r2.svalue-r1.uvalue<=0",  # missing: r1.uvalue-r2.svalue<=0; probably avoiding overflow in SplitDBM
-        "r2.uvalue-r1.uvalue<=0"]  # missing: r1.uvalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
+       "r2.type=number", "r2.svalue=9223372036854775803", "r2.uvalue=9223372036854775803",
+       "r2.uvalue-r1.svalue<=0",  # missing: r1.svalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
+       "r2.svalue-r1.svalue<=0",  # missing: r1.svalue-r2.svalue<=0; probably avoiding overflow in SplitDBM
+       "r2.svalue-r1.uvalue<=0",  # missing: r1.uvalue-r2.svalue<=0; probably avoiding overflow in SplitDBM
+       "r2.uvalue-r1.uvalue<=0"]  # missing: r1.uvalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
 ---
 test-case: "assume [0, INT32_MAX] w>= INT32_MAX narrows to INT32_MAX"
 pre: ["r1.type=number", "r1.svalue=[0, 2147483647]", "r1.uvalue=[0, 2147483647]", "r1.svalue=r1.uvalue"]
@@ -716,9 +716,9 @@ code:
     r2 = 2147483647
     assume w1 >= r2
 post: ["r1.type=number", "r1.svalue=2147483647", "r1.uvalue=2147483647", "r1.svalue=r1.uvalue",
-        "r2.type=number", "r2.svalue=2147483647", "r2.uvalue=2147483647",
-        "r2.uvalue-r1.svalue<=0",  # missing: r1.svalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
-        "r2.uvalue-r1.uvalue<=0"]  # missing: r1.uvalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
+       "r2.type=number", "r2.svalue=2147483647", "r2.uvalue=2147483647",
+       "r2.uvalue-r1.svalue<=0",  # missing: r1.svalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
+       "r2.uvalue-r1.uvalue<=0"]  # missing: r1.uvalue-r2.uvalue<=0; probably avoiding overflow in SplitDBM
 ---
 test-case: "assume 4294967301 w>= 5 nop"
 pre: ["r1.type=number", "r1.svalue=4294967301", "r1.uvalue=4294967301"]

From ad7a861f165829f807a05db989b4582fa76158f8 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 13 May 2024 19:51:04 +0300
Subject: [PATCH 187/373] Fix YAML lint errors and warnings (#636)

* fix yaml lint errors and warnings
* quote "on"
---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 .github/dependabot.yml                | 2 +-
 .github/workflows/build.yml           | 3 ++-
 .github/workflows/codeql-analysis.yml | 3 ++-
 .github/workflows/coverage.yml        | 4 ++--
 .github/workflows/validate-yaml.yml   | 3 ++-
 .yamllint.yml                         | 2 +-
 test-data/call.yaml                   | 4 ++--
 test-data/callx.yaml                  | 4 ++--
 test-data/loop.yaml                   | 6 +++---
 test-data/parse.yaml                  | 2 +-
 test-data/unsigned.yaml               | 2 +-
 test-schema.yaml                      | 1 +
 12 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index dc618205c..f2be7f8a5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,7 +3,7 @@
 #
 # For documentation on the format of this file, see
 # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
+---
 version: 2
 updates:
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85fb55f56..e063a9ee5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,7 @@
+---
 name: CPP CI
 
-on:
+"on":
   pull_request:
     paths-ignore:
       - '**.md'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 3a8a2f613..841d3125f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -9,9 +9,10 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
+---
 name: "CodeQL"
 
-on:
+"on":
   push:
     branches: [main]
   pull_request:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 2765caabb..d9ebe3dc6 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,9 +1,9 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
-
+---
 name: CPP Code Coverage
 
-on:
+"on":
   push:
     branches: [main]
   pull_request:
diff --git a/.github/workflows/validate-yaml.yml b/.github/workflows/validate-yaml.yml
index 7f7fc048e..591f36b4a 100644
--- a/.github/workflows/validate-yaml.yml
+++ b/.github/workflows/validate-yaml.yml
@@ -6,9 +6,10 @@
 #
 # For documentation on the syntax of this file, see
 # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
+---
 name: Validate-YAML
 
-on:
+"on":
   push:
     branches: [main]
   pull_request:
diff --git a/.yamllint.yml b/.yamllint.yml
index 9b63738a3..31a22e235 100644
--- a/.yamllint.yml
+++ b/.yamllint.yml
@@ -3,7 +3,7 @@
 #
 # Configuration file for yamllint.  For documentation, see
 # https://yamllint.readthedocs.io/en/stable/configuration.html
-
+---
 extends: default
 
 rules:
diff --git a/test-data/call.yaml b/test-data/call.yaml
index e7c81c31b..235951b3e 100644
--- a/test-data/call.yaml
+++ b/test-data/call.yaml
@@ -39,7 +39,7 @@ post:
 ---
 test-case: bpf_map_lookup_elem packet key
 
-pre: [ "meta_offset=0",
+pre: ["meta_offset=0",
       "r1.type=map_fd", "r1.map_fd=1",
       "r2.type=packet", "r2.packet_offset=0", "packet_size=4"]
 
@@ -226,7 +226,7 @@ post:
   - s[496...511].type=number
 
 messages:
-  -  "0: Possible null access (within stack(r3:value_size(r1)))"
+  - "0: Possible null access (within stack(r3:value_size(r1)))"
 
 ---
 test-case: bpf_map_update_elem with packet value
diff --git a/test-data/callx.yaml b/test-data/callx.yaml
index 45da0f9a9..44096aefc 100644
--- a/test-data/callx.yaml
+++ b/test-data/callx.yaml
@@ -47,7 +47,7 @@ post:
 ---
 test-case: callx bpf_map_lookup_elem packet key
 
-pre: [ "meta_offset=0",
+pre: ["meta_offset=0",
       "r1.type=map_fd", "r1.map_fd=1",
       "r2.type=packet", "r2.packet_offset=0", "packet_size=4",
       "r8.type=number", "r8.svalue=1", "r8.uvalue=1"]
@@ -321,7 +321,7 @@ post:
   - r8.uvalue=2
 
 messages:
-  -  "0: Possible null access (within stack(r3:value_size(r1)))"
+  - "0: Possible null access (within stack(r3:value_size(r1)))"
 
 ---
 test-case: callx bpf_map_update_elem with packet value
diff --git a/test-data/loop.yaml b/test-data/loop.yaml
index 643cb4b16..10e5fd116 100644
--- a/test-data/loop.yaml
+++ b/test-data/loop.yaml
@@ -121,7 +121,7 @@ post:
   - "pc[1]=r0.uvalue"
 ---
 test-case: while loop, eq
-#options: ["termination"]
+# options: ["termination"]
 pre: []
 
 code:
@@ -143,7 +143,7 @@ post:
 #  - "pc[1]=r0.value"
 ---
 test-case: until loop, neq
-#options: ["termination"]
+# options: ["termination"]
 
 pre: []
 
@@ -182,7 +182,7 @@ post:
   - "r0.type=number"
   - "r0.svalue=9"
   - "r0.uvalue=9"
-#  - "r0.svalue=r0.uvalue"
+  # - "r0.svalue=r0.uvalue"
   - "pc[1]=[1, +oo]"
 
 messages:
diff --git a/test-data/parse.yaml b/test-data/parse.yaml
index 359370453..49278e01b 100644
--- a/test-data/parse.yaml
+++ b/test-data/parse.yaml
@@ -55,7 +55,7 @@ code:
   <start>: r1 = 9223372036854775801ll
 post: ["r1.type=number", "r1.svalue=9223372036854775801", "r1.uvalue=9223372036854775801"]
 ---
-test-case: "parse INT_MAX code" # largest number that does not overflow
+test-case: "parse INT_MAX code"  # largest number that does not overflow
 pre: []
 code:
   <start>: r1 = 9223372036854775807ll
diff --git a/test-data/unsigned.yaml b/test-data/unsigned.yaml
index d2b9b0521..d05033357 100644
--- a/test-data/unsigned.yaml
+++ b/test-data/unsigned.yaml
@@ -1125,7 +1125,7 @@ test-case: "assume [UINT32_MAX+1, UINT32_MAX+5] w< 2"
 pre: ["r1.type=number", "r1.uvalue=[4294967296, 4294967300]"]
 code:
   <start>: assume w1 < 2
-post: ["r1.type=number", "r1.uvalue=[4294967296, 4294967300]"] # could be narrowed in future
+post: ["r1.type=number", "r1.uvalue=[4294967296, 4294967300]"]  # could be narrowed in future
 ---
 test-case: "assume [1, 4] w< INT32_MAX+5"
 pre: ["r1.type=number", "r1.uvalue=[1, 4]",
diff --git a/test-schema.yaml b/test-schema.yaml
index f38eed1ea..39ccd0449 100644
--- a/test-schema.yaml
+++ b/test-schema.yaml
@@ -1,5 +1,6 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
+---
 id: https://spec.openapis.org/oas/4.0/schema/2021-08-12
 $schema: http://json-schema.org/draft-04/schema#
 description: Validation schema for ebpf-verifier tests

From f7f871da5197b337bb04f4acdb1a166e8e5ce0c8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 May 2024 16:51:32 +0000
Subject: [PATCH 188/373] Bump external/bpf_conformance from `7c2ef8b` to
 `ce95710`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `7c2ef8b` to `ce95710`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/7c2ef8b77679089f3949cf48137ec2246358fb3f...ce9571054cb6e60ed88bddcfc8cbff19dc31dab6)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 7c2ef8b77..ce9571054 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 7c2ef8b77679089f3949cf48137ec2246358fb3f
+Subproject commit ce9571054cb6e60ed88bddcfc8cbff19dc31dab6

From e3e1efa3433d47afc08c27efdf2cc5fd71a54f8b Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Wed, 15 May 2024 00:50:08 -0600
Subject: [PATCH 189/373] Support multiple programs per section (#638)

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_files.cpp             | 179 +++++++++++++++++++++-------------
 src/main/check.cpp            |  36 +++++--
 src/spec_type_descriptors.hpp |   3 +-
 src/test/test_marshal.cpp     |  20 ++--
 src/test/test_verify.cpp      |  30 +++++-
 5 files changed, 176 insertions(+), 92 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index b05928991..274a71c16 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -21,15 +21,20 @@ using std::string;
 using std::vector;
 
 template <typename T>
-static vector<T> vector_of(const ELFIO::section& sec) {
-    auto data = sec.get_data();
-    auto size = sec.get_size();
+static vector<T> vector_of(const char* data, ELFIO::Elf_Xword size) {
     if ((size % sizeof(T) != 0) || size > UINT32_MAX || !data) {
         throw std::runtime_error("Invalid argument to vector_of");
     }
     return {(T*)data, (T*)(data + size)};
 }
 
+template <typename T>
+static vector<T> vector_of(const ELFIO::section& sec) {
+    auto data = sec.get_data();
+    auto size = sec.get_size();
+    return vector_of<T>(data, size);
+}
+
 int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries, ebpf_verifier_options_t options) {
     EquivalenceKey equiv{map_type.value_type, key_size, value_size, map_type.is_array ? max_entries : 0};
     if (!global_program_info->cache.count(equiv)) {
@@ -66,7 +71,7 @@ std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::con
     return {symbol_name, section_index};
 }
 
-ELFIO::Elf64_Addr get_value(ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Word index) {
+std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Word index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -75,7 +80,7 @@ ELFIO::Elf64_Addr get_value(ELFIO::const_symbol_section_accessor& symbols, ELFIO
     ELFIO::Elf_Half section_index{};
     unsigned char other{};
     symbols.get_symbol(index, symbol_name, value, size, bind, type, section_index, other);
-    return value;
+    return {value, type};
 }
 
 // parse_maps_sections processes all maps sections in the provided ELF file by calling the platform-specific maps
@@ -123,6 +128,30 @@ vector<raw_program> read_elf(const std::string& path, const std::string& desired
     throw std::runtime_error(string("Can't process ELF file ") + path);
 }
 
+std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& sec, ELFIO::Elf_Xword start, ELFIO::const_symbol_section_accessor& symbols) {
+    ELFIO::Elf_Xword symbol_count = symbols.get_symbols_num();
+    ELFIO::Elf_Half section_index = sec.get_index();
+    string program_name = sec.get_name();
+    ELFIO::Elf_Xword size = sec.get_size() - start;
+    for (ELFIO::Elf_Xword index = 0; index < symbol_count; index++) {
+        auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
+        if (symbol_section_index == section_index && !symbol_name.empty()) {
+            auto [relocation_offset, relocation_type] = get_value(symbols, index);
+            if (relocation_type != ELFIO::STT_FUNC) {
+                continue;
+            }
+            if (relocation_offset == start) {
+                // We found the program name for this program.
+                program_name = symbol_name;
+            } else if (relocation_offset > start && relocation_offset < start + size) {
+                // We found another program that follows, so truncate the size of this program.
+                size = relocation_offset - start;
+            }
+        }
+    }
+    return {program_name, size};
+}
+
 vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
     if (options == nullptr)
         options = &ebpf_verifier_default_options;
@@ -225,80 +254,90 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         if ((section->get_size() == 0) || (section->get_data() == nullptr))
             continue;
         info.type = platform->get_program_type(name, path);
-        raw_program prog{path, name, vector_of<ebpf_inst>(*section), info};
-        auto prelocs = reader.sections[string(".rel") + name];
-        if (!prelocs)
-            prelocs = reader.sections[string(".rela") + name];
-
-        if (prelocs) {
-            if (!prelocs->get_data()) {
-                throw std::runtime_error("Malformed relocation data");
-            }
-            ELFIO::const_relocation_section_accessor reloc{reader, prelocs};
-
-            // Fetch and store relocation count locally to permit static
-            // analysis tools to correctly reason about the code below.
-            ELFIO::Elf_Xword relocation_count = reloc.get_entries_num();
-
-            for (ELFIO::Elf_Xword i = 0; i < relocation_count; i++) {
-                ELFIO::Elf64_Addr offset{};
-                ELFIO::Elf_Word index{};
-                unsigned type{};
-                ELFIO::Elf_Sxword addend{};
-                if (!reloc.get_entry(i, offset, index, type, addend)) {
-                    continue;
-                }
-                if ((offset / sizeof(ebpf_inst)) >= prog.prog.size()) {
-                    throw std::runtime_error("Invalid relocation data");
-                }
-                ebpf_inst& inst = prog.prog[offset / sizeof(ebpf_inst)];
 
-                auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
+        for (ELFIO::Elf_Xword program_offset = 0; program_offset < section->get_size();) {
+            auto [program_name, program_size] = get_program_name_and_size(*section, program_offset, symbols);
+            raw_program prog{path, name, program_name, vector_of<ebpf_inst>(section->get_data() + program_offset, program_size), info};
+            auto prelocs = reader.sections[string(".rel") + name];
+            if (!prelocs)
+                prelocs = reader.sections[string(".rela") + name];
 
-                // Only perform relocation for symbols located in the maps section.
-                if (!map_section_indices.contains(symbol_section_index)) {
-                    std::string unresolved_symbol = "Unresolved external symbol " + symbol_name +
-                                                    " in section " + name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
-                    unresolved_symbols.push_back(unresolved_symbol);
-                    continue;
+            if (prelocs) {
+                if (!prelocs->get_data()) {
+                    throw std::runtime_error("Malformed relocation data");
                 }
+                ELFIO::const_relocation_section_accessor reloc{reader, prelocs};
+
+                // Fetch and store relocation count locally to permit static
+                // analysis tools to correctly reason about the code below.
+                ELFIO::Elf_Xword relocation_count = reloc.get_entries_num();
+
+                for (ELFIO::Elf_Xword i = 0; i < relocation_count; i++) {
+                    ELFIO::Elf64_Addr offset{};
+                    ELFIO::Elf_Word index{};
+                    unsigned type{};
+                    ELFIO::Elf_Sxword addend{};
+                    if (!reloc.get_entry(i, offset, index, type, addend)) {
+                        continue;
+                    }
+                    if (offset < program_offset || offset >= program_offset + program_size) {
+                        // Relocation is not for this program.
+                        continue;
+                    }
+                    offset -= program_offset;
+                    if ((offset / sizeof(ebpf_inst)) >= prog.prog.size()) {
+                        throw std::runtime_error("Invalid relocation data");
+                    }
+                    ebpf_inst& inst = prog.prog[offset / sizeof(ebpf_inst)];
 
-                // Only permit loading the address of the map.
-                if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
-                    throw std::runtime_error("Illegal operation on symbol " + symbol_name +
-                                             " at location " + std::to_string(offset / sizeof(ebpf_inst)));
-                }
-                inst.src = 1; // magic number for LoadFd
-
-                // Relocation value is an offset into the "maps" or ".maps" section.
-                size_t relocation_offset = get_value(symbols, index);
-                if (map_record_size_or_map_offsets.index() == 0) {
-                    // The older maps section format uses a single map_record_size value, so we can
-                    // calculate the map descriptor index directly.
-                    size_t reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
-                    if (reloc_value >= info.map_descriptors.size()) {
-                        throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). "
-                                                + "Make sure to compile with -O2.");
+                    auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
+
+                    // Only perform relocation for symbols located in the maps section.
+                    if (!map_section_indices.contains(symbol_section_index)) {
+                        std::string unresolved_symbol = "Unresolved external symbol " + symbol_name +
+                                                        " in section " + name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
+                        unresolved_symbols.push_back(unresolved_symbol);
+                        continue;
                     }
 
-                    inst.imm = info.map_descriptors.at(reloc_value).original_fd;
-                }
-                else {
-                    // The newer .maps section format uses a variable-length map descriptor array,
-                    // so we need to look up the map descriptor index in a map.
-                    auto& map_descriptors_offsets = std::get<1>(map_record_size_or_map_offsets);
-                    auto it = map_descriptors_offsets.find(symbol_name);
-
-                    if (it == map_descriptors_offsets.end()) {
-                        throw std::runtime_error("Bad reloc value (" + std::to_string(index) + "). "
-                                                + "Make sure to compile with -O2.");
+                    // Only permit loading the address of the map.
+                    if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
+                        throw std::runtime_error("Illegal operation on symbol " + symbol_name +
+                                                 " at location " + std::to_string(offset / sizeof(ebpf_inst)));
+                    }
+                    inst.src = 1; // magic number for LoadFd
+
+                    // Relocation value is an offset into the "maps" or ".maps" section.
+                    auto [relocation_offset, relocation_type] = get_value(symbols, index);
+                    if (map_record_size_or_map_offsets.index() == 0) {
+                        // The older maps section format uses a single map_record_size value, so we can
+                        // calculate the map descriptor index directly.
+                        size_t reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
+                        if (reloc_value >= info.map_descriptors.size()) {
+                            throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). "
+                                                    + "Make sure to compile with -O2.");
+                        }
+
+                        inst.imm = info.map_descriptors.at(reloc_value).original_fd;
+                    }
+                    else {
+                        // The newer .maps section format uses a variable-length map descriptor array,
+                        // so we need to look up the map descriptor index in a map.
+                        auto& map_descriptors_offsets = std::get<1>(map_record_size_or_map_offsets);
+                        auto it = map_descriptors_offsets.find(symbol_name);
+
+                        if (it == map_descriptors_offsets.end()) {
+                            throw std::runtime_error("Bad reloc value (" + std::to_string(index) + "). "
+                                                    + "Make sure to compile with -O2.");
+                        }
+                        inst.imm = info.map_descriptors.at(it->second).original_fd;
                     }
-                    inst.imm = info.map_descriptors.at(it->second).original_fd;
                 }
             }
+            prog.line_info.resize(prog.prog.size());
+            res.push_back(prog);
+            program_offset += program_size;
         }
-        prog.line_info.resize(prog.prog.size());
-        res.push_back(prog);
     }
 
     // Below, only relocations of symbols located in the map sections are allowed,
@@ -314,7 +353,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
     if (btf != nullptr && btf_ext != nullptr) {
         std::map<std::string, raw_program&> segment_to_program;
         for (auto& program : res) {
-            segment_to_program.insert({program.section, program});
+            segment_to_program.insert({program.function_name, program});
         }
 
         auto visitor = [&](const std::string& section, uint32_t instruction_offset, const std::string& file_name,
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 902eb3b96..25e571293 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -69,6 +69,19 @@ static std::vector<std::string> get_string_vector(std::string list) {
     return string_vector;
 }
 
+static std::optional<raw_program> find_program(vector<raw_program>& raw_progs, std::string desired_program) {
+    if (desired_program.empty() && raw_progs.size() == 1) {
+        // Select the last program section.
+        return raw_progs.back();
+    }
+    for (raw_program current_program : raw_progs) {
+        if (current_program.function_name == desired_program) {
+            return current_program;
+        }
+    }
+    return {};
+}
+
 int main(int argc, char** argv) {
     // Always call ebpf_verifier_clear_thread_local_state on scope exit.
     at_scope_exit<ebpf_verifier_clear_thread_local_state> clear_thread_local_state;
@@ -86,9 +99,13 @@ int main(int argc, char** argv) {
 
     std::string desired_section;
 
-    app.add_option("section", desired_section, "Section to analyze")->type_name("SECTION");
+    app.add_option("--section,section", desired_section, "Section to analyze")->type_name("SECTION");
+
+    std::string desired_program;
+
+    app.add_option("--function,function", desired_program, "Function to analyze")->type_name("FUNCTION");
     bool list = false;
-    app.add_flag("-l", list, "List sections");
+    app.add_flag("-l", list, "List programs");
 
     std::string domain = "zoneCrab";
     std::set<string> doms{"stats", "linux", "zoneCrab", "cfg"};
@@ -184,25 +201,24 @@ int main(int argc, char** argv) {
         return 1;
     }
 
-    if (list || raw_progs.size() != 1) {
+    std::optional<raw_program> found_prog = find_program(raw_progs, desired_program);
+    if (list || !found_prog) {
         if (!list) {
-            std::cout << "please specify a section\n";
-            std::cout << "available sections:\n";
+            std::cout << "please specify a program\n";
+            std::cout << "available programs:\n";
         }
         if (!desired_section.empty() && raw_progs.empty()) {
-            // We could not find the desired section, so get the full list
+            // We could not find the desired program, so get the full list
             // of possibilities.
             raw_progs = read_elf(filename, string(), &ebpf_verifier_options, &platform);
         }
         for (const raw_program& raw_prog : raw_progs) {
-            std::cout << raw_prog.section << " ";
+            std::cout << "section=" << raw_prog.section_name << " function=" << raw_prog.function_name << std::endl;
         }
         std::cout << "\n";
         return list ? 0 : 64;
     }
-
-    // Select the last program section.
-    raw_program raw_prog = raw_progs.back();
+    raw_program raw_prog = *found_prog;
 
     // Convert the raw program section to a set of instructions.
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
diff --git a/src/spec_type_descriptors.hpp b/src/spec_type_descriptors.hpp
index cad589fa7..50576ac92 100644
--- a/src/spec_type_descriptors.hpp
+++ b/src/spec_type_descriptors.hpp
@@ -66,7 +66,8 @@ struct btf_line_info_t {
 
 struct raw_program {
     std::string filename{};
-    std::string section{};
+    std::string section_name{};
+    std::string function_name{};
     std::vector<ebpf_inst> prog{};
     program_info info{};
     std::vector<btf_line_info_t> line_info{};
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 06508d25a..cf7c84f6f 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -207,7 +207,7 @@ static const ebpf_instruction_template_t instruction_template[] = {
 static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
@@ -215,7 +215,7 @@ static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t&
 static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {inst1, inst2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {inst1, inst2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
@@ -225,7 +225,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& exp
     program_info info{.platform = &platform,
                       .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -242,7 +242,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -260,7 +260,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -277,7 +277,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 // we get the original.
 static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
     auto [_, single, _2] = parsed.back();
     (void)_;  // unused
@@ -287,14 +287,14 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
 
 static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", marshal(ins, 0), info}));
+    std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
 static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
-    auto result = unmarshal(raw_program{"", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
@@ -304,7 +304,7 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     std::vector<ebpf_inst> insns{inst, exit, exit};
-    auto result = unmarshal(raw_program{"", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
@@ -314,7 +314,7 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
 static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst1, inst2};
-    auto result = unmarshal(raw_program{"", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 817744710..e5303871e 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -32,6 +32,7 @@ FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
 FAIL_UNMARSHAL("build", "wronghelper.o", "xdp")
 FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
 
+// Verify a section with only one program in it.
 #define VERIFY_SECTION(dirname, filename, sectionname, options, platform, pass) \
     do { \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, platform); \
@@ -47,11 +48,34 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
             REQUIRE(!res);                                   \
     } while (0)
 
+// Verify a program in a section that may have multiple programs in it.
+#define VERIFY_PROGRAM(dirname, filename, section_name, program_name, options, platform, pass) \
+    do { \
+        auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, section_name, nullptr, platform); \
+        for (auto& raw_prog : raw_progs) { \
+            if (raw_prog.function_name == program_name) { \
+                std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
+                REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
+                auto& prog = std::get<InstructionSeq>(prog_or_error); \
+                bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
+                if (pass) \
+                    REQUIRE(res); \
+                else \
+                    REQUIRE(!res); \
+            } \
+        } \
+    } while (0)
+
 #define TEST_SECTION(project, filename, section) \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
     }
 
+#define TEST_PROGRAM(project, filename, section_name, program_name) \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true); \
+    }
+
 #define TEST_SECTION_REJECT(project, filename, section) \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
@@ -482,7 +506,11 @@ TEST_SECTION("build", "map_in_map_legacy.o", ".text")
 TEST_SECTION("build", "twomaps.o", ".text");
 TEST_SECTION("build", "twostackvars.o", ".text");
 TEST_SECTION("build", "twotypes.o", ".text");
-TEST_SECTION("build", "prog_array.o", ".text");
+TEST_PROGRAM("build", "prog_array.o", ".text", "func");
+TEST_PROGRAM("build", "prog_array.o", ".text", "func0");
+TEST_PROGRAM("build", "prog_array.o", ".text", "func1");
+TEST_PROGRAM("build", "prog_array.o", ".text", "func2");
+TEST_PROGRAM("build", "prog_array.o", ".text", "func3");
 
 // Test some programs that ought to fail verification.
 TEST_SECTION_REJECT("build", "badhelpercall.o", ".text")

From 97a55ddba6079431455d500d4df469b044373e99 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 18 May 2024 16:47:00 +0000
Subject: [PATCH 190/373] Bump ebpf-samples from `5d65552` to `b6e7d26`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `5d65552` to `b6e7d26`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/5d6555274119147c6ea69866712db3e4fa964423...b6e7d2618359f605cdde7771b713d2cd74988c0d)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 5d6555274..b6e7d2618 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 5d6555274119147c6ea69866712db3e4fa964423
+Subproject commit b6e7d2618359f605cdde7771b713d2cd74988c0d

From 01d26e5c359e380fe7f3f0561ac9e877bc1f9ba3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 18 May 2024 16:46:58 +0000
Subject: [PATCH 191/373] Bump external/libbtf from `5ae35c7` to `ab8d59b`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `5ae35c7` to `ab8d59b`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/5ae35c7f3495d2aea9f3dad911acc2505acc2747...ab8d59bf9e2ca1ec3b9ab0f29996ae24cfd4c79a)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 5ae35c7f3..ab8d59bf9 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 5ae35c7f3495d2aea9f3dad911acc2505acc2747
+Subproject commit ab8d59bf9e2ca1ec3b9ab0f29996ae24cfd4c79a

From df3418141c99bf1fe48a3b038cf0870734c5250b Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Thu, 23 May 2024 11:07:35 -0700
Subject: [PATCH 192/373] Fix BTF line info for sections with multiple programs
 (#642)

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_files.cpp             | 27 ++++++++++++---------------
 src/spec_type_descriptors.hpp |  1 +
 src/test/test_marshal.cpp     | 20 ++++++++++----------
 3 files changed, 23 insertions(+), 25 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 274a71c16..bf6cd4b00 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -257,7 +257,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
         for (ELFIO::Elf_Xword program_offset = 0; program_offset < section->get_size();) {
             auto [program_name, program_size] = get_program_name_and_size(*section, program_offset, symbols);
-            raw_program prog{path, name, program_name, vector_of<ebpf_inst>(section->get_data() + program_offset, program_size), info};
+            raw_program prog{path, name, program_offset, program_name, vector_of<ebpf_inst>(section->get_data() + program_offset, program_size), info};
             auto prelocs = reader.sections[string(".rel") + name];
             if (!prelocs)
                 prelocs = reader.sections[string(".rela") + name];
@@ -351,28 +351,25 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
     }
 
     if (btf != nullptr && btf_ext != nullptr) {
-        std::map<std::string, raw_program&> segment_to_program;
-        for (auto& program : res) {
-            segment_to_program.insert({program.function_name, program});
-        }
-
         auto visitor = [&](const std::string& section, uint32_t instruction_offset, const std::string& file_name,
                         const std::string& source, uint32_t line_number, uint32_t column_number) {
-            auto program_iter = segment_to_program.find(section);
-            if (program_iter == segment_to_program.end()) {
-                return;
-            }
-            auto& program = program_iter->second;
-            if ((instruction_offset / sizeof(ebpf_inst)) >= program.line_info.size()) {
-                throw std::runtime_error("Invalid BTF data");
+            for (auto& program : res) {
+                if ((program.section_name == section) && (instruction_offset >= program.insn_off) &&
+                    (instruction_offset < program.insn_off + program.prog.size() * sizeof(ebpf_inst))) {
+                    size_t inst_index = (instruction_offset - program.insn_off) / sizeof(ebpf_inst);
+                    if (inst_index >= program.line_info.size()) {
+                        throw std::runtime_error("Invalid BTF data");
+                    }
+                    program.line_info[inst_index] = {file_name, source, line_number, column_number};
+                    return;
+                }
             }
-            program.line_info[instruction_offset / sizeof(ebpf_inst)] = {file_name, source, line_number, column_number};
         };
 
         libbtf::btf_parse_line_information(vector_of<std::byte>(*btf), vector_of<std::byte>(*btf_ext), visitor);
 
         // BTF doesn't include line info for every instruction, only on the first instruction per source line.
-        for (auto& [name, program] : segment_to_program) {
+        for (auto& program : res) {
             for (size_t i = 1; i < program.line_info.size(); i++) {
                 // If the previous PC has line info, copy it.
                 if ((program.line_info[i].line_number == 0) && (program.line_info[i - 1].line_number != 0)) {
diff --git a/src/spec_type_descriptors.hpp b/src/spec_type_descriptors.hpp
index 50576ac92..b827f17db 100644
--- a/src/spec_type_descriptors.hpp
+++ b/src/spec_type_descriptors.hpp
@@ -67,6 +67,7 @@ struct btf_line_info_t {
 struct raw_program {
     std::string filename{};
     std::string section_name{};
+    uint32_t insn_off{}; // Byte offset in section of first instruction in this program.
     std::string function_name{};
     std::vector<ebpf_inst> prog{};
     program_info info{};
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index cf7c84f6f..d1babcaf3 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -207,7 +207,7 @@ static const ebpf_instruction_template_t instruction_template[] = {
 static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
@@ -215,7 +215,7 @@ static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t&
 static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {inst1, inst2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {inst1, inst2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
@@ -225,7 +225,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& exp
     program_info info{.platform = &platform,
                       .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -242,7 +242,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -260,7 +260,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -277,7 +277,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 // we get the original.
 static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", "", marshal(ins, 0), info}));
+    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
     auto [_, single, _2] = parsed.back();
     (void)_;  // unused
@@ -287,14 +287,14 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
 
 static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", "", marshal(ins, 0), info}));
+    std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", 0, "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
 static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
-    auto result = unmarshal(raw_program{"", "", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
@@ -304,7 +304,7 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     std::vector<ebpf_inst> insns{inst, exit, exit};
-    auto result = unmarshal(raw_program{"", "", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);
@@ -314,7 +314,7 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
 static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst1, inst2};
-    auto result = unmarshal(raw_program{"", "", "", insns, info});
+    auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
     REQUIRE(std::holds_alternative<std::string>(result));
     std::string error_message = std::get<std::string>(result);
     REQUIRE(error_message == expected_error_message);

From 2018df951bae707437441ccdad21961857274675 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 28 May 2024 23:31:48 +0300
Subject: [PATCH 193/373] bump CLI11 to v2.4.2 and organize usage (#644)

* Update CLI11 to v2.4.2 (from v1.9.1).
* Use its built-in validator
* Reorganize options into categories
* Add invertible flags
* --include_groups and --exclude_groups can now use space separator
* Update README.md
---------

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 README.md                      |    45 +-
 external/CLI11.hpp             | 11543 +++++++++++++++++++------------
 src/config.cpp                 |     2 +-
 src/config.hpp                 |     2 +-
 src/crab_verifier.cpp          |     4 +-
 src/ebpf_yaml.cpp              |     8 +-
 src/main/check.cpp             |   152 +-
 src/main/run_yaml.cpp          |     5 +-
 src/test/conformance_check.cpp |     4 +-
 9 files changed, 7259 insertions(+), 4506 deletions(-)

diff --git a/README.md b/README.md
index 89d5d6561..fd832a9da 100644
--- a/README.md
+++ b/README.md
@@ -75,31 +75,50 @@ The output is three comma-separated values:
 
 ## Usage:
 ```
-A new eBPF verifier
-Usage: ./check [OPTIONS] path [section]
+PREVAIL is a new eBPF verifier based on abstract interpretation.
+Usage: ./check [OPTIONS] path [section] [function]
 
 Positionals:
-  path FILE REQUIRED          Elf file to analyze
+  path TEXT:FILE REQUIRED     Elf file to analyze
   section SECTION             Section to analyze
+  function FUNCTION           Function to analyze
 
 Options:
   -h,--help                   Print this help message and exit
-  -l                          List sections
-  -d,--dom,--domain DOMAIN:{cfg,linux,stats,zoneCrab}
+  --section SECTION           Section to analyze
+  --function FUNCTION         Function to analyze
+  -l                          List programs
+  --domain DOMAIN:{stats,linux,zoneCrab,cfg} [zoneCrab]
                               Abstract domain
-  --termination               Verify termination
-  --assume-assert             Assume assertions
+
+
+Features:
+  --termination,--no-verify-termination{false}
+                              Verify termination. Default: ignore
+  --allow-division-by-zero,--no-division-by-zero{false}
+                              Handling potential division by zero. Default: allow
+  -s,--strict                 Apply additional checks that would cause runtime failures
+  --include_groups GROUPS:{atomic32,atomic64,base32,base64,callx,divmul32,divmul64,packet}
+                              Include conformance groups
+  --exclude_groups GROUPS:{atomic32,atomic64,base32,base64,callx,divmul32,divmul64,packet}
+                              Exclude conformance groups
+
+
+Verbosity:
+  --simplify,--no-simplify{false}
+                              Simplify the CFG before analysis by merging chains of instructions into a single basic block. Default: enabled
+  --line-info                 Print line information
+  --print-btf-types           Print BTF types
+  --assume-assert,--no-assume-assert{false}
+                              Assume assertions (useful for debugging verification failures). Default: disabled
   -i                          Print invariants
   -f                          Print verifier's failure logs
-  -s                          Apply additional checks that would cause runtime failures
   -v                          Print both invariants and failures
-  --no-division-by-zero       Do not allow division by zero
-  --no-simplify               Do not simplify
-  --line-info                 Print line information
+
+
+CFG output:
   --asm FILE                  Print disassembly to FILE
   --dot FILE                  Export control-flow graph to dot FILE
-
-You can use @headers as the path to instead just show the output field headers.
 ```
 
 A standard alternative to the --asm flag is `llvm-objdump -S FILE`.
diff --git a/external/CLI11.hpp b/external/CLI11.hpp
index f6edf92e4..8a5b4c544 100644
--- a/external/CLI11.hpp
+++ b/external/CLI11.hpp
@@ -1,16 +1,11 @@
-// SPDX-License-Identifier: BSD-3-Clause
-#pragma once
-
-// CLI11: Version 1.9.1
+// CLI11: Version 2.4.2
 // Originally designed by Henry Schreiner
 // https://github.com/CLIUtils/CLI11
 //
 // This is a standalone header file generated by MakeSingleHeader.py in CLI11/scripts
-// from: v1.9.1
+// from: v2.4.2
 //
-// From LICENSE:
-//
-// CLI11 1.8 Copyright (c) 2017-2019 University of Cincinnati, developed by Henry
+// CLI11 2.4.2 Copyright (c) 2017-2024 University of Cincinnati, developed by Henry
 // Schreiner under NSF AWARD 1414736. All rights reserved.
 //
 // Redistribution and use in source and binary forms of CLI11, with or without
@@ -36,12 +31,18 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+#pragma once
 
 // Standard combined includes:
-
 #include <algorithm>
+#include <array>
+#include <cctype>
+#include <clocale>
 #include <cmath>
 #include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <cwchar>
 #include <exception>
 #include <fstream>
 #include <functional>
@@ -63,21 +64,15 @@
 #include <vector>
 
 
-// Verbatim copy from Version.hpp:
-
-
-#define CLI11_VERSION_MAJOR 1
-#define CLI11_VERSION_MINOR 9
-#define CLI11_VERSION_PATCH 1
-#define CLI11_VERSION "1.9.1"
-
+#define CLI11_VERSION_MAJOR 2
+#define CLI11_VERSION_MINOR 4
+#define CLI11_VERSION_PATCH 2
+#define CLI11_VERSION "2.4.2"
 
 
 
-// Verbatim copy from Macros.hpp:
 
-
-// The following version macro is very similar to the one in PyBind11
+// The following version macro is very similar to the one in pybind11
 #if !(defined(_MSC_VER) && __cplusplus == 199711L) && !defined(__INTEL_COMPILER)
 #if __cplusplus >= 201402L
 #define CLI11_CPP14
@@ -95,7 +90,7 @@
 #define CLI11_CPP14
 #if _MSVC_LANG > 201402L && _MSC_VER >= 1910
 #define CLI11_CPP17
-#if __MSVC_LANG > 201703L && _MSC_VER >= 1910
+#if _MSVC_LANG > 201703L && _MSC_VER >= 1910
 #define CLI11_CPP20
 #endif
 #endif
@@ -110,19 +105,40 @@
 #define CLI11_DEPRECATED(reason) __attribute__((deprecated(reason)))
 #endif
 
+// GCC < 10 doesn't ignore this in unevaluated contexts
+#if !defined(CLI11_CPP17) ||                                                                                           \
+    (defined(__GNUC__) && !defined(__llvm__) && !defined(__INTEL_COMPILER) && __GNUC__ < 10 && __GNUC__ > 4)
+#define CLI11_NODISCARD
+#else
+#define CLI11_NODISCARD [[nodiscard]]
+#endif
 
+/** detection of rtti */
+#ifndef CLI11_USE_STATIC_RTTI
+#if(defined(_HAS_STATIC_RTTI) && _HAS_STATIC_RTTI)
+#define CLI11_USE_STATIC_RTTI 1
+#elif defined(__cpp_rtti)
+#if(defined(_CPPRTTI) && _CPPRTTI == 0)
+#define CLI11_USE_STATIC_RTTI 1
+#else
+#define CLI11_USE_STATIC_RTTI 0
+#endif
+#elif(defined(__GCC_RTTI) && __GXX_RTTI)
+#define CLI11_USE_STATIC_RTTI 0
+#else
+#define CLI11_USE_STATIC_RTTI 1
+#endif
+#endif
 
-
-// Verbatim copy from Validators.hpp:
-
-
-// C standard library
-// Only needed for existence checking
+/** <filesystem> availability */
 #if defined CLI11_CPP17 && defined __has_include && !defined CLI11_HAS_FILESYSTEM
 #if __has_include(<filesystem>)
 // Filesystem cannot be used if targeting macOS < 10.15
 #if defined __MAC_OS_X_VERSION_MIN_REQUIRED && __MAC_OS_X_VERSION_MIN_REQUIRED < 101500
 #define CLI11_HAS_FILESYSTEM 0
+#elif defined(__wasi__)
+// As of wasi-sdk-14, filesystem is not implemented
+#define CLI11_HAS_FILESYSTEM 0
 #else
 #include <filesystem>
 #if defined __cpp_lib_filesystem && __cpp_lib_filesystem >= 201703
@@ -141,6 +157,44 @@
 #endif
 #endif
 
+/** <codecvt> availability */
+#if defined(__GNUC__) && !defined(__llvm__) && !defined(__INTEL_COMPILER) && __GNUC__ < 5
+#define CLI11_HAS_CODECVT 0
+#else
+#define CLI11_HAS_CODECVT 1
+#include <codecvt>
+#endif
+
+/** disable deprecations */
+#if defined(__GNUC__)  // GCC or clang
+#define CLI11_DIAGNOSTIC_PUSH _Pragma("GCC diagnostic push")
+#define CLI11_DIAGNOSTIC_POP _Pragma("GCC diagnostic pop")
+
+#define CLI11_DIAGNOSTIC_IGNORE_DEPRECATED _Pragma("GCC diagnostic ignored \"-Wdeprecated-declarations\"")
+
+#elif defined(_MSC_VER)
+#define CLI11_DIAGNOSTIC_PUSH __pragma(warning(push))
+#define CLI11_DIAGNOSTIC_POP __pragma(warning(pop))
+
+#define CLI11_DIAGNOSTIC_IGNORE_DEPRECATED __pragma(warning(disable : 4996))
+
+#else
+#define CLI11_DIAGNOSTIC_PUSH
+#define CLI11_DIAGNOSTIC_POP
+
+#define CLI11_DIAGNOSTIC_IGNORE_DEPRECATED
+
+#endif
+
+/** Inline macro **/
+#ifdef CLI11_COMPILE
+#define CLI11_INLINE
+#else
+#define CLI11_INLINE inline
+#endif
+
+
+
 #if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
 #include <filesystem>  // NOLINT(build/include)
 #else
@@ -150,18 +204,244 @@
 
 
 
-// From Version.hpp:
 
+#ifdef CLI11_CPP17
+#include <string_view>
+#endif  // CLI11_CPP17
 
+#if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
+#include <filesystem>
+#include <string_view>  // NOLINT(build/include)
+#endif                  // CLI11_HAS_FILESYSTEM
+
+
+
+#if defined(_WIN32)
+#if !(defined(_AMD64_) || defined(_X86_) || defined(_ARM_))
+#if defined(__amd64__) || defined(__amd64) || defined(__x86_64__) || defined(__x86_64) || defined(_M_X64) ||           \
+    defined(_M_AMD64)
+#define _AMD64_
+#elif defined(i386) || defined(__i386) || defined(__i386__) || defined(__i386__) || defined(_M_IX86)
+#define _X86_
+#elif defined(__arm__) || defined(_M_ARM) || defined(_M_ARMT)
+#define _ARM_
+#elif defined(__aarch64__) || defined(_M_ARM64)
+#define _ARM64_
+#elif defined(_M_ARM64EC)
+#define _ARM64EC_
+#endif
+#endif
 
-// From Macros.hpp:
-
+// first
+#ifndef NOMINMAX
+// if NOMINMAX is already defined we don't want to mess with that either way
+#define NOMINMAX
+#include <windef.h>
+#undef NOMINMAX
+#else
+#include <windef.h>
+#endif
 
+// second
+#include <winbase.h>
+// third
+#include <processthreadsapi.h>
+#include <shellapi.h>
+#endif
 
-// From StringTools.hpp:
 
 namespace CLI {
 
+
+/// Convert a wide string to a narrow string.
+CLI11_INLINE std::string narrow(const std::wstring &str);
+CLI11_INLINE std::string narrow(const wchar_t *str);
+CLI11_INLINE std::string narrow(const wchar_t *str, std::size_t size);
+
+/// Convert a narrow string to a wide string.
+CLI11_INLINE std::wstring widen(const std::string &str);
+CLI11_INLINE std::wstring widen(const char *str);
+CLI11_INLINE std::wstring widen(const char *str, std::size_t size);
+
+#ifdef CLI11_CPP17
+CLI11_INLINE std::string narrow(std::wstring_view str);
+CLI11_INLINE std::wstring widen(std::string_view str);
+#endif  // CLI11_CPP17
+
+#if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
+/// Convert a char-string to a native path correctly.
+CLI11_INLINE std::filesystem::path to_path(std::string_view str);
+#endif  // CLI11_HAS_FILESYSTEM
+
+
+
+
+namespace detail {
+
+#if !CLI11_HAS_CODECVT
+/// Attempt to set one of the acceptable unicode locales for conversion
+CLI11_INLINE void set_unicode_locale() {
+    static const std::array<const char *, 3> unicode_locales{{"C.UTF-8", "en_US.UTF-8", ".UTF-8"}};
+
+    for(const auto &locale_name : unicode_locales) {
+        if(std::setlocale(LC_ALL, locale_name) != nullptr) {
+            return;
+        }
+    }
+    throw std::runtime_error("CLI::narrow: could not set locale to C.UTF-8");
+}
+
+template <typename F> struct scope_guard_t {
+    F closure;
+
+    explicit scope_guard_t(F closure_) : closure(closure_) {}
+    ~scope_guard_t() { closure(); }
+};
+
+template <typename F> CLI11_NODISCARD CLI11_INLINE scope_guard_t<F> scope_guard(F &&closure) {
+    return scope_guard_t<F>{std::forward<F>(closure)};
+}
+
+#endif  // !CLI11_HAS_CODECVT
+
+CLI11_DIAGNOSTIC_PUSH
+CLI11_DIAGNOSTIC_IGNORE_DEPRECATED
+
+CLI11_INLINE std::string narrow_impl(const wchar_t *str, std::size_t str_size) {
+#if CLI11_HAS_CODECVT
+#ifdef _WIN32
+    return std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>>().to_bytes(str, str + str_size);
+
+#else
+    return std::wstring_convert<std::codecvt_utf8<wchar_t>>().to_bytes(str, str + str_size);
+
+#endif  // _WIN32
+#else   // CLI11_HAS_CODECVT
+    (void)str_size;
+    std::mbstate_t state = std::mbstate_t();
+    const wchar_t *it = str;
+
+    std::string old_locale = std::setlocale(LC_ALL, nullptr);
+    auto sg = scope_guard([&] { std::setlocale(LC_ALL, old_locale.c_str()); });
+    set_unicode_locale();
+
+    std::size_t new_size = std::wcsrtombs(nullptr, &it, 0, &state);
+    if(new_size == static_cast<std::size_t>(-1)) {
+        throw std::runtime_error("CLI::narrow: conversion error in std::wcsrtombs at offset " +
+                                 std::to_string(it - str));
+    }
+    std::string result(new_size, '\0');
+    std::wcsrtombs(const_cast<char *>(result.data()), &str, new_size, &state);
+
+    return result;
+
+#endif  // CLI11_HAS_CODECVT
+}
+
+CLI11_INLINE std::wstring widen_impl(const char *str, std::size_t str_size) {
+#if CLI11_HAS_CODECVT
+#ifdef _WIN32
+    return std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>>().from_bytes(str, str + str_size);
+
+#else
+    return std::wstring_convert<std::codecvt_utf8<wchar_t>>().from_bytes(str, str + str_size);
+
+#endif  // _WIN32
+#else   // CLI11_HAS_CODECVT
+    (void)str_size;
+    std::mbstate_t state = std::mbstate_t();
+    const char *it = str;
+
+    std::string old_locale = std::setlocale(LC_ALL, nullptr);
+    auto sg = scope_guard([&] { std::setlocale(LC_ALL, old_locale.c_str()); });
+    set_unicode_locale();
+
+    std::size_t new_size = std::mbsrtowcs(nullptr, &it, 0, &state);
+    if(new_size == static_cast<std::size_t>(-1)) {
+        throw std::runtime_error("CLI::widen: conversion error in std::mbsrtowcs at offset " +
+                                 std::to_string(it - str));
+    }
+    std::wstring result(new_size, L'\0');
+    std::mbsrtowcs(const_cast<wchar_t *>(result.data()), &str, new_size, &state);
+
+    return result;
+
+#endif  // CLI11_HAS_CODECVT
+}
+
+CLI11_DIAGNOSTIC_POP
+
+}  // namespace detail
+
+CLI11_INLINE std::string narrow(const wchar_t *str, std::size_t str_size) { return detail::narrow_impl(str, str_size); }
+CLI11_INLINE std::string narrow(const std::wstring &str) { return detail::narrow_impl(str.data(), str.size()); }
+// Flawfinder: ignore
+CLI11_INLINE std::string narrow(const wchar_t *str) { return detail::narrow_impl(str, std::wcslen(str)); }
+
+CLI11_INLINE std::wstring widen(const char *str, std::size_t str_size) { return detail::widen_impl(str, str_size); }
+CLI11_INLINE std::wstring widen(const std::string &str) { return detail::widen_impl(str.data(), str.size()); }
+// Flawfinder: ignore
+CLI11_INLINE std::wstring widen(const char *str) { return detail::widen_impl(str, std::strlen(str)); }
+
+#ifdef CLI11_CPP17
+CLI11_INLINE std::string narrow(std::wstring_view str) { return detail::narrow_impl(str.data(), str.size()); }
+CLI11_INLINE std::wstring widen(std::string_view str) { return detail::widen_impl(str.data(), str.size()); }
+#endif  // CLI11_CPP17
+
+#if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
+CLI11_INLINE std::filesystem::path to_path(std::string_view str) {
+    return std::filesystem::path{
+#ifdef _WIN32
+        widen(str)
+#else
+        str
+#endif  // _WIN32
+    };
+}
+#endif  // CLI11_HAS_FILESYSTEM
+
+
+
+
+namespace detail {
+#ifdef _WIN32
+/// Decode and return UTF-8 argv from GetCommandLineW.
+CLI11_INLINE std::vector<std::string> compute_win32_argv();
+#endif
+}  // namespace detail
+
+
+
+namespace detail {
+
+#ifdef _WIN32
+CLI11_INLINE std::vector<std::string> compute_win32_argv() {
+    std::vector<std::string> result;
+    int argc = 0;
+
+    auto deleter = [](wchar_t **ptr) { LocalFree(ptr); };
+    // NOLINTBEGIN(*-avoid-c-arrays)
+    auto wargv = std::unique_ptr<wchar_t *[], decltype(deleter)>(CommandLineToArgvW(GetCommandLineW(), &argc), deleter);
+    // NOLINTEND(*-avoid-c-arrays)
+
+    if(wargv == nullptr) {
+        throw std::runtime_error("CommandLineToArgvW failed with code " + std::to_string(GetLastError()));
+    }
+
+    result.reserve(static_cast<size_t>(argc));
+    for(size_t i = 0; i < static_cast<size_t>(argc); ++i) {
+        result.push_back(narrow(wargv[i]));
+    }
+
+    return result;
+}
+#endif
+
+}  // namespace detail
+
+
+
+
 /// Include the items in this namespace to get free conversion of enums to/from streams.
 /// (This is available inside CLI as well, so CLI11 will use this without a using statement).
 namespace enums {
@@ -184,21 +464,7 @@ namespace detail {
 constexpr int expected_max_vector_size{1 << 29};
 // Based on http://stackoverflow.com/questions/236129/split-a-string-in-c
 /// Split a string by a delim
-inline std::vector<std::string> split(const std::string &s, char delim) {
-    std::vector<std::string> elems;
-    // Check to see if empty string, give consistent result
-    if(s.empty()) {
-        elems.emplace_back();
-    } else {
-        std::stringstream ss;
-        ss.str(s);
-        std::string item;
-        while(std::getline(ss, item, delim)) {
-            elems.push_back(item);
-        }
-    }
-    return elems;
-}
+CLI11_INLINE std::vector<std::string> split(const std::string &s, char delim);
 
 /// Simple function to join a string
 template <typename T> std::string join(const T &v, std::string delim = ",") {
@@ -215,16 +481,20 @@ template <typename T> std::string join(const T &v, std::string delim = ",") {
 
 /// Simple function to join a string from processed elements
 template <typename T,
-    typename Callable,
-    typename = typename std::enable_if<!std::is_constructible<std::string, Callable>::value>::type>
+          typename Callable,
+          typename = typename std::enable_if<!std::is_constructible<std::string, Callable>::value>::type>
 std::string join(const T &v, Callable func, std::string delim = ",") {
     std::ostringstream s;
     auto beg = std::begin(v);
     auto end = std::end(v);
-    if(beg != end)
-        s << func(*beg++);
+    auto loc = s.tellp();
     while(beg != end) {
-        s << delim << func(*beg++);
+        auto nloc = s.tellp();
+        if(nloc > loc) {
+            s << delim;
+            loc = nloc;
+        }
+        s << func(*beg++);
     }
     return s.str();
 }
@@ -243,33 +513,16 @@ template <typename T> std::string rjoin(const T &v, std::string delim = ",") {
 // Based roughly on http://stackoverflow.com/questions/25829143/c-trim-whitespace-from-a-string
 
 /// Trim whitespace from left of string
-inline std::string &ltrim(std::string &str) {
-    auto it = std::find_if(str.begin(), str.end(), [](char ch) { return !std::isspace<char>(ch, std::locale()); });
-    str.erase(str.begin(), it);
-    return str;
-}
+CLI11_INLINE std::string &ltrim(std::string &str);
 
 /// Trim anything from left of string
-inline std::string &ltrim(std::string &str, const std::string &filter) {
-    auto it = std::find_if(str.begin(), str.end(), [&filter](char ch) { return filter.find(ch) == std::string::npos; });
-    str.erase(str.begin(), it);
-    return str;
-}
+CLI11_INLINE std::string &ltrim(std::string &str, const std::string &filter);
 
 /// Trim whitespace from right of string
-inline std::string &rtrim(std::string &str) {
-    auto it = std::find_if(str.rbegin(), str.rend(), [](char ch) { return !std::isspace<char>(ch, std::locale()); });
-    str.erase(it.base(), str.end());
-    return str;
-}
+CLI11_INLINE std::string &rtrim(std::string &str);
 
 /// Trim anything from right of string
-inline std::string &rtrim(std::string &str, const std::string &filter) {
-    auto it =
-        std::find_if(str.rbegin(), str.rend(), [&filter](char ch) { return filter.find(ch) == std::string::npos; });
-    str.erase(it.base(), str.end());
-    return str;
-}
+CLI11_INLINE std::string &rtrim(std::string &str, const std::string &filter);
 
 /// Trim whitespace from string
 inline std::string &trim(std::string &str) { return ltrim(rtrim(str)); }
@@ -284,15 +537,16 @@ inline std::string trim_copy(const std::string &str) {
 }
 
 /// remove quotes at the front and back of a string either '"' or '\''
-inline std::string &remove_quotes(std::string &str) {
-    if(str.length() > 1 && (str.front() == '"' || str.front() == '\'')) {
-        if(str.front() == str.back()) {
-            str.pop_back();
-            str.erase(str.begin(), str.begin() + 1);
-        }
-    }
-    return str;
-}
+CLI11_INLINE std::string &remove_quotes(std::string &str);
+
+/// remove quotes from all elements of a string vector and process escaped components
+CLI11_INLINE void remove_quotes(std::vector<std::string> &args);
+
+/// Add a leader to the beginning of all new lines (nothing is added
+/// at the start of the first line). `"; "` would be for ini files
+///
+/// Can't use Regex, or this would be a subs.
+CLI11_INLINE std::string fix_newlines(const std::string &leader, std::string input);
 
 /// Make a copy of the string and then trim it, any filter string can be used (any char in string is filtered)
 inline std::string trim_copy(const std::string &str, const std::string &filter) {
@@ -300,39 +554,39 @@ inline std::string trim_copy(const std::string &str, const std::string &filter)
     return trim(s, filter);
 }
 /// Print a two part "help" string
-inline std::ostream &format_help(std::ostream &out, std::string name, std::string description, std::size_t wid) {
-    name = "  " + name;
-    out << std::setw(static_cast<int>(wid)) << std::left << name;
-    if(!description.empty()) {
-        if(name.length() >= wid)
-            out << "\n" << std::setw(static_cast<int>(wid)) << "";
-        for(const char c : description) {
-            out.put(c);
-            if(c == '\n') {
-                out << std::setw(static_cast<int>(wid)) << "";
-            }
-        }
-    }
-    out << "\n";
-    return out;
-}
+CLI11_INLINE std::ostream &
+format_help(std::ostream &out, std::string name, const std::string &description, std::size_t wid);
+
+/// Print subcommand aliases
+CLI11_INLINE std::ostream &format_aliases(std::ostream &out, const std::vector<std::string> &aliases, std::size_t wid);
 
 /// Verify the first character of an option
+/// - is a trigger character, ! has special meaning and new lines would just be annoying to deal with
 template <typename T> bool valid_first_char(T c) {
-    return std::isalnum(c, std::locale()) || c == '_' || c == '?' || c == '@';
+    return ((c != '-') && (static_cast<unsigned char>(c) > 33));  // space and '!' not allowed
 }
 
 /// Verify following characters of an option
-template <typename T> bool valid_later_char(T c) { return valid_first_char(c) || c == '.' || c == '-'; }
+template <typename T> bool valid_later_char(T c) {
+    // = and : are value separators, { has special meaning for option defaults,
+    // and control codes other than tab would just be annoying to deal with in many places allowing space here has too
+    // much potential for inadvertent entry errors and bugs
+    return ((c != '=') && (c != ':') && (c != '{') && ((static_cast<unsigned char>(c) > 32) || c == '\t'));
+}
 
-/// Verify an option name
-inline bool valid_name_string(const std::string &str) {
-    if(str.empty() || !valid_first_char(str[0]))
-        return false;
-    for(auto c : str.substr(1))
-        if(!valid_later_char(c))
-            return false;
-    return true;
+/// Verify an option/subcommand name
+CLI11_INLINE bool valid_name_string(const std::string &str);
+
+/// Verify an app name
+inline bool valid_alias_name_string(const std::string &str) {
+    static const std::string badChars(std::string("\n") + '\0');
+    return (str.find_first_of(badChars) == std::string::npos);
+}
+
+/// check if a string is a container segment separator (empty or "%%")
+inline bool is_separator(const std::string &str) {
+    static const std::string sep("%%");
+    return (str.empty() || str == sep);
 }
 
 /// Verify that str consists of letters only
@@ -343,7 +597,7 @@ inline bool isalpha(const std::string &str) {
 /// Return a lower case version of a string
 inline std::string to_lower(std::string str) {
     std::transform(std::begin(str), std::end(str), std::begin(str), [](const std::string::value_type &x) {
-      return std::tolower(x, std::locale());
+        return std::tolower(x, std::locale());
     });
     return str;
 }
@@ -355,66 +609,20 @@ inline std::string remove_underscore(std::string str) {
 }
 
 /// Find and replace a substring with another substring
-inline std::string find_and_replace(std::string str, std::string from, std::string to) {
-
-    std::size_t start_pos = 0;
-
-    while((start_pos = str.find(from, start_pos)) != std::string::npos) {
-        str.replace(start_pos, from.length(), to);
-        start_pos += to.length();
-    }
-
-    return str;
-}
+CLI11_INLINE std::string find_and_replace(std::string str, std::string from, std::string to);
 
 /// check if the flag definitions has possible false flags
 inline bool has_default_flag_values(const std::string &flags) {
     return (flags.find_first_of("{!") != std::string::npos);
 }
 
-inline void remove_default_flag_values(std::string &flags) {
-    auto loc = flags.find_first_of('{');
-    while(loc != std::string::npos) {
-        auto finish = flags.find_first_of("},", loc + 1);
-        if((finish != std::string::npos) && (flags[finish] == '}')) {
-            flags.erase(flags.begin() + static_cast<std::ptrdiff_t>(loc),
-                        flags.begin() + static_cast<std::ptrdiff_t>(finish) + 1);
-        }
-        loc = flags.find_first_of('{', loc + 1);
-    }
-    flags.erase(std::remove(flags.begin(), flags.end(), '!'), flags.end());
-}
+CLI11_INLINE void remove_default_flag_values(std::string &flags);
 
 /// Check if a string is a member of a list of strings and optionally ignore case or ignore underscores
-inline std::ptrdiff_t find_member(std::string name,
-                                  const std::vector<std::string> names,
-                                  bool ignore_case = false,
-                                  bool ignore_underscore = false) {
-    auto it = std::end(names);
-    if(ignore_case) {
-        if(ignore_underscore) {
-            name = detail::to_lower(detail::remove_underscore(name));
-            it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
-              return detail::to_lower(detail::remove_underscore(local_name)) == name;
-            });
-        } else {
-            name = detail::to_lower(name);
-            it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
-              return detail::to_lower(local_name) == name;
-            });
-        }
-
-    } else if(ignore_underscore) {
-        name = detail::remove_underscore(name);
-        it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
-          return detail::remove_underscore(local_name) == name;
-        });
-    } else {
-        it = std::find(std::begin(names), std::end(names), name);
-    }
-
-    return (it != std::end(names)) ? (it - std::begin(names)) : (-1);
-}
+CLI11_INLINE std::ptrdiff_t find_member(std::string name,
+                                        const std::vector<std::string> names,
+                                        bool ignore_case = false,
+                                        bool ignore_underscore = false);
 
 /// Find a trigger string and call a modify callable function that takes the current string and starting position of the
 /// trigger and returns the position in the string to search for the next trigger string
@@ -426,60 +634,115 @@ template <typename Callable> inline std::string find_and_modify(std::string str,
     return str;
 }
 
+/// close a sequence of characters indicated by a closure character.  Brackets allows sub sequences
+/// recognized bracket sequences include "'`[(<{  other closure characters are assumed to be literal strings
+CLI11_INLINE std::size_t close_sequence(const std::string &str, std::size_t start, char closure_char);
+
 /// Split a string '"one two" "three"' into 'one two', 'three'
-/// Quote characters can be ` ' or "
-inline std::vector<std::string> split_up(std::string str, char delimiter = '\0') {
+/// Quote characters can be ` ' or " or bracket characters [{(< with matching to the matching bracket
+CLI11_INLINE std::vector<std::string> split_up(std::string str, char delimiter = '\0');
 
-    const std::string delims("\'\"`");
-    auto find_ws = [delimiter](char ch) {
-      return (delimiter == '\0') ? (std::isspace<char>(ch, std::locale()) != 0) : (ch == delimiter);
-    };
-    trim(str);
+/// get the value of an environmental variable or empty string if empty
+CLI11_INLINE std::string get_environment_value(const std::string &env_name);
 
-    std::vector<std::string> output;
-    bool embeddedQuote = false;
-    char keyChar = ' ';
-    while(!str.empty()) {
-        if(delims.find_first_of(str[0]) != std::string::npos) {
-            keyChar = str[0];
-            auto end = str.find_first_of(keyChar, 1);
-            while((end != std::string::npos) && (str[end - 1] == '\\')) {  // deal with escaped quotes
-                end = str.find_first_of(keyChar, end + 1);
-                embeddedQuote = true;
-            }
-            if(end != std::string::npos) {
-                output.push_back(str.substr(1, end - 1));
-                str = str.substr(end + 1);
-            } else {
-                output.push_back(str.substr(1));
-                str = "";
-            }
-        } else {
-            auto it = std::find_if(std::begin(str), std::end(str), find_ws);
-            if(it != std::end(str)) {
-                std::string value = std::string(str.begin(), it);
-                output.push_back(value);
-                str = std::string(it + 1, str.end());
-            } else {
-                output.push_back(str);
-                str = "";
-            }
+/// This function detects an equal or colon followed by an escaped quote after an argument
+/// then modifies the string to replace the equality with a space.  This is needed
+/// to allow the split up function to work properly and is intended to be used with the find_and_modify function
+/// the return value is the offset+1 which is required by the find_and_modify function.
+CLI11_INLINE std::size_t escape_detect(std::string &str, std::size_t offset);
+
+/// @brief  detect if a string has escapable characters
+/// @param str the string to do the detection on
+/// @return true if the string has escapable characters
+CLI11_INLINE bool has_escapable_character(const std::string &str);
+
+/// @brief escape all escapable characters
+/// @param str the string to escape
+/// @return a string with the escapble characters escaped with '\'
+CLI11_INLINE std::string add_escaped_characters(const std::string &str);
+
+/// @brief replace the escaped characters with their equivalent
+CLI11_INLINE std::string remove_escaped_characters(const std::string &str);
+
+/// generate a string with all non printable characters escaped to hex codes
+CLI11_INLINE std::string binary_escape_string(const std::string &string_to_escape);
+
+CLI11_INLINE bool is_binary_escaped_string(const std::string &escaped_string);
+
+/// extract an escaped binary_string
+CLI11_INLINE std::string extract_binary_string(const std::string &escaped_string);
+
+/// process a quoted string, remove the quotes and if appropriate handle escaped characters
+CLI11_INLINE bool process_quoted_string(std::string &str, char string_char = '\"', char literal_char = '\'');
+
+}  // namespace detail
+
+
+
+
+namespace detail {
+CLI11_INLINE std::vector<std::string> split(const std::string &s, char delim) {
+    std::vector<std::string> elems;
+    // Check to see if empty string, give consistent result
+    if(s.empty()) {
+        elems.emplace_back();
+    } else {
+        std::stringstream ss;
+        ss.str(s);
+        std::string item;
+        while(std::getline(ss, item, delim)) {
+            elems.push_back(item);
         }
-        // transform any embedded quotes into the regular character
-        if(embeddedQuote) {
-            output.back() = find_and_replace(output.back(), std::string("\\") + keyChar, std::string(1, keyChar));
-            embeddedQuote = false;
+    }
+    return elems;
+}
+
+CLI11_INLINE std::string &ltrim(std::string &str) {
+    auto it = std::find_if(str.begin(), str.end(), [](char ch) { return !std::isspace<char>(ch, std::locale()); });
+    str.erase(str.begin(), it);
+    return str;
+}
+
+CLI11_INLINE std::string &ltrim(std::string &str, const std::string &filter) {
+    auto it = std::find_if(str.begin(), str.end(), [&filter](char ch) { return filter.find(ch) == std::string::npos; });
+    str.erase(str.begin(), it);
+    return str;
+}
+
+CLI11_INLINE std::string &rtrim(std::string &str) {
+    auto it = std::find_if(str.rbegin(), str.rend(), [](char ch) { return !std::isspace<char>(ch, std::locale()); });
+    str.erase(it.base(), str.end());
+    return str;
+}
+
+CLI11_INLINE std::string &rtrim(std::string &str, const std::string &filter) {
+    auto it =
+        std::find_if(str.rbegin(), str.rend(), [&filter](char ch) { return filter.find(ch) == std::string::npos; });
+    str.erase(it.base(), str.end());
+    return str;
+}
+
+CLI11_INLINE std::string &remove_quotes(std::string &str) {
+    if(str.length() > 1 && (str.front() == '"' || str.front() == '\'' || str.front() == '`')) {
+        if(str.front() == str.back()) {
+            str.pop_back();
+            str.erase(str.begin(), str.begin() + 1);
         }
-        trim(str);
     }
-    return output;
+    return str;
 }
 
-/// Add a leader to the beginning of all new lines (nothing is added
-/// at the start of the first line). `"; "` would be for ini files
-///
-/// Can't use Regex, or this would be a subs.
-inline std::string fix_newlines(const std::string &leader, std::string input) {
+CLI11_INLINE std::string &remove_outer(std::string &str, char key) {
+    if(str.length() > 1 && (str.front() == key)) {
+        if(str.front() == str.back()) {
+            str.pop_back();
+            str.erase(str.begin(), str.begin() + 1);
+        }
+    }
+    return str;
+}
+
+CLI11_INLINE std::string fix_newlines(const std::string &leader, std::string input) {
     std::string::size_type n = 0;
     while(n != std::string::npos && n < input.size()) {
         n = input.find('\n', n);
@@ -491,133 +754,578 @@ inline std::string fix_newlines(const std::string &leader, std::string input) {
     return input;
 }
 
-/// This function detects an equal or colon followed by an escaped quote after an argument
-/// then modifies the string to replace the equality with a space.  This is needed
-/// to allow the split up function to work properly and is intended to be used with the find_and_modify function
-/// the return value is the offset+1 which is required by the find_and_modify function.
-inline std::size_t escape_detect(std::string &str, std::size_t offset) {
-    auto next = str[offset + 1];
-    if((next == '\"') || (next == '\'') || (next == '`')) {
-        auto astart = str.find_last_of("-/ \"\'`", offset - 1);
-        if(astart != std::string::npos) {
-            if(str[astart] == ((str[offset] == '=') ? '-' : '/'))
-                str[offset] = ' ';  // interpret this as a space so the split_up works properly
+CLI11_INLINE std::ostream &
+format_help(std::ostream &out, std::string name, const std::string &description, std::size_t wid) {
+    name = "  " + name;
+    out << std::setw(static_cast<int>(wid)) << std::left << name;
+    if(!description.empty()) {
+        if(name.length() >= wid)
+            out << "\n" << std::setw(static_cast<int>(wid)) << "";
+        for(const char c : description) {
+            out.put(c);
+            if(c == '\n') {
+                out << std::setw(static_cast<int>(wid)) << "";
+            }
         }
     }
-    return offset + 1;
+    out << "\n";
+    return out;
 }
 
-/// Add quotes if the string contains spaces
-inline std::string &add_quotes_if_needed(std::string &str) {
-    if((str.front() != '"' && str.front() != '\'') || str.front() != str.back()) {
-        char quote = str.find('"') < str.find('\'') ? '\'' : '"';
-        if(str.find(' ') != std::string::npos) {
-            str.insert(0, 1, quote);
-            str.append(1, quote);
+CLI11_INLINE std::ostream &format_aliases(std::ostream &out, const std::vector<std::string> &aliases, std::size_t wid) {
+    if(!aliases.empty()) {
+        out << std::setw(static_cast<int>(wid)) << "     aliases: ";
+        bool front = true;
+        for(const auto &alias : aliases) {
+            if(!front) {
+                out << ", ";
+            } else {
+                front = false;
+            }
+            out << detail::fix_newlines("              ", alias);
         }
+        out << "\n";
     }
-    return str;
+    return out;
 }
 
-}  // namespace detail
+CLI11_INLINE bool valid_name_string(const std::string &str) {
+    if(str.empty() || !valid_first_char(str[0])) {
+        return false;
+    }
+    auto e = str.end();
+    for(auto c = str.begin() + 1; c != e; ++c)
+        if(!valid_later_char(*c))
+            return false;
+    return true;
+}
 
-}  // namespace CLI
+CLI11_INLINE std::string find_and_replace(std::string str, std::string from, std::string to) {
 
-// From Error.hpp:
+    std::size_t start_pos = 0;
 
-namespace CLI {
+    while((start_pos = str.find(from, start_pos)) != std::string::npos) {
+        str.replace(start_pos, from.length(), to);
+        start_pos += to.length();
+    }
 
-// Use one of these on all error classes.
-// These are temporary and are undef'd at the end of this file.
-#define CLI11_ERROR_DEF(parent, name)                                                                                  \
-  protected:                                                                                                           \
-    name(std::string ename, std::string msg, int exit_code) : parent(std::move(ename), std::move(msg), exit_code) {}   \
-    name(std::string ename, std::string msg, ExitCodes exit_code)                                                      \
-        : parent(std::move(ename), std::move(msg), exit_code) {}                                                       \
-                                                                                                                       \
-  public:                                                                                                              \
-    name(std::string msg, ExitCodes exit_code) : parent(#name, std::move(msg), exit_code) {}                           \
-    name(std::string msg, int exit_code) : parent(#name, std::move(msg), exit_code) {}
+    return str;
+}
 
-// This is added after the one above if a class is used directly and builds its own message
-#define CLI11_ERROR_SIMPLE(name)                                                                                       \
-    explicit name(std::string msg) : name(#name, msg, ExitCodes::name) {}
+CLI11_INLINE void remove_default_flag_values(std::string &flags) {
+    auto loc = flags.find_first_of('{', 2);
+    while(loc != std::string::npos) {
+        auto finish = flags.find_first_of("},", loc + 1);
+        if((finish != std::string::npos) && (flags[finish] == '}')) {
+            flags.erase(flags.begin() + static_cast<std::ptrdiff_t>(loc),
+                        flags.begin() + static_cast<std::ptrdiff_t>(finish) + 1);
+        }
+        loc = flags.find_first_of('{', loc + 1);
+    }
+    flags.erase(std::remove(flags.begin(), flags.end(), '!'), flags.end());
+}
 
-/// These codes are part of every error in CLI. They can be obtained from e using e.exit_code or as a quick shortcut,
-/// int values from e.get_error_code().
-enum class ExitCodes {
-    Success = 0,
-    IncorrectConstruction = 100,
-    BadNameString,
-    OptionAlreadyAdded,
-    FileError,
-    ConversionError,
-    ValidationError,
-    RequiredError,
-    RequiresError,
-    ExcludesError,
-    ExtrasError,
-    ConfigError,
-    InvalidError,
-    HorribleError,
-    OptionNotFound,
-    ArgumentMismatch,
-    BaseClass = 127
-};
+CLI11_INLINE std::ptrdiff_t
+find_member(std::string name, const std::vector<std::string> names, bool ignore_case, bool ignore_underscore) {
+    auto it = std::end(names);
+    if(ignore_case) {
+        if(ignore_underscore) {
+            name = detail::to_lower(detail::remove_underscore(name));
+            it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
+                return detail::to_lower(detail::remove_underscore(local_name)) == name;
+            });
+        } else {
+            name = detail::to_lower(name);
+            it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
+                return detail::to_lower(local_name) == name;
+            });
+        }
 
-// Error definitions
+    } else if(ignore_underscore) {
+        name = detail::remove_underscore(name);
+        it = std::find_if(std::begin(names), std::end(names), [&name](std::string local_name) {
+            return detail::remove_underscore(local_name) == name;
+        });
+    } else {
+        it = std::find(std::begin(names), std::end(names), name);
+    }
 
-/// @defgroup error_group Errors
-/// @brief Errors thrown by CLI11
-///
-/// These are the errors that can be thrown. Some of them, like CLI::Success, are not really errors.
-/// @{
+    return (it != std::end(names)) ? (it - std::begin(names)) : (-1);
+}
 
-/// All errors derive from this one
-class Error : public std::runtime_error {
-    int actual_exit_code;
-    std::string error_name{"Error"};
+static const std::string escapedChars("\b\t\n\f\r\"\\");
+static const std::string escapedCharsCode("btnfr\"\\");
+static const std::string bracketChars{"\"'`[(<{"};
+static const std::string matchBracketChars("\"'`])>}");
 
-  public:
-    int get_exit_code() const { return actual_exit_code; }
+CLI11_INLINE bool has_escapable_character(const std::string &str) {
+    return (str.find_first_of(escapedChars) != std::string::npos);
+}
 
-    std::string get_name() const { return error_name; }
+CLI11_INLINE std::string add_escaped_characters(const std::string &str) {
+    std::string out;
+    out.reserve(str.size() + 4);
+    for(char s : str) {
+        auto sloc = escapedChars.find_first_of(s);
+        if(sloc != std::string::npos) {
+            out.push_back('\\');
+            out.push_back(escapedCharsCode[sloc]);
+        } else {
+            out.push_back(s);
+        }
+    }
+    return out;
+}
 
-    Error(std::string name, std::string msg, int exit_code = static_cast<int>(ExitCodes::BaseClass))
-        : runtime_error(msg), actual_exit_code(exit_code), error_name(std::move(name)) {}
+CLI11_INLINE std::uint32_t hexConvert(char hc) {
+    int hcode{0};
+    if(hc >= '0' && hc <= '9') {
+        hcode = (hc - '0');
+    } else if(hc >= 'A' && hc <= 'F') {
+        hcode = (hc - 'A' + 10);
+    } else if(hc >= 'a' && hc <= 'f') {
+        hcode = (hc - 'a' + 10);
+    } else {
+        hcode = -1;
+    }
+    return static_cast<uint32_t>(hcode);
+}
+
+CLI11_INLINE char make_char(std::uint32_t code) { return static_cast<char>(static_cast<unsigned char>(code)); }
+
+CLI11_INLINE void append_codepoint(std::string &str, std::uint32_t code) {
+    if(code < 0x80) {  // ascii code equivalent
+        str.push_back(static_cast<char>(code));
+    } else if(code < 0x800) {  // \u0080 to \u07FF
+        // 110yyyyx 10xxxxxx; 0x3f == 0b0011'1111
+        str.push_back(make_char(0xC0 | code >> 6));
+        str.push_back(make_char(0x80 | (code & 0x3F)));
+    } else if(code < 0x10000) {  // U+0800...U+FFFF
+        if(0xD800 <= code && code <= 0xDFFF) {
+            throw std::invalid_argument("[0xD800, 0xDFFF] are not valid UTF-8.");
+        }
+        // 1110yyyy 10yxxxxx 10xxxxxx
+        str.push_back(make_char(0xE0 | code >> 12));
+        str.push_back(make_char(0x80 | (code >> 6 & 0x3F)));
+        str.push_back(make_char(0x80 | (code & 0x3F)));
+    } else if(code < 0x110000) {  // U+010000 ... U+10FFFF
+        // 11110yyy 10yyxxxx 10xxxxxx 10xxxxxx
+        str.push_back(make_char(0xF0 | code >> 18));
+        str.push_back(make_char(0x80 | (code >> 12 & 0x3F)));
+        str.push_back(make_char(0x80 | (code >> 6 & 0x3F)));
+        str.push_back(make_char(0x80 | (code & 0x3F)));
+    }
+}
+
+CLI11_INLINE std::string remove_escaped_characters(const std::string &str) {
+
+    std::string out;
+    out.reserve(str.size());
+    for(auto loc = str.begin(); loc < str.end(); ++loc) {
+        if(*loc == '\\') {
+            if(str.end() - loc < 2) {
+                throw std::invalid_argument("invalid escape sequence " + str);
+            }
+            auto ecloc = escapedCharsCode.find_first_of(*(loc + 1));
+            if(ecloc != std::string::npos) {
+                out.push_back(escapedChars[ecloc]);
+                ++loc;
+            } else if(*(loc + 1) == 'u') {
+                // must have 4 hex characters
+                if(str.end() - loc < 6) {
+                    throw std::invalid_argument("unicode sequence must have 4 hex codes " + str);
+                }
+                std::uint32_t code{0};
+                std::uint32_t mplier{16 * 16 * 16};
+                for(int ii = 2; ii < 6; ++ii) {
+                    std::uint32_t res = hexConvert(*(loc + ii));
+                    if(res > 0x0F) {
+                        throw std::invalid_argument("unicode sequence must have 4 hex codes " + str);
+                    }
+                    code += res * mplier;
+                    mplier = mplier / 16;
+                }
+                append_codepoint(out, code);
+                loc += 5;
+            } else if(*(loc + 1) == 'U') {
+                // must have 8 hex characters
+                if(str.end() - loc < 10) {
+                    throw std::invalid_argument("unicode sequence must have 8 hex codes " + str);
+                }
+                std::uint32_t code{0};
+                std::uint32_t mplier{16 * 16 * 16 * 16 * 16 * 16 * 16};
+                for(int ii = 2; ii < 10; ++ii) {
+                    std::uint32_t res = hexConvert(*(loc + ii));
+                    if(res > 0x0F) {
+                        throw std::invalid_argument("unicode sequence must have 8 hex codes " + str);
+                    }
+                    code += res * mplier;
+                    mplier = mplier / 16;
+                }
+                append_codepoint(out, code);
+                loc += 9;
+            } else if(*(loc + 1) == '0') {
+                out.push_back('\0');
+                ++loc;
+            } else {
+                throw std::invalid_argument(std::string("unrecognized escape sequence \\") + *(loc + 1) + " in " + str);
+            }
+        } else {
+            out.push_back(*loc);
+        }
+    }
+    return out;
+}
 
-    Error(std::string name, std::string msg, ExitCodes exit_code) : Error(name, msg, static_cast<int>(exit_code)) {}
-};
+CLI11_INLINE std::size_t close_string_quote(const std::string &str, std::size_t start, char closure_char) {
+    std::size_t loc{0};
+    for(loc = start + 1; loc < str.size(); ++loc) {
+        if(str[loc] == closure_char) {
+            break;
+        }
+        if(str[loc] == '\\') {
+            // skip the next character for escaped sequences
+            ++loc;
+        }
+    }
+    return loc;
+}
 
-// Note: Using Error::Error constructors does not work on GCC 4.7
+CLI11_INLINE std::size_t close_literal_quote(const std::string &str, std::size_t start, char closure_char) {
+    auto loc = str.find_first_of(closure_char, start + 1);
+    return (loc != std::string::npos ? loc : str.size());
+}
 
-/// Construction errors (not in parsing)
-class ConstructionError : public Error {
-  CLI11_ERROR_DEF(Error, ConstructionError)
-};
+CLI11_INLINE std::size_t close_sequence(const std::string &str, std::size_t start, char closure_char) {
 
-/// Thrown when an option is set to conflicting values (non-vector and multi args, for example)
-class IncorrectConstruction : public ConstructionError {
-  CLI11_ERROR_DEF(ConstructionError, IncorrectConstruction)
-    CLI11_ERROR_SIMPLE(IncorrectConstruction)
-    static IncorrectConstruction PositionalFlag(std::string name) {
-        return IncorrectConstruction(name + ": Flags cannot be positional");
-    }
-    static IncorrectConstruction Set0Opt(std::string name) {
-        return IncorrectConstruction(name + ": Cannot set 0 expected, use a flag instead");
-    }
-    static IncorrectConstruction SetFlag(std::string name) {
-        return IncorrectConstruction(name + ": Cannot set an expected number for flags");
+    auto bracket_loc = matchBracketChars.find(closure_char);
+    switch(bracket_loc) {
+    case 0:
+        return close_string_quote(str, start, closure_char);
+    case 1:
+    case 2:
+    case std::string::npos:
+        return close_literal_quote(str, start, closure_char);
+    default:
+        break;
     }
-    static IncorrectConstruction ChangeNotVector(std::string name) {
-        return IncorrectConstruction(name + ": You can only change the expected arguments for vectors");
+
+    std::string closures(1, closure_char);
+    auto loc = start + 1;
+
+    while(loc < str.size()) {
+        if(str[loc] == closures.back()) {
+            closures.pop_back();
+            if(closures.empty()) {
+                return loc;
+            }
+        }
+        bracket_loc = bracketChars.find(str[loc]);
+        if(bracket_loc != std::string::npos) {
+            switch(bracket_loc) {
+            case 0:
+                loc = close_string_quote(str, loc, str[loc]);
+                break;
+            case 1:
+            case 2:
+                loc = close_literal_quote(str, loc, str[loc]);
+                break;
+            default:
+                closures.push_back(matchBracketChars[bracket_loc]);
+                break;
+            }
+        }
+        ++loc;
     }
-    static IncorrectConstruction AfterMultiOpt(std::string name) {
-        return IncorrectConstruction(
-            name + ": You can't change expected arguments after you've changed the multi option policy!");
+    if(loc > str.size()) {
+        loc = str.size();
     }
-    static IncorrectConstruction MissingOption(std::string name) {
-        return IncorrectConstruction("Option " + name + " is not defined");
+    return loc;
+}
+
+CLI11_INLINE std::vector<std::string> split_up(std::string str, char delimiter) {
+
+    auto find_ws = [delimiter](char ch) {
+        return (delimiter == '\0') ? std::isspace<char>(ch, std::locale()) : (ch == delimiter);
+    };
+    trim(str);
+
+    std::vector<std::string> output;
+    while(!str.empty()) {
+        if(bracketChars.find_first_of(str[0]) != std::string::npos) {
+            auto bracketLoc = bracketChars.find_first_of(str[0]);
+            auto end = close_sequence(str, 0, matchBracketChars[bracketLoc]);
+            if(end >= str.size()) {
+                output.push_back(std::move(str));
+                str.clear();
+            } else {
+                output.push_back(str.substr(0, end + 1));
+                if(end + 2 < str.size()) {
+                    str = str.substr(end + 2);
+                } else {
+                    str.clear();
+                }
+            }
+
+        } else {
+            auto it = std::find_if(std::begin(str), std::end(str), find_ws);
+            if(it != std::end(str)) {
+                std::string value = std::string(str.begin(), it);
+                output.push_back(value);
+                str = std::string(it + 1, str.end());
+            } else {
+                output.push_back(str);
+                str.clear();
+            }
+        }
+        trim(str);
+    }
+    return output;
+}
+
+CLI11_INLINE std::size_t escape_detect(std::string &str, std::size_t offset) {
+    auto next = str[offset + 1];
+    if((next == '\"') || (next == '\'') || (next == '`')) {
+        auto astart = str.find_last_of("-/ \"\'`", offset - 1);
+        if(astart != std::string::npos) {
+            if(str[astart] == ((str[offset] == '=') ? '-' : '/'))
+                str[offset] = ' ';  // interpret this as a space so the split_up works properly
+        }
+    }
+    return offset + 1;
+}
+
+CLI11_INLINE std::string binary_escape_string(const std::string &string_to_escape) {
+    // s is our escaped output string
+    std::string escaped_string{};
+    // loop through all characters
+    for(char c : string_to_escape) {
+        // check if a given character is printable
+        // the cast is necessary to avoid undefined behaviour
+        if(isprint(static_cast<unsigned char>(c)) == 0) {
+            std::stringstream stream;
+            // if the character is not printable
+            // we'll convert it to a hex string using a stringstream
+            // note that since char is signed we have to cast it to unsigned first
+            stream << std::hex << static_cast<unsigned int>(static_cast<unsigned char>(c));
+            std::string code = stream.str();
+            escaped_string += std::string("\\x") + (code.size() < 2 ? "0" : "") + code;
+
+        } else {
+            escaped_string.push_back(c);
+        }
+    }
+    if(escaped_string != string_to_escape) {
+        auto sqLoc = escaped_string.find('\'');
+        while(sqLoc != std::string::npos) {
+            escaped_string.replace(sqLoc, sqLoc + 1, "\\x27");
+            sqLoc = escaped_string.find('\'');
+        }
+        escaped_string.insert(0, "'B\"(");
+        escaped_string.push_back(')');
+        escaped_string.push_back('"');
+        escaped_string.push_back('\'');
+    }
+    return escaped_string;
+}
+
+CLI11_INLINE bool is_binary_escaped_string(const std::string &escaped_string) {
+    size_t ssize = escaped_string.size();
+    if(escaped_string.compare(0, 3, "B\"(") == 0 && escaped_string.compare(ssize - 2, 2, ")\"") == 0) {
+        return true;
+    }
+    return (escaped_string.compare(0, 4, "'B\"(") == 0 && escaped_string.compare(ssize - 3, 3, ")\"'") == 0);
+}
+
+CLI11_INLINE std::string extract_binary_string(const std::string &escaped_string) {
+    std::size_t start{0};
+    std::size_t tail{0};
+    size_t ssize = escaped_string.size();
+    if(escaped_string.compare(0, 3, "B\"(") == 0 && escaped_string.compare(ssize - 2, 2, ")\"") == 0) {
+        start = 3;
+        tail = 2;
+    } else if(escaped_string.compare(0, 4, "'B\"(") == 0 && escaped_string.compare(ssize - 3, 3, ")\"'") == 0) {
+        start = 4;
+        tail = 3;
+    }
+
+    if(start == 0) {
+        return escaped_string;
+    }
+    std::string outstring;
+
+    outstring.reserve(ssize - start - tail);
+    std::size_t loc = start;
+    while(loc < ssize - tail) {
+        // ssize-2 to skip )" at the end
+        if(escaped_string[loc] == '\\' && (escaped_string[loc + 1] == 'x' || escaped_string[loc + 1] == 'X')) {
+            auto c1 = escaped_string[loc + 2];
+            auto c2 = escaped_string[loc + 3];
+
+            std::uint32_t res1 = hexConvert(c1);
+            std::uint32_t res2 = hexConvert(c2);
+            if(res1 <= 0x0F && res2 <= 0x0F) {
+                loc += 4;
+                outstring.push_back(static_cast<char>(res1 * 16 + res2));
+                continue;
+            }
+        }
+        outstring.push_back(escaped_string[loc]);
+        ++loc;
+    }
+    return outstring;
+}
+
+CLI11_INLINE void remove_quotes(std::vector<std::string> &args) {
+    for(auto &arg : args) {
+        if(arg.front() == '\"' && arg.back() == '\"') {
+            remove_quotes(arg);
+            // only remove escaped for string arguments not literal strings
+            arg = remove_escaped_characters(arg);
+        } else {
+            remove_quotes(arg);
+        }
+    }
+}
+
+CLI11_INLINE bool process_quoted_string(std::string &str, char string_char, char literal_char) {
+    if(str.size() <= 1) {
+        return false;
+    }
+    if(detail::is_binary_escaped_string(str)) {
+        str = detail::extract_binary_string(str);
+        return true;
+    }
+    if(str.front() == string_char && str.back() == string_char) {
+        detail::remove_outer(str, string_char);
+        if(str.find_first_of('\\') != std::string::npos) {
+            str = detail::remove_escaped_characters(str);
+        }
+        return true;
+    }
+    if((str.front() == literal_char || str.front() == '`') && str.back() == str.front()) {
+        detail::remove_outer(str, str.front());
+        return true;
+    }
+    return false;
+}
+
+std::string get_environment_value(const std::string &env_name) {
+    char *buffer = nullptr;
+    std::string ename_string;
+
+#ifdef _MSC_VER
+    // Windows version
+    std::size_t sz = 0;
+    if(_dupenv_s(&buffer, &sz, env_name.c_str()) == 0 && buffer != nullptr) {
+        ename_string = std::string(buffer);
+        free(buffer);
+    }
+#else
+    // This also works on Windows, but gives a warning
+    buffer = std::getenv(env_name.c_str());
+    if(buffer != nullptr) {
+        ename_string = std::string(buffer);
+    }
+#endif
+    return ename_string;
+}
+
+}  // namespace detail
+
+
+
+// Use one of these on all error classes.
+// These are temporary and are undef'd at the end of this file.
+#define CLI11_ERROR_DEF(parent, name)                                                                                  \
+  protected:                                                                                                           \
+    name(std::string ename, std::string msg, int exit_code) : parent(std::move(ename), std::move(msg), exit_code) {}   \
+    name(std::string ename, std::string msg, ExitCodes exit_code)                                                      \
+        : parent(std::move(ename), std::move(msg), exit_code) {}                                                       \
+                                                                                                                       \
+  public:                                                                                                              \
+    name(std::string msg, ExitCodes exit_code) : parent(#name, std::move(msg), exit_code) {}                           \
+    name(std::string msg, int exit_code) : parent(#name, std::move(msg), exit_code) {}
+
+// This is added after the one above if a class is used directly and builds its own message
+#define CLI11_ERROR_SIMPLE(name)                                                                                       \
+    explicit name(std::string msg) : name(#name, msg, ExitCodes::name) {}
+
+/// These codes are part of every error in CLI. They can be obtained from e using e.exit_code or as a quick shortcut,
+/// int values from e.get_error_code().
+enum class ExitCodes {
+    Success = 0,
+    IncorrectConstruction = 100,
+    BadNameString,
+    OptionAlreadyAdded,
+    FileError,
+    ConversionError,
+    ValidationError,
+    RequiredError,
+    RequiresError,
+    ExcludesError,
+    ExtrasError,
+    ConfigError,
+    InvalidError,
+    HorribleError,
+    OptionNotFound,
+    ArgumentMismatch,
+    BaseClass = 127
+};
+
+// Error definitions
+
+/// @defgroup error_group Errors
+/// @brief Errors thrown by CLI11
+///
+/// These are the errors that can be thrown. Some of them, like CLI::Success, are not really errors.
+/// @{
+
+/// All errors derive from this one
+class Error : public std::runtime_error {
+    int actual_exit_code;
+    std::string error_name{"Error"};
+
+  public:
+    CLI11_NODISCARD int get_exit_code() const { return actual_exit_code; }
+
+    CLI11_NODISCARD std::string get_name() const { return error_name; }
+
+    Error(std::string name, std::string msg, int exit_code = static_cast<int>(ExitCodes::BaseClass))
+        : runtime_error(msg), actual_exit_code(exit_code), error_name(std::move(name)) {}
+
+    Error(std::string name, std::string msg, ExitCodes exit_code) : Error(name, msg, static_cast<int>(exit_code)) {}
+};
+
+// Note: Using Error::Error constructors does not work on GCC 4.7
+
+/// Construction errors (not in parsing)
+class ConstructionError : public Error {
+    CLI11_ERROR_DEF(Error, ConstructionError)
+};
+
+/// Thrown when an option is set to conflicting values (non-vector and multi args, for example)
+class IncorrectConstruction : public ConstructionError {
+    CLI11_ERROR_DEF(ConstructionError, IncorrectConstruction)
+    CLI11_ERROR_SIMPLE(IncorrectConstruction)
+    static IncorrectConstruction PositionalFlag(std::string name) {
+        return IncorrectConstruction(name + ": Flags cannot be positional");
+    }
+    static IncorrectConstruction Set0Opt(std::string name) {
+        return IncorrectConstruction(name + ": Cannot set 0 expected, use a flag instead");
+    }
+    static IncorrectConstruction SetFlag(std::string name) {
+        return IncorrectConstruction(name + ": Cannot set an expected number for flags");
+    }
+    static IncorrectConstruction ChangeNotVector(std::string name) {
+        return IncorrectConstruction(name + ": You can only change the expected arguments for vectors");
+    }
+    static IncorrectConstruction AfterMultiOpt(std::string name) {
+        return IncorrectConstruction(
+            name + ": You can't change expected arguments after you've changed the multi option policy!");
+    }
+    static IncorrectConstruction MissingOption(std::string name) {
+        return IncorrectConstruction("Option " + name + " is not defined");
     }
     static IncorrectConstruction MultiOptionPolicy(std::string name) {
         return IncorrectConstruction(name + ": multi_option_policy only works for flags and exact value options");
@@ -626,10 +1334,16 @@ class IncorrectConstruction : public ConstructionError {
 
 /// Thrown on construction of a bad name
 class BadNameString : public ConstructionError {
-  CLI11_ERROR_DEF(ConstructionError, BadNameString)
+    CLI11_ERROR_DEF(ConstructionError, BadNameString)
     CLI11_ERROR_SIMPLE(BadNameString)
     static BadNameString OneCharName(std::string name) { return BadNameString("Invalid one char name: " + name); }
+    static BadNameString MissingDash(std::string name) {
+        return BadNameString("Long names strings require 2 dashes " + name);
+    }
     static BadNameString BadLongName(std::string name) { return BadNameString("Bad long name: " + name); }
+    static BadNameString BadPositionalName(std::string name) {
+        return BadNameString("Invalid positional Name: " + name);
+    }
     static BadNameString DashesOnly(std::string name) {
         return BadNameString("Must have a name, not just dashes: " + name);
     }
@@ -640,14 +1354,14 @@ class BadNameString : public ConstructionError {
 
 /// Thrown when an option already exists
 class OptionAlreadyAdded : public ConstructionError {
-  CLI11_ERROR_DEF(ConstructionError, OptionAlreadyAdded)
+    CLI11_ERROR_DEF(ConstructionError, OptionAlreadyAdded)
     explicit OptionAlreadyAdded(std::string name)
         : OptionAlreadyAdded(name + " is already added", ExitCodes::OptionAlreadyAdded) {}
     static OptionAlreadyAdded Requires(std::string name, std::string other) {
-        return OptionAlreadyAdded(name + " requires " + other, ExitCodes::OptionAlreadyAdded);
+        return {name + " requires " + other, ExitCodes::OptionAlreadyAdded};
     }
     static OptionAlreadyAdded Excludes(std::string name, std::string other) {
-        return OptionAlreadyAdded(name + " excludes " + other, ExitCodes::OptionAlreadyAdded);
+        return {name + " excludes " + other, ExitCodes::OptionAlreadyAdded};
     }
 };
 
@@ -655,46 +1369,53 @@ class OptionAlreadyAdded : public ConstructionError {
 
 /// Anything that can error in Parse
 class ParseError : public Error {
-  CLI11_ERROR_DEF(Error, ParseError)
+    CLI11_ERROR_DEF(Error, ParseError)
 };
 
 // Not really "errors"
 
 /// This is a successful completion on parsing, supposed to exit
 class Success : public ParseError {
-  CLI11_ERROR_DEF(ParseError, Success)
+    CLI11_ERROR_DEF(ParseError, Success)
     Success() : Success("Successfully completed, should be caught and quit", ExitCodes::Success) {}
 };
 
 /// -h or --help on command line
-class CallForHelp : public ParseError {
-  CLI11_ERROR_DEF(ParseError, CallForHelp)
+class CallForHelp : public Success {
+    CLI11_ERROR_DEF(Success, CallForHelp)
     CallForHelp() : CallForHelp("This should be caught in your main function, see examples", ExitCodes::Success) {}
 };
 
 /// Usually something like --help-all on command line
-class CallForAllHelp : public ParseError {
-  CLI11_ERROR_DEF(ParseError, CallForAllHelp)
+class CallForAllHelp : public Success {
+    CLI11_ERROR_DEF(Success, CallForAllHelp)
     CallForAllHelp()
         : CallForAllHelp("This should be caught in your main function, see examples", ExitCodes::Success) {}
 };
 
-/// Does not output a diagnostic in CLI11_PARSE, but allows to return from main() with a specific error code.
+/// -v or --version on command line
+class CallForVersion : public Success {
+    CLI11_ERROR_DEF(Success, CallForVersion)
+    CallForVersion()
+        : CallForVersion("This should be caught in your main function, see examples", ExitCodes::Success) {}
+};
+
+/// Does not output a diagnostic in CLI11_PARSE, but allows main() to return with a specific error code.
 class RuntimeError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, RuntimeError)
+    CLI11_ERROR_DEF(ParseError, RuntimeError)
     explicit RuntimeError(int exit_code = 1) : RuntimeError("Runtime error", exit_code) {}
 };
 
 /// Thrown when parsing an INI file and it is missing
 class FileError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, FileError)
+    CLI11_ERROR_DEF(ParseError, FileError)
     CLI11_ERROR_SIMPLE(FileError)
     static FileError Missing(std::string name) { return FileError(name + " was not readable (missing?)"); }
 };
 
 /// Thrown when conversion call back fails, such as when an int fails to coerce to a string
 class ConversionError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ConversionError)
+    CLI11_ERROR_DEF(ParseError, ConversionError)
     CLI11_ERROR_SIMPLE(ConversionError)
     ConversionError(std::string member, std::string name)
         : ConversionError("The value " + member + " is not an allowed value for " + name) {}
@@ -710,51 +1431,49 @@ class ConversionError : public ParseError {
 
 /// Thrown when validation of results fails
 class ValidationError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ValidationError)
+    CLI11_ERROR_DEF(ParseError, ValidationError)
     CLI11_ERROR_SIMPLE(ValidationError)
     explicit ValidationError(std::string name, std::string msg) : ValidationError(name + ": " + msg) {}
 };
 
 /// Thrown when a required option is missing
 class RequiredError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, RequiredError)
+    CLI11_ERROR_DEF(ParseError, RequiredError)
     explicit RequiredError(std::string name) : RequiredError(name + " is required", ExitCodes::RequiredError) {}
     static RequiredError Subcommand(std::size_t min_subcom) {
         if(min_subcom == 1) {
             return RequiredError("A subcommand");
         }
-        return RequiredError("Requires at least " + std::to_string(min_subcom) + " subcommands",
-                             ExitCodes::RequiredError);
+        return {"Requires at least " + std::to_string(min_subcom) + " subcommands", ExitCodes::RequiredError};
     }
     static RequiredError
     Option(std::size_t min_option, std::size_t max_option, std::size_t used, const std::string &option_list) {
         if((min_option == 1) && (max_option == 1) && (used == 0))
             return RequiredError("Exactly 1 option from [" + option_list + "]");
         if((min_option == 1) && (max_option == 1) && (used > 1)) {
-            return RequiredError("Exactly 1 option from [" + option_list + "] is required and " + std::to_string(used) +
-                                 " were given",
-                                 ExitCodes::RequiredError);
+            return {"Exactly 1 option from [" + option_list + "] is required but " + std::to_string(used) +
+                        " were given",
+                    ExitCodes::RequiredError};
         }
         if((min_option == 1) && (used == 0))
             return RequiredError("At least 1 option from [" + option_list + "]");
         if(used < min_option) {
-            return RequiredError("Requires at least " + std::to_string(min_option) + " options used and only " +
-                                 std::to_string(used) + "were given from [" + option_list + "]",
-                                 ExitCodes::RequiredError);
+            return {"Requires at least " + std::to_string(min_option) + " options used but only " +
+                        std::to_string(used) + " were given from [" + option_list + "]",
+                    ExitCodes::RequiredError};
         }
         if(max_option == 1)
-            return RequiredError("Requires at most 1 options be given from [" + option_list + "]",
-                                 ExitCodes::RequiredError);
+            return {"Requires at most 1 options be given from [" + option_list + "]", ExitCodes::RequiredError};
 
-        return RequiredError("Requires at most " + std::to_string(max_option) + " options be used and " +
-                             std::to_string(used) + "were given from [" + option_list + "]",
-                             ExitCodes::RequiredError);
+        return {"Requires at most " + std::to_string(max_option) + " options be used but " + std::to_string(used) +
+                    " were given from [" + option_list + "]",
+                ExitCodes::RequiredError};
     }
 };
 
 /// Thrown when the wrong number of arguments has been received
 class ArgumentMismatch : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ArgumentMismatch)
+    CLI11_ERROR_DEF(ParseError, ArgumentMismatch)
     CLI11_ERROR_SIMPLE(ArgumentMismatch)
     ArgumentMismatch(std::string name, int expected, std::size_t received)
         : ArgumentMismatch(expected > 0 ? ("Expected exactly " + std::to_string(expected) + " arguments to " + name +
@@ -777,41 +1496,45 @@ class ArgumentMismatch : public ParseError {
     static ArgumentMismatch FlagOverride(std::string name) {
         return ArgumentMismatch(name + " was given a disallowed flag override");
     }
+    static ArgumentMismatch PartialType(std::string name, int num, std::string type) {
+        return ArgumentMismatch(name + ": " + type + " only partially specified: " + std::to_string(num) +
+                                " required for each element");
+    }
 };
 
 /// Thrown when a requires option is missing
 class RequiresError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, RequiresError)
+    CLI11_ERROR_DEF(ParseError, RequiresError)
     RequiresError(std::string curname, std::string subname)
         : RequiresError(curname + " requires " + subname, ExitCodes::RequiresError) {}
 };
 
 /// Thrown when an excludes option is present
 class ExcludesError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ExcludesError)
+    CLI11_ERROR_DEF(ParseError, ExcludesError)
     ExcludesError(std::string curname, std::string subname)
         : ExcludesError(curname + " excludes " + subname, ExitCodes::ExcludesError) {}
 };
 
 /// Thrown when too many positionals or options are found
 class ExtrasError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ExtrasError)
+    CLI11_ERROR_DEF(ParseError, ExtrasError)
     explicit ExtrasError(std::vector<std::string> args)
         : ExtrasError((args.size() > 1 ? "The following arguments were not expected: "
                                        : "The following argument was not expected: ") +
-                      detail::rjoin(args, " "),
+                          detail::rjoin(args, " "),
                       ExitCodes::ExtrasError) {}
     ExtrasError(const std::string &name, std::vector<std::string> args)
         : ExtrasError(name,
                       (args.size() > 1 ? "The following arguments were not expected: "
                                        : "The following argument was not expected: ") +
-                      detail::rjoin(args, " "),
+                          detail::rjoin(args, " "),
                       ExitCodes::ExtrasError) {}
 };
 
 /// Thrown when extra values are found in an INI file
 class ConfigError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, ConfigError)
+    CLI11_ERROR_DEF(ParseError, ConfigError)
     CLI11_ERROR_SIMPLE(ConfigError)
     static ConfigError Extras(std::string item) { return ConfigError("INI was not able to parse " + item); }
     static ConfigError NotConfigurable(std::string item) {
@@ -821,7 +1544,7 @@ class ConfigError : public ParseError {
 
 /// Thrown when validation fails before parsing
 class InvalidError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, InvalidError)
+    CLI11_ERROR_DEF(ParseError, InvalidError)
     explicit InvalidError(std::string name)
         : InvalidError(name + ": Too many positional arguments with unlimited expected args", ExitCodes::InvalidError) {
     }
@@ -830,7 +1553,7 @@ class InvalidError : public ParseError {
 /// This is just a safety check to verify selection and parsing match - you should not ever see it
 /// Strings are directly added to this error, but again, it should never be seen.
 class HorribleError : public ParseError {
-  CLI11_ERROR_DEF(ParseError, HorribleError)
+    CLI11_ERROR_DEF(ParseError, HorribleError)
     CLI11_ERROR_SIMPLE(HorribleError)
 };
 
@@ -838,7 +1561,7 @@ class HorribleError : public ParseError {
 
 /// Thrown when counting a non-existent option
 class OptionNotFound : public Error {
-  CLI11_ERROR_DEF(Error, OptionNotFound)
+    CLI11_ERROR_DEF(Error, OptionNotFound)
     explicit OptionNotFound(std::string name) : OptionNotFound(name + " not found", ExitCodes::OptionNotFound) {}
 };
 
@@ -847,11 +1570,8 @@ class OptionNotFound : public Error {
 
 /// @}
 
-}  // namespace CLI
 
-// From TypeTools.hpp:
 
-namespace CLI {
 
 // Type tools
 
@@ -868,12 +1588,14 @@ constexpr enabler dummy = {};
 /// A copy of enable_if_t from C++14, compatible with C++11.
 ///
 /// We could check to see if C++14 is being used, but it does not hurt to redefine this
-/// (even Google does this: https://github.com/google/skia/blob/master/include/private/SkTLogic.h)
+/// (even Google does this: https://github.com/google/skia/blob/main/include/private/SkTLogic.h)
 /// It is not in the std namespace anyway, so no harm done.
 template <bool B, class T = void> using enable_if_t = typename std::enable_if<B, T>::type;
 
 /// A copy of std::void_t from C++17 (helper for C++11 and C++14)
-template <typename... Ts> struct make_void { using type = void; };
+template <typename... Ts> struct make_void {
+    using type = void;
+};
 
 /// A copy of std::void_t from C++17 - same reasoning as enable_if_t, it does not hurt to redefine
 template <typename... Ts> using void_t = typename make_void<Ts...>::type;
@@ -881,15 +1603,6 @@ template <typename... Ts> using void_t = typename make_void<Ts...>::type;
 /// A copy of std::conditional_t from C++14 - same reasoning as enable_if_t, it does not hurt to redefine
 template <bool B, class T, class F> using conditional_t = typename std::conditional<B, T, F>::type;
 
-/// Check to see if something is a vector (fail check by default)
-template <typename T> struct is_vector : std::false_type {};
-
-/// Check to see if something is a vector (true if actually a vector)
-template <class T, class A> struct is_vector<std::vector<T, A>> : std::true_type {};
-
-/// Check to see if something is a vector (true if actually a const vector)
-template <class T, class A> struct is_vector<const std::vector<T, A>> : std::true_type {};
-
 /// Check to see if something is bool (fail check by default)
 template <typename T> struct is_bool : std::false_type {};
 
@@ -911,10 +1624,31 @@ template <typename T> struct is_copyable_ptr {
 };
 
 /// This can be specialized to override the type deduction for IsMember.
-template <typename T> struct IsMemberType { using type = T; };
+template <typename T> struct IsMemberType {
+    using type = T;
+};
 
 /// The main custom type needed here is const char * should be a string.
-template <> struct IsMemberType<const char *> { using type = std::string; };
+template <> struct IsMemberType<const char *> {
+    using type = std::string;
+};
+
+namespace adl_detail {
+/// Check for existence of user-supplied lexical_cast.
+///
+/// This struct has to be in a separate namespace so that it doesn't see our lexical_cast overloads in CLI::detail.
+/// Standard says it shouldn't see them if it's defined before the corresponding lexical_cast declarations, but this
+/// requires a working implementation of two-phase lookup, and not all compilers can boast that (msvc, ahem).
+template <typename T, typename S = std::string> class is_lexical_castable {
+    template <typename TT, typename SS>
+    static auto test(int) -> decltype(lexical_cast(std::declval<const SS &>(), std::declval<TT &>()), std::true_type());
+
+    template <typename, typename> static auto test(...) -> std::false_type;
+
+  public:
+    static constexpr bool value = decltype(test<T, S>(0))::value;
+};
+}  // namespace adl_detail
 
 namespace detail {
 
@@ -924,7 +1658,9 @@ namespace detail {
 /// pointer_traits<T> be valid.
 
 /// not a pointer
-template <typename T, typename Enable = void> struct element_type { using type = T; };
+template <typename T, typename Enable = void> struct element_type {
+    using type = T;
+};
 
 template <typename T> struct element_type<T, typename std::enable_if<is_copyable_ptr<T>::value>::type> {
     using type = typename std::pointer_traits<T>::element_type;
@@ -932,7 +1668,9 @@ template <typename T> struct element_type<T, typename std::enable_if<is_copyable
 
 /// Combination of the element type and value type - remove pointer (including smart pointers) and get the value_type of
 /// the container
-template <typename T> struct element_value_type { using type = typename element_type<T>::type::value_type; };
+template <typename T> struct element_value_type {
+    using type = typename element_type<T>::type::value_type;
+};
 
 /// Adaptor for set-like structure: This just wraps a normal container in a few utilities that do almost nothing.
 template <typename T, typename _ = void> struct pair_adaptor : std::false_type {
@@ -987,14 +1725,22 @@ template <typename T, typename C> class is_direct_constructible {
     static auto test(int, std::true_type) -> decltype(
 // NVCC warns about narrowing conversions here
 #ifdef __CUDACC__
+#ifdef __NVCC_DIAG_PRAGMA_SUPPORT__
+#pragma nv_diag_suppress 2361
+#else
 #pragma diag_suppress 2361
 #endif
-    TT { std::declval<CC>() }
+#endif
+                                              TT{std::declval<CC>()}
 #ifdef __CUDACC__
+#ifdef __NVCC_DIAG_PRAGMA_SUPPORT__
+#pragma nv_diag_default 2361
+#else
 #pragma diag_default 2361
 #endif
-        ,
-        std::is_move_assignable<TT>());
+#endif
+                                              ,
+                                              std::is_move_assignable<TT>());
 
     template <typename TT, typename CC> static auto test(int, std::false_type) -> std::false_type;
 
@@ -1031,6 +1777,17 @@ template <typename T, typename S = std::istringstream> class is_istreamable {
     static constexpr bool value = decltype(test<T, S>(0))::value;
 };
 
+/// Check for complex
+template <typename T> class is_complex {
+    template <typename TT>
+    static auto test(int) -> decltype(std::declval<TT>().real(), std::declval<TT>().imag(), std::true_type());
+
+    template <typename> static auto test(...) -> std::false_type;
+
+  public:
+    static constexpr bool value = decltype(test<T>(0))::value;
+};
+
 /// Templated operation to get a value from a stream
 template <typename T, enable_if_t<is_istreamable<T>::value, detail::enabler> = detail::dummy>
 bool from_stream(const std::string &istring, T &obj) {
@@ -1045,12 +1802,51 @@ bool from_stream(const std::string & /*istring*/, T & /*obj*/) {
     return false;
 }
 
+// check to see if an object is a mutable container (fail by default)
+template <typename T, typename _ = void> struct is_mutable_container : std::false_type {};
+
+/// type trait to test if a type is a mutable container meaning it has a value_type, it has an iterator, a clear, and
+/// end methods and an insert function.  And for our purposes we exclude std::string and types that can be constructed
+/// from a std::string
+template <typename T>
+struct is_mutable_container<
+    T,
+    conditional_t<false,
+                  void_t<typename T::value_type,
+                         decltype(std::declval<T>().end()),
+                         decltype(std::declval<T>().clear()),
+                         decltype(std::declval<T>().insert(std::declval<decltype(std::declval<T>().end())>(),
+                                                           std::declval<const typename T::value_type &>()))>,
+                  void>> : public conditional_t<std::is_constructible<T, std::string>::value ||
+                                                    std::is_constructible<T, std::wstring>::value,
+                                                std::false_type,
+                                                std::true_type> {};
+
+// check to see if an object is a mutable container (fail by default)
+template <typename T, typename _ = void> struct is_readable_container : std::false_type {};
+
+/// type trait to test if a type is a container meaning it has a value_type, it has an iterator, a clear, and an end
+/// methods and an insert function.  And for our purposes we exclude std::string and types that can be constructed from
+/// a std::string
+template <typename T>
+struct is_readable_container<
+    T,
+    conditional_t<false, void_t<decltype(std::declval<T>().end()), decltype(std::declval<T>().begin())>, void>>
+    : public std::true_type {};
+
+// check to see if an object is a wrapper (fail by default)
+template <typename T, typename _ = void> struct is_wrapper : std::false_type {};
+
+// check if an object is a wrapper (it has a value_type defined)
+template <typename T>
+struct is_wrapper<T, conditional_t<false, void_t<typename T::value_type>, void>> : public std::true_type {};
+
 // Check for tuple like types, as in classes with a tuple_size type trait
 template <typename S> class is_tuple_like {
     template <typename SS>
     // static auto test(int)
     //     -> decltype(std::conditional<(std::tuple_size<SS>::value > 0), std::true_type, std::false_type>::type());
-    static auto test(int) -> decltype(std::tuple_size<SS>::value, std::true_type{});
+    static auto test(int) -> decltype(std::tuple_size<typename std::decay<SS>::type>::value, std::true_type{});
     template <typename> static auto test(...) -> std::false_type;
 
   public:
@@ -1065,17 +1861,17 @@ auto to_string(T &&value) -> decltype(std::forward<T>(value)) {
 
 /// Construct a string from the object
 template <typename T,
-    enable_if_t<std::is_constructible<std::string, T>::value && !std::is_convertible<T, std::string>::value,
-        detail::enabler> = detail::dummy>
+          enable_if_t<std::is_constructible<std::string, T>::value && !std::is_convertible<T, std::string>::value,
+                      detail::enabler> = detail::dummy>
 std::string to_string(const T &value) {
-    return std::string(value);
+    return std::string(value);  // NOLINT(google-readability-casting)
 }
 
 /// Convert an object to a string (streaming must be supported for that type)
 template <typename T,
-    enable_if_t<!std::is_convertible<std::string, T>::value && !std::is_constructible<std::string, T>::value &&
-                is_ostreamable<T>::value,
-        detail::enabler> = detail::dummy>
+          enable_if_t<!std::is_convertible<std::string, T>::value && !std::is_constructible<std::string, T>::value &&
+                          is_ostreamable<T>::value,
+                      detail::enabler> = detail::dummy>
 std::string to_string(T &&value) {
     std::stringstream stream;
     stream << value;
@@ -1084,44 +1880,46 @@ std::string to_string(T &&value) {
 
 /// If conversion is not supported, return an empty string (streaming is not supported for that type)
 template <typename T,
-    enable_if_t<!std::is_constructible<std::string, T>::value && !is_ostreamable<T>::value &&
-                !is_vector<typename std::remove_reference<typename std::remove_const<T>::type>::type>::value,
-        detail::enabler> = detail::dummy>
+          enable_if_t<!std::is_constructible<std::string, T>::value && !is_ostreamable<T>::value &&
+                          !is_readable_container<typename std::remove_const<T>::type>::value,
+                      detail::enabler> = detail::dummy>
 std::string to_string(T &&) {
-    return std::string{};
+    return {};
 }
 
-/// convert a vector to a string
+/// convert a readable container to a string
 template <typename T,
-    enable_if_t<!std::is_constructible<std::string, T>::value && !is_ostreamable<T>::value &&
-                is_vector<typename std::remove_reference<typename std::remove_const<T>::type>::type>::value,
-        detail::enabler> = detail::dummy>
+          enable_if_t<!std::is_constructible<std::string, T>::value && !is_ostreamable<T>::value &&
+                          is_readable_container<T>::value,
+                      detail::enabler> = detail::dummy>
 std::string to_string(T &&variable) {
-    std::vector<std::string> defaults;
-    defaults.reserve(variable.size());
     auto cval = variable.begin();
     auto end = variable.end();
+    if(cval == end) {
+        return {"{}"};
+    }
+    std::vector<std::string> defaults;
     while(cval != end) {
         defaults.emplace_back(CLI::detail::to_string(*cval));
         ++cval;
     }
-    return std::string("[" + detail::join(defaults) + "]");
+    return {"[" + detail::join(defaults) + "]"};
 }
 
 /// special template overload
 template <typename T1,
-    typename T2,
-    typename T,
-    enable_if_t<std::is_same<T1, T2>::value, detail::enabler> = detail::dummy>
+          typename T2,
+          typename T,
+          enable_if_t<std::is_same<T1, T2>::value, detail::enabler> = detail::dummy>
 auto checked_to_string(T &&value) -> decltype(to_string(std::forward<T>(value))) {
     return to_string(std::forward<T>(value));
 }
 
 /// special template overload
 template <typename T1,
-    typename T2,
-    typename T,
-    enable_if_t<!std::is_same<T1, T2>::value, detail::enabler> = detail::dummy>
+          typename T2,
+          typename T,
+          enable_if_t<!std::is_same<T1, T2>::value, detail::enabler> = detail::dummy>
 std::string checked_to_string(T &&) {
     return std::string{};
 }
@@ -1137,85 +1935,235 @@ std::string value_string(const T &value) {
 }
 /// for other types just use the regular to_string function
 template <typename T,
-    enable_if_t<!std::is_enum<T>::value && !std::is_arithmetic<T>::value, detail::enabler> = detail::dummy>
+          enable_if_t<!std::is_enum<T>::value && !std::is_arithmetic<T>::value, detail::enabler> = detail::dummy>
 auto value_string(const T &value) -> decltype(to_string(value)) {
     return to_string(value);
 }
 
-/// This will only trigger for actual void type
-template <typename T, typename Enable = void> struct type_count { static const int value{0}; };
+/// template to get the underlying value type if it exists or use a default
+template <typename T, typename def, typename Enable = void> struct wrapped_type {
+    using type = def;
+};
 
-/// Set of overloads to get the type size of an object
-template <typename T> struct type_count<T, typename std::enable_if<is_tuple_like<T>::value>::type> {
-    static constexpr int value{std::tuple_size<T>::value};
+/// Type size for regular object types that do not look like a tuple
+template <typename T, typename def> struct wrapped_type<T, def, typename std::enable_if<is_wrapper<T>::value>::type> {
+    using type = typename T::value_type;
+};
+
+/// This will only trigger for actual void type
+template <typename T, typename Enable = void> struct type_count_base {
+    static const int value{0};
 };
+
 /// Type size for regular object types that do not look like a tuple
 template <typename T>
-struct type_count<
-    T,
-    typename std::enable_if<!is_vector<T>::value && !is_tuple_like<T>::value && !std::is_void<T>::value>::type> {
+struct type_count_base<T,
+                       typename std::enable_if<!is_tuple_like<T>::value && !is_mutable_container<T>::value &&
+                                               !std::is_void<T>::value>::type> {
     static constexpr int value{1};
 };
 
-/// Type size of types that look like a vector
-template <typename T> struct type_count<T, typename std::enable_if<is_vector<T>::value>::type> {
-    static constexpr int value{is_vector<typename T::value_type>::value ? expected_max_vector_size
-                                                                        : type_count<typename T::value_type>::value};
+/// the base tuple size
+template <typename T>
+struct type_count_base<T, typename std::enable_if<is_tuple_like<T>::value && !is_mutable_container<T>::value>::type> {
+    static constexpr int value{std::tuple_size<T>::value};
+};
+
+/// Type count base for containers is the type_count_base of the individual element
+template <typename T> struct type_count_base<T, typename std::enable_if<is_mutable_container<T>::value>::type> {
+    static constexpr int value{type_count_base<typename T::value_type>::value};
 };
 
+/// Set of overloads to get the type size of an object
+
+/// forward declare the subtype_count structure
+template <typename T> struct subtype_count;
+
+/// forward declare the subtype_count_min structure
+template <typename T> struct subtype_count_min;
+
 /// This will only trigger for actual void type
-template <typename T, typename Enable = void> struct expected_count { static const int value{0}; };
+template <typename T, typename Enable = void> struct type_count {
+    static const int value{0};
+};
 
-/// For most types the number of expected items is 1
+/// Type size for regular object types that do not look like a tuple
 template <typename T>
-struct expected_count<T, typename std::enable_if<!is_vector<T>::value && !std::is_void<T>::value>::type> {
+struct type_count<T,
+                  typename std::enable_if<!is_wrapper<T>::value && !is_tuple_like<T>::value && !is_complex<T>::value &&
+                                          !std::is_void<T>::value>::type> {
     static constexpr int value{1};
 };
-/// number of expected items in a vector
-template <typename T> struct expected_count<T, typename std::enable_if<is_vector<T>::value>::type> {
-    static constexpr int value{expected_max_vector_size};
+
+/// Type size for complex since it sometimes looks like a wrapper
+template <typename T> struct type_count<T, typename std::enable_if<is_complex<T>::value>::type> {
+    static constexpr int value{2};
 };
 
-// Enumeration of the different supported categorizations of objects
-enum class object_category : int {
-    integral_value = 2,
-    unsigned_integral = 4,
+/// Type size of types that are wrappers,except complex and tuples(which can also be wrappers sometimes)
+template <typename T> struct type_count<T, typename std::enable_if<is_mutable_container<T>::value>::type> {
+    static constexpr int value{subtype_count<typename T::value_type>::value};
+};
+
+/// Type size of types that are wrappers,except containers complex and tuples(which can also be wrappers sometimes)
+template <typename T>
+struct type_count<T,
+                  typename std::enable_if<is_wrapper<T>::value && !is_complex<T>::value && !is_tuple_like<T>::value &&
+                                          !is_mutable_container<T>::value>::type> {
+    static constexpr int value{type_count<typename T::value_type>::value};
+};
+
+/// 0 if the index > tuple size
+template <typename T, std::size_t I>
+constexpr typename std::enable_if<I == type_count_base<T>::value, int>::type tuple_type_size() {
+    return 0;
+}
+
+/// Recursively generate the tuple type name
+template <typename T, std::size_t I>
+    constexpr typename std::enable_if < I<type_count_base<T>::value, int>::type tuple_type_size() {
+    return subtype_count<typename std::tuple_element<I, T>::type>::value + tuple_type_size<T, I + 1>();
+}
+
+/// Get the type size of the sum of type sizes for all the individual tuple types
+template <typename T> struct type_count<T, typename std::enable_if<is_tuple_like<T>::value>::type> {
+    static constexpr int value{tuple_type_size<T, 0>()};
+};
+
+/// definition of subtype count
+template <typename T> struct subtype_count {
+    static constexpr int value{is_mutable_container<T>::value ? expected_max_vector_size : type_count<T>::value};
+};
+
+/// This will only trigger for actual void type
+template <typename T, typename Enable = void> struct type_count_min {
+    static const int value{0};
+};
+
+/// Type size for regular object types that do not look like a tuple
+template <typename T>
+struct type_count_min<
+    T,
+    typename std::enable_if<!is_mutable_container<T>::value && !is_tuple_like<T>::value && !is_wrapper<T>::value &&
+                            !is_complex<T>::value && !std::is_void<T>::value>::type> {
+    static constexpr int value{type_count<T>::value};
+};
+
+/// Type size for complex since it sometimes looks like a wrapper
+template <typename T> struct type_count_min<T, typename std::enable_if<is_complex<T>::value>::type> {
+    static constexpr int value{1};
+};
+
+/// Type size min of types that are wrappers,except complex and tuples(which can also be wrappers sometimes)
+template <typename T>
+struct type_count_min<
+    T,
+    typename std::enable_if<is_wrapper<T>::value && !is_complex<T>::value && !is_tuple_like<T>::value>::type> {
+    static constexpr int value{subtype_count_min<typename T::value_type>::value};
+};
+
+/// 0 if the index > tuple size
+template <typename T, std::size_t I>
+constexpr typename std::enable_if<I == type_count_base<T>::value, int>::type tuple_type_size_min() {
+    return 0;
+}
+
+/// Recursively generate the tuple type name
+template <typename T, std::size_t I>
+    constexpr typename std::enable_if < I<type_count_base<T>::value, int>::type tuple_type_size_min() {
+    return subtype_count_min<typename std::tuple_element<I, T>::type>::value + tuple_type_size_min<T, I + 1>();
+}
+
+/// Get the type size of the sum of type sizes for all the individual tuple types
+template <typename T> struct type_count_min<T, typename std::enable_if<is_tuple_like<T>::value>::type> {
+    static constexpr int value{tuple_type_size_min<T, 0>()};
+};
+
+/// definition of subtype count
+template <typename T> struct subtype_count_min {
+    static constexpr int value{is_mutable_container<T>::value
+                                   ? ((type_count<T>::value < expected_max_vector_size) ? type_count<T>::value : 0)
+                                   : type_count_min<T>::value};
+};
+
+/// This will only trigger for actual void type
+template <typename T, typename Enable = void> struct expected_count {
+    static const int value{0};
+};
+
+/// For most types the number of expected items is 1
+template <typename T>
+struct expected_count<T,
+                      typename std::enable_if<!is_mutable_container<T>::value && !is_wrapper<T>::value &&
+                                              !std::is_void<T>::value>::type> {
+    static constexpr int value{1};
+};
+/// number of expected items in a vector
+template <typename T> struct expected_count<T, typename std::enable_if<is_mutable_container<T>::value>::type> {
+    static constexpr int value{expected_max_vector_size};
+};
+
+/// number of expected items in a vector
+template <typename T>
+struct expected_count<T, typename std::enable_if<!is_mutable_container<T>::value && is_wrapper<T>::value>::type> {
+    static constexpr int value{expected_count<typename T::value_type>::value};
+};
+
+// Enumeration of the different supported categorizations of objects
+enum class object_category : int {
+    char_value = 1,
+    integral_value = 2,
+    unsigned_integral = 4,
     enumeration = 6,
     boolean_value = 8,
     floating_point = 10,
     number_constructible = 12,
     double_constructible = 14,
     integer_constructible = 16,
-    vector_value = 30,
-    tuple_value = 35,
-    // string assignable or greater used in a condition so anything string like must come last
-    string_assignable = 50,
-    string_constructible = 60,
-    other = 200,
+    // string like types
+    string_assignable = 23,
+    string_constructible = 24,
+    wstring_assignable = 25,
+    wstring_constructible = 26,
+    other = 45,
+    // special wrapper or container types
+    wrapper_value = 50,
+    complex_number = 60,
+    tuple_value = 70,
+    container_value = 80,
 
 };
 
+/// Set of overloads to classify an object according to type
+
 /// some type that is not otherwise recognized
 template <typename T, typename Enable = void> struct classify_object {
     static constexpr object_category value{object_category::other};
 };
 
-/// Set of overloads to classify an object according to type
+/// Signed integers
 template <typename T>
-struct classify_object<T,
-    typename std::enable_if<std::is_integral<T>::value && std::is_signed<T>::value &&
+struct classify_object<
+    T,
+    typename std::enable_if<std::is_integral<T>::value && !std::is_same<T, char>::value && std::is_signed<T>::value &&
                             !is_bool<T>::value && !std::is_enum<T>::value>::type> {
     static constexpr object_category value{object_category::integral_value};
 };
 
 /// Unsigned integers
 template <typename T>
-struct classify_object<
-    T,
-    typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value && !is_bool<T>::value>::type> {
+struct classify_object<T,
+                       typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value &&
+                                               !std::is_same<T, char>::value && !is_bool<T>::value>::type> {
     static constexpr object_category value{object_category::unsigned_integral};
 };
 
+/// single character values
+template <typename T>
+struct classify_object<T, typename std::enable_if<std::is_same<T, char>::value && !std::is_enum<T>::value>::type> {
+    static constexpr object_category value{object_category::char_value};
+};
+
 /// Boolean values
 template <typename T> struct classify_object<T, typename std::enable_if<is_bool<T>::value>::type> {
     static constexpr object_category value{object_category::boolean_value};
@@ -1225,13 +2173,23 @@ template <typename T> struct classify_object<T, typename std::enable_if<is_bool<
 template <typename T> struct classify_object<T, typename std::enable_if<std::is_floating_point<T>::value>::type> {
     static constexpr object_category value{object_category::floating_point};
 };
+#if defined _MSC_VER
+// in MSVC wstring should take precedence if available this isn't as useful on other compilers due to the broader use of
+// utf-8 encoding
+#define WIDE_STRING_CHECK                                                                                              \
+    !std::is_assignable<T &, std::wstring>::value && !std::is_constructible<T, std::wstring>::value
+#define STRING_CHECK true
+#else
+#define WIDE_STRING_CHECK true
+#define STRING_CHECK !std::is_assignable<T &, std::string>::value && !std::is_constructible<T, std::string>::value
+#endif
 
 /// String and similar direct assignment
 template <typename T>
 struct classify_object<
     T,
-    typename std::enable_if<!std::is_floating_point<T>::value && !std::is_integral<T>::value &&
-                            std::is_assignable<T &, std::string>::value && !is_vector<T>::value>::type> {
+    typename std::enable_if<!std::is_floating_point<T>::value && !std::is_integral<T>::value && WIDE_STRING_CHECK &&
+                            std::is_assignable<T &, std::string>::value>::type> {
     static constexpr object_category value{object_category::string_assignable};
 };
 
@@ -1240,68 +2198,105 @@ template <typename T>
 struct classify_object<
     T,
     typename std::enable_if<!std::is_floating_point<T>::value && !std::is_integral<T>::value &&
-                            !std::is_assignable<T &, std::string>::value &&
-                            std::is_constructible<T, std::string>::value && !is_vector<T>::value>::type> {
+                            !std::is_assignable<T &, std::string>::value && (type_count<T>::value == 1) &&
+                            WIDE_STRING_CHECK && std::is_constructible<T, std::string>::value>::type> {
     static constexpr object_category value{object_category::string_constructible};
 };
 
+/// Wide strings
+template <typename T>
+struct classify_object<T,
+                       typename std::enable_if<!std::is_floating_point<T>::value && !std::is_integral<T>::value &&
+                                               STRING_CHECK && std::is_assignable<T &, std::wstring>::value>::type> {
+    static constexpr object_category value{object_category::wstring_assignable};
+};
+
+template <typename T>
+struct classify_object<
+    T,
+    typename std::enable_if<!std::is_floating_point<T>::value && !std::is_integral<T>::value &&
+                            !std::is_assignable<T &, std::wstring>::value && (type_count<T>::value == 1) &&
+                            STRING_CHECK && std::is_constructible<T, std::wstring>::value>::type> {
+    static constexpr object_category value{object_category::wstring_constructible};
+};
+
 /// Enumerations
 template <typename T> struct classify_object<T, typename std::enable_if<std::is_enum<T>::value>::type> {
     static constexpr object_category value{object_category::enumeration};
 };
 
+template <typename T> struct classify_object<T, typename std::enable_if<is_complex<T>::value>::type> {
+    static constexpr object_category value{object_category::complex_number};
+};
+
 /// Handy helper to contain a bunch of checks that rule out many common types (integers, string like, floating point,
 /// vectors, and enumerations
 template <typename T> struct uncommon_type {
-    using type = typename std::conditional<!std::is_floating_point<T>::value && !std::is_integral<T>::value &&
-                                           !std::is_assignable<T &, std::string>::value &&
-                                           !std::is_constructible<T, std::string>::value && !is_vector<T>::value &&
-                                           !std::is_enum<T>::value,
+    using type = typename std::conditional<
+        !std::is_floating_point<T>::value && !std::is_integral<T>::value &&
+            !std::is_assignable<T &, std::string>::value && !std::is_constructible<T, std::string>::value &&
+            !std::is_assignable<T &, std::wstring>::value && !std::is_constructible<T, std::wstring>::value &&
+            !is_complex<T>::value && !is_mutable_container<T>::value && !std::is_enum<T>::value,
         std::true_type,
         std::false_type>::type;
     static constexpr bool value = type::value;
 };
 
+/// wrapper type
+template <typename T>
+struct classify_object<T,
+                       typename std::enable_if<(!is_mutable_container<T>::value && is_wrapper<T>::value &&
+                                                !is_tuple_like<T>::value && uncommon_type<T>::value)>::type> {
+    static constexpr object_category value{object_category::wrapper_value};
+};
+
 /// Assignable from double or int
 template <typename T>
 struct classify_object<T,
-    typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
-                            is_direct_constructible<T, double>::value &&
-                            is_direct_constructible<T, int>::value>::type> {
+                       typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
+                                               !is_wrapper<T>::value && is_direct_constructible<T, double>::value &&
+                                               is_direct_constructible<T, int>::value>::type> {
     static constexpr object_category value{object_category::number_constructible};
 };
 
 /// Assignable from int
 template <typename T>
 struct classify_object<T,
-    typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
-                            !is_direct_constructible<T, double>::value &&
-                            is_direct_constructible<T, int>::value>::type> {
+                       typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
+                                               !is_wrapper<T>::value && !is_direct_constructible<T, double>::value &&
+                                               is_direct_constructible<T, int>::value>::type> {
     static constexpr object_category value{object_category::integer_constructible};
 };
 
 /// Assignable from double
 template <typename T>
 struct classify_object<T,
-    typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
-                            is_direct_constructible<T, double>::value &&
-                            !is_direct_constructible<T, int>::value>::type> {
+                       typename std::enable_if<uncommon_type<T>::value && type_count<T>::value == 1 &&
+                                               !is_wrapper<T>::value && is_direct_constructible<T, double>::value &&
+                                               !is_direct_constructible<T, int>::value>::type> {
     static constexpr object_category value{object_category::double_constructible};
 };
 
 /// Tuple type
 template <typename T>
-struct classify_object<T,
-    typename std::enable_if<(type_count<T>::value >= 2 && !is_vector<T>::value) ||
-                            (is_tuple_like<T>::value && uncommon_type<T>::value &&
-                             !is_direct_constructible<T, double>::value &&
-                             !is_direct_constructible<T, int>::value)>::type> {
+struct classify_object<
+    T,
+    typename std::enable_if<is_tuple_like<T>::value &&
+                            ((type_count<T>::value >= 2 && !is_wrapper<T>::value) ||
+                             (uncommon_type<T>::value && !is_direct_constructible<T, double>::value &&
+                              !is_direct_constructible<T, int>::value) ||
+                             (uncommon_type<T>::value && type_count<T>::value >= 2))>::type> {
     static constexpr object_category value{object_category::tuple_value};
+    // the condition on this class requires it be like a tuple, but on some compilers (like Xcode) tuples can be
+    // constructed from just the first element so tuples of <string, int,int> can be constructed from a string, which
+    // could lead to issues so there are two variants of the condition, the first isolates things with a type size >=2
+    // mainly to get tuples on Xcode with the exception of wrappers, the second is the main one and just separating out
+    // those cases that are caught by other object classifications
 };
 
-/// Vector type
-template <typename T> struct classify_object<T, typename std::enable_if<is_vector<T>::value>::type> {
-    static constexpr object_category value{object_category::vector_value};
+/// container type
+template <typename T> struct classify_object<T, typename std::enable_if<is_mutable_container<T>::value>::type> {
+    static constexpr object_category value{object_category::container_value};
 };
 
 // Type name print
@@ -1311,67 +2306,95 @@ template <typename T> struct classify_object<T, typename std::enable_if<is_vecto
 /// But this is cleaner and works better in this case
 
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::integral_value ||
-                classify_object<T>::value == object_category::integer_constructible,
-        detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::char_value, detail::enabler> = detail::dummy>
+constexpr const char *type_name() {
+    return "CHAR";
+}
+
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::integral_value ||
+                          classify_object<T>::value == object_category::integer_constructible,
+                      detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "INT";
 }
 
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::unsigned_integral, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::unsigned_integral, detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "UINT";
 }
 
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::floating_point ||
-                classify_object<T>::value == object_category::number_constructible ||
-                classify_object<T>::value == object_category::double_constructible,
-        detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::floating_point ||
+                          classify_object<T>::value == object_category::number_constructible ||
+                          classify_object<T>::value == object_category::double_constructible,
+                      detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "FLOAT";
 }
 
 /// Print name for enumeration types
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::enumeration, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::enumeration, detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "ENUM";
 }
 
 /// Print name for enumeration types
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::boolean_value, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::boolean_value, detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "BOOLEAN";
 }
 
+/// Print name for enumeration types
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::complex_number, detail::enabler> = detail::dummy>
+constexpr const char *type_name() {
+    return "COMPLEX";
+}
+
 /// Print for all other types
 template <typename T,
-    enable_if_t<classify_object<T>::value >= object_category::string_assignable, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value >= object_category::string_assignable &&
+                          classify_object<T>::value <= object_category::other,
+                      detail::enabler> = detail::dummy>
 constexpr const char *type_name() {
     return "TEXT";
 }
+/// typename for tuple value
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::tuple_value && type_count_base<T>::value >= 2,
+                      detail::enabler> = detail::dummy>
+std::string type_name();  // forward declaration
+
+/// Generate type name for a wrapper or container value
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::container_value ||
+                          classify_object<T>::value == object_category::wrapper_value,
+                      detail::enabler> = detail::dummy>
+std::string type_name();  // forward declaration
 
 /// Print name for single element tuple types
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::tuple_value && type_count<T>::value == 1,
-        detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::tuple_value && type_count_base<T>::value == 1,
+                      detail::enabler> = detail::dummy>
 inline std::string type_name() {
-    return type_name<typename std::tuple_element<0, T>::type>();
+    return type_name<typename std::decay<typename std::tuple_element<0, T>::type>::type>();
 }
 
 /// Empty string if the index > tuple size
 template <typename T, std::size_t I>
-inline typename std::enable_if<I == type_count<T>::value, std::string>::type tuple_name() {
+inline typename std::enable_if<I == type_count_base<T>::value, std::string>::type tuple_name() {
     return std::string{};
 }
 
 /// Recursively generate the tuple type name
 template <typename T, std::size_t I>
-inline typename std::enable_if < I<type_count<T>::value, std::string>::type tuple_name() {
-    std::string str = std::string(type_name<typename std::tuple_element<I, T>::type>()) + ',' + tuple_name<T, I + 1>();
+inline typename std::enable_if<(I < type_count_base<T>::value), std::string>::type tuple_name() {
+    auto str = std::string{type_name<typename std::decay<typename std::tuple_element<I, T>::type>::type>()} + ',' +
+               tuple_name<T, I + 1>();
     if(str.back() == ',')
         str.pop_back();
     return str;
@@ -1379,25 +2402,130 @@ inline typename std::enable_if < I<type_count<T>::value, std::string>::type tupl
 
 /// Print type name for tuples with 2 or more elements
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::tuple_value && type_count<T>::value >= 2,
-        detail::enabler> = detail::dummy>
-std::string type_name() {
+          enable_if_t<classify_object<T>::value == object_category::tuple_value && type_count_base<T>::value >= 2,
+                      detail::enabler>>
+inline std::string type_name() {
     auto tname = std::string(1, '[') + tuple_name<T, 0>();
     tname.push_back(']');
     return tname;
 }
 
-/// This one should not be used normally, since vector types print the internal type
+/// get the type name for a type that has a value_type member
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::vector_value, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::container_value ||
+                          classify_object<T>::value == object_category::wrapper_value,
+                      detail::enabler>>
 inline std::string type_name() {
     return type_name<typename T::value_type>();
 }
 
 // Lexical cast
 
-/// Convert a flag into an integer value  typically binary flags
-inline std::int64_t to_flag_value(std::string val) {
+/// Convert to an unsigned integral
+template <typename T, enable_if_t<std::is_unsigned<T>::value, detail::enabler> = detail::dummy>
+bool integral_conversion(const std::string &input, T &output) noexcept {
+    if(input.empty() || input.front() == '-') {
+        return false;
+    }
+    char *val{nullptr};
+    errno = 0;
+    std::uint64_t output_ll = std::strtoull(input.c_str(), &val, 0);
+    if(errno == ERANGE) {
+        return false;
+    }
+    output = static_cast<T>(output_ll);
+    if(val == (input.c_str() + input.size()) && static_cast<std::uint64_t>(output) == output_ll) {
+        return true;
+    }
+    val = nullptr;
+    std::int64_t output_sll = std::strtoll(input.c_str(), &val, 0);
+    if(val == (input.c_str() + input.size())) {
+        output = (output_sll < 0) ? static_cast<T>(0) : static_cast<T>(output_sll);
+        return (static_cast<std::int64_t>(output) == output_sll);
+    }
+    // remove separators
+    if(input.find_first_of("_'") != std::string::npos) {
+        std::string nstring = input;
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '_'), nstring.end());
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '\''), nstring.end());
+        return integral_conversion(nstring, output);
+    }
+    if(input.compare(0, 2, "0o") == 0) {
+        val = nullptr;
+        errno = 0;
+        output_ll = std::strtoull(input.c_str() + 2, &val, 8);
+        if(errno == ERANGE) {
+            return false;
+        }
+        output = static_cast<T>(output_ll);
+        return (val == (input.c_str() + input.size()) && static_cast<std::uint64_t>(output) == output_ll);
+    }
+    if(input.compare(0, 2, "0b") == 0) {
+        val = nullptr;
+        errno = 0;
+        output_ll = std::strtoull(input.c_str() + 2, &val, 2);
+        if(errno == ERANGE) {
+            return false;
+        }
+        output = static_cast<T>(output_ll);
+        return (val == (input.c_str() + input.size()) && static_cast<std::uint64_t>(output) == output_ll);
+    }
+    return false;
+}
+
+/// Convert to a signed integral
+template <typename T, enable_if_t<std::is_signed<T>::value, detail::enabler> = detail::dummy>
+bool integral_conversion(const std::string &input, T &output) noexcept {
+    if(input.empty()) {
+        return false;
+    }
+    char *val = nullptr;
+    errno = 0;
+    std::int64_t output_ll = std::strtoll(input.c_str(), &val, 0);
+    if(errno == ERANGE) {
+        return false;
+    }
+    output = static_cast<T>(output_ll);
+    if(val == (input.c_str() + input.size()) && static_cast<std::int64_t>(output) == output_ll) {
+        return true;
+    }
+    if(input == "true") {
+        // this is to deal with a few oddities with flags and wrapper int types
+        output = static_cast<T>(1);
+        return true;
+    }
+    // remove separators
+    if(input.find_first_of("_'") != std::string::npos) {
+        std::string nstring = input;
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '_'), nstring.end());
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '\''), nstring.end());
+        return integral_conversion(nstring, output);
+    }
+    if(input.compare(0, 2, "0o") == 0) {
+        val = nullptr;
+        errno = 0;
+        output_ll = std::strtoll(input.c_str() + 2, &val, 8);
+        if(errno == ERANGE) {
+            return false;
+        }
+        output = static_cast<T>(output_ll);
+        return (val == (input.c_str() + input.size()) && static_cast<std::int64_t>(output) == output_ll);
+    }
+    if(input.compare(0, 2, "0b") == 0) {
+        val = nullptr;
+        errno = 0;
+        output_ll = std::strtoll(input.c_str() + 2, &val, 2);
+        if(errno == ERANGE) {
+            return false;
+        }
+        output = static_cast<T>(output_ll);
+        return (val == (input.c_str() + input.size()) && static_cast<std::int64_t>(output) == output_ll);
+    }
+    return false;
+}
+
+/// Convert a flag into an integer value  typically binary flags sets errno to nonzero if conversion failed
+inline std::int64_t to_flag_value(std::string val) noexcept {
     static const std::string trueString("true");
     static const std::string falseString("false");
     if(val == trueString) {
@@ -1407,7 +2535,7 @@ inline std::int64_t to_flag_value(std::string val) {
         return -1;
     }
     val = detail::to_lower(val);
-    std::int64_t ret;
+    std::int64_t ret = 0;
     if(val.size() == 1) {
         if(val[0] >= '1' && val[0] <= '9') {
             return (static_cast<std::int64_t>(val[0]) - '0');
@@ -1425,7 +2553,8 @@ inline std::int64_t to_flag_value(std::string val) {
             ret = 1;
             break;
         default:
-            throw std::invalid_argument("unrecognized character");
+            errno = EINVAL;
+            return -1;
         }
         return ret;
     }
@@ -1434,82 +2563,109 @@ inline std::int64_t to_flag_value(std::string val) {
     } else if(val == falseString || val == "off" || val == "no" || val == "disable") {
         ret = -1;
     } else {
-        ret = std::stoll(val);
+        char *loc_ptr{nullptr};
+        ret = std::strtoll(val.c_str(), &loc_ptr, 0);
+        if(loc_ptr != (val.c_str() + val.size()) && errno == 0) {
+            errno = EINVAL;
+        }
     }
     return ret;
 }
 
-/// Signed integers
+/// Integer conversion
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::integral_value, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::integral_value ||
+                          classify_object<T>::value == object_category::unsigned_integral,
+                      detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    try {
-        std::size_t n = 0;
-        std::int64_t output_ll = std::stoll(input, &n, 0);
-        output = static_cast<T>(output_ll);
-        return n == input.size() && static_cast<std::int64_t>(output) == output_ll;
-    } catch(const std::invalid_argument &) {
-        return false;
-    } catch(const std::out_of_range &) {
-        return false;
-    }
+    return integral_conversion(input, output);
 }
 
-/// Unsigned integers
+/// char values
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::unsigned_integral, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::char_value, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    if(!input.empty() && input.front() == '-')
-        return false;  // std::stoull happily converts negative values to junk without any errors.
-
-    try {
-        std::size_t n = 0;
-        std::uint64_t output_ll = std::stoull(input, &n, 0);
-        output = static_cast<T>(output_ll);
-        return n == input.size() && static_cast<std::uint64_t>(output) == output_ll;
-    } catch(const std::invalid_argument &) {
-        return false;
-    } catch(const std::out_of_range &) {
-        return false;
+    if(input.size() == 1) {
+        output = static_cast<T>(input[0]);
+        return true;
     }
+    return integral_conversion(input, output);
 }
 
 /// Boolean values
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::boolean_value, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::boolean_value, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    try {
-        auto out = to_flag_value(input);
+    errno = 0;
+    auto out = to_flag_value(input);
+    if(errno == 0) {
         output = (out > 0);
-        return true;
-    } catch(const std::invalid_argument &) {
-        return false;
-    } catch(const std::out_of_range &) {
-        // if the number is out of the range of a 64 bit value then it is still a number and for this purpose is still
-        // valid all we care about the sign
+    } else if(errno == ERANGE) {
         output = (input[0] != '-');
-        return true;
+    } else {
+        return false;
     }
+    return true;
 }
 
 /// Floats
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::floating_point, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::floating_point, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    try {
-        std::size_t n = 0;
-        output = static_cast<T>(std::stold(input, &n));
-        return n == input.size();
-    } catch(const std::invalid_argument &) {
-        return false;
-    } catch(const std::out_of_range &) {
+    if(input.empty()) {
         return false;
     }
+    char *val = nullptr;
+    auto output_ld = std::strtold(input.c_str(), &val);
+    output = static_cast<T>(output_ld);
+    if(val == (input.c_str() + input.size())) {
+        return true;
+    }
+    // remove separators
+    if(input.find_first_of("_'") != std::string::npos) {
+        std::string nstring = input;
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '_'), nstring.end());
+        nstring.erase(std::remove(nstring.begin(), nstring.end(), '\''), nstring.end());
+        return lexical_cast(nstring, output);
+    }
+    return false;
+}
+
+/// complex
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::complex_number, detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    using XC = typename wrapped_type<T, double>::type;
+    XC x{0.0}, y{0.0};
+    auto str1 = input;
+    bool worked = false;
+    auto nloc = str1.find_last_of("+-");
+    if(nloc != std::string::npos && nloc > 0) {
+        worked = lexical_cast(str1.substr(0, nloc), x);
+        str1 = str1.substr(nloc);
+        if(str1.back() == 'i' || str1.back() == 'j')
+            str1.pop_back();
+        worked = worked && lexical_cast(str1, y);
+    } else {
+        if(str1.back() == 'i' || str1.back() == 'j') {
+            str1.pop_back();
+            worked = lexical_cast(str1, y);
+            x = XC{0};
+        } else {
+            worked = lexical_cast(str1, x);
+            y = XC{0};
+        }
+    }
+    if(worked) {
+        output = T{x, y};
+        return worked;
+    }
+    return from_stream(input, output);
 }
 
 /// String and similar direct assignment
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::string_assignable, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::string_assignable, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
     output = input;
     return true;
@@ -1524,35 +2680,79 @@ bool lexical_cast(const std::string &input, T &output) {
     return true;
 }
 
+/// Wide strings
+template <
+    typename T,
+    enable_if_t<classify_object<T>::value == object_category::wstring_assignable, detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    output = widen(input);
+    return true;
+}
+
+template <
+    typename T,
+    enable_if_t<classify_object<T>::value == object_category::wstring_constructible, detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    output = T{widen(input)};
+    return true;
+}
+
 /// Enumerations
 template <typename T,
-    enable_if_t<classify_object<T>::value == object_category::enumeration, detail::enabler> = detail::dummy>
+          enable_if_t<classify_object<T>::value == object_category::enumeration, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
     typename std::underlying_type<T>::type val;
-    bool retval = detail::lexical_cast(input, val);
-    if(!retval) {
+    if(!integral_conversion(input, val)) {
         return false;
     }
     output = static_cast<T>(val);
     return true;
 }
 
+/// wrapper types
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::wrapper_value &&
+                          std::is_assignable<T &, typename T::value_type>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    typename T::value_type val;
+    if(lexical_cast(input, val)) {
+        output = val;
+        return true;
+    }
+    return from_stream(input, output);
+}
+
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::wrapper_value &&
+                          !std::is_assignable<T &, typename T::value_type>::value && std::is_assignable<T &, T>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    typename T::value_type val;
+    if(lexical_cast(input, val)) {
+        output = T{val};
+        return true;
+    }
+    return from_stream(input, output);
+}
+
 /// Assignable from double or int
 template <
     typename T,
     enable_if_t<classify_object<T>::value == object_category::number_constructible, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    int val;
-    if(lexical_cast(input, val)) {
+    int val = 0;
+    if(integral_conversion(input, val)) {
         output = T(val);
         return true;
-    } else {
-        double dval;
-        if(lexical_cast(input, dval)) {
-            output = T{dval};
-            return true;
-        }
     }
+
+    double dval = 0.0;
+    if(lexical_cast(input, dval)) {
+        output = T{dval};
+        return true;
+    }
+
     return from_stream(input, output);
 }
 
@@ -1561,8 +2761,8 @@ template <
     typename T,
     enable_if_t<classify_object<T>::value == object_category::integer_constructible, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    int val;
-    if(lexical_cast(input, val)) {
+    int val = 0;
+    if(integral_conversion(input, val)) {
         output = T(val);
         return true;
     }
@@ -1574,7 +2774,7 @@ template <
     typename T,
     enable_if_t<classify_object<T>::value == object_category::double_constructible, detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    double val;
+    double val = 0.0;
     if(lexical_cast(input, val)) {
         output = T{val};
         return true;
@@ -1582,277 +2782,559 @@ bool lexical_cast(const std::string &input, T &output) {
     return from_stream(input, output);
 }
 
+/// Non-string convertible from an int
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::other && std::is_assignable<T &, int>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string &input, T &output) {
+    int val = 0;
+    if(integral_conversion(input, val)) {
+#ifdef _MSC_VER
+#pragma warning(push)
+#pragma warning(disable : 4800)
+#endif
+        // with Atomic<XX> this could produce a warning due to the conversion but if atomic gets here it is an old style
+        // so will most likely still work
+        output = val;
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
+        return true;
+    }
+    // LCOV_EXCL_START
+    // This version of cast is only used for odd cases in an older compilers the fail over
+    // from_stream is tested elsewhere an not relevant for coverage here
+    return from_stream(input, output);
+    // LCOV_EXCL_STOP
+}
+
 /// Non-string parsable by a stream
-template <typename T, enable_if_t<classify_object<T>::value == object_category::other, detail::enabler> = detail::dummy>
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::other && !std::is_assignable<T &, int>::value &&
+                          is_istreamable<T>::value,
+                      detail::enabler> = detail::dummy>
 bool lexical_cast(const std::string &input, T &output) {
-    static_assert(is_istreamable<T>::value,
+    return from_stream(input, output);
+}
+
+/// Fallback overload that prints a human-readable error for types that we don't recognize and that don't have a
+/// user-supplied lexical_cast overload.
+template <typename T,
+          enable_if_t<classify_object<T>::value == object_category::other && !std::is_assignable<T &, int>::value &&
+                          !is_istreamable<T>::value && !adl_detail::is_lexical_castable<T>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_cast(const std::string & /*input*/, T & /*output*/) {
+    static_assert(!std::is_same<T, T>::value,  // Can't just write false here.
                   "option object type must have a lexical cast overload or streaming input operator(>>) defined, if it "
                   "is convertible from another type use the add_option<T, XC>(...) with XC being the known type");
-    return from_stream(input, output);
+    return false;
 }
 
 /// Assign a value through lexical cast operations
-template <
-    typename T,
-    typename XC,
-    enable_if_t<std::is_same<T, XC>::value && (classify_object<T>::value == object_category::string_assignable ||
-                                               classify_object<T>::value == object_category::string_constructible),
-        detail::enabler> = detail::dummy>
-bool lexical_assign(const std::string &input, T &output) {
+/// Strings can be empty so we need to do a little different
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<std::is_same<AssignTo, ConvertTo>::value &&
+                          (classify_object<AssignTo>::value == object_category::string_assignable ||
+                           classify_object<AssignTo>::value == object_category::string_constructible ||
+                           classify_object<AssignTo>::value == object_category::wstring_assignable ||
+                           classify_object<AssignTo>::value == object_category::wstring_constructible),
+                      detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
     return lexical_cast(input, output);
 }
 
 /// Assign a value through lexical cast operations
-template <typename T,
-    typename XC,
-    enable_if_t<std::is_same<T, XC>::value && classify_object<T>::value != object_category::string_assignable &&
-                classify_object<T>::value != object_category::string_constructible,
-        detail::enabler> = detail::dummy>
-bool lexical_assign(const std::string &input, T &output) {
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<std::is_same<AssignTo, ConvertTo>::value && std::is_assignable<AssignTo &, AssignTo>::value &&
+                          classify_object<AssignTo>::value != object_category::string_assignable &&
+                          classify_object<AssignTo>::value != object_category::string_constructible &&
+                          classify_object<AssignTo>::value != object_category::wstring_assignable &&
+                          classify_object<AssignTo>::value != object_category::wstring_constructible,
+                      detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
     if(input.empty()) {
-        output = T{};
+        output = AssignTo{};
         return true;
     }
+
     return lexical_cast(input, output);
 }
 
-/// Assign a value converted from a string in lexical cast to the output value directly
-template <
-    typename T,
-    typename XC,
-    enable_if_t<!std::is_same<T, XC>::value && std::is_assignable<T &, XC &>::value, detail::enabler> = detail::dummy>
-bool lexical_assign(const std::string &input, T &output) {
-    XC val{};
-    bool parse_result = (!input.empty()) ? lexical_cast<XC>(input, val) : true;
-    if(parse_result) {
-        output = val;
+/// Assign a value through lexical cast operations
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<std::is_same<AssignTo, ConvertTo>::value && !std::is_assignable<AssignTo &, AssignTo>::value &&
+                          classify_object<AssignTo>::value == object_category::wrapper_value,
+                      detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
+    if(input.empty()) {
+        typename AssignTo::value_type emptyVal{};
+        output = emptyVal;
+        return true;
     }
-    return parse_result;
+    return lexical_cast(input, output);
 }
 
-/// Assign a value from a lexical cast through constructing a value and move assigning it
-template <typename T,
-    typename XC,
-    enable_if_t<!std::is_same<T, XC>::value && !std::is_assignable<T &, XC &>::value &&
-                std::is_move_assignable<T>::value,
-        detail::enabler> = detail::dummy>
-bool lexical_assign(const std::string &input, T &output) {
-    XC val{};
-    bool parse_result = input.empty() ? true : lexical_cast<XC>(input, val);
+/// Assign a value through lexical cast operations for int compatible values
+/// mainly for atomic operations on some compilers
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<std::is_same<AssignTo, ConvertTo>::value && !std::is_assignable<AssignTo &, AssignTo>::value &&
+                          classify_object<AssignTo>::value != object_category::wrapper_value &&
+                          std::is_assignable<AssignTo &, int>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
+    if(input.empty()) {
+        output = 0;
+        return true;
+    }
+    int val{0};
+    if(lexical_cast(input, val)) {
+#if defined(__clang__)
+/* on some older clang compilers */
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wsign-conversion"
+#endif
+        output = val;
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
+        return true;
+    }
+    return false;
+}
+
+/// Assign a value converted from a string in lexical cast to the output value directly
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<!std::is_same<AssignTo, ConvertTo>::value && std::is_assignable<AssignTo &, ConvertTo &>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
+    ConvertTo val{};
+    bool parse_result = (!input.empty()) ? lexical_cast(input, val) : true;
     if(parse_result) {
-        output = T(val);  // use () form of constructor to allow some implicit conversions
+        output = val;
     }
     return parse_result;
 }
-/// Lexical conversion if there is only one element
+
+/// Assign a value from a lexical cast through constructing a value and move assigning it
 template <
-    typename T,
-    typename XC,
-    enable_if_t<!is_tuple_like<T>::value && !is_tuple_like<XC>::value && !is_vector<T>::value && !is_vector<XC>::value,
-        detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
-    return lexical_assign<T, XC>(strings[0], output);
+    typename AssignTo,
+    typename ConvertTo,
+    enable_if_t<!std::is_same<AssignTo, ConvertTo>::value && !std::is_assignable<AssignTo &, ConvertTo &>::value &&
+                    std::is_move_assignable<AssignTo>::value,
+                detail::enabler> = detail::dummy>
+bool lexical_assign(const std::string &input, AssignTo &output) {
+    ConvertTo val{};
+    bool parse_result = input.empty() ? true : lexical_cast(input, val);
+    if(parse_result) {
+        output = AssignTo(val);  // use () form of constructor to allow some implicit conversions
+    }
+    return parse_result;
 }
 
-/// Lexical conversion if there is only one element but the conversion type is for two call a two element constructor
-template <typename T,
-    typename XC,
-    enable_if_t<type_count<T>::value == 1 && type_count<XC>::value == 2, detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
-    typename std::tuple_element<0, XC>::type v1;
-    typename std::tuple_element<1, XC>::type v2;
-    bool retval = lexical_assign<decltype(v1), decltype(v1)>(strings[0], v1);
-    if(strings.size() > 1) {
-        retval = retval && lexical_assign<decltype(v2), decltype(v2)>(strings[1], v2);
-    }
+/// primary lexical conversion operation, 1 string to 1 type of some kind
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<classify_object<ConvertTo>::value <= object_category::other &&
+                          classify_object<AssignTo>::value <= object_category::wrapper_value,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
+    return lexical_assign<AssignTo, ConvertTo>(strings[0], output);
+}
+
+/// Lexical conversion if there is only one element but the conversion type is for two, then call a two element
+/// constructor
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<(type_count<AssignTo>::value <= 2) && expected_count<AssignTo>::value == 1 &&
+                          is_tuple_like<ConvertTo>::value && type_count_base<ConvertTo>::value == 2,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
+    // the remove const is to handle pair types coming from a container
+    using FirstType = typename std::remove_const<typename std::tuple_element<0, ConvertTo>::type>::type;
+    using SecondType = typename std::tuple_element<1, ConvertTo>::type;
+    FirstType v1;
+    SecondType v2;
+    bool retval = lexical_assign<FirstType, FirstType>(strings[0], v1);
+    retval = retval && lexical_assign<SecondType, SecondType>((strings.size() > 1) ? strings[1] : std::string{}, v2);
     if(retval) {
-        output = T{v1, v2};
+        output = AssignTo{v1, v2};
     }
     return retval;
 }
 
-/// Lexical conversion of a vector types
-template <class T,
-    class XC,
-    enable_if_t<expected_count<T>::value == expected_max_vector_size &&
-                expected_count<XC>::value == expected_max_vector_size && type_count<XC>::value == 1,
-        detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
-    output.clear();
-    output.reserve(strings.size());
+/// Lexical conversion of a container types of single elements
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && is_mutable_container<ConvertTo>::value &&
+                          type_count<ConvertTo>::value == 1,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
+    output.erase(output.begin(), output.end());
+    if(strings.empty()) {
+        return true;
+    }
+    if(strings.size() == 1 && strings[0] == "{}") {
+        return true;
+    }
+    bool skip_remaining = false;
+    if(strings.size() == 2 && strings[0] == "{}" && is_separator(strings[1])) {
+        skip_remaining = true;
+    }
     for(const auto &elem : strings) {
-
-        output.emplace_back();
-        bool retval = lexical_assign<typename T::value_type, typename XC::value_type>(elem, output.back());
+        typename AssignTo::value_type out;
+        bool retval = lexical_assign<typename AssignTo::value_type, typename ConvertTo::value_type>(elem, out);
         if(!retval) {
             return false;
         }
+        output.insert(output.end(), std::move(out));
+        if(skip_remaining) {
+            break;
+        }
     }
     return (!output.empty());
 }
 
-/// Lexical conversion of a vector types with type size of two
-template <class T,
-    class XC,
-    enable_if_t<expected_count<T>::value == expected_max_vector_size &&
-                expected_count<XC>::value == expected_max_vector_size && type_count<XC>::value == 2,
-        detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
-    output.clear();
-    for(std::size_t ii = 0; ii < strings.size(); ii += 2) {
+/// Lexical conversion for complex types
+template <class AssignTo, class ConvertTo, enable_if_t<is_complex<ConvertTo>::value, detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std::string> &strings, AssignTo &output) {
 
-        typename std::tuple_element<0, typename XC::value_type>::type v1;
-        typename std::tuple_element<1, typename XC::value_type>::type v2;
-        bool retval = lexical_assign<decltype(v1), decltype(v1)>(strings[ii], v1);
-        if(strings.size() > ii + 1) {
-            retval = retval && lexical_assign<decltype(v2), decltype(v2)>(strings[ii + 1], v2);
+    if(strings.size() >= 2 && !strings[1].empty()) {
+        using XC2 = typename wrapped_type<ConvertTo, double>::type;
+        XC2 x{0.0}, y{0.0};
+        auto str1 = strings[1];
+        if(str1.back() == 'i' || str1.back() == 'j') {
+            str1.pop_back();
         }
-        if(retval) {
-            output.emplace_back(v1, v2);
-        } else {
-            return false;
+        auto worked = lexical_cast(strings[0], x) && lexical_cast(str1, y);
+        if(worked) {
+            output = ConvertTo{x, y};
         }
+        return worked;
     }
-    return (!output.empty());
+    return lexical_assign<AssignTo, ConvertTo>(strings[0], output);
 }
 
 /// Conversion to a vector type using a particular single type as the conversion type
-template <class T,
-    class XC,
-    enable_if_t<(expected_count<T>::value == expected_max_vector_size) && (expected_count<XC>::value == 1) &&
-                (type_count<XC>::value == 1),
-        detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && (expected_count<ConvertTo>::value == 1) &&
+                          (type_count<ConvertTo>::value == 1),
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
     bool retval = true;
     output.clear();
     output.reserve(strings.size());
     for(const auto &elem : strings) {
 
         output.emplace_back();
-        retval = retval && lexical_assign<typename T::value_type, XC>(elem, output.back());
+        retval = retval && lexical_assign<typename AssignTo::value_type, ConvertTo>(elem, output.back());
     }
     return (!output.empty()) && retval;
 }
-// This one is last since it can call other lexical_conversion functions
-/// Lexical conversion if there is only one element but the conversion type is a vector
-template <typename T,
-    typename XC,
-    enable_if_t<!is_tuple_like<T>::value && !is_vector<T>::value && is_vector<XC>::value, detail::enabler> =
-    detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
+
+// forward declaration
+
+/// Lexical conversion of a container types with conversion type of two elements
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && is_mutable_container<ConvertTo>::value &&
+                          type_count_base<ConvertTo>::value == 2,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(std::vector<std::string> strings, AssignTo &output);
+
+/// Lexical conversion of a vector types with type_size >2 forward declaration
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && is_mutable_container<ConvertTo>::value &&
+                          type_count_base<ConvertTo>::value != 2 &&
+                          ((type_count<ConvertTo>::value > 2) ||
+                           (type_count<ConvertTo>::value > type_count_base<ConvertTo>::value)),
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std::string> &strings, AssignTo &output);
+
+/// Conversion for tuples
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_tuple_like<AssignTo>::value && is_tuple_like<ConvertTo>::value &&
+                          (type_count_base<ConvertTo>::value != type_count<ConvertTo>::value ||
+                           type_count<ConvertTo>::value > 2),
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std::string> &strings, AssignTo &output);  // forward declaration
+
+/// Conversion for operations where the assigned type is some class but the conversion is a mutable container or large
+/// tuple
+template <typename AssignTo,
+          typename ConvertTo,
+          enable_if_t<!is_tuple_like<AssignTo>::value && !is_mutable_container<AssignTo>::value &&
+                          classify_object<ConvertTo>::value != object_category::wrapper_value &&
+                          (is_mutable_container<ConvertTo>::value || type_count<ConvertTo>::value > 2),
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
 
     if(strings.size() > 1 || (!strings.empty() && !(strings.front().empty()))) {
-        XC val;
-        auto retval = lexical_conversion<XC, XC>(strings, val);
-        output = T{val};
+        ConvertTo val;
+        auto retval = lexical_conversion<ConvertTo, ConvertTo>(strings, val);
+        output = AssignTo{val};
         return retval;
     }
-    output = T{};
+    output = AssignTo{};
     return true;
 }
 
 /// function template for converting tuples if the static Index is greater than the tuple size
-template <class T, class XC, std::size_t I>
-inline typename std::enable_if<I >= type_count<T>::value, bool>::type tuple_conversion(const std::vector<std::string> &,
-                                                                                       T &) {
+template <class AssignTo, class ConvertTo, std::size_t I>
+inline typename std::enable_if<(I >= type_count_base<AssignTo>::value), bool>::type
+tuple_conversion(const std::vector<std::string> &, AssignTo &) {
     return true;
 }
+
+/// Conversion of a tuple element where the type size ==1 and not a mutable container
+template <class AssignTo, class ConvertTo>
+inline typename std::enable_if<!is_mutable_container<ConvertTo>::value && type_count<ConvertTo>::value == 1, bool>::type
+tuple_type_conversion(std::vector<std::string> &strings, AssignTo &output) {
+    auto retval = lexical_assign<AssignTo, ConvertTo>(strings[0], output);
+    strings.erase(strings.begin());
+    return retval;
+}
+
+/// Conversion of a tuple element where the type size !=1 but the size is fixed and not a mutable container
+template <class AssignTo, class ConvertTo>
+inline typename std::enable_if<!is_mutable_container<ConvertTo>::value && (type_count<ConvertTo>::value > 1) &&
+                                   type_count<ConvertTo>::value == type_count_min<ConvertTo>::value,
+                               bool>::type
+tuple_type_conversion(std::vector<std::string> &strings, AssignTo &output) {
+    auto retval = lexical_conversion<AssignTo, ConvertTo>(strings, output);
+    strings.erase(strings.begin(), strings.begin() + type_count<ConvertTo>::value);
+    return retval;
+}
+
+/// Conversion of a tuple element where the type is a mutable container or a type with different min and max type sizes
+template <class AssignTo, class ConvertTo>
+inline typename std::enable_if<is_mutable_container<ConvertTo>::value ||
+                                   type_count<ConvertTo>::value != type_count_min<ConvertTo>::value,
+                               bool>::type
+tuple_type_conversion(std::vector<std::string> &strings, AssignTo &output) {
+
+    std::size_t index{subtype_count_min<ConvertTo>::value};
+    const std::size_t mx_count{subtype_count<ConvertTo>::value};
+    const std::size_t mx{(std::min)(mx_count, strings.size() - 1)};
+
+    while(index < mx) {
+        if(is_separator(strings[index])) {
+            break;
+        }
+        ++index;
+    }
+    bool retval = lexical_conversion<AssignTo, ConvertTo>(
+        std::vector<std::string>(strings.begin(), strings.begin() + static_cast<std::ptrdiff_t>(index)), output);
+    if(strings.size() > index) {
+        strings.erase(strings.begin(), strings.begin() + static_cast<std::ptrdiff_t>(index) + 1);
+    } else {
+        strings.clear();
+    }
+    return retval;
+}
+
 /// Tuple conversion operation
-template <class T, class XC, std::size_t I>
-inline typename std::enable_if <
-    I<type_count<T>::value, bool>::type tuple_conversion(const std::vector<std::string> &strings, T &output) {
+template <class AssignTo, class ConvertTo, std::size_t I>
+inline typename std::enable_if<(I < type_count_base<AssignTo>::value), bool>::type
+tuple_conversion(std::vector<std::string> strings, AssignTo &output) {
     bool retval = true;
-    if(strings.size() > I) {
-        retval = retval && lexical_assign<typename std::tuple_element<I, T>::type,
-            typename std::conditional<is_tuple_like<XC>::value,
-                typename std::tuple_element<I, XC>::type,
-                XC>::type>(strings[I], std::get<I>(output));
+    using ConvertToElement = typename std::
+        conditional<is_tuple_like<ConvertTo>::value, typename std::tuple_element<I, ConvertTo>::type, ConvertTo>::type;
+    if(!strings.empty()) {
+        retval = retval && tuple_type_conversion<typename std::tuple_element<I, AssignTo>::type, ConvertToElement>(
+                               strings, std::get<I>(output));
     }
-    retval = retval && tuple_conversion<T, XC, I + 1>(strings, output);
+    retval = retval && tuple_conversion<AssignTo, ConvertTo, I + 1>(std::move(strings), output);
     return retval;
 }
 
-/// Conversion for tuples
-template <class T, class XC, enable_if_t<is_tuple_like<T>::value, detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
-    static_assert(
-        !is_tuple_like<XC>::value || type_count<T>::value == type_count<XC>::value,
-        "if the conversion type is defined as a tuple it must be the same size as the type you are converting to");
-    return tuple_conversion<T, XC, 0>(strings, output);
+/// Lexical conversion of a container types with tuple elements of size 2
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && is_mutable_container<ConvertTo>::value &&
+                          type_count_base<ConvertTo>::value == 2,
+                      detail::enabler>>
+bool lexical_conversion(std::vector<std::string> strings, AssignTo &output) {
+    output.clear();
+    while(!strings.empty()) {
+
+        typename std::remove_const<typename std::tuple_element<0, typename ConvertTo::value_type>::type>::type v1;
+        typename std::tuple_element<1, typename ConvertTo::value_type>::type v2;
+        bool retval = tuple_type_conversion<decltype(v1), decltype(v1)>(strings, v1);
+        if(!strings.empty()) {
+            retval = retval && tuple_type_conversion<decltype(v2), decltype(v2)>(strings, v2);
+        }
+        if(retval) {
+            output.insert(output.end(), typename AssignTo::value_type{v1, v2});
+        } else {
+            return false;
+        }
+    }
+    return (!output.empty());
 }
 
-/// Lexical conversion of a vector types with type_size >2
-template <class T,
-    class XC,
-    enable_if_t<expected_count<T>::value == expected_max_vector_size &&
-                expected_count<XC>::value == expected_max_vector_size && (type_count<XC>::value > 2),
-        detail::enabler> = detail::dummy>
-bool lexical_conversion(const std::vector<std ::string> &strings, T &output) {
+/// lexical conversion of tuples with type count>2 or tuples of types of some element with a type size>=2
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_tuple_like<AssignTo>::value && is_tuple_like<ConvertTo>::value &&
+                          (type_count_base<ConvertTo>::value != type_count<ConvertTo>::value ||
+                           type_count<ConvertTo>::value > 2),
+                      detail::enabler>>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
+    static_assert(
+        !is_tuple_like<ConvertTo>::value || type_count_base<AssignTo>::value == type_count_base<ConvertTo>::value,
+        "if the conversion type is defined as a tuple it must be the same size as the type you are converting to");
+    return tuple_conversion<AssignTo, ConvertTo, 0>(strings, output);
+}
+
+/// Lexical conversion of a vector types for everything but tuples of two elements and types of size 1
+template <class AssignTo,
+          class ConvertTo,
+          enable_if_t<is_mutable_container<AssignTo>::value && is_mutable_container<ConvertTo>::value &&
+                          type_count_base<ConvertTo>::value != 2 &&
+                          ((type_count<ConvertTo>::value > 2) ||
+                           (type_count<ConvertTo>::value > type_count_base<ConvertTo>::value)),
+                      detail::enabler>>
+bool lexical_conversion(const std::vector<std ::string> &strings, AssignTo &output) {
     bool retval = true;
     output.clear();
     std::vector<std::string> temp;
-    std::size_t ii = 0;
-    std::size_t icount = 0;
-    std::size_t xcm = type_count<XC>::value;
-    while(ii < strings.size()) {
+    std::size_t ii{0};
+    std::size_t icount{0};
+    std::size_t xcm{type_count<ConvertTo>::value};
+    auto ii_max = strings.size();
+    while(ii < ii_max) {
         temp.push_back(strings[ii]);
         ++ii;
         ++icount;
-        if(icount == xcm || temp.back().empty()) {
-            if(static_cast<int>(xcm) == expected_max_vector_size) {
+        if(icount == xcm || is_separator(temp.back()) || ii == ii_max) {
+            if(static_cast<int>(xcm) > type_count_min<ConvertTo>::value && is_separator(temp.back())) {
                 temp.pop_back();
             }
-            output.emplace_back();
-            retval = retval && lexical_conversion<typename T::value_type, typename XC::value_type>(temp, output.back());
+            typename AssignTo::value_type temp_out;
+            retval = retval &&
+                     lexical_conversion<typename AssignTo::value_type, typename ConvertTo::value_type>(temp, temp_out);
             temp.clear();
             if(!retval) {
                 return false;
             }
+            output.insert(output.end(), std::move(temp_out));
             icount = 0;
         }
     }
     return retval;
 }
-/// Sum a vector of flag representations
-/// The flag vector produces a series of strings in a vector,  simple true is represented by a "1",  simple false is
-/// by
-/// "-1" an if numbers are passed by some fashion they are captured as well so the function just checks for the most
-/// common true and false strings then uses stoll to convert the rest for summing
-template <typename T,
-    enable_if_t<std::is_integral<T>::value && std::is_unsigned<T>::value, detail::enabler> = detail::dummy>
-void sum_flag_vector(const std::vector<std::string> &flags, T &output) {
-    std::int64_t count{0};
-    for(auto &flag : flags) {
-        count += detail::to_flag_value(flag);
+
+/// conversion for wrapper types
+template <typename AssignTo,
+          class ConvertTo,
+          enable_if_t<classify_object<ConvertTo>::value == object_category::wrapper_value &&
+                          std::is_assignable<ConvertTo &, ConvertTo>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std::string> &strings, AssignTo &output) {
+    if(strings.empty() || strings.front().empty()) {
+        output = ConvertTo{};
+        return true;
     }
-    output = (count > 0) ? static_cast<T>(count) : T{0};
+    typename ConvertTo::value_type val;
+    if(lexical_conversion<typename ConvertTo::value_type, typename ConvertTo::value_type>(strings, val)) {
+        output = ConvertTo{val};
+        return true;
+    }
+    return false;
 }
 
-/// Sum a vector of flag representations
-/// The flag vector produces a series of strings in a vector,  simple true is represented by a "1",  simple false is
-/// by
-/// "-1" an if numbers are passed by some fashion they are captured as well so the function just checks for the most
-/// common true and false strings then uses stoll to convert the rest for summing
-template <typename T,
-    enable_if_t<std::is_integral<T>::value && std::is_signed<T>::value, detail::enabler> = detail::dummy>
-void sum_flag_vector(const std::vector<std::string> &flags, T &output) {
-    std::int64_t count{0};
-    for(auto &flag : flags) {
-        count += detail::to_flag_value(flag);
+/// conversion for wrapper types
+template <typename AssignTo,
+          class ConvertTo,
+          enable_if_t<classify_object<ConvertTo>::value == object_category::wrapper_value &&
+                          !std::is_assignable<AssignTo &, ConvertTo>::value,
+                      detail::enabler> = detail::dummy>
+bool lexical_conversion(const std::vector<std::string> &strings, AssignTo &output) {
+    using ConvertType = typename ConvertTo::value_type;
+    if(strings.empty() || strings.front().empty()) {
+        output = ConvertType{};
+        return true;
+    }
+    ConvertType val;
+    if(lexical_conversion<typename ConvertTo::value_type, typename ConvertTo::value_type>(strings, val)) {
+        output = val;
+        return true;
+    }
+    return false;
+}
+
+/// Sum a vector of strings
+inline std::string sum_string_vector(const std::vector<std::string> &values) {
+    double val{0.0};
+    bool fail{false};
+    std::string output;
+    for(const auto &arg : values) {
+        double tv{0.0};
+        auto comp = lexical_cast(arg, tv);
+        if(!comp) {
+            errno = 0;
+            auto fv = detail::to_flag_value(arg);
+            fail = (errno != 0);
+            if(fail) {
+                break;
+            }
+            tv = static_cast<double>(fv);
+        }
+        val += tv;
     }
-    output = static_cast<T>(count);
+    if(fail) {
+        for(const auto &arg : values) {
+            output.append(arg);
+        }
+    } else {
+        std::ostringstream out;
+        out.precision(16);
+        out << val;
+        output = out.str();
+    }
+    return output;
 }
 
 }  // namespace detail
-}  // namespace CLI
 
-// From Split.hpp:
 
-namespace CLI {
+
 namespace detail {
 
 // Returns false if not a short option. Otherwise, sets opt name and rest and returns true
-inline bool split_short(const std::string &current, std::string &name, std::string &rest) {
+CLI11_INLINE bool split_short(const std::string &current, std::string &name, std::string &rest);
+
+// Returns false if not a long option. Otherwise, sets opt name and other side of = and returns true
+CLI11_INLINE bool split_long(const std::string &current, std::string &name, std::string &value);
+
+// Returns false if not a windows style option. Otherwise, sets opt name and value and returns true
+CLI11_INLINE bool split_windows_style(const std::string &current, std::string &name, std::string &value);
+
+// Splits a string into multiple long and short names
+CLI11_INLINE std::vector<std::string> split_names(std::string current);
+
+/// extract default flag values either {def} or starting with a !
+CLI11_INLINE std::vector<std::pair<std::string, std::string>> get_default_flag_values(const std::string &str);
+
+/// Get a vector of short names, one of long names, and a single name
+CLI11_INLINE std::tuple<std::vector<std::string>, std::vector<std::string>, std::string>
+get_names(const std::vector<std::string> &input);
+
+}  // namespace detail
+
+
+
+namespace detail {
+
+CLI11_INLINE bool split_short(const std::string &current, std::string &name, std::string &rest) {
     if(current.size() > 1 && current[0] == '-' && valid_first_char(current[1])) {
         name = current.substr(1, 1);
         rest = current.substr(2);
@@ -1861,9 +3343,8 @@ inline bool split_short(const std::string &current, std::string &name, std::stri
     return false;
 }
 
-// Returns false if not a long option. Otherwise, sets opt name and other side of = and returns true
-inline bool split_long(const std::string &current, std::string &name, std::string &value) {
-    if(current.size() > 2 && current.substr(0, 2) == "--" && valid_first_char(current[2])) {
+CLI11_INLINE bool split_long(const std::string &current, std::string &name, std::string &value) {
+    if(current.size() > 2 && current.compare(0, 2, "--") == 0 && valid_first_char(current[2])) {
         auto loc = current.find_first_of('=');
         if(loc != std::string::npos) {
             name = current.substr(2, loc - 2);
@@ -1877,8 +3358,7 @@ inline bool split_long(const std::string &current, std::string &name, std::strin
     return false;
 }
 
-// Returns false if not a windows style option. Otherwise, sets opt name and value and returns true
-inline bool split_windows_style(const std::string &current, std::string &name, std::string &value) {
+CLI11_INLINE bool split_windows_style(const std::string &current, std::string &name, std::string &value) {
     if(current.size() > 1 && current[0] == '/' && valid_first_char(current[1])) {
         auto loc = current.find_first_of(':');
         if(loc != std::string::npos) {
@@ -1893,11 +3373,10 @@ inline bool split_windows_style(const std::string &current, std::string &name, s
     return false;
 }
 
-// Splits a string into multiple long and short names
-inline std::vector<std::string> split_names(std::string current) {
+CLI11_INLINE std::vector<std::string> split_names(std::string current) {
     std::vector<std::string> output;
-    std::size_t val;
-    while((val = current.find(",")) != std::string::npos) {
+    std::size_t val = 0;
+    while((val = current.find(',')) != std::string::npos) {
         output.push_back(trim_copy(current.substr(0, val)));
         current = current.substr(val + 1);
     }
@@ -1905,15 +3384,14 @@ inline std::vector<std::string> split_names(std::string current) {
     return output;
 }
 
-/// extract default flag values either {def} or starting with a !
-inline std::vector<std::pair<std::string, std::string>> get_default_flag_values(const std::string &str) {
+CLI11_INLINE std::vector<std::pair<std::string, std::string>> get_default_flag_values(const std::string &str) {
     std::vector<std::string> flags = split_names(str);
     flags.erase(std::remove_if(flags.begin(),
                                flags.end(),
                                [](const std::string &name) {
-                                 return ((name.empty()) || (!(((name.find_first_of('{') != std::string::npos) &&
-                                                               (name.back() == '}')) ||
-                                                              (name[0] == '!'))));
+                                   return ((name.empty()) || (!(((name.find_first_of('{') != std::string::npos) &&
+                                                                 (name.back() == '}')) ||
+                                                                (name[0] == '!'))));
                                }),
                 flags.end());
     std::vector<std::pair<std::string, std::string>> output;
@@ -1924,7 +3402,7 @@ inline std::vector<std::pair<std::string, std::string>> get_default_flag_values(
         if((def_start != std::string::npos) && (flag.back() == '}')) {
             defval = flag.substr(def_start + 1);
             defval.pop_back();
-            flag.erase(def_start, std::string::npos);
+            flag.erase(def_start, std::string::npos);  // NOLINT(readability-suspicious-call-argument)
         }
         flag.erase(0, flag.find_first_not_of("-!"));
         output.emplace_back(flag, defval);
@@ -1932,14 +3410,12 @@ inline std::vector<std::pair<std::string, std::string>> get_default_flag_values(
     return output;
 }
 
-/// Get a vector of short names, one of long names, and a single name
-inline std::tuple<std::vector<std::string>, std::vector<std::string>, std::string>
+CLI11_INLINE std::tuple<std::vector<std::string>, std::vector<std::string>, std::string>
 get_names(const std::vector<std::string> &input) {
 
     std::vector<std::string> short_names;
     std::vector<std::string> long_names;
     std::string pos_name;
-
     for(std::string name : input) {
         if(name.length() == 0) {
             continue;
@@ -1947,6 +3423,8 @@ get_names(const std::vector<std::string> &input) {
         if(name.length() > 1 && name[0] == '-' && name[1] != '-') {
             if(name.length() == 2 && valid_first_char(name[1]))
                 short_names.emplace_back(1, name[1]);
+            else if(name.length() > 2)
+                throw BadNameString::MissingDash(name);
             else
                 throw BadNameString::OneCharName(name);
         } else if(name.length() > 2 && name.substr(0, 2) == "--") {
@@ -1958,22 +3436,21 @@ get_names(const std::vector<std::string> &input) {
         } else if(name == "-" || name == "--") {
             throw BadNameString::DashesOnly(name);
         } else {
-            if(pos_name.length() > 0)
+            if(!pos_name.empty())
                 throw BadNameString::MultiPositionalNames(name);
-            pos_name = name;
+            if(valid_name_string(name)) {
+                pos_name = name;
+            } else {
+                throw BadNameString::BadPositionalName(name);
+            }
         }
     }
-
-    return std::tuple<std::vector<std::string>, std::vector<std::string>, std::string>(
-        short_names, long_names, pos_name);
+    return std::make_tuple(short_names, long_names, pos_name);
 }
 
 }  // namespace detail
-}  // namespace CLI
 
-// From ConfigFwd.hpp:
 
-namespace CLI {
 
 class App;
 
@@ -1984,12 +3461,11 @@ struct ConfigItem {
 
     /// This is the name
     std::string name{};
-
     /// Listing of inputs
     std::vector<std::string> inputs{};
 
     /// The list of parents and name joined by "."
-    std::string fullname() const {
+    CLI11_NODISCARD std::string fullname() const {
         std::vector<std::string> tmp = parents;
         tmp.emplace_back(name);
         return detail::join(tmp, ".");
@@ -2009,15 +3485,18 @@ class Config {
     virtual std::vector<ConfigItem> from_config(std::istream &) const = 0;
 
     /// Get a flag value
-    virtual std::string to_flag(const ConfigItem &item) const {
+    CLI11_NODISCARD virtual std::string to_flag(const ConfigItem &item) const {
         if(item.inputs.size() == 1) {
             return item.inputs.at(0);
         }
-        throw ConversionError::TooManyInputsFlag(item.fullname());
+        if(item.inputs.empty()) {
+            return "{}";
+        }
+        throw ConversionError::TooManyInputsFlag(item.fullname());  // LCOV_EXCL_LINE
     }
 
     /// Parse a config file, throw an error (ParseError:ConfigParseError or FileError) on failure
-    std::vector<ConfigItem> from_file(const std::string &name) {
+    CLI11_NODISCARD std::vector<ConfigItem> from_file(const std::string &name) const {
         std::ifstream input{name};
         if(!input.good())
             throw FileError::Missing(name);
@@ -2029,19 +3508,31 @@ class Config {
     virtual ~Config() = default;
 };
 
-/// This converter works with INI/TOML files; to write proper TOML files use ConfigTOML
+/// This converter works with INI/TOML files; to write INI files use ConfigINI
 class ConfigBase : public Config {
   protected:
     /// the character used for comments
-    char commentChar = ';';
+    char commentChar = '#';
     /// the character used to start an array '\0' is a default to not use
-    char arrayStart = '\0';
+    char arrayStart = '[';
     /// the character used to end an array '\0' is a default to not use
-    char arrayEnd = '\0';
+    char arrayEnd = ']';
     /// the character used to separate elements in an array
-    char arraySeparator = ' ';
+    char arraySeparator = ',';
     /// the character used separate the name from the value
     char valueDelimiter = '=';
+    /// the character to use around strings
+    char stringQuote = '"';
+    /// the character to use around single characters and literal strings
+    char literalQuote = '\'';
+    /// the maximum number of layers to allow
+    uint8_t maximumLayers{255};
+    /// the separator used to separator parent layers
+    char parentSeparatorChar{'.'};
+    /// Specify the configuration index to use for arrayed sections
+    int16_t configIndex{-1};
+    /// Specify the configuration section that should be used
+    std::string configSection{};
 
   public:
     std::string
@@ -2069,28 +3560,60 @@ class ConfigBase : public Config {
         valueDelimiter = vSep;
         return this;
     }
+    /// Specify the quote characters used around strings and literal strings
+    ConfigBase *quoteCharacter(char qString, char literalChar) {
+        stringQuote = qString;
+        literalQuote = literalChar;
+        return this;
+    }
+    /// Specify the maximum number of parents
+    ConfigBase *maxLayers(uint8_t layers) {
+        maximumLayers = layers;
+        return this;
+    }
+    /// Specify the separator to use for parent layers
+    ConfigBase *parentSeparator(char sep) {
+        parentSeparatorChar = sep;
+        return this;
+    }
+    /// get a reference to the configuration section
+    std::string &sectionRef() { return configSection; }
+    /// get the section
+    CLI11_NODISCARD const std::string &section() const { return configSection; }
+    /// specify a particular section of the configuration file to use
+    ConfigBase *section(const std::string &sectionName) {
+        configSection = sectionName;
+        return this;
+    }
+
+    /// get a reference to the configuration index
+    int16_t &indexRef() { return configIndex; }
+    /// get the section index
+    CLI11_NODISCARD int16_t index() const { return configIndex; }
+    /// specify a particular index in the section to use (-1) for all sections to use
+    ConfigBase *index(int16_t sectionIndex) {
+        configIndex = sectionIndex;
+        return this;
+    }
 };
 
-/// the default Config is the INI file format
-using ConfigINI = ConfigBase;
+/// the default Config is the TOML file format
+using ConfigTOML = ConfigBase;
 
-/// ConfigTOML generates a TOML compliant output
-class ConfigTOML : public ConfigINI {
+/// ConfigINI generates a "standard" INI compliant output
+class ConfigINI : public ConfigTOML {
 
   public:
-    ConfigTOML() {
-        commentChar = '#';
-        arrayStart = '[';
-        arrayEnd = ']';
-        arraySeparator = ',';
+    ConfigINI() {
+        commentChar = ';';
+        arrayStart = '\0';
+        arrayEnd = '\0';
+        arraySeparator = ' ';
         valueDelimiter = '=';
     }
 };
-}  // namespace CLI
 
-// From Validators.hpp:
 
-namespace CLI {
 
 class Option;
 
@@ -2121,6 +3644,9 @@ class Validator {
     /// specify that a validator should not modify the input
     bool non_modifying_{false};
 
+    Validator(std::string validator_desc, std::function<std::string(std::string &)> func)
+        : desc_function_([validator_desc]() { return validator_desc; }), func_(std::move(func)) {}
+
   public:
     Validator() = default;
     /// Construct a Validator with just the description string
@@ -2136,18 +3662,7 @@ class Validator {
     }
     /// This is the required operator for a Validator - provided to help
     /// users (CLI11 uses the member `func` directly)
-    std::string operator()(std::string &str) const {
-        std::string retstring;
-        if(active_) {
-            if(non_modifying_) {
-                std::string value = str;
-                retstring = func_(value);
-            } else {
-                retstring = func_(str);
-            }
-        }
-        return retstring;
-    }
+    std::string operator()(std::string &str) const;
 
     /// This is the required operator for a Validator - provided to help
     /// users (CLI11 uses the member `func` directly)
@@ -2162,13 +3677,10 @@ class Validator {
         return *this;
     }
     /// Specify the type string
-    Validator description(std::string validator_desc) const {
-        Validator newval(*this);
-        newval.desc_function_ = [validator_desc]() { return validator_desc; };
-        return newval;
-    }
+    CLI11_NODISCARD Validator description(std::string validator_desc) const;
+
     /// Generate type description information for the Validator
-    std::string get_description() const {
+    CLI11_NODISCARD std::string get_description() const {
         if(active_) {
             return desc_function_();
         }
@@ -2180,20 +3692,20 @@ class Validator {
         return *this;
     }
     /// Specify the type string
-    Validator name(std::string validator_name) const {
+    CLI11_NODISCARD Validator name(std::string validator_name) const {
         Validator newval(*this);
         newval.name_ = std::move(validator_name);
         return newval;
     }
     /// Get the name of the Validator
-    const std::string &get_name() const { return name_; }
+    CLI11_NODISCARD const std::string &get_name() const { return name_; }
     /// Specify whether the Validator is active or not
     Validator &active(bool active_val = true) {
         active_ = active_val;
         return *this;
     }
     /// Specify whether the Validator is active or not
-    Validator active(bool active_val = true) const {
+    CLI11_NODISCARD Validator active(bool active_val = true) const {
         Validator newval(*this);
         newval.active_ = active_val;
         return newval;
@@ -2210,107 +3722,33 @@ class Validator {
         return *this;
     }
     /// Specify the application index of a validator
-    Validator application_index(int app_index) const {
+    CLI11_NODISCARD Validator application_index(int app_index) const {
         Validator newval(*this);
         newval.application_index_ = app_index;
         return newval;
     }
     /// Get the current value of the application index
-    int get_application_index() const { return application_index_; }
+    CLI11_NODISCARD int get_application_index() const { return application_index_; }
     /// Get a boolean if the validator is active
-    bool get_active() const { return active_; }
+    CLI11_NODISCARD bool get_active() const { return active_; }
 
     /// Get a boolean if the validator is allowed to modify the input returns true if it can modify the input
-    bool get_modifying() const { return !non_modifying_; }
+    CLI11_NODISCARD bool get_modifying() const { return !non_modifying_; }
 
     /// Combining validators is a new validator. Type comes from left validator if function, otherwise only set if the
     /// same.
-    Validator operator&(const Validator &other) const {
-        Validator newval;
-
-        newval._merge_description(*this, other, " AND ");
-
-        // Give references (will make a copy in lambda function)
-        const std::function<std::string(std::string & filename)> &f1 = func_;
-        const std::function<std::string(std::string & filename)> &f2 = other.func_;
-
-        newval.func_ = [f1, f2](std::string &input) {
-          std::string s1 = f1(input);
-          std::string s2 = f2(input);
-          if(!s1.empty() && !s2.empty())
-              return std::string("(") + s1 + ") AND (" + s2 + ")";
-          else
-              return s1 + s2;
-        };
-
-        newval.active_ = (active_ & other.active_);
-        newval.application_index_ = application_index_;
-        return newval;
-    }
+    Validator operator&(const Validator &other) const;
 
     /// Combining validators is a new validator. Type comes from left validator if function, otherwise only set if the
     /// same.
-    Validator operator|(const Validator &other) const {
-        Validator newval;
-
-        newval._merge_description(*this, other, " OR ");
-
-        // Give references (will make a copy in lambda function)
-        const std::function<std::string(std::string &)> &f1 = func_;
-        const std::function<std::string(std::string &)> &f2 = other.func_;
-
-        newval.func_ = [f1, f2](std::string &input) {
-          std::string s1 = f1(input);
-          std::string s2 = f2(input);
-          if(s1.empty() || s2.empty())
-              return std::string();
-
-          return std::string("(") + s1 + ") OR (" + s2 + ")";
-        };
-        newval.active_ = (active_ & other.active_);
-        newval.application_index_ = application_index_;
-        return newval;
-    }
+    Validator operator|(const Validator &other) const;
 
     /// Create a validator that fails when a given validator succeeds
-    Validator operator!() const {
-        Validator newval;
-        const std::function<std::string()> &dfunc1 = desc_function_;
-        newval.desc_function_ = [dfunc1]() {
-          auto str = dfunc1();
-          return (!str.empty()) ? std::string("NOT ") + str : std::string{};
-        };
-        // Give references (will make a copy in lambda function)
-        const std::function<std::string(std::string & res)> &f1 = func_;
-
-        newval.func_ = [f1, dfunc1](std::string &test) -> std::string {
-          std::string s1 = f1(test);
-          if(s1.empty()) {
-              return std::string("check ") + dfunc1() + " succeeded improperly";
-          }
-          return std::string{};
-        };
-        newval.active_ = active_;
-        newval.application_index_ = application_index_;
-        return newval;
-    }
+    Validator operator!() const;
 
   private:
-    void _merge_description(const Validator &val1, const Validator &val2, const std::string &merger) {
-
-        const std::function<std::string()> &dfunc1 = val1.desc_function_;
-        const std::function<std::string()> &dfunc2 = val2.desc_function_;
-
-        desc_function_ = [=]() {
-          std::string f1 = dfunc1();
-          std::string f2 = dfunc2();
-          if((f1.empty()) || (f2.empty())) {
-              return f1 + f2;
-          }
-          return std::string(1, '(') + f1 + ')' + merger + '(' + f2 + ')';
-        };
-    }
-};  // namespace CLI
+    void _merge_description(const Validator &val1, const Validator &val2, const std::string &merger);
+};
 
 /// Class wrapping some of the accessors of Validator
 class CustomValidator : public Validator {
@@ -2324,179 +3762,42 @@ namespace detail {
 /// CLI enumeration of different file types
 enum class path_type { nonexistent, file, directory };
 
-#if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
-/// get the type of the path from a file name
-inline path_type check_path(const char *file) noexcept {
-    std::error_code ec;
-    auto stat = std::filesystem::status(file, ec);
-    if(ec) {
-        return path_type::nonexistent;
-    }
-    switch(stat.type()) {
-    case std::filesystem::file_type::none:
-    case std::filesystem::file_type::not_found:
-        return path_type::nonexistent;
-    case std::filesystem::file_type::directory:
-        return path_type::directory;
-    case std::filesystem::file_type::symlink:
-    case std::filesystem::file_type::block:
-    case std::filesystem::file_type::character:
-    case std::filesystem::file_type::fifo:
-    case std::filesystem::file_type::socket:
-    case std::filesystem::file_type::regular:
-    case std::filesystem::file_type::unknown:
-    default:
-        return path_type::file;
-    }
-}
-#else
 /// get the type of the path from a file name
-inline path_type check_path(const char *file) noexcept {
-#if defined(_MSC_VER)
-    struct __stat64 buffer;
-    if(_stat64(file, &buffer) == 0) {
-        return ((buffer.st_mode & S_IFDIR) != 0) ? path_type::directory : path_type::file;
-    }
-#else
-    struct stat buffer;
-    if(stat(file, &buffer) == 0) {
-        return ((buffer.st_mode & S_IFDIR) != 0) ? path_type::directory : path_type::file;
-    }
-#endif
-    return path_type::nonexistent;
-}
-#endif
+CLI11_INLINE path_type check_path(const char *file) noexcept;
+
 /// Check for an existing file (returns error message if check fails)
 class ExistingFileValidator : public Validator {
   public:
-    ExistingFileValidator() : Validator("FILE") {
-        func_ = [](std::string &filename) {
-          auto path_result = check_path(filename.c_str());
-          if(path_result == path_type::nonexistent) {
-              return "File does not exist: " + filename;
-          }
-          if(path_result == path_type::directory) {
-              return "File is actually a directory: " + filename;
-          }
-          return std::string();
-        };
-    }
+    ExistingFileValidator();
 };
 
 /// Check for an existing directory (returns error message if check fails)
 class ExistingDirectoryValidator : public Validator {
   public:
-    ExistingDirectoryValidator() : Validator("DIR") {
-        func_ = [](std::string &filename) {
-          auto path_result = check_path(filename.c_str());
-          if(path_result == path_type::nonexistent) {
-              return "Directory does not exist: " + filename;
-          }
-          if(path_result == path_type::file) {
-              return "Directory is actually a file: " + filename;
-          }
-          return std::string();
-        };
-    }
+    ExistingDirectoryValidator();
 };
 
 /// Check for an existing path
 class ExistingPathValidator : public Validator {
   public:
-    ExistingPathValidator() : Validator("PATH(existing)") {
-        func_ = [](std::string &filename) {
-          auto path_result = check_path(filename.c_str());
-          if(path_result == path_type::nonexistent) {
-              return "Path does not exist: " + filename;
-          }
-          return std::string();
-        };
-    }
+    ExistingPathValidator();
 };
 
 /// Check for an non-existing path
 class NonexistentPathValidator : public Validator {
   public:
-    NonexistentPathValidator() : Validator("PATH(non-existing)") {
-        func_ = [](std::string &filename) {
-          auto path_result = check_path(filename.c_str());
-          if(path_result != path_type::nonexistent) {
-              return "Path already exists: " + filename;
-          }
-          return std::string();
-        };
-    }
+    NonexistentPathValidator();
 };
 
 /// Validate the given string is a legal ipv4 address
 class IPV4Validator : public Validator {
   public:
-    IPV4Validator() : Validator("IPV4") {
-        func_ = [](std::string &ip_addr) {
-          auto result = CLI::detail::split(ip_addr, '.');
-          if(result.size() != 4) {
-              return std::string("Invalid IPV4 address must have four parts (") + ip_addr + ')';
-          }
-          int num;
-          for(const auto &var : result) {
-              bool retval = detail::lexical_cast(var, num);
-              if(!retval) {
-                  return std::string("Failed parsing number (") + var + ')';
-              }
-              if(num < 0 || num > 255) {
-                  return std::string("Each IP number must be between 0 and 255 ") + var;
-              }
-          }
-          return std::string();
-        };
-    }
-};
-
-/// Validate the argument is a number and greater than 0
-class PositiveNumber : public Validator {
-  public:
-    PositiveNumber() : Validator("POSITIVE") {
-        func_ = [](std::string &number_str) {
-          double number;
-          if(!detail::lexical_cast(number_str, number)) {
-              return std::string("Failed parsing number: (") + number_str + ')';
-          }
-          if(number <= 0) {
-              return std::string("Number less or equal to 0: (") + number_str + ')';
-          }
-          return std::string();
-        };
-    }
-};
-/// Validate the argument is a number and greater than or equal to 0
-class NonNegativeNumber : public Validator {
-  public:
-    NonNegativeNumber() : Validator("NONNEGATIVE") {
-        func_ = [](std::string &number_str) {
-          double number;
-          if(!detail::lexical_cast(number_str, number)) {
-              return std::string("Failed parsing number: (") + number_str + ')';
-          }
-          if(number < 0) {
-              return std::string("Number less than 0: (") + number_str + ')';
-          }
-          return std::string();
-        };
-    }
+    IPV4Validator();
 };
 
-/// Validate the argument is a number
-class Number : public Validator {
+class EscapedStringTransformer : public Validator {
   public:
-    Number() : Validator("NUMBER") {
-        func_ = [](std::string &number_str) {
-          double number;
-          if(!detail::lexical_cast(number_str, number)) {
-              return std::string("Failed parsing as a number (") + number_str + ')';
-          }
-          return std::string();
-        };
-    }
+    EscapedStringTransformer();
 };
 
 }  // namespace detail
@@ -2518,14 +3819,33 @@ const detail::NonexistentPathValidator NonexistentPath;
 /// Check for an IP4 address
 const detail::IPV4Validator ValidIPV4;
 
-/// Check for a positive number
-const detail::PositiveNumber PositiveNumber;
+/// convert escaped characters into their associated values
+const detail::EscapedStringTransformer EscapedString;
 
-/// Check for a non-negative number
-const detail::NonNegativeNumber NonNegativeNumber;
+/// Validate the input as a particular type
+template <typename DesiredType> class TypeValidator : public Validator {
+  public:
+    explicit TypeValidator(const std::string &validator_name)
+        : Validator(validator_name, [](std::string &input_string) {
+              using CLI::detail::lexical_cast;
+              auto val = DesiredType();
+              if(!lexical_cast(input_string, val)) {
+                  return std::string("Failed parsing ") + input_string + " as a " + detail::type_name<DesiredType>();
+              }
+              return std::string();
+          }) {}
+    TypeValidator() : TypeValidator(detail::type_name<DesiredType>()) {}
+};
 
 /// Check for a number
-const detail::Number Number;
+const TypeValidator<double> Number("NUMBER");
+
+/// Modify a path if the file is a particular default location, can be used as Check or transform
+/// with the error return optionally disabled
+class FileOnDefaultPath : public Validator {
+  public:
+    explicit FileOnDefaultPath(std::string default_path, bool enableErrorReturn = true);
+};
 
 /// Produce a range (factory). Min and max are inclusive.
 class Range : public Validator {
@@ -2534,26 +3854,40 @@ class Range : public Validator {
     ///
     /// Note that the constructor is templated, but the struct is not, so C++17 is not
     /// needed to provide nice syntax for Range(a,b).
-    template <typename T> Range(T min, T max) {
-        std::stringstream out;
-        out << detail::type_name<T>() << " in [" << min << " - " << max << "]";
-        description(out.str());
-
-        func_ = [min, max](std::string &input) {
-          T val;
-          bool converted = detail::lexical_cast(input, val);
-          if((!converted) || (val < min || val > max))
-              return std::string("Value ") + input + " not in range " + std::to_string(min) + " to " +
-                     std::to_string(max);
-
-          return std::string();
+    template <typename T>
+    Range(T min_val, T max_val, const std::string &validator_name = std::string{}) : Validator(validator_name) {
+        if(validator_name.empty()) {
+            std::stringstream out;
+            out << detail::type_name<T>() << " in [" << min_val << " - " << max_val << "]";
+            description(out.str());
+        }
+
+        func_ = [min_val, max_val](std::string &input) {
+            using CLI::detail::lexical_cast;
+            T val;
+            bool converted = lexical_cast(input, val);
+            if((!converted) || (val < min_val || val > max_val)) {
+                std::stringstream out;
+                out << "Value " << input << " not in range [";
+                out << min_val << " - " << max_val << "]";
+                return out.str();
+            }
+            return std::string{};
         };
     }
 
     /// Range of one value is 0 to value
-    template <typename T> explicit Range(T max) : Range(static_cast<T>(0), max) {}
+    template <typename T>
+    explicit Range(T max_val, const std::string &validator_name = std::string{})
+        : Range(static_cast<T>(0), max_val, validator_name) {}
 };
 
+/// Check for a non negative number
+const Range NonNegativeNumber((std::numeric_limits<double>::max)(), "NONNEGATIVE");
+
+/// Check for a positive valued number (val>0.0), <double>::min  here is the smallest positive number
+const Range PositiveNumber((std::numeric_limits<double>::min)(), (std::numeric_limits<double>::max)(), "POSITIVE");
+
 /// Produce a bounded range (factory). Min and max are inclusive.
 class Bound : public Validator {
   public:
@@ -2561,33 +3895,34 @@ class Bound : public Validator {
     ///
     /// Note that the constructor is templated, but the struct is not, so C++17 is not
     /// needed to provide nice syntax for Range(a,b).
-    template <typename T> Bound(T min, T max) {
+    template <typename T> Bound(T min_val, T max_val) {
         std::stringstream out;
-        out << detail::type_name<T>() << " bounded to [" << min << " - " << max << "]";
+        out << detail::type_name<T>() << " bounded to [" << min_val << " - " << max_val << "]";
         description(out.str());
 
-        func_ = [min, max](std::string &input) {
-          T val;
-          bool converted = detail::lexical_cast(input, val);
-          if(!converted) {
-              return std::string("Value ") + input + " could not be converted";
-          }
-          if(val < min)
-              input = detail::to_string(min);
-          else if(val > max)
-              input = detail::to_string(max);
-
-          return std::string{};
+        func_ = [min_val, max_val](std::string &input) {
+            using CLI::detail::lexical_cast;
+            T val;
+            bool converted = lexical_cast(input, val);
+            if(!converted) {
+                return std::string("Value ") + input + " could not be converted";
+            }
+            if(val < min_val)
+                input = detail::to_string(min_val);
+            else if(val > max_val)
+                input = detail::to_string(max_val);
+
+            return std::string{};
         };
     }
 
     /// Range of one value is 0 to value
-    template <typename T> explicit Bound(T max) : Bound(static_cast<T>(0), max) {}
+    template <typename T> explicit Bound(T max_val) : Bound(static_cast<T>(0), max_val) {}
 };
 
 namespace detail {
 template <typename T,
-    enable_if_t<is_copyable_ptr<typename std::remove_reference<T>::type>::value, detail::enabler> = detail::dummy>
+          enable_if_t<is_copyable_ptr<typename std::remove_reference<T>::type>::value, detail::enabler> = detail::dummy>
 auto smart_deref(T value) -> decltype(*value) {
     return *value;
 }
@@ -2619,13 +3954,13 @@ template <typename T> std::string generate_map(const T &map, bool key_only = fal
     out.append(detail::join(
         detail::smart_deref(map),
         [key_only](const iteration_type_t &v) {
-          std::string res{detail::to_string(detail::pair_adaptor<element_t>::first(v))};
+            std::string res{detail::to_string(detail::pair_adaptor<element_t>::first(v))};
 
-          if(!key_only) {
-              res.append("->");
-              res += detail::to_string(detail::pair_adaptor<element_t>::second(v));
-          }
-          return res;
+            if(!key_only) {
+                res.append("->");
+                res += detail::to_string(detail::pair_adaptor<element_t>::second(v));
+            }
+            return res;
         },
         ","));
     out.push_back('}');
@@ -2647,7 +3982,7 @@ auto search(const T &set, const V &val) -> std::pair<bool, decltype(std::begin(d
     using element_t = typename detail::element_type<T>::type;
     auto &setref = detail::smart_deref(set);
     auto it = std::find_if(std::begin(setref), std::end(setref), [&val](decltype(*std::begin(setref)) v) {
-      return (detail::pair_adaptor<element_t>::first(v) == val);
+        return (detail::pair_adaptor<element_t>::first(v) == val);
     });
     return {(it != std::end(setref)), it};
 }
@@ -2663,7 +3998,7 @@ auto search(const T &set, const V &val) -> std::pair<bool, decltype(std::begin(d
 /// A search function with a filter function
 template <typename T, typename V>
 auto search(const T &set, const V &val, const std::function<V(V)> &filter_function)
--> std::pair<bool, decltype(std::begin(detail::smart_deref(set)))> {
+    -> std::pair<bool, decltype(std::begin(detail::smart_deref(set)))> {
     using element_t = typename detail::element_type<T>::type;
     // do the potentially faster first search
     auto res = search(set, val);
@@ -2673,9 +4008,9 @@ auto search(const T &set, const V &val, const std::function<V(V)> &filter_functi
     // if we haven't found it do the longer linear search with all the element translations
     auto &setref = detail::smart_deref(set);
     auto it = std::find_if(std::begin(setref), std::end(setref), [&](decltype(*std::begin(setref)) v) {
-      V a{detail::pair_adaptor<element_t>::first(v)};
-      a = filter_function(a);
-      return (a == val);
+        V a{detail::pair_adaptor<element_t>::first(v)};
+        a = filter_function(a);
+        return (a == val);
     });
     return {(it != std::end(setref)), it};
 }
@@ -2688,9 +4023,8 @@ template <typename T>
 inline typename std::enable_if<std::is_signed<T>::value, T>::type overflowCheck(const T &a, const T &b) {
     if((a > 0) == (b > 0)) {
         return ((std::numeric_limits<T>::max)() / (std::abs)(a) < (std::abs)(b));
-    } else {
-        return ((std::numeric_limits<T>::min)() / (std::abs)(a) > -(std::abs)(b));
     }
+    return ((std::numeric_limits<T>::min)() / (std::abs)(a) > -(std::abs)(b));
 }
 /// Do a check for overflow on unsigned numbers
 template <typename T>
@@ -2733,7 +4067,7 @@ class IsMember : public Validator {
 
     /// This allows in-place construction using an initializer list
     template <typename T, typename... Args>
-    IsMember(std::initializer_list<T> values, Args &&... args)
+    IsMember(std::initializer_list<T> values, Args &&...args)
         : IsMember(std::vector<T>(values), std::forward<Args>(args)...) {}
 
     /// This checks to see if an item is in a set (empty function)
@@ -2749,7 +4083,7 @@ class IsMember : public Validator {
         using item_t = typename detail::pair_adaptor<element_t>::first_type;  // Is value_type if not a map
 
         using local_item_t = typename IsMemberType<item_t>::type;  // This will convert bad types to good ones
-        // (const char * to std::string)
+                                                                   // (const char * to std::string)
 
         // Make a local copy of the filter function, using a std::function if not one already
         std::function<local_item_t(local_item_t)> filter_fn = filter_function;
@@ -2760,38 +4094,37 @@ class IsMember : public Validator {
         // This is the function that validates
         // It stores a copy of the set pointer-like, so shared_ptr will stay alive
         func_ = [set, filter_fn](std::string &input) {
-          local_item_t b;
-          if(!detail::lexical_cast(input, b)) {
-              throw ValidationError(input);  // name is added later
-          }
-          if(filter_fn) {
-              b = filter_fn(b);
-          }
-          auto res = detail::search(set, b, filter_fn);
-          if(res.first) {
-              // Make sure the version in the input string is identical to the one in the set
-              if(filter_fn) {
-                  input = detail::value_string(detail::pair_adaptor<element_t>::first(*(res.second)));
-              }
+            using CLI::detail::lexical_cast;
+            local_item_t b;
+            if(!lexical_cast(input, b)) {
+                throw ValidationError(input);  // name is added later
+            }
+            if(filter_fn) {
+                b = filter_fn(b);
+            }
+            auto res = detail::search(set, b, filter_fn);
+            if(res.first) {
+                // Make sure the version in the input string is identical to the one in the set
+                if(filter_fn) {
+                    input = detail::value_string(detail::pair_adaptor<element_t>::first(*(res.second)));
+                }
 
-              // Return empty error string (success)
-              return std::string{};
-          }
+                // Return empty error string (success)
+                return std::string{};
+            }
 
-          // If you reach this point, the result was not found
-          std::string out(" not in ");
-          out += detail::generate_set(detail::smart_deref(set));
-          return out;
+            // If you reach this point, the result was not found
+            return input + " not in " + detail::generate_set(detail::smart_deref(set));
         };
     }
 
     /// You can pass in as many filter functions as you like, they nest (string only currently)
     template <typename T, typename... Args>
-    IsMember(T &&set, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&... other)
+    IsMember(T &&set, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&...other)
         : IsMember(
-        std::forward<T>(set),
-        [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
-        other...) {}
+              std::forward<T>(set),
+              [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
+              other...) {}
 };
 
 /// definition of the default transformation object
@@ -2804,7 +4137,7 @@ class Transformer : public Validator {
 
     /// This allows in-place construction
     template <typename... Args>
-    Transformer(std::initializer_list<std::pair<std::string, std::string>> values, Args &&... args)
+    Transformer(std::initializer_list<std::pair<std::string, std::string>> values, Args &&...args)
         : Transformer(TransformPairs<std::string>(values), std::forward<Args>(args)...) {}
 
     /// direct map of std::string to std::string
@@ -2821,7 +4154,7 @@ class Transformer : public Validator {
         using element_t = typename detail::element_type<T>::type;             // Removes (smart) pointers if needed
         using item_t = typename detail::pair_adaptor<element_t>::first_type;  // Is value_type if not a map
         using local_item_t = typename IsMemberType<item_t>::type;             // Will convert bad types to good ones
-        // (const char * to std::string)
+                                                                              // (const char * to std::string)
 
         // Make a local copy of the filter function, using a std::function if not one already
         std::function<local_item_t(local_item_t)> filter_fn = filter_function;
@@ -2830,29 +4163,30 @@ class Transformer : public Validator {
         desc_function_ = [mapping]() { return detail::generate_map(detail::smart_deref(mapping)); };
 
         func_ = [mapping, filter_fn](std::string &input) {
-          local_item_t b;
-          if(!detail::lexical_cast(input, b)) {
-              return std::string();
-              // there is no possible way we can match anything in the mapping if we can't convert so just return
-          }
-          if(filter_fn) {
-              b = filter_fn(b);
-          }
-          auto res = detail::search(mapping, b, filter_fn);
-          if(res.first) {
-              input = detail::value_string(detail::pair_adaptor<element_t>::second(*res.second));
-          }
-          return std::string{};
+            using CLI::detail::lexical_cast;
+            local_item_t b;
+            if(!lexical_cast(input, b)) {
+                return std::string();
+                // there is no possible way we can match anything in the mapping if we can't convert so just return
+            }
+            if(filter_fn) {
+                b = filter_fn(b);
+            }
+            auto res = detail::search(mapping, b, filter_fn);
+            if(res.first) {
+                input = detail::value_string(detail::pair_adaptor<element_t>::second(*res.second));
+            }
+            return std::string{};
         };
     }
 
     /// You can pass in as many filter functions as you like, they nest
     template <typename T, typename... Args>
-    Transformer(T &&mapping, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&... other)
+    Transformer(T &&mapping, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&...other)
         : Transformer(
-        std::forward<T>(mapping),
-        [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
-        other...) {}
+              std::forward<T>(mapping),
+              [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
+              other...) {}
 };
 
 /// translate named items to other or a value set
@@ -2862,7 +4196,7 @@ class CheckedTransformer : public Validator {
 
     /// This allows in-place construction
     template <typename... Args>
-    CheckedTransformer(std::initializer_list<std::pair<std::string, std::string>> values, Args &&... args)
+    CheckedTransformer(std::initializer_list<std::pair<std::string, std::string>> values, Args &&...args)
         : CheckedTransformer(TransformPairs<std::string>(values), std::forward<Args>(args)...) {}
 
     /// direct map of std::string to std::string
@@ -2879,56 +4213,57 @@ class CheckedTransformer : public Validator {
         using element_t = typename detail::element_type<T>::type;             // Removes (smart) pointers if needed
         using item_t = typename detail::pair_adaptor<element_t>::first_type;  // Is value_type if not a map
         using local_item_t = typename IsMemberType<item_t>::type;             // Will convert bad types to good ones
-        // (const char * to std::string)
+                                                                              // (const char * to std::string)
         using iteration_type_t = typename detail::pair_adaptor<element_t>::value_type;  // the type of the object pair
 
         // Make a local copy of the filter function, using a std::function if not one already
         std::function<local_item_t(local_item_t)> filter_fn = filter_function;
 
         auto tfunc = [mapping]() {
-          std::string out("value in ");
-          out += detail::generate_map(detail::smart_deref(mapping)) + " OR {";
-          out += detail::join(
-              detail::smart_deref(mapping),
-              [](const iteration_type_t &v) { return detail::to_string(detail::pair_adaptor<element_t>::second(v)); },
-              ",");
-          out.push_back('}');
-          return out;
+            std::string out("value in ");
+            out += detail::generate_map(detail::smart_deref(mapping)) + " OR {";
+            out += detail::join(
+                detail::smart_deref(mapping),
+                [](const iteration_type_t &v) { return detail::to_string(detail::pair_adaptor<element_t>::second(v)); },
+                ",");
+            out.push_back('}');
+            return out;
         };
 
         desc_function_ = tfunc;
 
         func_ = [mapping, tfunc, filter_fn](std::string &input) {
-          local_item_t b;
-          bool converted = detail::lexical_cast(input, b);
-          if(converted) {
-              if(filter_fn) {
-                  b = filter_fn(b);
-              }
-              auto res = detail::search(mapping, b, filter_fn);
-              if(res.first) {
-                  input = detail::value_string(detail::pair_adaptor<element_t>::second(*res.second));
-                  return std::string{};
-              }
-          }
-          for(const auto &v : detail::smart_deref(mapping)) {
-              auto output_string = detail::value_string(detail::pair_adaptor<element_t>::second(v));
-              if(output_string == input) {
-                  return std::string();
-              }
-          }
+            using CLI::detail::lexical_cast;
+            local_item_t b;
+            bool converted = lexical_cast(input, b);
+            if(converted) {
+                if(filter_fn) {
+                    b = filter_fn(b);
+                }
+                auto res = detail::search(mapping, b, filter_fn);
+                if(res.first) {
+                    input = detail::value_string(detail::pair_adaptor<element_t>::second(*res.second));
+                    return std::string{};
+                }
+            }
+            for(const auto &v : detail::smart_deref(mapping)) {
+                auto output_string = detail::value_string(detail::pair_adaptor<element_t>::second(v));
+                if(output_string == input) {
+                    return std::string();
+                }
+            }
 
-          return "Check " + input + " " + tfunc() + " FAILED";
+            return "Check " + input + " " + tfunc() + " FAILED";
         };
     }
 
     /// You can pass in as many filter functions as you like, they nest
     template <typename T, typename... Args>
-    CheckedTransformer(T &&mapping, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&... other)
+    CheckedTransformer(T &&mapping, filter_fn_t filter_fn_1, filter_fn_t filter_fn_2, Args &&...other)
         : CheckedTransformer(
-        std::forward<T>(mapping),
-        [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
-        other...) {}
+              std::forward<T>(mapping),
+              [filter_fn_1, filter_fn_2](std::string a) { return filter_fn_2(filter_fn_1(a)); },
+              other...) {}
 };
 
 /// Helper function to allow ignore_case to be passed to IsMember or Transform
@@ -2978,59 +4313,68 @@ class AsNumberWithUnit : public Validator {
 
         // transform function
         func_ = [mapping, opts](std::string &input) -> std::string {
-          Number num;
-
-          detail::rtrim(input);
-          if(input.empty()) {
-              throw ValidationError("Input is empty");
-          }
-
-          // Find split position between number and prefix
-          auto unit_begin = input.end();
-          while(unit_begin > input.begin() && std::isalpha(*(unit_begin - 1), std::locale())) {
-              --unit_begin;
-          }
-
-          std::string unit{unit_begin, input.end()};
-          input.resize(static_cast<std::size_t>(std::distance(input.begin(), unit_begin)));
-          detail::trim(input);
-
-          if(opts & UNIT_REQUIRED && unit.empty()) {
-              throw ValidationError("Missing mandatory unit");
-          }
-          if(opts & CASE_INSENSITIVE) {
-              unit = detail::to_lower(unit);
-          }
-
-          bool converted = detail::lexical_cast(input, num);
-          if(!converted) {
-              throw ValidationError(std::string("Value ") + input + " could not be converted to " +
-                                    detail::type_name<Number>());
-          }
-
-          if(unit.empty()) {
-              // No need to modify input if no unit passed
-              return {};
-          }
-
-          // find corresponding factor
-          auto it = mapping.find(unit);
-          if(it == mapping.end()) {
-              throw ValidationError(unit +
-                                    " unit not recognized. "
-                                    "Allowed values: " +
-                                    detail::generate_map(mapping, true));
-          }
-
-          // perform safe multiplication
-          bool ok = detail::checked_multiply(num, it->second);
-          if(!ok) {
-              throw ValidationError(detail::to_string(num) + " multiplied by " + unit +
-                                    " factor would cause number overflow. Use smaller value.");
-          }
-          input = detail::to_string(num);
-
-          return {};
+            Number num{};
+
+            detail::rtrim(input);
+            if(input.empty()) {
+                throw ValidationError("Input is empty");
+            }
+
+            // Find split position between number and prefix
+            auto unit_begin = input.end();
+            while(unit_begin > input.begin() && std::isalpha(*(unit_begin - 1), std::locale())) {
+                --unit_begin;
+            }
+
+            std::string unit{unit_begin, input.end()};
+            input.resize(static_cast<std::size_t>(std::distance(input.begin(), unit_begin)));
+            detail::trim(input);
+
+            if(opts & UNIT_REQUIRED && unit.empty()) {
+                throw ValidationError("Missing mandatory unit");
+            }
+            if(opts & CASE_INSENSITIVE) {
+                unit = detail::to_lower(unit);
+            }
+            if(unit.empty()) {
+                using CLI::detail::lexical_cast;
+                if(!lexical_cast(input, num)) {
+                    throw ValidationError(std::string("Value ") + input + " could not be converted to " +
+                                          detail::type_name<Number>());
+                }
+                // No need to modify input if no unit passed
+                return {};
+            }
+
+            // find corresponding factor
+            auto it = mapping.find(unit);
+            if(it == mapping.end()) {
+                throw ValidationError(unit +
+                                      " unit not recognized. "
+                                      "Allowed values: " +
+                                      detail::generate_map(mapping, true));
+            }
+
+            if(!input.empty()) {
+                using CLI::detail::lexical_cast;
+                bool converted = lexical_cast(input, num);
+                if(!converted) {
+                    throw ValidationError(std::string("Value ") + input + " could not be converted to " +
+                                          detail::type_name<Number>());
+                }
+                // perform safe multiplication
+                bool ok = detail::checked_multiply(num, it->second);
+                if(!ok) {
+                    throw ValidationError(detail::to_string(num) + " multiplied by " + unit +
+                                          " factor would cause number overflow. Use smaller value.");
+                }
+            } else {
+                num = static_cast<Number>(it->second);
+            }
+
+            input = detail::to_string(num);
+
+            return {};
         };
     }
 
@@ -3075,6 +4419,10 @@ class AsNumberWithUnit : public Validator {
     }
 };
 
+inline AsNumberWithUnit::Options operator|(const AsNumberWithUnit::Options &a, const AsNumberWithUnit::Options &b) {
+    return static_cast<AsNumberWithUnit::Options>(static_cast<int>(a) | static_cast<int>(b));
+}
+
 /// Converts a human-readable size string (with unit literal) to uin64_t size.
 /// Example:
 ///   "100" => 100
@@ -3097,44 +4445,14 @@ class AsSizeValue : public AsNumberWithUnit {
     /// The first option is formally correct, but
     /// the second interpretation is more wide-spread
     /// (see https://en.wikipedia.org/wiki/Binary_prefix).
-    explicit AsSizeValue(bool kb_is_1000) : AsNumberWithUnit(get_mapping(kb_is_1000)) {
-        if(kb_is_1000) {
-            description("SIZE [b, kb(=1000b), kib(=1024b), ...]");
-        } else {
-            description("SIZE [b, kb(=1024b), ...]");
-        }
-    }
+    explicit AsSizeValue(bool kb_is_1000);
 
   private:
     /// Get <size unit, factor> mapping
-    static std::map<std::string, result_t> init_mapping(bool kb_is_1000) {
-        std::map<std::string, result_t> m;
-        result_t k_factor = kb_is_1000 ? 1000 : 1024;
-        result_t ki_factor = 1024;
-        result_t k = 1;
-        result_t ki = 1;
-        m["b"] = 1;
-        for(std::string p : {"k", "m", "g", "t", "p", "e"}) {
-            k *= k_factor;
-            ki *= ki_factor;
-            m[p] = k;
-            m[p + "b"] = k;
-            m[p + "i"] = ki;
-            m[p + "ib"] = ki;
-        }
-        return m;
-    }
+    static std::map<std::string, result_t> init_mapping(bool kb_is_1000);
 
     /// Cache calculated mapping
-    static std::map<std::string, result_t> get_mapping(bool kb_is_1000) {
-        if(kb_is_1000) {
-            static auto m = init_mapping(true);
-            return m;
-        } else {
-            static auto m = init_mapping(false);
-            return m;
-        }
-    }
+    static std::map<std::string, result_t> get_mapping(bool kb_is_1000);
 };
 
 namespace detail {
@@ -3142,7 +4460,308 @@ namespace detail {
 /// the string is assumed to contain a file name followed by other arguments
 /// the return value contains is a pair with the first argument containing the program name and the second
 /// everything else.
-inline std::pair<std::string, std::string> split_program_name(std::string commandline) {
+CLI11_INLINE std::pair<std::string, std::string> split_program_name(std::string commandline);
+
+}  // namespace detail
+/// @}
+
+
+
+
+CLI11_INLINE std::string Validator::operator()(std::string &str) const {
+    std::string retstring;
+    if(active_) {
+        if(non_modifying_) {
+            std::string value = str;
+            retstring = func_(value);
+        } else {
+            retstring = func_(str);
+        }
+    }
+    return retstring;
+}
+
+CLI11_NODISCARD CLI11_INLINE Validator Validator::description(std::string validator_desc) const {
+    Validator newval(*this);
+    newval.desc_function_ = [validator_desc]() { return validator_desc; };
+    return newval;
+}
+
+CLI11_INLINE Validator Validator::operator&(const Validator &other) const {
+    Validator newval;
+
+    newval._merge_description(*this, other, " AND ");
+
+    // Give references (will make a copy in lambda function)
+    const std::function<std::string(std::string & filename)> &f1 = func_;
+    const std::function<std::string(std::string & filename)> &f2 = other.func_;
+
+    newval.func_ = [f1, f2](std::string &input) {
+        std::string s1 = f1(input);
+        std::string s2 = f2(input);
+        if(!s1.empty() && !s2.empty())
+            return std::string("(") + s1 + ") AND (" + s2 + ")";
+        return s1 + s2;
+    };
+
+    newval.active_ = active_ && other.active_;
+    newval.application_index_ = application_index_;
+    return newval;
+}
+
+CLI11_INLINE Validator Validator::operator|(const Validator &other) const {
+    Validator newval;
+
+    newval._merge_description(*this, other, " OR ");
+
+    // Give references (will make a copy in lambda function)
+    const std::function<std::string(std::string &)> &f1 = func_;
+    const std::function<std::string(std::string &)> &f2 = other.func_;
+
+    newval.func_ = [f1, f2](std::string &input) {
+        std::string s1 = f1(input);
+        std::string s2 = f2(input);
+        if(s1.empty() || s2.empty())
+            return std::string();
+
+        return std::string("(") + s1 + ") OR (" + s2 + ")";
+    };
+    newval.active_ = active_ && other.active_;
+    newval.application_index_ = application_index_;
+    return newval;
+}
+
+CLI11_INLINE Validator Validator::operator!() const {
+    Validator newval;
+    const std::function<std::string()> &dfunc1 = desc_function_;
+    newval.desc_function_ = [dfunc1]() {
+        auto str = dfunc1();
+        return (!str.empty()) ? std::string("NOT ") + str : std::string{};
+    };
+    // Give references (will make a copy in lambda function)
+    const std::function<std::string(std::string & res)> &f1 = func_;
+
+    newval.func_ = [f1, dfunc1](std::string &test) -> std::string {
+        std::string s1 = f1(test);
+        if(s1.empty()) {
+            return std::string("check ") + dfunc1() + " succeeded improperly";
+        }
+        return std::string{};
+    };
+    newval.active_ = active_;
+    newval.application_index_ = application_index_;
+    return newval;
+}
+
+CLI11_INLINE void
+Validator::_merge_description(const Validator &val1, const Validator &val2, const std::string &merger) {
+
+    const std::function<std::string()> &dfunc1 = val1.desc_function_;
+    const std::function<std::string()> &dfunc2 = val2.desc_function_;
+
+    desc_function_ = [=]() {
+        std::string f1 = dfunc1();
+        std::string f2 = dfunc2();
+        if((f1.empty()) || (f2.empty())) {
+            return f1 + f2;
+        }
+        return std::string(1, '(') + f1 + ')' + merger + '(' + f2 + ')';
+    };
+}
+
+namespace detail {
+
+#if defined CLI11_HAS_FILESYSTEM && CLI11_HAS_FILESYSTEM > 0
+CLI11_INLINE path_type check_path(const char *file) noexcept {
+    std::error_code ec;
+    auto stat = std::filesystem::status(to_path(file), ec);
+    if(ec) {
+        return path_type::nonexistent;
+    }
+    switch(stat.type()) {
+    case std::filesystem::file_type::none:  // LCOV_EXCL_LINE
+    case std::filesystem::file_type::not_found:
+        return path_type::nonexistent;  // LCOV_EXCL_LINE
+    case std::filesystem::file_type::directory:
+        return path_type::directory;
+    case std::filesystem::file_type::symlink:
+    case std::filesystem::file_type::block:
+    case std::filesystem::file_type::character:
+    case std::filesystem::file_type::fifo:
+    case std::filesystem::file_type::socket:
+    case std::filesystem::file_type::regular:
+    case std::filesystem::file_type::unknown:
+    default:
+        return path_type::file;
+    }
+}
+#else
+CLI11_INLINE path_type check_path(const char *file) noexcept {
+#if defined(_MSC_VER)
+    struct __stat64 buffer;
+    if(_stat64(file, &buffer) == 0) {
+        return ((buffer.st_mode & S_IFDIR) != 0) ? path_type::directory : path_type::file;
+    }
+#else
+    struct stat buffer;
+    if(stat(file, &buffer) == 0) {
+        return ((buffer.st_mode & S_IFDIR) != 0) ? path_type::directory : path_type::file;
+    }
+#endif
+    return path_type::nonexistent;
+}
+#endif
+
+CLI11_INLINE ExistingFileValidator::ExistingFileValidator() : Validator("FILE") {
+    func_ = [](std::string &filename) {
+        auto path_result = check_path(filename.c_str());
+        if(path_result == path_type::nonexistent) {
+            return "File does not exist: " + filename;
+        }
+        if(path_result == path_type::directory) {
+            return "File is actually a directory: " + filename;
+        }
+        return std::string();
+    };
+}
+
+CLI11_INLINE ExistingDirectoryValidator::ExistingDirectoryValidator() : Validator("DIR") {
+    func_ = [](std::string &filename) {
+        auto path_result = check_path(filename.c_str());
+        if(path_result == path_type::nonexistent) {
+            return "Directory does not exist: " + filename;
+        }
+        if(path_result == path_type::file) {
+            return "Directory is actually a file: " + filename;
+        }
+        return std::string();
+    };
+}
+
+CLI11_INLINE ExistingPathValidator::ExistingPathValidator() : Validator("PATH(existing)") {
+    func_ = [](std::string &filename) {
+        auto path_result = check_path(filename.c_str());
+        if(path_result == path_type::nonexistent) {
+            return "Path does not exist: " + filename;
+        }
+        return std::string();
+    };
+}
+
+CLI11_INLINE NonexistentPathValidator::NonexistentPathValidator() : Validator("PATH(non-existing)") {
+    func_ = [](std::string &filename) {
+        auto path_result = check_path(filename.c_str());
+        if(path_result != path_type::nonexistent) {
+            return "Path already exists: " + filename;
+        }
+        return std::string();
+    };
+}
+
+CLI11_INLINE IPV4Validator::IPV4Validator() : Validator("IPV4") {
+    func_ = [](std::string &ip_addr) {
+        auto result = CLI::detail::split(ip_addr, '.');
+        if(result.size() != 4) {
+            return std::string("Invalid IPV4 address must have four parts (") + ip_addr + ')';
+        }
+        int num = 0;
+        for(const auto &var : result) {
+            using CLI::detail::lexical_cast;
+            bool retval = lexical_cast(var, num);
+            if(!retval) {
+                return std::string("Failed parsing number (") + var + ')';
+            }
+            if(num < 0 || num > 255) {
+                return std::string("Each IP number must be between 0 and 255 ") + var;
+            }
+        }
+        return std::string{};
+    };
+}
+
+CLI11_INLINE EscapedStringTransformer::EscapedStringTransformer() {
+    func_ = [](std::string &str) {
+        try {
+            if(str.size() > 1 && (str.front() == '\"' || str.front() == '\'' || str.front() == '`') &&
+               str.front() == str.back()) {
+                process_quoted_string(str);
+            } else if(str.find_first_of('\\') != std::string::npos) {
+                if(detail::is_binary_escaped_string(str)) {
+                    str = detail::extract_binary_string(str);
+                } else {
+                    str = remove_escaped_characters(str);
+                }
+            }
+            return std::string{};
+        } catch(const std::invalid_argument &ia) {
+            return std::string(ia.what());
+        }
+    };
+}
+}  // namespace detail
+
+CLI11_INLINE FileOnDefaultPath::FileOnDefaultPath(std::string default_path, bool enableErrorReturn)
+    : Validator("FILE") {
+    func_ = [default_path, enableErrorReturn](std::string &filename) {
+        auto path_result = detail::check_path(filename.c_str());
+        if(path_result == detail::path_type::nonexistent) {
+            std::string test_file_path = default_path;
+            if(default_path.back() != '/' && default_path.back() != '\\') {
+                // Add folder separator
+                test_file_path += '/';
+            }
+            test_file_path.append(filename);
+            path_result = detail::check_path(test_file_path.c_str());
+            if(path_result == detail::path_type::file) {
+                filename = test_file_path;
+            } else {
+                if(enableErrorReturn) {
+                    return "File does not exist: " + filename;
+                }
+            }
+        }
+        return std::string{};
+    };
+}
+
+CLI11_INLINE AsSizeValue::AsSizeValue(bool kb_is_1000) : AsNumberWithUnit(get_mapping(kb_is_1000)) {
+    if(kb_is_1000) {
+        description("SIZE [b, kb(=1000b), kib(=1024b), ...]");
+    } else {
+        description("SIZE [b, kb(=1024b), ...]");
+    }
+}
+
+CLI11_INLINE std::map<std::string, AsSizeValue::result_t> AsSizeValue::init_mapping(bool kb_is_1000) {
+    std::map<std::string, result_t> m;
+    result_t k_factor = kb_is_1000 ? 1000 : 1024;
+    result_t ki_factor = 1024;
+    result_t k = 1;
+    result_t ki = 1;
+    m["b"] = 1;
+    for(std::string p : {"k", "m", "g", "t", "p", "e"}) {
+        k *= k_factor;
+        ki *= ki_factor;
+        m[p] = k;
+        m[p + "b"] = k;
+        m[p + "i"] = ki;
+        m[p + "ib"] = ki;
+    }
+    return m;
+}
+
+CLI11_INLINE std::map<std::string, AsSizeValue::result_t> AsSizeValue::get_mapping(bool kb_is_1000) {
+    if(kb_is_1000) {
+        static auto m = init_mapping(true);
+        return m;
+    }
+    static auto m = init_mapping(false);
+    return m;
+}
+
+namespace detail {
+
+CLI11_INLINE std::pair<std::string, std::string> split_program_name(std::string commandline) {
     // try to determine the programName
     std::pair<std::string, std::string> vals;
     trim(commandline);
@@ -3152,14 +4771,37 @@ inline std::pair<std::string, std::string> split_program_name(std::string comman
         if(esp == std::string::npos) {
             // if we have reached the end and haven't found a valid file just assume the first argument is the
             // program name
-            esp = commandline.find_first_of(' ', 1);
+            if(commandline[0] == '"' || commandline[0] == '\'' || commandline[0] == '`') {
+                bool embeddedQuote = false;
+                auto keyChar = commandline[0];
+                auto end = commandline.find_first_of(keyChar, 1);
+                while((end != std::string::npos) && (commandline[end - 1] == '\\')) {  // deal with escaped quotes
+                    end = commandline.find_first_of(keyChar, end + 1);
+                    embeddedQuote = true;
+                }
+                if(end != std::string::npos) {
+                    vals.first = commandline.substr(1, end - 1);
+                    esp = end + 1;
+                    if(embeddedQuote) {
+                        vals.first = find_and_replace(vals.first, std::string("\\") + keyChar, std::string(1, keyChar));
+                    }
+                } else {
+                    esp = commandline.find_first_of(' ', 1);
+                }
+            } else {
+                esp = commandline.find_first_of(' ', 1);
+            }
+
             break;
         }
     }
-    vals.first = commandline.substr(0, esp);
-    rtrim(vals.first);
+    if(vals.first.empty()) {
+        vals.first = commandline.substr(0, esp);
+        rtrim(vals.first);
+    }
+
     // strip the program name
-    vals.second = (esp != std::string::npos) ? commandline.substr(esp + 1) : std::string{};
+    vals.second = (esp < commandline.length() - 1) ? commandline.substr(esp + 1) : std::string{};
     ltrim(vals.second);
     return vals;
 }
@@ -3167,11 +4809,8 @@ inline std::pair<std::string, std::string> split_program_name(std::string comman
 }  // namespace detail
 /// @}
 
-}  // namespace CLI
 
-// From FormatterFwd.hpp:
 
-namespace CLI {
 
 class Option;
 class App;
@@ -3211,6 +4850,8 @@ class FormatterBase {
     FormatterBase() = default;
     FormatterBase(const FormatterBase &) = default;
     FormatterBase(FormatterBase &&) = default;
+    FormatterBase &operator=(const FormatterBase &) = default;
+    FormatterBase &operator=(FormatterBase &&) = default;
 
     /// Adding a destructor in this form to work around bug in GCC 4.7
     virtual ~FormatterBase() noexcept {}  // NOLINT(modernize-use-equals-default)
@@ -3233,15 +4874,14 @@ class FormatterBase {
     ///@{
 
     /// Get the current value of a name (REQUIRED, etc.)
-    std::string get_label(std::string key) const {
+    CLI11_NODISCARD std::string get_label(std::string key) const {
         if(labels_.find(key) == labels_.end())
             return key;
-        else
-            return labels_.at(key);
+        return labels_.at(key);
     }
 
     /// Get the current column width
-    std::size_t get_column_width() const { return column_width_; }
+    CLI11_NODISCARD std::size_t get_column_width() const { return column_width_; }
 
     ///@}
 };
@@ -3273,13 +4913,16 @@ class Formatter : public FormatterBase {
     Formatter() = default;
     Formatter(const Formatter &) = default;
     Formatter(Formatter &&) = default;
+    Formatter &operator=(const Formatter &) = default;
+    Formatter &operator=(Formatter &&) = default;
 
     /// @name Overridables
     ///@{
 
     /// This prints out a group of options with title
     ///
-    virtual std::string make_group(std::string group, bool is_positional, std::vector<const Option *> opts) const;
+    CLI11_NODISCARD virtual std::string
+    make_group(std::string group, bool is_positional, std::vector<const Option *> opts) const;
 
     /// This prints out just the positionals "group"
     virtual std::string make_positionals(const App *app) const;
@@ -3335,11 +4978,8 @@ class Formatter : public FormatterBase {
     ///@}
 };
 
-}  // namespace CLI
 
-// From Option.hpp:
 
-namespace CLI {
 
 using results_t = std::vector<std::string>;
 /// callback function definition
@@ -3355,7 +4995,9 @@ enum class MultiOptionPolicy : char {
     TakeLast,   //!< take only the last Expected number of arguments
     TakeFirst,  //!< take only the first Expected number of arguments
     Join,       //!< merge all the arguments together into a single string via the delimiter character default('\n')
-    TakeAll     //!< just get all the passed argument regardless
+    TakeAll,    //!< just get all the passed argument regardless
+    Sum,        //!< sum all the arguments together if numerical or concatenate directly without delimiter
+    Reverse,    //!< take only the last Expected number of arguments in reverse order
 };
 
 /// This is the CRTP base class for Option and OptionDefaults. It was designed this way
@@ -3392,23 +5034,16 @@ template <typename CRTP> class OptionBase {
     MultiOptionPolicy multi_option_policy_{MultiOptionPolicy::Throw};
 
     /// Copy the contents to another similar class (one based on OptionBase)
-    template <typename T> void copy_to(T *other) const {
-        other->group(group_);
-        other->required(required_);
-        other->ignore_case(ignore_case_);
-        other->ignore_underscore(ignore_underscore_);
-        other->configurable(configurable_);
-        other->disable_flag_override(disable_flag_override_);
-        other->delimiter(delimiter_);
-        other->always_capture_default(always_capture_default_);
-        other->multi_option_policy(multi_option_policy_);
-    }
+    template <typename T> void copy_to(T *other) const;
 
   public:
     // setters
 
     /// Changes the group membership
     CRTP *group(const std::string &name) {
+        if(!detail::valid_alias_name_string(name)) {
+            throw IncorrectConstruction("Group names may not contain newlines or null characters");
+        }
         group_ = name;
         return static_cast<CRTP *>(this);
     }
@@ -3430,44 +5065,44 @@ template <typename CRTP> class OptionBase {
     // Getters
 
     /// Get the group of this option
-    const std::string &get_group() const { return group_; }
+    CLI11_NODISCARD const std::string &get_group() const { return group_; }
 
     /// True if this is a required option
-    bool get_required() const { return required_; }
+    CLI11_NODISCARD bool get_required() const { return required_; }
 
     /// The status of ignore case
-    bool get_ignore_case() const { return ignore_case_; }
+    CLI11_NODISCARD bool get_ignore_case() const { return ignore_case_; }
 
     /// The status of ignore_underscore
-    bool get_ignore_underscore() const { return ignore_underscore_; }
+    CLI11_NODISCARD bool get_ignore_underscore() const { return ignore_underscore_; }
 
     /// The status of configurable
-    bool get_configurable() const { return configurable_; }
+    CLI11_NODISCARD bool get_configurable() const { return configurable_; }
 
     /// The status of configurable
-    bool get_disable_flag_override() const { return disable_flag_override_; }
+    CLI11_NODISCARD bool get_disable_flag_override() const { return disable_flag_override_; }
 
     /// Get the current delimiter char
-    char get_delimiter() const { return delimiter_; }
+    CLI11_NODISCARD char get_delimiter() const { return delimiter_; }
 
     /// Return true if this will automatically capture the default value for help printing
-    bool get_always_capture_default() const { return always_capture_default_; }
+    CLI11_NODISCARD bool get_always_capture_default() const { return always_capture_default_; }
 
     /// The status of the multi option policy
-    MultiOptionPolicy get_multi_option_policy() const { return multi_option_policy_; }
+    CLI11_NODISCARD MultiOptionPolicy get_multi_option_policy() const { return multi_option_policy_; }
 
     // Shortcuts for multi option policy
 
     /// Set the multi option policy to take last
     CRTP *take_last() {
-        auto self = static_cast<CRTP *>(this);
+        auto *self = static_cast<CRTP *>(this);
         self->multi_option_policy(MultiOptionPolicy::TakeLast);
         return self;
     }
 
     /// Set the multi option policy to take last
     CRTP *take_first() {
-        auto self = static_cast<CRTP *>(this);
+        auto *self = static_cast<CRTP *>(this);
         self->multi_option_policy(MultiOptionPolicy::TakeFirst);
         return self;
     }
@@ -3481,7 +5116,7 @@ template <typename CRTP> class OptionBase {
 
     /// Set the multi option policy to join
     CRTP *join() {
-        auto self = static_cast<CRTP *>(this);
+        auto *self = static_cast<CRTP *>(this);
         self->multi_option_policy(MultiOptionPolicy::Join);
         return self;
     }
@@ -3582,6 +5217,9 @@ class Option : public OptionBase<Option> {
     /// A human readable default value, either manually set, captured, or captured by default
     std::string default_str_{};
 
+    /// If given, replace the text that describes the option type and usage in the help text
+    std::string option_text_{};
+
     /// A human readable type value, set when App creates this
     ///
     /// This is a lambda function so "types" can be dynamic, such as when a set prints its contents.
@@ -3618,7 +5256,7 @@ class Option : public OptionBase<Option> {
     /// @name Other
     ///@{
 
-    /// Remember the parent app
+    /// link back up to the parent App for fallthrough
     App *parent_{nullptr};
 
     /// Options store a callback to do all the work
@@ -3633,7 +5271,7 @@ class Option : public OptionBase<Option> {
     /// results after reduction
     results_t proc_results_{};
     /// enumeration for the option state machine
-    enum class option_state {
+    enum class option_state : char {
         parsing = 0,       //!< The option is currently collecting parsed results
         validated = 2,     //!< the results have been validated
         reduced = 4,       //!< a subset of results has been generated
@@ -3647,6 +5285,12 @@ class Option : public OptionBase<Option> {
     bool flag_like_{false};
     /// Control option to run the callback to set the default
     bool run_callback_for_default_{false};
+    /// flag indicating a separator needs to be injected after each argument call
+    bool inject_separator_{false};
+    /// flag indicating that the option should trigger the validation and callback chain on each result when loaded
+    bool trigger_on_result_{false};
+    /// flag indicating that the option should force the callback regardless if any results present
+    bool force_callback_{false};
     ///@}
 
     /// Making an option by hand is not defined, it must be made by the App class
@@ -3663,13 +5307,13 @@ class Option : public OptionBase<Option> {
     Option &operator=(const Option &) = delete;
 
     /// Count the total number of times an option was passed
-    std::size_t count() const { return results_.size(); }
+    CLI11_NODISCARD std::size_t count() const { return results_.size(); }
 
     /// True if the option was not passed
-    bool empty() const { return results_.empty(); }
+    CLI11_NODISCARD bool empty() const { return results_.empty(); }
 
-    /// This class is true if option is passed.
-    explicit operator bool() const { return !empty(); }
+    /// This bool operator returns true if any arguments were passed or the option callback is forced
+    explicit operator bool() const { return !empty() || force_callback_; }
 
     /// Clear the parsed results (mostly for testing)
     void clear() {
@@ -3682,46 +5326,11 @@ class Option : public OptionBase<Option> {
     ///@{
 
     /// Set the number of expected arguments
-    Option *expected(int value) {
-        if(value < 0) {
-            expected_min_ = -value;
-            if(expected_max_ < expected_min_) {
-                expected_max_ = expected_min_;
-            }
-            allow_extra_args_ = true;
-            flag_like_ = false;
-        } else if(value == detail::expected_max_vector_size) {
-            expected_min_ = 1;
-            expected_max_ = detail::expected_max_vector_size;
-            allow_extra_args_ = true;
-            flag_like_ = false;
-        } else {
-            expected_min_ = value;
-            expected_max_ = value;
-            flag_like_ = (expected_min_ == 0);
-        }
-        return this;
-    }
+    Option *expected(int value);
 
     /// Set the range of expected arguments
-    Option *expected(int value_min, int value_max) {
-        if(value_min < 0) {
-            value_min = -value_min;
-        }
-
-        if(value_max < 0) {
-            value_max = detail::expected_max_vector_size;
-        }
-        if(value_max < value_min) {
-            expected_min_ = value_max;
-            expected_max_ = value_min;
-        } else {
-            expected_max_ = value_max;
-            expected_min_ = value_min;
-        }
+    Option *expected(int value_min, int value_max);
 
-        return this;
-    }
     /// Set the value of allow_extra_args which allows extra value arguments on the flag or option to be included
     /// with each instance
     Option *allow_extra_args(bool value = true) {
@@ -3729,7 +5338,22 @@ class Option : public OptionBase<Option> {
         return this;
     }
     /// Get the current value of allow extra args
-    bool get_allow_extra_args() const { return allow_extra_args_; }
+    CLI11_NODISCARD bool get_allow_extra_args() const { return allow_extra_args_; }
+    /// Set the value of trigger_on_parse which specifies that the option callback should be triggered on every parse
+    Option *trigger_on_parse(bool value = true) {
+        trigger_on_result_ = value;
+        return this;
+    }
+    /// The status of trigger on parse
+    CLI11_NODISCARD bool get_trigger_on_parse() const { return trigger_on_result_; }
+
+    /// Set the value of force_callback
+    Option *force_callback(bool value = true) {
+        force_callback_ = value;
+        return this;
+    }
+    /// The status of force_callback
+    CLI11_NODISCARD bool get_force_callback() const { return force_callback_; }
 
     /// Set the value of run_callback_for_default which controls whether the callback function should be called to set
     /// the default This is controlled automatically but could be manipulated by the user.
@@ -3738,81 +5362,32 @@ class Option : public OptionBase<Option> {
         return this;
     }
     /// Get the current value of run_callback_for_default
-    bool get_run_callback_for_default() const { return run_callback_for_default_; }
+    CLI11_NODISCARD bool get_run_callback_for_default() const { return run_callback_for_default_; }
 
     /// Adds a Validator with a built in type name
-    Option *check(Validator validator, const std::string &validator_name = "") {
-        validator.non_modifying();
-        validators_.push_back(std::move(validator));
-        if(!validator_name.empty())
-            validators_.back().name(validator_name);
-        return this;
-    }
+    Option *check(Validator validator, const std::string &validator_name = "");
 
     /// Adds a Validator. Takes a const string& and returns an error message (empty if conversion/check is okay).
     Option *check(std::function<std::string(const std::string &)> Validator,
                   std::string Validator_description = "",
-                  std::string Validator_name = "") {
-        validators_.emplace_back(Validator, std::move(Validator_description), std::move(Validator_name));
-        validators_.back().non_modifying();
-        return this;
-    }
+                  std::string Validator_name = "");
 
     /// Adds a transforming Validator with a built in type name
-    Option *transform(Validator Validator, const std::string &Validator_name = "") {
-        validators_.insert(validators_.begin(), std::move(Validator));
-        if(!Validator_name.empty())
-            validators_.front().name(Validator_name);
-        return this;
-    }
+    Option *transform(Validator Validator, const std::string &Validator_name = "");
 
     /// Adds a Validator-like function that can change result
     Option *transform(const std::function<std::string(std::string)> &func,
                       std::string transform_description = "",
-                      std::string transform_name = "") {
-        validators_.insert(validators_.begin(),
-                           Validator(
-                               [func](std::string &val) {
-                                 val = func(val);
-                                 return std::string{};
-                               },
-                               std::move(transform_description),
-                               std::move(transform_name)));
-
-        return this;
-    }
+                      std::string transform_name = "");
 
     /// Adds a user supplied function to run on each item passed in (communicate though lambda capture)
-    Option *each(const std::function<void(std::string)> &func) {
-        validators_.emplace_back(
-            [func](std::string &inout) {
-              func(inout);
-              return std::string{};
-            },
-            std::string{});
-        return this;
-    }
+    Option *each(const std::function<void(std::string)> &func);
+
     /// Get a named Validator
-    Validator *get_validator(const std::string &Validator_name = "") {
-        for(auto &Validator : validators_) {
-            if(Validator_name == Validator.get_name()) {
-                return &Validator;
-            }
-        }
-        if((Validator_name.empty()) && (!validators_.empty())) {
-            return &(validators_.front());
-        }
-        throw OptionNotFound(std::string{"Validator "} + Validator_name + " Not Found");
-    }
+    Validator *get_validator(const std::string &Validator_name = "");
 
     /// Get a Validator by index NOTE: this may not be the order of definition
-    Validator *get_validator(int index) {
-        // This is an signed int so that it is not equivalent to a pointer.
-        if(index >= 0 && index < static_cast<int>(validators_.size())) {
-            return &(validators_[static_cast<decltype(validators_)::size_type>(index)]);
-        }
-        throw OptionNotFound("Validator index is not valid");
-    }
+    Validator *get_validator(int index);
 
     /// Sets required options
     Option *needs(Option *opt) {
@@ -3834,35 +5409,14 @@ class Option : public OptionBase<Option> {
     /// Any number supported, any mix of string and Opt
     template <typename A, typename B, typename... ARG> Option *needs(A opt, B opt1, ARG... args) {
         needs(opt);
-        return needs(opt1, args...);
+        return needs(opt1, args...);  // NOLINT(readability-suspicious-call-argument)
     }
 
     /// Remove needs link from an option. Returns true if the option really was in the needs list.
-    bool remove_needs(Option *opt) {
-        auto iterator = std::find(std::begin(needs_), std::end(needs_), opt);
-
-        if(iterator == std::end(needs_)) {
-            return false;
-        }
-        needs_.erase(iterator);
-        return true;
-    }
+    bool remove_needs(Option *opt);
 
     /// Sets excluded options
-    Option *excludes(Option *opt) {
-        if(opt == this) {
-            throw(IncorrectConstruction("and option cannot exclude itself"));
-        }
-        excludes_.insert(opt);
-
-        // Help text should be symmetric - excluding a should exclude b
-        opt->excludes_.insert(this);
-
-        // Ignoring the insert return value, excluding twice is now allowed.
-        // (Mostly to allow both directions to be excluded by user, even though the library does it for you.)
-
-        return this;
-    }
+    Option *excludes(Option *opt);
 
     /// Can find a string if needed
     template <typename T = App> Option *excludes(std::string opt_name) {
@@ -3880,15 +5434,7 @@ class Option : public OptionBase<Option> {
     }
 
     /// Remove needs link from an option. Returns true if the option really was in the needs list.
-    bool remove_excludes(Option *opt) {
-        auto iterator = std::find(std::begin(excludes_), std::end(excludes_), opt);
-
-        if(iterator == std::end(excludes_)) {
-            return false;
-        }
-        excludes_.erase(iterator);
-        return true;
-    }
+    bool remove_excludes(Option *opt);
 
     /// Sets environment variable to read if no option given
     Option *envname(std::string name) {
@@ -3900,64 +5446,16 @@ class Option : public OptionBase<Option> {
     ///
     /// The template hides the fact that we don't have the definition of App yet.
     /// You are never expected to add an argument to the template here.
-    template <typename T = App> Option *ignore_case(bool value = true) {
-        if(!ignore_case_ && value) {
-            ignore_case_ = value;
-            auto *parent = static_cast<T *>(parent_);
-            for(const Option_p &opt : parent->options_) {
-                if(opt.get() == this) {
-                    continue;
-                }
-                auto &omatch = opt->matching_name(*this);
-                if(!omatch.empty()) {
-                    ignore_case_ = false;
-                    throw OptionAlreadyAdded("adding ignore case caused a name conflict with " + omatch);
-                }
-            }
-        } else {
-            ignore_case_ = value;
-        }
-        return this;
-    }
+    template <typename T = App> Option *ignore_case(bool value = true);
 
     /// Ignore underscores in the option names
     ///
     /// The template hides the fact that we don't have the definition of App yet.
     /// You are never expected to add an argument to the template here.
-    template <typename T = App> Option *ignore_underscore(bool value = true) {
-
-        if(!ignore_underscore_ && value) {
-            ignore_underscore_ = value;
-            auto *parent = static_cast<T *>(parent_);
-            for(const Option_p &opt : parent->options_) {
-                if(opt.get() == this) {
-                    continue;
-                }
-                auto &omatch = opt->matching_name(*this);
-                if(!omatch.empty()) {
-                    ignore_underscore_ = false;
-                    throw OptionAlreadyAdded("adding ignore underscore caused a name conflict with " + omatch);
-                }
-            }
-        } else {
-            ignore_underscore_ = value;
-        }
-        return this;
-    }
+    template <typename T = App> Option *ignore_underscore(bool value = true);
 
     /// Take the last argument if given multiple times (or another policy)
-    Option *multi_option_policy(MultiOptionPolicy value = MultiOptionPolicy::Throw) {
-        if(value != multi_option_policy_) {
-            if(multi_option_policy_ == MultiOptionPolicy::Throw && expected_max_ == detail::expected_max_vector_size &&
-               expected_min_ > 1) {  // this bizarre condition is to maintain backwards compatibility
-                // with the previous behavior of expected_ with vectors
-                expected_max_ = expected_min_;
-            }
-            multi_option_policy_ = value;
-            current_option_state_ = option_state::parsing;
-        }
-        return this;
-    }
+    Option *multi_option_policy(MultiOptionPolicy value = MultiOptionPolicy::Throw);
 
     /// Disable flag overrides values, e.g. --flag=<value> is not allowed
     Option *disable_flag_override(bool value = true) {
@@ -3969,67 +5467,82 @@ class Option : public OptionBase<Option> {
     ///@{
 
     /// The number of arguments the option expects
-    int get_type_size() const { return type_size_min_; }
+    CLI11_NODISCARD int get_type_size() const { return type_size_min_; }
 
     /// The minimum number of arguments the option expects
-    int get_type_size_min() const { return type_size_min_; }
+    CLI11_NODISCARD int get_type_size_min() const { return type_size_min_; }
     /// The maximum number of arguments the option expects
-    int get_type_size_max() const { return type_size_max_; }
+    CLI11_NODISCARD int get_type_size_max() const { return type_size_max_; }
+
+    /// Return the inject_separator flag
+    CLI11_NODISCARD bool get_inject_separator() const { return inject_separator_; }
 
     /// The environment variable associated to this value
-    std::string get_envname() const { return envname_; }
+    CLI11_NODISCARD std::string get_envname() const { return envname_; }
 
     /// The set of options needed
-    std::set<Option *> get_needs() const { return needs_; }
+    CLI11_NODISCARD std::set<Option *> get_needs() const { return needs_; }
 
     /// The set of options excluded
-    std::set<Option *> get_excludes() const { return excludes_; }
+    CLI11_NODISCARD std::set<Option *> get_excludes() const { return excludes_; }
 
     /// The default value (for help printing)
-    std::string get_default_str() const { return default_str_; }
+    CLI11_NODISCARD std::string get_default_str() const { return default_str_; }
 
     /// Get the callback function
-    callback_t get_callback() const { return callback_; }
+    CLI11_NODISCARD callback_t get_callback() const { return callback_; }
 
     /// Get the long names
-    const std::vector<std::string> &get_lnames() const { return lnames_; }
+    CLI11_NODISCARD const std::vector<std::string> &get_lnames() const { return lnames_; }
 
     /// Get the short names
-    const std::vector<std::string> &get_snames() const { return snames_; }
+    CLI11_NODISCARD const std::vector<std::string> &get_snames() const { return snames_; }
 
     /// Get the flag names with specified default values
-    const std::vector<std::string> &get_fnames() const { return fnames_; }
-
+    CLI11_NODISCARD const std::vector<std::string> &get_fnames() const { return fnames_; }
+    /// Get a single name for the option, first of lname, pname, sname, envname
+    CLI11_NODISCARD const std::string &get_single_name() const {
+        if(!lnames_.empty()) {
+            return lnames_[0];
+        }
+        if(!snames_.empty()) {
+            return snames_[0];
+        }
+        if(!pname_.empty()) {
+            return pname_;
+        }
+        return envname_;
+    }
     /// The number of times the option expects to be included
-    int get_expected() const { return expected_min_; }
+    CLI11_NODISCARD int get_expected() const { return expected_min_; }
 
     /// The number of times the option expects to be included
-    int get_expected_min() const { return expected_min_; }
+    CLI11_NODISCARD int get_expected_min() const { return expected_min_; }
     /// The max number of times the option expects to be included
-    int get_expected_max() const { return expected_max_; }
+    CLI11_NODISCARD int get_expected_max() const { return expected_max_; }
 
     /// The total min number of expected  string values to be used
-    int get_items_expected_min() const { return type_size_min_ * expected_min_; }
+    CLI11_NODISCARD int get_items_expected_min() const { return type_size_min_ * expected_min_; }
 
     /// Get the maximum number of items expected to be returned and used for the callback
-    int get_items_expected_max() const {
+    CLI11_NODISCARD int get_items_expected_max() const {
         int t = type_size_max_;
         return detail::checked_multiply(t, expected_max_) ? t : detail::expected_max_vector_size;
     }
     /// The total min number of expected  string values to be used
-    int get_items_expected() const { return get_items_expected_min(); }
+    CLI11_NODISCARD int get_items_expected() const { return get_items_expected_min(); }
 
     /// True if the argument can be given directly
-    bool get_positional() const { return pname_.length() > 0; }
+    CLI11_NODISCARD bool get_positional() const { return !pname_.empty(); }
 
     /// True if option has at least one non-positional name
-    bool nonpositional() const { return (snames_.size() + lnames_.size()) > 0; }
+    CLI11_NODISCARD bool nonpositional() const { return (!lnames_.empty() || !snames_.empty()); }
 
     /// True if option has description
-    bool has_description() const { return description_.length() > 0; }
+    CLI11_NODISCARD bool has_description() const { return !description_.empty(); }
 
     /// Get the description
-    const std::string &get_description() const { return description_; }
+    CLI11_NODISCARD const std::string &get_description() const { return description_; }
 
     /// Set the description
     Option *description(std::string option_description) {
@@ -4037,6 +5550,13 @@ class Option : public OptionBase<Option> {
         return this;
     }
 
+    Option *option_text(std::string text) {
+        option_text_ = std::move(text);
+        return this;
+    }
+
+    CLI11_NODISCARD const std::string &get_option_text() const { return option_text_; }
+
     ///@}
     /// @name Help tools
     ///@{
@@ -4045,146 +5565,38 @@ class Option : public OptionBase<Option> {
     /// Will include / prefer the positional name if positional is true.
     /// If all_options is false, pick just the most descriptive name to show.
     /// Use `get_name(true)` to get the positional name (replaces `get_pname`)
-    std::string get_name(bool positional = false,  ///< Show the positional name
-                         bool all_options = false  ///< Show every option
-    ) const {
-        if(get_group().empty())
-            return {};  // Hidden
-
-        if(all_options) {
-
-            std::vector<std::string> name_list;
-
-            /// The all list will never include a positional unless asked or that's the only name.
-            if((positional && (!pname_.empty())) || (snames_.empty() && lnames_.empty())) {
-                name_list.push_back(pname_);
-            }
-            if((get_items_expected() == 0) && (!fnames_.empty())) {
-                for(const std::string &sname : snames_) {
-                    name_list.push_back("-" + sname);
-                    if(check_fname(sname)) {
-                        name_list.back() += "{" + get_flag_value(sname, "") + "}";
-                    }
-                }
-
-                for(const std::string &lname : lnames_) {
-                    name_list.push_back("--" + lname);
-                    if(check_fname(lname)) {
-                        name_list.back() += "{" + get_flag_value(lname, "") + "}";
-                    }
-                }
-            } else {
-                for(const std::string &sname : snames_)
-                    name_list.push_back("-" + sname);
-
-                for(const std::string &lname : lnames_)
-                    name_list.push_back("--" + lname);
-            }
-
-            return detail::join(name_list);
-        }
-
-        // This returns the positional name no matter what
-        if(positional)
-            return pname_;
-
-        // Prefer long name
-        if(!lnames_.empty())
-            return std::string(2, '-') + lnames_[0];
-
-        // Or short name if no long name
-        if(!snames_.empty())
-            return std::string(1, '-') + snames_[0];
-
-        // If positional is the only name, it's okay to use that
-        return pname_;
-    }
+    CLI11_NODISCARD std::string get_name(bool positional = false,  ///< Show the positional name
+                                         bool all_options = false  ///< Show every option
+    ) const;
 
     ///@}
     /// @name Parser tools
     ///@{
 
     /// Process the callback
-    void run_callback() {
-
-        if(current_option_state_ == option_state::parsing) {
-            _validate_results(results_);
-            current_option_state_ = option_state::validated;
-        }
-
-        if(current_option_state_ < option_state::reduced) {
-            _reduce_results(proc_results_, results_);
-            current_option_state_ = option_state::reduced;
-        }
-        if(current_option_state_ >= option_state::reduced) {
-            current_option_state_ = option_state::callback_run;
-            if(!(callback_)) {
-                return;
-            }
-            const results_t &send_results = proc_results_.empty() ? results_ : proc_results_;
-            bool local_result = callback_(send_results);
-
-            if(!local_result)
-                throw ConversionError(get_name(), results_);
-        }
-    }
+    void run_callback();
 
     /// If options share any of the same names, find it
-    const std::string &matching_name(const Option &other) const {
-        static const std::string estring;
-        for(const std::string &sname : snames_)
-            if(other.check_sname(sname))
-                return sname;
-        for(const std::string &lname : lnames_)
-            if(other.check_lname(lname))
-                return lname;
+    CLI11_NODISCARD const std::string &matching_name(const Option &other) const;
 
-        if(ignore_case_ ||
-           ignore_underscore_) {  // We need to do the inverse, in case we are ignore_case or ignore underscore
-            for(const std::string &sname : other.snames_)
-                if(check_sname(sname))
-                    return sname;
-            for(const std::string &lname : other.lnames_)
-                if(check_lname(lname))
-                    return lname;
-        }
-        return estring;
-    }
     /// If options share any of the same names, they are equal (not counting positional)
     bool operator==(const Option &other) const { return !matching_name(other).empty(); }
 
     /// Check a name. Requires "-" or "--" for short / long, supports positional name
-    bool check_name(std::string name) const {
-
-        if(name.length() > 2 && name[0] == '-' && name[1] == '-')
-            return check_lname(name.substr(2));
-        if(name.length() > 1 && name.front() == '-')
-            return check_sname(name.substr(1));
-
-        std::string local_pname = pname_;
-        if(ignore_underscore_) {
-            local_pname = detail::remove_underscore(local_pname);
-            name = detail::remove_underscore(name);
-        }
-        if(ignore_case_) {
-            local_pname = detail::to_lower(local_pname);
-            name = detail::to_lower(name);
-        }
-        return name == local_pname;
-    }
+    CLI11_NODISCARD bool check_name(const std::string &name) const;
 
     /// Requires "-" to be removed from string
-    bool check_sname(std::string name) const {
+    CLI11_NODISCARD bool check_sname(std::string name) const {
         return (detail::find_member(std::move(name), snames_, ignore_case_) >= 0);
     }
 
     /// Requires "--" to be removed from string
-    bool check_lname(std::string name) const {
+    CLI11_NODISCARD bool check_lname(std::string name) const {
         return (detail::find_member(std::move(name), lnames_, ignore_case_, ignore_underscore_) >= 0);
     }
 
     /// Requires "--" to be removed from string
-    bool check_fname(std::string name) const {
+    CLI11_NODISCARD bool check_fname(std::string name) const {
         if(fnames_.empty()) {
             return false;
         }
@@ -4193,98 +5605,26 @@ class Option : public OptionBase<Option> {
 
     /// Get the value that goes for a flag, nominally gets the default value but allows for overrides if not
     /// disabled
-    std::string get_flag_value(const std::string &name, std::string input_value) const {
-        static const std::string trueString{"true"};
-        static const std::string falseString{"false"};
-        static const std::string emptyString{"{}"};
-        // check for disable flag override_
-        if(disable_flag_override_) {
-            if(!((input_value.empty()) || (input_value == emptyString))) {
-                auto default_ind = detail::find_member(name, fnames_, ignore_case_, ignore_underscore_);
-                if(default_ind >= 0) {
-                    // We can static cast this to std::size_t because it is more than 0 in this block
-                    if(default_flag_values_[static_cast<std::size_t>(default_ind)].second != input_value) {
-                        throw(ArgumentMismatch::FlagOverride(name));
-                    }
-                } else {
-                    if(input_value != trueString) {
-                        throw(ArgumentMismatch::FlagOverride(name));
-                    }
-                }
-            }
-        }
-        auto ind = detail::find_member(name, fnames_, ignore_case_, ignore_underscore_);
-        if((input_value.empty()) || (input_value == emptyString)) {
-            if(flag_like_) {
-                return (ind < 0) ? trueString : default_flag_values_[static_cast<std::size_t>(ind)].second;
-            } else {
-                return (ind < 0) ? default_str_ : default_flag_values_[static_cast<std::size_t>(ind)].second;
-            }
-        }
-        if(ind < 0) {
-            return input_value;
-        }
-        if(default_flag_values_[static_cast<std::size_t>(ind)].second == falseString) {
-            try {
-                auto val = detail::to_flag_value(input_value);
-                return (val == 1) ? falseString : (val == (-1) ? trueString : std::to_string(-val));
-            } catch(const std::invalid_argument &) {
-                return input_value;
-            }
-        } else {
-            return input_value;
-        }
-    }
+    CLI11_NODISCARD std::string get_flag_value(const std::string &name, std::string input_value) const;
 
     /// Puts a result at the end
-    Option *add_result(std::string s) {
-        _add_result(std::move(s), results_);
-        current_option_state_ = option_state::parsing;
-        return this;
-    }
+    Option *add_result(std::string s);
 
     /// Puts a result at the end and get a count of the number of arguments actually added
-    Option *add_result(std::string s, int &results_added) {
-        results_added = _add_result(std::move(s), results_);
-        current_option_state_ = option_state::parsing;
-        return this;
-    }
+    Option *add_result(std::string s, int &results_added);
 
     /// Puts a result at the end
-    Option *add_result(std::vector<std::string> s) {
-        for(auto &str : s) {
-            _add_result(std::move(str), results_);
-        }
-        current_option_state_ = option_state::parsing;
-        return this;
-    }
+    Option *add_result(std::vector<std::string> s);
 
-    /// Get a copy of the results
-    results_t results() const { return results_; }
+    /// Get the current complete results set
+    CLI11_NODISCARD const results_t &results() const { return results_; }
 
     /// Get a copy of the results
-    results_t reduced_results() const {
-        results_t res = proc_results_.empty() ? results_ : proc_results_;
-        if(current_option_state_ < option_state::reduced) {
-            if(current_option_state_ == option_state::parsing) {
-                res = results_;
-                _validate_results(res);
-            }
-            if(!res.empty()) {
-                results_t extra;
-                _reduce_results(extra, res);
-                if(!extra.empty()) {
-                    res = std::move(extra);
-                }
-            }
-        }
-        return res;
-    }
+    CLI11_NODISCARD results_t reduced_results() const;
 
     /// Get the results as a specified type
-    template <typename T, enable_if_t<!std::is_const<T>::value, detail::enabler> = detail::dummy>
-    void results(T &output) const {
-        bool retval;
+    template <typename T> void results(T &output) const {
+        bool retval = false;
         if(current_option_state_ >= option_state::reduced || (results_.size() == 1 && validators_.empty())) {
             const results_t &res = (proc_results_.empty()) ? results_ : proc_results_;
             retval = detail::lexical_conversion<T, T>(res, output);
@@ -4314,14 +5654,14 @@ class Option : public OptionBase<Option> {
     }
 
     /// Return the results as the specified type
-    template <typename T> T as() const {
+    template <typename T> CLI11_NODISCARD T as() const {
         T output;
         results(output);
         return output;
     }
 
     /// See if the callback has been run already
-    bool get_callback_run() const { return (current_option_state_ == option_state::callback_run); }
+    CLI11_NODISCARD bool get_callback_run() const { return (current_option_state_ == option_state::callback_run); }
 
     ///@}
     /// @name Custom options
@@ -4340,43 +5680,13 @@ class Option : public OptionBase<Option> {
     }
 
     /// Set a custom option size
-    Option *type_size(int option_type_size) {
-        if(option_type_size < 0) {
-            // this section is included for backwards compatibility
-            type_size_max_ = -option_type_size;
-            type_size_min_ = -option_type_size;
-            expected_max_ = detail::expected_max_vector_size;
-        } else {
-            type_size_max_ = option_type_size;
-            if(type_size_max_ < detail::expected_max_vector_size) {
-                type_size_min_ = option_type_size;
-            }
-            if(type_size_max_ == 0)
-                required_ = false;
-        }
-        return this;
-    }
+    Option *type_size(int option_type_size);
+
     /// Set a custom option type size range
-    Option *type_size(int option_type_size_min, int option_type_size_max) {
-        if(option_type_size_min < 0 || option_type_size_max < 0) {
-            // this section is included for backwards compatibility
-            expected_max_ = detail::expected_max_vector_size;
-            option_type_size_min = (std::abs)(option_type_size_min);
-            option_type_size_max = (std::abs)(option_type_size_max);
-        }
+    Option *type_size(int option_type_size_min, int option_type_size_max);
 
-        if(option_type_size_min > option_type_size_max) {
-            type_size_max_ = option_type_size_min;
-            type_size_min_ = option_type_size_max;
-        } else {
-            type_size_min_ = option_type_size_min;
-            type_size_max_ = option_type_size_max;
-        }
-        if(type_size_max_ == 0) {
-            required_ = false;
-        }
-        return this;
-    }
+    /// Set the value of the separator injection flag
+    void inject_separator(bool value = true) { inject_separator_ = value; }
 
     /// Set a capture function for the default. Mostly used by App.
     Option *default_function(const std::function<std::string()> &func) {
@@ -4407,8 +5717,9 @@ class Option : public OptionBase<Option> {
         results_.clear();
         try {
             add_result(val_str);
-            if(run_callback_for_default_) {
-                run_callback();  // run callback sets the state we need to reset it again
+            // if trigger_on_result_ is set the callback already ran
+            if(run_callback_for_default_ && !trigger_on_result_) {
+                run_callback();  // run callback sets the state, we need to reset it again
                 current_option_state_ = option_state::parsing;
             } else {
                 _validate_results(results_);
@@ -4426,2613 +5737,3733 @@ class Option : public OptionBase<Option> {
     }
 
     /// Get the full typename for this option
-    std::string get_type_name() const {
-        std::string full_type_name = type_name_();
-        if(!validators_.empty()) {
-            for(auto &Validator : validators_) {
-                std::string vtype = Validator.get_description();
-                if(!vtype.empty()) {
-                    full_type_name += ":" + vtype;
-                }
-            }
-        }
-        return full_type_name;
-    }
+    CLI11_NODISCARD std::string get_type_name() const;
 
   private:
     /// Run the results through the Validators
-    void _validate_results(results_t &res) const {
-        // Run the Validators (can change the string)
-        if(!validators_.empty()) {
-            if(type_size_max_ > 1) {  // in this context index refers to the index in the type
-                int index = 0;
-                if(get_items_expected_max() < static_cast<int>(res.size()) &&
-                   multi_option_policy_ == CLI::MultiOptionPolicy::TakeLast) {
-                    // create a negative index for the earliest ones
-                    index = get_items_expected_max() - static_cast<int>(res.size());
-                }
-
-                for(std::string &result : res) {
-                    if(result.empty() && type_size_max_ != type_size_min_ && index >= 0) {
-                        index = 0;  // reset index for variable size chunks
-                        continue;
-                    }
-                    auto err_msg = _validate(result, (index >= 0) ? (index % type_size_max_) : index);
-                    if(!err_msg.empty())
-                        throw ValidationError(get_name(), err_msg);
-                    ++index;
-                }
-            } else {
-                int index = 0;
-                if(expected_max_ < static_cast<int>(res.size()) &&
-                   multi_option_policy_ == CLI::MultiOptionPolicy::TakeLast) {
-                    // create a negative index for the earliest ones
-                    index = expected_max_ - static_cast<int>(res.size());
-                }
-                for(std::string &result : res) {
-                    auto err_msg = _validate(result, index);
-                    ++index;
-                    if(!err_msg.empty())
-                        throw ValidationError(get_name(), err_msg);
-                }
-            }
-        }
-    }
+    void _validate_results(results_t &res) const;
 
     /** reduce the results in accordance with the MultiOptionPolicy
-    @param[out] res results are assigned to res if there if they are different
+    @param[out] out results are assigned to res if there if they are different
     */
-    void _reduce_results(results_t &res, const results_t &original) const {
-
-        // max num items expected or length of vector, always at least 1
-        // Only valid for a trimming policy
-
-        res.clear();
-        // Operation depends on the policy setting
-        switch(multi_option_policy_) {
-        case MultiOptionPolicy::TakeAll:
-            break;
-        case MultiOptionPolicy::TakeLast: {
-            // Allow multi-option sizes (including 0)
-            std::size_t trim_size = std::min<std::size_t>(
-                static_cast<std::size_t>(std::max<int>(get_items_expected_max(), 1)), original.size());
-            if(original.size() != trim_size) {
-                res.assign(original.end() - static_cast<results_t::difference_type>(trim_size), original.end());
-            }
-        } break;
-        case MultiOptionPolicy::TakeFirst: {
-            std::size_t trim_size = std::min<std::size_t>(
-                static_cast<std::size_t>(std::max<int>(get_items_expected_max(), 1)), original.size());
-            if(original.size() != trim_size) {
-                res.assign(original.begin(), original.begin() + static_cast<results_t::difference_type>(trim_size));
-            }
-        } break;
-        case MultiOptionPolicy::Join:
-            if(results_.size() > 1) {
-                res.push_back(detail::join(original, std::string(1, (delimiter_ == '\0') ? '\n' : delimiter_)));
-            }
-            break;
-        case MultiOptionPolicy::Throw:
-        default: {
-            auto num_min = static_cast<std::size_t>(get_items_expected_min());
-            auto num_max = static_cast<std::size_t>(get_items_expected_max());
-            if(num_min == 0) {
-                num_min = 1;
-            }
-            if(num_max == 0) {
-                num_max = 1;
-            }
-            if(original.size() < num_min) {
-                throw ArgumentMismatch::AtLeast(get_name(), static_cast<int>(num_min), original.size());
-            }
-            if(original.size() > num_max) {
-                throw ArgumentMismatch::AtMost(get_name(), static_cast<int>(num_max), original.size());
-            }
-            break;
-        }
-        }
-    }
+    void _reduce_results(results_t &out, const results_t &original) const;
 
     // Run a result through the Validators
-    std::string _validate(std::string &result, int index) const {
-        std::string err_msg;
-        if(result.empty() && expected_min_ == 0) {
-            // an empty with nothing expected is allowed
-            return err_msg;
-        }
-        for(const auto &vali : validators_) {
-            auto v = vali.get_application_index();
-            if(v == -1 || v == index) {
-                try {
-                    err_msg = vali(result);
-                } catch(const ValidationError &err) {
-                    err_msg = err.what();
-                }
-                if(!err_msg.empty())
-                    break;
-            }
-        }
-
-        return err_msg;
-    }
+    std::string _validate(std::string &result, int index) const;
 
     /// Add a single result to the result set, taking into account delimiters
-    int _add_result(std::string &&result, std::vector<std::string> &res) const {
-        int result_count = 0;
-        if(allow_extra_args_ && !result.empty() && result.front() == '[' &&
-           result.back() == ']') {  // this is now a vector string likely from the default or user entry
-            result.pop_back();
+    int _add_result(std::string &&result, std::vector<std::string> &res) const;
+};
 
-            for(auto &var : CLI::detail::split(result.substr(1), ',')) {
-                if(!var.empty()) {
-                    result_count += _add_result(std::move(var), res);
-                }
-            }
-            return result_count;
-        }
-        if(delimiter_ == '\0') {
-            res.push_back(std::move(result));
-            ++result_count;
-        } else {
-            if((result.find_first_of(delimiter_) != std::string::npos)) {
-                for(const auto &var : CLI::detail::split(result, delimiter_)) {
-                    if(!var.empty()) {
-                        res.push_back(var);
-                        ++result_count;
-                    }
-                }
-            } else {
-                res.push_back(std::move(result));
-                ++result_count;
-            }
-        }
-        return result_count;
-    }
-};  // namespace CLI
 
-}  // namespace CLI
 
-// From App.hpp:
 
-namespace CLI {
+template <typename CRTP> template <typename T> void OptionBase<CRTP>::copy_to(T *other) const {
+    other->group(group_);
+    other->required(required_);
+    other->ignore_case(ignore_case_);
+    other->ignore_underscore(ignore_underscore_);
+    other->configurable(configurable_);
+    other->disable_flag_override(disable_flag_override_);
+    other->delimiter(delimiter_);
+    other->always_capture_default(always_capture_default_);
+    other->multi_option_policy(multi_option_policy_);
+}
 
-#ifndef CLI11_PARSE
-#define CLI11_PARSE(app, argc, argv)                                                                                   \
-    try {                                                                                                              \
-        (app).parse((argc), (argv));                                                                                   \
-    } catch(const CLI::ParseError &e) {                                                                                \
-        return (app).exit(e);                                                                                          \
+CLI11_INLINE Option *Option::expected(int value) {
+    if(value < 0) {
+        expected_min_ = -value;
+        if(expected_max_ < expected_min_) {
+            expected_max_ = expected_min_;
+        }
+        allow_extra_args_ = true;
+        flag_like_ = false;
+    } else if(value == detail::expected_max_vector_size) {
+        expected_min_ = 1;
+        expected_max_ = detail::expected_max_vector_size;
+        allow_extra_args_ = true;
+        flag_like_ = false;
+    } else {
+        expected_min_ = value;
+        expected_max_ = value;
+        flag_like_ = (expected_min_ == 0);
     }
-#endif
+    return this;
+}
 
-namespace detail {
-enum class Classifier { NONE, POSITIONAL_MARK, SHORT, LONG, WINDOWS, SUBCOMMAND, SUBCOMMAND_TERMINATOR };
-struct AppFriend;
-}  // namespace detail
+CLI11_INLINE Option *Option::expected(int value_min, int value_max) {
+    if(value_min < 0) {
+        value_min = -value_min;
+    }
 
-namespace FailureMessage {
-std::string simple(const App *app, const Error &e);
-std::string help(const App *app, const Error &e);
-}  // namespace FailureMessage
+    if(value_max < 0) {
+        value_max = detail::expected_max_vector_size;
+    }
+    if(value_max < value_min) {
+        expected_min_ = value_max;
+        expected_max_ = value_min;
+    } else {
+        expected_max_ = value_max;
+        expected_min_ = value_min;
+    }
 
-/// enumeration of modes of how to deal with extras in config files
+    return this;
+}
 
-enum class config_extras_mode : char { error = 0, ignore, capture };
+CLI11_INLINE Option *Option::check(Validator validator, const std::string &validator_name) {
+    validator.non_modifying();
+    validators_.push_back(std::move(validator));
+    if(!validator_name.empty())
+        validators_.back().name(validator_name);
+    return this;
+}
 
-class App;
+CLI11_INLINE Option *Option::check(std::function<std::string(const std::string &)> Validator,
+                                   std::string Validator_description,
+                                   std::string Validator_name) {
+    validators_.emplace_back(Validator, std::move(Validator_description), std::move(Validator_name));
+    validators_.back().non_modifying();
+    return this;
+}
 
-using App_p = std::shared_ptr<App>;
+CLI11_INLINE Option *Option::transform(Validator Validator, const std::string &Validator_name) {
+    validators_.insert(validators_.begin(), std::move(Validator));
+    if(!Validator_name.empty())
+        validators_.front().name(Validator_name);
+    return this;
+}
 
-class Option_group;
-/// Creates a command line program, with very few defaults.
-/** To use, create a new `Program()` instance with `argc`, `argv`, and a help description. The templated
- *  add_option methods make it easy to prepare options. Remember to call `.start` before starting your
- * program, so that the options can be evaluated and the help option doesn't accidentally run your program. */
-class App {
-    friend Option;
-    friend detail::AppFriend;
+CLI11_INLINE Option *Option::transform(const std::function<std::string(std::string)> &func,
+                                       std::string transform_description,
+                                       std::string transform_name) {
+    validators_.insert(validators_.begin(),
+                       Validator(
+                           [func](std::string &val) {
+                               val = func(val);
+                               return std::string{};
+                           },
+                           std::move(transform_description),
+                           std::move(transform_name)));
 
-  protected:
-    // This library follows the Google style guide for member names ending in underscores
+    return this;
+}
 
-    /// @name Basics
-    ///@{
+CLI11_INLINE Option *Option::each(const std::function<void(std::string)> &func) {
+    validators_.emplace_back(
+        [func](std::string &inout) {
+            func(inout);
+            return std::string{};
+        },
+        std::string{});
+    return this;
+}
 
-    /// Subcommand name or program name (from parser if name is empty)
-    std::string name_{};
+CLI11_INLINE Validator *Option::get_validator(const std::string &Validator_name) {
+    for(auto &Validator : validators_) {
+        if(Validator_name == Validator.get_name()) {
+            return &Validator;
+        }
+    }
+    if((Validator_name.empty()) && (!validators_.empty())) {
+        return &(validators_.front());
+    }
+    throw OptionNotFound(std::string{"Validator "} + Validator_name + " Not Found");
+}
 
-    /// Description of the current program/subcommand
-    std::string description_{};
+CLI11_INLINE Validator *Option::get_validator(int index) {
+    // This is an signed int so that it is not equivalent to a pointer.
+    if(index >= 0 && index < static_cast<int>(validators_.size())) {
+        return &(validators_[static_cast<decltype(validators_)::size_type>(index)]);
+    }
+    throw OptionNotFound("Validator index is not valid");
+}
 
-    /// If true, allow extra arguments (ie, don't throw an error). INHERITABLE
-    bool allow_extras_{false};
+CLI11_INLINE bool Option::remove_needs(Option *opt) {
+    auto iterator = std::find(std::begin(needs_), std::end(needs_), opt);
 
-    /// If ignore, allow extra arguments in the ini file (ie, don't throw an error). INHERITABLE
-    /// if error error on an extra argument, and if capture feed it to the app
-    config_extras_mode allow_config_extras_{config_extras_mode::ignore};
+    if(iterator == std::end(needs_)) {
+        return false;
+    }
+    needs_.erase(iterator);
+    return true;
+}
 
-    ///  If true, return immediately on an unrecognized option (implies allow_extras) INHERITABLE
-    bool prefix_command_{false};
+CLI11_INLINE Option *Option::excludes(Option *opt) {
+    if(opt == this) {
+        throw(IncorrectConstruction("and option cannot exclude itself"));
+    }
+    excludes_.insert(opt);
 
-    /// If set to true the name was automatically generated from the command line vs a user set name
-    bool has_automatic_name_{false};
+    // Help text should be symmetric - excluding a should exclude b
+    opt->excludes_.insert(this);
 
-    /// If set to true the subcommand is required to be processed and used, ignored for main app
-    bool required_{false};
+    // Ignoring the insert return value, excluding twice is now allowed.
+    // (Mostly to allow both directions to be excluded by user, even though the library does it for you.)
 
-    /// If set to true the subcommand is disabled and cannot be used, ignored for main app
-    bool disabled_{false};
+    return this;
+}
 
-    /// Flag indicating that the pre_parse_callback has been triggered
-    bool pre_parse_called_{false};
+CLI11_INLINE bool Option::remove_excludes(Option *opt) {
+    auto iterator = std::find(std::begin(excludes_), std::end(excludes_), opt);
 
-    /// Flag indicating that the callback for the subcommand should be executed immediately on parse completion which is
-    /// before help or ini files are processed. INHERITABLE
-    bool immediate_callback_{false};
+    if(iterator == std::end(excludes_)) {
+        return false;
+    }
+    excludes_.erase(iterator);
+    return true;
+}
 
-    /// This is a function that runs prior to the start of parsing
+template <typename T> Option *Option::ignore_case(bool value) {
+    if(!ignore_case_ && value) {
+        ignore_case_ = value;
+        auto *parent = static_cast<T *>(parent_);
+        for(const Option_p &opt : parent->options_) {
+            if(opt.get() == this) {
+                continue;
+            }
+            const auto &omatch = opt->matching_name(*this);
+            if(!omatch.empty()) {
+                ignore_case_ = false;
+                throw OptionAlreadyAdded("adding ignore case caused a name conflict with " + omatch);
+            }
+        }
+    } else {
+        ignore_case_ = value;
+    }
+    return this;
+}
+
+template <typename T> Option *Option::ignore_underscore(bool value) {
+
+    if(!ignore_underscore_ && value) {
+        ignore_underscore_ = value;
+        auto *parent = static_cast<T *>(parent_);
+        for(const Option_p &opt : parent->options_) {
+            if(opt.get() == this) {
+                continue;
+            }
+            const auto &omatch = opt->matching_name(*this);
+            if(!omatch.empty()) {
+                ignore_underscore_ = false;
+                throw OptionAlreadyAdded("adding ignore underscore caused a name conflict with " + omatch);
+            }
+        }
+    } else {
+        ignore_underscore_ = value;
+    }
+    return this;
+}
+
+CLI11_INLINE Option *Option::multi_option_policy(MultiOptionPolicy value) {
+    if(value != multi_option_policy_) {
+        if(multi_option_policy_ == MultiOptionPolicy::Throw && expected_max_ == detail::expected_max_vector_size &&
+           expected_min_ > 1) {  // this bizarre condition is to maintain backwards compatibility
+                                 // with the previous behavior of expected_ with vectors
+            expected_max_ = expected_min_;
+        }
+        multi_option_policy_ = value;
+        current_option_state_ = option_state::parsing;
+    }
+    return this;
+}
+
+CLI11_NODISCARD CLI11_INLINE std::string Option::get_name(bool positional, bool all_options) const {
+    if(get_group().empty())
+        return {};  // Hidden
+
+    if(all_options) {
+
+        std::vector<std::string> name_list;
+
+        /// The all list will never include a positional unless asked or that's the only name.
+        if((positional && (!pname_.empty())) || (snames_.empty() && lnames_.empty())) {
+            name_list.push_back(pname_);
+        }
+        if((get_items_expected() == 0) && (!fnames_.empty())) {
+            for(const std::string &sname : snames_) {
+                name_list.push_back("-" + sname);
+                if(check_fname(sname)) {
+                    name_list.back() += "{" + get_flag_value(sname, "") + "}";
+                }
+            }
+
+            for(const std::string &lname : lnames_) {
+                name_list.push_back("--" + lname);
+                if(check_fname(lname)) {
+                    name_list.back() += "{" + get_flag_value(lname, "") + "}";
+                }
+            }
+        } else {
+            for(const std::string &sname : snames_)
+                name_list.push_back("-" + sname);
+
+            for(const std::string &lname : lnames_)
+                name_list.push_back("--" + lname);
+        }
+
+        return detail::join(name_list);
+    }
+
+    // This returns the positional name no matter what
+    if(positional)
+        return pname_;
+
+    // Prefer long name
+    if(!lnames_.empty())
+        return std::string(2, '-') + lnames_[0];
+
+    // Or short name if no long name
+    if(!snames_.empty())
+        return std::string(1, '-') + snames_[0];
+
+    // If positional is the only name, it's okay to use that
+    return pname_;
+}
+
+CLI11_INLINE void Option::run_callback() {
+    if(force_callback_ && results_.empty()) {
+        add_result(default_str_);
+    }
+    if(current_option_state_ == option_state::parsing) {
+        _validate_results(results_);
+        current_option_state_ = option_state::validated;
+    }
+
+    if(current_option_state_ < option_state::reduced) {
+        _reduce_results(proc_results_, results_);
+        current_option_state_ = option_state::reduced;
+    }
+    if(current_option_state_ >= option_state::reduced) {
+        current_option_state_ = option_state::callback_run;
+        if(!(callback_)) {
+            return;
+        }
+        const results_t &send_results = proc_results_.empty() ? results_ : proc_results_;
+        bool local_result = callback_(send_results);
+
+        if(!local_result)
+            throw ConversionError(get_name(), results_);
+    }
+}
+
+CLI11_NODISCARD CLI11_INLINE const std::string &Option::matching_name(const Option &other) const {
+    static const std::string estring;
+    for(const std::string &sname : snames_) {
+        if(other.check_sname(sname))
+            return sname;
+        if(other.check_lname(sname))
+            return sname;
+    }
+    for(const std::string &lname : lnames_) {
+        if(other.check_lname(lname))
+            return lname;
+        if(lname.size() == 1) {
+            if(other.check_sname(lname)) {
+                return lname;
+            }
+        }
+    }
+    if(snames_.empty() && lnames_.empty() && !pname_.empty()) {
+        if(other.check_sname(pname_) || other.check_lname(pname_) || pname_ == other.pname_)
+            return pname_;
+    }
+    if(other.snames_.empty() && other.fnames_.empty() && !other.pname_.empty()) {
+        if(check_sname(other.pname_) || check_lname(other.pname_) || (pname_ == other.pname_))
+            return other.pname_;
+    }
+    if(ignore_case_ ||
+       ignore_underscore_) {  // We need to do the inverse, in case we are ignore_case or ignore underscore
+        for(const std::string &sname : other.snames_)
+            if(check_sname(sname))
+                return sname;
+        for(const std::string &lname : other.lnames_)
+            if(check_lname(lname))
+                return lname;
+    }
+    return estring;
+}
+
+CLI11_NODISCARD CLI11_INLINE bool Option::check_name(const std::string &name) const {
+
+    if(name.length() > 2 && name[0] == '-' && name[1] == '-')
+        return check_lname(name.substr(2));
+    if(name.length() > 1 && name.front() == '-')
+        return check_sname(name.substr(1));
+    if(!pname_.empty()) {
+        std::string local_pname = pname_;
+        std::string local_name = name;
+        if(ignore_underscore_) {
+            local_pname = detail::remove_underscore(local_pname);
+            local_name = detail::remove_underscore(local_name);
+        }
+        if(ignore_case_) {
+            local_pname = detail::to_lower(local_pname);
+            local_name = detail::to_lower(local_name);
+        }
+        if(local_name == local_pname) {
+            return true;
+        }
+    }
+
+    if(!envname_.empty()) {
+        // this needs to be the original since envname_ shouldn't match on case insensitivity
+        return (name == envname_);
+    }
+    return false;
+}
+
+CLI11_NODISCARD CLI11_INLINE std::string Option::get_flag_value(const std::string &name,
+                                                                std::string input_value) const {
+    static const std::string trueString{"true"};
+    static const std::string falseString{"false"};
+    static const std::string emptyString{"{}"};
+    // check for disable flag override_
+    if(disable_flag_override_) {
+        if(!((input_value.empty()) || (input_value == emptyString))) {
+            auto default_ind = detail::find_member(name, fnames_, ignore_case_, ignore_underscore_);
+            if(default_ind >= 0) {
+                // We can static cast this to std::size_t because it is more than 0 in this block
+                if(default_flag_values_[static_cast<std::size_t>(default_ind)].second != input_value) {
+                    if(input_value == default_str_ && force_callback_) {
+                        return input_value;
+                    }
+                    throw(ArgumentMismatch::FlagOverride(name));
+                }
+            } else {
+                if(input_value != trueString) {
+                    throw(ArgumentMismatch::FlagOverride(name));
+                }
+            }
+        }
+    }
+    auto ind = detail::find_member(name, fnames_, ignore_case_, ignore_underscore_);
+    if((input_value.empty()) || (input_value == emptyString)) {
+        if(flag_like_) {
+            return (ind < 0) ? trueString : default_flag_values_[static_cast<std::size_t>(ind)].second;
+        }
+        return (ind < 0) ? default_str_ : default_flag_values_[static_cast<std::size_t>(ind)].second;
+    }
+    if(ind < 0) {
+        return input_value;
+    }
+    if(default_flag_values_[static_cast<std::size_t>(ind)].second == falseString) {
+        errno = 0;
+        auto val = detail::to_flag_value(input_value);
+        if(errno != 0) {
+            errno = 0;
+            return input_value;
+        }
+        return (val == 1) ? falseString : (val == (-1) ? trueString : std::to_string(-val));
+    }
+    return input_value;
+}
+
+CLI11_INLINE Option *Option::add_result(std::string s) {
+    _add_result(std::move(s), results_);
+    current_option_state_ = option_state::parsing;
+    return this;
+}
+
+CLI11_INLINE Option *Option::add_result(std::string s, int &results_added) {
+    results_added = _add_result(std::move(s), results_);
+    current_option_state_ = option_state::parsing;
+    return this;
+}
+
+CLI11_INLINE Option *Option::add_result(std::vector<std::string> s) {
+    current_option_state_ = option_state::parsing;
+    for(auto &str : s) {
+        _add_result(std::move(str), results_);
+    }
+    return this;
+}
+
+CLI11_NODISCARD CLI11_INLINE results_t Option::reduced_results() const {
+    results_t res = proc_results_.empty() ? results_ : proc_results_;
+    if(current_option_state_ < option_state::reduced) {
+        if(current_option_state_ == option_state::parsing) {
+            res = results_;
+            _validate_results(res);
+        }
+        if(!res.empty()) {
+            results_t extra;
+            _reduce_results(extra, res);
+            if(!extra.empty()) {
+                res = std::move(extra);
+            }
+        }
+    }
+    return res;
+}
+
+CLI11_INLINE Option *Option::type_size(int option_type_size) {
+    if(option_type_size < 0) {
+        // this section is included for backwards compatibility
+        type_size_max_ = -option_type_size;
+        type_size_min_ = -option_type_size;
+        expected_max_ = detail::expected_max_vector_size;
+    } else {
+        type_size_max_ = option_type_size;
+        if(type_size_max_ < detail::expected_max_vector_size) {
+            type_size_min_ = option_type_size;
+        } else {
+            inject_separator_ = true;
+        }
+        if(type_size_max_ == 0)
+            required_ = false;
+    }
+    return this;
+}
+
+CLI11_INLINE Option *Option::type_size(int option_type_size_min, int option_type_size_max) {
+    if(option_type_size_min < 0 || option_type_size_max < 0) {
+        // this section is included for backwards compatibility
+        expected_max_ = detail::expected_max_vector_size;
+        option_type_size_min = (std::abs)(option_type_size_min);
+        option_type_size_max = (std::abs)(option_type_size_max);
+    }
+
+    if(option_type_size_min > option_type_size_max) {
+        type_size_max_ = option_type_size_min;
+        type_size_min_ = option_type_size_max;
+    } else {
+        type_size_min_ = option_type_size_min;
+        type_size_max_ = option_type_size_max;
+    }
+    if(type_size_max_ == 0) {
+        required_ = false;
+    }
+    if(type_size_max_ >= detail::expected_max_vector_size) {
+        inject_separator_ = true;
+    }
+    return this;
+}
+
+CLI11_NODISCARD CLI11_INLINE std::string Option::get_type_name() const {
+    std::string full_type_name = type_name_();
+    if(!validators_.empty()) {
+        for(const auto &Validator : validators_) {
+            std::string vtype = Validator.get_description();
+            if(!vtype.empty()) {
+                full_type_name += ":" + vtype;
+            }
+        }
+    }
+    return full_type_name;
+}
+
+CLI11_INLINE void Option::_validate_results(results_t &res) const {
+    // Run the Validators (can change the string)
+    if(!validators_.empty()) {
+        if(type_size_max_ > 1) {  // in this context index refers to the index in the type
+            int index = 0;
+            if(get_items_expected_max() < static_cast<int>(res.size()) &&
+               (multi_option_policy_ == CLI::MultiOptionPolicy::TakeLast ||
+                multi_option_policy_ == CLI::MultiOptionPolicy::Reverse)) {
+                // create a negative index for the earliest ones
+                index = get_items_expected_max() - static_cast<int>(res.size());
+            }
+
+            for(std::string &result : res) {
+                if(detail::is_separator(result) && type_size_max_ != type_size_min_ && index >= 0) {
+                    index = 0;  // reset index for variable size chunks
+                    continue;
+                }
+                auto err_msg = _validate(result, (index >= 0) ? (index % type_size_max_) : index);
+                if(!err_msg.empty())
+                    throw ValidationError(get_name(), err_msg);
+                ++index;
+            }
+        } else {
+            int index = 0;
+            if(expected_max_ < static_cast<int>(res.size()) &&
+               (multi_option_policy_ == CLI::MultiOptionPolicy::TakeLast ||
+                multi_option_policy_ == CLI::MultiOptionPolicy::Reverse)) {
+                // create a negative index for the earliest ones
+                index = expected_max_ - static_cast<int>(res.size());
+            }
+            for(std::string &result : res) {
+                auto err_msg = _validate(result, index);
+                ++index;
+                if(!err_msg.empty())
+                    throw ValidationError(get_name(), err_msg);
+            }
+        }
+    }
+}
+
+CLI11_INLINE void Option::_reduce_results(results_t &out, const results_t &original) const {
+
+    // max num items expected or length of vector, always at least 1
+    // Only valid for a trimming policy
+
+    out.clear();
+    // Operation depends on the policy setting
+    switch(multi_option_policy_) {
+    case MultiOptionPolicy::TakeAll:
+        break;
+    case MultiOptionPolicy::TakeLast: {
+        // Allow multi-option sizes (including 0)
+        std::size_t trim_size = std::min<std::size_t>(
+            static_cast<std::size_t>(std::max<int>(get_items_expected_max(), 1)), original.size());
+        if(original.size() != trim_size) {
+            out.assign(original.end() - static_cast<results_t::difference_type>(trim_size), original.end());
+        }
+    } break;
+    case MultiOptionPolicy::Reverse: {
+        // Allow multi-option sizes (including 0)
+        std::size_t trim_size = std::min<std::size_t>(
+            static_cast<std::size_t>(std::max<int>(get_items_expected_max(), 1)), original.size());
+        if(original.size() != trim_size || trim_size > 1) {
+            out.assign(original.end() - static_cast<results_t::difference_type>(trim_size), original.end());
+        }
+        std::reverse(out.begin(), out.end());
+    } break;
+    case MultiOptionPolicy::TakeFirst: {
+        std::size_t trim_size = std::min<std::size_t>(
+            static_cast<std::size_t>(std::max<int>(get_items_expected_max(), 1)), original.size());
+        if(original.size() != trim_size) {
+            out.assign(original.begin(), original.begin() + static_cast<results_t::difference_type>(trim_size));
+        }
+    } break;
+    case MultiOptionPolicy::Join:
+        if(results_.size() > 1) {
+            out.push_back(detail::join(original, std::string(1, (delimiter_ == '\0') ? '\n' : delimiter_)));
+        }
+        break;
+    case MultiOptionPolicy::Sum:
+        out.push_back(detail::sum_string_vector(original));
+        break;
+    case MultiOptionPolicy::Throw:
+    default: {
+        auto num_min = static_cast<std::size_t>(get_items_expected_min());
+        auto num_max = static_cast<std::size_t>(get_items_expected_max());
+        if(num_min == 0) {
+            num_min = 1;
+        }
+        if(num_max == 0) {
+            num_max = 1;
+        }
+        if(original.size() < num_min) {
+            throw ArgumentMismatch::AtLeast(get_name(), static_cast<int>(num_min), original.size());
+        }
+        if(original.size() > num_max) {
+            if(original.size() == 2 && num_max == 1 && original[1] == "%%" && original[0] == "{}") {
+                // this condition is a trap for the following empty indicator check on config files
+                out = original;
+            } else {
+                throw ArgumentMismatch::AtMost(get_name(), static_cast<int>(num_max), original.size());
+            }
+        }
+        break;
+    }
+    }
+    // this check is to allow an empty vector in certain circumstances but not if expected is not zero.
+    // {} is the indicator for an empty container
+    if(out.empty()) {
+        if(original.size() == 1 && original[0] == "{}" && get_items_expected_min() > 0) {
+            out.emplace_back("{}");
+            out.emplace_back("%%");
+        }
+    } else if(out.size() == 1 && out[0] == "{}" && get_items_expected_min() > 0) {
+        out.emplace_back("%%");
+    }
+}
+
+CLI11_INLINE std::string Option::_validate(std::string &result, int index) const {
+    std::string err_msg;
+    if(result.empty() && expected_min_ == 0) {
+        // an empty with nothing expected is allowed
+        return err_msg;
+    }
+    for(const auto &vali : validators_) {
+        auto v = vali.get_application_index();
+        if(v == -1 || v == index) {
+            try {
+                err_msg = vali(result);
+            } catch(const ValidationError &err) {
+                err_msg = err.what();
+            }
+            if(!err_msg.empty())
+                break;
+        }
+    }
+
+    return err_msg;
+}
+
+CLI11_INLINE int Option::_add_result(std::string &&result, std::vector<std::string> &res) const {
+    int result_count = 0;
+    if(allow_extra_args_ && !result.empty() && result.front() == '[' &&
+       result.back() == ']') {  // this is now a vector string likely from the default or user entry
+        result.pop_back();
+
+        for(auto &var : CLI::detail::split(result.substr(1), ',')) {
+            if(!var.empty()) {
+                result_count += _add_result(std::move(var), res);
+            }
+        }
+        return result_count;
+    }
+    if(delimiter_ == '\0') {
+        res.push_back(std::move(result));
+        ++result_count;
+    } else {
+        if((result.find_first_of(delimiter_) != std::string::npos)) {
+            for(const auto &var : CLI::detail::split(result, delimiter_)) {
+                if(!var.empty()) {
+                    res.push_back(var);
+                    ++result_count;
+                }
+            }
+        } else {
+            res.push_back(std::move(result));
+            ++result_count;
+        }
+    }
+    return result_count;
+}
+
+
+
+#ifndef CLI11_PARSE
+#define CLI11_PARSE(app, ...)                                                                                          \
+    try {                                                                                                              \
+        (app).parse(__VA_ARGS__);                                                                                      \
+    } catch(const CLI::ParseError &e) {                                                                                \
+        return (app).exit(e);                                                                                          \
+    }
+#endif
+
+namespace detail {
+enum class Classifier { NONE, POSITIONAL_MARK, SHORT, LONG, WINDOWS_STYLE, SUBCOMMAND, SUBCOMMAND_TERMINATOR };
+struct AppFriend;
+}  // namespace detail
+
+namespace FailureMessage {
+/// Printout a clean, simple message on error (the default in CLI11 1.5+)
+CLI11_INLINE std::string simple(const App *app, const Error &e);
+
+/// Printout the full help string on error (if this fn is set, the old default for CLI11)
+CLI11_INLINE std::string help(const App *app, const Error &e);
+}  // namespace FailureMessage
+
+/// enumeration of modes of how to deal with extras in config files
+
+enum class config_extras_mode : char { error = 0, ignore, ignore_all, capture };
+
+class App;
+
+using App_p = std::shared_ptr<App>;
+
+namespace detail {
+/// helper functions for adding in appropriate flag modifiers for add_flag
+
+template <typename T, enable_if_t<!std::is_integral<T>::value || (sizeof(T) <= 1U), detail::enabler> = detail::dummy>
+Option *default_flag_modifiers(Option *opt) {
+    return opt->always_capture_default();
+}
+
+/// summing modifiers
+template <typename T, enable_if_t<std::is_integral<T>::value && (sizeof(T) > 1U), detail::enabler> = detail::dummy>
+Option *default_flag_modifiers(Option *opt) {
+    return opt->multi_option_policy(MultiOptionPolicy::Sum)->default_str("0")->force_callback();
+}
+
+}  // namespace detail
+
+class Option_group;
+/// Creates a command line program, with very few defaults.
+/** To use, create a new `Program()` instance with `argc`, `argv`, and a help description. The templated
+ *  add_option methods make it easy to prepare options. Remember to call `.start` before starting your
+ * program, so that the options can be evaluated and the help option doesn't accidentally run your program. */
+class App {
+    friend Option;
+    friend detail::AppFriend;
+
+  protected:
+    // This library follows the Google style guide for member names ending in underscores
+
+    /// @name Basics
+    ///@{
+
+    /// Subcommand name or program name (from parser if name is empty)
+    std::string name_{};
+
+    /// Description of the current program/subcommand
+    std::string description_{};
+
+    /// If true, allow extra arguments (ie, don't throw an error). INHERITABLE
+    bool allow_extras_{false};
+
+    /// If ignore, allow extra arguments in the ini file (ie, don't throw an error). INHERITABLE
+    /// if error error on an extra argument, and if capture feed it to the app
+    config_extras_mode allow_config_extras_{config_extras_mode::ignore};
+
+    ///  If true, return immediately on an unrecognized option (implies allow_extras) INHERITABLE
+    bool prefix_command_{false};
+
+    /// If set to true the name was automatically generated from the command line vs a user set name
+    bool has_automatic_name_{false};
+
+    /// If set to true the subcommand is required to be processed and used, ignored for main app
+    bool required_{false};
+
+    /// If set to true the subcommand is disabled and cannot be used, ignored for main app
+    bool disabled_{false};
+
+    /// Flag indicating that the pre_parse_callback has been triggered
+    bool pre_parse_called_{false};
+
+    /// Flag indicating that the callback for the subcommand should be executed immediately on parse completion which is
+    /// before help or ini files are processed. INHERITABLE
+    bool immediate_callback_{false};
+
+    /// This is a function that runs prior to the start of parsing
     std::function<void(std::size_t)> pre_parse_callback_{};
 
-    /// This is a function that runs when parsing has finished.
-    std::function<void()> parse_complete_callback_{};
-    /// This is a function that runs when all processing has completed
-    std::function<void()> final_callback_{};
+    /// This is a function that runs when parsing has finished.
+    std::function<void()> parse_complete_callback_{};
+
+    /// This is a function that runs when all processing has completed
+    std::function<void()> final_callback_{};
+
+    ///@}
+    /// @name Options
+    ///@{
+
+    /// The default values for options, customizable and changeable INHERITABLE
+    OptionDefaults option_defaults_{};
+
+    /// The list of options, stored locally
+    std::vector<Option_p> options_{};
+
+    ///@}
+    /// @name Help
+    ///@{
+
+    /// Usage to put after program/subcommand description in the help output INHERITABLE
+    std::string usage_{};
+
+    /// This is a function that generates a usage to put after program/subcommand description in help output
+    std::function<std::string()> usage_callback_{};
+
+    /// Footer to put after all options in the help output INHERITABLE
+    std::string footer_{};
+
+    /// This is a function that generates a footer to put after all other options in help output
+    std::function<std::string()> footer_callback_{};
+
+    /// A pointer to the help flag if there is one INHERITABLE
+    Option *help_ptr_{nullptr};
+
+    /// A pointer to the help all flag if there is one INHERITABLE
+    Option *help_all_ptr_{nullptr};
+
+    /// A pointer to a version flag if there is one
+    Option *version_ptr_{nullptr};
+
+    /// This is the formatter for help printing. Default provided. INHERITABLE (same pointer)
+    std::shared_ptr<FormatterBase> formatter_{new Formatter()};
+
+    /// The error message printing function INHERITABLE
+    std::function<std::string(const App *, const Error &e)> failure_message_{FailureMessage::simple};
+
+    ///@}
+    /// @name Parsing
+    ///@{
+
+    using missing_t = std::vector<std::pair<detail::Classifier, std::string>>;
+
+    /// Pair of classifier, string for missing options. (extra detail is removed on returning from parse)
+    ///
+    /// This is faster and cleaner than storing just a list of strings and reparsing. This may contain the -- separator.
+    missing_t missing_{};
+
+    /// This is a list of pointers to options with the original parse order
+    std::vector<Option *> parse_order_{};
+
+    /// This is a list of the subcommands collected, in order
+    std::vector<App *> parsed_subcommands_{};
+
+    /// this is a list of subcommands that are exclusionary to this one
+    std::set<App *> exclude_subcommands_{};
+
+    /// This is a list of options which are exclusionary to this App, if the options were used this subcommand should
+    /// not be
+    std::set<Option *> exclude_options_{};
+
+    /// this is a list of subcommands or option groups that are required by this one, the list is not mutual,  the
+    /// listed subcommands do not require this one
+    std::set<App *> need_subcommands_{};
+
+    /// This is a list of options which are required by this app, the list is not mutual, listed options do not need the
+    /// subcommand not be
+    std::set<Option *> need_options_{};
+
+    ///@}
+    /// @name Subcommands
+    ///@{
+
+    /// Storage for subcommand list
+    std::vector<App_p> subcommands_{};
+
+    /// If true, the program name is not case sensitive INHERITABLE
+    bool ignore_case_{false};
+
+    /// If true, the program should ignore underscores INHERITABLE
+    bool ignore_underscore_{false};
+
+    /// Allow subcommand fallthrough, so that parent commands can collect commands after subcommand.  INHERITABLE
+    bool fallthrough_{false};
+
+    /// Allow '/' for options for Windows like options. Defaults to true on Windows, false otherwise. INHERITABLE
+    bool allow_windows_style_options_{
+#ifdef _WIN32
+        true
+#else
+        false
+#endif
+    };
+    /// specify that positional arguments come at the end of the argument sequence not inheritable
+    bool positionals_at_end_{false};
+
+    enum class startup_mode : char { stable, enabled, disabled };
+    /// specify the startup mode for the app
+    /// stable=no change, enabled= startup enabled, disabled=startup disabled
+    startup_mode default_startup{startup_mode::stable};
+
+    /// if set to true the subcommand can be triggered via configuration files INHERITABLE
+    bool configurable_{false};
+
+    /// If set to true positional options are validated before assigning INHERITABLE
+    bool validate_positionals_{false};
+
+    /// If set to true optional vector arguments are validated before assigning INHERITABLE
+    bool validate_optional_arguments_{false};
+
+    /// indicator that the subcommand is silent and won't show up in subcommands list
+    /// This is potentially useful as a modifier subcommand
+    bool silent_{false};
+
+    /// Counts the number of times this command/subcommand was parsed
+    std::uint32_t parsed_{0U};
+
+    /// Minimum required subcommands (not inheritable!)
+    std::size_t require_subcommand_min_{0};
+
+    /// Max number of subcommands allowed (parsing stops after this number). 0 is unlimited INHERITABLE
+    std::size_t require_subcommand_max_{0};
+
+    /// Minimum required options (not inheritable!)
+    std::size_t require_option_min_{0};
+
+    /// Max number of options allowed. 0 is unlimited (not inheritable)
+    std::size_t require_option_max_{0};
+
+    /// A pointer to the parent if this is a subcommand
+    App *parent_{nullptr};
+
+    /// The group membership INHERITABLE
+    std::string group_{"Subcommands"};
+
+    /// Alias names for the subcommand
+    std::vector<std::string> aliases_{};
+
+    ///@}
+    /// @name Config
+    ///@{
+
+    /// Pointer to the config option
+    Option *config_ptr_{nullptr};
+
+    /// This is the formatter for help printing. Default provided. INHERITABLE (same pointer)
+    std::shared_ptr<Config> config_formatter_{new ConfigTOML()};
+
+    ///@}
+
+#ifdef _WIN32
+    /// When normalizing argv to UTF-8 on Windows, this is the storage for normalized args.
+    std::vector<std::string> normalized_argv_{};
+
+    /// When normalizing argv to UTF-8 on Windows, this is the `char**` value returned to the user.
+    std::vector<char *> normalized_argv_view_{};
+#endif
+
+    /// Special private constructor for subcommand
+    App(std::string app_description, std::string app_name, App *parent);
+
+  public:
+    /// @name Basic
+    ///@{
+
+    /// Create a new program. Pass in the same arguments as main(), along with a help string.
+    explicit App(std::string app_description = "", std::string app_name = "")
+        : App(app_description, app_name, nullptr) {
+        set_help_flag("-h,--help", "Print this help message and exit");
+    }
+
+    App(const App &) = delete;
+    App &operator=(const App &) = delete;
+
+    /// virtual destructor
+    virtual ~App() = default;
+
+    /// Convert the contents of argv to UTF-8. Only does something on Windows, does nothing elsewhere.
+    CLI11_NODISCARD char **ensure_utf8(char **argv);
+
+    /// Set a callback for execution when all parsing and processing has completed
+    ///
+    /// Due to a bug in c++11,
+    /// it is not possible to overload on std::function (fixed in c++14
+    /// and backported to c++11 on newer compilers). Use capture by reference
+    /// to get a pointer to App if needed.
+    App *callback(std::function<void()> app_callback) {
+        if(immediate_callback_) {
+            parse_complete_callback_ = std::move(app_callback);
+        } else {
+            final_callback_ = std::move(app_callback);
+        }
+        return this;
+    }
+
+    /// Set a callback for execution when all parsing and processing has completed
+    /// aliased as callback
+    App *final_callback(std::function<void()> app_callback) {
+        final_callback_ = std::move(app_callback);
+        return this;
+    }
+
+    /// Set a callback to execute when parsing has completed for the app
+    ///
+    App *parse_complete_callback(std::function<void()> pc_callback) {
+        parse_complete_callback_ = std::move(pc_callback);
+        return this;
+    }
+
+    /// Set a callback to execute prior to parsing.
+    ///
+    App *preparse_callback(std::function<void(std::size_t)> pp_callback) {
+        pre_parse_callback_ = std::move(pp_callback);
+        return this;
+    }
+
+    /// Set a name for the app (empty will use parser to set the name)
+    App *name(std::string app_name = "");
+
+    /// Set an alias for the app
+    App *alias(std::string app_name);
+
+    /// Remove the error when extras are left over on the command line.
+    App *allow_extras(bool allow = true) {
+        allow_extras_ = allow;
+        return this;
+    }
+
+    /// Remove the error when extras are left over on the command line.
+    App *required(bool require = true) {
+        required_ = require;
+        return this;
+    }
+
+    /// Disable the subcommand or option group
+    App *disabled(bool disable = true) {
+        disabled_ = disable;
+        return this;
+    }
+
+    /// silence the subcommand from showing up in the processed list
+    App *silent(bool silence = true) {
+        silent_ = silence;
+        return this;
+    }
+
+    /// Set the subcommand to be disabled by default, so on clear(), at the start of each parse it is disabled
+    App *disabled_by_default(bool disable = true) {
+        if(disable) {
+            default_startup = startup_mode::disabled;
+        } else {
+            default_startup = (default_startup == startup_mode::enabled) ? startup_mode::enabled : startup_mode::stable;
+        }
+        return this;
+    }
+
+    /// Set the subcommand to be enabled by default, so on clear(), at the start of each parse it is enabled (not
+    /// disabled)
+    App *enabled_by_default(bool enable = true) {
+        if(enable) {
+            default_startup = startup_mode::enabled;
+        } else {
+            default_startup =
+                (default_startup == startup_mode::disabled) ? startup_mode::disabled : startup_mode::stable;
+        }
+        return this;
+    }
+
+    /// Set the subcommand callback to be executed immediately on subcommand completion
+    App *immediate_callback(bool immediate = true);
+
+    /// Set the subcommand to validate positional arguments before assigning
+    App *validate_positionals(bool validate = true) {
+        validate_positionals_ = validate;
+        return this;
+    }
+
+    /// Set the subcommand to validate optional vector arguments before assigning
+    App *validate_optional_arguments(bool validate = true) {
+        validate_optional_arguments_ = validate;
+        return this;
+    }
+
+    /// ignore extras in config files
+    App *allow_config_extras(bool allow = true) {
+        if(allow) {
+            allow_config_extras_ = config_extras_mode::capture;
+            allow_extras_ = true;
+        } else {
+            allow_config_extras_ = config_extras_mode::error;
+        }
+        return this;
+    }
+
+    /// ignore extras in config files
+    App *allow_config_extras(config_extras_mode mode) {
+        allow_config_extras_ = mode;
+        return this;
+    }
+
+    /// Do not parse anything after the first unrecognized option and return
+    App *prefix_command(bool allow = true) {
+        prefix_command_ = allow;
+        return this;
+    }
+
+    /// Ignore case. Subcommands inherit value.
+    App *ignore_case(bool value = true);
+
+    /// Allow windows style options, such as `/opt`. First matching short or long name used. Subcommands inherit
+    /// value.
+    App *allow_windows_style_options(bool value = true) {
+        allow_windows_style_options_ = value;
+        return this;
+    }
+
+    /// Specify that the positional arguments are only at the end of the sequence
+    App *positionals_at_end(bool value = true) {
+        positionals_at_end_ = value;
+        return this;
+    }
+
+    /// Specify that the subcommand can be triggered by a config file
+    App *configurable(bool value = true) {
+        configurable_ = value;
+        return this;
+    }
+
+    /// Ignore underscore. Subcommands inherit value.
+    App *ignore_underscore(bool value = true);
+
+    /// Set the help formatter
+    App *formatter(std::shared_ptr<FormatterBase> fmt) {
+        formatter_ = fmt;
+        return this;
+    }
+
+    /// Set the help formatter
+    App *formatter_fn(std::function<std::string(const App *, std::string, AppFormatMode)> fmt) {
+        formatter_ = std::make_shared<FormatterLambda>(fmt);
+        return this;
+    }
+
+    /// Set the config formatter
+    App *config_formatter(std::shared_ptr<Config> fmt) {
+        config_formatter_ = fmt;
+        return this;
+    }
+
+    /// Check to see if this subcommand was parsed, true only if received on command line.
+    CLI11_NODISCARD bool parsed() const { return parsed_ > 0; }
+
+    /// Get the OptionDefault object, to set option defaults
+    OptionDefaults *option_defaults() { return &option_defaults_; }
+
+    ///@}
+    /// @name Adding options
+    ///@{
+
+    /// Add an option, will automatically understand the type for common types.
+    ///
+    /// To use, create a variable with the expected type, and pass it in after the name.
+    /// After start is called, you can use count to see if the value was passed, and
+    /// the value will be initialized properly. Numbers, vectors, and strings are supported.
+    ///
+    /// ->required(), ->default, and the validators are options,
+    /// The positional options take an optional number of arguments.
+    ///
+    /// For example,
+    ///
+    ///     std::string filename;
+    ///     program.add_option("filename", filename, "description of filename");
+    ///
+    Option *add_option(std::string option_name,
+                       callback_t option_callback,
+                       std::string option_description = "",
+                       bool defaulted = false,
+                       std::function<std::string()> func = {});
+
+    /// Add option for assigning to a variable
+    template <typename AssignTo,
+              typename ConvertTo = AssignTo,
+              enable_if_t<!std::is_const<ConvertTo>::value, detail::enabler> = detail::dummy>
+    Option *add_option(std::string option_name,
+                       AssignTo &variable,  ///< The variable to set
+                       std::string option_description = "") {
+
+        auto fun = [&variable](const CLI::results_t &res) {  // comment for spacing
+            return detail::lexical_conversion<AssignTo, ConvertTo>(res, variable);
+        };
+
+        Option *opt = add_option(option_name, fun, option_description, false, [&variable]() {
+            return CLI::detail::checked_to_string<AssignTo, ConvertTo>(variable);
+        });
+        opt->type_name(detail::type_name<ConvertTo>());
+        // these must be actual lvalues since (std::max) sometimes is defined in terms of references and references
+        // to structs used in the evaluation can be temporary so that would cause issues.
+        auto Tcount = detail::type_count<AssignTo>::value;
+        auto XCcount = detail::type_count<ConvertTo>::value;
+        opt->type_size(detail::type_count_min<ConvertTo>::value, (std::max)(Tcount, XCcount));
+        opt->expected(detail::expected_count<ConvertTo>::value);
+        opt->run_callback_for_default();
+        return opt;
+    }
+
+    /// Add option for assigning to a variable
+    template <typename AssignTo, enable_if_t<!std::is_const<AssignTo>::value, detail::enabler> = detail::dummy>
+    Option *add_option_no_stream(std::string option_name,
+                                 AssignTo &variable,  ///< The variable to set
+                                 std::string option_description = "") {
+
+        auto fun = [&variable](const CLI::results_t &res) {  // comment for spacing
+            return detail::lexical_conversion<AssignTo, AssignTo>(res, variable);
+        };
+
+        Option *opt = add_option(option_name, fun, option_description, false, []() { return std::string{}; });
+        opt->type_name(detail::type_name<AssignTo>());
+        opt->type_size(detail::type_count_min<AssignTo>::value, detail::type_count<AssignTo>::value);
+        opt->expected(detail::expected_count<AssignTo>::value);
+        opt->run_callback_for_default();
+        return opt;
+    }
+
+    /// Add option for a callback of a specific type
+    template <typename ArgType>
+    Option *add_option_function(std::string option_name,
+                                const std::function<void(const ArgType &)> &func,  ///< the callback to execute
+                                std::string option_description = "") {
+
+        auto fun = [func](const CLI::results_t &res) {
+            ArgType variable;
+            bool result = detail::lexical_conversion<ArgType, ArgType>(res, variable);
+            if(result) {
+                func(variable);
+            }
+            return result;
+        };
+
+        Option *opt = add_option(option_name, std::move(fun), option_description, false);
+        opt->type_name(detail::type_name<ArgType>());
+        opt->type_size(detail::type_count_min<ArgType>::value, detail::type_count<ArgType>::value);
+        opt->expected(detail::expected_count<ArgType>::value);
+        return opt;
+    }
+
+    /// Add option with no description or variable assignment
+    Option *add_option(std::string option_name) {
+        return add_option(option_name, CLI::callback_t{}, std::string{}, false);
+    }
+
+    /// Add option with description but with no variable assignment or callback
+    template <typename T,
+              enable_if_t<std::is_const<T>::value && std::is_constructible<std::string, T>::value, detail::enabler> =
+                  detail::dummy>
+    Option *add_option(std::string option_name, T &option_description) {
+        return add_option(option_name, CLI::callback_t(), option_description, false);
+    }
+
+    /// Set a help flag, replace the existing one if present
+    Option *set_help_flag(std::string flag_name = "", const std::string &help_description = "");
+
+    /// Set a help all flag, replaced the existing one if present
+    Option *set_help_all_flag(std::string help_name = "", const std::string &help_description = "");
+
+    /// Set a version flag and version display string, replace the existing one if present
+    Option *set_version_flag(std::string flag_name = "",
+                             const std::string &versionString = "",
+                             const std::string &version_help = "Display program version information and exit");
+
+    /// Generate the version string through a callback function
+    Option *set_version_flag(std::string flag_name,
+                             std::function<std::string()> vfunc,
+                             const std::string &version_help = "Display program version information and exit");
+
+  private:
+    /// Internal function for adding a flag
+    Option *_add_flag_internal(std::string flag_name, CLI::callback_t fun, std::string flag_description);
+
+  public:
+    /// Add a flag with no description or variable assignment
+    Option *add_flag(std::string flag_name) { return _add_flag_internal(flag_name, CLI::callback_t(), std::string{}); }
+
+    /// Add flag with description but with no variable assignment or callback
+    /// takes a constant string,  if a variable string is passed that variable will be assigned the results from the
+    /// flag
+    template <typename T,
+              enable_if_t<std::is_const<T>::value && std::is_constructible<std::string, T>::value, detail::enabler> =
+                  detail::dummy>
+    Option *add_flag(std::string flag_name, T &flag_description) {
+        return _add_flag_internal(flag_name, CLI::callback_t(), flag_description);
+    }
+
+    /// Other type version accepts all other types that are not vectors such as bool, enum, string or other classes
+    /// that can be converted from a string
+    template <typename T,
+              enable_if_t<!detail::is_mutable_container<T>::value && !std::is_const<T>::value &&
+                              !std::is_constructible<std::function<void(int)>, T>::value,
+                          detail::enabler> = detail::dummy>
+    Option *add_flag(std::string flag_name,
+                     T &flag_result,  ///< A variable holding the flag result
+                     std::string flag_description = "") {
+
+        CLI::callback_t fun = [&flag_result](const CLI::results_t &res) {
+            using CLI::detail::lexical_cast;
+            return lexical_cast(res[0], flag_result);
+        };
+        auto *opt = _add_flag_internal(flag_name, std::move(fun), std::move(flag_description));
+        return detail::default_flag_modifiers<T>(opt);
+    }
+
+    /// Vector version to capture multiple flags.
+    template <typename T,
+              enable_if_t<!std::is_assignable<std::function<void(std::int64_t)> &, T>::value, detail::enabler> =
+                  detail::dummy>
+    Option *add_flag(std::string flag_name,
+                     std::vector<T> &flag_results,  ///< A vector of values with the flag results
+                     std::string flag_description = "") {
+        CLI::callback_t fun = [&flag_results](const CLI::results_t &res) {
+            bool retval = true;
+            for(const auto &elem : res) {
+                using CLI::detail::lexical_cast;
+                flag_results.emplace_back();
+                retval &= lexical_cast(elem, flag_results.back());
+            }
+            return retval;
+        };
+        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))
+            ->multi_option_policy(MultiOptionPolicy::TakeAll)
+            ->run_callback_for_default();
+    }
+
+    /// Add option for callback that is triggered with a true flag and takes no arguments
+    Option *add_flag_callback(std::string flag_name,
+                              std::function<void(void)> function,  ///< A function to call, void(void)
+                              std::string flag_description = "");
+
+    /// Add option for callback with an integer value
+    Option *add_flag_function(std::string flag_name,
+                              std::function<void(std::int64_t)> function,  ///< A function to call, void(int)
+                              std::string flag_description = "");
+
+#ifdef CLI11_CPP14
+    /// Add option for callback (C++14 or better only)
+    Option *add_flag(std::string flag_name,
+                     std::function<void(std::int64_t)> function,  ///< A function to call, void(std::int64_t)
+                     std::string flag_description = "") {
+        return add_flag_function(std::move(flag_name), std::move(function), std::move(flag_description));
+    }
+#endif
+
+    /// Set a configuration ini file option, or clear it if no name passed
+    Option *set_config(std::string option_name = "",
+                       std::string default_filename = "",
+                       const std::string &help_message = "Read an ini file",
+                       bool config_required = false);
+
+    /// Removes an option from the App. Takes an option pointer. Returns true if found and removed.
+    bool remove_option(Option *opt);
+
+    /// creates an option group as part of the given app
+    template <typename T = Option_group>
+    T *add_option_group(std::string group_name, std::string group_description = "") {
+        if(!detail::valid_alias_name_string(group_name)) {
+            throw IncorrectConstruction("option group names may not contain newlines or null characters");
+        }
+        auto option_group = std::make_shared<T>(std::move(group_description), group_name, this);
+        auto *ptr = option_group.get();
+        // move to App_p for overload resolution on older gcc versions
+        App_p app_ptr = std::dynamic_pointer_cast<App>(option_group);
+        add_subcommand(std::move(app_ptr));
+        return ptr;
+    }
+
+    ///@}
+    /// @name Subcommands
+    ///@{
+
+    /// Add a subcommand. Inherits INHERITABLE and OptionDefaults, and help flag
+    App *add_subcommand(std::string subcommand_name = "", std::string subcommand_description = "");
+
+    /// Add a previously created app as a subcommand
+    App *add_subcommand(CLI::App_p subcom);
+
+    /// Removes a subcommand from the App. Takes a subcommand pointer. Returns true if found and removed.
+    bool remove_subcommand(App *subcom);
+
+    /// Check to see if a subcommand is part of this command (doesn't have to be in command line)
+    /// returns the first subcommand if passed a nullptr
+    App *get_subcommand(const App *subcom) const;
+
+    /// Check to see if a subcommand is part of this command (text version)
+    CLI11_NODISCARD App *get_subcommand(std::string subcom) const;
+
+    /// Get a subcommand by name (noexcept non-const version)
+    /// returns null if subcommand doesn't exist
+    CLI11_NODISCARD App *get_subcommand_no_throw(std::string subcom) const noexcept;
+
+    /// Get a pointer to subcommand by index
+    CLI11_NODISCARD App *get_subcommand(int index = 0) const;
+
+    /// Check to see if a subcommand is part of this command and get a shared_ptr to it
+    CLI::App_p get_subcommand_ptr(App *subcom) const;
+
+    /// Check to see if a subcommand is part of this command (text version)
+    CLI11_NODISCARD CLI::App_p get_subcommand_ptr(std::string subcom) const;
+
+    /// Get an owning pointer to subcommand by index
+    CLI11_NODISCARD CLI::App_p get_subcommand_ptr(int index = 0) const;
+
+    /// Check to see if an option group is part of this App
+    CLI11_NODISCARD App *get_option_group(std::string group_name) const;
+
+    /// No argument version of count counts the number of times this subcommand was
+    /// passed in. The main app will return 1. Unnamed subcommands will also return 1 unless
+    /// otherwise modified in a callback
+    CLI11_NODISCARD std::size_t count() const { return parsed_; }
+
+    /// Get a count of all the arguments processed in options and subcommands, this excludes arguments which were
+    /// treated as extras.
+    CLI11_NODISCARD std::size_t count_all() const;
+
+    /// Changes the group membership
+    App *group(std::string group_name) {
+        group_ = group_name;
+        return this;
+    }
+
+    /// The argumentless form of require subcommand requires 1 or more subcommands
+    App *require_subcommand() {
+        require_subcommand_min_ = 1;
+        require_subcommand_max_ = 0;
+        return this;
+    }
+
+    /// Require a subcommand to be given (does not affect help call)
+    /// The number required can be given. Negative values indicate maximum
+    /// number allowed (0 for any number). Max number inheritable.
+    App *require_subcommand(int value) {
+        if(value < 0) {
+            require_subcommand_min_ = 0;
+            require_subcommand_max_ = static_cast<std::size_t>(-value);
+        } else {
+            require_subcommand_min_ = static_cast<std::size_t>(value);
+            require_subcommand_max_ = static_cast<std::size_t>(value);
+        }
+        return this;
+    }
+
+    /// Explicitly control the number of subcommands required. Setting 0
+    /// for the max means unlimited number allowed. Max number inheritable.
+    App *require_subcommand(std::size_t min, std::size_t max) {
+        require_subcommand_min_ = min;
+        require_subcommand_max_ = max;
+        return this;
+    }
+
+    /// The argumentless form of require option requires 1 or more options be used
+    App *require_option() {
+        require_option_min_ = 1;
+        require_option_max_ = 0;
+        return this;
+    }
+
+    /// Require an option to be given (does not affect help call)
+    /// The number required can be given. Negative values indicate maximum
+    /// number allowed (0 for any number).
+    App *require_option(int value) {
+        if(value < 0) {
+            require_option_min_ = 0;
+            require_option_max_ = static_cast<std::size_t>(-value);
+        } else {
+            require_option_min_ = static_cast<std::size_t>(value);
+            require_option_max_ = static_cast<std::size_t>(value);
+        }
+        return this;
+    }
+
+    /// Explicitly control the number of options required. Setting 0
+    /// for the max means unlimited number allowed. Max number inheritable.
+    App *require_option(std::size_t min, std::size_t max) {
+        require_option_min_ = min;
+        require_option_max_ = max;
+        return this;
+    }
+
+    /// Stop subcommand fallthrough, so that parent commands cannot collect commands after subcommand.
+    /// Default from parent, usually set on parent.
+    App *fallthrough(bool value = true) {
+        fallthrough_ = value;
+        return this;
+    }
+
+    /// Check to see if this subcommand was parsed, true only if received on command line.
+    /// This allows the subcommand to be directly checked.
+    explicit operator bool() const { return parsed_ > 0; }
 
     ///@}
-    /// @name Options
+    /// @name Extras for subclassing
     ///@{
 
-    /// The default values for options, customizable and changeable INHERITABLE
-    OptionDefaults option_defaults_{};
-
-    /// The list of options, stored locally
-    std::vector<Option_p> options_{};
+    /// This allows subclasses to inject code before callbacks but after parse.
+    ///
+    /// This does not run if any errors or help is thrown.
+    virtual void pre_callback() {}
 
     ///@}
-    /// @name Help
+    /// @name Parsing
     ///@{
+    //
+    /// Reset the parsed data
+    void clear();
 
-    /// Footer to put after all options in the help output INHERITABLE
-    std::string footer_{};
+    /// Parses the command line - throws errors.
+    /// This must be called after the options are in but before the rest of the program.
+    void parse(int argc, const char *const *argv);
+    void parse(int argc, const wchar_t *const *argv);
 
-    /// This is a function that generates a footer to put after all other options in help output
-    std::function<std::string()> footer_callback_{};
+  private:
+    template <class CharT> void parse_char_t(int argc, const CharT *const *argv);
 
-    /// A pointer to the help flag if there is one INHERITABLE
-    Option *help_ptr_{nullptr};
+  public:
+    /// Parse a single string as if it contained command line arguments.
+    /// This function splits the string into arguments then calls parse(std::vector<std::string> &)
+    /// the function takes an optional boolean argument specifying if the programName is included in the string to
+    /// process
+    void parse(std::string commandline, bool program_name_included = false);
+    void parse(std::wstring commandline, bool program_name_included = false);
 
-    /// A pointer to the help all flag if there is one INHERITABLE
-    Option *help_all_ptr_{nullptr};
+    /// The real work is done here. Expects a reversed vector.
+    /// Changes the vector to the remaining options.
+    void parse(std::vector<std::string> &args);
 
-    /// This is the formatter for help printing. Default provided. INHERITABLE (same pointer)
-    std::shared_ptr<FormatterBase> formatter_{new Formatter()};
+    /// The real work is done here. Expects a reversed vector.
+    void parse(std::vector<std::string> &&args);
 
-    /// The error message printing function INHERITABLE
-    std::function<std::string(const App *, const Error &e)> failure_message_{FailureMessage::simple};
+    void parse_from_stream(std::istream &input);
+
+    /// Provide a function to print a help message. The function gets access to the App pointer and error.
+    void failure_message(std::function<std::string(const App *, const Error &e)> function) {
+        failure_message_ = function;
+    }
+
+    /// Print a nice error message and return the exit code
+    int exit(const Error &e, std::ostream &out = std::cout, std::ostream &err = std::cerr) const;
 
     ///@}
-    /// @name Parsing
+    /// @name Post parsing
     ///@{
 
-    using missing_t = std::vector<std::pair<detail::Classifier, std::string>>;
+    /// Counts the number of times the given option was passed.
+    CLI11_NODISCARD std::size_t count(std::string option_name) const { return get_option(option_name)->count(); }
 
-    /// Pair of classifier, string for missing options. (extra detail is removed on returning from parse)
-    ///
-    /// This is faster and cleaner than storing just a list of strings and reparsing. This may contain the -- separator.
-    missing_t missing_{};
+    /// Get a subcommand pointer list to the currently selected subcommands (after parsing by default, in command
+    /// line order; use parsed = false to get the original definition list.)
+    CLI11_NODISCARD std::vector<App *> get_subcommands() const { return parsed_subcommands_; }
 
-    /// This is a list of pointers to options with the original parse order
-    std::vector<Option *> parse_order_{};
+    /// Get a filtered subcommand pointer list from the original definition list. An empty function will provide all
+    /// subcommands (const)
+    std::vector<const App *> get_subcommands(const std::function<bool(const App *)> &filter) const;
 
-    /// This is a list of the subcommands collected, in order
-    std::vector<App *> parsed_subcommands_{};
+    /// Get a filtered subcommand pointer list from the original definition list. An empty function will provide all
+    /// subcommands
+    std::vector<App *> get_subcommands(const std::function<bool(App *)> &filter);
 
-    /// this is a list of subcommands that are exclusionary to this one
-    std::set<App *> exclude_subcommands_{};
+    /// Check to see if given subcommand was selected
+    bool got_subcommand(const App *subcom) const {
+        // get subcom needed to verify that this was a real subcommand
+        return get_subcommand(subcom)->parsed_ > 0;
+    }
 
-    /// This is a list of options which are exclusionary to this App, if the options were used this subcommand should
-    /// not be
-    std::set<Option *> exclude_options_{};
+    /// Check with name instead of pointer to see if subcommand was selected
+    CLI11_NODISCARD bool got_subcommand(std::string subcommand_name) const noexcept {
+        App *sub = get_subcommand_no_throw(subcommand_name);
+        return (sub != nullptr) ? (sub->parsed_ > 0) : false;
+    }
 
-    /// this is a list of subcommands or option groups that are required by this one, the list is not mutual,  the
-    /// listed subcommands do not require this one
-    std::set<App *> need_subcommands_{};
+    /// Sets excluded options for the subcommand
+    App *excludes(Option *opt) {
+        if(opt == nullptr) {
+            throw OptionNotFound("nullptr passed");
+        }
+        exclude_options_.insert(opt);
+        return this;
+    }
 
-    /// This is a list of options which are required by this app, the list is not mutual, listed options do not need the
-    /// subcommand not be
-    std::set<Option *> need_options_{};
+    /// Sets excluded subcommands for the subcommand
+    App *excludes(App *app) {
+        if(app == nullptr) {
+            throw OptionNotFound("nullptr passed");
+        }
+        if(app == this) {
+            throw OptionNotFound("cannot self reference in needs");
+        }
+        auto res = exclude_subcommands_.insert(app);
+        // subcommand exclusion should be symmetric
+        if(res.second) {
+            app->exclude_subcommands_.insert(this);
+        }
+        return this;
+    }
+
+    App *needs(Option *opt) {
+        if(opt == nullptr) {
+            throw OptionNotFound("nullptr passed");
+        }
+        need_options_.insert(opt);
+        return this;
+    }
+
+    App *needs(App *app) {
+        if(app == nullptr) {
+            throw OptionNotFound("nullptr passed");
+        }
+        if(app == this) {
+            throw OptionNotFound("cannot self reference in needs");
+        }
+        need_subcommands_.insert(app);
+        return this;
+    }
+
+    /// Removes an option from the excludes list of this subcommand
+    bool remove_excludes(Option *opt);
+
+    /// Removes a subcommand from the excludes list of this subcommand
+    bool remove_excludes(App *app);
+
+    /// Removes an option from the needs list of this subcommand
+    bool remove_needs(Option *opt);
+
+    /// Removes a subcommand from the needs list of this subcommand
+    bool remove_needs(App *app);
+    ///@}
+    /// @name Help
+    ///@{
+
+    /// Set usage.
+    App *usage(std::string usage_string) {
+        usage_ = std::move(usage_string);
+        return this;
+    }
+    /// Set usage.
+    App *usage(std::function<std::string()> usage_function) {
+        usage_callback_ = std::move(usage_function);
+        return this;
+    }
+    /// Set footer.
+    App *footer(std::string footer_string) {
+        footer_ = std::move(footer_string);
+        return this;
+    }
+    /// Set footer.
+    App *footer(std::function<std::string()> footer_function) {
+        footer_callback_ = std::move(footer_function);
+        return this;
+    }
+    /// Produce a string that could be read in as a config of the current values of the App. Set default_also to
+    /// include default arguments. write_descriptions will print a description for the App and for each option.
+    CLI11_NODISCARD std::string config_to_str(bool default_also = false, bool write_description = false) const {
+        return config_formatter_->to_config(this, default_also, write_description, "");
+    }
 
+    /// Makes a help message, using the currently configured formatter
+    /// Will only do one subcommand at a time
+    CLI11_NODISCARD std::string help(std::string prev = "", AppFormatMode mode = AppFormatMode::Normal) const;
+
+    /// Displays a version string
+    CLI11_NODISCARD std::string version() const;
     ///@}
-    /// @name Subcommands
+    /// @name Getters
     ///@{
 
-    /// Storage for subcommand list
-    std::vector<App_p> subcommands_{};
-
-    /// If true, the program name is not case sensitive INHERITABLE
-    bool ignore_case_{false};
-
-    /// If true, the program should ignore underscores INHERITABLE
-    bool ignore_underscore_{false};
+    /// Access the formatter
+    CLI11_NODISCARD std::shared_ptr<FormatterBase> get_formatter() const { return formatter_; }
 
-    /// Allow subcommand fallthrough, so that parent commands can collect commands after subcommand.  INHERITABLE
-    bool fallthrough_{false};
+    /// Access the config formatter
+    CLI11_NODISCARD std::shared_ptr<Config> get_config_formatter() const { return config_formatter_; }
 
-    /// Allow '/' for options for Windows like options. Defaults to true on Windows, false otherwise. INHERITABLE
-    bool allow_windows_style_options_{
-#ifdef _WIN32
-        true
+    /// Access the config formatter as a configBase pointer
+    CLI11_NODISCARD std::shared_ptr<ConfigBase> get_config_formatter_base() const {
+        // This is safer as a dynamic_cast if we have RTTI, as Config -> ConfigBase
+#if CLI11_USE_STATIC_RTTI == 0
+        return std::dynamic_pointer_cast<ConfigBase>(config_formatter_);
 #else
-        false
+        return std::static_pointer_cast<ConfigBase>(config_formatter_);
 #endif
-    };
-    /// specify that positional arguments come at the end of the argument sequence not inheritable
-    bool positionals_at_end_{false};
+    }
 
-    enum class startup_mode : char { stable, enabled, disabled };
-    /// specify the startup mode for the app
-    /// stable=no change, enabled= startup enabled, disabled=startup disabled
-    startup_mode default_startup{startup_mode::stable};
+    /// Get the app or subcommand description
+    CLI11_NODISCARD std::string get_description() const { return description_; }
 
-    /// if set to true the subcommand can be triggered via configuration files INHERITABLE
-    bool configurable_{false};
+    /// Set the description of the app
+    App *description(std::string app_description) {
+        description_ = std::move(app_description);
+        return this;
+    }
 
-    /// If set to true positional options are validated before assigning INHERITABLE
-    bool validate_positionals_{false};
+    /// Get the list of options (user facing function, so returns raw pointers), has optional filter function
+    std::vector<const Option *> get_options(const std::function<bool(const Option *)> filter = {}) const;
 
-    /// A pointer to the parent if this is a subcommand
-    App *parent_{nullptr};
+    /// Non-const version of the above
+    std::vector<Option *> get_options(const std::function<bool(Option *)> filter = {});
 
-    /// Counts the number of times this command/subcommand was parsed
-    std::size_t parsed_{0};
+    /// Get an option by name (noexcept non-const version)
+    CLI11_NODISCARD Option *get_option_no_throw(std::string option_name) noexcept;
 
-    /// Minimum required subcommands (not inheritable!)
-    std::size_t require_subcommand_min_{0};
+    /// Get an option by name (noexcept const version)
+    CLI11_NODISCARD const Option *get_option_no_throw(std::string option_name) const noexcept;
 
-    /// Max number of subcommands allowed (parsing stops after this number). 0 is unlimited INHERITABLE
-    std::size_t require_subcommand_max_{0};
+    /// Get an option by name
+    CLI11_NODISCARD const Option *get_option(std::string option_name) const {
+        const auto *opt = get_option_no_throw(option_name);
+        if(opt == nullptr) {
+            throw OptionNotFound(option_name);
+        }
+        return opt;
+    }
 
-    /// Minimum required options (not inheritable!)
-    std::size_t require_option_min_{0};
+    /// Get an option by name (non-const version)
+    Option *get_option(std::string option_name) {
+        auto *opt = get_option_no_throw(option_name);
+        if(opt == nullptr) {
+            throw OptionNotFound(option_name);
+        }
+        return opt;
+    }
 
-    /// Max number of options allowed. 0 is unlimited (not inheritable)
-    std::size_t require_option_max_{0};
+    /// Shortcut bracket operator for getting a pointer to an option
+    const Option *operator[](const std::string &option_name) const { return get_option(option_name); }
 
-    /// The group membership INHERITABLE
-    std::string group_{"Subcommands"};
+    /// Shortcut bracket operator for getting a pointer to an option
+    const Option *operator[](const char *option_name) const { return get_option(option_name); }
 
-    /// Alias names for the subcommand
-    std::vector<std::string> aliases_{};
+    /// Check the status of ignore_case
+    CLI11_NODISCARD bool get_ignore_case() const { return ignore_case_; }
 
-    ///@}
-    /// @name Config
-    ///@{
+    /// Check the status of ignore_underscore
+    CLI11_NODISCARD bool get_ignore_underscore() const { return ignore_underscore_; }
 
-    /// Pointer to the config option
-    Option *config_ptr_{nullptr};
+    /// Check the status of fallthrough
+    CLI11_NODISCARD bool get_fallthrough() const { return fallthrough_; }
 
-    /// This is the formatter for help printing. Default provided. INHERITABLE (same pointer)
-    std::shared_ptr<Config> config_formatter_{new ConfigINI()};
+    /// Check the status of the allow windows style options
+    CLI11_NODISCARD bool get_allow_windows_style_options() const { return allow_windows_style_options_; }
 
-    ///@}
+    /// Check the status of the allow windows style options
+    CLI11_NODISCARD bool get_positionals_at_end() const { return positionals_at_end_; }
 
-    /// Special private constructor for subcommand
-    App(std::string app_description, std::string app_name, App *parent)
-        : name_(std::move(app_name)), description_(std::move(app_description)), parent_(parent) {
-        // Inherit if not from a nullptr
-        if(parent_ != nullptr) {
-            if(parent_->help_ptr_ != nullptr)
-                set_help_flag(parent_->help_ptr_->get_name(false, true), parent_->help_ptr_->get_description());
-            if(parent_->help_all_ptr_ != nullptr)
-                set_help_all_flag(parent_->help_all_ptr_->get_name(false, true),
-                                  parent_->help_all_ptr_->get_description());
-
-            /// OptionDefaults
-            option_defaults_ = parent_->option_defaults_;
-
-            // INHERITABLE
-            failure_message_ = parent_->failure_message_;
-            allow_extras_ = parent_->allow_extras_;
-            allow_config_extras_ = parent_->allow_config_extras_;
-            prefix_command_ = parent_->prefix_command_;
-            immediate_callback_ = parent_->immediate_callback_;
-            ignore_case_ = parent_->ignore_case_;
-            ignore_underscore_ = parent_->ignore_underscore_;
-            fallthrough_ = parent_->fallthrough_;
-            validate_positionals_ = parent_->validate_positionals_;
-            configurable_ = parent_->configurable_;
-            allow_windows_style_options_ = parent_->allow_windows_style_options_;
-            group_ = parent_->group_;
-            footer_ = parent_->footer_;
-            formatter_ = parent_->formatter_;
-            config_formatter_ = parent_->config_formatter_;
-            require_subcommand_max_ = parent_->require_subcommand_max_;
-        }
-    }
+    /// Check the status of the allow windows style options
+    CLI11_NODISCARD bool get_configurable() const { return configurable_; }
 
-  public:
-    /// @name Basic
-    ///@{
+    /// Get the group of this subcommand
+    CLI11_NODISCARD const std::string &get_group() const { return group_; }
 
-    /// Create a new program. Pass in the same arguments as main(), along with a help string.
-    explicit App(std::string app_description = "", std::string app_name = "")
-        : App(app_description, app_name, nullptr) {
-        set_help_flag("-h,--help", "Print this help message and exit");
+    /// Generate and return the usage.
+    CLI11_NODISCARD std::string get_usage() const {
+        return (usage_callback_) ? usage_callback_() + '\n' + usage_ : usage_;
     }
 
-    App(const App &) = delete;
-    App &operator=(const App &) = delete;
-
-    /// virtual destructor
-    virtual ~App() = default;
-
-    /// Set a callback for execution when all parsing and processing has completed
-    ///
-    /// Due to a bug in c++11,
-    /// it is not possible to overload on std::function (fixed in c++14
-    /// and backported to c++11 on newer compilers). Use capture by reference
-    /// to get a pointer to App if needed.
-    App *callback(std::function<void()> app_callback) {
-        if(immediate_callback_) {
-            parse_complete_callback_ = std::move(app_callback);
-        } else {
-            final_callback_ = std::move(app_callback);
-        }
-        return this;
+    /// Generate and return the footer.
+    CLI11_NODISCARD std::string get_footer() const {
+        return (footer_callback_) ? footer_callback_() + '\n' + footer_ : footer_;
     }
 
-    /// Set a callback for execution when all parsing and processing has completed
-    /// aliased as callback
-    App *final_callback(std::function<void()> app_callback) {
-        final_callback_ = std::move(app_callback);
-        return this;
-    }
+    /// Get the required min subcommand value
+    CLI11_NODISCARD std::size_t get_require_subcommand_min() const { return require_subcommand_min_; }
 
-    /// Set a callback to execute when parsing has completed for the app
-    ///
-    App *parse_complete_callback(std::function<void()> pc_callback) {
-        parse_complete_callback_ = std::move(pc_callback);
-        return this;
-    }
+    /// Get the required max subcommand value
+    CLI11_NODISCARD std::size_t get_require_subcommand_max() const { return require_subcommand_max_; }
 
-    /// Set a callback to execute prior to parsing.
-    ///
-    App *preparse_callback(std::function<void(std::size_t)> pp_callback) {
-        pre_parse_callback_ = std::move(pp_callback);
-        return this;
-    }
+    /// Get the required min option value
+    CLI11_NODISCARD std::size_t get_require_option_min() const { return require_option_min_; }
 
-    /// Set a name for the app (empty will use parser to set the name)
-    App *name(std::string app_name = "") {
+    /// Get the required max option value
+    CLI11_NODISCARD std::size_t get_require_option_max() const { return require_option_max_; }
 
-        if(parent_ != nullptr) {
-            auto oname = name_;
-            name_ = app_name;
-            auto &res = _compare_subcommand_names(*this, *_get_fallthrough_parent());
-            if(!res.empty()) {
-                name_ = oname;
-                throw(OptionAlreadyAdded(app_name + " conflicts with existing subcommand names"));
-            }
-        } else {
-            name_ = app_name;
-        }
-        has_automatic_name_ = false;
-        return this;
-    }
+    /// Get the prefix command status
+    CLI11_NODISCARD bool get_prefix_command() const { return prefix_command_; }
 
-    /// Set an alias for the app
-    App *alias(std::string app_name) {
-        if(!detail::valid_name_string(app_name)) {
-            throw(IncorrectConstruction("alias is not a valid name string"));
-        }
+    /// Get the status of allow extras
+    CLI11_NODISCARD bool get_allow_extras() const { return allow_extras_; }
 
-        if(parent_ != nullptr) {
-            aliases_.push_back(app_name);
-            auto &res = _compare_subcommand_names(*this, *_get_fallthrough_parent());
-            if(!res.empty()) {
-                aliases_.pop_back();
-                throw(OptionAlreadyAdded("alias already matches an existing subcommand: " + app_name));
-            }
-        } else {
-            aliases_.push_back(app_name);
-        }
+    /// Get the status of required
+    CLI11_NODISCARD bool get_required() const { return required_; }
 
-        return this;
-    }
+    /// Get the status of disabled
+    CLI11_NODISCARD bool get_disabled() const { return disabled_; }
 
-    /// Remove the error when extras are left over on the command line.
-    App *allow_extras(bool allow = true) {
-        allow_extras_ = allow;
-        return this;
-    }
+    /// Get the status of silence
+    CLI11_NODISCARD bool get_silent() const { return silent_; }
 
-    /// Remove the error when extras are left over on the command line.
-    App *required(bool require = true) {
-        required_ = require;
-        return this;
-    }
+    /// Get the status of disabled
+    CLI11_NODISCARD bool get_immediate_callback() const { return immediate_callback_; }
 
-    /// Disable the subcommand or option group
-    App *disabled(bool disable = true) {
-        disabled_ = disable;
-        return this;
-    }
+    /// Get the status of disabled by default
+    CLI11_NODISCARD bool get_disabled_by_default() const { return (default_startup == startup_mode::disabled); }
 
-    /// Set the subcommand to be disabled by default, so on clear(), at the start of each parse it is disabled
-    App *disabled_by_default(bool disable = true) {
-        if(disable) {
-            default_startup = startup_mode::disabled;
-        } else {
-            default_startup = (default_startup == startup_mode::enabled) ? startup_mode::enabled : startup_mode::stable;
-        }
-        return this;
-    }
+    /// Get the status of disabled by default
+    CLI11_NODISCARD bool get_enabled_by_default() const { return (default_startup == startup_mode::enabled); }
+    /// Get the status of validating positionals
+    CLI11_NODISCARD bool get_validate_positionals() const { return validate_positionals_; }
+    /// Get the status of validating optional vector arguments
+    CLI11_NODISCARD bool get_validate_optional_arguments() const { return validate_optional_arguments_; }
 
-    /// Set the subcommand to be enabled by default, so on clear(), at the start of each parse it is enabled (not
-    /// disabled)
-    App *enabled_by_default(bool enable = true) {
-        if(enable) {
-            default_startup = startup_mode::enabled;
-        } else {
-            default_startup =
-                (default_startup == startup_mode::disabled) ? startup_mode::disabled : startup_mode::stable;
-        }
-        return this;
-    }
+    /// Get the status of allow extras
+    CLI11_NODISCARD config_extras_mode get_allow_config_extras() const { return allow_config_extras_; }
 
-    /// Set the subcommand callback to be executed immediately on subcommand completion
-    App *immediate_callback(bool immediate = true) {
-        immediate_callback_ = immediate;
-        if(immediate_callback_) {
-            if(final_callback_ && !(parse_complete_callback_)) {
-                std::swap(final_callback_, parse_complete_callback_);
-            }
-        } else if(!(final_callback_) && parse_complete_callback_) {
-            std::swap(final_callback_, parse_complete_callback_);
-        }
-        return this;
-    }
+    /// Get a pointer to the help flag.
+    Option *get_help_ptr() { return help_ptr_; }
 
-    /// Set the subcommand to validate positional arguments before assigning
-    App *validate_positionals(bool validate = true) {
-        validate_positionals_ = validate;
-        return this;
-    }
+    /// Get a pointer to the help flag. (const)
+    CLI11_NODISCARD const Option *get_help_ptr() const { return help_ptr_; }
 
-    /// ignore extras in config files
-    App *allow_config_extras(bool allow = true) {
-        if(allow) {
-            allow_config_extras_ = config_extras_mode::capture;
-            allow_extras_ = true;
-        } else {
-            allow_config_extras_ = config_extras_mode::error;
-        }
-        return this;
-    }
+    /// Get a pointer to the help all flag. (const)
+    CLI11_NODISCARD const Option *get_help_all_ptr() const { return help_all_ptr_; }
 
-    /// ignore extras in config files
-    App *allow_config_extras(config_extras_mode mode) {
-        allow_config_extras_ = mode;
-        return this;
-    }
+    /// Get a pointer to the config option.
+    Option *get_config_ptr() { return config_ptr_; }
 
-    /// Do not parse anything after the first unrecognized option and return
-    App *prefix_command(bool allow = true) {
-        prefix_command_ = allow;
-        return this;
-    }
+    /// Get a pointer to the config option. (const)
+    CLI11_NODISCARD const Option *get_config_ptr() const { return config_ptr_; }
 
-    /// Ignore case. Subcommands inherit value.
-    App *ignore_case(bool value = true) {
-        if(value && !ignore_case_) {
-            ignore_case_ = true;
-            auto *p = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
-            auto &match = _compare_subcommand_names(*this, *p);
-            if(!match.empty()) {
-                ignore_case_ = false;  // we are throwing so need to be exception invariant
-                throw OptionAlreadyAdded("ignore case would cause subcommand name conflicts: " + match);
-            }
-        }
-        ignore_case_ = value;
-        return this;
-    }
+    /// Get a pointer to the version option.
+    Option *get_version_ptr() { return version_ptr_; }
 
-    /// Allow windows style options, such as `/opt`. First matching short or long name used. Subcommands inherit
-    /// value.
-    App *allow_windows_style_options(bool value = true) {
-        allow_windows_style_options_ = value;
-        return this;
-    }
+    /// Get a pointer to the version option. (const)
+    CLI11_NODISCARD const Option *get_version_ptr() const { return version_ptr_; }
+
+    /// Get the parent of this subcommand (or nullptr if main app)
+    App *get_parent() { return parent_; }
 
-    /// Specify that the positional arguments are only at the end of the sequence
-    App *positionals_at_end(bool value = true) {
-        positionals_at_end_ = value;
-        return this;
-    }
+    /// Get the parent of this subcommand (or nullptr if main app) (const version)
+    CLI11_NODISCARD const App *get_parent() const { return parent_; }
 
-    /// Specify that the subcommand can be triggered by a config file
-    App *configurable(bool value = true) {
-        configurable_ = value;
-        return this;
-    }
+    /// Get the name of the current app
+    CLI11_NODISCARD const std::string &get_name() const { return name_; }
 
-    /// Ignore underscore. Subcommands inherit value.
-    App *ignore_underscore(bool value = true) {
-        if(value && !ignore_underscore_) {
-            ignore_underscore_ = true;
-            auto *p = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
-            auto &match = _compare_subcommand_names(*this, *p);
-            if(!match.empty()) {
-                ignore_underscore_ = false;
-                throw OptionAlreadyAdded("ignore underscore would cause subcommand name conflicts: " + match);
-            }
-        }
-        ignore_underscore_ = value;
-        return this;
-    }
+    /// Get the aliases of the current app
+    CLI11_NODISCARD const std::vector<std::string> &get_aliases() const { return aliases_; }
 
-    /// Set the help formatter
-    App *formatter(std::shared_ptr<FormatterBase> fmt) {
-        formatter_ = fmt;
+    /// clear all the aliases of the current App
+    App *clear_aliases() {
+        aliases_.clear();
         return this;
     }
 
-    /// Set the help formatter
-    App *formatter_fn(std::function<std::string(const App *, std::string, AppFormatMode)> fmt) {
-        formatter_ = std::make_shared<FormatterLambda>(fmt);
-        return this;
-    }
+    /// Get a display name for an app
+    CLI11_NODISCARD std::string get_display_name(bool with_aliases = false) const;
 
-    /// Set the config formatter
-    App *config_formatter(std::shared_ptr<Config> fmt) {
-        config_formatter_ = fmt;
-        return this;
-    }
+    /// Check the name, case insensitive and underscore insensitive if set
+    CLI11_NODISCARD bool check_name(std::string name_to_check) const;
 
-    /// Check to see if this subcommand was parsed, true only if received on command line.
-    bool parsed() const { return parsed_ > 0; }
+    /// Get the groups available directly from this option (in order)
+    CLI11_NODISCARD std::vector<std::string> get_groups() const;
 
-    /// Get the OptionDefault object, to set option defaults
-    OptionDefaults *option_defaults() { return &option_defaults_; }
+    /// This gets a vector of pointers with the original parse order
+    CLI11_NODISCARD const std::vector<Option *> &parse_order() const { return parse_order_; }
+
+    /// This returns the missing options from the current subcommand
+    CLI11_NODISCARD std::vector<std::string> remaining(bool recurse = false) const;
+
+    /// This returns the missing options in a form ready for processing by another command line program
+    CLI11_NODISCARD std::vector<std::string> remaining_for_passthrough(bool recurse = false) const;
+
+    /// This returns the number of remaining options, minus the -- separator
+    CLI11_NODISCARD std::size_t remaining_size(bool recurse = false) const;
 
     ///@}
-    /// @name Adding options
-    ///@{
 
-    /// Add an option, will automatically understand the type for common types.
-    ///
-    /// To use, create a variable with the expected type, and pass it in after the name.
-    /// After start is called, you can use count to see if the value was passed, and
-    /// the value will be initialized properly. Numbers, vectors, and strings are supported.
-    ///
-    /// ->required(), ->default, and the validators are options,
-    /// The positional options take an optional number of arguments.
-    ///
-    /// For example,
-    ///
-    ///     std::string filename;
-    ///     program.add_option("filename", filename, "description of filename");
+  protected:
+    /// Check the options to make sure there are no conflicts.
     ///
-    Option *add_option(std::string option_name,
-                       callback_t option_callback,
-                       std::string option_description = "",
-                       bool defaulted = false,
-                       std::function<std::string()> func = {}) {
-        Option myopt{option_name, option_description, option_callback, this};
+    /// Currently checks to see if multiple positionals exist with unlimited args and checks if the min and max options
+    /// are feasible
+    void _validate() const;
 
-        if(std::find_if(std::begin(options_), std::end(options_), [&myopt](const Option_p &v) {
-          return *v == myopt;
-        }) == std::end(options_)) {
-            options_.emplace_back();
-            Option_p &option = options_.back();
-            option.reset(new Option(option_name, option_description, option_callback, this));
+    /// configure subcommands to enable parsing through the current object
+    /// set the correct fallthrough and prefix for nameless subcommands and manage the automatic enable or disable
+    /// makes sure parent is set correctly
+    void _configure();
 
-            // Set the default string capture function
-            option->default_function(func);
+    /// Internal function to run (App) callback, bottom up
+    void run_callback(bool final_mode = false, bool suppress_final_callback = false);
 
-            // For compatibility with CLI11 1.7 and before, capture the default string here
-            if(defaulted)
-                option->capture_default_str();
+    /// Check to see if a subcommand is valid. Give up immediately if subcommand max has been reached.
+    CLI11_NODISCARD bool _valid_subcommand(const std::string &current, bool ignore_used = true) const;
 
-            // Transfer defaults to the new option
-            option_defaults_.copy_to(option.get());
+    /// Selects a Classifier enum based on the type of the current argument
+    CLI11_NODISCARD detail::Classifier _recognize(const std::string &current,
+                                                  bool ignore_used_subcommands = true) const;
 
-            // Don't bother to capture if we already did
-            if(!defaulted && option->get_always_capture_default())
-                option->capture_default_str();
+    // The parse function is now broken into several parts, and part of process
 
-            return option.get();
-        }
-        // we know something matches now find what it is so we can produce more error information
-        for(auto &opt : options_) {
-            auto &matchname = opt->matching_name(myopt);
-            if(!matchname.empty()) {
-                throw(OptionAlreadyAdded("added option matched existing option name: " + matchname));
-            }
-        }
-        // this line should not be reached the above loop should trigger the throw
-        throw(OptionAlreadyAdded("added option matched existing option name"));  // LCOV_EXCL_LINE
-    }
+    /// Read and process a configuration file (main app only)
+    void _process_config_file();
 
-    /// Add option for assigning to a variable
-    template <typename AssignTo,
-        typename ConvertTo = AssignTo,
-        enable_if_t<!std::is_const<ConvertTo>::value, detail::enabler> = detail::dummy>
-    Option *add_option(std::string option_name,
-                       AssignTo &variable,  ///< The variable to set
-                       std::string option_description = "",
-                       bool defaulted = false) {
+    /// Read and process a particular configuration file
+    bool _process_config_file(const std::string &config_file, bool throw_error);
 
-        auto fun = [&variable](const CLI::results_t &res) {  // comment for spacing
-          return detail::lexical_conversion<AssignTo, ConvertTo>(res, variable);
-        };
+    /// Get envname options if not yet passed. Runs on *all* subcommands.
+    void _process_env();
 
-        Option *opt = add_option(option_name, fun, option_description, defaulted, [&variable]() {
-          return CLI::detail::checked_to_string<AssignTo, ConvertTo>(variable);
-        });
-        opt->type_name(detail::type_name<ConvertTo>());
-        // these must be actual lvalues since (std::max) sometimes is defined in terms of references and references
-        // to structs used in the evaluation can be temporary so that would cause issues.
-        auto Tcount = detail::type_count<AssignTo>::value;
-        auto XCcount = detail::type_count<ConvertTo>::value;
-        opt->type_size((std::max)(Tcount, XCcount));
-        opt->expected(detail::expected_count<ConvertTo>::value);
-        opt->run_callback_for_default();
-        return opt;
-    }
+    /// Process callbacks. Runs on *all* subcommands.
+    void _process_callbacks();
 
-    /// Add option for a callback of a specific type
-    template <typename T>
-    Option *add_option_function(std::string option_name,
-                                const std::function<void(const T &)> &func,  ///< the callback to execute
-                                std::string option_description = "") {
+    /// Run help flag processing if any are found.
+    ///
+    /// The flags allow recursive calls to remember if there was a help flag on a parent.
+    void _process_help_flags(bool trigger_help = false, bool trigger_all_help = false) const;
 
-        auto fun = [func](const CLI::results_t &res) {
-          T variable;
-          bool result = detail::lexical_conversion<T, T>(res, variable);
-          if(result) {
-              func(variable);
-          }
-          return result;
-        };
+    /// Verify required options and cross requirements. Subcommands too (only if selected).
+    void _process_requirements();
 
-        Option *opt = add_option(option_name, std::move(fun), option_description, false);
-        opt->type_name(detail::type_name<T>());
-        opt->type_size(detail::type_count<T>::value);
-        opt->expected(detail::expected_count<T>::value);
-        return opt;
-    }
+    /// Process callbacks and such.
+    void _process();
 
-    /// Add option with no description or variable assignment
-    Option *add_option(std::string option_name) {
-        return add_option(option_name, CLI::callback_t(), std::string{}, false);
-    }
+    /// Throw an error if anything is left over and should not be.
+    void _process_extras();
 
-    /// Add option with description but with no variable assignment or callback
-    template <typename T,
-        enable_if_t<std::is_const<T>::value && std::is_constructible<std::string, T>::value, detail::enabler> =
-        detail::dummy>
-    Option *add_option(std::string option_name, T &option_description) {
-        return add_option(option_name, CLI::callback_t(), option_description, false);
-    }
+    /// Throw an error if anything is left over and should not be.
+    /// Modifies the args to fill in the missing items before throwing.
+    void _process_extras(std::vector<std::string> &args);
 
-    /// Set a help flag, replace the existing one if present
-    Option *set_help_flag(std::string flag_name = "", const std::string &help_description = "") {
-        // take flag_description by const reference otherwise add_flag tries to assign to help_description
-        if(help_ptr_ != nullptr) {
-            remove_option(help_ptr_);
-            help_ptr_ = nullptr;
-        }
+    /// Internal function to recursively increment the parsed counter on the current app as well unnamed subcommands
+    void increment_parsed();
 
-        // Empty name will simply remove the help flag
-        if(!flag_name.empty()) {
-            help_ptr_ = add_flag(flag_name, help_description);
-            help_ptr_->configurable(false);
-        }
+    /// Internal parse function
+    void _parse(std::vector<std::string> &args);
 
-        return help_ptr_;
-    }
+    /// Internal parse function
+    void _parse(std::vector<std::string> &&args);
 
-    /// Set a help all flag, replaced the existing one if present
-    Option *set_help_all_flag(std::string help_name = "", const std::string &help_description = "") {
-        // take flag_description by const reference otherwise add_flag tries to assign to flag_description
-        if(help_all_ptr_ != nullptr) {
-            remove_option(help_all_ptr_);
-            help_all_ptr_ = nullptr;
-        }
+    /// Internal function to parse a stream
+    void _parse_stream(std::istream &input);
 
-        // Empty name will simply remove the help all flag
-        if(!help_name.empty()) {
-            help_all_ptr_ = add_flag(help_name, help_description);
-            help_all_ptr_->configurable(false);
-        }
+    /// Parse one config param, return false if not found in any subcommand, remove if it is
+    ///
+    /// If this has more than one dot.separated.name, go into the subcommand matching it
+    /// Returns true if it managed to find the option, if false you'll need to remove the arg manually.
+    void _parse_config(const std::vector<ConfigItem> &args);
 
-        return help_all_ptr_;
-    }
+    /// Fill in a single config option
+    bool _parse_single_config(const ConfigItem &item, std::size_t level = 0);
 
-  private:
-    /// Internal function for adding a flag
-    Option *_add_flag_internal(std::string flag_name, CLI::callback_t fun, std::string flag_description) {
-        Option *opt;
-        if(detail::has_default_flag_values(flag_name)) {
-            // check for default values and if it has them
-            auto flag_defaults = detail::get_default_flag_values(flag_name);
-            detail::remove_default_flag_values(flag_name);
-            opt = add_option(std::move(flag_name), std::move(fun), std::move(flag_description), false);
-            for(const auto &fname : flag_defaults)
-                opt->fnames_.push_back(fname.first);
-            opt->default_flag_values_ = std::move(flag_defaults);
-        } else {
-            opt = add_option(std::move(flag_name), std::move(fun), std::move(flag_description), false);
-        }
-        // flags cannot have positional values
-        if(opt->get_positional()) {
-            auto pos_name = opt->get_name(true);
-            remove_option(opt);
-            throw IncorrectConstruction::PositionalFlag(pos_name);
-        }
-        opt->multi_option_policy(MultiOptionPolicy::TakeLast);
-        opt->expected(0);
-        opt->required(false);
-        return opt;
-    }
+    /// Parse "one" argument (some may eat more than one), delegate to parent if fails, add to missing if missing
+    /// from main return false if the parse has failed and needs to return to parent
+    bool _parse_single(std::vector<std::string> &args, bool &positional_only);
 
-  public:
-    /// Add a flag with no description or variable assignment
-    Option *add_flag(std::string flag_name) { return _add_flag_internal(flag_name, CLI::callback_t(), std::string{}); }
+    /// Count the required remaining positional arguments
+    CLI11_NODISCARD std::size_t _count_remaining_positionals(bool required_only = false) const;
 
-    /// Add flag with description but with no variable assignment or callback
-    /// takes a constant string,  if a variable string is passed that variable will be assigned the results from the
-    /// flag
-    template <typename T,
-        enable_if_t<std::is_const<T>::value && std::is_constructible<std::string, T>::value, detail::enabler> =
-        detail::dummy>
-    Option *add_flag(std::string flag_name, T &flag_description) {
-        return _add_flag_internal(flag_name, CLI::callback_t(), flag_description);
-    }
+    /// Count the required remaining positional arguments
+    CLI11_NODISCARD bool _has_remaining_positionals() const;
 
-    /// Add option for flag with integer result - defaults to allowing multiple passings, but can be forced to one
-    /// if `multi_option_policy(CLI::MultiOptionPolicy::Throw)` is used.
-    template <typename T,
-        enable_if_t<std::is_integral<T>::value && !is_bool<T>::value, detail::enabler> = detail::dummy>
-    Option *add_flag(std::string flag_name,
-                     T &flag_count,  ///< A variable holding the count
-                     std::string flag_description = "") {
-        flag_count = 0;
-        CLI::callback_t fun = [&flag_count](const CLI::results_t &res) {
-          try {
-              detail::sum_flag_vector(res, flag_count);
-          } catch(const std::invalid_argument &) {
-              return false;
-          }
-          return true;
-        };
-        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))
-            ->multi_option_policy(MultiOptionPolicy::TakeAll);
-    }
+    /// Parse a positional, go up the tree to check
+    /// @param haltOnSubcommand if set to true the operation will not process subcommands merely return false
+    /// Return true if the positional was used false otherwise
+    bool _parse_positional(std::vector<std::string> &args, bool haltOnSubcommand);
 
-    /// Other type version accepts all other types that are not vectors such as bool, enum, string or other classes
-    /// that can be converted from a string
-    template <typename T,
-        enable_if_t<!is_vector<T>::value && !std::is_const<T>::value &&
-                    (!std::is_integral<T>::value || is_bool<T>::value) &&
-                    !std::is_constructible<std::function<void(int)>, T>::value,
-            detail::enabler> = detail::dummy>
-    Option *add_flag(std::string flag_name,
-                     T &flag_result,  ///< A variable holding true if passed
-                     std::string flag_description = "") {
+    /// Locate a subcommand by name with two conditions, should disabled subcommands be ignored, and should used
+    /// subcommands be ignored
+    CLI11_NODISCARD App *
+    _find_subcommand(const std::string &subc_name, bool ignore_disabled, bool ignore_used) const noexcept;
 
-        CLI::callback_t fun = [&flag_result](const CLI::results_t &res) {
-          return CLI::detail::lexical_cast(res[0], flag_result);
-        };
-        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))->run_callback_for_default();
-    }
+    /// Parse a subcommand, modify args and continue
+    ///
+    /// Unlike the others, this one will always allow fallthrough
+    /// return true if the subcommand was processed false otherwise
+    bool _parse_subcommand(std::vector<std::string> &args);
 
-    /// Vector version to capture multiple flags.
-    template <
-        typename T,
-        enable_if_t<!std::is_assignable<std::function<void(std::int64_t)>, T>::value, detail::enabler> = detail::dummy>
-    Option *add_flag(std::string flag_name,
-                     std::vector<T> &flag_results,  ///< A vector of values with the flag results
-                     std::string flag_description = "") {
-        CLI::callback_t fun = [&flag_results](const CLI::results_t &res) {
-          bool retval = true;
-          for(const auto &elem : res) {
-              flag_results.emplace_back();
-              retval &= detail::lexical_cast(elem, flag_results.back());
-          }
-          return retval;
-        };
-        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))
-            ->multi_option_policy(MultiOptionPolicy::TakeAll)
-            ->run_callback_for_default();
-    }
+    /// Parse a short (false) or long (true) argument, must be at the top of the list
+    /// if local_processing_only is set to true then fallthrough is disabled will return false if not found
+    /// return true if the argument was processed or false if nothing was done
+    bool _parse_arg(std::vector<std::string> &args, detail::Classifier current_type, bool local_processing_only);
 
-    /// Add option for callback that is triggered with a true flag and takes no arguments
-    Option *add_flag_callback(std::string flag_name,
-                              std::function<void(void)> function,  ///< A function to call, void(void)
-                              std::string flag_description = "") {
-
-        CLI::callback_t fun = [function](const CLI::results_t &res) {
-          bool trigger{false};
-          auto result = CLI::detail::lexical_cast(res[0], trigger);
-          if(result && trigger) {
-              function();
-          }
-          return result;
-        };
-        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description));
-    }
+    /// Trigger the pre_parse callback if needed
+    void _trigger_pre_parse(std::size_t remaining_args);
 
-    /// Add option for callback with an integer value
-    Option *add_flag_function(std::string flag_name,
-                              std::function<void(std::int64_t)> function,  ///< A function to call, void(int)
-                              std::string flag_description = "") {
+    /// Get the appropriate parent to fallthrough to which is the first one that has a name or the main app
+    App *_get_fallthrough_parent();
 
-        CLI::callback_t fun = [function](const CLI::results_t &res) {
-          std::int64_t flag_count = 0;
-          detail::sum_flag_vector(res, flag_count);
-          function(flag_count);
-          return true;
-        };
-        return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))
-            ->multi_option_policy(MultiOptionPolicy::TakeAll);
-    }
+    /// Helper function to run through all possible comparisons of subcommand names to check there is no overlap
+    CLI11_NODISCARD const std::string &_compare_subcommand_names(const App &subcom, const App &base) const;
 
-#ifdef CLI11_CPP14
-    /// Add option for callback (C++14 or better only)
-    Option *add_flag(std::string flag_name,
-                     std::function<void(std::int64_t)> function,  ///< A function to call, void(std::int64_t)
-                     std::string flag_description = "") {
-        return add_flag_function(std::move(flag_name), std::move(function), std::move(flag_description));
-    }
-#endif
+    /// Helper function to place extra values in the most appropriate position
+    void _move_to_missing(detail::Classifier val_type, const std::string &val);
 
-    /// Add set of options (No default, temp reference, such as an inline set) DEPRECATED
-    template <typename T>
-    Option *add_set(std::string option_name,
-                    T &member,            ///< The selected member of the set
-                    std::set<T> options,  ///< The set of possibilities
-                    std::string option_description = "") {
+  public:
+    /// function that could be used by subclasses of App to shift options around into subcommands
+    void _move_option(Option *opt, App *app);
+};  // namespace CLI
 
-        Option *opt = add_option(option_name, member, std::move(option_description));
-        opt->check(IsMember{options});
-        return opt;
+/// Extension of App to better manage groups of options
+class Option_group : public App {
+  public:
+    Option_group(std::string group_description, std::string group_name, App *parent)
+        : App(std::move(group_description), "", parent) {
+        group(group_name);
+        // option groups should have automatic fallthrough
     }
-
-    /// Add set of options (No default, set can be changed afterwards - do not destroy the set) DEPRECATED
-    template <typename T>
-    Option *add_mutable_set(std::string option_name,
-                            T &member,                   ///< The selected member of the set
-                            const std::set<T> &options,  ///< The set of possibilities
-                            std::string option_description = "") {
-
-        Option *opt = add_option(option_name, member, std::move(option_description));
-        opt->check(IsMember{&options});
+    using App::add_option;
+    /// Add an existing option to the Option_group
+    Option *add_option(Option *opt) {
+        if(get_parent() == nullptr) {
+            throw OptionNotFound("Unable to locate the specified option");
+        }
+        get_parent()->_move_option(opt, this);
         return opt;
     }
+    /// Add an existing option to the Option_group
+    void add_options(Option *opt) { add_option(opt); }
+    /// Add a bunch of options to the group
+    template <typename... Args> void add_options(Option *opt, Args... args) {
+        add_option(opt);
+        add_options(args...);
+    }
+    using App::add_subcommand;
+    /// Add an existing subcommand to be a member of an option_group
+    App *add_subcommand(App *subcom) {
+        App_p subc = subcom->get_parent()->get_subcommand_ptr(subcom);
+        subc->get_parent()->remove_subcommand(subcom);
+        add_subcommand(std::move(subc));
+        return subcom;
+    }
+};
 
-    /// Add set of options (with default, static set, such as an inline set) DEPRECATED
-    template <typename T>
-    Option *add_set(std::string option_name,
-                    T &member,            ///< The selected member of the set
-                    std::set<T> options,  ///< The set of possibilities
-                    std::string option_description,
-                    bool defaulted) {
-
-        Option *opt = add_option(option_name, member, std::move(option_description), defaulted);
-        opt->check(IsMember{options});
-        return opt;
-    }
+/// Helper function to enable one option group/subcommand when another is used
+CLI11_INLINE void TriggerOn(App *trigger_app, App *app_to_enable);
 
-    /// Add set of options (with default, set can be changed afterwards - do not destroy the set) DEPRECATED
-    template <typename T>
-    Option *add_mutable_set(std::string option_name,
-                            T &member,                   ///< The selected member of the set
-                            const std::set<T> &options,  ///< The set of possibilities
-                            std::string option_description,
-                            bool defaulted) {
-
-        Option *opt = add_option(option_name, member, std::move(option_description), defaulted);
-        opt->check(IsMember{&options});
-        return opt;
-    }
+/// Helper function to enable one option group/subcommand when another is used
+CLI11_INLINE void TriggerOn(App *trigger_app, std::vector<App *> apps_to_enable);
 
-    /// Add a complex number
-    template <typename T, typename XC = double>
-    Option *add_complex(std::string option_name,
-                        T &variable,
-                        std::string option_description = "",
-                        bool defaulted = false,
-                        std::string label = "COMPLEX") {
-
-        CLI::callback_t fun = [&variable](const results_t &res) {
-          XC x, y;
-          bool worked;
-          if(res.size() >= 2 && !res[1].empty()) {
-              auto str1 = res[1];
-              if(str1.back() == 'i' || str1.back() == 'j')
-                  str1.pop_back();
-              worked = detail::lexical_cast(res[0], x) && detail::lexical_cast(str1, y);
-          } else {
-              auto str1 = res.front();
-              auto nloc = str1.find_last_of('-');
-              if(nloc != std::string::npos && nloc > 0) {
-                  worked = detail::lexical_cast(str1.substr(0, nloc), x);
-                  str1 = str1.substr(nloc);
-                  if(str1.back() == 'i' || str1.back() == 'j')
-                      str1.pop_back();
-                  worked = worked && detail::lexical_cast(str1, y);
-              } else {
-                  if(str1.back() == 'i' || str1.back() == 'j') {
-                      str1.pop_back();
-                      worked = detail::lexical_cast(str1, y);
-                      x = XC{0};
-                  } else {
-                      worked = detail::lexical_cast(str1, x);
-                      y = XC{0};
-                  }
-              }
-          }
-          if(worked)
-              variable = T{x, y};
-          return worked;
-        };
+/// Helper function to disable one option group/subcommand when another is used
+CLI11_INLINE void TriggerOff(App *trigger_app, App *app_to_enable);
 
-        auto default_function = [&variable]() { return CLI::detail::checked_to_string<T, T>(variable); };
+/// Helper function to disable one option group/subcommand when another is used
+CLI11_INLINE void TriggerOff(App *trigger_app, std::vector<App *> apps_to_enable);
 
-        CLI::Option *opt =
-            add_option(option_name, std::move(fun), std::move(option_description), defaulted, default_function);
+/// Helper function to mark an option as deprecated
+CLI11_INLINE void deprecate_option(Option *opt, const std::string &replacement = "");
 
-        opt->type_name(label)->type_size(1, 2)->delimiter('+')->run_callback_for_default();
-        return opt;
-    }
+/// Helper function to mark an option as deprecated
+inline void deprecate_option(App *app, const std::string &option_name, const std::string &replacement = "") {
+    auto *opt = app->get_option(option_name);
+    deprecate_option(opt, replacement);
+}
 
-    /// Set a configuration ini file option, or clear it if no name passed
-    Option *set_config(std::string option_name = "",
-                       std::string default_filename = "",
-                       const std::string &help_message = "Read an ini file",
-                       bool config_required = false) {
+/// Helper function to mark an option as deprecated
+inline void deprecate_option(App &app, const std::string &option_name, const std::string &replacement = "") {
+    auto *opt = app.get_option(option_name);
+    deprecate_option(opt, replacement);
+}
 
-        // Remove existing config if present
-        if(config_ptr_ != nullptr) {
-            remove_option(config_ptr_);
-            config_ptr_ = nullptr;  // need to remove the config_ptr completely
-        }
+/// Helper function to mark an option as retired
+CLI11_INLINE void retire_option(App *app, Option *opt);
 
-        // Only add config if option passed
-        if(!option_name.empty()) {
-            config_ptr_ = add_option(option_name, help_message);
-            if(config_required) {
-                config_ptr_->required();
-            }
-            if(!default_filename.empty()) {
-                config_ptr_->default_str(std::move(default_filename));
-            }
-            config_ptr_->configurable(false);
-        }
+/// Helper function to mark an option as retired
+CLI11_INLINE void retire_option(App &app, Option *opt);
 
-        return config_ptr_;
-    }
+/// Helper function to mark an option as retired
+CLI11_INLINE void retire_option(App *app, const std::string &option_name);
 
-    /// Removes an option from the App. Takes an option pointer. Returns true if found and removed.
-    bool remove_option(Option *opt) {
-        // Make sure no links exist
-        for(Option_p &op : options_) {
-            op->remove_needs(opt);
-            op->remove_excludes(opt);
-        }
+/// Helper function to mark an option as retired
+CLI11_INLINE void retire_option(App &app, const std::string &option_name);
 
-        if(help_ptr_ == opt)
-            help_ptr_ = nullptr;
-        if(help_all_ptr_ == opt)
-            help_all_ptr_ = nullptr;
+namespace detail {
+/// This class is simply to allow tests access to App's protected functions
+struct AppFriend {
+#ifdef CLI11_CPP14
 
-        auto iterator =
-            std::find_if(std::begin(options_), std::end(options_), [opt](const Option_p &v) { return v.get() == opt; });
-        if(iterator != std::end(options_)) {
-            options_.erase(iterator);
-            return true;
-        }
-        return false;
+    /// Wrap _parse_short, perfectly forward arguments and return
+    template <typename... Args> static decltype(auto) parse_arg(App *app, Args &&...args) {
+        return app->_parse_arg(std::forward<Args>(args)...);
     }
 
-    /// creates an option group as part of the given app
-    template <typename T = Option_group>
-    T *add_option_group(std::string group_name, std::string group_description = "") {
-        auto option_group = std::make_shared<T>(std::move(group_description), group_name, this);
-        auto ptr = option_group.get();
-        // move to App_p for overload resolution on older gcc versions
-        App_p app_ptr = std::dynamic_pointer_cast<App>(option_group);
-        add_subcommand(std::move(app_ptr));
-        return ptr;
+    /// Wrap _parse_subcommand, perfectly forward arguments and return
+    template <typename... Args> static decltype(auto) parse_subcommand(App *app, Args &&...args) {
+        return app->_parse_subcommand(std::forward<Args>(args)...);
     }
-
-    ///@}
-    /// @name Subcommands
-    ///@{
-
-    /// Add a subcommand. Inherits INHERITABLE and OptionDefaults, and help flag
-    App *add_subcommand(std::string subcommand_name = "", std::string subcommand_description = "") {
-        if(!subcommand_name.empty() && !detail::valid_name_string(subcommand_name)) {
-            throw IncorrectConstruction("subcommand name is not valid");
-        }
-        CLI::App_p subcom = std::shared_ptr<App>(new App(std::move(subcommand_description), subcommand_name, this));
-        return add_subcommand(std::move(subcom));
+#else
+    /// Wrap _parse_short, perfectly forward arguments and return
+    template <typename... Args>
+    static auto parse_arg(App *app, Args &&...args) ->
+        typename std::result_of<decltype (&App::_parse_arg)(App, Args...)>::type {
+        return app->_parse_arg(std::forward<Args>(args)...);
     }
 
-    /// Add a previously created app as a subcommand
-    App *add_subcommand(CLI::App_p subcom) {
-        if(!subcom)
-            throw IncorrectConstruction("passed App is not valid");
-        auto ckapp = (name_.empty() && parent_ != nullptr) ? _get_fallthrough_parent() : this;
-        auto &mstrg = _compare_subcommand_names(*subcom, *ckapp);
-        if(!mstrg.empty()) {
-            throw(OptionAlreadyAdded("subcommand name or alias matches existing subcommand: " + mstrg));
-        }
-        subcom->parent_ = this;
-        subcommands_.push_back(std::move(subcom));
-        return subcommands_.back().get();
+    /// Wrap _parse_subcommand, perfectly forward arguments and return
+    template <typename... Args>
+    static auto parse_subcommand(App *app, Args &&...args) ->
+        typename std::result_of<decltype (&App::_parse_subcommand)(App, Args...)>::type {
+        return app->_parse_subcommand(std::forward<Args>(args)...);
     }
+#endif
+    /// Wrap the fallthrough parent function to make sure that is working correctly
+    static App *get_fallthrough_parent(App *app) { return app->_get_fallthrough_parent(); }
+};
+}  // namespace detail
 
-    /// Removes a subcommand from the App. Takes a subcommand pointer. Returns true if found and removed.
-    bool remove_subcommand(App *subcom) {
-        // Make sure no links exist
-        for(App_p &sub : subcommands_) {
-            sub->remove_excludes(subcom);
-            sub->remove_needs(subcom);
-        }
 
-        auto iterator = std::find_if(
-            std::begin(subcommands_), std::end(subcommands_), [subcom](const App_p &v) { return v.get() == subcom; });
-        if(iterator != std::end(subcommands_)) {
-            subcommands_.erase(iterator);
-            return true;
-        }
-        return false;
-    }
-    /// Check to see if a subcommand is part of this command (doesn't have to be in command line)
-    /// returns the first subcommand if passed a nullptr
-    App *get_subcommand(const App *subcom) const {
-        if(subcom == nullptr)
-            throw OptionNotFound("nullptr passed");
-        for(const App_p &subcomptr : subcommands_)
-            if(subcomptr.get() == subcom)
-                return subcomptr.get();
-        throw OptionNotFound(subcom->get_name());
-    }
 
-    /// Check to see if a subcommand is part of this command (text version)
-    App *get_subcommand(std::string subcom) const {
-        auto subc = _find_subcommand(subcom, false, false);
-        if(subc == nullptr)
-            throw OptionNotFound(subcom);
-        return subc;
-    }
-    /// Get a pointer to subcommand by index
-    App *get_subcommand(int index = 0) const {
-        if(index >= 0) {
-            auto uindex = static_cast<unsigned>(index);
-            if(uindex < subcommands_.size())
-                return subcommands_[uindex].get();
-        }
-        throw OptionNotFound(std::to_string(index));
-    }
 
-    /// Check to see if a subcommand is part of this command and get a shared_ptr to it
-    CLI::App_p get_subcommand_ptr(App *subcom) const {
-        if(subcom == nullptr)
-            throw OptionNotFound("nullptr passed");
-        for(const App_p &subcomptr : subcommands_)
-            if(subcomptr.get() == subcom)
-                return subcomptr;
-        throw OptionNotFound(subcom->get_name());
-    }
+CLI11_INLINE App::App(std::string app_description, std::string app_name, App *parent)
+    : name_(std::move(app_name)), description_(std::move(app_description)), parent_(parent) {
+    // Inherit if not from a nullptr
+    if(parent_ != nullptr) {
+        if(parent_->help_ptr_ != nullptr)
+            set_help_flag(parent_->help_ptr_->get_name(false, true), parent_->help_ptr_->get_description());
+        if(parent_->help_all_ptr_ != nullptr)
+            set_help_all_flag(parent_->help_all_ptr_->get_name(false, true), parent_->help_all_ptr_->get_description());
 
-    /// Check to see if a subcommand is part of this command (text version)
-    CLI::App_p get_subcommand_ptr(std::string subcom) const {
-        for(const App_p &subcomptr : subcommands_)
-            if(subcomptr->check_name(subcom))
-                return subcomptr;
-        throw OptionNotFound(subcom);
-    }
+        /// OptionDefaults
+        option_defaults_ = parent_->option_defaults_;
 
-    /// Get an owning pointer to subcommand by index
-    CLI::App_p get_subcommand_ptr(int index = 0) const {
-        if(index >= 0) {
-            auto uindex = static_cast<unsigned>(index);
-            if(uindex < subcommands_.size())
-                return subcommands_[uindex];
-        }
-        throw OptionNotFound(std::to_string(index));
+        // INHERITABLE
+        failure_message_ = parent_->failure_message_;
+        allow_extras_ = parent_->allow_extras_;
+        allow_config_extras_ = parent_->allow_config_extras_;
+        prefix_command_ = parent_->prefix_command_;
+        immediate_callback_ = parent_->immediate_callback_;
+        ignore_case_ = parent_->ignore_case_;
+        ignore_underscore_ = parent_->ignore_underscore_;
+        fallthrough_ = parent_->fallthrough_;
+        validate_positionals_ = parent_->validate_positionals_;
+        validate_optional_arguments_ = parent_->validate_optional_arguments_;
+        configurable_ = parent_->configurable_;
+        allow_windows_style_options_ = parent_->allow_windows_style_options_;
+        group_ = parent_->group_;
+        usage_ = parent_->usage_;
+        footer_ = parent_->footer_;
+        formatter_ = parent_->formatter_;
+        config_formatter_ = parent_->config_formatter_;
+        require_subcommand_max_ = parent_->require_subcommand_max_;
     }
+}
 
-    /// Check to see if an option group is part of this App
-    App *get_option_group(std::string group_name) const {
-        for(const App_p &app : subcommands_) {
-            if(app->name_.empty() && app->group_ == group_name) {
-                return app.get();
-            }
-        }
-        throw OptionNotFound(group_name);
-    }
+CLI11_NODISCARD CLI11_INLINE char **App::ensure_utf8(char **argv) {
+#ifdef _WIN32
+    (void)argv;
 
-    /// No argument version of count counts the number of times this subcommand was
-    /// passed in. The main app will return 1. Unnamed subcommands will also return 1 unless
-    /// otherwise modified in a callback
-    std::size_t count() const { return parsed_; }
+    normalized_argv_ = detail::compute_win32_argv();
 
-    /// Get a count of all the arguments processed in options and subcommands, this excludes arguments which were
-    /// treated as extras.
-    std::size_t count_all() const {
-        std::size_t cnt{0};
-        for(auto &opt : options_) {
-            cnt += opt->count();
-        }
-        for(auto &sub : subcommands_) {
-            cnt += sub->count_all();
-        }
-        if(!get_name().empty()) {  // for named subcommands add the number of times the subcommand was called
-            cnt += parsed_;
-        }
-        return cnt;
+    if(!normalized_argv_view_.empty()) {
+        normalized_argv_view_.clear();
     }
 
-    /// Changes the group membership
-    App *group(std::string group_name) {
-        group_ = group_name;
-        return this;
+    normalized_argv_view_.reserve(normalized_argv_.size());
+    for(auto &arg : normalized_argv_) {
+        // using const_cast is well-defined, string is known to not be const.
+        normalized_argv_view_.push_back(const_cast<char *>(arg.data()));
     }
 
-    /// The argumentless form of require subcommand requires 1 or more subcommands
-    App *require_subcommand() {
-        require_subcommand_min_ = 1;
-        require_subcommand_max_ = 0;
-        return this;
-    }
+    return normalized_argv_view_.data();
+#else
+    return argv;
+#endif
+}
 
-    /// Require a subcommand to be given (does not affect help call)
-    /// The number required can be given. Negative values indicate maximum
-    /// number allowed (0 for any number). Max number inheritable.
-    App *require_subcommand(int value) {
-        if(value < 0) {
-            require_subcommand_min_ = 0;
-            require_subcommand_max_ = static_cast<std::size_t>(-value);
-        } else {
-            require_subcommand_min_ = static_cast<std::size_t>(value);
-            require_subcommand_max_ = static_cast<std::size_t>(value);
+CLI11_INLINE App *App::name(std::string app_name) {
+
+    if(parent_ != nullptr) {
+        std::string oname = name_;
+        name_ = app_name;
+        const auto &res = _compare_subcommand_names(*this, *_get_fallthrough_parent());
+        if(!res.empty()) {
+            name_ = oname;
+            throw(OptionAlreadyAdded(app_name + " conflicts with existing subcommand names"));
         }
-        return this;
+    } else {
+        name_ = app_name;
     }
+    has_automatic_name_ = false;
+    return this;
+}
 
-    /// Explicitly control the number of subcommands required. Setting 0
-    /// for the max means unlimited number allowed. Max number inheritable.
-    App *require_subcommand(std::size_t min, std::size_t max) {
-        require_subcommand_min_ = min;
-        require_subcommand_max_ = max;
-        return this;
+CLI11_INLINE App *App::alias(std::string app_name) {
+    if(app_name.empty() || !detail::valid_alias_name_string(app_name)) {
+        throw IncorrectConstruction("Aliases may not be empty or contain newlines or null characters");
     }
-
-    /// The argumentless form of require option requires 1 or more options be used
-    App *require_option() {
-        require_option_min_ = 1;
-        require_option_max_ = 0;
-        return this;
+    if(parent_ != nullptr) {
+        aliases_.push_back(app_name);
+        const auto &res = _compare_subcommand_names(*this, *_get_fallthrough_parent());
+        if(!res.empty()) {
+            aliases_.pop_back();
+            throw(OptionAlreadyAdded("alias already matches an existing subcommand: " + app_name));
+        }
+    } else {
+        aliases_.push_back(app_name);
     }
 
-    /// Require an option to be given (does not affect help call)
-    /// The number required can be given. Negative values indicate maximum
-    /// number allowed (0 for any number).
-    App *require_option(int value) {
-        if(value < 0) {
-            require_option_min_ = 0;
-            require_option_max_ = static_cast<std::size_t>(-value);
-        } else {
-            require_option_min_ = static_cast<std::size_t>(value);
-            require_option_max_ = static_cast<std::size_t>(value);
+    return this;
+}
+
+CLI11_INLINE App *App::immediate_callback(bool immediate) {
+    immediate_callback_ = immediate;
+    if(immediate_callback_) {
+        if(final_callback_ && !(parse_complete_callback_)) {
+            std::swap(final_callback_, parse_complete_callback_);
         }
-        return this;
+    } else if(!(final_callback_) && parse_complete_callback_) {
+        std::swap(final_callback_, parse_complete_callback_);
     }
+    return this;
+}
 
-    /// Explicitly control the number of options required. Setting 0
-    /// for the max means unlimited number allowed. Max number inheritable.
-    App *require_option(std::size_t min, std::size_t max) {
-        require_option_min_ = min;
-        require_option_max_ = max;
-        return this;
+CLI11_INLINE App *App::ignore_case(bool value) {
+    if(value && !ignore_case_) {
+        ignore_case_ = true;
+        auto *p = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
+        const auto &match = _compare_subcommand_names(*this, *p);
+        if(!match.empty()) {
+            ignore_case_ = false;  // we are throwing so need to be exception invariant
+            throw OptionAlreadyAdded("ignore case would cause subcommand name conflicts: " + match);
+        }
     }
+    ignore_case_ = value;
+    return this;
+}
 
-    /// Stop subcommand fallthrough, so that parent commands cannot collect commands after subcommand.
-    /// Default from parent, usually set on parent.
-    App *fallthrough(bool value = true) {
-        fallthrough_ = value;
-        return this;
+CLI11_INLINE App *App::ignore_underscore(bool value) {
+    if(value && !ignore_underscore_) {
+        ignore_underscore_ = true;
+        auto *p = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
+        const auto &match = _compare_subcommand_names(*this, *p);
+        if(!match.empty()) {
+            ignore_underscore_ = false;
+            throw OptionAlreadyAdded("ignore underscore would cause subcommand name conflicts: " + match);
+        }
     }
+    ignore_underscore_ = value;
+    return this;
+}
 
-    /// Check to see if this subcommand was parsed, true only if received on command line.
-    /// This allows the subcommand to be directly checked.
-    explicit operator bool() const { return parsed_ > 0; }
+CLI11_INLINE Option *App::add_option(std::string option_name,
+                                     callback_t option_callback,
+                                     std::string option_description,
+                                     bool defaulted,
+                                     std::function<std::string()> func) {
+    Option myopt{option_name, option_description, option_callback, this};
 
-    ///@}
-    /// @name Extras for subclassing
-    ///@{
+    if(std::find_if(std::begin(options_), std::end(options_), [&myopt](const Option_p &v) { return *v == myopt; }) ==
+       std::end(options_)) {
+        if(myopt.lnames_.empty() && myopt.snames_.empty()) {
+            // if the option is positional only there is additional potential for ambiguities in config files and needs
+            // to be checked
+            std::string test_name = "--" + myopt.get_single_name();
+            if(test_name.size() == 3) {
+                test_name.erase(0, 1);
+            }
 
-    /// This allows subclasses to inject code before callbacks but after parse.
-    ///
-    /// This does not run if any errors or help is thrown.
-    virtual void pre_callback() {}
+            auto *op = get_option_no_throw(test_name);
+            if(op != nullptr) {
+                throw(OptionAlreadyAdded("added option positional name matches existing option: " + test_name));
+            }
+        } else if(parent_ != nullptr) {
+            for(auto &ln : myopt.lnames_) {
+                auto *op = parent_->get_option_no_throw(ln);
+                if(op != nullptr) {
+                    throw(OptionAlreadyAdded("added option matches existing positional option: " + ln));
+                }
+            }
+            for(auto &sn : myopt.snames_) {
+                auto *op = parent_->get_option_no_throw(sn);
+                if(op != nullptr) {
+                    throw(OptionAlreadyAdded("added option matches existing positional option: " + sn));
+                }
+            }
+        }
+        options_.emplace_back();
+        Option_p &option = options_.back();
+        option.reset(new Option(option_name, option_description, option_callback, this));
 
-    ///@}
-    /// @name Parsing
-    ///@{
-    //
-    /// Reset the parsed data
-    void clear() {
+        // Set the default string capture function
+        option->default_function(func);
 
-        parsed_ = 0;
-        pre_parse_called_ = false;
+        // For compatibility with CLI11 1.7 and before, capture the default string here
+        if(defaulted)
+            option->capture_default_str();
 
-        missing_.clear();
-        parsed_subcommands_.clear();
-        for(const Option_p &opt : options_) {
-            opt->clear();
-        }
-        for(const App_p &subc : subcommands_) {
-            subc->clear();
-        }
-    }
+        // Transfer defaults to the new option
+        option_defaults_.copy_to(option.get());
 
-    /// Parses the command line - throws errors.
-    /// This must be called after the options are in but before the rest of the program.
-    void parse(int argc, const char *const *argv) {
-        // If the name is not set, read from command line
-        if(name_.empty() || has_automatic_name_) {
-            has_automatic_name_ = true;
-            name_ = argv[0];
-        }
+        // Don't bother to capture if we already did
+        if(!defaulted && option->get_always_capture_default())
+            option->capture_default_str();
 
-        std::vector<std::string> args;
-        args.reserve(static_cast<std::size_t>(argc) - 1);
-        for(int i = argc - 1; i > 0; i--)
-            args.emplace_back(argv[i]);
-        parse(std::move(args));
+        return option.get();
     }
-
-    /// Parse a single string as if it contained command line arguments.
-    /// This function splits the string into arguments then calls parse(std::vector<std::string> &)
-    /// the function takes an optional boolean argument specifying if the programName is included in the string to
-    /// process
-    void parse(std::string commandline, bool program_name_included = false) {
-
-        if(program_name_included) {
-            auto nstr = detail::split_program_name(commandline);
-            if((name_.empty()) || (has_automatic_name_)) {
-                has_automatic_name_ = true;
-                name_ = nstr.first;
-            }
-            commandline = std::move(nstr.second);
-        } else {
-            detail::trim(commandline);
+    // we know something matches now find what it is so we can produce more error information
+    for(auto &opt : options_) {
+        const auto &matchname = opt->matching_name(myopt);
+        if(!matchname.empty()) {
+            throw(OptionAlreadyAdded("added option matched existing option name: " + matchname));
         }
-        // the next section of code is to deal with quoted arguments after an '=' or ':' for windows like operations
-        if(!commandline.empty()) {
-            commandline = detail::find_and_modify(commandline, "=", detail::escape_detect);
-            if(allow_windows_style_options_)
-                commandline = detail::find_and_modify(commandline, ":", detail::escape_detect);
-        }
-
-        auto args = detail::split_up(std::move(commandline));
-        // remove all empty strings
-        args.erase(std::remove(args.begin(), args.end(), std::string{}), args.end());
-        std::reverse(args.begin(), args.end());
-
-        parse(std::move(args));
     }
+    // this line should not be reached the above loop should trigger the throw
+    throw(OptionAlreadyAdded("added option matched existing option name"));  // LCOV_EXCL_LINE
+}
 
-    /// The real work is done here. Expects a reversed vector.
-    /// Changes the vector to the remaining options.
-    void parse(std::vector<std::string> &args) {
-        // Clear if parsed
-        if(parsed_ > 0)
-            clear();
-
-        // parsed_ is incremented in commands/subcommands,
-        // but placed here to make sure this is cleared when
-        // running parse after an error is thrown, even by _validate or _configure.
-        parsed_ = 1;
-        _validate();
-        _configure();
-        // set the parent as nullptr as this object should be the top now
-        parent_ = nullptr;
-        parsed_ = 0;
+CLI11_INLINE Option *App::set_help_flag(std::string flag_name, const std::string &help_description) {
+    // take flag_description by const reference otherwise add_flag tries to assign to help_description
+    if(help_ptr_ != nullptr) {
+        remove_option(help_ptr_);
+        help_ptr_ = nullptr;
+    }
 
-        _parse(args);
-        run_callback();
+    // Empty name will simply remove the help flag
+    if(!flag_name.empty()) {
+        help_ptr_ = add_flag(flag_name, help_description);
+        help_ptr_->configurable(false);
     }
 
-    /// The real work is done here. Expects a reversed vector.
-    void parse(std::vector<std::string> &&args) {
-        // Clear if parsed
-        if(parsed_ > 0)
-            clear();
+    return help_ptr_;
+}
 
-        // parsed_ is incremented in commands/subcommands,
-        // but placed here to make sure this is cleared when
-        // running parse after an error is thrown, even by _validate or _configure.
-        parsed_ = 1;
-        _validate();
-        _configure();
-        // set the parent as nullptr as this object should be the top now
-        parent_ = nullptr;
-        parsed_ = 0;
+CLI11_INLINE Option *App::set_help_all_flag(std::string help_name, const std::string &help_description) {
+    // take flag_description by const reference otherwise add_flag tries to assign to flag_description
+    if(help_all_ptr_ != nullptr) {
+        remove_option(help_all_ptr_);
+        help_all_ptr_ = nullptr;
+    }
 
-        _parse(std::move(args));
-        run_callback();
+    // Empty name will simply remove the help all flag
+    if(!help_name.empty()) {
+        help_all_ptr_ = add_flag(help_name, help_description);
+        help_all_ptr_->configurable(false);
     }
 
-    /// Provide a function to print a help message. The function gets access to the App pointer and error.
-    void failure_message(std::function<std::string(const App *, const Error &e)> function) {
-        failure_message_ = function;
+    return help_all_ptr_;
+}
+
+CLI11_INLINE Option *
+App::set_version_flag(std::string flag_name, const std::string &versionString, const std::string &version_help) {
+    // take flag_description by const reference otherwise add_flag tries to assign to version_description
+    if(version_ptr_ != nullptr) {
+        remove_option(version_ptr_);
+        version_ptr_ = nullptr;
     }
 
-    /// Print a nice error message and return the exit code
-    int exit(const Error &e, std::ostream &out = std::cout, std::ostream &err = std::cerr) const {
+    // Empty name will simply remove the version flag
+    if(!flag_name.empty()) {
+        version_ptr_ = add_flag_callback(
+            flag_name, [versionString]() { throw(CLI::CallForVersion(versionString, 0)); }, version_help);
+        version_ptr_->configurable(false);
+    }
 
-        /// Avoid printing anything if this is a CLI::RuntimeError
-        if(e.get_name() == "RuntimeError")
-            return e.get_exit_code();
+    return version_ptr_;
+}
 
-        if(e.get_name() == "CallForHelp") {
-            out << help();
-            return e.get_exit_code();
-        }
+CLI11_INLINE Option *
+App::set_version_flag(std::string flag_name, std::function<std::string()> vfunc, const std::string &version_help) {
+    if(version_ptr_ != nullptr) {
+        remove_option(version_ptr_);
+        version_ptr_ = nullptr;
+    }
 
-        if(e.get_name() == "CallForAllHelp") {
-            out << help("", AppFormatMode::All);
-            return e.get_exit_code();
-        }
+    // Empty name will simply remove the version flag
+    if(!flag_name.empty()) {
+        version_ptr_ =
+            add_flag_callback(flag_name, [vfunc]() { throw(CLI::CallForVersion(vfunc(), 0)); }, version_help);
+        version_ptr_->configurable(false);
+    }
 
-        if(e.get_exit_code() != static_cast<int>(ExitCodes::Success)) {
-            if(failure_message_)
-                err << failure_message_(this, e) << std::flush;
-        }
+    return version_ptr_;
+}
 
-        return e.get_exit_code();
+CLI11_INLINE Option *App::_add_flag_internal(std::string flag_name, CLI::callback_t fun, std::string flag_description) {
+    Option *opt = nullptr;
+    if(detail::has_default_flag_values(flag_name)) {
+        // check for default values and if it has them
+        auto flag_defaults = detail::get_default_flag_values(flag_name);
+        detail::remove_default_flag_values(flag_name);
+        opt = add_option(std::move(flag_name), std::move(fun), std::move(flag_description), false);
+        for(const auto &fname : flag_defaults)
+            opt->fnames_.push_back(fname.first);
+        opt->default_flag_values_ = std::move(flag_defaults);
+    } else {
+        opt = add_option(std::move(flag_name), std::move(fun), std::move(flag_description), false);
+    }
+    // flags cannot have positional values
+    if(opt->get_positional()) {
+        auto pos_name = opt->get_name(true);
+        remove_option(opt);
+        throw IncorrectConstruction::PositionalFlag(pos_name);
     }
+    opt->multi_option_policy(MultiOptionPolicy::TakeLast);
+    opt->expected(0);
+    opt->required(false);
+    return opt;
+}
 
-    ///@}
-    /// @name Post parsing
-    ///@{
+CLI11_INLINE Option *App::add_flag_callback(std::string flag_name,
+                                            std::function<void(void)> function,  ///< A function to call, void(void)
+                                            std::string flag_description) {
 
-    /// Counts the number of times the given option was passed.
-    std::size_t count(std::string option_name) const { return get_option(option_name)->count(); }
+    CLI::callback_t fun = [function](const CLI::results_t &res) {
+        using CLI::detail::lexical_cast;
+        bool trigger{false};
+        auto result = lexical_cast(res[0], trigger);
+        if(result && trigger) {
+            function();
+        }
+        return result;
+    };
+    return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description));
+}
 
-    /// Get a subcommand pointer list to the currently selected subcommands (after parsing by default, in command
-    /// line order; use parsed = false to get the original definition list.)
-    std::vector<App *> get_subcommands() const { return parsed_subcommands_; }
+CLI11_INLINE Option *
+App::add_flag_function(std::string flag_name,
+                       std::function<void(std::int64_t)> function,  ///< A function to call, void(int)
+                       std::string flag_description) {
 
-    /// Get a filtered subcommand pointer list from the original definition list. An empty function will provide all
-    /// subcommands (const)
-    std::vector<const App *> get_subcommands(const std::function<bool(const App *)> &filter) const {
-        std::vector<const App *> subcomms(subcommands_.size());
-        std::transform(std::begin(subcommands_), std::end(subcommands_), std::begin(subcomms), [](const App_p &v) {
-          return v.get();
-        });
+    CLI::callback_t fun = [function](const CLI::results_t &res) {
+        using CLI::detail::lexical_cast;
+        std::int64_t flag_count{0};
+        lexical_cast(res[0], flag_count);
+        function(flag_count);
+        return true;
+    };
+    return _add_flag_internal(flag_name, std::move(fun), std::move(flag_description))
+        ->multi_option_policy(MultiOptionPolicy::Sum);
+}
 
-        if(filter) {
-            subcomms.erase(std::remove_if(std::begin(subcomms),
-                                          std::end(subcomms),
-                                          [&filter](const App *app) { return !filter(app); }),
-                           std::end(subcomms));
-        }
+CLI11_INLINE Option *App::set_config(std::string option_name,
+                                     std::string default_filename,
+                                     const std::string &help_message,
+                                     bool config_required) {
 
-        return subcomms;
+    // Remove existing config if present
+    if(config_ptr_ != nullptr) {
+        remove_option(config_ptr_);
+        config_ptr_ = nullptr;  // need to remove the config_ptr completely
     }
 
-    /// Get a filtered subcommand pointer list from the original definition list. An empty function will provide all
-    /// subcommands
-    std::vector<App *> get_subcommands(const std::function<bool(App *)> &filter) {
-        std::vector<App *> subcomms(subcommands_.size());
-        std::transform(std::begin(subcommands_), std::end(subcommands_), std::begin(subcomms), [](const App_p &v) {
-          return v.get();
-        });
-
-        if(filter) {
-            subcomms.erase(
-                std::remove_if(std::begin(subcomms), std::end(subcomms), [&filter](App *app) { return !filter(app); }),
-                std::end(subcomms));
+    // Only add config if option passed
+    if(!option_name.empty()) {
+        config_ptr_ = add_option(option_name, help_message);
+        if(config_required) {
+            config_ptr_->required();
         }
-
-        return subcomms;
+        if(!default_filename.empty()) {
+            config_ptr_->default_str(std::move(default_filename));
+            config_ptr_->force_callback_ = true;
+        }
+        config_ptr_->configurable(false);
+        // set the option to take the last value and reverse given by default
+        config_ptr_->multi_option_policy(MultiOptionPolicy::Reverse);
     }
 
-    /// Check to see if given subcommand was selected
-    bool got_subcommand(const App *subcom) const {
-        // get subcom needed to verify that this was a real subcommand
-        return get_subcommand(subcom)->parsed_ > 0;
+    return config_ptr_;
+}
+
+CLI11_INLINE bool App::remove_option(Option *opt) {
+    // Make sure no links exist
+    for(Option_p &op : options_) {
+        op->remove_needs(opt);
+        op->remove_excludes(opt);
     }
 
-    /// Check with name instead of pointer to see if subcommand was selected
-    bool got_subcommand(std::string subcommand_name) const { return get_subcommand(subcommand_name)->parsed_ > 0; }
+    if(help_ptr_ == opt)
+        help_ptr_ = nullptr;
+    if(help_all_ptr_ == opt)
+        help_all_ptr_ = nullptr;
 
-    /// Sets excluded options for the subcommand
-    App *excludes(Option *opt) {
-        if(opt == nullptr) {
-            throw OptionNotFound("nullptr passed");
-        }
-        exclude_options_.insert(opt);
-        return this;
+    auto iterator =
+        std::find_if(std::begin(options_), std::end(options_), [opt](const Option_p &v) { return v.get() == opt; });
+    if(iterator != std::end(options_)) {
+        options_.erase(iterator);
+        return true;
     }
+    return false;
+}
 
-    /// Sets excluded subcommands for the subcommand
-    App *excludes(App *app) {
-        if(app == nullptr) {
-            throw OptionNotFound("nullptr passed");
+CLI11_INLINE App *App::add_subcommand(std::string subcommand_name, std::string subcommand_description) {
+    if(!subcommand_name.empty() && !detail::valid_name_string(subcommand_name)) {
+        if(!detail::valid_first_char(subcommand_name[0])) {
+            throw IncorrectConstruction(
+                "Subcommand name starts with invalid character, '!' and '-' and control characters");
         }
-        if(app == this) {
-            throw OptionNotFound("cannot self reference in needs");
-        }
-        auto res = exclude_subcommands_.insert(app);
-        // subcommand exclusion should be symmetric
-        if(res.second) {
-            app->exclude_subcommands_.insert(this);
+        for(auto c : subcommand_name) {
+            if(!detail::valid_later_char(c)) {
+                throw IncorrectConstruction(std::string("Subcommand name contains invalid character ('") + c +
+                                            "'), all characters are allowed except"
+                                            "'=',':','{','}', ' ', and control characters");
+            }
         }
-        return this;
     }
+    CLI::App_p subcom = std::shared_ptr<App>(new App(std::move(subcommand_description), subcommand_name, this));
+    return add_subcommand(std::move(subcom));
+}
 
-    App *needs(Option *opt) {
-        if(opt == nullptr) {
-            throw OptionNotFound("nullptr passed");
-        }
-        need_options_.insert(opt);
-        return this;
+CLI11_INLINE App *App::add_subcommand(CLI::App_p subcom) {
+    if(!subcom)
+        throw IncorrectConstruction("passed App is not valid");
+    auto *ckapp = (name_.empty() && parent_ != nullptr) ? _get_fallthrough_parent() : this;
+    const auto &mstrg = _compare_subcommand_names(*subcom, *ckapp);
+    if(!mstrg.empty()) {
+        throw(OptionAlreadyAdded("subcommand name or alias matches existing subcommand: " + mstrg));
     }
+    subcom->parent_ = this;
+    subcommands_.push_back(std::move(subcom));
+    return subcommands_.back().get();
+}
 
-    App *needs(App *app) {
-        if(app == nullptr) {
-            throw OptionNotFound("nullptr passed");
-        }
-        if(app == this) {
-            throw OptionNotFound("cannot self reference in needs");
-        }
-        need_subcommands_.insert(app);
-        return this;
+CLI11_INLINE bool App::remove_subcommand(App *subcom) {
+    // Make sure no links exist
+    for(App_p &sub : subcommands_) {
+        sub->remove_excludes(subcom);
+        sub->remove_needs(subcom);
     }
 
-    /// Removes an option from the excludes list of this subcommand
-    bool remove_excludes(Option *opt) {
-        auto iterator = std::find(std::begin(exclude_options_), std::end(exclude_options_), opt);
-        if(iterator == std::end(exclude_options_)) {
-            return false;
-        }
-        exclude_options_.erase(iterator);
+    auto iterator = std::find_if(
+        std::begin(subcommands_), std::end(subcommands_), [subcom](const App_p &v) { return v.get() == subcom; });
+    if(iterator != std::end(subcommands_)) {
+        subcommands_.erase(iterator);
         return true;
     }
+    return false;
+}
 
-    /// Removes a subcommand from the excludes list of this subcommand
-    bool remove_excludes(App *app) {
-        auto iterator = std::find(std::begin(exclude_subcommands_), std::end(exclude_subcommands_), app);
-        if(iterator == std::end(exclude_subcommands_)) {
-            return false;
-        }
-        auto other_app = *iterator;
-        exclude_subcommands_.erase(iterator);
-        other_app->remove_excludes(this);
-        return true;
+CLI11_INLINE App *App::get_subcommand(const App *subcom) const {
+    if(subcom == nullptr)
+        throw OptionNotFound("nullptr passed");
+    for(const App_p &subcomptr : subcommands_)
+        if(subcomptr.get() == subcom)
+            return subcomptr.get();
+    throw OptionNotFound(subcom->get_name());
+}
+
+CLI11_NODISCARD CLI11_INLINE App *App::get_subcommand(std::string subcom) const {
+    auto *subc = _find_subcommand(subcom, false, false);
+    if(subc == nullptr)
+        throw OptionNotFound(subcom);
+    return subc;
+}
+
+CLI11_NODISCARD CLI11_INLINE App *App::get_subcommand_no_throw(std::string subcom) const noexcept {
+    return _find_subcommand(subcom, false, false);
+}
+
+CLI11_NODISCARD CLI11_INLINE App *App::get_subcommand(int index) const {
+    if(index >= 0) {
+        auto uindex = static_cast<unsigned>(index);
+        if(uindex < subcommands_.size())
+            return subcommands_[uindex].get();
     }
+    throw OptionNotFound(std::to_string(index));
+}
 
-    /// Removes an option from the needs list of this subcommand
-    bool remove_needs(Option *opt) {
-        auto iterator = std::find(std::begin(need_options_), std::end(need_options_), opt);
-        if(iterator == std::end(need_options_)) {
-            return false;
-        }
-        need_options_.erase(iterator);
-        return true;
+CLI11_INLINE CLI::App_p App::get_subcommand_ptr(App *subcom) const {
+    if(subcom == nullptr)
+        throw OptionNotFound("nullptr passed");
+    for(const App_p &subcomptr : subcommands_)
+        if(subcomptr.get() == subcom)
+            return subcomptr;
+    throw OptionNotFound(subcom->get_name());
+}
+
+CLI11_NODISCARD CLI11_INLINE CLI::App_p App::get_subcommand_ptr(std::string subcom) const {
+    for(const App_p &subcomptr : subcommands_)
+        if(subcomptr->check_name(subcom))
+            return subcomptr;
+    throw OptionNotFound(subcom);
+}
+
+CLI11_NODISCARD CLI11_INLINE CLI::App_p App::get_subcommand_ptr(int index) const {
+    if(index >= 0) {
+        auto uindex = static_cast<unsigned>(index);
+        if(uindex < subcommands_.size())
+            return subcommands_[uindex];
     }
+    throw OptionNotFound(std::to_string(index));
+}
 
-    /// Removes a subcommand from the needs list of this subcommand
-    bool remove_needs(App *app) {
-        auto iterator = std::find(std::begin(need_subcommands_), std::end(need_subcommands_), app);
-        if(iterator == std::end(need_subcommands_)) {
-            return false;
+CLI11_NODISCARD CLI11_INLINE CLI::App *App::get_option_group(std::string group_name) const {
+    for(const App_p &app : subcommands_) {
+        if(app->name_.empty() && app->group_ == group_name) {
+            return app.get();
         }
-        need_subcommands_.erase(iterator);
-        return true;
     }
+    throw OptionNotFound(group_name);
+}
 
-    ///@}
-    /// @name Help
-    ///@{
-
-    /// Set footer.
-    App *footer(std::string footer_string) {
-        footer_ = std::move(footer_string);
-        return this;
+CLI11_NODISCARD CLI11_INLINE std::size_t App::count_all() const {
+    std::size_t cnt{0};
+    for(const auto &opt : options_) {
+        cnt += opt->count();
     }
-    /// Set footer.
-    App *footer(std::function<std::string()> footer_function) {
-        footer_callback_ = std::move(footer_function);
-        return this;
+    for(const auto &sub : subcommands_) {
+        cnt += sub->count_all();
     }
-    /// Produce a string that could be read in as a config of the current values of the App. Set default_also to
-    /// include default arguments. Prefix will add a string to the beginning of each option.
-    std::string config_to_str(bool default_also = false, bool write_description = false) const {
-        return config_formatter_->to_config(this, default_also, write_description, "");
+    if(!get_name().empty()) {  // for named subcommands add the number of times the subcommand was called
+        cnt += parsed_;
     }
+    return cnt;
+}
 
-    /// Makes a help message, using the currently configured formatter
-    /// Will only do one subcommand at a time
-    std::string help(std::string prev = "", AppFormatMode mode = AppFormatMode::Normal) const {
-        if(prev.empty())
-            prev = get_name();
-        else
-            prev += " " + get_name();
+CLI11_INLINE void App::clear() {
 
-        // Delegate to subcommand if needed
-        auto selected_subcommands = get_subcommands();
-        if(!selected_subcommands.empty()) {
-            return selected_subcommands.at(0)->help(prev, mode);
-        }
-        return formatter_->make_help(this, prev, mode);
+    parsed_ = 0;
+    pre_parse_called_ = false;
+
+    missing_.clear();
+    parsed_subcommands_.clear();
+    for(const Option_p &opt : options_) {
+        opt->clear();
     }
+    for(const App_p &subc : subcommands_) {
+        subc->clear();
+    }
+}
 
-    ///@}
-    /// @name Getters
-    ///@{
+CLI11_INLINE void App::parse(int argc, const char *const *argv) { parse_char_t(argc, argv); }
+CLI11_INLINE void App::parse(int argc, const wchar_t *const *argv) { parse_char_t(argc, argv); }
 
-    /// Access the formatter
-    std::shared_ptr<FormatterBase> get_formatter() const { return formatter_; }
+namespace detail {
 
-    /// Access the config formatter
-    std::shared_ptr<Config> get_config_formatter() const { return config_formatter_; }
+// Do nothing or perform narrowing
+CLI11_INLINE const char *maybe_narrow(const char *str) { return str; }
+CLI11_INLINE std::string maybe_narrow(const wchar_t *str) { return narrow(str); }
 
-    /// Access the config formatter as a configBase pointer
-    std::shared_ptr<ConfigBase> get_config_formatter_base() const {
-        // This is safer as a dynamic_cast if we have RTTI, as Config -> ConfigBase
-#if defined(__cpp_rtti) || (defined(__GXX_RTTI) && __GXX_RTTI) || (defined(_HAS_STATIC_RTTI) && (_HAS_STATIC_RTTI == 0))
-        return std::dynamic_pointer_cast<ConfigBase>(config_formatter_);
-#else
-        return std::static_pointer_cast<ConfigBase>(config_formatter_);
-#endif
+}  // namespace detail
+
+template <class CharT> CLI11_INLINE void App::parse_char_t(int argc, const CharT *const *argv) {
+    // If the name is not set, read from command line
+    if(name_.empty() || has_automatic_name_) {
+        has_automatic_name_ = true;
+        name_ = detail::maybe_narrow(argv[0]);
     }
 
-    /// Get the app or subcommand description
-    std::string get_description() const { return description_; }
+    std::vector<std::string> args;
+    args.reserve(static_cast<std::size_t>(argc) - 1U);
+    for(auto i = static_cast<std::size_t>(argc) - 1U; i > 0U; --i)
+        args.emplace_back(detail::maybe_narrow(argv[i]));
 
-    /// Set the description of the app
-    App *description(std::string app_description) {
-        description_ = std::move(app_description);
-        return this;
-    }
+    parse(std::move(args));
+}
 
-    /// Get the list of options (user facing function, so returns raw pointers), has optional filter function
-    std::vector<const Option *> get_options(const std::function<bool(const Option *)> filter = {}) const {
-        std::vector<const Option *> options(options_.size());
-        std::transform(std::begin(options_), std::end(options_), std::begin(options), [](const Option_p &val) {
-          return val.get();
-        });
+CLI11_INLINE void App::parse(std::string commandline, bool program_name_included) {
 
-        if(filter) {
-            options.erase(std::remove_if(std::begin(options),
-                                         std::end(options),
-                                         [&filter](const Option *opt) { return !filter(opt); }),
-                          std::end(options));
+    if(program_name_included) {
+        auto nstr = detail::split_program_name(commandline);
+        if((name_.empty()) || (has_automatic_name_)) {
+            has_automatic_name_ = true;
+            name_ = nstr.first;
         }
-
-        return options;
+        commandline = std::move(nstr.second);
+    } else {
+        detail::trim(commandline);
+    }
+    // the next section of code is to deal with quoted arguments after an '=' or ':' for windows like operations
+    if(!commandline.empty()) {
+        commandline = detail::find_and_modify(commandline, "=", detail::escape_detect);
+        if(allow_windows_style_options_)
+            commandline = detail::find_and_modify(commandline, ":", detail::escape_detect);
     }
 
-    /// Non-const version of the above
-    std::vector<Option *> get_options(const std::function<bool(Option *)> filter = {}) {
-        std::vector<Option *> options(options_.size());
-        std::transform(std::begin(options_), std::end(options_), std::begin(options), [](const Option_p &val) {
-          return val.get();
-        });
+    auto args = detail::split_up(std::move(commandline));
+    // remove all empty strings
+    args.erase(std::remove(args.begin(), args.end(), std::string{}), args.end());
+    try {
+        detail::remove_quotes(args);
+    } catch(const std::invalid_argument &arg) {
+        throw CLI::ParseError(arg.what(), CLI::ExitCodes::InvalidError);
+    }
+    std::reverse(args.begin(), args.end());
+    parse(std::move(args));
+}
 
-        if(filter) {
-            options.erase(
-                std::remove_if(std::begin(options), std::end(options), [&filter](Option *opt) { return !filter(opt); }),
-                std::end(options));
-        }
+CLI11_INLINE void App::parse(std::wstring commandline, bool program_name_included) {
+    parse(narrow(commandline), program_name_included);
+}
 
-        return options;
-    }
+CLI11_INLINE void App::parse(std::vector<std::string> &args) {
+    // Clear if parsed
+    if(parsed_ > 0)
+        clear();
 
-    /// Get an option by name (noexcept non-const version)
-    Option *get_option_no_throw(std::string option_name) noexcept {
-        for(Option_p &opt : options_) {
-            if(opt->check_name(option_name)) {
-                return opt.get();
-            }
-        }
-        for(auto &subc : subcommands_) {
-            // also check down into nameless subcommands
-            if(subc->get_name().empty()) {
-                auto opt = subc->get_option_no_throw(option_name);
-                if(opt != nullptr) {
-                    return opt;
-                }
-            }
-        }
-        return nullptr;
-    }
+    // parsed_ is incremented in commands/subcommands,
+    // but placed here to make sure this is cleared when
+    // running parse after an error is thrown, even by _validate or _configure.
+    parsed_ = 1;
+    _validate();
+    _configure();
+    // set the parent as nullptr as this object should be the top now
+    parent_ = nullptr;
+    parsed_ = 0;
 
-    /// Get an option by name (noexcept const version)
-    const Option *get_option_no_throw(std::string option_name) const noexcept {
-        for(const Option_p &opt : options_) {
-            if(opt->check_name(option_name)) {
-                return opt.get();
-            }
-        }
-        for(const auto &subc : subcommands_) {
-            // also check down into nameless subcommands
-            if(subc->get_name().empty()) {
-                auto opt = subc->get_option_no_throw(option_name);
-                if(opt != nullptr) {
-                    return opt;
-                }
-            }
-        }
-        return nullptr;
-    }
+    _parse(args);
+    run_callback();
+}
 
-    /// Get an option by name
-    const Option *get_option(std::string option_name) const {
-        auto opt = get_option_no_throw(option_name);
-        if(opt == nullptr) {
-            throw OptionNotFound(option_name);
-        }
-        return opt;
-    }
+CLI11_INLINE void App::parse(std::vector<std::string> &&args) {
+    // Clear if parsed
+    if(parsed_ > 0)
+        clear();
 
-    /// Get an option by name (non-const version)
-    Option *get_option(std::string option_name) {
-        auto opt = get_option_no_throw(option_name);
-        if(opt == nullptr) {
-            throw OptionNotFound(option_name);
-        }
-        return opt;
-    }
+    // parsed_ is incremented in commands/subcommands,
+    // but placed here to make sure this is cleared when
+    // running parse after an error is thrown, even by _validate or _configure.
+    parsed_ = 1;
+    _validate();
+    _configure();
+    // set the parent as nullptr as this object should be the top now
+    parent_ = nullptr;
+    parsed_ = 0;
 
-    /// Shortcut bracket operator for getting a pointer to an option
-    const Option *operator[](const std::string &option_name) const { return get_option(option_name); }
+    _parse(std::move(args));
+    run_callback();
+}
 
-    /// Shortcut bracket operator for getting a pointer to an option
-    const Option *operator[](const char *option_name) const { return get_option(option_name); }
+CLI11_INLINE void App::parse_from_stream(std::istream &input) {
+    if(parsed_ == 0) {
+        _validate();
+        _configure();
+        // set the parent as nullptr as this object should be the top now
+    }
 
-    /// Check the status of ignore_case
-    bool get_ignore_case() const { return ignore_case_; }
+    _parse_stream(input);
+    run_callback();
+}
 
-    /// Check the status of ignore_underscore
-    bool get_ignore_underscore() const { return ignore_underscore_; }
+CLI11_INLINE int App::exit(const Error &e, std::ostream &out, std::ostream &err) const {
 
-    /// Check the status of fallthrough
-    bool get_fallthrough() const { return fallthrough_; }
+    /// Avoid printing anything if this is a CLI::RuntimeError
+    if(e.get_name() == "RuntimeError")
+        return e.get_exit_code();
 
-    /// Check the status of the allow windows style options
-    bool get_allow_windows_style_options() const { return allow_windows_style_options_; }
+    if(e.get_name() == "CallForHelp") {
+        out << help();
+        return e.get_exit_code();
+    }
 
-    /// Check the status of the allow windows style options
-    bool get_positionals_at_end() const { return positionals_at_end_; }
+    if(e.get_name() == "CallForAllHelp") {
+        out << help("", AppFormatMode::All);
+        return e.get_exit_code();
+    }
 
-    /// Check the status of the allow windows style options
-    bool get_configurable() const { return configurable_; }
+    if(e.get_name() == "CallForVersion") {
+        out << e.what() << '\n';
+        return e.get_exit_code();
+    }
 
-    /// Get the group of this subcommand
-    const std::string &get_group() const { return group_; }
+    if(e.get_exit_code() != static_cast<int>(ExitCodes::Success)) {
+        if(failure_message_)
+            err << failure_message_(this, e) << std::flush;
+    }
 
-    /// Generate and return the footer.
-    std::string get_footer() const { return (footer_callback_) ? footer_callback_() + '\n' + footer_ : footer_; }
+    return e.get_exit_code();
+}
 
-    /// Get the required min subcommand value
-    std::size_t get_require_subcommand_min() const { return require_subcommand_min_; }
+CLI11_INLINE std::vector<const App *> App::get_subcommands(const std::function<bool(const App *)> &filter) const {
+    std::vector<const App *> subcomms(subcommands_.size());
+    std::transform(
+        std::begin(subcommands_), std::end(subcommands_), std::begin(subcomms), [](const App_p &v) { return v.get(); });
 
-    /// Get the required max subcommand value
-    std::size_t get_require_subcommand_max() const { return require_subcommand_max_; }
+    if(filter) {
+        subcomms.erase(std::remove_if(std::begin(subcomms),
+                                      std::end(subcomms),
+                                      [&filter](const App *app) { return !filter(app); }),
+                       std::end(subcomms));
+    }
 
-    /// Get the required min option value
-    std::size_t get_require_option_min() const { return require_option_min_; }
+    return subcomms;
+}
 
-    /// Get the required max option value
-    std::size_t get_require_option_max() const { return require_option_max_; }
+CLI11_INLINE std::vector<App *> App::get_subcommands(const std::function<bool(App *)> &filter) {
+    std::vector<App *> subcomms(subcommands_.size());
+    std::transform(
+        std::begin(subcommands_), std::end(subcommands_), std::begin(subcomms), [](const App_p &v) { return v.get(); });
 
-    /// Get the prefix command status
-    bool get_prefix_command() const { return prefix_command_; }
+    if(filter) {
+        subcomms.erase(
+            std::remove_if(std::begin(subcomms), std::end(subcomms), [&filter](App *app) { return !filter(app); }),
+            std::end(subcomms));
+    }
 
-    /// Get the status of allow extras
-    bool get_allow_extras() const { return allow_extras_; }
+    return subcomms;
+}
 
-    /// Get the status of required
-    bool get_required() const { return required_; }
+CLI11_INLINE bool App::remove_excludes(Option *opt) {
+    auto iterator = std::find(std::begin(exclude_options_), std::end(exclude_options_), opt);
+    if(iterator == std::end(exclude_options_)) {
+        return false;
+    }
+    exclude_options_.erase(iterator);
+    return true;
+}
 
-    /// Get the status of disabled
-    bool get_disabled() const { return disabled_; }
+CLI11_INLINE bool App::remove_excludes(App *app) {
+    auto iterator = std::find(std::begin(exclude_subcommands_), std::end(exclude_subcommands_), app);
+    if(iterator == std::end(exclude_subcommands_)) {
+        return false;
+    }
+    auto *other_app = *iterator;
+    exclude_subcommands_.erase(iterator);
+    other_app->remove_excludes(this);
+    return true;
+}
 
-    /// Get the status of disabled
-    bool get_immediate_callback() const { return immediate_callback_; }
+CLI11_INLINE bool App::remove_needs(Option *opt) {
+    auto iterator = std::find(std::begin(need_options_), std::end(need_options_), opt);
+    if(iterator == std::end(need_options_)) {
+        return false;
+    }
+    need_options_.erase(iterator);
+    return true;
+}
 
-    /// Get the status of disabled by default
-    bool get_disabled_by_default() const { return (default_startup == startup_mode::disabled); }
+CLI11_INLINE bool App::remove_needs(App *app) {
+    auto iterator = std::find(std::begin(need_subcommands_), std::end(need_subcommands_), app);
+    if(iterator == std::end(need_subcommands_)) {
+        return false;
+    }
+    need_subcommands_.erase(iterator);
+    return true;
+}
 
-    /// Get the status of disabled by default
-    bool get_enabled_by_default() const { return (default_startup == startup_mode::enabled); }
-    /// Get the status of validating positionals
-    bool get_validate_positionals() const { return validate_positionals_; }
+CLI11_NODISCARD CLI11_INLINE std::string App::help(std::string prev, AppFormatMode mode) const {
+    if(prev.empty())
+        prev = get_name();
+    else
+        prev += " " + get_name();
 
-    /// Get the status of allow extras
-    config_extras_mode get_allow_config_extras() const { return allow_config_extras_; }
+    // Delegate to subcommand if needed
+    auto selected_subcommands = get_subcommands();
+    if(!selected_subcommands.empty()) {
+        return selected_subcommands.back()->help(prev, mode);
+    }
+    return formatter_->make_help(this, prev, mode);
+}
 
-    /// Get a pointer to the help flag.
-    Option *get_help_ptr() { return help_ptr_; }
+CLI11_NODISCARD CLI11_INLINE std::string App::version() const {
+    std::string val;
+    if(version_ptr_ != nullptr) {
+        // copy the results for reuse later
+        results_t rv = version_ptr_->results();
+        version_ptr_->clear();
+        version_ptr_->add_result("true");
+        try {
+            version_ptr_->run_callback();
+        } catch(const CLI::CallForVersion &cfv) {
+            val = cfv.what();
+        }
+        version_ptr_->clear();
+        version_ptr_->add_result(rv);
+    }
+    return val;
+}
 
-    /// Get a pointer to the help flag. (const)
-    const Option *get_help_ptr() const { return help_ptr_; }
+CLI11_INLINE std::vector<const Option *> App::get_options(const std::function<bool(const Option *)> filter) const {
+    std::vector<const Option *> options(options_.size());
+    std::transform(
+        std::begin(options_), std::end(options_), std::begin(options), [](const Option_p &val) { return val.get(); });
 
-    /// Get a pointer to the help all flag. (const)
-    const Option *get_help_all_ptr() const { return help_all_ptr_; }
+    if(filter) {
+        options.erase(std::remove_if(std::begin(options),
+                                     std::end(options),
+                                     [&filter](const Option *opt) { return !filter(opt); }),
+                      std::end(options));
+    }
 
-    /// Get a pointer to the config option.
-    Option *get_config_ptr() { return config_ptr_; }
+    return options;
+}
 
-    /// Get a pointer to the config option. (const)
-    const Option *get_config_ptr() const { return config_ptr_; }
+CLI11_INLINE std::vector<Option *> App::get_options(const std::function<bool(Option *)> filter) {
+    std::vector<Option *> options(options_.size());
+    std::transform(
+        std::begin(options_), std::end(options_), std::begin(options), [](const Option_p &val) { return val.get(); });
 
-    /// Get the parent of this subcommand (or nullptr if master app)
-    App *get_parent() { return parent_; }
+    if(filter) {
+        options.erase(
+            std::remove_if(std::begin(options), std::end(options), [&filter](Option *opt) { return !filter(opt); }),
+            std::end(options));
+    }
 
-    /// Get the parent of this subcommand (or nullptr if master app) (const version)
-    const App *get_parent() const { return parent_; }
+    return options;
+}
 
-    /// Get the name of the current app
-    const std::string &get_name() const { return name_; }
+CLI11_NODISCARD CLI11_INLINE Option *App::get_option_no_throw(std::string option_name) noexcept {
+    for(Option_p &opt : options_) {
+        if(opt->check_name(option_name)) {
+            return opt.get();
+        }
+    }
+    for(auto &subc : subcommands_) {
+        // also check down into nameless subcommands
+        if(subc->get_name().empty()) {
+            auto *opt = subc->get_option_no_throw(option_name);
+            if(opt != nullptr) {
+                return opt;
+            }
+        }
+    }
+    return nullptr;
+}
 
-    /// Get the aliases of the current app
-    const std::vector<std::string> &get_aliases() const { return aliases_; }
+CLI11_NODISCARD CLI11_INLINE const Option *App::get_option_no_throw(std::string option_name) const noexcept {
+    for(const Option_p &opt : options_) {
+        if(opt->check_name(option_name)) {
+            return opt.get();
+        }
+    }
+    for(const auto &subc : subcommands_) {
+        // also check down into nameless subcommands
+        if(subc->get_name().empty()) {
+            auto *opt = subc->get_option_no_throw(option_name);
+            if(opt != nullptr) {
+                return opt;
+            }
+        }
+    }
+    return nullptr;
+}
 
-    /// clear all the aliases of the current App
-    App *clear_aliases() {
-        aliases_.clear();
-        return this;
+CLI11_NODISCARD CLI11_INLINE std::string App::get_display_name(bool with_aliases) const {
+    if(name_.empty()) {
+        return std::string("[Option Group: ") + get_group() + "]";
+    }
+    if(aliases_.empty() || !with_aliases) {
+        return name_;
     }
+    std::string dispname = name_;
+    for(const auto &lalias : aliases_) {
+        dispname.push_back(',');
+        dispname.push_back(' ');
+        dispname.append(lalias);
+    }
+    return dispname;
+}
 
-    /// Get a display name for an app
-    std::string get_display_name() const { return (!name_.empty()) ? name_ : "[Option Group: " + get_group() + "]"; }
+CLI11_NODISCARD CLI11_INLINE bool App::check_name(std::string name_to_check) const {
+    std::string local_name = name_;
+    if(ignore_underscore_) {
+        local_name = detail::remove_underscore(name_);
+        name_to_check = detail::remove_underscore(name_to_check);
+    }
+    if(ignore_case_) {
+        local_name = detail::to_lower(name_);
+        name_to_check = detail::to_lower(name_to_check);
+    }
 
-    /// Check the name, case insensitive and underscore insensitive if set
-    bool check_name(std::string name_to_check) const {
-        std::string local_name = name_;
+    if(local_name == name_to_check) {
+        return true;
+    }
+    for(std::string les : aliases_) {  // NOLINT(performance-for-range-copy)
         if(ignore_underscore_) {
-            local_name = detail::remove_underscore(name_);
-            name_to_check = detail::remove_underscore(name_to_check);
+            les = detail::remove_underscore(les);
         }
         if(ignore_case_) {
-            local_name = detail::to_lower(name_);
-            name_to_check = detail::to_lower(name_to_check);
+            les = detail::to_lower(les);
         }
-
-        if(local_name == name_to_check) {
+        if(les == name_to_check) {
             return true;
         }
-        for(auto les : aliases_) {
-            if(ignore_underscore_) {
-                les = detail::remove_underscore(les);
-            }
-            if(ignore_case_) {
-                les = detail::to_lower(les);
-            }
-            if(les == name_to_check) {
-                return true;
-            }
-        }
-        return false;
     }
+    return false;
+}
 
-    /// Get the groups available directly from this option (in order)
-    std::vector<std::string> get_groups() const {
-        std::vector<std::string> groups;
+CLI11_NODISCARD CLI11_INLINE std::vector<std::string> App::get_groups() const {
+    std::vector<std::string> groups;
 
-        for(const Option_p &opt : options_) {
-            // Add group if it is not already in there
-            if(std::find(groups.begin(), groups.end(), opt->get_group()) == groups.end()) {
-                groups.push_back(opt->get_group());
-            }
+    for(const Option_p &opt : options_) {
+        // Add group if it is not already in there
+        if(std::find(groups.begin(), groups.end(), opt->get_group()) == groups.end()) {
+            groups.push_back(opt->get_group());
         }
-
-        return groups;
     }
 
-    /// This gets a vector of pointers with the original parse order
-    const std::vector<Option *> &parse_order() const { return parse_order_; }
+    return groups;
+}
 
-    /// This returns the missing options from the current subcommand
-    std::vector<std::string> remaining(bool recurse = false) const {
-        std::vector<std::string> miss_list;
-        for(const std::pair<detail::Classifier, std::string> &miss : missing_) {
-            miss_list.push_back(std::get<1>(miss));
-        }
-        // Get from a subcommand that may allow extras
-        if(recurse) {
-            if(!allow_extras_) {
-                for(const auto &sub : subcommands_) {
-                    if(sub->name_.empty() && !sub->missing_.empty()) {
-                        for(const std::pair<detail::Classifier, std::string> &miss : sub->missing_) {
-                            miss_list.push_back(std::get<1>(miss));
-                        }
+CLI11_NODISCARD CLI11_INLINE std::vector<std::string> App::remaining(bool recurse) const {
+    std::vector<std::string> miss_list;
+    for(const std::pair<detail::Classifier, std::string> &miss : missing_) {
+        miss_list.push_back(std::get<1>(miss));
+    }
+    // Get from a subcommand that may allow extras
+    if(recurse) {
+        if(!allow_extras_) {
+            for(const auto &sub : subcommands_) {
+                if(sub->name_.empty() && !sub->missing_.empty()) {
+                    for(const std::pair<detail::Classifier, std::string> &miss : sub->missing_) {
+                        miss_list.push_back(std::get<1>(miss));
                     }
                 }
             }
-            // Recurse into subcommands
+        }
+        // Recurse into subcommands
 
-            for(const App *sub : parsed_subcommands_) {
-                std::vector<std::string> output = sub->remaining(recurse);
-                std::copy(std::begin(output), std::end(output), std::back_inserter(miss_list));
-            }
+        for(const App *sub : parsed_subcommands_) {
+            std::vector<std::string> output = sub->remaining(recurse);
+            std::copy(std::begin(output), std::end(output), std::back_inserter(miss_list));
         }
-        return miss_list;
     }
+    return miss_list;
+}
 
-    /// This returns the missing options in a form ready for processing by another command line program
-    std::vector<std::string> remaining_for_passthrough(bool recurse = false) const {
-        std::vector<std::string> miss_list = remaining(recurse);
-        std::reverse(std::begin(miss_list), std::end(miss_list));
-        return miss_list;
-    }
+CLI11_NODISCARD CLI11_INLINE std::vector<std::string> App::remaining_for_passthrough(bool recurse) const {
+    std::vector<std::string> miss_list = remaining(recurse);
+    std::reverse(std::begin(miss_list), std::end(miss_list));
+    return miss_list;
+}
 
-    /// This returns the number of remaining options, minus the -- separator
-    std::size_t remaining_size(bool recurse = false) const {
-        auto remaining_options = static_cast<std::size_t>(std::count_if(
-            std::begin(missing_), std::end(missing_), [](const std::pair<detail::Classifier, std::string> &val) {
-              return val.first != detail::Classifier::POSITIONAL_MARK;
-            }));
+CLI11_NODISCARD CLI11_INLINE std::size_t App::remaining_size(bool recurse) const {
+    auto remaining_options = static_cast<std::size_t>(std::count_if(
+        std::begin(missing_), std::end(missing_), [](const std::pair<detail::Classifier, std::string> &val) {
+            return val.first != detail::Classifier::POSITIONAL_MARK;
+        }));
 
-        if(recurse) {
-            for(const App_p &sub : subcommands_) {
-                remaining_options += sub->remaining_size(recurse);
-            }
+    if(recurse) {
+        for(const App_p &sub : subcommands_) {
+            remaining_options += sub->remaining_size(recurse);
         }
-        return remaining_options;
     }
+    return remaining_options;
+}
 
-    ///@}
-
-  protected:
-    /// Check the options to make sure there are no conflicts.
-    ///
-    /// Currently checks to see if multiple positionals exist with unlimited args and checks if the min and max options
-    /// are feasible
-    void _validate() const {
-        // count the number of positional only args
-        auto pcount = std::count_if(std::begin(options_), std::end(options_), [](const Option_p &opt) {
-          return opt->get_items_expected_max() >= detail::expected_max_vector_size && !opt->nonpositional();
+CLI11_INLINE void App::_validate() const {
+    // count the number of positional only args
+    auto pcount = std::count_if(std::begin(options_), std::end(options_), [](const Option_p &opt) {
+        return opt->get_items_expected_max() >= detail::expected_max_vector_size && !opt->nonpositional();
+    });
+    if(pcount > 1) {
+        auto pcount_req = std::count_if(std::begin(options_), std::end(options_), [](const Option_p &opt) {
+            return opt->get_items_expected_max() >= detail::expected_max_vector_size && !opt->nonpositional() &&
+                   opt->get_required();
         });
-        if(pcount > 1) {
-            auto pcount_req = std::count_if(std::begin(options_), std::end(options_), [](const Option_p &opt) {
-              return opt->get_items_expected_max() >= detail::expected_max_vector_size && !opt->nonpositional() &&
-                     opt->get_required();
-            });
-            if(pcount - pcount_req > 1) {
-                throw InvalidError(name_);
-            }
+        if(pcount - pcount_req > 1) {
+            throw InvalidError(name_);
         }
+    }
 
-        std::size_t nameless_subs{0};
-        for(const App_p &app : subcommands_) {
-            app->_validate();
-            if(app->get_name().empty())
-                ++nameless_subs;
-        }
+    std::size_t nameless_subs{0};
+    for(const App_p &app : subcommands_) {
+        app->_validate();
+        if(app->get_name().empty())
+            ++nameless_subs;
+    }
 
-        if(require_option_min_ > 0) {
-            if(require_option_max_ > 0) {
-                if(require_option_max_ < require_option_min_) {
-                    throw(InvalidError("Required min options greater than required max options",
-                                       ExitCodes::InvalidError));
-                }
-            }
-            if(require_option_min_ > (options_.size() + nameless_subs)) {
-                throw(InvalidError("Required min options greater than number of available options",
-                                   ExitCodes::InvalidError));
+    if(require_option_min_ > 0) {
+        if(require_option_max_ > 0) {
+            if(require_option_max_ < require_option_min_) {
+                throw(InvalidError("Required min options greater than required max options", ExitCodes::InvalidError));
             }
         }
+        if(require_option_min_ > (options_.size() + nameless_subs)) {
+            throw(
+                InvalidError("Required min options greater than number of available options", ExitCodes::InvalidError));
+        }
     }
+}
 
-    /// configure subcommands to enable parsing through the current object
-    /// set the correct fallthrough and prefix for nameless subcommands and manage the automatic enable or disable
-    /// makes sure parent is set correctly
-    void _configure() {
-        if(default_startup == startup_mode::enabled) {
-            disabled_ = false;
-        } else if(default_startup == startup_mode::disabled) {
-            disabled_ = true;
+CLI11_INLINE void App::_configure() {
+    if(default_startup == startup_mode::enabled) {
+        disabled_ = false;
+    } else if(default_startup == startup_mode::disabled) {
+        disabled_ = true;
+    }
+    for(const App_p &app : subcommands_) {
+        if(app->has_automatic_name_) {
+            app->name_.clear();
         }
-        for(const App_p &app : subcommands_) {
-            if(app->has_automatic_name_) {
-                app->name_.clear();
-            }
-            if(app->name_.empty()) {
-                app->fallthrough_ = false;  // make sure fallthrough_ is false to prevent infinite loop
-                app->prefix_command_ = false;
-            }
-            // make sure the parent is set to be this object in preparation for parse
-            app->parent_ = this;
-            app->_configure();
+        if(app->name_.empty()) {
+            app->fallthrough_ = false;  // make sure fallthrough_ is false to prevent infinite loop
+            app->prefix_command_ = false;
         }
+        // make sure the parent is set to be this object in preparation for parse
+        app->parent_ = this;
+        app->_configure();
     }
-    /// Internal function to run (App) callback, bottom up
-    void run_callback(bool final_mode = false) {
-        pre_callback();
-        // in the main app if immediate_callback_ is set it runs the main callback before the used subcommands
-        if(!final_mode && parse_complete_callback_) {
-            parse_complete_callback_();
-        }
-        // run the callbacks for the received subcommands
-        for(App *subc : get_subcommands()) {
-            subc->run_callback(true);
+}
+
+CLI11_INLINE void App::run_callback(bool final_mode, bool suppress_final_callback) {
+    pre_callback();
+    // in the main app if immediate_callback_ is set it runs the main callback before the used subcommands
+    if(!final_mode && parse_complete_callback_) {
+        parse_complete_callback_();
+    }
+    // run the callbacks for the received subcommands
+    for(App *subc : get_subcommands()) {
+        if(subc->parent_ == this) {
+            subc->run_callback(true, suppress_final_callback);
         }
-        // now run callbacks for option_groups
-        for(auto &subc : subcommands_) {
-            if(subc->name_.empty() && subc->count_all() > 0) {
-                subc->run_callback(true);
-            }
+    }
+    // now run callbacks for option_groups
+    for(auto &subc : subcommands_) {
+        if(subc->name_.empty() && subc->count_all() > 0) {
+            subc->run_callback(true, suppress_final_callback);
         }
+    }
 
-        // finally run the main callback
-        if(final_callback_ && (parsed_ > 0)) {
-            if(!name_.empty() || count_all() > 0) {
-                final_callback_();
-            }
+    // finally run the main callback
+    if(final_callback_ && (parsed_ > 0) && (!suppress_final_callback)) {
+        if(!name_.empty() || count_all() > 0 || parent_ == nullptr) {
+            final_callback_();
         }
     }
+}
 
-    /// Check to see if a subcommand is valid. Give up immediately if subcommand max has been reached.
-    bool _valid_subcommand(const std::string &current, bool ignore_used = true) const {
-        // Don't match if max has been reached - but still check parents
-        if(require_subcommand_max_ != 0 && parsed_subcommands_.size() >= require_subcommand_max_) {
-            return parent_ != nullptr && parent_->_valid_subcommand(current, ignore_used);
-        }
-        auto com = _find_subcommand(current, true, ignore_used);
-        if(com != nullptr) {
-            return true;
-        }
-        // Check parent if exists, else return false
+CLI11_NODISCARD CLI11_INLINE bool App::_valid_subcommand(const std::string &current, bool ignore_used) const {
+    // Don't match if max has been reached - but still check parents
+    if(require_subcommand_max_ != 0 && parsed_subcommands_.size() >= require_subcommand_max_) {
         return parent_ != nullptr && parent_->_valid_subcommand(current, ignore_used);
     }
+    auto *com = _find_subcommand(current, true, ignore_used);
+    if(com != nullptr) {
+        return true;
+    }
+    // Check parent if exists, else return false
+    return parent_ != nullptr && parent_->_valid_subcommand(current, ignore_used);
+}
 
-    /// Selects a Classifier enum based on the type of the current argument
-    detail::Classifier _recognize(const std::string &current, bool ignore_used_subcommands = true) const {
-        std::string dummy1, dummy2;
-
-        if(current == "--")
-            return detail::Classifier::POSITIONAL_MARK;
-        if(_valid_subcommand(current, ignore_used_subcommands))
-            return detail::Classifier::SUBCOMMAND;
-        if(detail::split_long(current, dummy1, dummy2))
-            return detail::Classifier::LONG;
-        if(detail::split_short(current, dummy1, dummy2)) {
-            if(dummy1[0] >= '0' && dummy1[0] <= '9') {
-                if(get_option_no_throw(std::string{'-', dummy1[0]}) == nullptr) {
-                    return detail::Classifier::NONE;
-                }
+CLI11_NODISCARD CLI11_INLINE detail::Classifier App::_recognize(const std::string &current,
+                                                                bool ignore_used_subcommands) const {
+    std::string dummy1, dummy2;
+
+    if(current == "--")
+        return detail::Classifier::POSITIONAL_MARK;
+    if(_valid_subcommand(current, ignore_used_subcommands))
+        return detail::Classifier::SUBCOMMAND;
+    if(detail::split_long(current, dummy1, dummy2))
+        return detail::Classifier::LONG;
+    if(detail::split_short(current, dummy1, dummy2)) {
+        if(dummy1[0] >= '0' && dummy1[0] <= '9') {
+            if(get_option_no_throw(std::string{'-', dummy1[0]}) == nullptr) {
+                return detail::Classifier::NONE;
             }
-            return detail::Classifier::SHORT;
         }
-        if((allow_windows_style_options_) && (detail::split_windows_style(current, dummy1, dummy2)))
-            return detail::Classifier::WINDOWS;
-        if((current == "++") && !name_.empty() && parent_ != nullptr)
-            return detail::Classifier::SUBCOMMAND_TERMINATOR;
-        return detail::Classifier::NONE;
+        return detail::Classifier::SHORT;
     }
-
-    // The parse function is now broken into several parts, and part of process
-
-    /// Read and process a configuration file (main app only)
-    void _process_config_file() {
-        if(config_ptr_ != nullptr) {
-            bool config_required = config_ptr_->get_required();
-            bool file_given = config_ptr_->count() > 0;
-            auto config_file = config_ptr_->as<std::string>();
-            if(config_file.empty()) {
-                if(config_required) {
-                    throw FileError::Missing("no specified config file");
-                }
-                return;
+    if((allow_windows_style_options_) && (detail::split_windows_style(current, dummy1, dummy2)))
+        return detail::Classifier::WINDOWS_STYLE;
+    if((current == "++") && !name_.empty() && parent_ != nullptr)
+        return detail::Classifier::SUBCOMMAND_TERMINATOR;
+    auto dotloc = current.find_first_of('.');
+    if(dotloc != std::string::npos) {
+        auto *cm = _find_subcommand(current.substr(0, dotloc), true, ignore_used_subcommands);
+        if(cm != nullptr) {
+            auto res = cm->_recognize(current.substr(dotloc + 1), ignore_used_subcommands);
+            if(res == detail::Classifier::SUBCOMMAND) {
+                return res;
             }
+        }
+    }
+    return detail::Classifier::NONE;
+}
 
-            auto path_result = detail::check_path(config_file.c_str());
-            if(path_result == detail::path_type::file) {
-                try {
-                    std::vector<ConfigItem> values = config_formatter_->from_file(config_file);
-                    _parse_config(values);
-                    if(!file_given) {
-                        config_ptr_->add_result(config_file);
-                    }
-                } catch(const FileError &) {
-                    if(config_required || file_given)
-                        throw;
-                }
-            } else if(config_required || file_given) {
-                throw FileError::Missing(config_file);
+CLI11_INLINE bool App::_process_config_file(const std::string &config_file, bool throw_error) {
+    auto path_result = detail::check_path(config_file.c_str());
+    if(path_result == detail::path_type::file) {
+        try {
+            std::vector<ConfigItem> values = config_formatter_->from_file(config_file);
+            _parse_config(values);
+            return true;
+        } catch(const FileError &) {
+            if(throw_error) {
+                throw;
             }
+            return false;
         }
+    } else if(throw_error) {
+        throw FileError::Missing(config_file);
+    } else {
+        return false;
     }
+}
 
-    /// Get envname options if not yet passed. Runs on *all* subcommands.
-    void _process_env() {
-        for(const Option_p &opt : options_) {
-            if(opt->count() == 0 && !opt->envname_.empty()) {
-                char *buffer = nullptr;
-                std::string ename_string;
+CLI11_INLINE void App::_process_config_file() {
+    if(config_ptr_ != nullptr) {
+        bool config_required = config_ptr_->get_required();
+        auto file_given = config_ptr_->count() > 0;
+        if(!(file_given || config_ptr_->envname_.empty())) {
+            std::string ename_string = detail::get_environment_value(config_ptr_->envname_);
+            if(!ename_string.empty()) {
+                config_ptr_->add_result(ename_string);
+            }
+        }
+        config_ptr_->run_callback();
 
-#ifdef _MSC_VER
-                // Windows version
-                std::size_t sz = 0;
-                if(_dupenv_s(&buffer, &sz, opt->envname_.c_str()) == 0 && buffer != nullptr) {
-                    ename_string = std::string(buffer);
-                    free(buffer);
-                }
-#else
-                // This also works on Windows, but gives a warning
-                buffer = std::getenv(opt->envname_.c_str());
-                if(buffer != nullptr)
-                    ename_string = std::string(buffer);
-#endif
+        auto config_files = config_ptr_->as<std::vector<std::string>>();
+        bool files_used{file_given};
+        if(config_files.empty() || config_files.front().empty()) {
+            if(config_required) {
+                throw FileError("config file is required but none was given");
+            }
+            return;
+        }
+        for(const auto &config_file : config_files) {
+            if(_process_config_file(config_file, config_required || file_given)) {
+                files_used = true;
+            }
+        }
+        if(!files_used) {
+            // this is done so the count shows as 0 if no callbacks were processed
+            config_ptr_->clear();
+            bool force = config_ptr_->force_callback_;
+            config_ptr_->force_callback_ = false;
+            config_ptr_->run_callback();
+            config_ptr_->force_callback_ = force;
+        }
+    }
+}
 
-                if(!ename_string.empty()) {
+CLI11_INLINE void App::_process_env() {
+    for(const Option_p &opt : options_) {
+        if(opt->count() == 0 && !opt->envname_.empty()) {
+            std::string ename_string = detail::get_environment_value(opt->envname_);
+            if(!ename_string.empty()) {
+                std::string result = ename_string;
+                result = opt->_validate(result, 0);
+                if(result.empty()) {
                     opt->add_result(ename_string);
                 }
             }
         }
+    }
 
-        for(App_p &sub : subcommands_) {
-            if(sub->get_name().empty() || !sub->parse_complete_callback_)
-                sub->_process_env();
+    for(App_p &sub : subcommands_) {
+        if(sub->get_name().empty() || (sub->count_all() > 0 && !sub->parse_complete_callback_)) {
+            // only process environment variables if the callback has actually been triggered already
+            sub->_process_env();
         }
     }
+}
 
-    /// Process callbacks. Runs on *all* subcommands.
-    void _process_callbacks() {
-
-        for(App_p &sub : subcommands_) {
-            // process the priority option_groups first
-            if(sub->get_name().empty() && sub->parse_complete_callback_) {
-                if(sub->count_all() > 0) {
-                    sub->_process_callbacks();
-                    sub->run_callback();
-                }
+CLI11_INLINE void App::_process_callbacks() {
+
+    for(App_p &sub : subcommands_) {
+        // process the priority option_groups first
+        if(sub->get_name().empty() && sub->parse_complete_callback_) {
+            if(sub->count_all() > 0) {
+                sub->_process_callbacks();
+                sub->run_callback();
             }
         }
+    }
 
-        for(const Option_p &opt : options_) {
-            if(opt->count() > 0 && !opt->get_callback_run()) {
-                opt->run_callback();
-            }
+    for(const Option_p &opt : options_) {
+        if((*opt) && !opt->get_callback_run()) {
+            opt->run_callback();
         }
-        for(App_p &sub : subcommands_) {
-            if(!sub->parse_complete_callback_) {
-                sub->_process_callbacks();
-            }
+    }
+    for(App_p &sub : subcommands_) {
+        if(!sub->parse_complete_callback_) {
+            sub->_process_callbacks();
         }
     }
+}
 
-    /// Run help flag processing if any are found.
-    ///
-    /// The flags allow recursive calls to remember if there was a help flag on a parent.
-    void _process_help_flags(bool trigger_help = false, bool trigger_all_help = false) const {
-        const Option *help_ptr = get_help_ptr();
-        const Option *help_all_ptr = get_help_all_ptr();
+CLI11_INLINE void App::_process_help_flags(bool trigger_help, bool trigger_all_help) const {
+    const Option *help_ptr = get_help_ptr();
+    const Option *help_all_ptr = get_help_all_ptr();
 
-        if(help_ptr != nullptr && help_ptr->count() > 0)
-            trigger_help = true;
-        if(help_all_ptr != nullptr && help_all_ptr->count() > 0)
-            trigger_all_help = true;
+    if(help_ptr != nullptr && help_ptr->count() > 0)
+        trigger_help = true;
+    if(help_all_ptr != nullptr && help_all_ptr->count() > 0)
+        trigger_all_help = true;
 
-        // If there were parsed subcommands, call those. First subcommand wins if there are multiple ones.
-        if(!parsed_subcommands_.empty()) {
-            for(const App *sub : parsed_subcommands_)
-                sub->_process_help_flags(trigger_help, trigger_all_help);
+    // If there were parsed subcommands, call those. First subcommand wins if there are multiple ones.
+    if(!parsed_subcommands_.empty()) {
+        for(const App *sub : parsed_subcommands_)
+            sub->_process_help_flags(trigger_help, trigger_all_help);
 
-            // Only the final subcommand should call for help. All help wins over help.
-        } else if(trigger_all_help) {
-            throw CallForAllHelp();
-        } else if(trigger_help) {
-            throw CallForHelp();
-        }
+        // Only the final subcommand should call for help. All help wins over help.
+    } else if(trigger_all_help) {
+        throw CallForAllHelp();
+    } else if(trigger_help) {
+        throw CallForHelp();
     }
+}
 
-    /// Verify required options and cross requirements. Subcommands too (only if selected).
-    void _process_requirements() {
-        // check excludes
-        bool excluded{false};
-        std::string excluder;
-        for(auto &opt : exclude_options_) {
-            if(opt->count() > 0) {
-                excluded = true;
-                excluder = opt->get_name();
-            }
+CLI11_INLINE void App::_process_requirements() {
+    // check excludes
+    bool excluded{false};
+    std::string excluder;
+    for(const auto &opt : exclude_options_) {
+        if(opt->count() > 0) {
+            excluded = true;
+            excluder = opt->get_name();
         }
-        for(auto &subc : exclude_subcommands_) {
-            if(subc->count_all() > 0) {
-                excluded = true;
-                excluder = subc->get_display_name();
-            }
+    }
+    for(const auto &subc : exclude_subcommands_) {
+        if(subc->count_all() > 0) {
+            excluded = true;
+            excluder = subc->get_display_name();
         }
-        if(excluded) {
-            if(count_all() > 0) {
-                throw ExcludesError(get_display_name(), excluder);
-            }
-            // if we are excluded but didn't receive anything, just return
-            return;
+    }
+    if(excluded) {
+        if(count_all() > 0) {
+            throw ExcludesError(get_display_name(), excluder);
         }
+        // if we are excluded but didn't receive anything, just return
+        return;
+    }
 
-        // check excludes
-        bool missing_needed{false};
-        std::string missing_need;
-        for(auto &opt : need_options_) {
-            if(opt->count() == 0) {
-                missing_needed = true;
-                missing_need = opt->get_name();
-            }
+    // check excludes
+    bool missing_needed{false};
+    std::string missing_need;
+    for(const auto &opt : need_options_) {
+        if(opt->count() == 0) {
+            missing_needed = true;
+            missing_need = opt->get_name();
         }
-        for(auto &subc : need_subcommands_) {
-            if(subc->count_all() == 0) {
-                missing_needed = true;
-                missing_need = subc->get_display_name();
-            }
+    }
+    for(const auto &subc : need_subcommands_) {
+        if(subc->count_all() == 0) {
+            missing_needed = true;
+            missing_need = subc->get_display_name();
         }
-        if(missing_needed) {
-            if(count_all() > 0) {
-                throw RequiresError(get_display_name(), missing_need);
-            }
-            // if we missing something but didn't have any options, just return
-            return;
+    }
+    if(missing_needed) {
+        if(count_all() > 0) {
+            throw RequiresError(get_display_name(), missing_need);
         }
+        // if we missing something but didn't have any options, just return
+        return;
+    }
 
-        std::size_t used_options = 0;
-        for(const Option_p &opt : options_) {
+    std::size_t used_options = 0;
+    for(const Option_p &opt : options_) {
 
-            if(opt->count() != 0) {
-                ++used_options;
-            }
-            // Required but empty
-            if(opt->get_required() && opt->count() == 0) {
-                throw RequiredError(opt->get_name());
-            }
-            // Requires
-            for(const Option *opt_req : opt->needs_)
-                if(opt->count() > 0 && opt_req->count() == 0)
-                    throw RequiresError(opt->get_name(), opt_req->get_name());
-            // Excludes
-            for(const Option *opt_ex : opt->excludes_)
-                if(opt->count() > 0 && opt_ex->count() != 0)
-                    throw ExcludesError(opt->get_name(), opt_ex->get_name());
+        if(opt->count() != 0) {
+            ++used_options;
         }
-        // check for the required number of subcommands
-        if(require_subcommand_min_ > 0) {
-            auto selected_subcommands = get_subcommands();
-            if(require_subcommand_min_ > selected_subcommands.size())
-                throw RequiredError::Subcommand(require_subcommand_min_);
+        // Required but empty
+        if(opt->get_required() && opt->count() == 0) {
+            throw RequiredError(opt->get_name());
         }
+        // Requires
+        for(const Option *opt_req : opt->needs_)
+            if(opt->count() > 0 && opt_req->count() == 0)
+                throw RequiresError(opt->get_name(), opt_req->get_name());
+        // Excludes
+        for(const Option *opt_ex : opt->excludes_)
+            if(opt->count() > 0 && opt_ex->count() != 0)
+                throw ExcludesError(opt->get_name(), opt_ex->get_name());
+    }
+    // check for the required number of subcommands
+    if(require_subcommand_min_ > 0) {
+        auto selected_subcommands = get_subcommands();
+        if(require_subcommand_min_ > selected_subcommands.size())
+            throw RequiredError::Subcommand(require_subcommand_min_);
+    }
 
-        // Max error cannot occur, the extra subcommand will parse as an ExtrasError or a remaining item.
+    // Max error cannot occur, the extra subcommand will parse as an ExtrasError or a remaining item.
 
-        // run this loop to check how many unnamed subcommands were actually used since they are considered options
-        // from the perspective of an App
-        for(App_p &sub : subcommands_) {
-            if(sub->disabled_)
-                continue;
-            if(sub->name_.empty() && sub->count_all() > 0) {
-                ++used_options;
-            }
+    // run this loop to check how many unnamed subcommands were actually used since they are considered options
+    // from the perspective of an App
+    for(App_p &sub : subcommands_) {
+        if(sub->disabled_)
+            continue;
+        if(sub->name_.empty() && sub->count_all() > 0) {
+            ++used_options;
         }
+    }
 
-        if(require_option_min_ > used_options || (require_option_max_ > 0 && require_option_max_ < used_options)) {
-            auto option_list = detail::join(options_, [](const Option_p &ptr) { return ptr->get_name(false, true); });
-            if(option_list.compare(0, 10, "-h,--help,") == 0) {
-                option_list.erase(0, 10);
+    if(require_option_min_ > used_options || (require_option_max_ > 0 && require_option_max_ < used_options)) {
+        auto option_list = detail::join(options_, [this](const Option_p &ptr) {
+            if(ptr.get() == help_ptr_ || ptr.get() == help_all_ptr_) {
+                return std::string{};
             }
-            auto subc_list = get_subcommands([](App *app) { return ((app->get_name().empty()) && (!app->disabled_)); });
-            if(!subc_list.empty()) {
-                option_list += "," + detail::join(subc_list, [](const App *app) { return app->get_display_name(); });
-            }
-            throw RequiredError::Option(require_option_min_, require_option_max_, used_options, option_list);
+            return ptr->get_name(false, true);
+        });
+
+        auto subc_list = get_subcommands([](App *app) { return ((app->get_name().empty()) && (!app->disabled_)); });
+        if(!subc_list.empty()) {
+            option_list += "," + detail::join(subc_list, [](const App *app) { return app->get_display_name(); });
         }
+        throw RequiredError::Option(require_option_min_, require_option_max_, used_options, option_list);
+    }
 
-        // now process the requirements for subcommands if needed
-        for(App_p &sub : subcommands_) {
-            if(sub->disabled_)
-                continue;
-            if(sub->name_.empty() && sub->required_ == false) {
-                if(sub->count_all() == 0) {
-                    if(require_option_min_ > 0 && require_option_min_ <= used_options) {
-                        continue;
-                        // if we have met the requirement and there is nothing in this option group skip checking
-                        // requirements
-                    }
-                    if(require_option_max_ > 0 && used_options >= require_option_min_) {
-                        continue;
-                        // if we have met the requirement and there is nothing in this option group skip checking
-                        // requirements
-                    }
+    // now process the requirements for subcommands if needed
+    for(App_p &sub : subcommands_) {
+        if(sub->disabled_)
+            continue;
+        if(sub->name_.empty() && sub->required_ == false) {
+            if(sub->count_all() == 0) {
+                if(require_option_min_ > 0 && require_option_min_ <= used_options) {
+                    continue;
+                    // if we have met the requirement and there is nothing in this option group skip checking
+                    // requirements
+                }
+                if(require_option_max_ > 0 && used_options >= require_option_min_) {
+                    continue;
+                    // if we have met the requirement and there is nothing in this option group skip checking
+                    // requirements
                 }
             }
-            if(sub->count() > 0 || sub->name_.empty()) {
-                sub->_process_requirements();
-            }
+        }
+        if(sub->count() > 0 || sub->name_.empty()) {
+            sub->_process_requirements();
+        }
 
-            if(sub->required_ && sub->count_all() == 0) {
-                throw(CLI::RequiredError(sub->get_display_name()));
-            }
+        if(sub->required_ && sub->count_all() == 0) {
+            throw(CLI::RequiredError(sub->get_display_name()));
         }
     }
+}
 
-    /// Process callbacks and such.
-    void _process() {
+CLI11_INLINE void App::_process() {
+    try {
+        // the config file might generate a FileError but that should not be processed until later in the process
+        // to allow for help, version and other errors to generate first.
         _process_config_file();
+
+        // process env shouldn't throw but no reason to process it if config generated an error
         _process_env();
+    } catch(const CLI::FileError &) {
+        // callbacks and help_flags can generate exceptions which should take priority
+        // over the config file error if one exists.
         _process_callbacks();
         _process_help_flags();
-        _process_requirements();
+        throw;
     }
 
-    /// Throw an error if anything is left over and should not be.
-    void _process_extras() {
-        if(!(allow_extras_ || prefix_command_)) {
-            std::size_t num_left_over = remaining_size();
-            if(num_left_over > 0) {
-                throw ExtrasError(name_, remaining(false));
-            }
-        }
+    _process_callbacks();
+    _process_help_flags();
+
+    _process_requirements();
+}
 
-        for(App_p &sub : subcommands_) {
-            if(sub->count() > 0)
-                sub->_process_extras();
+CLI11_INLINE void App::_process_extras() {
+    if(!(allow_extras_ || prefix_command_)) {
+        std::size_t num_left_over = remaining_size();
+        if(num_left_over > 0) {
+            throw ExtrasError(name_, remaining(false));
         }
     }
 
-    /// Throw an error if anything is left over and should not be.
-    /// Modifies the args to fill in the missing items before throwing.
-    void _process_extras(std::vector<std::string> &args) {
-        if(!(allow_extras_ || prefix_command_)) {
-            std::size_t num_left_over = remaining_size();
-            if(num_left_over > 0) {
-                args = remaining(false);
-                throw ExtrasError(name_, args);
-            }
-        }
+    for(App_p &sub : subcommands_) {
+        if(sub->count() > 0)
+            sub->_process_extras();
+    }
+}
 
-        for(App_p &sub : subcommands_) {
-            if(sub->count() > 0)
-                sub->_process_extras(args);
+CLI11_INLINE void App::_process_extras(std::vector<std::string> &args) {
+    if(!(allow_extras_ || prefix_command_)) {
+        std::size_t num_left_over = remaining_size();
+        if(num_left_over > 0) {
+            args = remaining(false);
+            throw ExtrasError(name_, args);
         }
     }
 
-    /// Internal function to recursively increment the parsed counter on the current app as well unnamed subcommands
-    void increment_parsed() {
-        ++parsed_;
-        for(App_p &sub : subcommands_) {
-            if(sub->get_name().empty())
-                sub->increment_parsed();
-        }
+    for(App_p &sub : subcommands_) {
+        if(sub->count() > 0)
+            sub->_process_extras(args);
     }
-    /// Internal parse function
-    void _parse(std::vector<std::string> &args) {
-        increment_parsed();
-        _trigger_pre_parse(args.size());
-        bool positional_only = false;
+}
 
-        while(!args.empty()) {
-            if(!_parse_single(args, positional_only)) {
-                break;
-            }
+CLI11_INLINE void App::increment_parsed() {
+    ++parsed_;
+    for(App_p &sub : subcommands_) {
+        if(sub->get_name().empty())
+            sub->increment_parsed();
+    }
+}
+
+CLI11_INLINE void App::_parse(std::vector<std::string> &args) {
+    increment_parsed();
+    _trigger_pre_parse(args.size());
+    bool positional_only = false;
+
+    while(!args.empty()) {
+        if(!_parse_single(args, positional_only)) {
+            break;
         }
+    }
+
+    if(parent_ == nullptr) {
+        _process();
 
-        if(parent_ == nullptr) {
-            _process();
+        // Throw error if any items are left over (depending on settings)
+        _process_extras(args);
+
+        // Convert missing (pairs) to extras (string only) ready for processing in another app
+        args = remaining_for_passthrough(false);
+    } else if(parse_complete_callback_) {
+        _process_env();
+        _process_callbacks();
+        _process_help_flags();
+        _process_requirements();
+        run_callback(false, true);
+    }
+}
 
-            // Throw error if any items are left over (depending on settings)
-            _process_extras(args);
+CLI11_INLINE void App::_parse(std::vector<std::string> &&args) {
+    // this can only be called by the top level in which case parent == nullptr by definition
+    // operation is simplified
+    increment_parsed();
+    _trigger_pre_parse(args.size());
+    bool positional_only = false;
 
-            // Convert missing (pairs) to extras (string only) ready for processing in another app
-            args = remaining_for_passthrough(false);
-        } else if(parse_complete_callback_) {
-            _process_env();
-            _process_callbacks();
-            _process_help_flags();
-            _process_requirements();
-            run_callback();
-        }
+    while(!args.empty()) {
+        _parse_single(args, positional_only);
     }
+    _process();
 
-    /// Internal parse function
-    void _parse(std::vector<std::string> &&args) {
-        // this can only be called by the top level in which case parent == nullptr by definition
-        // operation is simplified
-        increment_parsed();
-        _trigger_pre_parse(args.size());
-        bool positional_only = false;
+    // Throw error if any items are left over (depending on settings)
+    _process_extras();
+}
 
-        while(!args.empty()) {
-            _parse_single(args, positional_only);
-        }
-        _process();
+CLI11_INLINE void App::_parse_stream(std::istream &input) {
+    auto values = config_formatter_->from_config(input);
+    _parse_config(values);
+    increment_parsed();
+    _trigger_pre_parse(values.size());
+    _process();
 
-        // Throw error if any items are left over (depending on settings)
-        _process_extras();
-    }
+    // Throw error if any items are left over (depending on settings)
+    _process_extras();
+}
 
-    /// Parse one config param, return false if not found in any subcommand, remove if it is
-    ///
-    /// If this has more than one dot.separated.name, go into the subcommand matching it
-    /// Returns true if it managed to find the option, if false you'll need to remove the arg manually.
-    void _parse_config(std::vector<ConfigItem> &args) {
-        for(ConfigItem item : args) {
-            if(!_parse_single_config(item) && allow_config_extras_ == config_extras_mode::error)
-                throw ConfigError::Extras(item.fullname());
-        }
+CLI11_INLINE void App::_parse_config(const std::vector<ConfigItem> &args) {
+    for(const ConfigItem &item : args) {
+        if(!_parse_single_config(item) && allow_config_extras_ == config_extras_mode::error)
+            throw ConfigError::Extras(item.fullname());
     }
+}
 
-    /// Fill in a single config option
-    bool _parse_single_config(const ConfigItem &item, std::size_t level = 0) {
-        if(level < item.parents.size()) {
-            try {
-                auto subcom = get_subcommand(item.parents.at(level));
-                auto result = subcom->_parse_single_config(item, level + 1);
+CLI11_INLINE bool App::_parse_single_config(const ConfigItem &item, std::size_t level) {
 
-                return result;
-            } catch(const OptionNotFound &) {
-                return false;
+    if(level < item.parents.size()) {
+        auto *subcom = get_subcommand_no_throw(item.parents.at(level));
+        return (subcom != nullptr) ? subcom->_parse_single_config(item, level + 1) : false;
+    }
+    // check for section open
+    if(item.name == "++") {
+        if(configurable_) {
+            increment_parsed();
+            _trigger_pre_parse(2);
+            if(parent_ != nullptr) {
+                parent_->parsed_subcommands_.push_back(this);
             }
         }
-        // check for section open
-        if(item.name == "++") {
-            if(configurable_) {
-                increment_parsed();
-                _trigger_pre_parse(2);
-                if(parent_ != nullptr) {
-                    parent_->parsed_subcommands_.push_back(this);
-                }
-            }
-            return true;
+        return true;
+    }
+    // check for section close
+    if(item.name == "--") {
+        if(configurable_ && parse_complete_callback_) {
+            _process_callbacks();
+            _process_requirements();
+            run_callback();
         }
-        // check for section close
-        if(item.name == "--") {
-            if(configurable_) {
-                _process_callbacks();
-                _process_requirements();
-                run_callback();
-            }
-            return true;
+        return true;
+    }
+    Option *op = get_option_no_throw("--" + item.name);
+    if(op == nullptr) {
+        if(item.name.size() == 1) {
+            op = get_option_no_throw("-" + item.name);
         }
-        Option *op = get_option_no_throw("--" + item.name);
         if(op == nullptr) {
-            // If the option was not present
-            if(get_allow_config_extras() == config_extras_mode::capture)
-                // Should we worry about classifying the extras properly?
-                missing_.emplace_back(detail::Classifier::NONE, item.fullname());
+            op = get_option_no_throw(item.name);
+        }
+    }
+
+    if(op == nullptr) {
+        // If the option was not present
+        if(get_allow_config_extras() == config_extras_mode::capture) {
+            // Should we worry about classifying the extras properly?
+            missing_.emplace_back(detail::Classifier::NONE, item.fullname());
+            for(const auto &input : item.inputs) {
+                missing_.emplace_back(detail::Classifier::NONE, input);
+            }
+        }
+        return false;
+    }
+
+    if(!op->get_configurable()) {
+        if(get_allow_config_extras() == config_extras_mode::ignore_all) {
             return false;
         }
+        throw ConfigError::NotConfigurable(item.fullname());
+    }
 
-        if(!op->get_configurable())
-            throw ConfigError::NotConfigurable(item.fullname());
+    if(op->empty()) {
 
-        if(op->empty()) {
-            // Flag parsing
-            if(op->get_expected_min() == 0) {
+        if(op->get_expected_min() == 0) {
+            if(item.inputs.size() <= 1) {
+                // Flag parsing
                 auto res = config_formatter_->to_flag(item);
-                res = op->get_flag_value(item.name, res);
+                bool converted{false};
+                if(op->get_disable_flag_override()) {
+                    auto val = detail::to_flag_value(res);
+                    if(val == 1) {
+                        res = op->get_flag_value(item.name, "{}");
+                        converted = true;
+                    }
+                }
+
+                if(!converted) {
+                    errno = 0;
+                    res = op->get_flag_value(item.name, res);
+                }
 
                 op->add_result(res);
+                return true;
+            }
+            if(static_cast<int>(item.inputs.size()) > op->get_items_expected_max() &&
+               op->get_multi_option_policy() != MultiOptionPolicy::TakeAll) {
+                if(op->get_items_expected_max() > 1) {
+                    throw ArgumentMismatch::AtMost(item.fullname(), op->get_items_expected_max(), item.inputs.size());
+                }
 
-            } else {
-                op->add_result(item.inputs);
-                op->run_callback();
+                if(!op->get_disable_flag_override()) {
+                    throw ConversionError::TooManyInputsFlag(item.fullname());
+                }
+                // if the disable flag override is set then we must have the flag values match a known flag value
+                // this is true regardless of the output value, so an array input is possible and must be accounted for
+                for(const auto &res : item.inputs) {
+                    bool valid_value{false};
+                    if(op->default_flag_values_.empty()) {
+                        if(res == "true" || res == "false" || res == "1" || res == "0") {
+                            valid_value = true;
+                        }
+                    } else {
+                        for(const auto &valid_res : op->default_flag_values_) {
+                            if(valid_res.second == res) {
+                                valid_value = true;
+                                break;
+                            }
+                        }
+                    }
+
+                    if(valid_value) {
+                        op->add_result(res);
+                    } else {
+                        throw InvalidError("invalid flag argument given");
+                    }
+                }
+                return true;
             }
         }
-
-        return true;
+        op->add_result(item.inputs);
+        op->run_callback();
     }
 
-    /// Parse "one" argument (some may eat more than one), delegate to parent if fails, add to missing if missing
-    /// from master return false if the parse has failed and needs to return to parent
-    bool _parse_single(std::vector<std::string> &args, bool &positional_only) {
-        bool retval = true;
-        detail::Classifier classifier = positional_only ? detail::Classifier::NONE : _recognize(args.back());
-        switch(classifier) {
-        case detail::Classifier::POSITIONAL_MARK:
-            args.pop_back();
-            positional_only = true;
-            if((!_has_remaining_positionals()) && (parent_ != nullptr)) {
-                retval = false;
-            } else {
-                _move_to_missing(classifier, "--");
-            }
-            break;
-        case detail::Classifier::SUBCOMMAND_TERMINATOR:
-            // treat this like a positional mark if in the parent app
-            args.pop_back();
+    return true;
+}
+
+CLI11_INLINE bool App::_parse_single(std::vector<std::string> &args, bool &positional_only) {
+    bool retval = true;
+    detail::Classifier classifier = positional_only ? detail::Classifier::NONE : _recognize(args.back());
+    switch(classifier) {
+    case detail::Classifier::POSITIONAL_MARK:
+        args.pop_back();
+        positional_only = true;
+        if((!_has_remaining_positionals()) && (parent_ != nullptr)) {
             retval = false;
-            break;
-        case detail::Classifier::SUBCOMMAND:
-            retval = _parse_subcommand(args);
-            break;
-        case detail::Classifier::LONG:
-        case detail::Classifier::SHORT:
-        case detail::Classifier::WINDOWS:
-            // If already parsed a subcommand, don't accept options_
-            _parse_arg(args, classifier);
-            break;
-        case detail::Classifier::NONE:
-            // Probably a positional or something for a parent (sub)command
-            retval = _parse_positional(args, false);
-            if(retval && positionals_at_end_) {
-                positional_only = true;
-            }
-            break;
-            // LCOV_EXCL_START
-        default:
-            throw HorribleError("unrecognized classifier (you should not see this!)");
-            // LCOV_EXCL_STOP
+        } else {
+            _move_to_missing(classifier, "--");
         }
-        return retval;
+        break;
+    case detail::Classifier::SUBCOMMAND_TERMINATOR:
+        // treat this like a positional mark if in the parent app
+        args.pop_back();
+        retval = false;
+        break;
+    case detail::Classifier::SUBCOMMAND:
+        retval = _parse_subcommand(args);
+        break;
+    case detail::Classifier::LONG:
+    case detail::Classifier::SHORT:
+    case detail::Classifier::WINDOWS_STYLE:
+        // If already parsed a subcommand, don't accept options_
+        retval = _parse_arg(args, classifier, false);
+        break;
+    case detail::Classifier::NONE:
+        // Probably a positional or something for a parent (sub)command
+        retval = _parse_positional(args, false);
+        if(retval && positionals_at_end_) {
+            positional_only = true;
+        }
+        break;
+        // LCOV_EXCL_START
+    default:
+        throw HorribleError("unrecognized classifier (you should not see this!)");
+        // LCOV_EXCL_STOP
     }
+    return retval;
+}
 
-    /// Count the required remaining positional arguments
-    std::size_t _count_remaining_positionals(bool required_only = false) const {
-        std::size_t retval = 0;
-        for(const Option_p &opt : options_) {
-            if(opt->get_positional() && (!required_only || opt->get_required())) {
-                if(opt->get_items_expected_min() > 0 &&
-                   static_cast<int>(opt->count()) < opt->get_items_expected_min()) {
-                    retval += static_cast<std::size_t>(opt->get_items_expected_min()) - opt->count();
-                }
+CLI11_NODISCARD CLI11_INLINE std::size_t App::_count_remaining_positionals(bool required_only) const {
+    std::size_t retval = 0;
+    for(const Option_p &opt : options_) {
+        if(opt->get_positional() && (!required_only || opt->get_required())) {
+            if(opt->get_items_expected_min() > 0 && static_cast<int>(opt->count()) < opt->get_items_expected_min()) {
+                retval += static_cast<std::size_t>(opt->get_items_expected_min()) - opt->count();
             }
         }
-        return retval;
     }
+    return retval;
+}
 
-    /// Count the required remaining positional arguments
-    bool _has_remaining_positionals() const {
-        for(const Option_p &opt : options_) {
-            if(opt->get_positional() && ((static_cast<int>(opt->count()) < opt->get_items_expected_min()))) {
-                return true;
-            }
+CLI11_NODISCARD CLI11_INLINE bool App::_has_remaining_positionals() const {
+    for(const Option_p &opt : options_) {
+        if(opt->get_positional() && ((static_cast<int>(opt->count()) < opt->get_items_expected_min()))) {
+            return true;
         }
-
-        return false;
     }
 
-    /// Parse a positional, go up the tree to check
-    /// @param haltOnSubcommand if set to true the operation will not process subcommands merely return false
-    /// Return true if the positional was used false otherwise
-    bool _parse_positional(std::vector<std::string> &args, bool haltOnSubcommand) {
-
-        const std::string &positional = args.back();
-
-        if(positionals_at_end_) {
-            // deal with the case of required arguments at the end which should take precedence over other arguments
-            auto arg_rem = args.size();
-            auto remreq = _count_remaining_positionals(true);
-            if(arg_rem <= remreq) {
-                for(const Option_p &opt : options_) {
-                    if(opt->get_positional() && opt->required_) {
-                        if(static_cast<int>(opt->count()) < opt->get_items_expected_min()) {
-                            if(validate_positionals_) {
-                                std::string pos = positional;
-                                pos = opt->_validate(pos, 0);
-                                if(!pos.empty()) {
-                                    continue;
-                                }
+    return false;
+}
+
+CLI11_INLINE bool App::_parse_positional(std::vector<std::string> &args, bool haltOnSubcommand) {
+
+    const std::string &positional = args.back();
+    Option *posOpt{nullptr};
+
+    if(positionals_at_end_) {
+        // deal with the case of required arguments at the end which should take precedence over other arguments
+        auto arg_rem = args.size();
+        auto remreq = _count_remaining_positionals(true);
+        if(arg_rem <= remreq) {
+            for(const Option_p &opt : options_) {
+                if(opt->get_positional() && opt->required_) {
+                    if(static_cast<int>(opt->count()) < opt->get_items_expected_min()) {
+                        if(validate_positionals_) {
+                            std::string pos = positional;
+                            pos = opt->_validate(pos, 0);
+                            if(!pos.empty()) {
+                                continue;
                             }
-                            opt->add_result(positional);
-                            parse_order_.push_back(opt.get());
-                            args.pop_back();
-                            return true;
                         }
+                        posOpt = opt.get();
+                        break;
                     }
                 }
             }
         }
+    }
+    if(posOpt == nullptr) {
         for(const Option_p &opt : options_) {
             // Eat options, one by one, until done
             if(opt->get_positional() &&
@@ -7044,482 +9475,540 @@ class App {
                         continue;
                     }
                 }
-                opt->add_result(positional);
-                parse_order_.push_back(opt.get());
-                args.pop_back();
-                return true;
+                posOpt = opt.get();
+                break;
             }
         }
-
-        for(auto &subc : subcommands_) {
-            if((subc->name_.empty()) && (!subc->disabled_)) {
-                if(subc->_parse_positional(args, false)) {
-                    if(!subc->pre_parse_called_) {
-                        subc->_trigger_pre_parse(args.size());
-                    }
-                    return true;
-                }
+    }
+    if(posOpt != nullptr) {
+        parse_order_.push_back(posOpt);
+        if(posOpt->get_inject_separator()) {
+            if(!posOpt->results().empty() && !posOpt->results().back().empty()) {
+                posOpt->add_result(std::string{});
             }
         }
-        // let the parent deal with it if possible
-        if(parent_ != nullptr && fallthrough_)
-            return _get_fallthrough_parent()->_parse_positional(args, static_cast<bool>(parse_complete_callback_));
-
-        /// Try to find a local subcommand that is repeated
-        auto com = _find_subcommand(args.back(), true, false);
-        if(com != nullptr && (require_subcommand_max_ == 0 || require_subcommand_max_ > parsed_subcommands_.size())) {
-            if(haltOnSubcommand) {
-                return false;
-            }
-            args.pop_back();
-            com->_parse(args);
-            return true;
+        if(posOpt->get_trigger_on_parse() && posOpt->current_option_state_ == Option::option_state::callback_run) {
+            posOpt->clear();
         }
-        /// now try one last gasp at subcommands that have been executed before, go to root app and try to find a
-        /// subcommand in a broader way, if one exists let the parent deal with it
-        auto parent_app = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
-        com = parent_app->_find_subcommand(args.back(), true, false);
-        if(com != nullptr && (com->parent_->require_subcommand_max_ == 0 ||
-                              com->parent_->require_subcommand_max_ > com->parent_->parsed_subcommands_.size())) {
-            return false;
+        posOpt->add_result(positional);
+        if(posOpt->get_trigger_on_parse()) {
+            posOpt->run_callback();
         }
 
-        if(positionals_at_end_) {
-            throw CLI::ExtrasError(name_, args);
-        }
-        /// If this is an option group don't deal with it
-        if(parent_ != nullptr && name_.empty()) {
-            return false;
-        }
-        /// We are out of other options this goes to missing
-        _move_to_missing(detail::Classifier::NONE, positional);
         args.pop_back();
-        if(prefix_command_) {
-            while(!args.empty()) {
-                _move_to_missing(detail::Classifier::NONE, args.back());
-                args.pop_back();
+        return true;
+    }
+
+    for(auto &subc : subcommands_) {
+        if((subc->name_.empty()) && (!subc->disabled_)) {
+            if(subc->_parse_positional(args, false)) {
+                if(!subc->pre_parse_called_) {
+                    subc->_trigger_pre_parse(args.size());
+                }
+                return true;
             }
         }
+    }
+    // let the parent deal with it if possible
+    if(parent_ != nullptr && fallthrough_)
+        return _get_fallthrough_parent()->_parse_positional(args, static_cast<bool>(parse_complete_callback_));
 
+    /// Try to find a local subcommand that is repeated
+    auto *com = _find_subcommand(args.back(), true, false);
+    if(com != nullptr && (require_subcommand_max_ == 0 || require_subcommand_max_ > parsed_subcommands_.size())) {
+        if(haltOnSubcommand) {
+            return false;
+        }
+        args.pop_back();
+        com->_parse(args);
         return true;
     }
+    /// now try one last gasp at subcommands that have been executed before, go to root app and try to find a
+    /// subcommand in a broader way, if one exists let the parent deal with it
+    auto *parent_app = (parent_ != nullptr) ? _get_fallthrough_parent() : this;
+    com = parent_app->_find_subcommand(args.back(), true, false);
+    if(com != nullptr && (com->parent_->require_subcommand_max_ == 0 ||
+                          com->parent_->require_subcommand_max_ > com->parent_->parsed_subcommands_.size())) {
+        return false;
+    }
 
-    /// Locate a subcommand by name with two conditions, should disabled subcommands be ignored, and should used
-    /// subcommands be ignored
-    App *_find_subcommand(const std::string &subc_name, bool ignore_disabled, bool ignore_used) const noexcept {
-        for(const App_p &com : subcommands_) {
-            if(com->disabled_ && ignore_disabled)
-                continue;
-            if(com->get_name().empty()) {
-                auto subc = com->_find_subcommand(subc_name, ignore_disabled, ignore_used);
-                if(subc != nullptr) {
-                    return subc;
-                }
-            }
-            if(com->check_name(subc_name)) {
-                if((!*com) || !ignore_used)
-                    return com.get();
+    if(positionals_at_end_) {
+        throw CLI::ExtrasError(name_, args);
+    }
+    /// If this is an option group don't deal with it
+    if(parent_ != nullptr && name_.empty()) {
+        return false;
+    }
+    /// We are out of other options this goes to missing
+    _move_to_missing(detail::Classifier::NONE, positional);
+    args.pop_back();
+    if(prefix_command_) {
+        while(!args.empty()) {
+            _move_to_missing(detail::Classifier::NONE, args.back());
+            args.pop_back();
+        }
+    }
+
+    return true;
+}
+
+CLI11_NODISCARD CLI11_INLINE App *
+App::_find_subcommand(const std::string &subc_name, bool ignore_disabled, bool ignore_used) const noexcept {
+    for(const App_p &com : subcommands_) {
+        if(com->disabled_ && ignore_disabled)
+            continue;
+        if(com->get_name().empty()) {
+            auto *subc = com->_find_subcommand(subc_name, ignore_disabled, ignore_used);
+            if(subc != nullptr) {
+                return subc;
             }
         }
-        return nullptr;
+        if(com->check_name(subc_name)) {
+            if((!*com) || !ignore_used)
+                return com.get();
+        }
     }
+    return nullptr;
+}
 
-    /// Parse a subcommand, modify args and continue
-    ///
-    /// Unlike the others, this one will always allow fallthrough
-    /// return true if the subcommand was processed false otherwise
-    bool _parse_subcommand(std::vector<std::string> &args) {
-        if(_count_remaining_positionals(/* required */ true) > 0) {
-            _parse_positional(args, false);
-            return true;
+CLI11_INLINE bool App::_parse_subcommand(std::vector<std::string> &args) {
+    if(_count_remaining_positionals(/* required */ true) > 0) {
+        _parse_positional(args, false);
+        return true;
+    }
+    auto *com = _find_subcommand(args.back(), true, true);
+    if(com == nullptr) {
+        // the main way to get here is using .notation
+        auto dotloc = args.back().find_first_of('.');
+        if(dotloc != std::string::npos) {
+            com = _find_subcommand(args.back().substr(0, dotloc), true, true);
+            if(com != nullptr) {
+                args.back() = args.back().substr(dotloc + 1);
+                args.push_back(com->get_display_name());
+            }
         }
-        auto com = _find_subcommand(args.back(), true, true);
-        if(com != nullptr) {
-            args.pop_back();
+    }
+    if(com != nullptr) {
+        args.pop_back();
+        if(!com->silent_) {
             parsed_subcommands_.push_back(com);
-            com->_parse(args);
-            auto parent_app = com->parent_;
-            while(parent_app != this) {
-                parent_app->_trigger_pre_parse(args.size());
+        }
+        com->_parse(args);
+        auto *parent_app = com->parent_;
+        while(parent_app != this) {
+            parent_app->_trigger_pre_parse(args.size());
+            if(!com->silent_) {
                 parent_app->parsed_subcommands_.push_back(com);
-                parent_app = parent_app->parent_;
             }
-            return true;
+            parent_app = parent_app->parent_;
         }
-
-        if(parent_ == nullptr)
-            throw HorribleError("Subcommand " + args.back() + " missing");
-        return false;
+        return true;
     }
 
-    /// Parse a short (false) or long (true) argument, must be at the top of the list
-    /// return true if the argument was processed or false if nothing was done
-    bool _parse_arg(std::vector<std::string> &args, detail::Classifier current_type) {
+    if(parent_ == nullptr)
+        throw HorribleError("Subcommand " + args.back() + " missing");
+    return false;
+}
 
-        std::string current = args.back();
+CLI11_INLINE bool
+App::_parse_arg(std::vector<std::string> &args, detail::Classifier current_type, bool local_processing_only) {
+
+    std::string current = args.back();
+
+    std::string arg_name;
+    std::string value;
+    std::string rest;
+
+    switch(current_type) {
+    case detail::Classifier::LONG:
+        if(!detail::split_long(current, arg_name, value))
+            throw HorribleError("Long parsed but missing (you should not see this):" + args.back());
+        break;
+    case detail::Classifier::SHORT:
+        if(!detail::split_short(current, arg_name, rest))
+            throw HorribleError("Short parsed but missing! You should not see this");
+        break;
+    case detail::Classifier::WINDOWS_STYLE:
+        if(!detail::split_windows_style(current, arg_name, value))
+            throw HorribleError("windows option parsed but missing! You should not see this");
+        break;
+    case detail::Classifier::SUBCOMMAND:
+    case detail::Classifier::SUBCOMMAND_TERMINATOR:
+    case detail::Classifier::POSITIONAL_MARK:
+    case detail::Classifier::NONE:
+    default:
+        throw HorribleError("parsing got called with invalid option! You should not see this");
+    }
 
-        std::string arg_name;
-        std::string value;
-        std::string rest;
+    auto op_ptr = std::find_if(std::begin(options_), std::end(options_), [arg_name, current_type](const Option_p &opt) {
+        if(current_type == detail::Classifier::LONG)
+            return opt->check_lname(arg_name);
+        if(current_type == detail::Classifier::SHORT)
+            return opt->check_sname(arg_name);
+        // this will only get called for detail::Classifier::WINDOWS_STYLE
+        return opt->check_lname(arg_name) || opt->check_sname(arg_name);
+    });
 
-        switch(current_type) {
-        case detail::Classifier::LONG:
-            if(!detail::split_long(current, arg_name, value))
-                throw HorribleError("Long parsed but missing (you should not see this):" + args.back());
-            break;
-        case detail::Classifier::SHORT:
-            if(!detail::split_short(current, arg_name, rest))
-                throw HorribleError("Short parsed but missing! You should not see this");
-            break;
-        case detail::Classifier::WINDOWS:
-            if(!detail::split_windows_style(current, arg_name, value))
-                throw HorribleError("windows option parsed but missing! You should not see this");
-            break;
-        case detail::Classifier::SUBCOMMAND:
-        case detail::Classifier::SUBCOMMAND_TERMINATOR:
-        case detail::Classifier::POSITIONAL_MARK:
-        case detail::Classifier::NONE:
-        default:
-            throw HorribleError("parsing got called with invalid option! You should not see this");
+    // Option not found
+    if(op_ptr == std::end(options_)) {
+        for(auto &subc : subcommands_) {
+            if(subc->name_.empty() && !subc->disabled_) {
+                if(subc->_parse_arg(args, current_type, local_processing_only)) {
+                    if(!subc->pre_parse_called_) {
+                        subc->_trigger_pre_parse(args.size());
+                    }
+                    return true;
+                }
+            }
         }
 
-        auto op_ptr =
-            std::find_if(std::begin(options_), std::end(options_), [arg_name, current_type](const Option_p &opt) {
-              if(current_type == detail::Classifier::LONG)
-                  return opt->check_lname(arg_name);
-              if(current_type == detail::Classifier::SHORT)
-                  return opt->check_sname(arg_name);
-              // this will only get called for detail::Classifier::WINDOWS
-              return opt->check_lname(arg_name) || opt->check_sname(arg_name);
-            });
+        // don't capture missing if this is a nameless subcommand and nameless subcommands can't fallthrough
+        if(parent_ != nullptr && name_.empty()) {
+            return false;
+        }
 
-        // Option not found
-        if(op_ptr == std::end(options_)) {
-            for(auto &subc : subcommands_) {
-                if(subc->name_.empty() && !subc->disabled_) {
-                    if(subc->_parse_arg(args, current_type)) {
-                        if(!subc->pre_parse_called_) {
-                            subc->_trigger_pre_parse(args.size());
-                        }
-                        return true;
+        // now check for '.' notation of subcommands
+        auto dotloc = arg_name.find_first_of('.', 1);
+        if(dotloc != std::string::npos) {
+            // using dot notation is equivalent to single argument subcommand
+            auto *sub = _find_subcommand(arg_name.substr(0, dotloc), true, false);
+            if(sub != nullptr) {
+                auto v = args.back();
+                args.pop_back();
+                arg_name = arg_name.substr(dotloc + 1);
+                if(arg_name.size() > 1) {
+                    args.push_back(std::string("--") + v.substr(dotloc + 3));
+                    current_type = detail::Classifier::LONG;
+                } else {
+                    auto nval = v.substr(dotloc + 2);
+                    nval.front() = '-';
+                    if(nval.size() > 2) {
+                        // '=' not allowed in short form arguments
+                        args.push_back(nval.substr(3));
+                        nval.resize(2);
                     }
+                    args.push_back(nval);
+                    current_type = detail::Classifier::SHORT;
                 }
+                auto val = sub->_parse_arg(args, current_type, true);
+                if(val) {
+                    if(!sub->silent_) {
+                        parsed_subcommands_.push_back(sub);
+                    }
+                    // deal with preparsing
+                    increment_parsed();
+                    _trigger_pre_parse(args.size());
+                    // run the parse complete callback since the subcommand processing is now complete
+                    if(sub->parse_complete_callback_) {
+                        sub->_process_env();
+                        sub->_process_callbacks();
+                        sub->_process_help_flags();
+                        sub->_process_requirements();
+                        sub->run_callback(false, true);
+                    }
+                    return true;
+                }
+                args.pop_back();
+                args.push_back(v);
             }
-            // If a subcommand, try the master command
-            if(parent_ != nullptr && fallthrough_)
-                return _get_fallthrough_parent()->_parse_arg(args, current_type);
-            // don't capture missing if this is a nameless subcommand
-            if(parent_ != nullptr && name_.empty()) {
-                return false;
-            }
-            // Otherwise, add to missing
-            args.pop_back();
-            _move_to_missing(current_type, current);
-            return true;
         }
+        if(local_processing_only) {
+            return false;
+        }
+        // If a subcommand, try the main command
+        if(parent_ != nullptr && fallthrough_)
+            return _get_fallthrough_parent()->_parse_arg(args, current_type, false);
 
+        // Otherwise, add to missing
         args.pop_back();
+        _move_to_missing(current_type, current);
+        return true;
+    }
 
-        // Get a reference to the pointer to make syntax bearable
-        Option_p &op = *op_ptr;
-
-        int min_num = (std::min)(op->get_type_size_min(), op->get_items_expected_min());
-        int max_num = op->get_items_expected_max();
-
-        // Make sure we always eat the minimum for unlimited vectors
-        int collected = 0;     // total number of arguments collected
-        int result_count = 0;  // local variable for number of results in a single arg string
-        // deal with purely flag like things
-        if(max_num == 0) {
-            auto res = op->get_flag_value(arg_name, value);
-            op->add_result(res);
-            parse_order_.push_back(op.get());
-        } else if(!value.empty()) {  // --this=value
-            op->add_result(value, result_count);
-            parse_order_.push_back(op.get());
-            collected += result_count;
-            // -Trest
-        } else if(!rest.empty()) {
-            op->add_result(rest, result_count);
-            parse_order_.push_back(op.get());
-            rest = "";
-            collected += result_count;
-        }
+    args.pop_back();
 
-        // gather the minimum number of arguments
-        while(min_num > collected && !args.empty()) {
-            std::string current_ = args.back();
-            args.pop_back();
-            op->add_result(current_, result_count);
-            parse_order_.push_back(op.get());
-            collected += result_count;
+    // Get a reference to the pointer to make syntax bearable
+    Option_p &op = *op_ptr;
+    /// if we require a separator add it here
+    if(op->get_inject_separator()) {
+        if(!op->results().empty() && !op->results().back().empty()) {
+            op->add_result(std::string{});
         }
+    }
+    if(op->get_trigger_on_parse() && op->current_option_state_ == Option::option_state::callback_run) {
+        op->clear();
+    }
+    int min_num = (std::min)(op->get_type_size_min(), op->get_items_expected_min());
+    int max_num = op->get_items_expected_max();
+    // check container like options to limit the argument size to a single type if the allow_extra_flags argument is
+    // set. 16 is somewhat arbitrary (needs to be at least 4)
+    if(max_num >= detail::expected_max_vector_size / 16 && !op->get_allow_extra_args()) {
+        auto tmax = op->get_type_size_max();
+        max_num = detail::checked_multiply(tmax, op->get_expected_min()) ? tmax : detail::expected_max_vector_size;
+    }
+    // Make sure we always eat the minimum for unlimited vectors
+    int collected = 0;     // total number of arguments collected
+    int result_count = 0;  // local variable for number of results in a single arg string
+    // deal with purely flag like things
+    if(max_num == 0) {
+        auto res = op->get_flag_value(arg_name, value);
+        op->add_result(res);
+        parse_order_.push_back(op.get());
+    } else if(!value.empty()) {  // --this=value
+        op->add_result(value, result_count);
+        parse_order_.push_back(op.get());
+        collected += result_count;
+        // -Trest
+    } else if(!rest.empty()) {
+        op->add_result(rest, result_count);
+        parse_order_.push_back(op.get());
+        rest = "";
+        collected += result_count;
+    }
+
+    // gather the minimum number of arguments
+    while(min_num > collected && !args.empty()) {
+        std::string current_ = args.back();
+        args.pop_back();
+        op->add_result(current_, result_count);
+        parse_order_.push_back(op.get());
+        collected += result_count;
+    }
 
-        if(min_num > collected) {  // if we have run out of arguments and the minimum was not met
-            throw ArgumentMismatch::TypedAtLeast(op->get_name(), min_num, op->get_type_name());
-        }
+    if(min_num > collected) {  // if we have run out of arguments and the minimum was not met
+        throw ArgumentMismatch::TypedAtLeast(op->get_name(), min_num, op->get_type_name());
+    }
 
-        if(max_num > collected || op->get_allow_extra_args()) {  // we allow optional arguments
-            auto remreqpos = _count_remaining_positionals(true);
-            // we have met the minimum now optionally check up to the maximum
-            while((collected < max_num || op->get_allow_extra_args()) && !args.empty() &&
-                  _recognize(args.back(), false) == detail::Classifier::NONE) {
-                // If any required positionals remain, don't keep eating
-                if(remreqpos >= args.size()) {
+    // now check for optional arguments
+    if(max_num > collected || op->get_allow_extra_args()) {  // we allow optional arguments
+        auto remreqpos = _count_remaining_positionals(true);
+        // we have met the minimum now optionally check up to the maximum
+        while((collected < max_num || op->get_allow_extra_args()) && !args.empty() &&
+              _recognize(args.back(), false) == detail::Classifier::NONE) {
+            // If any required positionals remain, don't keep eating
+            if(remreqpos >= args.size()) {
+                break;
+            }
+            if(validate_optional_arguments_) {
+                std::string arg = args.back();
+                arg = op->_validate(arg, 0);
+                if(!arg.empty()) {
                     break;
                 }
-
-                op->add_result(args.back(), result_count);
-                parse_order_.push_back(op.get());
-                args.pop_back();
-                collected += result_count;
-            }
-
-            // Allow -- to end an unlimited list and "eat" it
-            if(!args.empty() && _recognize(args.back()) == detail::Classifier::POSITIONAL_MARK)
-                args.pop_back();
-            // optional flag that didn't receive anything now get the default value
-            if(min_num == 0 && max_num > 0 && collected == 0) {
-                auto res = op->get_flag_value(arg_name, std::string{});
-                op->add_result(res);
-                parse_order_.push_back(op.get());
             }
+            op->add_result(args.back(), result_count);
+            parse_order_.push_back(op.get());
+            args.pop_back();
+            collected += result_count;
         }
 
-        // if we only partially completed a type then add an empty string for later processing
-        if(min_num > 0 && op->get_type_size_max() != min_num && collected % op->get_type_size_max() != 0) {
-            op->add_result(std::string{});
+        // Allow -- to end an unlimited list and "eat" it
+        if(!args.empty() && _recognize(args.back()) == detail::Classifier::POSITIONAL_MARK)
+            args.pop_back();
+        // optional flag that didn't receive anything now get the default value
+        if(min_num == 0 && max_num > 0 && collected == 0) {
+            auto res = op->get_flag_value(arg_name, std::string{});
+            op->add_result(res);
+            parse_order_.push_back(op.get());
         }
-
-        if(!rest.empty()) {
-            rest = "-" + rest;
-            args.push_back(rest);
+    }
+    // if we only partially completed a type then add an empty string if allowed for later processing
+    if(min_num > 0 && (collected % op->get_type_size_max()) != 0) {
+        if(op->get_type_size_max() != op->get_type_size_min()) {
+            op->add_result(std::string{});
+        } else {
+            throw ArgumentMismatch::PartialType(op->get_name(), op->get_type_size_min(), op->get_type_name());
         }
-        return true;
     }
+    if(op->get_trigger_on_parse()) {
+        op->run_callback();
+    }
+    if(!rest.empty()) {
+        rest = "-" + rest;
+        args.push_back(rest);
+    }
+    return true;
+}
 
-    /// Trigger the pre_parse callback if needed
-    void _trigger_pre_parse(std::size_t remaining_args) {
-        if(!pre_parse_called_) {
+CLI11_INLINE void App::_trigger_pre_parse(std::size_t remaining_args) {
+    if(!pre_parse_called_) {
+        pre_parse_called_ = true;
+        if(pre_parse_callback_) {
+            pre_parse_callback_(remaining_args);
+        }
+    } else if(immediate_callback_) {
+        if(!name_.empty()) {
+            auto pcnt = parsed_;
+            missing_t extras = std::move(missing_);
+            clear();
+            parsed_ = pcnt;
             pre_parse_called_ = true;
-            if(pre_parse_callback_) {
-                pre_parse_callback_(remaining_args);
-            }
-        } else if(immediate_callback_) {
-            if(!name_.empty()) {
-                auto pcnt = parsed_;
-                auto extras = std::move(missing_);
-                clear();
-                parsed_ = pcnt;
-                pre_parse_called_ = true;
-                missing_ = std::move(extras);
-            }
+            missing_ = std::move(extras);
         }
     }
+}
 
-    /// Get the appropriate parent to fallthrough to which is the first one that has a name or the main app
-    App *_get_fallthrough_parent() {
-        if(parent_ == nullptr) {
-            throw(HorribleError("No Valid parent"));
-        }
-        auto fallthrough_parent = parent_;
-        while((fallthrough_parent->parent_ != nullptr) && (fallthrough_parent->get_name().empty())) {
-            fallthrough_parent = fallthrough_parent->parent_;
-        }
-        return fallthrough_parent;
+CLI11_INLINE App *App::_get_fallthrough_parent() {
+    if(parent_ == nullptr) {
+        throw(HorribleError("No Valid parent"));
     }
+    auto *fallthrough_parent = parent_;
+    while((fallthrough_parent->parent_ != nullptr) && (fallthrough_parent->get_name().empty())) {
+        fallthrough_parent = fallthrough_parent->parent_;
+    }
+    return fallthrough_parent;
+}
 
-    /// Helper function to run through all possible comparisons of subcommand names to check there is no overlap
-    const std::string &_compare_subcommand_names(const App &subcom, const App &base) const {
-        static const std::string estring;
-        if(subcom.disabled_) {
-            return estring;
-        }
-        for(auto &subc : base.subcommands_) {
-            if(subc.get() != &subcom) {
-                if(subc->disabled_) {
-                    continue;
-                }
-                if(!subcom.get_name().empty()) {
-                    if(subc->check_name(subcom.get_name())) {
-                        return subcom.get_name();
-                    }
+CLI11_NODISCARD CLI11_INLINE const std::string &App::_compare_subcommand_names(const App &subcom,
+                                                                               const App &base) const {
+    static const std::string estring;
+    if(subcom.disabled_) {
+        return estring;
+    }
+    for(const auto &subc : base.subcommands_) {
+        if(subc.get() != &subcom) {
+            if(subc->disabled_) {
+                continue;
+            }
+            if(!subcom.get_name().empty()) {
+                if(subc->check_name(subcom.get_name())) {
+                    return subcom.get_name();
                 }
-                if(!subc->get_name().empty()) {
-                    if(subcom.check_name(subc->get_name())) {
-                        return subc->get_name();
-                    }
+            }
+            if(!subc->get_name().empty()) {
+                if(subcom.check_name(subc->get_name())) {
+                    return subc->get_name();
                 }
-                for(const auto &les : subcom.aliases_) {
-                    if(subc->check_name(les)) {
-                        return les;
-                    }
+            }
+            for(const auto &les : subcom.aliases_) {
+                if(subc->check_name(les)) {
+                    return les;
                 }
-                // this loop is needed in case of ignore_underscore or ignore_case on one but not the other
-                for(const auto &les : subc->aliases_) {
-                    if(subcom.check_name(les)) {
-                        return les;
-                    }
+            }
+            // this loop is needed in case of ignore_underscore or ignore_case on one but not the other
+            for(const auto &les : subc->aliases_) {
+                if(subcom.check_name(les)) {
+                    return les;
                 }
-                // if the subcommand is an option group we need to check deeper
-                if(subc->get_name().empty()) {
-                    auto &cmpres = _compare_subcommand_names(subcom, *subc);
-                    if(!cmpres.empty()) {
-                        return cmpres;
-                    }
+            }
+            // if the subcommand is an option group we need to check deeper
+            if(subc->get_name().empty()) {
+                const auto &cmpres = _compare_subcommand_names(subcom, *subc);
+                if(!cmpres.empty()) {
+                    return cmpres;
                 }
-                // if the test subcommand is an option group we need to check deeper
-                if(subcom.get_name().empty()) {
-                    auto &cmpres = _compare_subcommand_names(*subc, subcom);
-                    if(!cmpres.empty()) {
-                        return cmpres;
-                    }
+            }
+            // if the test subcommand is an option group we need to check deeper
+            if(subcom.get_name().empty()) {
+                const auto &cmpres = _compare_subcommand_names(*subc, subcom);
+                if(!cmpres.empty()) {
+                    return cmpres;
                 }
             }
         }
-        return estring;
     }
-    /// Helper function to place extra values in the most appropriate position
-    void _move_to_missing(detail::Classifier val_type, const std::string &val) {
-        if(allow_extras_ || subcommands_.empty()) {
-            missing_.emplace_back(val_type, val);
+    return estring;
+}
+
+CLI11_INLINE void App::_move_to_missing(detail::Classifier val_type, const std::string &val) {
+    if(allow_extras_ || subcommands_.empty()) {
+        missing_.emplace_back(val_type, val);
+        return;
+    }
+    // allow extra arguments to be places in an option group if it is allowed there
+    for(auto &subc : subcommands_) {
+        if(subc->name_.empty() && subc->allow_extras_) {
+            subc->missing_.emplace_back(val_type, val);
             return;
         }
-        // allow extra arguments to be places in an option group if it is allowed there
-        for(auto &subc : subcommands_) {
-            if(subc->name_.empty() && subc->allow_extras_) {
-                subc->missing_.emplace_back(val_type, val);
-                return;
-            }
-        }
-        // if we haven't found any place to put them yet put them in missing
-        missing_.emplace_back(val_type, val);
     }
+    // if we haven't found any place to put them yet put them in missing
+    missing_.emplace_back(val_type, val);
+}
 
-  public:
-    /// function that could be used by subclasses of App to shift options around into subcommands
-    void _move_option(Option *opt, App *app) {
-        if(opt == nullptr) {
-            throw OptionNotFound("the option is NULL");
-        }
-        // verify that the give app is actually a subcommand
-        bool found = false;
-        for(auto &subc : subcommands_) {
-            if(app == subc.get()) {
-                found = true;
-            }
-        }
-        if(!found) {
-            throw OptionNotFound("The Given app is not a subcommand");
+CLI11_INLINE void App::_move_option(Option *opt, App *app) {
+    if(opt == nullptr) {
+        throw OptionNotFound("the option is NULL");
+    }
+    // verify that the give app is actually a subcommand
+    bool found = false;
+    for(auto &subc : subcommands_) {
+        if(app == subc.get()) {
+            found = true;
         }
+    }
+    if(!found) {
+        throw OptionNotFound("The Given app is not a subcommand");
+    }
 
-        if((help_ptr_ == opt) || (help_all_ptr_ == opt))
-            throw OptionAlreadyAdded("cannot move help options");
+    if((help_ptr_ == opt) || (help_all_ptr_ == opt))
+        throw OptionAlreadyAdded("cannot move help options");
 
-        if(config_ptr_ == opt)
-            throw OptionAlreadyAdded("cannot move config file options");
+    if(config_ptr_ == opt)
+        throw OptionAlreadyAdded("cannot move config file options");
 
-        auto iterator =
-            std::find_if(std::begin(options_), std::end(options_), [opt](const Option_p &v) { return v.get() == opt; });
-        if(iterator != std::end(options_)) {
-            const auto &opt_p = *iterator;
-            if(std::find_if(std::begin(app->options_), std::end(app->options_), [&opt_p](const Option_p &v) {
-              return (*v == *opt_p);
-            }) == std::end(app->options_)) {
-                // only erase after the insertion was successful
-                app->options_.push_back(std::move(*iterator));
-                options_.erase(iterator);
-            } else {
-                throw OptionAlreadyAdded("option was not located: " + opt->get_name());
-            }
+    auto iterator =
+        std::find_if(std::begin(options_), std::end(options_), [opt](const Option_p &v) { return v.get() == opt; });
+    if(iterator != std::end(options_)) {
+        const auto &opt_p = *iterator;
+        if(std::find_if(std::begin(app->options_), std::end(app->options_), [&opt_p](const Option_p &v) {
+               return (*v == *opt_p);
+           }) == std::end(app->options_)) {
+            // only erase after the insertion was successful
+            app->options_.push_back(std::move(*iterator));
+            options_.erase(iterator);
         } else {
-            throw OptionNotFound("could not locate the given Option");
+            throw OptionAlreadyAdded("option was not located: " + opt->get_name());
         }
+    } else {
+        throw OptionNotFound("could not locate the given Option");
     }
-};  // namespace CLI
+}
 
-/// Extension of App to better manage groups of options
-class Option_group : public App {
-  public:
-    Option_group(std::string group_description, std::string group_name, App *parent)
-        : App(std::move(group_description), "", parent) {
-        group(group_name);
-        // option groups should have automatic fallthrough
-    }
-    using App::add_option;
-    /// Add an existing option to the Option_group
-    Option *add_option(Option *opt) {
-        if(get_parent() == nullptr) {
-            throw OptionNotFound("Unable to locate the specified option");
-        }
-        get_parent()->_move_option(opt, this);
-        return opt;
-    }
-    /// Add an existing option to the Option_group
-    void add_options(Option *opt) { add_option(opt); }
-    /// Add a bunch of options to the group
-    template <typename... Args> void add_options(Option *opt, Args... args) {
-        add_option(opt);
-        add_options(args...);
-    }
-    using App::add_subcommand;
-    /// Add an existing subcommand to be a member of an option_group
-    App *add_subcommand(App *subcom) {
-        App_p subc = subcom->get_parent()->get_subcommand_ptr(subcom);
-        subc->get_parent()->remove_subcommand(subcom);
-        add_subcommand(std::move(subc));
-        return subcom;
-    }
-};
-/// Helper function to enable one option group/subcommand when another is used
-inline void TriggerOn(App *trigger_app, App *app_to_enable) {
+CLI11_INLINE void TriggerOn(App *trigger_app, App *app_to_enable) {
     app_to_enable->enabled_by_default(false);
     app_to_enable->disabled_by_default();
     trigger_app->preparse_callback([app_to_enable](std::size_t) { app_to_enable->disabled(false); });
 }
 
-/// Helper function to enable one option group/subcommand when another is used
-inline void TriggerOn(App *trigger_app, std::vector<App *> apps_to_enable) {
+CLI11_INLINE void TriggerOn(App *trigger_app, std::vector<App *> apps_to_enable) {
     for(auto &app : apps_to_enable) {
         app->enabled_by_default(false);
         app->disabled_by_default();
     }
 
     trigger_app->preparse_callback([apps_to_enable](std::size_t) {
-      for(auto &app : apps_to_enable) {
-          app->disabled(false);
-      }
+        for(const auto &app : apps_to_enable) {
+            app->disabled(false);
+        }
     });
 }
 
-/// Helper function to disable one option group/subcommand when another is used
-inline void TriggerOff(App *trigger_app, App *app_to_enable) {
+CLI11_INLINE void TriggerOff(App *trigger_app, App *app_to_enable) {
     app_to_enable->disabled_by_default(false);
     app_to_enable->enabled_by_default();
     trigger_app->preparse_callback([app_to_enable](std::size_t) { app_to_enable->disabled(); });
 }
 
-/// Helper function to disable one option group/subcommand when another is used
-inline void TriggerOff(App *trigger_app, std::vector<App *> apps_to_enable) {
+CLI11_INLINE void TriggerOff(App *trigger_app, std::vector<App *> apps_to_enable) {
     for(auto &app : apps_to_enable) {
         app->disabled_by_default(false);
         app->enabled_by_default();
     }
 
     trigger_app->preparse_callback([apps_to_enable](std::size_t) {
-      for(auto &app : apps_to_enable) {
-          app->disabled();
-      }
+        for(const auto &app : apps_to_enable) {
+            app->disabled();
+        }
     });
 }
 
-/// Helper function to mark an option as deprecated
-inline void deprecate_option(Option *opt, const std::string &replacement = "") {
+CLI11_INLINE void deprecate_option(Option *opt, const std::string &replacement) {
     Validator deprecate_warning{[opt, replacement](std::string &) {
-      std::cout << opt->get_name() << " is deprecated please use '" << replacement
-                << "' instead\n";
-      return std::string();
-    },
+                                    std::cout << opt->get_name() << " is deprecated please use '" << replacement
+                                              << "' instead\n";
+                                    return std::string();
+                                },
                                 "DEPRECATED"};
     deprecate_warning.application_index(0);
     opt->check(deprecate_warning);
@@ -7528,74 +10017,57 @@ inline void deprecate_option(Option *opt, const std::string &replacement = "") {
     }
 }
 
-/// Helper function to mark an option as deprecated
-inline void deprecate_option(App *app, const std::string &option_name, const std::string &replacement = "") {
-    auto opt = app->get_option(option_name);
-    deprecate_option(opt, replacement);
-}
-
-/// Helper function to mark an option as deprecated
-inline void deprecate_option(App &app, const std::string &option_name, const std::string &replacement = "") {
-    auto opt = app.get_option(option_name);
-    deprecate_option(opt, replacement);
-}
-
-/// Helper function to mark an option as retired
-inline void retire_option(App *app, Option *opt) {
+CLI11_INLINE void retire_option(App *app, Option *opt) {
     App temp;
-    auto option_copy = temp.add_option(opt->get_name(false, true))
-        ->type_size(opt->get_type_size_min(), opt->get_type_size_max())
-        ->expected(opt->get_expected_min(), opt->get_expected_max())
-        ->allow_extra_args(opt->get_allow_extra_args());
+    auto *option_copy = temp.add_option(opt->get_name(false, true))
+                            ->type_size(opt->get_type_size_min(), opt->get_type_size_max())
+                            ->expected(opt->get_expected_min(), opt->get_expected_max())
+                            ->allow_extra_args(opt->get_allow_extra_args());
 
     app->remove_option(opt);
-    auto opt2 = app->add_option(option_copy->get_name(false, true), "option has been retired and has no effect")
-        ->type_name("RETIRED")
+    auto *opt2 = app->add_option(option_copy->get_name(false, true), "option has been retired and has no effect");
+    opt2->type_name("RETIRED")
         ->default_str("RETIRED")
         ->type_size(option_copy->get_type_size_min(), option_copy->get_type_size_max())
         ->expected(option_copy->get_expected_min(), option_copy->get_expected_max())
         ->allow_extra_args(option_copy->get_allow_extra_args());
 
     Validator retired_warning{[opt2](std::string &) {
-      std::cout << "WARNING " << opt2->get_name() << " is retired and has no effect\n";
-      return std::string();
-    },
+                                  std::cout << "WARNING " << opt2->get_name() << " is retired and has no effect\n";
+                                  return std::string();
+                              },
                               ""};
     retired_warning.application_index(0);
     opt2->check(retired_warning);
 }
 
-/// Helper function to mark an option as retired
-inline void retire_option(App &app, Option *opt) { retire_option(&app, opt); }
+CLI11_INLINE void retire_option(App &app, Option *opt) { retire_option(&app, opt); }
 
-/// Helper function to mark an option as retired
-inline void retire_option(App *app, const std::string &option_name) {
+CLI11_INLINE void retire_option(App *app, const std::string &option_name) {
 
-    auto opt = app->get_option_no_throw(option_name);
+    auto *opt = app->get_option_no_throw(option_name);
     if(opt != nullptr) {
         retire_option(app, opt);
         return;
     }
-    auto opt2 = app->add_option(option_name, "option has been retired and has no effect")
-        ->type_name("RETIRED")
-        ->expected(0, 1)
-        ->default_str("RETIRED");
+    auto *opt2 = app->add_option(option_name, "option has been retired and has no effect")
+                     ->type_name("RETIRED")
+                     ->expected(0, 1)
+                     ->default_str("RETIRED");
     Validator retired_warning{[opt2](std::string &) {
-      std::cout << "WARNING " << opt2->get_name() << " is retired and has no effect\n";
-      return std::string();
-    },
+                                  std::cout << "WARNING " << opt2->get_name() << " is retired and has no effect\n";
+                                  return std::string();
+                              },
                               ""};
     retired_warning.application_index(0);
     opt2->check(retired_warning);
 }
 
-/// Helper function to mark an option as retired
-inline void retire_option(App &app, const std::string &option_name) { retire_option(&app, option_name); }
+CLI11_INLINE void retire_option(App &app, const std::string &option_name) { retire_option(&app, option_name); }
 
 namespace FailureMessage {
 
-/// Printout a clean, simple message on error (the default in CLI11 1.5+)
-inline std::string simple(const App *app, const Error &e) {
+CLI11_INLINE std::string simple(const App *app, const Error &e) {
     std::string header = std::string(e.what()) + "\n";
     std::vector<std::string> names;
 
@@ -7613,8 +10085,7 @@ inline std::string simple(const App *app, const Error &e) {
     return header;
 }
 
-/// Printout the full help string on error (if this fn is set, the old default for CLI11)
-inline std::string help(const App *app, const Error &e) {
+CLI11_INLINE std::string help(const App *app, const Error &e) {
     std::string header = std::string("ERROR: ") + e.get_name() + ": " + e.what() + "\n";
     header += app->help();
     return header;
@@ -7622,51 +10093,50 @@ inline std::string help(const App *app, const Error &e) {
 
 }  // namespace FailureMessage
 
+
+
+
 namespace detail {
-/// This class is simply to allow tests access to App's protected functions
-struct AppFriend {
-#ifdef CLI11_CPP14
 
-    /// Wrap _parse_short, perfectly forward arguments and return
-    template <typename... Args> static decltype(auto) parse_arg(App *app, Args &&... args) {
-        return app->_parse_arg(std::forward<Args>(args)...);
-    }
+std::string convert_arg_for_ini(const std::string &arg,
+                                char stringQuote = '"',
+                                char literalQuote = '\'',
+                                bool disable_multi_line = false);
 
-    /// Wrap _parse_subcommand, perfectly forward arguments and return
-    template <typename... Args> static decltype(auto) parse_subcommand(App *app, Args &&... args) {
-        return app->_parse_subcommand(std::forward<Args>(args)...);
-    }
-#else
-    /// Wrap _parse_short, perfectly forward arguments and return
-    template <typename... Args>
-    static auto parse_arg(App *app, Args &&... args) ->
-        typename std::result_of<decltype (&App::_parse_arg)(App, Args...)>::type {
-        return app->_parse_arg(std::forward<Args>(args)...);
-    }
+/// Comma separated join, adds quotes if needed
+std::string ini_join(const std::vector<std::string> &args,
+                     char sepChar = ',',
+                     char arrayStart = '[',
+                     char arrayEnd = ']',
+                     char stringQuote = '"',
+                     char literalQuote = '\'');
 
-    /// Wrap _parse_subcommand, perfectly forward arguments and return
-    template <typename... Args>
-    static auto parse_subcommand(App *app, Args &&... args) ->
-        typename std::result_of<decltype (&App::_parse_subcommand)(App, Args...)>::type {
-        return app->_parse_subcommand(std::forward<Args>(args)...);
-    }
-#endif
-    /// Wrap the fallthrough parent function to make sure that is working correctly
-    static App *get_fallthrough_parent(App *app) { return app->_get_fallthrough_parent(); }
-};
+void clean_name_string(std::string &name, const std::string &keyChars);
+
+std::vector<std::string> generate_parents(const std::string &section, std::string &name, char parentSeparator);
+
+/// assuming non default segments do a check on the close and open of the segments in a configItem structure
+void checkParentSegments(std::vector<ConfigItem> &output, const std::string &currentSection, char parentSeparator);
 }  // namespace detail
 
-}  // namespace CLI
 
-// From Config.hpp:
 
-namespace CLI {
+
+static constexpr auto multiline_literal_quote = R"(''')";
+static constexpr auto multiline_string_quote = R"(""")";
 
 namespace detail {
 
-inline std::string convert_arg_for_ini(const std::string &arg) {
+CLI11_INLINE bool is_printable(const std::string &test_string) {
+    return std::all_of(test_string.begin(), test_string.end(), [](char x) {
+        return (isprint(static_cast<unsigned char>(x)) != 0 || x == '\n' || x == '\t');
+    });
+}
+
+CLI11_INLINE std::string
+convert_arg_for_ini(const std::string &arg, char stringQuote, char literalQuote, bool disable_multi_line) {
     if(arg.empty()) {
-        return std::string(2, '"');
+        return std::string(2, stringQuote);
     }
     // some specifically supported strings
     if(arg == "true" || arg == "false" || arg == "nan" || arg == "inf") {
@@ -7674,21 +10144,30 @@ inline std::string convert_arg_for_ini(const std::string &arg) {
     }
     // floating point conversion can convert some hex codes, but don't try that here
     if(arg.compare(0, 2, "0x") != 0 && arg.compare(0, 2, "0X") != 0) {
-        double val;
-        if(detail::lexical_cast(arg, val)) {
-            return arg;
+        using CLI::detail::lexical_cast;
+        double val = 0.0;
+        if(lexical_cast(arg, val)) {
+            if(arg.find_first_not_of("0123456789.-+eE") == std::string::npos) {
+                return arg;
+            }
         }
     }
     // just quote a single non numeric character
     if(arg.size() == 1) {
-        return std::string("'") + arg + '\'';
+        if(isprint(static_cast<unsigned char>(arg.front())) == 0) {
+            return binary_escape_string(arg);
+        }
+        if(arg == "'") {
+            return std::string(1, stringQuote) + "'" + stringQuote;
+        }
+        return std::string(1, literalQuote) + arg + literalQuote;
     }
     // handle hex, binary or octal arguments
     if(arg.front() == '0') {
         if(arg[1] == 'x') {
             if(std::all_of(arg.begin() + 2, arg.end(), [](char x) {
-              return (x >= '0' && x <= '9') || (x >= 'A' && x <= 'F') || (x >= 'a' && x <= 'f');
-            })) {
+                   return (x >= '0' && x <= '9') || (x >= 'A' && x <= 'F') || (x >= 'a' && x <= 'f');
+               })) {
                 return arg;
             }
         } else if(arg[1] == 'o') {
@@ -7701,29 +10180,39 @@ inline std::string convert_arg_for_ini(const std::string &arg) {
             }
         }
     }
-    if(arg.find_first_of('"') == std::string::npos) {
-        return std::string("\"") + arg + '"';
-    } else {
-        return std::string("'") + arg + '\'';
+    if(!is_printable(arg)) {
+        return binary_escape_string(arg);
     }
+    if(detail::has_escapable_character(arg)) {
+        if(arg.size() > 100 && !disable_multi_line) {
+            return std::string(multiline_literal_quote) + arg + multiline_literal_quote;
+        }
+        return std::string(1, stringQuote) + detail::add_escaped_characters(arg) + stringQuote;
+    }
+    return std::string(1, stringQuote) + arg + stringQuote;
 }
 
-/// Comma separated join, adds quotes if needed
-inline std::string
-ini_join(const std::vector<std::string> &args, char sepChar = ',', char arrayStart = '[', char arrayEnd = ']') {
+CLI11_INLINE std::string ini_join(const std::vector<std::string> &args,
+                                  char sepChar,
+                                  char arrayStart,
+                                  char arrayEnd,
+                                  char stringQuote,
+                                  char literalQuote) {
+    bool disable_multi_line{false};
     std::string joined;
     if(args.size() > 1 && arrayStart != '\0') {
         joined.push_back(arrayStart);
+        disable_multi_line = true;
     }
     std::size_t start = 0;
     for(const auto &arg : args) {
         if(start++ > 0) {
             joined.push_back(sepChar);
-            if(isspace(sepChar) == 0) {
+            if(!std::isspace<char>(sepChar, std::locale())) {
                 joined.push_back(' ');
             }
         }
-        joined.append(convert_arg_for_ini(arg));
+        joined.append(convert_arg_for_ini(arg, stringQuote, literalQuote, disable_multi_line));
     }
     if(args.size() > 1 && arrayEnd != '\0') {
         joined.push_back(arrayEnd);
@@ -7731,35 +10220,36 @@ ini_join(const std::vector<std::string> &args, char sepChar = ',', char arraySta
     return joined;
 }
 
-inline std::vector<std::string> generate_parents(const std::string &section, std::string &name) {
+CLI11_INLINE std::vector<std::string>
+generate_parents(const std::string &section, std::string &name, char parentSeparator) {
     std::vector<std::string> parents;
     if(detail::to_lower(section) != "default") {
-        if(section.find('.') != std::string::npos) {
-            parents = detail::split(section, '.');
+        if(section.find(parentSeparator) != std::string::npos) {
+            parents = detail::split_up(section, parentSeparator);
         } else {
             parents = {section};
         }
     }
-    if(name.find('.') != std::string::npos) {
-        std::vector<std::string> plist = detail::split(name, '.');
+    if(name.find(parentSeparator) != std::string::npos) {
+        std::vector<std::string> plist = detail::split_up(name, parentSeparator);
         name = plist.back();
-        detail::remove_quotes(name);
         plist.pop_back();
         parents.insert(parents.end(), plist.begin(), plist.end());
     }
-
     // clean up quotes on the parents
-    for(auto &parent : parents) {
-        detail::remove_quotes(parent);
+    try {
+        detail::remove_quotes(parents);
+    } catch(const std::invalid_argument &iarg) {
+        throw CLI::ParseError(iarg.what(), CLI::ExitCodes::InvalidError);
     }
     return parents;
 }
 
-/// assuming non default segments do a check on the close and open of the segments in a configItem structure
-inline void checkParentSegments(std::vector<ConfigItem> &output, const std::string &currentSection) {
+CLI11_INLINE void
+checkParentSegments(std::vector<ConfigItem> &output, const std::string &currentSection, char parentSeparator) {
 
     std::string estring;
-    auto parents = detail::generate_parents(currentSection, estring);
+    auto parents = detail::generate_parents(currentSection, estring, parentSeparator);
     if(!output.empty() && output.back().name == "--") {
         std::size_t msize = (parents.size() > 1U) ? parents.size() : 2;
         while(output.back().parents.size() >= msize) {
@@ -7803,79 +10293,227 @@ inline void checkParentSegments(std::vector<ConfigItem> &output, const std::stri
     output.back().parents = std::move(parents);
     output.back().name = "++";
 }
+
+/// @brief  checks if a string represents a multiline comment
+CLI11_INLINE bool hasMLString(std::string const &fullString, char check) {
+    if(fullString.length() < 3) {
+        return false;
+    }
+    auto it = fullString.rbegin();
+    return (*it == check) && (*(it + 1) == check) && (*(it + 2) == check);
+}
 }  // namespace detail
 
 inline std::vector<ConfigItem> ConfigBase::from_config(std::istream &input) const {
     std::string line;
-    std::string section = "default";
-
+    std::string buffer;
+    std::string currentSection = "default";
+    std::string previousSection = "default";
     std::vector<ConfigItem> output;
-    bool defaultArray = (arrayStart == '\0' || arrayStart == ' ') && arrayStart == arrayEnd;
-    char aStart = (defaultArray) ? '[' : arrayStart;
-    char aEnd = (defaultArray) ? ']' : arrayEnd;
-    char aSep = (defaultArray && arraySeparator == ' ') ? ',' : arraySeparator;
-
-    while(getline(input, line)) {
+    bool isDefaultArray = (arrayStart == '[' && arrayEnd == ']' && arraySeparator == ',');
+    bool isINIArray = (arrayStart == '\0' || arrayStart == ' ') && arrayStart == arrayEnd;
+    bool inSection{false};
+    bool inMLineComment{false};
+    bool inMLineValue{false};
+
+    char aStart = (isINIArray) ? '[' : arrayStart;
+    char aEnd = (isINIArray) ? ']' : arrayEnd;
+    char aSep = (isINIArray && arraySeparator == ' ') ? ',' : arraySeparator;
+    int currentSectionIndex{0};
+
+    std::string line_sep_chars{parentSeparatorChar, commentChar, valueDelimiter};
+    while(getline(input, buffer)) {
         std::vector<std::string> items_buffer;
         std::string name;
-
-        detail::trim(line);
+        line = detail::trim_copy(buffer);
         std::size_t len = line.length();
-        if(len > 1 && line.front() == '[' && line.back() == ']') {
-            if(section != "default") {
+        // lines have to be at least 3 characters to have any meaning to CLI just skip the rest
+        if(len < 3) {
+            continue;
+        }
+        if(line.compare(0, 3, multiline_string_quote) == 0 || line.compare(0, 3, multiline_literal_quote) == 0) {
+            inMLineComment = true;
+            auto cchar = line.front();
+            while(inMLineComment) {
+                if(getline(input, line)) {
+                    detail::trim(line);
+                } else {
+                    break;
+                }
+                if(detail::hasMLString(line, cchar)) {
+                    inMLineComment = false;
+                }
+            }
+            continue;
+        }
+        if(line.front() == '[' && line.back() == ']') {
+            if(currentSection != "default") {
                 // insert a section end which is just an empty items_buffer
                 output.emplace_back();
-                output.back().parents = detail::generate_parents(section, name);
+                output.back().parents = detail::generate_parents(currentSection, name, parentSeparatorChar);
                 output.back().name = "--";
             }
-            section = line.substr(1, len - 2);
+            currentSection = line.substr(1, len - 2);
             // deal with double brackets for TOML
-            if(section.size() > 1 && section.front() == '[' && section.back() == ']') {
-                section = section.substr(1, section.size() - 2);
+            if(currentSection.size() > 1 && currentSection.front() == '[' && currentSection.back() == ']') {
+                currentSection = currentSection.substr(1, currentSection.size() - 2);
             }
-            if(detail::to_lower(section) == "default") {
-                section = "default";
+            if(detail::to_lower(currentSection) == "default") {
+                currentSection = "default";
             } else {
-                detail::checkParentSegments(output, section);
+                detail::checkParentSegments(output, currentSection, parentSeparatorChar);
+            }
+            inSection = false;
+            if(currentSection == previousSection) {
+                ++currentSectionIndex;
+            } else {
+                currentSectionIndex = 0;
+                previousSection = currentSection;
             }
             continue;
         }
-        if(len == 0) {
-            continue;
-        }
+
         // comment lines
         if(line.front() == ';' || line.front() == '#' || line.front() == commentChar) {
             continue;
         }
-
+        std::size_t search_start = 0;
+        if(line.find_first_of("\"'`") != std::string::npos) {
+            while(search_start < line.size()) {
+                auto test_char = line[search_start];
+                if(test_char == '\"' || test_char == '\'' || test_char == '`') {
+                    search_start = detail::close_sequence(line, search_start, line[search_start]);
+                    ++search_start;
+                } else if(test_char == valueDelimiter || test_char == commentChar) {
+                    --search_start;
+                    break;
+                } else if(test_char == ' ' || test_char == '\t' || test_char == parentSeparatorChar) {
+                    ++search_start;
+                } else {
+                    search_start = line.find_first_of(line_sep_chars, search_start);
+                }
+            }
+        }
         // Find = in string, split and recombine
-        auto pos = line.find(valueDelimiter);
-        if(pos != std::string::npos) {
-            name = detail::trim_copy(line.substr(0, pos));
-            std::string item = detail::trim_copy(line.substr(pos + 1));
-            if(item.size() > 1 && item.front() == aStart && item.back() == aEnd) {
-                items_buffer = detail::split_up(item.substr(1, item.length() - 2), aSep);
-            } else if(defaultArray && item.find_first_of(aSep) != std::string::npos) {
+        auto delimiter_pos = line.find_first_of(valueDelimiter, search_start + 1);
+        auto comment_pos = line.find_first_of(commentChar, search_start);
+        if(comment_pos < delimiter_pos) {
+            delimiter_pos = std::string::npos;
+        }
+        if(delimiter_pos != std::string::npos) {
+
+            name = detail::trim_copy(line.substr(0, delimiter_pos));
+            std::string item = detail::trim_copy(line.substr(delimiter_pos + 1, std::string::npos));
+            bool mlquote =
+                (item.compare(0, 3, multiline_literal_quote) == 0 || item.compare(0, 3, multiline_string_quote) == 0);
+            if(!mlquote && comment_pos != std::string::npos) {
+                auto citems = detail::split_up(item, commentChar);
+                item = detail::trim_copy(citems.front());
+            }
+            if(mlquote) {
+                // mutliline string
+                auto keyChar = item.front();
+                item = buffer.substr(delimiter_pos + 1, std::string::npos);
+                detail::ltrim(item);
+                item.erase(0, 3);
+                inMLineValue = true;
+                bool lineExtension{false};
+                bool firstLine = true;
+                if(!item.empty() && item.back() == '\\') {
+                    item.pop_back();
+                    lineExtension = true;
+                }
+                while(inMLineValue) {
+                    std::string l2;
+                    if(!std::getline(input, l2)) {
+                        break;
+                    }
+                    line = l2;
+                    detail::rtrim(line);
+                    if(detail::hasMLString(line, keyChar)) {
+                        line.pop_back();
+                        line.pop_back();
+                        line.pop_back();
+                        if(lineExtension) {
+                            detail::ltrim(line);
+                        } else if(!(firstLine && item.empty())) {
+                            item.push_back('\n');
+                        }
+                        firstLine = false;
+                        item += line;
+                        inMLineValue = false;
+                        if(!item.empty() && item.back() == '\n') {
+                            item.pop_back();
+                        }
+                        if(keyChar == '\"') {
+                            try {
+                                item = detail::remove_escaped_characters(item);
+                            } catch(const std::invalid_argument &iarg) {
+                                throw CLI::ParseError(iarg.what(), CLI::ExitCodes::InvalidError);
+                            }
+                        }
+                    } else {
+                        if(lineExtension) {
+                            detail::trim(l2);
+                        } else if(!(firstLine && item.empty())) {
+                            item.push_back('\n');
+                        }
+                        lineExtension = false;
+                        firstLine = false;
+                        if(!l2.empty() && l2.back() == '\\') {
+                            lineExtension = true;
+                            l2.pop_back();
+                        }
+                        item += l2;
+                    }
+                }
+                items_buffer = {item};
+            } else if(item.size() > 1 && item.front() == aStart) {
+                for(std::string multiline; item.back() != aEnd && std::getline(input, multiline);) {
+                    detail::trim(multiline);
+                    item += multiline;
+                }
+                if(item.back() == aEnd) {
+                    items_buffer = detail::split_up(item.substr(1, item.length() - 2), aSep);
+                } else {
+                    items_buffer = detail::split_up(item.substr(1, std::string::npos), aSep);
+                }
+            } else if((isDefaultArray || isINIArray) && item.find_first_of(aSep) != std::string::npos) {
                 items_buffer = detail::split_up(item, aSep);
-            } else if(defaultArray && item.find_first_of(' ') != std::string::npos) {
-                items_buffer = detail::split_up(item);
+            } else if((isDefaultArray || isINIArray) && item.find_first_of(' ') != std::string::npos) {
+                items_buffer = detail::split_up(item, '\0');
             } else {
                 items_buffer = {item};
             }
         } else {
-            name = detail::trim_copy(line);
+            name = detail::trim_copy(line.substr(0, comment_pos));
             items_buffer = {"true"};
         }
-        if(name.find('.') == std::string::npos) {
-            detail::remove_quotes(name);
-        }
-        // clean up quotes on the items
-        for(auto &it : items_buffer) {
-            detail::remove_quotes(it);
+        std::vector<std::string> parents;
+        try {
+            parents = detail::generate_parents(currentSection, name, parentSeparatorChar);
+            detail::process_quoted_string(name);
+            // clean up quotes on the items and check for escaped strings
+            for(auto &it : items_buffer) {
+                detail::process_quoted_string(it, stringQuote, literalQuote);
+            }
+        } catch(const std::invalid_argument &ia) {
+            throw CLI::ParseError(ia.what(), CLI::ExitCodes::InvalidError);
         }
 
-        std::vector<std::string> parents = detail::generate_parents(section, name);
-
+        if(parents.size() > maximumLayers) {
+            continue;
+        }
+        if(!configSection.empty() && !inSection) {
+            if(parents.empty() || parents.front() != configSection) {
+                continue;
+            }
+            if(configIndex >= 0 && currentSectionIndex != configIndex) {
+                continue;
+            }
+            parents.erase(parents.begin());
+            inSection = true;
+        }
         if(!output.empty() && name == output.back().name && parents == output.back().parents) {
             output.back().inputs.insert(output.back().inputs.end(), items_buffer.begin(), items_buffer.end());
         } else {
@@ -7885,11 +10523,11 @@ inline std::vector<ConfigItem> ConfigBase::from_config(std::istream &input) cons
             output.back().inputs = std::move(items_buffer);
         }
     }
-    if(section != "default") {
+    if(currentSection != "default") {
         // insert a section end which is just an empty items_buffer
         std::string ename;
         output.emplace_back();
-        output.back().parents = detail::generate_parents(section, ename);
+        output.back().parents = detail::generate_parents(currentSection, ename, parentSeparatorChar);
         output.back().name = "--";
         while(output.back().parents.size() > 1) {
             output.push_back(output.back());
@@ -7899,18 +10537,47 @@ inline std::vector<ConfigItem> ConfigBase::from_config(std::istream &input) cons
     return output;
 }
 
-inline std::string
+CLI11_INLINE std::string &clean_name_string(std::string &name, const std::string &keyChars) {
+    if(name.find_first_of(keyChars) != std::string::npos || (name.front() == '[' && name.back() == ']') ||
+       (name.find_first_of("'`\"\\") != std::string::npos)) {
+        if(name.find_first_of('\'') == std::string::npos) {
+            name.insert(0, 1, '\'');
+            name.push_back('\'');
+        } else {
+            if(detail::has_escapable_character(name)) {
+                name = detail::add_escaped_characters(name);
+            }
+            name.insert(0, 1, '\"');
+            name.push_back('\"');
+        }
+    }
+    return name;
+}
+
+CLI11_INLINE std::string
 ConfigBase::to_config(const App *app, bool default_also, bool write_description, std::string prefix) const {
     std::stringstream out;
     std::string commentLead;
     commentLead.push_back(commentChar);
     commentLead.push_back(' ');
 
+    std::string commentTest = "#;";
+    commentTest.push_back(commentChar);
+    commentTest.push_back(parentSeparatorChar);
+
+    std::string keyChars = commentTest;
+    keyChars.push_back(literalQuote);
+    keyChars.push_back(stringQuote);
+    keyChars.push_back(arrayStart);
+    keyChars.push_back(arrayEnd);
+    keyChars.push_back(valueDelimiter);
+    keyChars.push_back(arraySeparator);
+
     std::vector<std::string> groups = app->get_groups();
     bool defaultUsed = false;
     groups.insert(groups.begin(), std::string("Options"));
-    if(write_description) {
-        out << commentLead << app->get_description() << '\n';
+    if(write_description && (app->get_configurable() || app->get_parent() == nullptr || app->get_name().empty())) {
+        out << commentLead << detail::fix_newlines(commentLead, app->get_description()) << '\n';
     }
     for(auto &group : groups) {
         if(group == "Options" || group.empty()) {
@@ -7924,29 +10591,61 @@ ConfigBase::to_config(const App *app, bool default_also, bool write_description,
         }
         for(const Option *opt : app->get_options({})) {
 
-            // Only process option with a long-name and configurable
-            if(!opt->get_lnames().empty() && opt->get_configurable()) {
+            // Only process options that are configurable
+            if(opt->get_configurable()) {
                 if(opt->get_group() != group) {
                     if(!(group == "Options" && opt->get_group().empty())) {
                         continue;
                     }
                 }
-                std::string name = prefix + opt->get_lnames()[0];
-                std::string value = detail::ini_join(opt->reduced_results(), arraySeparator, arrayStart, arrayEnd);
+                std::string single_name = opt->get_single_name();
+                if(single_name.empty()) {
+                    continue;
+                }
+
+                std::string value = detail::ini_join(
+                    opt->reduced_results(), arraySeparator, arrayStart, arrayEnd, stringQuote, literalQuote);
 
                 if(value.empty() && default_also) {
                     if(!opt->get_default_str().empty()) {
-                        value = detail::convert_arg_for_ini(opt->get_default_str());
+                        value = detail::convert_arg_for_ini(opt->get_default_str(), stringQuote, literalQuote, false);
                     } else if(opt->get_expected_min() == 0) {
                         value = "false";
+                    } else if(opt->get_run_callback_for_default()) {
+                        value = "\"\"";  // empty string default value
                     }
                 }
 
                 if(!value.empty()) {
+
+                    if(!opt->get_fnames().empty()) {
+                        try {
+                            value = opt->get_flag_value(single_name, value);
+                        } catch(const CLI::ArgumentMismatch &) {
+                            bool valid{false};
+                            for(const auto &test_name : opt->get_fnames()) {
+                                try {
+                                    value = opt->get_flag_value(test_name, value);
+                                    single_name = test_name;
+                                    valid = true;
+                                } catch(const CLI::ArgumentMismatch &) {
+                                    continue;
+                                }
+                            }
+                            if(!valid) {
+                                value = detail::ini_join(
+                                    opt->results(), arraySeparator, arrayStart, arrayEnd, stringQuote, literalQuote);
+                            }
+                        }
+                    }
                     if(write_description && opt->has_description()) {
                         out << '\n';
                         out << commentLead << detail::fix_newlines(commentLead, opt->get_description()) << '\n';
                     }
+                    clean_name_string(single_name, keyChars);
+
+                    std::string name = prefix + single_name;
+
                     out << name << valueDelimiter << value << '\n';
                 }
             }
@@ -7955,30 +10654,56 @@ ConfigBase::to_config(const App *app, bool default_also, bool write_description,
     auto subcommands = app->get_subcommands({});
     for(const App *subcom : subcommands) {
         if(subcom->get_name().empty()) {
+            if(!default_also && (subcom->count_all() == 0)) {
+                continue;
+            }
             if(write_description && !subcom->get_group().empty()) {
                 out << '\n' << commentLead << subcom->get_group() << " Options\n";
             }
+            /*if (!prefix.empty() || app->get_parent() == nullptr) {
+                out << '[' << prefix << "___"<< subcom->get_group() << "]\n";
+            } else {
+                std::string subname = app->get_name() + parentSeparatorChar + "___"+subcom->get_group();
+                const auto *p = app->get_parent();
+                while(p->get_parent() != nullptr) {
+                    subname = p->get_name() + parentSeparatorChar +subname;
+                    p = p->get_parent();
+                }
+                out << '[' << subname << "]\n";
+            }
+            */
             out << to_config(subcom, default_also, write_description, prefix);
         }
     }
 
     for(const App *subcom : subcommands) {
         if(!subcom->get_name().empty()) {
+            if(!default_also && (subcom->count_all() == 0)) {
+                continue;
+            }
+            std::string subname = subcom->get_name();
+            clean_name_string(subname, keyChars);
+
             if(subcom->get_configurable() && app->got_subcommand(subcom)) {
                 if(!prefix.empty() || app->get_parent() == nullptr) {
-                    out << '[' << prefix << subcom->get_name() << "]\n";
+
+                    out << '[' << prefix << subname << "]\n";
                 } else {
-                    std::string subname = app->get_name() + "." + subcom->get_name();
-                    auto p = app->get_parent();
+                    std::string appname = app->get_name();
+                    clean_name_string(appname, keyChars);
+                    subname = appname + parentSeparatorChar + subname;
+                    const auto *p = app->get_parent();
                     while(p->get_parent() != nullptr) {
-                        subname = p->get_name() + "." + subname;
+                        std::string pname = p->get_name();
+                        clean_name_string(pname, keyChars);
+                        subname = pname + parentSeparatorChar + subname;
                         p = p->get_parent();
                     }
                     out << '[' << subname << "]\n";
                 }
                 out << to_config(subcom, default_also, write_description, "");
             } else {
-                out << to_config(subcom, default_also, write_description, prefix + subcom->get_name() + ".");
+                out << to_config(subcom, default_also, write_description, prefix + subname + parentSeparatorChar);
             }
         }
     }
@@ -7986,13 +10711,12 @@ ConfigBase::to_config(const App *app, bool default_also, bool write_description,
     return out.str();
 }
 
-}  // namespace CLI
 
-// From Formatter.hpp:
 
-namespace CLI {
 
-inline std::string
+
+
+CLI11_INLINE std::string
 Formatter::make_group(std::string group, bool is_positional, std::vector<const Option *> opts) const {
     std::stringstream out;
 
@@ -8004,28 +10728,28 @@ Formatter::make_group(std::string group, bool is_positional, std::vector<const O
     return out.str();
 }
 
-inline std::string Formatter::make_positionals(const App *app) const {
+CLI11_INLINE std::string Formatter::make_positionals(const App *app) const {
     std::vector<const Option *> opts =
         app->get_options([](const Option *opt) { return !opt->get_group().empty() && opt->get_positional(); });
 
     if(opts.empty())
-        return std::string();
+        return {};
 
     return make_group(get_label("Positionals"), true, opts);
 }
 
-inline std::string Formatter::make_groups(const App *app, AppFormatMode mode) const {
+CLI11_INLINE std::string Formatter::make_groups(const App *app, AppFormatMode mode) const {
     std::stringstream out;
     std::vector<std::string> groups = app->get_groups();
 
     // Options
     for(const std::string &group : groups) {
         std::vector<const Option *> opts = app->get_options([app, mode, &group](const Option *opt) {
-          return opt->get_group() == group                     // Must be in the right group
-                 && opt->nonpositional()                       // Must not be a positional
-                 && (mode != AppFormatMode::Sub                // If mode is Sub, then
-                     || (app->get_help_ptr() != opt            // Ignore help pointer
-                         && app->get_help_all_ptr() != opt));  // Ignore help all pointer
+            return opt->get_group() == group                     // Must be in the right group
+                   && opt->nonpositional()                       // Must not be a positional
+                   && (mode != AppFormatMode::Sub                // If mode is Sub, then
+                       || (app->get_help_ptr() != opt            // Ignore help pointer
+                           && app->get_help_all_ptr() != opt));  // Ignore help all pointer
         });
         if(!group.empty() && !opts.empty()) {
             out << make_group(group, false, opts);
@@ -8038,18 +10762,18 @@ inline std::string Formatter::make_groups(const App *app, AppFormatMode mode) co
     return out.str();
 }
 
-inline std::string Formatter::make_description(const App *app) const {
+CLI11_INLINE std::string Formatter::make_description(const App *app) const {
     std::string desc = app->get_description();
     auto min_options = app->get_require_option_min();
     auto max_options = app->get_require_option_max();
     if(app->get_required()) {
-        desc += " REQUIRED ";
+        desc += " " + get_label("REQUIRED") + " ";
     }
     if((max_options == min_options) && (min_options > 0)) {
         if(min_options == 1) {
             desc += " \n[Exactly 1 of the following options is required]";
         } else {
-            desc += " \n[Exactly " + std::to_string(min_options) + "options from the following list are required]";
+            desc += " \n[Exactly " + std::to_string(min_options) + " options from the following list are required]";
         }
     } else if(max_options > 0) {
         if(min_options > 0) {
@@ -8064,7 +10788,12 @@ inline std::string Formatter::make_description(const App *app) const {
     return (!desc.empty()) ? desc + "\n" : std::string{};
 }
 
-inline std::string Formatter::make_usage(const App *app, std::string name) const {
+CLI11_INLINE std::string Formatter::make_usage(const App *app, std::string name) const {
+    std::string usage = app->get_usage();
+    if(!usage.empty()) {
+        return usage + "\n";
+    }
+
     std::stringstream out;
 
     out << get_label("Usage") << ":" << (name.empty() ? "" : " ") << name;
@@ -8085,7 +10814,7 @@ inline std::string Formatter::make_usage(const App *app, std::string name) const
         // Convert to help names
         std::vector<std::string> positional_names(positionals.size());
         std::transform(positionals.begin(), positionals.end(), positional_names.begin(), [this](const Option *opt) {
-          return make_option_usage(opt);
+            return make_option_usage(opt);
         });
 
         out << " " << detail::join(positional_names, " ");
@@ -8093,28 +10822,28 @@ inline std::string Formatter::make_usage(const App *app, std::string name) const
 
     // Add a marker if subcommands are expected or optional
     if(!app->get_subcommands(
-        [](const CLI::App *subc) { return ((!subc->get_disabled()) && (!subc->get_name().empty())); })
-        .empty()) {
+               [](const CLI::App *subc) { return ((!subc->get_disabled()) && (!subc->get_name().empty())); })
+            .empty()) {
         out << " " << (app->get_require_subcommand_min() == 0 ? "[" : "")
             << get_label(app->get_require_subcommand_max() < 2 || app->get_require_subcommand_min() > 1 ? "SUBCOMMAND"
                                                                                                         : "SUBCOMMANDS")
             << (app->get_require_subcommand_min() == 0 ? "]" : "");
     }
 
-    out << std::endl;
+    out << '\n';
 
     return out.str();
 }
 
-inline std::string Formatter::make_footer(const App *app) const {
+CLI11_INLINE std::string Formatter::make_footer(const App *app) const {
     std::string footer = app->get_footer();
     if(footer.empty()) {
         return std::string{};
     }
-    return footer + "\n";
+    return "\n" + footer + "\n";
 }
 
-inline std::string Formatter::make_help(const App *app, std::string name, AppFormatMode mode) const {
+CLI11_INLINE std::string Formatter::make_help(const App *app, std::string name, AppFormatMode mode) const {
 
     // This immediately forwards to the make_expanded method. This is done this way so that subcommands can
     // have overridden formatters
@@ -8133,12 +10862,12 @@ inline std::string Formatter::make_help(const App *app, std::string name, AppFor
     out << make_positionals(app);
     out << make_groups(app, mode);
     out << make_subcommands(app, mode);
-    out << '\n' << make_footer(app);
+    out << make_footer(app);
 
     return out.str();
 }
 
-inline std::string Formatter::make_subcommands(const App *app, AppFormatMode mode) const {
+CLI11_INLINE std::string Formatter::make_subcommands(const App *app, AppFormatMode mode) const {
     std::stringstream out;
 
     std::vector<const App *> subcommands = app->get_subcommands({});
@@ -8155,7 +10884,7 @@ inline std::string Formatter::make_subcommands(const App *app, AppFormatMode mod
         std::string group_key = com->get_group();
         if(!group_key.empty() &&
            std::find_if(subcmd_groups_seen.begin(), subcmd_groups_seen.end(), [&group_key](std::string a) {
-             return detail::to_lower(a) == detail::to_lower(group_key);
+               return detail::to_lower(a) == detail::to_lower(group_key);
            }) == subcmd_groups_seen.end())
             subcmd_groups_seen.push_back(group_key);
     }
@@ -8180,17 +10909,23 @@ inline std::string Formatter::make_subcommands(const App *app, AppFormatMode mod
     return out.str();
 }
 
-inline std::string Formatter::make_subcommand(const App *sub) const {
+CLI11_INLINE std::string Formatter::make_subcommand(const App *sub) const {
     std::stringstream out;
-    detail::format_help(out, sub->get_name(), sub->get_description(), column_width_);
+    detail::format_help(out,
+                        sub->get_display_name(true) + (sub->get_required() ? " " + get_label("REQUIRED") : ""),
+                        sub->get_description(),
+                        column_width_);
     return out.str();
 }
 
-inline std::string Formatter::make_expanded(const App *sub) const {
+CLI11_INLINE std::string Formatter::make_expanded(const App *sub) const {
     std::stringstream out;
-    out << sub->get_display_name() << "\n";
+    out << sub->get_display_name(true) << "\n";
 
     out << make_description(sub);
+    if(sub->get_name().empty() && !sub->get_aliases().empty()) {
+        detail::format_aliases(out, sub->get_aliases(), column_width_ + 2);
+    }
     out << make_positionals(sub);
     out << make_groups(sub, AppFormatMode::Sub);
     out << make_subcommands(sub, AppFormatMode::Sub);
@@ -8203,47 +10938,51 @@ inline std::string Formatter::make_expanded(const App *sub) const {
     return detail::find_and_replace(tmp, "\n", "\n  ") + "\n";
 }
 
-inline std::string Formatter::make_option_name(const Option *opt, bool is_positional) const {
+CLI11_INLINE std::string Formatter::make_option_name(const Option *opt, bool is_positional) const {
     if(is_positional)
         return opt->get_name(true, false);
 
     return opt->get_name(false, true);
 }
 
-inline std::string Formatter::make_option_opts(const Option *opt) const {
+CLI11_INLINE std::string Formatter::make_option_opts(const Option *opt) const {
     std::stringstream out;
 
-    if(opt->get_type_size() != 0) {
-        if(!opt->get_type_name().empty())
-            out << " " << get_label(opt->get_type_name());
-        if(!opt->get_default_str().empty())
-            out << "=" << opt->get_default_str();
-        if(opt->get_expected_max() == detail::expected_max_vector_size)
-            out << " ...";
-        else if(opt->get_expected_min() > 1)
-            out << " x " << opt->get_expected();
-
-        if(opt->get_required())
-            out << " " << get_label("REQUIRED");
-    }
-    if(!opt->get_envname().empty())
-        out << " (" << get_label("Env") << ":" << opt->get_envname() << ")";
-    if(!opt->get_needs().empty()) {
-        out << " " << get_label("Needs") << ":";
-        for(const Option *op : opt->get_needs())
-            out << " " << op->get_name();
-    }
-    if(!opt->get_excludes().empty()) {
-        out << " " << get_label("Excludes") << ":";
-        for(const Option *op : opt->get_excludes())
-            out << " " << op->get_name();
+    if(!opt->get_option_text().empty()) {
+        out << " " << opt->get_option_text();
+    } else {
+        if(opt->get_type_size() != 0) {
+            if(!opt->get_type_name().empty())
+                out << " " << get_label(opt->get_type_name());
+            if(!opt->get_default_str().empty())
+                out << " [" << opt->get_default_str() << "] ";
+            if(opt->get_expected_max() == detail::expected_max_vector_size)
+                out << " ...";
+            else if(opt->get_expected_min() > 1)
+                out << " x " << opt->get_expected();
+
+            if(opt->get_required())
+                out << " " << get_label("REQUIRED");
+        }
+        if(!opt->get_envname().empty())
+            out << " (" << get_label("Env") << ":" << opt->get_envname() << ")";
+        if(!opt->get_needs().empty()) {
+            out << " " << get_label("Needs") << ":";
+            for(const Option *op : opt->get_needs())
+                out << " " << op->get_name();
+        }
+        if(!opt->get_excludes().empty()) {
+            out << " " << get_label("Excludes") << ":";
+            for(const Option *op : opt->get_excludes())
+                out << " " << op->get_name();
+        }
     }
     return out.str();
 }
 
-inline std::string Formatter::make_option_desc(const Option *opt) const { return opt->get_description(); }
+CLI11_INLINE std::string Formatter::make_option_desc(const Option *opt) const { return opt->get_description(); }
 
-inline std::string Formatter::make_option_usage(const Option *opt) const {
+CLI11_INLINE std::string Formatter::make_option_usage(const Option *opt) const {
     // Note that these are positionals usages
     std::stringstream out;
     out << make_option_name(opt, true);
@@ -8255,5 +10994,5 @@ inline std::string Formatter::make_option_usage(const Option *opt) const {
     return opt->get_required() ? out.str() : "[" + out.str() + "]";
 }
 
-}  // namespace CLI
 
+} // namespace CLI
diff --git a/src/config.cpp b/src/config.cpp
index 00ccab43b..6c40e86d2 100644
--- a/src/config.cpp
+++ b/src/config.cpp
@@ -7,7 +7,7 @@ const ebpf_verifier_options_t ebpf_verifier_default_options = {
     .assume_assertions = false,
     .print_invariants = false,
     .print_failures = false,
-    .no_simplify = false,
+    .simplify = true,
     .mock_map_fds = true,
     .strict = false,
     .print_line_info = false,
diff --git a/src/config.hpp b/src/config.hpp
index 93d787f3b..26963b0a9 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -7,7 +7,7 @@ struct ebpf_verifier_options_t {
     bool assume_assertions;
     bool print_invariants;
     bool print_failures;
-    bool no_simplify;
+    bool simplify;
 
     // False to use actual map fd's, true to use mock fd's.
     bool mock_map_fds;
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 3d5d33f31..81f543e33 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -197,7 +197,7 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
     ebpf_domain_t entry_inv = ebpf_domain_t::from_constraints(entry_invariant.value(), options.setup_constraints);
     if (entry_inv.is_bottom())
         throw std::runtime_error("Entry invariant is inconsistent");
-    cfg_t cfg = prepare_cfg(prog, info, !options.no_simplify, false);
+    cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
     auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
     checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
     print_report(os, report, prog, false);
@@ -215,7 +215,7 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
 
     // Convert the instruction sequence to a control-flow graph
     // in a "passive", non-deterministic form.
-    cfg_t cfg = prepare_cfg(prog, info, !options->no_simplify);
+    cfg_t cfg = prepare_cfg(prog, info, options->simplify);
 
     checks_db report = get_ebpf_report(os, cfg, info, options);
     if (options->print_failures) {
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index dfdf6ef3e..29a2f1b6b 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -174,8 +174,8 @@ static InstructionSeq raw_cfg_to_instruction_seq(const vector<std::tuple<string,
 static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& raw_options) {
     ebpf_verifier_options_t options = ebpf_verifier_default_options;
 
-    // All YAML tests use no_simplify and !setup_constraints.
-    options.no_simplify = true;
+    // All YAML tests use !simplify and !setup_constraints.
+    options.simplify = false;
     options.setup_constraints = false;
 
     // Default to the machine's native endianness.
@@ -244,7 +244,7 @@ std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
     if (debug) {
         test_case.options.print_failures = true;
         test_case.options.print_invariants = true;
-        test_case.options.no_simplify = true;
+        test_case.options.simplify = false;
     }
 
     ebpf_context_descriptor_t context_descriptor{64, 0, 4, -1};
@@ -353,7 +353,7 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
         print(prog, std::cout, {});
         options.print_failures = true;
         options.print_invariants = true;
-        options.no_simplify = true;
+        options.simplify = false;
     }
 
     try {
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 25e571293..50d6d25aa 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -3,11 +3,8 @@
 #include <iostream>
 #include <vector>
 
-#include <boost/algorithm/string.hpp>
 #include <boost/functional/hash.hpp>
 
-#include "CLI11.hpp"
-
 #include "ebpf_verifier.hpp"
 #ifdef _WIN32
 #include "memsize_windows.hpp"
@@ -17,6 +14,9 @@
 #include "linux_verifier.hpp"
 #include "utils.hpp"
 
+// Avoid affecting other headers by macros.
+#include "CLI11.hpp"
+
 using std::string;
 using std::vector;
 
@@ -26,22 +26,17 @@ static size_t hash(const raw_program& raw_prog) {
     return boost::hash_range(start, end);
 }
 
-template <void (on_exit)()>
-struct at_scope_exit
-{
+template <void(on_exit)()>
+struct at_scope_exit {
     at_scope_exit() = default;
     ~at_scope_exit() { on_exit(); }
 };
 
 static const std::map<std::string, bpf_conformance_groups_t> _conformance_groups = {
-    {"atomic32", bpf_conformance_groups_t::atomic32},
-    {"atomic64", bpf_conformance_groups_t::atomic64},
-    {"base32", bpf_conformance_groups_t::base32},
-    {"base64", bpf_conformance_groups_t::base64},
-    {"callx", bpf_conformance_groups_t::callx},
-    {"divmul32", bpf_conformance_groups_t::divmul32},
-    {"divmul64", bpf_conformance_groups_t::divmul64},
-    {"packet", bpf_conformance_groups_t::packet}};
+    {"atomic32", bpf_conformance_groups_t::atomic32}, {"atomic64", bpf_conformance_groups_t::atomic64},
+    {"base32", bpf_conformance_groups_t::base32},     {"base64", bpf_conformance_groups_t::base64},
+    {"callx", bpf_conformance_groups_t::callx},       {"divmul32", bpf_conformance_groups_t::divmul32},
+    {"divmul64", bpf_conformance_groups_t::divmul64}, {"packet", bpf_conformance_groups_t::packet}};
 
 static std::optional<bpf_conformance_groups_t> _get_conformance_group_by_name(std::string group) {
     if (!_conformance_groups.contains(group)) {
@@ -50,25 +45,14 @@ static std::optional<bpf_conformance_groups_t> _get_conformance_group_by_name(st
     return _conformance_groups.find(group)->second;
 }
 
-static std::string _get_conformance_group_names() {
-    std::string result;
-    for (const auto& entry : _conformance_groups) {
-        if (!result.empty()) {
-            result += ", ";
-        }
-        result += entry.first;
+static std::set<std::string> _get_conformance_group_names() {
+    std::set<std::string> result;
+    for (const auto& [name, _] : _conformance_groups) {
+        result.insert(name);
     }
     return result;
 }
 
-// Given a string containing comma-separated tokens, split them into a list of strings.
-static std::vector<std::string> get_string_vector(std::string list) {
-    std::vector<std::string> string_vector;
-    if (!list.empty())
-       boost::split(string_vector, list, boost::is_any_of(","));
-    return string_vector;
-}
-
 static std::optional<raw_program> find_program(vector<raw_program>& raw_progs, std::string desired_program) {
     if (desired_program.empty() && raw_progs.size() == 1) {
         // Select the last program section.
@@ -88,80 +72,89 @@ int main(int argc, char** argv) {
 
     ebpf_verifier_options_t ebpf_verifier_options = ebpf_verifier_default_options;
 
-    // Parse command line arguments:
-
     crab::CrabEnableWarningMsg(false);
 
-    CLI::App app{"A new eBPF verifier"};
+    // Parse command line arguments:
+
+    CLI::App app{"PREVAIL is a new eBPF verifier based on abstract interpretation."};
+    app.option_defaults()->delimiter(',');
 
     std::string filename;
-    app.add_option("path", filename, "Elf file to analyze")->required()->type_name("FILE");
+    app.add_option("path", filename, "Elf file to analyze")->required()->check(CLI::ExistingFile);
 
     std::string desired_section;
-
     app.add_option("--section,section", desired_section, "Section to analyze")->type_name("SECTION");
 
     std::string desired_program;
-
     app.add_option("--function,function", desired_program, "Function to analyze")->type_name("FUNCTION");
+
     bool list = false;
     app.add_flag("-l", list, "List programs");
 
     std::string domain = "zoneCrab";
-    std::set<string> doms{"stats", "linux", "zoneCrab", "cfg"};
-    app.add_set("-d,--dom,--domain", domain, doms, "Abstract domain")->type_name("DOMAIN");
-
-    app.add_flag("--termination", ebpf_verifier_options.check_termination, "Verify termination");
-
-    app.add_flag("--assume-assert", ebpf_verifier_options.assume_assertions, "Assume assertions");
-
+    app.add_option("--domain", domain, "Abstract domain")
+        ->type_name("DOMAIN")
+        ->capture_default_str()
+        ->check(CLI::IsMember({"stats", "linux", "zoneCrab", "cfg"}));
+
+    app.add_flag("--termination,!--no-verify-termination", ebpf_verifier_options.check_termination,
+                 "Verify termination. Default: ignore")
+        ->group("Features");
+
+    app.add_flag("--allow-division-by-zero,!--no-division-by-zero", ebpf_verifier_options.allow_division_by_zero,
+                 "Handling potential division by zero. Default: allow")
+        ->group("Features");
+
+    app.add_flag("--strict,-s", ebpf_verifier_options.strict,
+                 "Apply additional checks that would cause runtime failures")
+        ->group("Features");
+
+    std::set<std::string> include_groups = _get_conformance_group_names();
+    app.add_option("--include_groups", include_groups, "Include conformance groups")
+        ->group("Features")->type_name("GROUPS")
+        ->expected(0, _conformance_groups.size())
+        ->check(CLI::IsMember(_get_conformance_group_names()));
+
+    std::set<std::string> exclude_groups;
+    app.add_option("--exclude_groups", exclude_groups, "Exclude conformance groups")
+        ->group("Features")->type_name("GROUPS")->option_text("")
+        ->expected(0, _conformance_groups.size())
+        ->check(CLI::IsMember(_get_conformance_group_names()));
+
+    app.add_flag("--simplify,!--no-simplify", ebpf_verifier_options.simplify,
+                 "Simplify the CFG before analysis by merging chains of instructions into a single basic block. "
+                 "Default: enabled")
+        ->group("Verbosity");
+    app.add_flag("--line-info", ebpf_verifier_options.print_line_info, "Print line information")->group("Verbosity");
+    app.add_flag("--print-btf-types", ebpf_verifier_options.dump_btf_types_json, "Print BTF types")->group("Verbosity");
+
+    app.add_flag("--assume-assert,!--no-assume-assert", ebpf_verifier_options.assume_assertions,
+                 "Assume assertions (useful for debugging verification failures). Default: disabled")
+        ->group("Verbosity");
+
+    app.add_flag("-i", ebpf_verifier_options.print_invariants, "Print invariants")->group("Verbosity");
+    app.add_flag("-f", ebpf_verifier_options.print_failures, "Print verifier's failure logs")->group("Verbosity");
     bool verbose = false;
-    app.add_flag("-i", ebpf_verifier_options.print_invariants, "Print invariants");
-    app.add_flag("-f", ebpf_verifier_options.print_failures, "Print verifier's failure logs");
-    app.add_flag("-s", ebpf_verifier_options.strict, "Apply additional checks that would cause runtime failures");
-    app.add_flag("-v", verbose, "Print both invariants and failures");
-    std::string include_groups;
-    app.add_option("include_groups", include_groups,
-                   "Include conformance groups (valid group names: " + _get_conformance_group_names() + ")");
-    std::string exclude_groups;
-    app.add_option("exclude_groups", exclude_groups,
-                   "Exclude conformance groups (valid group names: " + _get_conformance_group_names() + ")");
-    bool no_division_by_zero = false;
-    app.add_flag("--no-division-by-zero", no_division_by_zero, "Do not allow division by zero");
-    app.add_flag("--no-simplify", ebpf_verifier_options.no_simplify, "Do not simplify");
-    app.add_flag("--line-info", ebpf_verifier_options.print_line_info, "Print line information");
-    app.add_flag("--print-btf-types", ebpf_verifier_options.dump_btf_types_json, "Print BTF types");
+    app.add_flag("-v", verbose, "Print both invariants and failures")->group("Verbosity");
 
     std::string asmfile;
-    app.add_option("--asm", asmfile, "Print disassembly to FILE")->type_name("FILE");
+    app.add_option("--asm", asmfile, "Print disassembly to FILE")->group("CFG output")->type_name("FILE");
     std::string dotfile;
-    app.add_option("--dot", dotfile, "Export control-flow graph to dot FILE")->type_name("FILE");
-
-    app.footer("You can use @headers as the path to instead just show the output field headers.\n");
+    app.add_option("--dot", dotfile, "Export control-flow graph to dot FILE")->group("CFG output")->type_name("FILE");
 
     CLI11_PARSE(app, argc, argv);
+
     if (verbose)
         ebpf_verifier_options.print_invariants = ebpf_verifier_options.print_failures = true;
-    ebpf_verifier_options.allow_division_by_zero = !no_division_by_zero;
 
     // Enable default conformance groups, which don't include callx or packet.
     ebpf_platform_t platform = g_ebpf_platform_linux;
     platform.supported_conformance_groups = bpf_conformance_groups_t::default_groups;
-    for (auto group_name : get_string_vector(include_groups)) {
-        if (auto group = _get_conformance_group_by_name(group_name)) {
-            platform.supported_conformance_groups |= *group;
-        } else {
-            std::cerr << "Invalid group: " << group_name << std::endl;
-            return 1;
-        }
+    for (auto group_name : include_groups) {
+        platform.supported_conformance_groups |= _get_conformance_group_by_name(group_name).value();
     }
-    for (auto group_name : get_string_vector(exclude_groups)) {
-        if (auto group = _get_conformance_group_by_name(group_name)) {
-            platform.supported_conformance_groups &= ~(*group);
-        } else {
-            std::cerr << "Invalid group: " << group_name << std::endl;
-            return 1;
-        }
+    for (auto group_name : exclude_groups) {
+        platform.supported_conformance_groups &= _get_conformance_group_by_name(group_name).value();
     }
 
     // Main program
@@ -239,7 +232,8 @@ int main(int argc, char** argv) {
         const auto [res, seconds] = timed_execution([&] {
             return ebpf_verify_program(std::cout, prog, raw_prog.info, &ebpf_verifier_options, &verifier_stats);
         });
-        if (res && ebpf_verifier_options.check_termination && (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
+        if (res && ebpf_verifier_options.check_termination &&
+            (ebpf_verifier_options.print_failures || ebpf_verifier_options.print_invariants)) {
             std::cout << "Program terminates within " << verifier_stats.max_loop_count << " loop iterations\n";
         }
         std::cout << res << "," << seconds << "," << resident_set_size_kb() << "\n";
@@ -251,7 +245,7 @@ int main(int argc, char** argv) {
         return !res;
     } else if (domain == "stats") {
         // Convert the instruction sequence to a control-flow graph.
-        cfg_t cfg = prepare_cfg(prog, raw_prog.info, !ebpf_verifier_options.no_simplify);
+        cfg_t cfg = prepare_cfg(prog, raw_prog.info, ebpf_verifier_options.simplify);
 
         // Just print eBPF program stats.
         auto stats = collect_stats(cfg);
@@ -265,7 +259,7 @@ int main(int argc, char** argv) {
         std::cout << "\n";
     } else if (domain == "cfg") {
         // Convert the instruction sequence to a control-flow graph.
-        cfg_t cfg = prepare_cfg(prog, raw_prog.info, !ebpf_verifier_options.no_simplify);
+        cfg_t cfg = prepare_cfg(prog, raw_prog.info, ebpf_verifier_options.simplify);
         std::cout << cfg;
         std::cout << "\n";
     } else {
diff --git a/src/main/run_yaml.cpp b/src/main/run_yaml.cpp
index 65a839a57..cb2905c33 100644
--- a/src/main/run_yaml.cpp
+++ b/src/main/run_yaml.cpp
@@ -2,11 +2,12 @@
 // SPDX-License-Identifier: MIT
 #include <iostream>
 
-#include "CLI11.hpp"
-
 #include "ebpf_verifier.hpp"
 #include "ebpf_yaml.hpp"
 
+// Avoid affecting other headers by macros.
+#include "CLI11.hpp"
+
 int main(int argc, char** argv) {
     CLI::App app{"Run YAML test cases"};
 
diff --git a/src/test/conformance_check.cpp b/src/test/conformance_check.cpp
index 8e9c25b9a..b5aa75f9c 100644
--- a/src/test/conformance_check.cpp
+++ b/src/test/conformance_check.cpp
@@ -8,12 +8,12 @@
 
 #include <iostream>
 #include <sstream>
-#include <optional>
 #include <string>
 #include <vector>
-#include "CLI11.hpp"
 #include "ebpf_verifier.hpp"
 #include "ebpf_yaml.hpp"
+#include "CLI11.hpp"
+
 using string = std::string;
 
 /**

From 20bdd4ab6a677c039fb385157e546552fcc8bf11 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Jun 2024 16:17:24 +0000
Subject: [PATCH 194/373] Bump external/libbtf from `ab8d59b` to `a02cd25`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `ab8d59b` to `a02cd25`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/ab8d59bf9e2ca1ec3b9ab0f29996ae24cfd4c79a...a02cd258f2d2f4d62891f70308962e466e1a683e)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index ab8d59bf9..a02cd258f 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit ab8d59bf9e2ca1ec3b9ab0f29996ae24cfd4c79a
+Subproject commit a02cd258f2d2f4d62891f70308962e466e1a683e

From 6721feca77f3898e0725fb0c6c5e7062101dfeff Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 1 Jun 2024 16:17:27 +0000
Subject: [PATCH 195/373] Bump external/bpf_conformance from `ce95710` to
 `bdd8c3e`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `ce95710` to `bdd8c3e`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/ce9571054cb6e60ed88bddcfc8cbff19dc31dab6...bdd8c3eb347ef49c5a4cd86f605a776ae8253cdf)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index ce9571054..bdd8c3eb3 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit ce9571054cb6e60ed88bddcfc8cbff19dc31dab6
+Subproject commit bdd8c3eb347ef49c5a4cd86f605a776ae8253cdf

From e1beedc0f0306607408580a6404aae7113c78562 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Dantas?= <vinicius.gppcom@gmail.com>
Date: Sun, 9 Jun 2024 14:07:27 -0400
Subject: [PATCH 196/373] Update docker base image Ubuntu 20.04 comes with gcc
 9, which isn't capable of compiling the code base. Upgrading it to Ubuntu
 22.04 provides us with gcc 11, which handles the more modern features used in
 the project
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Vinícius Dantas <vinicius.gppcom@gmail.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 618d605e2..125d91709 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:22.04
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt update

From 6d0d7c0a570e21cc3261aa381e66df1155d93367 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 8 Jun 2024 16:02:23 +0000
Subject: [PATCH 197/373] Bump external/libbtf from `a02cd25` to `b2b9eac`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `a02cd25` to `b2b9eac`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/a02cd258f2d2f4d62891f70308962e466e1a683e...b2b9eac9a37ea87a4c33440f5c316debb5e66cf0)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index a02cd258f..b2b9eac9a 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit a02cd258f2d2f4d62891f70308962e466e1a683e
+Subproject commit b2b9eac9a37ea87a4c33440f5c316debb5e66cf0

From 4e68d5e889b245155d91c86132ae81fa353df317 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 8 Jun 2024 16:02:20 +0000
Subject: [PATCH 198/373] Bump external/bpf_conformance from `bdd8c3e` to
 `16c80f4`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `bdd8c3e` to `16c80f4`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/bdd8c3eb347ef49c5a4cd86f605a776ae8253cdf...16c80f4aa3aa87d4ab085beba3faf96aaa5bbb95)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index bdd8c3eb3..16c80f4aa 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit bdd8c3eb347ef49c5a4cd86f605a776ae8253cdf
+Subproject commit 16c80f4aa3aa87d4ab085beba3faf96aaa5bbb95

From 372eae79cae9812df4eb359e0b052029a44f0194 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 15 Jun 2024 16:39:38 +0000
Subject: [PATCH 199/373] Bump external/bpf_conformance from `16c80f4` to
 `252ec2c`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `16c80f4` to `252ec2c`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/16c80f4aa3aa87d4ab085beba3faf96aaa5bbb95...252ec2cf2283d765b0f6da4da5ace8a5979bb92e)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 16c80f4aa..252ec2cf2 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 16c80f4aa3aa87d4ab085beba3faf96aaa5bbb95
+Subproject commit 252ec2cf2283d765b0f6da4da5ace8a5979bb92e

From c6dd88bdb0236d90dfc03e7abb67e9044b3cf572 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 15 Jun 2024 16:39:41 +0000
Subject: [PATCH 200/373] Bump external/libbtf from `b2b9eac` to `0fe51e6`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `b2b9eac` to `0fe51e6`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/b2b9eac9a37ea87a4c33440f5c316debb5e66cf0...0fe51e6328b01a676fcf7259b8f1b9f22fd9ceb4)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index b2b9eac9a..0fe51e632 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit b2b9eac9a37ea87a4c33440f5c316debb5e66cf0
+Subproject commit 0fe51e6328b01a676fcf7259b8f1b9f22fd9ceb4

From 81042222760cac32c10be832d987bddacd6472f7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 22 Jun 2024 16:36:35 +0000
Subject: [PATCH 201/373] Bump external/libbtf from `0fe51e6` to `0ff1ef7`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `0fe51e6` to `0ff1ef7`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/0fe51e6328b01a676fcf7259b8f1b9f22fd9ceb4...0ff1ef7d61e25598b05ec9a6aa1a4e90dd7ad22b)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 0fe51e632..0ff1ef7d6 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 0fe51e6328b01a676fcf7259b8f1b9f22fd9ceb4
+Subproject commit 0ff1ef7d61e25598b05ec9a6aa1a4e90dd7ad22b

From cd399bb487e8cdbd718a0acc9409953b1fec1711 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 22 Jun 2024 16:36:33 +0000
Subject: [PATCH 202/373] Bump external/bpf_conformance from `252ec2c` to
 `a407af3`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `252ec2c` to `a407af3`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/252ec2cf2283d765b0f6da4da5ace8a5979bb92e...a407af3dd99ce656643001bb2899e0c23e31d1a4)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 252ec2cf2..a407af3dd 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 252ec2cf2283d765b0f6da4da5ace8a5979bb92e
+Subproject commit a407af3dd99ce656643001bb2899e0c23e31d1a4

From 14b27b21927a8a8b0d633c51834807738de0988a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 29 Jun 2024 16:52:46 +0000
Subject: [PATCH 203/373] Bump ebpf-samples from `b6e7d26` to `498d2f7`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `b6e7d26` to `498d2f7`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/b6e7d2618359f605cdde7771b713d2cd74988c0d...498d2f7ae80d8dcd0cc47defd4104c0901d1afa8)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index b6e7d2618..498d2f7ae 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit b6e7d2618359f605cdde7771b713d2cd74988c0d
+Subproject commit 498d2f7ae80d8dcd0cc47defd4104c0901d1afa8

From 324ebf0138b626488263613e8b2e2f7aa3eaf80f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 8 Jul 2024 03:19:52 -0400
Subject: [PATCH 204/373] Fixed a bug that was caused by introducing Atomic
 Operation

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_domain.cpp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 28688933c..17e014cb9 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -230,14 +230,14 @@ void type_domain_t::operator()(const Atomic &u, location_t loc) {
     }
     // Fetch the current value into the R11 pseudo-register.
     const Reg r11{11};
-    (*this)(Mem{.access = u.access, .value = r11, .is_load = true});
+    (*this)(Mem{.access = u.access, .value = r11, .is_load = true}, loc);
 
     // Compute the new value in R11.
-    (*this)(atomic_to_bin(u));
+    (*this)(atomic_to_bin(u), loc);
 
     if (u.op == Atomic::Op::CMPXCHG) {
         // For CMPXCHG, store the original value in r0.
-        (*this)(Mem{.access = u.access, .value = Reg{R0_RETURN_VALUE}, .is_load = true});
+        (*this)(Mem{.access = u.access, .value = Reg{R0_RETURN_VALUE}, .is_load = true}, loc);
 
         // For the destination, there are 3 possibilities:
         // 1) dst.value == r0.value : set R11 to valreg
@@ -249,13 +249,13 @@ void type_domain_t::operator()(const Atomic &u, location_t loc) {
         insert_in_registers_in_interval_domain(register_t{11}, loc, interval_t::top());
     } else if (u.fetch) {
         // For other FETCH operations, store the original value in the src register.
-        (*this)(Mem{.access = u.access, .value = u.valreg, .is_load = true});
+        (*this)(Mem{.access = u.access, .value = u.valreg, .is_load = true}, loc);
     }
 
     // Store the new value back in the original shared memory location.
     // Note that do_mem_store() currently doesn't track shared memory values,
     // but stack memory values are tracked and are legal here.
-    (*this)(Mem{.access = u.access, .value = r11, .is_load = false});
+    (*this)(Mem{.access = u.access, .value = r11, .is_load = false}, loc);
 
     // Clear the R11 pseudo-register.
     m_region -= register_t{11};

From 19872f1e7263068756b5d3232fe1ccbf98525f24 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 25 Apr 2024 10:12:07 -0400
Subject: [PATCH 205/373] Some refactoring related to FuncConstraint and Callx

Did some refactoring related to FuncConstraint and Callx operations;
These operations are not supported yet, as current benchmarks do not
rely on it, TODO in future;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.hpp          | 1 -
 src/crab/region_domain.cpp          | 4 ----
 src/crab/region_domain.hpp          | 1 -
 src/crab/signed_interval_domain.hpp | 1 -
 src/crab/type_domain.cpp            | 8 ++++++++
 src/crab/type_domain.hpp            | 2 +-
 6 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index f9b2d1793..662bcc0c9 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -147,7 +147,6 @@ class offset_domain_t final {
     void operator()(const LoadMapFd&, location_t loc = boost::none);
     void operator()(const Atomic&, location_t loc = boost::none) {}
     void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none);
     void operator()(const Exit&, location_t loc = boost::none);
     void operator()(const Jmp&, location_t loc = boost::none);
     void operator()(const Mem&, location_t loc = boost::none);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index afcb956d3..2f5a8ed01 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -729,10 +729,6 @@ void region_domain_t::operator()(const Call& u, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::operator()(const Callx &u, location_t loc) {
-    // WARNING: Not implemented yet.
-}
-
 void region_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
     // WARNING: Not implemented yet.
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 1ac9bd1c9..f0083d21f 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -138,7 +138,6 @@ class region_domain_t final {
     void operator()(const LoadMapFd&, location_t loc = boost::none);
     void operator()(const Atomic&, location_t loc = boost::none);
     void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none);
     void operator()(const Exit&, location_t loc = boost::none);
     void operator()(const Jmp&, location_t loc = boost::none);
     void operator()(const Mem&, location_t loc = boost::none);
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 52de2e1a2..91274ab0f 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -118,7 +118,6 @@ class signed_interval_domain_t final {
     void operator()(const LoadMapFd&, location_t loc = boost::none);
     void operator()(const Atomic&, location_t loc = boost::none) {}
     void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none) {}
     void operator()(const Exit&, location_t loc = boost::none);
     void operator()(const Jmp&, location_t loc = boost::none);
     void operator()(const Mem&, location_t loc = boost::none);
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 17e014cb9..ae8dff8ef 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -300,6 +300,8 @@ void type_domain_t::operator()(const Call& u, location_t loc) {
 
 void type_domain_t::operator()(const Callx &u, location_t loc) {
     // WARNING: Not implemented yet
+    // This operation is not needed for current benchmarks,
+    // TODO: implement this if needed
 }
 
 void type_domain_t::operator()(const Exit& u, location_t loc) {
@@ -367,6 +369,12 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
     }
 }
 
+void type_domain_t::operator()(const FuncConstraint& s, location_t loc) {
+    // WARNING: Not implemented yet
+    // This operation is not needed for current benchmarks,
+    // TODO: implement this if needed
+}
+
 void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type_reg = m_interval.find_unsigned_interval_value(u.reg.v);
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
index c99645b97..41683d74d 100644
--- a/src/crab/type_domain.hpp
+++ b/src/crab/type_domain.hpp
@@ -73,7 +73,7 @@ class type_domain_t final {
     void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
     void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none) {};
+    void operator()(const FuncConstraint& s, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;

From 55a19974aaaef0f93791a9b9fd908e440063e8e9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 7 Jul 2024 11:15:49 -0400
Subject: [PATCH 206/373] Removing packet end and packet meta from offset
 domain registers

We do not need these values stored in registers, as these do not change,
however, we do need these as static member methods for refinement_t

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 13 ++++++-------
 src/crab/offset_domain.hpp |  9 ++-------
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 46ae20180..688ea2725 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -142,22 +142,21 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
             }
         }
     }
-    // need special handling for the registers v_begin, v_end, and v_meta
-    for (uint8_t i = NUM_REGISTERS; i < NUM_REGISTERS+3; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
+    // need special handling for the registers v_begin
+    if (m_cur_def[NUM_REGISTERS] != nullptr && other.m_cur_def[NUM_REGISTERS] != nullptr) {
+        auto it1 = find(*(m_cur_def[NUM_REGISTERS]));
+        auto it2 = other.find(*(other.m_cur_def[NUM_REGISTERS]));
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             auto rf_joined = rf1 | rf2;
-            joined_state.insert(register_t{i}, loc, std::move(rf_joined));
+            joined_state.insert(register_t{NUM_REGISTERS}, loc, std::move(rf_joined));
         }
     }
     return joined_state;
 }
 
 void registers_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS+3; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS+1; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, std::move(*it));
         }
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 662bcc0c9..6bca9b6a5 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -7,7 +7,8 @@
 
 namespace crab {
 
-using live_refinements_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS+3>;
+// +1 for v_begin
+using live_refinements_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS+1>;
 using global_offset_env_t = std::unordered_map<reg_with_loc_t, refinement_t>;
 
 class registers_state_t {
@@ -32,12 +33,6 @@ class registers_state_t {
             if (desc->data >= 0) {
                 insert(register_t{12}, loc, refinement_t::begin());
             }
-            if (desc->end >= 0) {
-                insert(register_t{13}, loc, refinement_t::end());
-            }
-            if (desc->meta >= 0) {
-                insert(register_t{14}, loc, refinement_t::meta());
-            }
         }
 
         explicit registers_state_t(live_refinements_t&& vars,

From 9b07a54c6e4a3d25dd9000dcf3b309d5cb8e4670 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 7 Jul 2024 11:37:05 -0400
Subject: [PATCH 207/373] Refactor

Some refactoring with variable renaming for better readability

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp    | 31 +++++++++++++++----------------
 src/crab/constraint.hpp    | 10 +++++-----
 src/crab/expression.cpp    | 26 +++++++++++++-------------
 src/crab/expression.hpp    | 14 +++++++-------
 src/crab/offset_domain.cpp |  6 +++---
 src/crab/refinement.cpp    |  4 ++--
 6 files changed, 45 insertions(+), 46 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index fb4d48268..be9b52735 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -9,23 +9,22 @@ std::ostream &operator<<(std::ostream &o, const constraint_t &c) {
 }
 
 bool constraint_t::contains(const symbol_t &s) const {
-    return _expression_lhs.contains(s) || _expression_rhs.contains(s);
+    return _lhs.contains(s) || _rhs.contains(s);
 }
 
 void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
-    auto neg = _expression_rhs.negate();
-    _expression_lhs = _expression_lhs + _expression_rhs.negate();
-    _expression_rhs = expression_t(0);
-    for (auto &e : _expression_lhs.get_symbol_terms()) {
+    auto neg = _rhs.negate();
+    _lhs = _lhs + _rhs.negate();
+    _rhs = expression_t(0);
+    for (auto &e : _lhs.get_symbol_terms()) {
         if (e.second == 0) {
-            _expression_lhs -= e.first;
+            _lhs -= e.first;
         }
         else if (e.first.is_slack()) {
             auto val = slacks->find(e.first);
             if (val != slacks->end()) {
-                _expression_lhs -= e.first;
-                _expression_lhs = _expression_lhs +
-                    val->second.to_interval() * interval_t{(int)e.second};
+                _lhs -= e.first;
+                _lhs = _lhs + val->second.to_interval() * interval_t{(int)e.second};
             }
         }
     }
@@ -33,27 +32,27 @@ void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
 
 bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
     simplify(slacks);
-    symbol_terms_t terms = _expression_lhs.get_symbol_terms();
+    symbol_terms_t terms = _lhs.get_symbol_terms();
     if (terms.size() == 1 && terms.begin()->first == symbol_t::begin()) {
         // we can sometimes simplify if we have a single symbol begin, since it is always offset 0
-        _expression_lhs -= terms.begin()->first;
+        _lhs -= terms.begin()->first;
     }
-    if (!_expression_lhs.is_constant()) {
+    if (!_lhs.is_constant()) {
         return false;
     }
-    auto constant = _expression_lhs.get_interval();
-    //auto interval_0 = _expression_rhs.get_interval();
+    auto constant = _lhs.get_constant_term();
+    //auto interval_0 = _rhs.get_constant_term();
     return (bound_t{number_t{0}} < constant.lb());
     //return (constant.ub() > interval_0.lb()) && ((constant & interval_0) == interval_t::bottom());
 }
 
 constraint_t constraint_t::negate() const {
     // neg(x <= y) -> x > y -> y < x -> y <= x - 1
-    return constraint_t(_expression_rhs, _expression_lhs + (-1));
+    return constraint_t(_rhs, _lhs + (-1));
 }
 
 void constraint_t::write(std::ostream &o) const {
-    o << _expression_lhs << " <= " << _expression_rhs;
+    o << _lhs << " <= " << _rhs;
 }
 
 } // namespace crab
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 75a6ce9c8..37bd0512f 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -12,17 +12,17 @@ using slacks_t = std::map<symbol_t, mock_interval_t>;
 // represents a constraint of the form lhs <= rhs
 class constraint_t {
   private:
-    expression_t _expression_lhs;
-    expression_t _expression_rhs;
+    expression_t _lhs;
+    expression_t _rhs;
 
   public:
     constraint_t(expression_t lhs, expression_t rhs)
-        : _expression_lhs(lhs), _expression_rhs(rhs) {}
+        : _lhs(lhs), _rhs(rhs) {}
 
     bool is_bottom(std::shared_ptr<slacks_t>);
 
-    expression_t get_lhs() const { return _expression_lhs; }
-    expression_t get_rhs() const { return _expression_rhs; }
+    expression_t get_lhs() const { return _lhs; }
+    expression_t get_rhs() const { return _rhs; }
 
     constraint_t operator+(const constraint_t&) const;    
     constraint_t operator+(int) const;
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 136b24c1a..614873673 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -9,23 +9,23 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
 }
 
 bool expression_t::operator==(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _interval == other._interval;
+    return _symbol_terms == other._symbol_terms && _constant_term == other._constant_term;
 }
 
 bool expression_t::operator<(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _interval.ub() < other._interval.lb();
+    return _symbol_terms == other._symbol_terms && _constant_term.ub() < other._constant_term.lb();
 }
 
 bool expression_t::operator<=(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _interval.ub() <= other._interval.lb();
+    return _symbol_terms == other._symbol_terms && _constant_term.ub() <= other._constant_term.lb();
 }
 
 bool expression_t::operator>(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _interval.lb() > other._interval.ub();
+    return _symbol_terms == other._symbol_terms && _constant_term.lb() > other._constant_term.ub();
 }
 
 bool expression_t::is_singleton() const {
-    return _symbol_terms.size() == 1 && _interval == interval_t{0};
+    return _symbol_terms.size() == 1 && _constant_term == interval_t{0};
 }
 
 bool expression_t::contains(const symbol_t &s) const {
@@ -65,7 +65,7 @@ expression_t expression_t::negate() const {
     for (const auto &term : _symbol_terms) {
         new_terms[term.first] = -term.second;
     }
-    return expression_t(new_terms, -_interval);
+    return expression_t(new_terms, -_constant_term);
 }
 
 expression_t expression_t::operator+(const expression_t &other) const {
@@ -73,11 +73,11 @@ expression_t expression_t::operator+(const expression_t &other) const {
     for (const auto &term : other._symbol_terms) {
         insert(new_terms, term);
     }
-    return expression_t(new_terms, _interval + other._interval);
+    return expression_t(new_terms, _constant_term + other._constant_term);
 }
 
-expression_t expression_t::operator+(interval_t interval) const {
-    return expression_t(_symbol_terms, _interval + interval);
+expression_t expression_t::operator+(interval_t constant) const {
+    return expression_t(_symbol_terms, _constant_term + constant);
 }
 
 expression_t expression_t::operator+(int n) const {
@@ -106,8 +106,8 @@ expression_t expression_t::operator|(const expression_t &other) const {
             new_terms[term.first] = term.second;
         }
     }
-    interval_t new_interval = _interval | other._interval;
-    return expression_t(new_terms, new_interval);
+    interval_t new_constant_term = _constant_term | other._constant_term;
+    return expression_t(new_terms, new_constant_term);
 }
 
 void expression_t::write(std::ostream &o) const {
@@ -122,13 +122,13 @@ void expression_t::write(std::ostream &o) const {
         }
         i++;
     }
-    if (auto s = _interval.singleton()) {
+    if (auto s = _constant_term.singleton()) {
         if ((int)*s != 0 || _symbol_terms.empty()) {
             if (!_symbol_terms.empty()) o << " + ";
             o <<  *s;
         }
     } else {
-        o << " + " << _interval;
+        o << " + " << _constant_term;
     }
 }
 
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index cc17b4642..517eda39c 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -16,19 +16,19 @@ using symbol_terms_t = std::map<symbol_t, int8_t>;
 class expression_t {
   private:
     symbol_terms_t _symbol_terms;
-    interval_t _interval;
+    interval_t _constant_term;
 
   public:
-    expression_t() : _interval(interval_t::top()) {};
+    expression_t() : _constant_term(interval_t::top()) {};
     expression_t(symbol_terms_t symbol_terms, interval_t interval = interval_t{0})
-        : _symbol_terms(symbol_terms), _interval(interval) {}
-    expression_t(symbol_t symbol) : _interval(interval_t{0}) {
+        : _symbol_terms(symbol_terms), _constant_term(interval) {}
+    expression_t(symbol_t symbol) : _constant_term(interval_t{0}) {
         _symbol_terms[symbol] = 1;
     }
     expression_t(interval_t interval)
-        : _symbol_terms(symbol_terms_t{}), _interval(interval) {}
+        : _symbol_terms(symbol_terms_t{}), _constant_term(interval) {}
     expression_t(int n)
-        : _symbol_terms(symbol_terms_t{}), _interval(interval_t{n}) {}
+        : _symbol_terms(symbol_terms_t{}), _constant_term(interval_t{n}) {}
     bool operator==(const expression_t &other) const;
     bool operator<(const expression_t &other) const;
     bool operator<=(const expression_t &other) const;
@@ -46,7 +46,7 @@ class expression_t {
     expression_t substitute(const symbol_t &, const expression_t &) const;
     bool contains(const symbol_t &s) const;
     symbol_t get_singleton() const;
-    interval_t get_interval() const { return _interval; }
+    interval_t get_constant_term() const { return _constant_term; }
 
     static expression_t begin() {
         return expression_t({std::make_pair(symbol_t::begin(), 1)});
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 688ea2725..1f142cefa 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -113,8 +113,8 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
                     bool added = false;
                     auto symbol_terms1 = rf1_value.get_symbol_terms();
                     auto symbol_terms2 = rf2_value.get_symbol_terms();
-                    auto interval_rf1_value = rf1_value.get_interval();
-                    auto interval_rf2_value = rf2_value.get_interval();
+                    auto interval_rf1_value = rf1_value.get_constant_term();
+                    auto interval_rf2_value = rf2_value.get_constant_term();
                     for (auto it = symbol_terms1.begin(); it != symbol_terms1.end(); it++) {
                         // assuming slack variables are at same position in both states
                         if (!added && it->first.is_slack()) {
@@ -460,7 +460,7 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     refinement_t result_rf = *dst_rf - *src_rf;
     expression_t result_expr = result_rf.get_value();
     if (result_expr.is_constant()) {
-        return result_expr.get_interval();
+        return result_expr.get_constant_term();
     }
     // with non-singleton expressions, we might be able to compute subtraction,
     // but it might be complicated
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index ea9e781f4..3bbe2ffe7 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -170,12 +170,12 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
                 if (terms.size() == 2) {
                     if (terms[dst] == 1 && terms[src] == -1) {
                         // dst - src + [lb, ub] <= 0 -> dst - src <= -lb
-                        interval_t lhs_interval = lhs.get_interval();
+                        interval_t lhs_interval = lhs.get_constant_term();
                         result = result & interval_t{-max_size, -lhs_interval.lb()};
                     }
                     else if (terms[dst] == -1 && terms[src] == 1) {
                         // src - dst + [lb, ub] <= 0 -> dst - src >= -lb
-                        interval_t lhs_interval = lhs.get_interval();
+                        interval_t lhs_interval = lhs.get_constant_term();
                         result = result & interval_t{lhs_interval.lb(), max_size};
                     }
                 }

From 3fbfcdc9e3caa4121eec23e0e7219fdd152cd7d2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 7 Jul 2024 22:36:40 -0400
Subject: [PATCH 208/373] Simplifications in offset domain

Many simplifications for better handling offset domain, and better
processing of invariants;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp    | 28 +++-----------
 src/crab/constraint.hpp    |  7 +---
 src/crab/expression.cpp    | 74 ++++++++++++++++++++++++++-----------
 src/crab/expression.hpp    | 21 +++++++++--
 src/crab/offset_domain.cpp | 76 +++++++-------------------------------
 src/crab/refinement.cpp    | 54 +++++++++++++--------------
 src/crab/refinement.hpp    |  6 +--
 7 files changed, 119 insertions(+), 147 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index be9b52735..ac6229c6b 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -12,38 +12,20 @@ bool constraint_t::contains(const symbol_t &s) const {
     return _lhs.contains(s) || _rhs.contains(s);
 }
 
-void constraint_t::simplify(std::shared_ptr<slacks_t> slacks) {
-    auto neg = _rhs.negate();
+void constraint_t::simplify() {
     _lhs = _lhs + _rhs.negate();
     _rhs = expression_t(0);
-    for (auto &e : _lhs.get_symbol_terms()) {
-        if (e.second == 0) {
-            _lhs -= e.first;
-        }
-        else if (e.first.is_slack()) {
-            auto val = slacks->find(e.first);
-            if (val != slacks->end()) {
-                _lhs -= e.first;
-                _lhs = _lhs + val->second.to_interval() * interval_t{(int)e.second};
-            }
-        }
-    }
 }
 
-bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
-    simplify(slacks);
+bool constraint_t::is_bottom() {
+    simplify();
     symbol_terms_t terms = _lhs.get_symbol_terms();
     if (terms.size() == 1 && terms.begin()->first == symbol_t::begin()) {
         // we can sometimes simplify if we have a single symbol begin, since it is always offset 0
         _lhs -= terms.begin()->first;
     }
-    if (!_lhs.is_constant()) {
-        return false;
-    }
-    auto constant = _lhs.get_constant_term();
-    //auto interval_0 = _rhs.get_constant_term();
-    return (bound_t{number_t{0}} < constant.lb());
-    //return (constant.ub() > interval_0.lb()) && ((constant & interval_0) == interval_t::bottom());
+
+    return _lhs.is_greater_than(expression_t(0));
 }
 
 constraint_t constraint_t::negate() const {
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 37bd0512f..3e13d5b64 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -3,12 +3,9 @@
 #pragma once
 
 #include "expression.hpp"
-#include "common.hpp"
 
 namespace crab {
 
-using slacks_t = std::map<symbol_t, mock_interval_t>;
-
 // represents a constraint of the form lhs <= rhs
 class constraint_t {
   private:
@@ -19,7 +16,7 @@ class constraint_t {
     constraint_t(expression_t lhs, expression_t rhs)
         : _lhs(lhs), _rhs(rhs) {}
 
-    bool is_bottom(std::shared_ptr<slacks_t>);
+    bool is_bottom();
 
     expression_t get_lhs() const { return _lhs; }
     expression_t get_rhs() const { return _rhs; }
@@ -33,7 +30,7 @@ class constraint_t {
     constraint_t operator>(const constraint_t&) const;
     bool is_equality() const;
     bool contains(const symbol_t&) const;
-    void simplify(std::shared_ptr<slacks_t>);
+    void simplify();
     [[nodiscard]] constraint_t negate() const;
     void write(std::ostream&) const;
 };
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 614873673..f1b24d7b2 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -8,6 +8,35 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
     return o;
 }
 
+expression_t expression_t::get_equivalent_expression() const {
+    interval_t value = _constant_term;
+    symbol_terms_t symbol_terms;
+    for (const auto &term : _symbol_terms) {
+        if (term.first.is_slack()) {
+            value = value + ((*_slacks)[term.first]).to_interval() * interval_t{(int)term.second};
+        } else {
+            symbol_terms[term.first] = term.second;
+        }
+    }
+    return expression_t(symbol_terms, value, _slacks);
+}
+
+bool expression_t::is_equal(const expression_t &other) const {
+    return get_equivalent_expression() == other.get_equivalent_expression();
+}
+
+bool expression_t::is_less_than(const expression_t &other) const {
+    return get_equivalent_expression() < other.get_equivalent_expression();
+}
+
+bool expression_t::is_less_or_equal(const expression_t &other) const {
+    return get_equivalent_expression() <= other.get_equivalent_expression();
+}
+
+bool expression_t::is_greater_than(const expression_t &other) const {
+    return get_equivalent_expression() > other.get_equivalent_expression();
+}
+
 bool expression_t::operator==(const expression_t &other) const {
     return _symbol_terms == other._symbol_terms && _constant_term == other._constant_term;
 }
@@ -65,7 +94,7 @@ expression_t expression_t::negate() const {
     for (const auto &term : _symbol_terms) {
         new_terms[term.first] = -term.second;
     }
-    return expression_t(new_terms, -_constant_term);
+    return expression_t(new_terms, -_constant_term, _slacks);
 }
 
 expression_t expression_t::operator+(const expression_t &other) const {
@@ -73,11 +102,12 @@ expression_t expression_t::operator+(const expression_t &other) const {
     for (const auto &term : other._symbol_terms) {
         insert(new_terms, term);
     }
-    return expression_t(new_terms, _constant_term + other._constant_term);
+    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
+    return expression_t(new_terms, _constant_term + other._constant_term, slacks);
 }
 
 expression_t expression_t::operator+(interval_t constant) const {
-    return expression_t(_symbol_terms, _constant_term + constant);
+    return expression_t(_symbol_terms, _constant_term + constant, _slacks);
 }
 
 expression_t expression_t::operator+(int n) const {
@@ -85,29 +115,31 @@ expression_t expression_t::operator+(int n) const {
 }
 
 expression_t expression_t::operator|(const expression_t &other) const {
-    if (_symbol_terms.size() != other._symbol_terms.size()) {
-        return expression_t();
+    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
+    if (_symbol_terms == other._symbol_terms) {
+        return expression_t(_symbol_terms, _constant_term | other._constant_term, slacks);
     }
+    interval_t constant_term = _constant_term;
+    interval_t other_constant_term = other._constant_term;
     symbol_terms_t new_terms;
-    for (auto &term : _symbol_terms) {
-        auto it = other._symbol_terms.find(term.first);
-        if (it == other._symbol_terms.end()) {
-            // we need to know what is the other slack, but it's not accesible directly
-            //if (term.first.is_slack() && it->first.is_slack()) {
-                auto new_slack = symbol_t::make();
-                new_terms[new_slack] = 1;
-            //}
-            //else {
-            //    return expression_t();
-            //}
-        }
-        else {
-            // TODO: some complex logic is needed here
+    for (const auto &term : _symbol_terms) {
+        if (other._symbol_terms.find(term.first) != other._symbol_terms.end()) {
             new_terms[term.first] = term.second;
+        } else {
+            constant_term = constant_term +
+                interval_t{(int)term.second} * (*slacks)[term.first].to_interval();
+        }
+    }
+    for (const auto &term : other._symbol_terms) {
+        if (_symbol_terms.find(term.first) == _symbol_terms.end()) {
+            other_constant_term = other_constant_term +
+                interval_t{(int)term.second} * (*slacks)[term.first].to_interval();
         }
     }
-    interval_t new_constant_term = _constant_term | other._constant_term;
-    return expression_t(new_terms, new_constant_term);
+    symbol_t new_slack = symbol_t::make();
+    new_terms[new_slack] = 1;
+    (*slacks)[new_slack] = constant_term | other_constant_term;
+    return expression_t(new_terms, interval_t{0}, slacks);
 }
 
 void expression_t::write(std::ostream &o) const {
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 517eda39c..80997ca69 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -6,29 +6,43 @@
 #include <cassert>
 #include "symbol.hpp"
 #include "interval.hpp"
+#include "common.hpp"
 
 namespace crab {
 // An expression is of form: Ax + By + Cz + ... + I.
 // x, y, z, ... are symbols, and A, B, C, ... are coefficients.
 // I is an interval.
     
+using slacks_t = std::map<symbol_t, mock_interval_t>;
 using symbol_terms_t = std::map<symbol_t, int8_t>;
 class expression_t {
   private:
     symbol_terms_t _symbol_terms;
     interval_t _constant_term;
+    std::shared_ptr<slacks_t> _slacks = nullptr;
 
   public:
     expression_t() : _constant_term(interval_t::top()) {};
     expression_t(symbol_terms_t symbol_terms, interval_t interval = interval_t{0})
         : _symbol_terms(symbol_terms), _constant_term(interval) {}
-    expression_t(symbol_t symbol) : _constant_term(interval_t{0}) {
+    expression_t(symbol_t symbol, std::shared_ptr<slacks_t> slacks)
+        : _constant_term(interval_t{0}), _slacks(slacks) {
         _symbol_terms[symbol] = 1;
     }
+    expression_t(symbol_terms_t symbol_terms, interval_t interval,
+            std::shared_ptr<slacks_t> slacks)
+        : _symbol_terms(symbol_terms), _constant_term(interval), _slacks(slacks) {}
+    expression_t(symbol_terms_t symbol_terms, std::shared_ptr<slacks_t> slacks)
+        : _symbol_terms(symbol_terms), _constant_term{interval_t{0}}, _slacks(slacks) {}
     expression_t(interval_t interval)
-        : _symbol_terms(symbol_terms_t{}), _constant_term(interval) {}
+        : _constant_term(interval) {}
     expression_t(int n)
-        : _symbol_terms(symbol_terms_t{}), _constant_term(interval_t{n}) {}
+        : _constant_term(interval_t{n}) {}
+    expression_t get_equivalent_expression() const;
+    bool is_equal(const expression_t &other) const;
+    bool is_less_than(const expression_t &other) const;
+    bool is_less_or_equal(const expression_t &other) const;
+    bool is_greater_than(const expression_t &other) const;
     bool operator==(const expression_t &other) const;
     bool operator<(const expression_t &other) const;
     bool operator<=(const expression_t &other) const;
@@ -47,6 +61,7 @@ class expression_t {
     bool contains(const symbol_t &s) const;
     symbol_t get_singleton() const;
     interval_t get_constant_term() const { return _constant_term; }
+    std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
 
     static expression_t begin() {
         return expression_t({std::make_pair(symbol_t::begin(), 1)});
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 1f142cefa..f1d9adf1e 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -94,64 +94,17 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
     registers_state_t joined_state(m_offset_env, m_slacks);
     location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
 
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS+1; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             if (rf1.same_type(rf2)) {
-                expression_t rf1_value = rf1.get_value();
-                expression_t rf2_value = rf2.get_value();
-                if (rf1_value == rf2_value) {
-                    joined_state.insert(register_t{i}, loc, std::move(rf1));
-                }
-                else {
-                    //joined_state.insert(register_t{i}, loc, std::move(rf1 | rf2));
-                    symbol_t s = symbol_t::make();
-                    symbol_terms_t terms;
-                    bool added = false;
-                    auto symbol_terms1 = rf1_value.get_symbol_terms();
-                    auto symbol_terms2 = rf2_value.get_symbol_terms();
-                    auto interval_rf1_value = rf1_value.get_constant_term();
-                    auto interval_rf2_value = rf2_value.get_constant_term();
-                    for (auto it = symbol_terms1.begin(); it != symbol_terms1.end(); it++) {
-                        // assuming slack variables are at same position in both states
-                        if (!added && it->first.is_slack()) {
-                            auto slack1 = it->first;
-                            auto dist = std::distance(symbol_terms1.begin(), it);
-                            auto it2 = std::next(symbol_terms2.begin(), dist);
-                            auto slack2 = it2->first;
-                            auto slack1_value = find_slack_value(slack1);
-                            auto slack2_value = other.find_slack_value(slack2);
-                            if (slack1_value && slack2_value) {
-                                auto interval1 = slack1_value->to_interval() + interval_rf1_value;
-                                auto interval2 = slack2_value->to_interval() + interval_rf2_value;
-                                auto interval = interval1 | interval2;
-                                terms[s] = 1;
-                                (*m_slacks)[s] = mock_interval_t{interval};
-                                added = true;
-                                continue;
-                            }
-                        }
-                        terms[it->first] = it->second;
-                    }
-                    auto rf = refinement_t(rf1.get_type(), expression_t(terms));
-                    joined_state.insert(register_t{i}, loc, std::move(rf));
-                }
+                joined_state.insert(register_t{i}, loc, std::move(rf1 | rf2));
             }
         }
     }
-    // need special handling for the registers v_begin
-    if (m_cur_def[NUM_REGISTERS] != nullptr && other.m_cur_def[NUM_REGISTERS] != nullptr) {
-        auto it1 = find(*(m_cur_def[NUM_REGISTERS]));
-        auto it2 = other.find(*(other.m_cur_def[NUM_REGISTERS]));
-        if (it1 && it2) {
-            auto rf1 = *it1, rf2 = *it2;
-            auto rf_joined = rf1 | rf2;
-            joined_state.insert(register_t{NUM_REGISTERS}, loc, std::move(rf_joined));
-        }
-    }
     return joined_state;
 }
 
@@ -414,16 +367,17 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             auto b = m_reg_state.find(register_t{12});
             auto le_rf = *rf_left <= *rf_right;
             if (b) {
+                bool no_constraints = b->get_constraints().empty();
                 b->add_constraint(le_rf);
-                if (rf_right->has_value(refinement_t::end())) {
+                if (rf_right->has_value(refinement_t::end()) && no_constraints) {
                     b->add_constraint(refinement_t::meta() <= refinement_t::begin());
                 }
-                else if (rf_right->has_value(refinement_t::begin())) {
+                else if (rf_right->has_value(refinement_t::begin()) && no_constraints) {
                     b->add_constraint(refinement_t::begin() <= refinement_t::end());
                 }
                 b->simplify();
                 auto b_copy = *b;
-                if (b_copy.is_bottom(m_reg_state.get_slacks())) {
+                if (b_copy.is_bottom()) {
                     set_to_bottom();
                 }
                 else {
@@ -438,7 +392,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                 b->add_constraint(gt_rf);
                 b->simplify();
                 auto b_copy = *b;
-                if (b_copy.is_bottom(m_reg_state.get_slacks())) {
+                if (b_copy.is_bottom()) {
                     set_to_bottom();
                 }
                 else {
@@ -470,14 +424,14 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     std::optional<refinement_t> begin_rf = m_reg_state.find(register_t{12});
     if (!begin_rf) return interval_t::top();
     interval_t result_interval = result_rf.simplify_for_subtraction(dst_symbol, src_symbol,
-            begin_rf->get_constraints(), m_reg_state.get_slacks());
+            begin_rf->get_constraints());
     return result_interval;
 }
 
 static void create_numeric_refinement(registers_state_t& reg_state, mock_interval_t&& interval,
         location_t loc, register_t reg) {
     symbol_t s = symbol_t::make();
-    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s));
+    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s, reg_state.get_slacks()));
     reg_state.insert(reg, loc, std::move(rf));
     reg_state.insert_slack_value(s, std::move(interval));
 }
@@ -493,11 +447,6 @@ void offset_domain_t::do_bin(const Bin& bin,
 
     auto dst_register = register_t{bin.dst.v};
 
-    //if (!is_packet_ptr(src_ptr_or_mapfd_opt) && !is_packet_ptr(dst_ptr_or_mapfd_opt) &&
-    //        (!src_signed_interval_opt && bin.op != Op::MOV) && !dst_signed_interval_opt) {
-    //    return interval_t::bottom();
-    //}
-
     if (std::holds_alternative<Imm>(bin.v)) {
         int64_t imm;
         if (bin.is64) {
@@ -542,7 +491,8 @@ void offset_domain_t::do_bin(const Bin& bin,
             default: {
                 if (dst_signed_interval_opt) {
                     symbol_t s = symbol_t::make();
-                    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s));
+                    refinement_t rf = refinement_t(data_type_t::NUM,
+                            expression_t(s, m_reg_state.get_slacks()));
                     m_reg_state.insert(dst_register, loc, std::move(rf));
                     m_reg_state.insert_slack_value(s, interval_result);
                 }
@@ -697,7 +647,7 @@ bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
     auto reg = m_reg_state.find(r.v);
     if (!reg) return false;
     auto toCheck = *reg + (offset+width);
-    return toCheck.is_safe_with(*begin, m_reg_state.get_slacks(), is_comparison_check);
+    return toCheck.is_safe_with(*begin, is_comparison_check);
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
@@ -728,7 +678,7 @@ void offset_domain_t::do_mem_store(const Mem& b,
     }
     else {
         symbol_t s = symbol_t::make();
-        rf_info = refinement_t(data_type_t::NUM, expression_t(s));
+        rf_info = refinement_t(data_type_t::NUM, expression_t(s, m_reg_state.get_slacks()));
         auto mock_interval = mock_interval_t{bound_t{(uint64_t)std::get<Imm>(b.value).v}};
         m_reg_state.insert_slack_value(s, std::move(mock_interval));
     }
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 3bbe2ffe7..825b22b80 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -40,12 +40,12 @@ std::ostream& operator<<(std::ostream& o, const refinement_t& r) {
     return o;
 }
 
-bool refinement_t::is_bottom(std::shared_ptr<slacks_t> slacks) {
+bool refinement_t::is_bottom() {
     std::vector<constraint_t> constraints_to_check = _constraints;
     int i = 0;
     while (i <= PROPAGATE_INEQUALITIES) {
         for (constraint_t c : constraints_to_check) {
-            if (c.is_bottom(slacks)) {
+            if (c.is_bottom()) {
                 return true;
             }
         }
@@ -134,7 +134,7 @@ refinement_t refinement_t::operator+(const refinement_t &other) const {
 }
 
 interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src,
-        const std::vector<constraint_t>& constraints, std::shared_ptr<slacks_t> slacks) const {
+        const std::vector<constraint_t>& constraints) const {
     bound_t max_packet_size = bound_t{number_t{MAX_PACKET_SIZE}};
     bound_t max_meta_size = bound_t{number_t{4098}};
     bound_t zero = bound_t{number_t{0}};
@@ -159,25 +159,20 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
 
     interval_t result = interval_t::top();
     for (constraint_t c : constraints) {
-        c.simplify(slacks);
-        if (c.contains(dst) && c.contains(src)) {
-            expression_t lhs = c.get_lhs();
-            expression_t rhs = c.get_rhs();
-            lhs = lhs + rhs.negate();
-            rhs = expression_t{0};
-            if (lhs.contains(dst) && lhs.contains(src)) {
-                symbol_terms_t terms = lhs.get_symbol_terms();
-                if (terms.size() == 2) {
-                    if (terms[dst] == 1 && terms[src] == -1) {
-                        // dst - src + [lb, ub] <= 0 -> dst - src <= -lb
-                        interval_t lhs_interval = lhs.get_constant_term();
-                        result = result & interval_t{-max_size, -lhs_interval.lb()};
-                    }
-                    else if (terms[dst] == -1 && terms[src] == 1) {
-                        // src - dst + [lb, ub] <= 0 -> dst - src >= -lb
-                        interval_t lhs_interval = lhs.get_constant_term();
-                        result = result & interval_t{lhs_interval.lb(), max_size};
-                    }
+        c.simplify();
+        expression_t lhs = c.get_lhs();
+        if (lhs.contains(dst) && lhs.contains(src)) {
+            symbol_terms_t terms = lhs.get_symbol_terms();
+            if (terms.size() == 2) {
+                if (terms[dst] == 1 && terms[src] == -1) {
+                    // dst - src + [lb, ub] <= 0 -> dst - src <= -lb
+                    interval_t lhs_interval = lhs.get_constant_term();
+                    result = result & interval_t{-max_size, -lhs_interval.lb()};
+                }
+                else if (terms[dst] == -1 && terms[src] == 1) {
+                    // src - dst + [lb, ub] <= 0 -> dst - src >= lb
+                    interval_t lhs_interval = lhs.get_constant_term();
+                    result = result & interval_t{lhs_interval.lb(), max_size};
                 }
             }
         }
@@ -221,13 +216,15 @@ refinement_t refinement_t::operator|(const refinement_t &other) const {
         for (size_t j = 0; j < other._constraints.size(); j++) {
             auto c = _constraints[i];
             auto c1 = other._constraints[j];
-            if (c.get_lhs() == c1.get_lhs() && c.get_rhs() == c1.get_rhs()) {
+            auto lhs = c.get_lhs();
+            auto lhs1 = c1.get_lhs();
+            if (lhs.is_equal(lhs1)) {
                 to_keep.insert(i);
             }
-            else if (c.get_rhs() == c1.get_rhs() && c.get_lhs() < c1.get_lhs()) {
+            else if (lhs.is_less_than(lhs1)) {
                 to_keep.insert(i);
             }
-            else if (c.get_rhs() == c1.get_rhs() && c1.get_lhs() < c.get_lhs()) {
+            else if (lhs1.is_less_than(lhs)) {
                 to_keep1.insert(j);
             }
         }
@@ -259,20 +256,19 @@ void refinement_t::add_constraint(const constraint_t& c) {
     _constraints.push_back(c);
 }
 
-bool refinement_t::is_safe_with(refinement_t begin, std::shared_ptr<slacks_t> slacks,
-        bool is_comparison_check) const {
+bool refinement_t::is_safe_with(refinement_t begin, bool is_comparison_check) const {
     refinement_t check_lb = begin;
     auto lb = constraint_t(expression_t::meta(), _value);
     constraint_t neg_lb = lb.negate();
     check_lb.add_constraint(neg_lb);
-    bool lb_satisfied = check_lb.is_bottom(slacks);
+    bool lb_satisfied = check_lb.is_bottom();
 
     refinement_t check_ub = std::move(begin);
     auto ub = is_comparison_check ? constraint_t(_value, expression_t(interval_t{MAX_PACKET_SIZE}))
         : constraint_t(_value, expression_t::end());
     constraint_t neg_ub = ub.negate();
     check_ub.add_constraint(neg_ub);
-    bool ub_satisfied = check_ub.is_bottom(slacks);
+    bool ub_satisfied = check_ub.is_bottom();
 
     return lb_satisfied && ub_satisfied;
 }
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index e01083909..7ed50e98b 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -23,7 +23,7 @@ class refinement_t {
         : _type(type), _value(value), _constraints(constraints) {}
     refinement_t() : _type(data_type_t::ANY) {}
  
-    bool is_bottom(std::shared_ptr<slacks_t>);
+    bool is_bottom();
     [[nodiscard]] data_type_t get_type() const { return _type; }
     [[nodiscard]] std::vector<crab::constraint_t> get_constraints() const { return _constraints; }
     [[nodiscard]] expression_t get_value() const { return _value; }
@@ -39,9 +39,9 @@ class refinement_t {
     bool same_type(const refinement_t &other) const;
     void add_constraint(const constraint_t&);
     void simplify();
-    bool is_safe_with(refinement_t, std::shared_ptr<slacks_t>, bool) const;
+    bool is_safe_with(refinement_t, bool) const;
     interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
-            const std::vector<constraint_t>&, std::shared_ptr<slacks_t>) const;
+            const std::vector<constraint_t>&) const;
 
     static refinement_t begin() {
         return refinement_t(data_type_t::PACKET, expression_t::begin());

From 1034a62004fe8c0d6e18184f7b3834e32e548b8d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 01:20:01 -0400
Subject: [PATCH 209/373] Removing duplicate lemmas after join operation

In refinement class, duplicate clauses were getting accumulated in
formulas, which caused a significant performance loss, hence a simple
check removes duplicate candidates;
Possibly, make this check for everytime we add a constraint;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 825b22b80..af83a6478 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -239,6 +239,17 @@ refinement_t refinement_t::operator|(const refinement_t &other) const {
             new_constraints.push_back(other._constraints[i]);
         }
     }
+    // remove duplicates
+    for (int i = 0; i < (int)new_constraints.size()-1; i++) {
+        for (int j = i+1; j < (int)new_constraints.size(); j++) {
+            auto c = new_constraints[i];
+            auto c1 = new_constraints[j];
+            c.simplify();   c1.simplify();
+            if (c.get_lhs().is_equal(c1.get_lhs())) {
+                new_constraints.erase(new_constraints.begin() + j);
+            }
+        }
+    }
     return refinement_t(_type, joined_value, new_constraints);
 }
 

From 76e2961086554dd5252c21b38c416ee238b8c430 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 04:13:03 -0400
Subject: [PATCH 210/373] Fixing a seg fault due to slacks not found

When joining two expressions that both do not contain slacks pointer,
like `begin + 14` and `begin + 18`, we need to create a join like
`begin + a0 & a0 = [14, 18]`, but we do not have slacks pointer to store
`a0` into. Fixing the issue by always storing slacks pointer, even when
no slacks present.

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.cpp    |  4 ++--
 src/crab/expression.hpp    |  1 +
 src/crab/offset_domain.cpp | 20 ++++++++++++++------
 src/crab/offset_domain.hpp |  2 +-
 4 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index f1b24d7b2..9b102510d 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -116,8 +116,8 @@ expression_t expression_t::operator+(int n) const {
 
 expression_t expression_t::operator|(const expression_t &other) const {
     auto slacks = _slacks == nullptr ? other._slacks : _slacks;
-    if (_symbol_terms == other._symbol_terms) {
-        return expression_t(_symbol_terms, _constant_term | other._constant_term, slacks);
+    if (*this == other) {
+        return expression_t(_symbol_terms, _constant_term, slacks);
     }
     interval_t constant_term = _constant_term;
     interval_t other_constant_term = other._constant_term;
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 80997ca69..f414f445a 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -62,6 +62,7 @@ class expression_t {
     symbol_t get_singleton() const;
     interval_t get_constant_term() const { return _constant_term; }
     std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
+    void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
 
     static expression_t begin() {
         return expression_t({std::make_pair(symbol_t::begin(), 1)});
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index f1d9adf1e..0dbce18f3 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -7,6 +7,7 @@ namespace crab {
 
 void registers_state_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
     reg_with_loc_t reg_with_loc{reg, loc};
+    rf.get_value().set_slacks(m_slacks);
     (*m_offset_env)[reg_with_loc] = std::move(rf);
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
@@ -208,15 +209,21 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
     return stack_state_t(std::move(out_stack_rfs));
 }
 
-ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
+ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
     if (desc->data >= 0) {
-        m_rfs[desc->data] = refinement_t::begin();
+        refinement_t rf = refinement_t(data_type_t::PACKET,
+                expression_t(symbol_t::begin(), slacks));
+        m_rfs[desc->data] = std::move(rf);
     }
     if (desc->end >= 0) {
-        m_rfs[desc->end] = refinement_t::end();
+        refinement_t rf = refinement_t(data_type_t::PACKET,
+                expression_t(symbol_t::end(), slacks));
+        m_rfs[desc->end] = std::move(rf);
     }
     if (desc->meta >= 0) {
-        m_rfs[desc->meta] = refinement_t::meta();
+        refinement_t rf = refinement_t(data_type_t::PACKET,
+                expression_t(symbol_t::meta(), slacks));
+        m_rfs[desc->meta] = std::move(rf);
     }
     if (desc->size >= 0) {
         m_size = desc->size;
@@ -234,10 +241,11 @@ std::optional<refinement_t> ctx_offsets_t::find(int key) const {
 }
 
 offset_domain_t&& offset_domain_t::setup_entry() {
+    auto slacks = std::make_shared<slacks_t>();
     std::shared_ptr<ctx_offsets_t> ctx
-        = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor);
+        = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor, slacks);
     registers_state_t regs(std::make_shared<global_offset_env_t>(),
-            std::make_shared<slacks_t>(), global_program_info->type.context_descriptor);
+            slacks, global_program_info->type.context_descriptor);
 
     static offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
     return std::move(off_d);
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 6bca9b6a5..4623936a8 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -89,7 +89,7 @@ class ctx_offsets_t {
     int m_size;
 
     public:
-        ctx_offsets_t(const ebpf_context_descriptor_t* desc);
+        ctx_offsets_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t>);
         std::optional<refinement_t> find(int) const;
         int get_size() const;
 };

From 65c60162062f747a3b5a960b7eaeff2069efcd9a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 04:21:33 -0400
Subject: [PATCH 211/373] Fixing an issue with simplifying refinements;
 Refactor

Simplification of refinement removes any weaker constraints, which was
not done correctly; before it only checked for syntax of the constraints, and
not semantic (by resolving slacks);

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp |  5 +++--
 src/crab/constraint.hpp |  2 +-
 src/crab/refinement.cpp | 38 +++++++++++++++++++++++++++++---------
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index ac6229c6b..2e6d0c0d1 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -12,13 +12,14 @@ bool constraint_t::contains(const symbol_t &s) const {
     return _lhs.contains(s) || _rhs.contains(s);
 }
 
-void constraint_t::simplify() {
+// move all terms to the left side
+void constraint_t::normalize() {
     _lhs = _lhs + _rhs.negate();
     _rhs = expression_t(0);
 }
 
 bool constraint_t::is_bottom() {
-    simplify();
+    normalize();
     symbol_terms_t terms = _lhs.get_symbol_terms();
     if (terms.size() == 1 && terms.begin()->first == symbol_t::begin()) {
         // we can sometimes simplify if we have a single symbol begin, since it is always offset 0
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 3e13d5b64..ac41d3158 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -30,7 +30,7 @@ class constraint_t {
     constraint_t operator>(const constraint_t&) const;
     bool is_equality() const;
     bool contains(const symbol_t&) const;
-    void simplify();
+    void normalize();
     [[nodiscard]] constraint_t negate() const;
     void write(std::ostream&) const;
 };
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index af83a6478..b713e9d4c 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -75,32 +75,52 @@ void refinement_t::write(std::ostream& o) const {
         o << "_";
     }
     o << _value;
+    std::vector<std::pair<symbol_t, interval_t>> slack_intervals;
     if (_constraints.size() > 0) {
         o << " & ";
         for (size_t i = 0; i < _constraints.size(); i++) {
+            auto c = _constraints[i];
+            auto c_slack_intervals = c.get_slack_intervals();
+            slack_intervals.insert(slack_intervals.end(), c_slack_intervals.begin(),
+                    c_slack_intervals.end());
             o << _constraints[i];
             if (i < _constraints.size() - 1) {
                 o << " & ";
             }
         }
     }
+    std::set<symbol_t> seen;
+    if (slack_intervals.size() > 0) {
+        o << " & ";
+        for (auto [s, i] : slack_intervals) {
+            if (seen.find(s) != seen.end()) {
+                continue;
+            }
+            o << s << " = " << i;
+            seen.insert(s);
+            if (s != slack_intervals.back().first) {
+                o << " & ";
+            }
+        }
+    }
     o << "}";
 }
 
 void refinement_t::simplify() {
+    // remove redundant constraints, when found a stronger constraint
+    // e.g., begin + 14 <= end & begin + 34 <= end -> begin + 34 <= end
     std::set<int> to_remove;
     std::vector<crab::constraint_t> constraints;
     for (int i = 0; i < (int)_constraints.size()-1; i++) {
         for (int j = i+1; j < (int)_constraints.size(); j++) {
             auto c = _constraints[i];
             auto c1 = _constraints[j];
-            if (c.get_rhs() == c1.get_rhs()) {
-                if (c.get_lhs() < c1.get_lhs()) {
-                    to_remove.insert(i);
-                }
-                else if (c1.get_lhs() < c.get_lhs()) {
-                    to_remove.insert(j);
-                }
+            c.normalize();   c1.normalize();
+            if (c.get_lhs().is_less_than(c1.get_lhs())) {
+                to_remove.insert(i);
+            }
+            else if (c1.get_lhs().is_less_than(c.get_lhs())) {
+                to_remove.insert(j);
             }
         }
     }
@@ -159,7 +179,7 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
 
     interval_t result = interval_t::top();
     for (constraint_t c : constraints) {
-        c.simplify();
+        c.normalize();
         expression_t lhs = c.get_lhs();
         if (lhs.contains(dst) && lhs.contains(src)) {
             symbol_terms_t terms = lhs.get_symbol_terms();
@@ -244,7 +264,7 @@ refinement_t refinement_t::operator|(const refinement_t &other) const {
         for (int j = i+1; j < (int)new_constraints.size(); j++) {
             auto c = new_constraints[i];
             auto c1 = new_constraints[j];
-            c.simplify();   c1.simplify();
+            c.normalize();   c1.normalize();
             if (c.get_lhs().is_equal(c1.get_lhs())) {
                 new_constraints.erase(new_constraints.begin() + j);
             }

From 5bb293891033ed8930582f1b1177048b19b85dca Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 04:24:28 -0400
Subject: [PATCH 212/373] Printing slack values, along with other constraints

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp |  7 +++++++
 src/crab/constraint.hpp |  1 +
 src/crab/expression.cpp | 10 ++++++++++
 src/crab/expression.hpp |  1 +
 4 files changed, 19 insertions(+)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 2e6d0c0d1..363b79c0d 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -18,6 +18,13 @@ void constraint_t::normalize() {
     _rhs = expression_t(0);
 }
 
+std::vector<std::pair<symbol_t, interval_t>> constraint_t::get_slack_intervals() const {
+    std::vector<std::pair<symbol_t, interval_t>> result = _lhs.get_slack_intervals();
+    auto rhs_intervals = _rhs.get_slack_intervals();
+    result.insert(result.end(), rhs_intervals.begin(), rhs_intervals.end());
+    return result;
+}
+
 bool constraint_t::is_bottom() {
     normalize();
     symbol_terms_t terms = _lhs.get_symbol_terms();
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index ac41d3158..79626e166 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -28,6 +28,7 @@ class constraint_t {
     constraint_t operator|(const constraint_t&) const;
     constraint_t operator<=(const constraint_t&) const;
     constraint_t operator>(const constraint_t&) const;
+    std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
     bool is_equality() const;
     bool contains(const symbol_t&) const;
     void normalize();
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 9b102510d..ccd2bf184 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -8,6 +8,16 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
     return o;
 }
 
+std::vector<std::pair<symbol_t, interval_t>> expression_t::get_slack_intervals() const {
+    std::vector<std::pair<symbol_t, interval_t>> slack_intervals;
+    for (const auto &term : _symbol_terms) {
+        if (term.first.is_slack()) {
+            slack_intervals.push_back({term.first, (*_slacks)[term.first].to_interval()});
+        }
+    }
+    return slack_intervals;
+}
+
 expression_t expression_t::get_equivalent_expression() const {
     interval_t value = _constant_term;
     symbol_terms_t symbol_terms;
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index f414f445a..f47503f7e 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -63,6 +63,7 @@ class expression_t {
     interval_t get_constant_term() const { return _constant_term; }
     std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
     void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
+    std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
 
     static expression_t begin() {
         return expression_t({std::make_pair(symbol_t::begin(), 1)});

From ad8eb63d48b1f5e064efafd0a3f9a1aee19c2714 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 06:39:38 -0400
Subject: [PATCH 213/373] Removing redundant constraints directly when adding

Moved the simplification of constraints in refinements from a separate
method simplify() to directly in add_constraints(), as former resulted
in extra computations and less clearer code;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp    | 11 -----
 src/crab/constraint.hpp    |  2 -
 src/crab/offset_domain.cpp | 15 ++-----
 src/crab/refinement.cpp    | 82 ++++++++++++++++++--------------------
 src/crab/refinement.hpp    |  9 +++--
 5 files changed, 49 insertions(+), 70 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 363b79c0d..44471edd8 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -25,17 +25,6 @@ std::vector<std::pair<symbol_t, interval_t>> constraint_t::get_slack_intervals()
     return result;
 }
 
-bool constraint_t::is_bottom() {
-    normalize();
-    symbol_terms_t terms = _lhs.get_symbol_terms();
-    if (terms.size() == 1 && terms.begin()->first == symbol_t::begin()) {
-        // we can sometimes simplify if we have a single symbol begin, since it is always offset 0
-        _lhs -= terms.begin()->first;
-    }
-
-    return _lhs.is_greater_than(expression_t(0));
-}
-
 constraint_t constraint_t::negate() const {
     // neg(x <= y) -> x > y -> y < x -> y <= x - 1
     return constraint_t(_rhs, _lhs + (-1));
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 79626e166..3009986c7 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -16,8 +16,6 @@ class constraint_t {
     constraint_t(expression_t lhs, expression_t rhs)
         : _lhs(lhs), _rhs(rhs) {}
 
-    bool is_bottom();
-
     expression_t get_lhs() const { return _lhs; }
     expression_t get_rhs() const { return _rhs; }
 
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 0dbce18f3..2fd4c6d5c 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -375,15 +375,9 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             auto b = m_reg_state.find(register_t{12});
             auto le_rf = *rf_left <= *rf_right;
             if (b) {
-                bool no_constraints = b->get_constraints().empty();
-                b->add_constraint(le_rf);
-                if (rf_right->has_value(refinement_t::end()) && no_constraints) {
-                    b->add_constraint(refinement_t::meta() <= refinement_t::begin());
-                }
-                else if (rf_right->has_value(refinement_t::begin()) && no_constraints) {
-                    b->add_constraint(refinement_t::begin() <= refinement_t::end());
-                }
-                b->simplify();
+                b->add_constraint(std::move(le_rf));
+                b->add_constraint(refinement_t::meta() <= refinement_t::begin());
+                b->add_constraint(refinement_t::begin() <= refinement_t::end());
                 auto b_copy = *b;
                 if (b_copy.is_bottom()) {
                     set_to_bottom();
@@ -397,8 +391,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             auto b = m_reg_state.find(register_t{12});
             auto gt_rf = *rf_left > *rf_right;
             if (b) {
-                b->add_constraint(gt_rf);
-                b->simplify();
+                b->add_constraint(std::move(gt_rf));
                 auto b_copy = *b;
                 if (b_copy.is_bottom()) {
                     set_to_bottom();
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index b713e9d4c..5d7791d38 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -45,8 +45,16 @@ bool refinement_t::is_bottom() {
     int i = 0;
     while (i <= PROPAGATE_INEQUALITIES) {
         for (constraint_t c : constraints_to_check) {
-            if (c.is_bottom()) {
-                return true;
+            for (constraint_t c1 : constraints_to_check) {
+                c.normalize();  c1.normalize();
+                auto lhs = c.get_lhs();
+                auto lhs1 = c1.get_lhs();
+                auto add = lhs + lhs1;
+                // if we can derive a contradiction, then the refinement is bottom
+                // e.g., 5 <= 0
+                if (add.is_greater_than(expression_t(0))) {
+                    return true;
+                }
             }
         }
         if (i < PROPAGATE_INEQUALITIES) {
@@ -106,32 +114,6 @@ void refinement_t::write(std::ostream& o) const {
     o << "}";
 }
 
-void refinement_t::simplify() {
-    // remove redundant constraints, when found a stronger constraint
-    // e.g., begin + 14 <= end & begin + 34 <= end -> begin + 34 <= end
-    std::set<int> to_remove;
-    std::vector<crab::constraint_t> constraints;
-    for (int i = 0; i < (int)_constraints.size()-1; i++) {
-        for (int j = i+1; j < (int)_constraints.size(); j++) {
-            auto c = _constraints[i];
-            auto c1 = _constraints[j];
-            c.normalize();   c1.normalize();
-            if (c.get_lhs().is_less_than(c1.get_lhs())) {
-                to_remove.insert(i);
-            }
-            else if (c1.get_lhs().is_less_than(c.get_lhs())) {
-                to_remove.insert(j);
-            }
-        }
-    }
-    for (size_t i = 0; i < _constraints.size(); i++) {
-        if (to_remove.find(i) == to_remove.end()) {
-            constraints.push_back(_constraints[i]);
-        }
-    }
-    _constraints = constraints;
-}
-
 refinement_t refinement_t::operator+(interval_t i) const {
     expression_t added_value = _value + i;
     return refinement_t(_type, added_value, _constraints);
@@ -259,17 +241,6 @@ refinement_t refinement_t::operator|(const refinement_t &other) const {
             new_constraints.push_back(other._constraints[i]);
         }
     }
-    // remove duplicates
-    for (int i = 0; i < (int)new_constraints.size()-1; i++) {
-        for (int j = i+1; j < (int)new_constraints.size(); j++) {
-            auto c = new_constraints[i];
-            auto c1 = new_constraints[j];
-            c.normalize();   c1.normalize();
-            if (c.get_lhs().is_equal(c1.get_lhs())) {
-                new_constraints.erase(new_constraints.begin() + j);
-            }
-        }
-    }
     return refinement_t(_type, joined_value, new_constraints);
 }
 
@@ -283,22 +254,47 @@ constraint_t refinement_t::operator>(const refinement_t &other) const {
     return constraint_t(other._value, _value + (-1));
 }
 
-void refinement_t::add_constraint(const constraint_t& c) {
-    _constraints.push_back(c);
+void refinement_t::add_constraint(constraint_t&& c, bool remove_redundant) {
+    auto c_copy = c;
+    c_copy.normalize();
+    if (remove_redundant) {
+        // remove redundant constraints
+        for (auto it = _constraints.begin(); it != _constraints.end();) {
+            auto c1 = *it;
+            c1.normalize();
+            // already contains the same constraint
+            if (c1.get_lhs().is_equal(c_copy.get_lhs())) {
+                return;
+            }
+            // found a stronger constraint
+            // e.g., begin + 14 <= end & begin + 34 <= end -> begin + 34 <= end
+            if (c1.get_lhs().is_less_than(c_copy.get_lhs())) {
+                it = _constraints.erase(it);
+            }
+            // found a weaker constraint
+            else if (c_copy.get_lhs().is_less_than(c1.get_lhs())) {
+                return;
+            }
+            else {
+                it++;
+            }
+        }
+    }
+    _constraints.push_back(std::move(c));
 }
 
 bool refinement_t::is_safe_with(refinement_t begin, bool is_comparison_check) const {
     refinement_t check_lb = begin;
     auto lb = constraint_t(expression_t::meta(), _value);
     constraint_t neg_lb = lb.negate();
-    check_lb.add_constraint(neg_lb);
+    check_lb.add_constraint(std::move(neg_lb), false);
     bool lb_satisfied = check_lb.is_bottom();
 
     refinement_t check_ub = std::move(begin);
     auto ub = is_comparison_check ? constraint_t(_value, expression_t(interval_t{MAX_PACKET_SIZE}))
         : constraint_t(_value, expression_t::end());
     constraint_t neg_ub = ub.negate();
-    check_ub.add_constraint(neg_ub);
+    check_ub.add_constraint(std::move(neg_ub), false);
     bool ub_satisfied = check_ub.is_bottom();
 
     return lb_satisfied && ub_satisfied;
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 7ed50e98b..7563138ca 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -20,7 +20,11 @@ class refinement_t {
   public:
     explicit refinement_t(data_type_t type, expression_t value,
             std::vector<crab::constraint_t> constraints = {})
-        : _type(type), _value(value), _constraints(constraints) {}
+        : _type(type), _value(value) {
+        for (auto &&c : constraints) {
+            add_constraint(std::move(c));
+        }
+    }
     refinement_t() : _type(data_type_t::ANY) {}
  
     bool is_bottom();
@@ -37,8 +41,7 @@ class refinement_t {
     bool has_value(refinement_t&&) const;
     void write(std::ostream &o) const;
     bool same_type(const refinement_t &other) const;
-    void add_constraint(const constraint_t&);
-    void simplify();
+    void add_constraint(constraint_t&&, bool = true);
     bool is_safe_with(refinement_t, bool) const;
     interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
             const std::vector<constraint_t>&) const;

From 5cebed86e8a0c873fce8b7066f6bfa4a865ea76c Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 9 Jul 2024 07:18:41 -0400
Subject: [PATCH 214/373] Fix in printing of refinement types

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 5d7791d38..42998df47 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -83,7 +83,7 @@ void refinement_t::write(std::ostream& o) const {
         o << "_";
     }
     o << _value;
-    std::vector<std::pair<symbol_t, interval_t>> slack_intervals;
+    std::vector<std::pair<symbol_t, interval_t>> slack_intervals = get_value().get_slack_intervals();
     if (_constraints.size() > 0) {
         o << " & ";
         for (size_t i = 0; i < _constraints.size(); i++) {

From dca702176ead74598c9b8436c649c0f6c1dff7f7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Jul 2024 16:03:05 +0000
Subject: [PATCH 215/373] Bump external/bpf_conformance from `a407af3` to
 `b8bd0e3`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `a407af3` to `b8bd0e3`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/a407af3dd99ce656643001bb2899e0c23e31d1a4...b8bd0e3c1221bcf225c7a904c602b7da4b8ed34f)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index a407af3dd..b8bd0e3c1 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit a407af3dd99ce656643001bb2899e0c23e31d1a4
+Subproject commit b8bd0e3c1221bcf225c7a904c602b7da4b8ed34f

From 84fcbe6295cd7685421fdfde751c4c7a8f9850f1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 20 Jul 2024 16:03:03 +0000
Subject: [PATCH 216/373] Bump external/libbtf from `0ff1ef7` to `f967638`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `0ff1ef7` to `f967638`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/0ff1ef7d61e25598b05ec9a6aa1a4e90dd7ad22b...f96763822d18eb76f33669254ca14a5e5d3cf6ed)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 0ff1ef7d6..f96763822 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 0ff1ef7d61e25598b05ec9a6aa1a4e90dd7ad22b
+Subproject commit f96763822d18eb76f33669254ca14a5e5d3cf6ed

From f090ed54941b38e0c2408c5db0507ded4fb4ec7d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 3 Aug 2024 16:54:31 +0000
Subject: [PATCH 217/373] Bump external/bpf_conformance from `b8bd0e3` to
 `3e95a39`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `b8bd0e3` to `3e95a39`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/b8bd0e3c1221bcf225c7a904c602b7da4b8ed34f...3e95a3987c7b30deba3ff96a10c05275c59cfa82)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index b8bd0e3c1..3e95a3987 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit b8bd0e3c1221bcf225c7a904c602b7da4b8ed34f
+Subproject commit 3e95a3987c7b30deba3ff96a10c05275c59cfa82

From f390808bf943304fb396fb195dfff8d8d132c73a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 3 Aug 2024 16:54:33 +0000
Subject: [PATCH 218/373] Bump external/libbtf from `f967638` to `b685ba3`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `f967638` to `b685ba3`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/f96763822d18eb76f33669254ca14a5e5d3cf6ed...b685ba37734fb267d6818a4f34b90d96c93ba4f5)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index f96763822..b685ba377 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit f96763822d18eb76f33669254ca14a5e5d3cf6ed
+Subproject commit b685ba37734fb267d6818a4f34b90d96c93ba4f5

From 105cb1ec1cb4ea3db87e2e9d3894723129807209 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 10 Aug 2024 16:22:34 +0000
Subject: [PATCH 219/373] Bump external/bpf_conformance from `3e95a39` to
 `b975188`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `3e95a39` to `b975188`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/3e95a3987c7b30deba3ff96a10c05275c59cfa82...b97518831629a6cac21f34836f0113f99f13dec5)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 3e95a3987..b97518831 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 3e95a3987c7b30deba3ff96a10c05275c59cfa82
+Subproject commit b97518831629a6cac21f34836f0113f99f13dec5

From dc2d6ea75a1da5f90fee064f6241d2874f5ea953 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 10 Aug 2024 16:22:36 +0000
Subject: [PATCH 220/373] Bump external/libbtf from `b685ba3` to `125507b`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `b685ba3` to `125507b`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/b685ba37734fb267d6818a4f34b90d96c93ba4f5...125507bd6b7523872c395cb6807be52f304e3f6f)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index b685ba377..125507bd6 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit b685ba37734fb267d6818a4f34b90d96c93ba4f5
+Subproject commit 125507bd6b7523872c395cb6807be52f304e3f6f

From cd9344bdbbfc0a48b8c079cd8eeaf4abb3d6240a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 17 Aug 2024 16:17:18 +0000
Subject: [PATCH 221/373] Bump external/bpf_conformance from `b975188` to
 `57db562`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `b975188` to `57db562`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/b97518831629a6cac21f34836f0113f99f13dec5...57db56275392058e3eca1ec50634a3faae3ebe56)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index b97518831..57db56275 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit b97518831629a6cac21f34836f0113f99f13dec5
+Subproject commit 57db56275392058e3eca1ec50634a3faae3ebe56

From 59588d619cfd06ffde038a88da24a266d213afc6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 24 Aug 2024 16:19:50 +0000
Subject: [PATCH 222/373] Bump external/bpf_conformance from `57db562` to
 `23d01c2`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `57db562` to `23d01c2`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/57db56275392058e3eca1ec50634a3faae3ebe56...23d01c258a30f6e09dad52578b11ad720a6c9e68)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 57db56275..23d01c258 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 57db56275392058e3eca1ec50634a3faae3ebe56
+Subproject commit 23d01c258a30f6e09dad52578b11ad720a6c9e68

From e32012aad30b82dbbbbd16d481abcd5a1589c7bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 24 Aug 2024 16:19:53 +0000
Subject: [PATCH 223/373] Bump external/libbtf from `125507b` to `2231942`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `125507b` to `2231942`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/125507bd6b7523872c395cb6807be52f304e3f6f...2231942ac7a5ed3f21e0d3db97d6a7789105cf15)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 125507bd6..2231942ac 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 125507bd6b7523872c395cb6807be52f304e3f6f
+Subproject commit 2231942ac7a5ed3f21e0d3db97d6a7789105cf15

From 559482ccaf601e2a52db52eb9c41fcf08aae1629 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 Aug 2024 16:11:54 +0000
Subject: [PATCH 224/373] Bump external/bpf_conformance from `23d01c2` to
 `89c3d74`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `23d01c2` to `89c3d74`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/23d01c258a30f6e09dad52578b11ad720a6c9e68...89c3d7400b98e90142d7eedc4564307a11f14dd1)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 23d01c258..89c3d7400 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 23d01c258a30f6e09dad52578b11ad720a6c9e68
+Subproject commit 89c3d7400b98e90142d7eedc4564307a11f14dd1

From 37bf14674848c50557c6777dfe115dcd2a975208 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Mon, 2 Sep 2024 12:36:30 -0700
Subject: [PATCH 225/373] Statically inline bpf2bpf function calls (#608)

---------
Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
Co-authored-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_cfg.cpp               |  99 ++++++++++++
 src/asm_files.cpp             |  89 ++++++-----
 src/asm_marshal.cpp           |  12 +-
 src/asm_ostream.cpp           |  14 ++
 src/asm_parse.cpp             |   3 +
 src/asm_syntax.hpp            |  43 ++++--
 src/asm_unmarshal.cpp         |  33 ++--
 src/assertions.cpp            |  22 ++-
 src/crab/cfg.hpp              |   2 +-
 src/crab/ebpf_domain.cpp      |  54 ++++++-
 src/crab/ebpf_domain.hpp      |   4 +
 src/crab/var_factory.cpp      |   4 +
 src/crab/variable.hpp         |   1 +
 src/crab/wto.cpp              |   2 +-
 src/crab_verifier.cpp         |  17 +-
 src/ebpf_vm_isa.hpp           |   4 +
 src/ebpf_yaml.cpp             |   6 +-
 src/test/test_conformance.cpp |   2 +-
 src/test/test_marshal.cpp     |  26 +++-
 src/test/test_yaml.cpp        |   1 +
 test-data/calllocal.yaml      | 281 ++++++++++++++++++++++++++++++++++
 21 files changed, 636 insertions(+), 83 deletions(-)
 create mode 100644 test-data/calllocal.yaml

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index b67e87921..573989755 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -7,6 +7,7 @@
 #include <optional>
 #include <string>
 #include <vector>
+#include <queue>
 
 #include "crab_utils/debug.hpp"
 #include "asm_syntax.hpp"
@@ -35,11 +36,100 @@ static bool has_fall(Instruction ins) {
     return true;
 }
 
+/// Update a control-flow graph to inline function macros.
+static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t& entry_label) {
+    bool first = true;
+
+    // Get the label of the node to go to on returning from the macro.
+    basic_block_t& exit_to_node = cfg.get_node(cfg.next_nodes(caller_label).front());
+
+    // Construct the variable prefix to use for the new stack frame,
+    // and store a copy in the CallLocal instruction since the instruction-specific
+    // labels may only exist until the CFG is simplified.
+    basic_block_t& caller_node = cfg.get_node(caller_label);
+    std::string stack_frame_prefix = to_string(caller_label);
+    for (auto& inst : caller_node) {
+        if (std::holds_alternative<CallLocal>(inst)) {
+            std::get<CallLocal>(inst).stack_frame_prefix = stack_frame_prefix;
+        }
+    }
+
+    // Walk the transitive closure of CFG nodes starting at entry_label and ending at
+    // any exit instruction,
+    std::queue<label_t> macro_labels{{entry_label}};
+    std::set seen_labels{entry_label};
+    while (!macro_labels.empty()) {
+        label_t macro_label = macro_labels.front();
+        macro_labels.pop();
+
+        // Clone the macro block into a new block with the new stack frame prefix.
+        const label_t label(macro_label.from, macro_label.to, stack_frame_prefix);
+        auto& bb = cfg.insert(label);
+        for (auto inst : cfg.get_node(macro_label)) {
+            if (std::holds_alternative<Exit>(inst)) {
+                std::get<Exit>(inst).stack_frame_prefix = label.stack_frame_prefix;
+            } else if (std::holds_alternative<Call>(inst)) {
+                std::get<Call>(inst).stack_frame_prefix = label.stack_frame_prefix;
+            }
+            bb.insert(inst);
+        }
+
+        if (first) {
+            // Add an edge from the caller to the new block.
+            first = false;
+            caller_node >> bb;
+        }
+
+        // Add an edge from any other predecessors.
+        for (const auto& prev_macro_nodes = cfg.prev_nodes(macro_label);
+             const auto& prev_macro_label : prev_macro_nodes) {
+            const label_t prev_label(prev_macro_label.from, prev_macro_label.to, to_string(caller_label));
+            if (const auto& labels = cfg.labels(); std::ranges::find(labels, prev_label) != labels.end())
+                cfg.get_node(prev_label) >> bb;
+        }
+
+        // Walk all successor nodes.
+        for (const auto& next_macro_nodes = cfg.next_nodes(macro_label);
+             const auto& next_macro_label : next_macro_nodes) {
+            if (next_macro_label == cfg.exit_label()) {
+                // This is an exit transition, so add edge to the block to execute
+                // upon returning from the macro.
+                bb >> exit_to_node;
+            } else if (!seen_labels.contains(next_macro_label)) {
+                // Push any other unprocessed successor label onto the list to be processed.
+                macro_labels.push(next_macro_label);
+                seen_labels.insert(macro_label);
+            }
+        }
+    }
+
+    // Remove the original edge from the caller node to its successor,
+    // since processing now goes through the function macro instead.
+    caller_node -= exit_to_node;
+
+    // Finally, recurse to replace any nested function macros.
+    string caller_label_str = to_string(caller_label);
+    long stack_frame_depth = std::ranges::count(caller_label_str, STACK_FRAME_DELIMITER) + 2;
+    constexpr int MAX_CALL_STACK_FRAMES = 8;
+    for (auto& macro_label : seen_labels) {
+        for (const label_t label(macro_label.from, macro_label.to, caller_label_str);
+             const auto& inst : cfg.get_node(label)) {
+            if (std::holds_alternative<CallLocal>(inst)) {
+                if (stack_frame_depth >= MAX_CALL_STACK_FRAMES)
+                    throw std::runtime_error{"too many call stack frames"};
+                add_cfg_nodes(cfg, label, std::get<CallLocal>(inst).target);
+            }
+        }
+    }
+}
+
 /// Convert an instruction sequence to a control-flow graph (CFG).
 static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_exit) {
     cfg_t cfg;
     std::optional<label_t> falling_from = {};
     bool first = true;
+
+    // Do a first pass ignoring all function macro calls.
     for (const auto& [label, inst, _] : insts) {
 
         if (std::holds_alternative<Undefined>(inst))
@@ -73,6 +163,15 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
             cfg.get_node(*falling_from) >> cfg.get_node(cfg.exit_label());
     }
 
+    // Now replace macros. We have to do this as a second pass so that
+    // we only add new nodes that are actually reachable, based on the
+    // results of the first pass.
+    for (auto& [label, inst, _] : insts) {
+        if (std::holds_alternative<CallLocal>(inst)) {
+            add_cfg_nodes(cfg, label, std::get<CallLocal>(inst).target);
+        }
+    }
+
     return cfg;
 }
 
diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index bf6cd4b00..8edacc3e6 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -71,7 +71,7 @@ std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::con
     return {symbol_name, section_index};
 }
 
-std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Word index) {
+std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Word index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -152,6 +152,45 @@ std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& s
     return {program_name, size};
 }
 
+void relocate_function(ebpf_inst& inst, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index, const ELFIO::const_symbol_section_accessor& symbols) {
+    auto [relocation_offset, relocation_type] = get_value(symbols, index);
+    inst.imm = ((relocation_offset - offset) / sizeof(ebpf_inst)) - 1;
+}
+
+void relocate_map(ebpf_inst& inst, const std::string& symbol_name, const std::variant<size_t, std::map<std::string, size_t>>& map_record_size_or_map_offsets, const program_info& info, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index, const ELFIO::const_symbol_section_accessor& symbols) {
+    // Only permit loading the address of the map.
+    if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
+        throw std::runtime_error("Illegal operation on symbol " + symbol_name + " at location " +
+                                 std::to_string(offset / sizeof(ebpf_inst)));
+    }
+    inst.src = 1; // magic number for LoadFd
+
+    // Relocation value is an offset into the "maps" or ".maps" section.
+    auto [relocation_offset, relocation_type] = get_value(symbols, index);
+    if (map_record_size_or_map_offsets.index() == 0) {
+        // The older maps section format uses a single map_record_size value, so we can
+        // calculate the map descriptor index directly.
+        size_t reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
+        if (reloc_value >= info.map_descriptors.size()) {
+            throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). " +
+                                     "Make sure to compile with -O2.");
+        }
+
+        inst.imm = info.map_descriptors.at(reloc_value).original_fd;
+    } else {
+        // The newer .maps section format uses a variable-length map descriptor array,
+        // so we need to look up the map descriptor index in a map.
+        auto& map_descriptors_offsets = std::get<1>(map_record_size_or_map_offsets);
+        auto it = map_descriptors_offsets.find(symbol_name);
+
+        if (it == map_descriptors_offsets.end()) {
+            throw std::runtime_error("Bad reloc value (" + std::to_string(index) + "). " +
+                                     "Make sure to compile with -O2.");
+        }
+        inst.imm = info.map_descriptors.at(it->second).original_fd;
+    }
+}
+
 vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
     if (options == nullptr)
         options = &ebpf_verifier_default_options;
@@ -292,46 +331,22 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
                     auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
 
-                    // Only perform relocation for symbols located in the maps section.
-                    if (!map_section_indices.contains(symbol_section_index)) {
-                        std::string unresolved_symbol = "Unresolved external symbol " + symbol_name +
-                                                        " in section " + name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
-                        unresolved_symbols.push_back(unresolved_symbol);
+                    // Perform relocation for function symbols.
+                    if ((inst.opcode == INST_OP_CALL) && (inst.src == INST_CALL_LOCAL) &&
+                        (reader.sections[symbol_section_index] == section.get())) {
+                        relocate_function(inst, offset, index, symbols);
                         continue;
                     }
 
-                    // Only permit loading the address of the map.
-                    if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
-                        throw std::runtime_error("Illegal operation on symbol " + symbol_name +
-                                                 " at location " + std::to_string(offset / sizeof(ebpf_inst)));
-                    }
-                    inst.src = 1; // magic number for LoadFd
-
-                    // Relocation value is an offset into the "maps" or ".maps" section.
-                    auto [relocation_offset, relocation_type] = get_value(symbols, index);
-                    if (map_record_size_or_map_offsets.index() == 0) {
-                        // The older maps section format uses a single map_record_size value, so we can
-                        // calculate the map descriptor index directly.
-                        size_t reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
-                        if (reloc_value >= info.map_descriptors.size()) {
-                            throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). "
-                                                    + "Make sure to compile with -O2.");
-                        }
-
-                        inst.imm = info.map_descriptors.at(reloc_value).original_fd;
-                    }
-                    else {
-                        // The newer .maps section format uses a variable-length map descriptor array,
-                        // so we need to look up the map descriptor index in a map.
-                        auto& map_descriptors_offsets = std::get<1>(map_record_size_or_map_offsets);
-                        auto it = map_descriptors_offsets.find(symbol_name);
-
-                        if (it == map_descriptors_offsets.end()) {
-                            throw std::runtime_error("Bad reloc value (" + std::to_string(index) + "). "
-                                                    + "Make sure to compile with -O2.");
-                        }
-                        inst.imm = info.map_descriptors.at(it->second).original_fd;
+                    // Perform relocation for symbols located in the maps section.
+                    if (map_section_indices.contains(symbol_section_index)) {
+                        relocate_map(inst, symbol_name, map_record_size_or_map_offsets, info, offset, index, symbols);
+                        continue;
                     }
+
+                    std::string unresolved_symbol = "Unresolved external symbol " + symbol_name +
+                                                    " in section " + name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
+                    unresolved_symbols.push_back(unresolved_symbol);
                 }
             }
             prog.line_info.resize(prog.prog.size());
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 5e7f015e7..a8a2652d4 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -175,13 +175,21 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Call const& b) {
         return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL | INST_SRC_IMM), .dst = 0, .src = 0, .offset = 0, .imm = b.func}};
+            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL), .dst = 0, .src = INST_CALL_STATIC_HELPER, .offset = 0, .imm = b.func}};
+    }
+
+    vector<ebpf_inst> operator()(CallLocal const& b) {
+        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
+                          .dst = 0,
+                          .src = INST_CALL_LOCAL,
+                          .offset = 0,
+                          .imm = label_to_offset32(b.target)}};
     }
 
     vector<ebpf_inst> operator()(Callx const& b) {
         // callx is defined to have the register in 'dst' not in 'src'.
         return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL | INST_SRC_REG), .dst = b.func.v, .src = 0, .offset = 0}};
+            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALLX), .dst = b.func.v, .src = INST_CALL_STATIC_HELPER, .offset = 0}};
     }
 
     vector<ebpf_inst> operator()(Exit const& b) {
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 283bece2d..69c5c76f1 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -11,6 +11,9 @@
 #include "crab/cfg.hpp"
 #include "crab/interval.hpp"
 #include "crab/variable.hpp"
+#include "helpers.hpp"
+#include "platform.hpp"
+#include "spec_type_descriptors.hpp"
 
 using std::optional;
 using std::string;
@@ -160,6 +163,11 @@ std::ostream& operator<<(std::ostream& os, ValidSize const& a) {
     return os << a.reg << ".value" << op << 0;
 }
 
+std::ostream& operator<<(std::ostream& os, ValidCall const& a) {
+    EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(a.func);
+    return os << "valid call(" << proto.name << ")";
+}
+
 std::ostream& operator<<(std::ostream& os, ValidMapKeyValue const& a) {
     return os << "within stack(" << a.access_reg << ":" << (a.key ? "key_size" : "value_size") << "(" << a.map_fd_reg << "))";
 }
@@ -266,6 +274,8 @@ struct InstructionPrinterVisitor {
         os_ << ")";
     }
 
+    void operator()(CallLocal const& call) { os_ << "call <" << to_string(call.target) << ">"; }
+
     void operator()(Callx const& callx) { os_ << "callx " << callx.func; }
 
     void operator()(Exit const& b) { os_ << "exit"; }
@@ -531,6 +541,10 @@ std::ostream& operator<<(std::ostream& o, const crab::basic_block_rev_t& bb) {
 std::ostream& operator<<(std::ostream& o, const cfg_t& cfg) {
     for (const label_t& label : cfg.sorted_labels()) {
         o << cfg.get_node(label);
+        o << "edges to:";
+        for (const label_t& next_label : cfg.next_nodes(label))
+            o << " " << next_label;
+        o << "\n";
     }
     return o;
 }
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 474446fbd..dd15ebbf6 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -157,6 +157,9 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         int func = boost::lexical_cast<int>(m[1]);
         return make_call(func, g_ebpf_platform_linux);
     }
+    if (regex_match(text, m, regex("call " WRAPPED_LABEL))) {
+        return CallLocal{.target = label_name_to_label.at(m[1])};
+    }
     if (regex_match(text, m, regex("callx " REG))) {
         return Callx{reg(m[1])};
     }
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index f98e6dc31..3d379367c 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -11,24 +11,28 @@
 #include "crab/variable.hpp"
 #include "spec_type_descriptors.hpp"
 
+constexpr char STACK_FRAME_DELIMITER = '/';
+
 namespace crab {
 struct label_t {
     int from; ///< Jump source, or simply index of instruction
     int to; ///< Jump target or -1
+    std::string stack_frame_prefix; ///< Variable prefix when calling this label.
 
-    constexpr explicit label_t(int index, int to = -1) noexcept : from(index), to(to) {}
+    explicit label_t(int index, int to = -1, std::string stack_frame_prefix = {}) noexcept
+        : from(index), to(to), stack_frame_prefix(stack_frame_prefix) {}
 
-    static constexpr label_t make_jump(const label_t& src_label, const label_t& target_label) {
-        return label_t{src_label.from, target_label.from};
+    static label_t make_jump(const label_t& src_label, const label_t& target_label) {
+        return label_t{src_label.from, target_label.from, target_label.stack_frame_prefix};
     }
 
-    constexpr bool operator==(const label_t&) const = default;
+    bool operator==(const label_t& other) const noexcept = default;
 
     constexpr bool operator<(const label_t& other) const {
         if (this == &other) return false;
         if (*this == label_t::exit) return false;
         if (other == label_t::exit) return true;
-        return from < other.from || (from == other.from && to < other.to);
+        return (stack_frame_prefix < other.stack_frame_prefix || (stack_frame_prefix == other.stack_frame_prefix && (from < other.from || (from == other.from && to < other.to))));
     }
 
     // no hash; intended for use in ordered containers.
@@ -40,6 +44,8 @@ struct label_t {
             return os << "entry";
         if (label == exit)
             return os << "exit";
+        if (!label.stack_frame_prefix.empty())
+            os << label.stack_frame_prefix << STACK_FRAME_DELIMITER;
         if (label.to == -1)
             return os << label.from;
         return os << label.from << ":" << label.to;
@@ -157,7 +163,7 @@ struct Condition {
 struct Jmp {
     std::optional<Condition> cond;
     label_t target;
-    constexpr bool operator==(const Jmp&) const = default;
+    bool operator==(const Jmp&) const = default;
 };
 
 struct ArgSingle {
@@ -199,12 +205,22 @@ struct Call {
     bool reallocate_packet{};
     std::vector<ArgSingle> singles;
     std::vector<ArgPair> pairs;
+    std::string stack_frame_prefix; ///< Variable prefix at point of call.
+};
+
+/// Call a "function" (macro) within the same program.
+struct CallLocal {
+    label_t target;
+    std::string stack_frame_prefix; ///< Variable prefix to be used within the call.
+    bool operator==(const CallLocal& other) const noexcept = default;
 };
 
 struct Exit {
-    constexpr bool operator==(const Exit&) const = default;
+    std::string stack_frame_prefix; ///< Variable prefix to clean up when exiting.
+    bool operator==(const Exit& other) const noexcept = default;
 };
 
+/// Experimental callx instruction.
 struct Callx {
     Reg func;
     constexpr bool operator==(const Callx&) const = default;
@@ -340,6 +356,13 @@ struct ValidMapKeyValue {
     constexpr bool operator==(const ValidMapKeyValue&) const = default;
 };
 
+/// Condition check whether a call is valid in the current context.
+struct ValidCall {
+    int32_t func{};
+    std::string stack_frame_prefix; ///< Variable prefix at point of call.
+    bool operator==(const ValidCall&) const = default;
+};
+
 // "if mem is not stack, val is num"
 struct ValidStore {
     Reg mem;
@@ -365,7 +388,7 @@ struct ZeroCtxOffset {
 };
 
 using AssertionConstraint =
-    std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize, ValidMapKeyValue, TypeConstraint, FuncConstraint, ZeroCtxOffset>;
+    std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize, ValidMapKeyValue, ValidCall, TypeConstraint, FuncConstraint, ZeroCtxOffset>;
 
 struct Assert {
     AssertionConstraint cst;
@@ -375,10 +398,10 @@ struct Assert {
 
 struct IncrementLoopCounter {
     label_t name;
-    constexpr bool operator==(const IncrementLoopCounter&) const = default;
+    bool operator==(const IncrementLoopCounter&) const = default;
 };
 
-using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, Callx, Exit, Jmp, Mem, Packet, Atomic, Assume, Assert, IncrementLoopCounter>;
+using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, CallLocal, Callx, Exit, Jmp, Mem, Packet, Atomic, Assume, Assert, IncrementLoopCounter>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index f906db2f7..dad788f88 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -491,6 +491,24 @@ struct Unmarshaller {
         return res;
     }
 
+    /// Given a program counter and an offset, get the label of the target instruction.
+    label_t getJumpTarget(int32_t offset, const vector<ebpf_inst>& insts, pc_t pc) const {
+        pc_t new_pc = pc + 1 + offset;
+        if (new_pc >= insts.size())
+            throw InvalidInstruction(pc, "jump out of bounds");
+        else if (insts[new_pc].opcode == 0)
+            throw InvalidInstruction(pc, "jump to middle of lddw");
+        return label_t{(int)new_pc};
+    }
+
+    auto makeCallLocal(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) const {
+        if (inst.opcode & INST_SRC_REG)
+            throw InvalidInstruction(pc, inst.opcode);
+        if (inst.dst != 0)
+            throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
+        return CallLocal{.target = getJumpTarget(inst.imm, insts, pc)};
+    }
+
     auto makeCallx(ebpf_inst inst, pc_t pc) const {
         // callx puts the register number in the 'dst' field rather than the 'src' field.
         if (inst.dst > R10_STACK_POINTER)
@@ -516,10 +534,12 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, inst.opcode);
             if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.src > 0)
+            if (inst.src >= INST_CALL_BTF_HELPER)
                 throw InvalidInstruction(pc, inst.opcode);
             if (inst.offset != 0)
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            if (inst.src == INST_CALL_LOCAL)
+                return makeCallLocal(inst, insts, pc);
             if (inst.opcode & INST_SRC_REG)
                 return makeCallx(inst, pc);
             if (inst.dst != 0)
@@ -566,11 +586,7 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
 
             int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
-            pc_t new_pc = pc + 1 + offset;
-            if (new_pc >= insts.size())
-                throw InvalidInstruction(pc, "jump out of bounds");
-            else if (insts[new_pc].opcode == 0)
-                throw InvalidInstruction(pc, "jump to middle of lddw");
+            label_t target = getJumpTarget(offset, insts, pc);
             if (inst.opcode != INST_OP_JA16 && inst.opcode != INST_OP_JA32) {
                 if (inst.dst > R10_STACK_POINTER)
                     throw InvalidInstruction(pc, "bad register");
@@ -587,10 +603,7 @@ struct Unmarshaller {
                                                                                               : Imm{sign_extend(inst.imm)},
                                                         .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)
                                                     };
-            return Jmp{
-                .cond = cond,
-                .target = label_t{(int)new_pc},
-            };
+            return Jmp{.cond = cond, .target = target};
         }
         }
     }
diff --git a/src/assertions.cpp b/src/assertions.cpp
index e64a683c4..6c2257d40 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -15,6 +15,7 @@ using std::vector;
 
 class AssertExtractor {
     program_info info;
+    std::optional<label_t> current_label; ///< Pre-simplification label this assert is part of.
 
     static Reg reg(Value v) {
         return std::get<Reg>(v);
@@ -32,7 +33,7 @@ class AssertExtractor {
     }
 
   public:
-    explicit AssertExtractor(program_info info) : info{std::move(info)} {}
+    explicit AssertExtractor(program_info info, std::optional<label_t> label) : info{std::move(info)}, current_label(label) {}
 
     vector<Assert> operator()(Undefined const& ins) const { assert(false); return {}; }
 
@@ -45,12 +46,19 @@ class AssertExtractor {
     /// Packet access implicitly uses R6, so verify that R6 still has a pointer to the context.
     vector<Assert> operator()(Packet const& ins) const { return zero_offset_ctx({6}); }
 
-    /// Verify that Exit returns a number.
-    vector<Assert> operator()(Exit const& e) const { return {Assert{TypeConstraint{Reg{R0_RETURN_VALUE}, TypeGroup::number}}}; }
+    vector<Assert> operator()(Exit const& e) const {
+        vector<Assert> res;
+        if (current_label->stack_frame_prefix.empty()) {
+            // Verify that Exit returns a number.
+            res.emplace_back(TypeConstraint{Reg{R0_RETURN_VALUE}, TypeGroup::number});
+        }
+        return res;
+    }
 
     vector<Assert> operator()(Call const& call) const {
         vector<Assert> res;
         std::optional<Reg> map_fd_reg;
+        res.emplace_back(ValidCall{call.func, call.stack_frame_prefix});
         for (ArgSingle arg : call.singles) {
             switch (arg.kind) {
             case ArgSingle::Kind::ANYTHING:
@@ -105,6 +113,8 @@ class AssertExtractor {
         return res;
     }
 
+    vector<Assert> operator()(CallLocal const& call) const { return {}; }
+
     vector<Assert> operator()(Callx const& callx) const {
         vector<Assert> res;
         res.emplace_back(TypeConstraint{callx.func, TypeGroup::number});
@@ -247,8 +257,8 @@ class AssertExtractor {
     }
 };
 
-vector<Assert> get_assertions(Instruction ins, const program_info& info) {
-    return std::visit(AssertExtractor{info}, ins);
+vector<Assert> get_assertions(Instruction ins, const program_info& info, std::optional<label_t> label) {
+    return std::visit(AssertExtractor{info, label}, ins);
 }
 
 /// Annotate the CFG by adding explicit assertions for all the preconditions
@@ -261,7 +271,7 @@ void explicate_assertions(cfg_t& cfg, const program_info& info) {
         (void)label; // unused
         vector<Instruction> insts;
         for (const auto& ins : vector<Instruction>(bb.begin(), bb.end())) {
-            for (auto a : get_assertions(ins, info))
+            for (auto a : get_assertions(ins, info, bb.label()))
                 insts.emplace_back(a);
             insts.push_back(ins);
         }
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index dc9872402..1954a75af 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -519,7 +519,7 @@ std::map<std::string, int> collect_stats(const cfg_t&);
 cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit=true);
 
 void explicate_assertions(cfg_t& cfg, const program_info& info);
-std::vector<Assert> get_assertions(Instruction ins, const program_info& info);
+std::vector<Assert> get_assertions(Instruction ins, const program_info& info, std::optional<label_t> label);
 
 void print_dot(const cfg_t& cfg, std::ostream& out);
 void print_dot(const cfg_t& cfg, const std::string& outfile);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 200c6b469..b8b5df615 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -995,6 +995,33 @@ void ebpf_domain_t::scratch_caller_saved_registers() {
     }
 }
 
+void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
+    // Create variables specific to the new call stack frame that store
+    // copies of the states of r6 through r9.
+    for (int r = R6; r <= R9; r++) {
+        for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
+             kind = (data_kind_t)((int)kind + 1)) {
+            variable_t src_var = variable_t::reg(kind, r);
+            if (!m_inv[src_var].is_top())
+                assign(variable_t::stack_frame_var(kind, r, prefix), src_var);
+        }
+    }
+}
+
+void ebpf_domain_t::restore_callee_saved_registers(const std::string& prefix) {
+    for (int r = R6; r <= R9; r++) {
+        for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
+             kind = (data_kind_t)((int)kind + 1)) {
+            variable_t src_var = variable_t::stack_frame_var(kind, r, prefix);
+            if (!m_inv[src_var].is_top())
+                assign(variable_t::reg(kind, r), src_var);
+            else
+                havoc(variable_t::reg(kind, r));
+            havoc(src_var);
+        }
+    }
+}
+
 void ebpf_domain_t::forget_packet_pointers() {
     using namespace crab::dsl_syntax;
 
@@ -1541,7 +1568,13 @@ void ebpf_domain_t::operator()(const Un& stmt) {
     }
 }
 
-void ebpf_domain_t::operator()(const Exit& a) {}
+void ebpf_domain_t::operator()(const Exit& a) {
+    // Clean up any state for the current stack frame.
+    std::string prefix = a.stack_frame_prefix;
+    if (prefix.empty())
+        return;
+    restore_callee_saved_registers(prefix);
+}
 
 void ebpf_domain_t::operator()(const Jmp& a) {}
 
@@ -1605,7 +1638,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
                 return;
             }
             Call call = make_call(imm, *global_program_info->platform);
-            for (Assert a : get_assertions(call, *global_program_info)) {
+            for (Assert a : get_assertions(call, *global_program_info, {})) {
                 (*this)(a);
             }
             return;
@@ -1723,6 +1756,16 @@ crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const
     return result;
 }
 
+void ebpf_domain_t::operator()(const ValidCall& s) {
+    if (!s.stack_frame_prefix.empty()) {
+        EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(s.func);
+        if (proto.return_type == EBPF_RETURN_TYPE_INTEGER_OR_NO_RETURN_IF_SUCCEED) {
+            require(m_inv, linear_constraint_t::FALSE(), "tail call not supported in subprogram");
+            return;
+        }
+    }
+}
+
 void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
     using namespace crab::dsl_syntax;
 
@@ -2352,6 +2395,13 @@ void ebpf_domain_t::operator()(const Call& call) {
     }
 }
 
+void ebpf_domain_t::operator()(const CallLocal& call) {
+    using namespace crab::dsl_syntax;
+    if (m_inv.is_bottom())
+        return;
+    save_callee_saved_registers(call.stack_frame_prefix);
+}
+
 void ebpf_domain_t::operator()(const Callx& callx) {
     using namespace crab::dsl_syntax;
     if (m_inv.is_bottom())
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 39f11e73b..f9a92a2e2 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -61,6 +61,7 @@ class ebpf_domain_t final {
     void operator()(const Assume&);
     void operator()(const Bin&);
     void operator()(const Call&);
+    void operator()(const CallLocal&);
     void operator()(const Callx&);
     void operator()(const Comparable&);
     void operator()(const Exit&);
@@ -75,6 +76,7 @@ class ebpf_domain_t final {
     void operator()(const Un&);
     void operator()(const Undefined&);
     void operator()(const ValidAccess&);
+    void operator()(const ValidCall&);
     void operator()(const ValidMapKeyValue&);
     void operator()(const ValidSize&);
     void operator()(const ValidStore&);
@@ -157,6 +159,8 @@ class ebpf_domain_t final {
     [[nodiscard]] std::optional<variable_t> get_type_offset_variable(const Reg& reg) const;
 
     void scratch_caller_saved_registers();
+    void save_callee_saved_registers(const std::string& prefix);
+    void restore_callee_saved_registers(const std::string& prefix);
     [[nodiscard]] std::optional<uint32_t> get_map_type(const Reg& map_fd_reg) const;
     [[nodiscard]] std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
     [[nodiscard]] crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index e03371e32..501c79fe5 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -76,6 +76,10 @@ static std::string mk_scalar_name(data_kind_t kind, const number_t& o, const num
     return os.str();
 }
 
+variable_t variable_t::stack_frame_var(data_kind_t kind, int i, std::string prefix) {
+    return make(prefix + STACK_FRAME_DELIMITER + "r" + std::to_string(i) + "." + name_of(kind));
+}
+
 variable_t variable_t::cell_var(data_kind_t array, const number_t& offset, const number_t& size) {
     return make(mk_scalar_name(array, offset.cast_to_uint64(), size));
 }
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 4b83effbe..b594a4243 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -71,6 +71,7 @@ class variable_t final {
 
     static std::vector<variable_t> get_type_variables();
     static variable_t reg(data_kind_t, int);
+    static variable_t stack_frame_var(data_kind_t kind, int i, std::string prefix);
     static variable_t cell_var(data_kind_t array, const number_t& offset, const number_t& size);
     static variable_t kind_var(data_kind_t kind, variable_t type_variable);
     static variable_t meta_offset();
diff --git a/src/crab/wto.cpp b/src/crab/wto.cpp
index 8a440da31..037f8bfc6 100644
--- a/src/crab/wto.cpp
+++ b/src/crab/wto.cpp
@@ -127,7 +127,7 @@ wto_t::wto_t(const cfg_t& cfg) : _cfg(cfg) {
 
     // Keep processing tasks until we're done.
     while (!_visit_stack.empty()) {
-        visit_args_t& args2 = _visit_stack.top();
+        visit_args_t args2 = _visit_stack.top();
         _visit_stack.pop();
         switch (args2.type) {
         case visit_task_type_t::PushSuccessors: push_successors(args2.vertex, args2.partition, args2.containing_cycle); break;
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 81f543e33..06caf8510 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -197,14 +197,19 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
     ebpf_domain_t entry_inv = ebpf_domain_t::from_constraints(entry_invariant.value(), options.setup_constraints);
     if (entry_inv.is_bottom())
         throw std::runtime_error("Entry invariant is inconsistent");
-    cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
-    auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
-    checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
-    print_report(os, report, prog, false);
+    try {
+        cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
+        auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
+        checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
+        print_report(os, report, prog, false);
 
-    auto pre_invariant_map = to_string_invariant_map(pre_invariants);
+        auto pre_invariant_map = to_string_invariant_map(pre_invariants);
 
-    return {pre_invariant_map.at(label_t::exit), (report.total_warnings == 0)};
+        return {pre_invariant_map.at(label_t::exit), (report.total_warnings == 0)};
+    } catch (std::runtime_error& e) {
+        os << e.what();
+        return {string_invariant::top(), false};
+    }
 }
 
 /// Returned value is true if the program passes verification.
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 8af2b2503..4ce58b895 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -68,6 +68,10 @@ enum {
     INST_OP_CALLX = ((INST_CALL << 4) | INST_SRC_REG | INST_CLS_JMP),
     INST_OP_EXIT = ((INST_EXIT << 4) | INST_CLS_JMP),
 
+    INST_CALL_STATIC_HELPER = 0x0,
+    INST_CALL_LOCAL = 0x1,
+    INST_CALL_BTF_HELPER = 0x2,
+
     INST_ALU_OP_ADD  = 0x00,
     INST_ALU_OP_SUB  = 0x10,
     INST_ALU_OP_MUL  = 0x20,
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 29a2f1b6b..497d67ec9 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -174,8 +174,10 @@ static InstructionSeq raw_cfg_to_instruction_seq(const vector<std::tuple<string,
 static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& raw_options) {
     ebpf_verifier_options_t options = ebpf_verifier_default_options;
 
-    // All YAML tests use !simplify and !setup_constraints.
+    // Use ~simplify for YAML tests unless otherwise specified.
     options.simplify = false;
+
+    // All YAML tests use !setup_constraints.
     options.setup_constraints = false;
 
     // Default to the machine's native endianness.
@@ -188,6 +190,8 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
             options.check_termination = true;
         } else if (name == "strict") {
             options.strict = true;
+        } else if (name == "simplify") {
+            options.simplify = true;
         } else if (name == "big_endian") {
             options.big_endian = true;
         } else if (name == "!big_endian") {
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index 0680e0b2d..ae7f5f9dd 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -75,7 +75,7 @@ TEST_CONFORMANCE("be16.data")
 TEST_CONFORMANCE("be32-high.data")
 TEST_CONFORMANCE("be32.data")
 TEST_CONFORMANCE("be64.data")
-TEST_CONFORMANCE_VERIFICATION_FAILED("call_local.data")
+TEST_CONFORMANCE("call_local.data")
 TEST_CONFORMANCE("call_unwind_fail.data")
 TEST_CONFORMANCE("callx.data")
 TEST_CONFORMANCE("div32-by-zero-reg.data")
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index d1babcaf3..a636fae58 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -124,8 +124,7 @@ static const ebpf_instruction_template_t instruction_template[] = {
     {{0x7f, DST, SRC, 0, 0}, bpf_conformance_groups_t::base64},
     {{0x84, DST, 0, 0, 0}, bpf_conformance_groups_t::base32},
     {{0x85, 0, 0, 0, HELPER_ID}, bpf_conformance_groups_t::base32},
-    // TODO(issue #582): Add support for subprograms (call_local).
-    // {{0x85, 0, 1, 0, IMM}, bpf_conformance_groups_t::base32},
+    {{0x85, 0, 1, 0, JMP_OFFSET}, bpf_conformance_groups_t::base32},
     // TODO(issue #590): Add support for calling a helper function by BTF ID.
     // {{0x85, 0, 2, 0, IMM}, bpf_conformance_groups_t::base32},
     {{0x87, DST, 0, 0, 0}, bpf_conformance_groups_t::base64},
@@ -586,6 +585,21 @@ static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t&
     return platform;
 }
 
+// Check whether an instruction matches an instruction template that may have wildcards.
+static bool matches_template_inst(ebpf_inst inst, ebpf_inst template_inst) {
+    if (inst.opcode != template_inst.opcode)
+        return false;
+    if (inst.dst != template_inst.dst && template_inst.dst != DST)
+        return false;
+    if (inst.src != template_inst.src && template_inst.src != SRC)
+        return false;
+    if (inst.offset != template_inst.offset && template_inst.offset != MEM_OFFSET && template_inst.offset != JMP_OFFSET)
+        return false;
+    if (inst.imm != template_inst.imm && template_inst.imm != IMM && template_inst.imm != JMP_OFFSET)
+        return false;
+    return true;
+}
+
 // Check that various 'dst' variations between two valid instruction templates fail.
 static void check_instruction_dst_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
@@ -597,7 +611,7 @@ static void check_instruction_dst_variations(const ebpf_instruction_template_t&
         // This instruction doesn't put a register number in the 'dst' field.
         // Just try the next value unless that's what the next template has.
         inst.dst++;
-        if (!next_template || (inst != next_template->inst)) {
+        if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.dst == 1)
                 oss << "0: nonzero dst for register op 0x" << std::hex << (int)inst.opcode << std::endl;
@@ -619,7 +633,7 @@ static void check_instruction_src_variations(const ebpf_instruction_template_t&
         // This instruction doesn't put a register number in the 'src' field.
         // Just try the next value unless that's what the next template has.
         inst.src++;
-        if (!next_template || (inst != next_template->inst)) {
+        if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
@@ -638,7 +652,7 @@ static void check_instruction_offset_variations(const ebpf_instruction_template_
         // This instruction limits what can appear in the 'offset' field.
         // Just try the next value unless that's what the next template has.
         inst.offset++;
-        if (!next_template || (inst != next_template->inst)) {
+        if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.offset == 1 &&
                 (!next_template || next_template->inst.opcode != inst.opcode || next_template->inst.offset == 0))
@@ -661,7 +675,7 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
         // This instruction limits what can appear in the 'imm' field.
         // Just try the next value unless that's what the next template has.
         inst.imm++;
-        if (!next_template || (inst != next_template->inst)) {
+        if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.imm == 1)
                 oss << "0: nonzero imm for op 0x" << std::hex << (int)inst.opcode << std::endl;
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index da124a8bf..230150802 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -24,6 +24,7 @@ YAML_CASE("test-data/assign.yaml")
 YAML_CASE("test-data/atomic.yaml")
 YAML_CASE("test-data/bitop.yaml")
 YAML_CASE("test-data/call.yaml")
+YAML_CASE("test-data/calllocal.yaml")
 YAML_CASE("test-data/callx.yaml")
 YAML_CASE("test-data/udivmod.yaml")
 YAML_CASE("test-data/sdivmod.yaml")
diff --git a/test-data/calllocal.yaml b/test-data/calllocal.yaml
new file mode 100644
index 000000000..8b407a269
--- /dev/null
+++ b/test-data/calllocal.yaml
@@ -0,0 +1,281 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: call local
+
+pre: []
+
+code:
+  <start>: |
+    call <sub>
+    r0 += 2
+    exit
+  <sub>: |
+    r0 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=3
+  - r0.uvalue=3
+---
+test-case: call local with simplify
+
+pre: []
+
+options: ["simplify"]
+
+code:
+  <start>: |
+    call <sub>
+    r0 += 2
+    exit
+  <sub>: |
+    r0 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=3
+  - r0.uvalue=3
+---
+test-case: call local with multiple calls
+
+pre: []
+
+code:
+  <start>: |
+    r0 = 1
+    call <sub>
+    call <sub>
+    r0 += 2
+    exit
+  <sub>: |
+    r0 += 3
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=9
+  - r0.uvalue=9
+---
+test-case: nested call local
+
+pre: []
+
+code:
+  <start>: |
+    call <sub1>
+    exit
+  <sub1>: |
+    call <sub2>
+    exit
+  <sub2>: |
+    call <sub3>
+    exit
+  <sub3>: |
+    call <sub4>
+    exit
+  <sub4>: |
+    call <sub5>
+    exit
+  <sub5>: |
+    call <sub6>
+    exit
+  <sub6>: |
+    call <sub7>
+    exit
+  <sub7>: |
+    r0 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=1
+  - r0.uvalue=1
+---
+test-case: too many nested calls
+
+pre: []
+
+code:
+  <start>: |
+    call <sub1>
+    exit
+  <sub1>: |
+    call <sub2>
+    exit
+  <sub2>: |
+    call <sub3>
+    exit
+  <sub3>: |
+    call <sub4>
+    exit
+  <sub4>: |
+    call <sub5>
+    exit
+  <sub5>: |
+    call <sub6>
+    exit
+  <sub6>: |
+    call <sub7>
+    exit
+  <sub7>: |
+    call <sub8>
+    exit
+  <sub8>: |
+    r0 = 1
+    exit
+
+post: []
+
+messages:
+  - "too many call stack frames"
+---
+test-case: infinite recursion
+
+pre: []
+
+code:
+  <start>: |
+    call <sub1>
+    exit
+  <sub1>: |
+    call <sub1>
+    exit
+
+post: []
+
+messages:
+  - "too many call stack frames"
+---
+test-case: jump within a subfunction
+
+pre: []
+
+code:
+  <start>: |
+    call <sub>
+    r0 += 2
+    exit
+  <sub>: |
+    goto <sub2>
+    exit
+  <sub2>: |
+    r0 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=3
+  - r0.uvalue=3
+---
+test-case: jump out of a subfunction
+
+pre: []
+
+code:
+  <start>: |
+    r0 = 1
+    call <sub>
+  <more>: |
+    r0 += 2
+    exit
+  <sub>: |
+    goto <more>
+
+post:
+  - r0.type=number
+  - r0.svalue=5
+  - r0.uvalue=5
+---
+test-case: call local must preserve R6-R9
+
+pre: []
+
+code:
+  <start>: |
+    r6 = 0
+    call <sub>
+    r0 = 0
+    exit
+  <sub>: |
+    r6 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=0
+  - r0.uvalue=0
+  - r6.type=number
+  - r6.svalue=0
+  - r6.uvalue=0
+---
+test-case: call local must preserve R6-R9 types
+pre: ["r6.type=packet"]
+code:
+  <start>: |
+    call <sub>
+    r0 = 0
+    exit
+  <sub>: |
+    r6 = 1
+    exit
+post:
+  - r0.type=number
+  - r0.svalue=0
+  - r0.uvalue=0
+  - r6.type=packet
+#---
+# fails: correlations between callee-saved registers are not preserved
+#test-case: call local must preserve correlations within R6-R9
+#pre: ["r6.type=r7.type"]
+#code:
+#  <start>: |
+#    call <sub>
+#    r0 = 0
+#    exit
+#  <sub>: |
+#    r6 = 1
+#    exit
+#post:
+#  - r0.type=number
+#  - r0.svalue=0
+#  - r0.uvalue=0
+#  - r6.type=r7.type
+---
+test-case: disallow tail call from within a subprogram
+
+pre: ["r0.type=number", "r1.type=ctx", "r1.ctx_offset=0", "r2.type=map_fd_programs", "r3.type=number"]
+
+code:
+  <start>: |
+    call <sub>
+    exit
+  <sub>: |
+    call 12; bpf_tail_call
+    exit
+
+post: ["r0.type=number"]
+
+messages:
+  - "0/2: tail call not supported in subprogram (valid call(tail_call))"
+---
+test-case: call local must preserve R6-R9 types
+
+pre: ["r6.type=packet"]
+
+code:
+  <start>: |
+    call <sub>
+    r0 = 0
+    exit
+  <sub>: |
+    r6 = 1
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=0
+  - r0.uvalue=0
+  - r6.type=packet

From 3bb5b4e546f0e75fcaa2a7280eda1b3ae41e205c Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 3 Sep 2024 11:31:08 +0300
Subject: [PATCH 226/373] clang-format

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 .clang-format                     |    3 +
 src/asm_cfg.cpp                   |   55 +-
 src/asm_files.cpp                 |   80 +-
 src/asm_files.hpp                 |    6 +-
 src/asm_marshal.cpp               |   43 +-
 src/asm_ostream.cpp               |  117 +-
 src/asm_ostream.hpp               |    3 +-
 src/asm_parse.cpp                 |  231 +--
 src/asm_parse.hpp                 |    2 +-
 src/asm_syntax.hpp                |   72 +-
 src/asm_unmarshal.cpp             |  374 +++--
 src/asm_unmarshal.hpp             |    5 +-
 src/assertions.cpp                |   84 +-
 src/crab/add_bottom.hpp           |   79 +-
 src/crab/array_domain.cpp         |  206 +--
 src/crab/array_domain.hpp         |   42 +-
 src/crab/bitset_domain.cpp        |   30 +-
 src/crab/bitset_domain.hpp        |   36 +-
 src/crab/cfg.hpp                  |  211 ++-
 src/crab/cfg_bgl.hpp              |    3 +-
 src/crab/dsl_syntax.hpp           |   32 +-
 src/crab/ebpf_domain.cpp          |  291 ++--
 src/crab/ebpf_domain.hpp          |   75 +-
 src/crab/fwd_analyzer.cpp         |   21 +-
 src/crab/interval.cpp             |   16 +-
 src/crab/interval.hpp             |  144 +-
 src/crab/linear_constraint.hpp    |   38 +-
 src/crab/linear_expression.hpp    |   49 +-
 src/crab/split_dbm.cpp            |  175 ++-
 src/crab/split_dbm.hpp            |   78 +-
 src/crab/thresholds.cpp           |   13 +-
 src/crab/thresholds.hpp           |    2 +-
 src/crab/var_factory.cpp          |  154 +-
 src/crab/variable.hpp             |   39 +-
 src/crab/wto.cpp                  |   15 +-
 src/crab/wto.hpp                  |   40 +-
 src/crab/wto_cycle.hpp            |   29 +-
 src/crab_utils/adapt_sgraph.hpp   |  185 ++-
 src/crab_utils/bignums.hpp        |   78 +-
 src/crab_utils/graph_ops.hpp      |  232 +--
 src/crab_utils/heap.hpp           |   36 +-
 src/crab_utils/lazy_allocator.hpp |  155 +-
 src/crab_utils/safeint.hpp        |   37 +-
 src/crab_utils/stats.cpp          |   26 +-
 src/crab_verifier.cpp             |   26 +-
 src/crab_verifier.hpp             |   13 +-
 src/ebpf_base.h                   |    1 -
 src/ebpf_vm_isa.hpp               |   36 +-
 src/ebpf_yaml.cpp                 |  127 +-
 src/ebpf_yaml.hpp                 |    7 +-
 src/linux/gpl/spec_prototypes.cpp | 2326 ++++++++++++++++-------------
 src/linux/linux_platform.cpp      |   64 +-
 src/main/check.cpp                |   13 +-
 src/main/linux_verifier.cpp       |   11 +-
 src/main/linux_verifier.hpp       |   15 +-
 src/main/memsize_windows.hpp      |    2 +-
 src/main/utils.hpp                |    2 +-
 src/platform.hpp                  |    6 +-
 src/spec_type_descriptors.hpp     |   21 +-
 src/string_constraints.hpp        |   27 +-
 src/test/conformance_check.cpp    |   17 +-
 src/test/test_conformance.cpp     |   31 +-
 src/test/test_marshal.cpp         |  178 ++-
 src/test/test_print.cpp           |   13 +-
 src/test/test_verify.cpp          |  130 +-
 src/test/test_wto.cpp             |    2 +-
 src/test/test_yaml.cpp            |   18 +-
 67 files changed, 3929 insertions(+), 2799 deletions(-)

diff --git a/.clang-format b/.clang-format
index 09976dd24..dddcb124f 100644
--- a/.clang-format
+++ b/.clang-format
@@ -7,3 +7,6 @@ AlignEscapedNewlines: Left
 BreakAfterAttributes: Always
 PenaltyReturnTypeOnItsOwnLine: 60
 AlwaysBreakAfterReturnType: None
+Cpp11BracedListStyle: true
+BreakBeforeBraces: Attach
+InsertBraces: true
diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 573989755..7e9a2971c 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -5,13 +5,13 @@
 #include <algorithm>
 #include <map>
 #include <optional>
+#include <queue>
 #include <string>
 #include <vector>
-#include <queue>
 
-#include "crab_utils/debug.hpp"
 #include "asm_syntax.hpp"
 #include "crab/cfg.hpp"
+#include "crab_utils/debug.hpp"
 
 using std::optional;
 using std::set;
@@ -27,11 +27,13 @@ static optional<label_t> get_jump(Instruction ins) {
 }
 
 static bool has_fall(Instruction ins) {
-    if (std::holds_alternative<Exit>(ins))
+    if (std::holds_alternative<Exit>(ins)) {
         return false;
+    }
 
-    if (std::holds_alternative<Jmp>(ins) && !std::get<Jmp>(ins).cond)
+    if (std::holds_alternative<Jmp>(ins) && !std::get<Jmp>(ins).cond) {
         return false;
+    }
 
     return true;
 }
@@ -84,8 +86,9 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
         for (const auto& prev_macro_nodes = cfg.prev_nodes(macro_label);
              const auto& prev_macro_label : prev_macro_nodes) {
             const label_t prev_label(prev_macro_label.from, prev_macro_label.to, to_string(caller_label));
-            if (const auto& labels = cfg.labels(); std::ranges::find(labels, prev_label) != labels.end())
+            if (const auto& labels = cfg.labels(); std::ranges::find(labels, prev_label) != labels.end()) {
                 cfg.get_node(prev_label) >> bb;
+            }
         }
 
         // Walk all successor nodes.
@@ -115,8 +118,9 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
         for (const label_t label(macro_label.from, macro_label.to, caller_label_str);
              const auto& inst : cfg.get_node(label)) {
             if (std::holds_alternative<CallLocal>(inst)) {
-                if (stack_frame_depth >= MAX_CALL_STACK_FRAMES)
+                if (stack_frame_depth >= MAX_CALL_STACK_FRAMES) {
                     throw std::runtime_error{"too many call stack frames"};
+                }
                 add_cfg_nodes(cfg, label, std::get<CallLocal>(inst).target);
             }
         }
@@ -132,8 +136,9 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
     // Do a first pass ignoring all function macro calls.
     for (const auto& [label, inst, _] : insts) {
 
-        if (std::holds_alternative<Undefined>(inst))
+        if (std::holds_alternative<Undefined>(inst)) {
             continue;
+        }
 
         auto& bb = cfg.insert(label);
 
@@ -147,20 +152,24 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
             cfg.get_node(*falling_from) >> bb;
             falling_from = {};
         }
-        if (has_fall(inst))
+        if (has_fall(inst)) {
             falling_from = label;
+        }
         auto jump_target = get_jump(inst);
-        if (jump_target)
+        if (jump_target) {
             bb >> cfg.insert(*jump_target);
+        }
 
-        if (std::holds_alternative<Exit>(inst))
+        if (std::holds_alternative<Exit>(inst)) {
             bb >> cfg.get_node(cfg.exit_label());
+        }
     }
     if (falling_from) {
-        if (must_have_exit)
+        if (must_have_exit) {
             throw std::invalid_argument{"fallthrough in last instruction"};
-        else
+        } else {
             cfg.get_node(*falling_from) >> cfg.get_node(cfg.exit_label());
+        }
     }
 
     // Now replace macros. We have to do this as a second pass so that
@@ -201,7 +210,9 @@ static Condition::Op reverse(Condition::Op op) {
 }
 
 /// Get the inverse of a given comparison condition.
-static Condition reverse(Condition cond) { return {.op = reverse(cond.op), .left = cond.left, .right = cond.right, .is64 = cond.is64}; }
+static Condition reverse(Condition cond) {
+    return {.op = reverse(cond.op), .left = cond.left, .right = cond.right, .is64 = cond.is64};
+}
 
 template <typename T>
 static vector<label_t> unique(const std::pair<T, T>& be) {
@@ -251,8 +262,9 @@ static cfg_t to_nondet(const cfg_t& cfg) {
                 jump_bb >> res.insert(next_label);
             }
         } else {
-            for (const auto& label : nextlist)
+            for (const auto& label : nextlist) {
                 newbb >> res.insert(label);
+            }
         }
     }
     return res;
@@ -302,9 +314,9 @@ static std::string instype(Instruction ins) {
 
 std::vector<std::string> stats_headers() {
     return {
-        "basic_blocks", "joins",       "other",      "jumps",         "assign",  "arith",
-        "load",         "store",       "load_store", "packet_access", "call_1",  "call_mem",
-        "call_nomem",   "reallocate",  "map_in_map", "arith64",       "arith32",
+        "basic_blocks", "joins",      "other",      "jumps",         "assign",  "arith",
+        "load",         "store",      "load_store", "packet_access", "call_1",  "call_mem",
+        "call_nomem",   "reallocate", "map_in_map", "arith64",       "arith32",
     };
 }
 
@@ -325,8 +337,9 @@ std::map<std::string, int> collect_stats(const cfg_t& cfg) {
             }
             if (std::holds_alternative<Call>(ins)) {
                 auto call = std::get<Call>(ins);
-                if (call.reallocate_packet)
+                if (call.reallocate_packet) {
                     res["reallocate"] = 1;
+                }
             }
             if (std::holds_alternative<Bin>(ins)) {
                 auto const& bin = std::get<Bin>(ins);
@@ -334,10 +347,12 @@ std::map<std::string, int> collect_stats(const cfg_t& cfg) {
             }
             res[instype(ins)]++;
         }
-        if (unique(bb.prev_blocks()).size() > 1)
+        if (unique(bb.prev_blocks()).size() > 1) {
             res["joins"]++;
-        if (unique(bb.prev_blocks()).size() > 1)
+        }
+        if (unique(bb.prev_blocks()).size() > 1) {
             res["jumps"]++;
+        }
     }
     return res;
 }
diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 8edacc3e6..6045be64c 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -4,14 +4,14 @@
 #include <map>
 #include <set>
 #include <string>
-#include <vector>
 #include <sys/stat.h>
+#include <vector>
 
+#include "elfio/elfio.hpp"
 #include "libbtf/btf.h"
 #include "libbtf/btf_json.h"
 #include "libbtf/btf_map.h"
 #include "libbtf/btf_parse.h"
-#include "elfio/elfio.hpp"
 
 #include "asm_files.hpp"
 #include "platform.hpp"
@@ -35,7 +35,8 @@ static vector<T> vector_of(const ELFIO::section& sec) {
     return vector_of<T>(data, size);
 }
 
-int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries, ebpf_verifier_options_t options) {
+int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
+                    ebpf_verifier_options_t options) {
     EquivalenceKey equiv{map_type.value_type, key_size, value_size, map_type.is_array ? max_entries : 0};
     if (!global_program_info->cache.count(equiv)) {
         // +1 so 0 is the null FD
@@ -59,7 +60,8 @@ bool is_map_section(const std::string& name) {
     return name == "maps" || (name.length() > 5 && name.compare(0, maps_prefix.length(), maps_prefix) == 0);
 }
 
-std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Xword index) {
+std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::const_symbol_section_accessor& symbols,
+                                                                      ELFIO::Elf_Xword index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -71,7 +73,8 @@ std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::con
     return {symbol_name, section_index};
 }
 
-std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols, ELFIO::Elf_Word index) {
+std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols,
+                                                       ELFIO::Elf_Word index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -85,19 +88,24 @@ std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol
 
 // parse_maps_sections processes all maps sections in the provided ELF file by calling the platform-specific maps
 // parser. The section index of each maps section is inserted into section_indices.
-static size_t parse_map_sections(const ebpf_verifier_options_t* options, const ebpf_platform_t* platform, const ELFIO::elfio& reader, std::vector<EbpfMapDescriptor>& map_descriptors, std::set<ELFIO::Elf_Half>& section_indices, ELFIO::const_symbol_section_accessor& symbols) {
+static size_t parse_map_sections(const ebpf_verifier_options_t* options, const ebpf_platform_t* platform,
+                                 const ELFIO::elfio& reader, std::vector<EbpfMapDescriptor>& map_descriptors,
+                                 std::set<ELFIO::Elf_Half>& section_indices,
+                                 ELFIO::const_symbol_section_accessor& symbols) {
     size_t map_record_size = platform->map_record_size;
     for (ELFIO::Elf_Half i = 0; i < reader.sections.size(); ++i) {
         auto s = reader.sections[i];
-        if (!is_map_section(s->get_name()))
+        if (!is_map_section(s->get_name())) {
             continue;
+        }
 
         // Count the number of symbols that point into this maps section.
         int map_count = 0;
         for (ELFIO::Elf_Xword index = 0; index < symbols.get_symbols_num(); index++) {
             auto [symbol_name, section_index] = get_symbol_name_and_section_index(symbols, index);
-            if ((section_index == i) && !symbol_name.empty())
+            if ((section_index == i) && !symbol_name.empty()) {
                 map_count++;
+            }
         }
 
         if (map_count > 0) {
@@ -117,7 +125,8 @@ static size_t parse_map_sections(const ebpf_verifier_options_t* options, const e
     return map_record_size;
 }
 
-vector<raw_program> read_elf(const std::string& path, const std::string& desired_section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
+vector<raw_program> read_elf(const std::string& path, const std::string& desired_section,
+                             const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
     if (std::ifstream stream{path, std::ios::in | std::ios::binary}) {
         return read_elf(stream, path, desired_section, options, platform);
     }
@@ -128,7 +137,8 @@ vector<raw_program> read_elf(const std::string& path, const std::string& desired
     throw std::runtime_error(string("Can't process ELF file ") + path);
 }
 
-std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& sec, ELFIO::Elf_Xword start, ELFIO::const_symbol_section_accessor& symbols) {
+std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& sec, ELFIO::Elf_Xword start,
+                                                               ELFIO::const_symbol_section_accessor& symbols) {
     ELFIO::Elf_Xword symbol_count = symbols.get_symbols_num();
     ELFIO::Elf_Half section_index = sec.get_index();
     string program_name = sec.get_name();
@@ -152,12 +162,16 @@ std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& s
     return {program_name, size};
 }
 
-void relocate_function(ebpf_inst& inst, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index, const ELFIO::const_symbol_section_accessor& symbols) {
+void relocate_function(ebpf_inst& inst, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index,
+                       const ELFIO::const_symbol_section_accessor& symbols) {
     auto [relocation_offset, relocation_type] = get_value(symbols, index);
     inst.imm = ((relocation_offset - offset) / sizeof(ebpf_inst)) - 1;
 }
 
-void relocate_map(ebpf_inst& inst, const std::string& symbol_name, const std::variant<size_t, std::map<std::string, size_t>>& map_record_size_or_map_offsets, const program_info& info, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index, const ELFIO::const_symbol_section_accessor& symbols) {
+void relocate_map(ebpf_inst& inst, const std::string& symbol_name,
+                  const std::variant<size_t, std::map<std::string, size_t>>& map_record_size_or_map_offsets,
+                  const program_info& info, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index,
+                  const ELFIO::const_symbol_section_accessor& symbols) {
     // Only permit loading the address of the map.
     if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
         throw std::runtime_error("Illegal operation on symbol " + symbol_name + " at location " +
@@ -191,9 +205,11 @@ void relocate_map(ebpf_inst& inst, const std::string& symbol_name, const std::va
     }
 }
 
-vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
-    if (options == nullptr)
+vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section,
+                             const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
+    if (options == nullptr) {
         options = &ebpf_verifier_default_options;
+    }
     ELFIO::elfio reader;
     if (!reader.load(input_stream)) {
         throw std::runtime_error(string("Can't process ELF file ") + path);
@@ -234,9 +250,9 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         }
     }
 
-    std::variant<size_t, std::map<std::string, size_t>>  map_record_size_or_map_offsets = size_t(0);
+    std::variant<size_t, std::map<std::string, size_t>> map_record_size_or_map_offsets = size_t(0);
     if (reader.sections[string(".maps")]) {
-        if (!btf_data.has_value()){
+        if (!btf_data.has_value()) {
             throw std::runtime_error(string("No BTF section found in ELF file ") + path);
         }
         auto map_data = libbtf::parse_btf_map_section(btf_data.value());
@@ -261,13 +277,13 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         std::map<int, int> type_id_to_fd_map;
         int pseudo_fd = 1;
         // Gather the typeids for each map and assign a pseudo-fd to each map.
-        for (auto &map_descriptor : info.map_descriptors) {
+        for (auto& map_descriptor : info.map_descriptors) {
             if (type_id_to_fd_map.find(map_descriptor.original_fd) == type_id_to_fd_map.end()) {
                 type_id_to_fd_map[map_descriptor.original_fd] = pseudo_fd++;
             }
         }
         // Replace the typeids with the pseudo-fds.
-        for (auto &map_descriptor : info.map_descriptors) {
+        for (auto& map_descriptor : info.map_descriptors) {
             map_descriptor.original_fd = type_id_to_fd_map[map_descriptor.original_fd];
             if (map_descriptor.inner_map_fd != DEFAULT_MAP_FD) {
                 map_descriptor.inner_map_fd = type_id_to_fd_map[map_descriptor.inner_map_fd];
@@ -275,7 +291,8 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         }
         map_section_indices.insert(reader.sections[string(".maps")]->get_index());
     } else {
-        map_record_size_or_map_offsets = parse_map_sections(options, platform, reader, info.map_descriptors, map_section_indices, symbols);
+        map_record_size_or_map_offsets =
+            parse_map_sections(options, platform, reader, info.map_descriptors, map_section_indices, symbols);
     }
 
     vector<raw_program> res;
@@ -283,23 +300,32 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
     for (const auto& section : reader.sections) {
         const string name = section->get_name();
-        if (!desired_section.empty() && name != desired_section)
+        if (!desired_section.empty() && name != desired_section) {
             continue;
-        if (name == "license" || name == "version" || is_map_section(name))
+        }
+        if (name == "license" || name == "version" || is_map_section(name)) {
             continue;
+        }
         if (name != ".text" && name.find('.') == 0) {
             continue;
         }
-        if ((section->get_size() == 0) || (section->get_data() == nullptr))
+        if ((section->get_size() == 0) || (section->get_data() == nullptr)) {
             continue;
+        }
         info.type = platform->get_program_type(name, path);
 
         for (ELFIO::Elf_Xword program_offset = 0; program_offset < section->get_size();) {
             auto [program_name, program_size] = get_program_name_and_size(*section, program_offset, symbols);
-            raw_program prog{path, name, program_offset, program_name, vector_of<ebpf_inst>(section->get_data() + program_offset, program_size), info};
+            raw_program prog{path,
+                             name,
+                             program_offset,
+                             program_name,
+                             vector_of<ebpf_inst>(section->get_data() + program_offset, program_size),
+                             info};
             auto prelocs = reader.sections[string(".rel") + name];
-            if (!prelocs)
+            if (!prelocs) {
                 prelocs = reader.sections[string(".rela") + name];
+            }
 
             if (prelocs) {
                 if (!prelocs->get_data()) {
@@ -344,8 +370,8 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                         continue;
                     }
 
-                    std::string unresolved_symbol = "Unresolved external symbol " + symbol_name +
-                                                    " in section " + name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
+                    std::string unresolved_symbol = "Unresolved external symbol " + symbol_name + " in section " +
+                                                    name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
                     unresolved_symbols.push_back(unresolved_symbol);
                 }
             }
@@ -367,7 +393,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
     if (btf != nullptr && btf_ext != nullptr) {
         auto visitor = [&](const std::string& section, uint32_t instruction_offset, const std::string& file_name,
-                        const std::string& source, uint32_t line_number, uint32_t column_number) {
+                           const std::string& source, uint32_t line_number, uint32_t column_number) {
             for (auto& program : res) {
                 if ((program.section_name == section) && (instruction_offset >= program.insn_off) &&
                     (instruction_offset < program.insn_off + program.prog.size() * sizeof(ebpf_inst))) {
diff --git a/src/asm_files.hpp b/src/asm_files.hpp
index c529ff340..74bebb7cf 100644
--- a/src/asm_files.hpp
+++ b/src/asm_files.hpp
@@ -10,8 +10,10 @@
 #include "platform.hpp"
 
 std::vector<raw_program> read_raw(std::string path, program_info info);
-std::vector<raw_program> read_elf(const std::string& path, const std::string& section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
-std::vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& section, const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
+std::vector<raw_program> read_elf(const std::string& path, const std::string& section,
+                                  const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
+std::vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& section,
+                                  const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
 
 void write_binary_file(std::string path, const char* data, size_t size);
 
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index a8a2652d4..987b3423f 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -174,8 +174,11 @@ struct MarshalVisitor {
     }
 
     vector<ebpf_inst> operator()(Call const& b) {
-        return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL), .dst = 0, .src = INST_CALL_STATIC_HELPER, .offset = 0, .imm = b.func}};
+        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
+                          .dst = 0,
+                          .src = INST_CALL_STATIC_HELPER,
+                          .offset = 0,
+                          .imm = b.func}};
     }
 
     vector<ebpf_inst> operator()(CallLocal const& b) {
@@ -188,8 +191,10 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Callx const& b) {
         // callx is defined to have the register in 'dst' not in 'src'.
-        return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALLX), .dst = b.func.v, .src = INST_CALL_STATIC_HELPER, .offset = 0}};
+        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALLX),
+                          .dst = b.func.v,
+                          .src = INST_CALL_STATIC_HELPER,
+                          .offset = 0}};
     }
 
     vector<ebpf_inst> operator()(Exit const& b) {
@@ -217,10 +222,11 @@ struct MarshalVisitor {
             return {res};
         } else {
             int32_t imm = label_to_offset32(b.target);
-            if (imm != 0)
+            if (imm != 0) {
                 return {ebpf_inst{.opcode = INST_OP_JA32, .imm = imm}};
-            else
+            } else {
                 return {ebpf_inst{.opcode = INST_OP_JA16, .offset = label_to_offset16(b.target)}};
+            }
         }
     }
 
@@ -233,8 +239,9 @@ struct MarshalVisitor {
             .offset = static_cast<int16_t>(access.offset),
         };
         if (b.is_load) {
-            if (!std::holds_alternative<Reg>(b.value))
+            if (!std::holds_alternative<Reg>(b.value)) {
                 throw std::runtime_error(std::string("LD IMM: ") + to_string(b));
+            }
             res.opcode |= INST_CLS_LD | 0x1;
             res.dst = static_cast<uint8_t>(std::get<Reg>(b.value).v);
             res.src = static_cast<uint8_t>(access.basereg.v);
@@ -271,19 +278,18 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Atomic const& b) {
         int32_t imm = (int32_t)b.op;
-        if (b.fetch)
+        if (b.fetch) {
             imm |= INST_FETCH;
-        return {ebpf_inst{
-            .opcode = static_cast<uint8_t>(INST_CLS_STX | INST_MODE_ATOMIC | width_to_opcode(b.access.width)),
-            .dst = b.access.basereg.v,
-            .src = b.valreg.v,
-            .offset = static_cast<int16_t>(b.access.offset),
-            .imm = imm}};
+        }
+        return {
+            ebpf_inst{.opcode = static_cast<uint8_t>(INST_CLS_STX | INST_MODE_ATOMIC | width_to_opcode(b.access.width)),
+                      .dst = b.access.basereg.v,
+                      .src = b.valreg.v,
+                      .offset = static_cast<int16_t>(b.access.offset),
+                      .imm = imm}};
     }
 
-    vector<ebpf_inst> operator()(IncrementLoopCounter const& ins) {
-        return {};
-    }
+    vector<ebpf_inst> operator()(IncrementLoopCounter const& ins) { return {}; }
 };
 
 vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc) {
@@ -304,8 +310,9 @@ vector<ebpf_inst> marshal(const vector<Instruction>& insts) {
 
 static int size(Instruction inst) {
     if (std::holds_alternative<Bin>(inst)) {
-        if (std::get<Bin>(inst).lddw)
+        if (std::get<Bin>(inst).lddw) {
             return 2;
+        }
     }
     if (std::holds_alternative<LoadMapFd>(inst)) {
         return 2;
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 69c5c76f1..9b7558149 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -49,8 +49,9 @@ std::ostream& operator<<(std::ostream& os, ArgSingle arg) {
 
 std::ostream& operator<<(std::ostream& os, ArgPair arg) {
     os << arg.kind << " " << arg.mem << "[" << arg.size;
-    if (arg.can_be_zero)
+    if (arg.can_be_zero) {
         os << "?";
+    }
     os << "], uint64_t " << arg.size;
     return os;
 }
@@ -87,10 +88,10 @@ std::ostream& operator<<(std::ostream& os, Condition::Op op) {
     case Op::NE: return os << "!=";
     case Op::SET: return os << "&==";
     case Op::NSET: return os << "&!="; // not in ebpf
-    case Op::LT: return os << "<"; // TODO: os << "u<";
-    case Op::LE: return os << "<="; // TODO: os << "u<=";
-    case Op::GT: return os << ">"; // TODO: os << "u>";
-    case Op::GE: return os << ">="; // TODO: os << "u>=";
+    case Op::LT: return os << "<";     // TODO: os << "u<";
+    case Op::LE: return os << "<=";    // TODO: os << "u<=";
+    case Op::GT: return os << ">";     // TODO: os << "u>";
+    case Op::GE: return os << ">=";    // TODO: os << "u>=";
     case Op::SLT: return os << "s<";
     case Op::SLE: return os << "s<=";
     case Op::SGT: return os << "s>";
@@ -123,22 +124,22 @@ static std::string to_string(TypeGroup ts) {
     return {};
 }
 
-std::ostream& operator<<(std::ostream& os, TypeGroup ts) {
-    return os << to_string(ts);
-}
+std::ostream& operator<<(std::ostream& os, TypeGroup ts) { return os << to_string(ts); }
 
 std::ostream& operator<<(std::ostream& os, ValidStore const& a) {
     return os << a.mem << ".type != stack -> " << TypeConstraint{a.val, TypeGroup::number};
 }
 
 std::ostream& operator<<(std::ostream& os, ValidAccess const& a) {
-    if (a.or_null)
+    if (a.or_null) {
         os << "(" << TypeConstraint{a.reg, TypeGroup::number} << " and " << a.reg << ".value == 0) or ";
+    }
     os << "valid_access(" << a.reg << ".offset";
-    if (a.offset > 0)
+    if (a.offset > 0) {
         os << "+" << a.offset;
-    else if (a.offset < 0)
+    } else if (a.offset < 0) {
         os << a.offset;
+    }
 
     if (a.width == (Value)Imm{0}) {
         // a.width == 0, meaning we only care it's an in-bound pointer,
@@ -146,17 +147,16 @@ std::ostream& operator<<(std::ostream& os, ValidAccess const& a) {
         os << ") for comparison/subtraction";
     } else {
         os << ", width=" << a.width << ") for ";
-        if (a.access_type == AccessType::read)
+        if (a.access_type == AccessType::read) {
             os << "read";
-        else
+        } else {
             os << "write";
+        }
     }
     return os;
 }
 
-static crab::variable_t typereg(const Reg& r) {
-    return crab::variable_t::reg(crab::data_kind_t::types, r.v);
-}
+static crab::variable_t typereg(const Reg& r) { return crab::variable_t::reg(crab::data_kind_t::types, r.v); }
 
 std::ostream& operator<<(std::ostream& os, ValidSize const& a) {
     auto op = a.can_be_zero ? " >= " : " > ";
@@ -169,7 +169,8 @@ std::ostream& operator<<(std::ostream& os, ValidCall const& a) {
 }
 
 std::ostream& operator<<(std::ostream& os, ValidMapKeyValue const& a) {
-    return os << "within stack(" << a.access_reg << ":" << (a.key ? "key_size" : "value_size") << "(" << a.map_fd_reg << "))";
+    return os << "within stack(" << a.access_reg << ":" << (a.key ? "key_size" : "value_size") << "(" << a.map_fd_reg
+              << "))";
 }
 
 std::ostream& operator<<(std::ostream& os, ZeroCtxOffset const& a) {
@@ -177,19 +178,17 @@ std::ostream& operator<<(std::ostream& os, ZeroCtxOffset const& a) {
 }
 
 std::ostream& operator<<(std::ostream& os, Comparable const& a) {
-    if (a.or_r2_is_number)
+    if (a.or_r2_is_number) {
         os << TypeConstraint{a.r2, TypeGroup::number} << " or ";
-    return os << typereg(a.r1) << " == "
-              << typereg(a.r2) << " in " << to_string(TypeGroup::singleton_ptr);
+    }
+    return os << typereg(a.r1) << " == " << typereg(a.r2) << " in " << to_string(TypeGroup::singleton_ptr);
 }
 
 std::ostream& operator<<(std::ostream& os, Addable const& a) {
     return os << TypeConstraint{a.ptr, TypeGroup::pointer} << " -> " << TypeConstraint{a.num, TypeGroup::number};
 }
 
-std::ostream& operator<<(std::ostream& os, ValidDivisor const& a) {
-    return os << a.reg << " != 0";
-}
+std::ostream& operator<<(std::ostream& os, ValidDivisor const& a) { return os << a.reg << " != 0"; }
 
 std::ostream& operator<<(std::ostream& os, TypeConstraint const& tc) {
     string types = to_string(tc.types);
@@ -197,9 +196,7 @@ std::ostream& operator<<(std::ostream& os, TypeConstraint const& tc) {
     return os << typereg(tc.reg) << " " << cmp_op << " " << tc.types;
 }
 
-std::ostream& operator<<(std::ostream& os, FuncConstraint const& fc) {
-    return os << typereg(fc.reg) << " is helper";
-}
+std::ostream& operator<<(std::ostream& os, FuncConstraint const& fc) { return os << typereg(fc.reg) << " is helper"; }
 
 std::ostream& operator<<(std::ostream& os, AssertionConstraint const& a) {
     return std::visit([&](const auto& a) -> std::ostream& { return os << a; }, a);
@@ -223,8 +220,9 @@ struct InstructionPrinterVisitor {
 
     void operator()(Bin const& b) {
         os_ << reg_name(b.dst, b.is64) << " " << b.op << "= " << b.v;
-        if (b.lddw)
+        if (b.lddw) {
             os_ << " ll";
+        }
     }
 
     void operator()(Un const& b) {
@@ -251,8 +249,9 @@ struct InstructionPrinterVisitor {
             std::vector<ArgSingle>::const_iterator single =
                 std::find_if(call.singles.begin(), call.singles.end(), [r](ArgSingle arg) { return arg.reg.v == r; });
             if (single != call.singles.end()) {
-                if (r > 1)
+                if (r > 1) {
                     os_ << ", ";
+                }
                 os_ << *single;
                 continue;
             }
@@ -261,8 +260,9 @@ struct InstructionPrinterVisitor {
             std::vector<ArgPair>::const_iterator pair =
                 std::find_if(call.pairs.begin(), call.pairs.end(), [r](ArgPair arg) { return arg.mem.v == r; });
             if (pair != call.pairs.end()) {
-                if (r > 1)
+                if (r > 1) {
                     os_ << ", ";
+                }
                 os_ << *pair;
                 r++;
                 continue;
@@ -309,11 +309,13 @@ struct InstructionPrinterVisitor {
         string s = size(b.width);
         os_ << "r0 = ";
         os_ << "*(" << s << " *)skb[";
-        if (b.regoffset)
+        if (b.regoffset) {
             os_ << *b.regoffset;
+        }
         if (b.offset != 0) {
-            if (b.regoffset)
+            if (b.regoffset) {
                 os_ << " + ";
+            }
             os_ << b.offset;
         }
         os_ << "]";
@@ -326,7 +328,9 @@ struct InstructionPrinterVisitor {
         os_ << "(" << access.basereg << sign << offset << ")";
     }
 
-    void print(Condition const& cond) { os_ << cond.left << " " << ((!cond.is64) ? "w" : "") << cond.op << " " << cond.right; }
+    void print(Condition const& cond) {
+        os_ << cond.left << " " << ((!cond.is64) ? "w" : "") << cond.op << " " << cond.right;
+    }
 
     void operator()(Mem const& b) {
         if (b.is_load) {
@@ -345,11 +349,17 @@ struct InstructionPrinterVisitor {
         bool showfetch = true;
         switch (b.op) {
         case Atomic::Op::ADD: os_ << "+"; break;
-        case Atomic::Op::OR : os_ << "|"; break;
+        case Atomic::Op::OR: os_ << "|"; break;
         case Atomic::Op::AND: os_ << "&"; break;
         case Atomic::Op::XOR: os_ << "^"; break;
-        case Atomic::Op::XCHG: os_ << "x"; showfetch = false; break;
-        case Atomic::Op::CMPXCHG: os_ << "cx"; showfetch = false; break;
+        case Atomic::Op::XCHG:
+            os_ << "x";
+            showfetch = false;
+            break;
+        case Atomic::Op::CMPXCHG:
+            os_ << "cx";
+            showfetch = false;
+            break;
         }
         os_ << "= " << b.valreg;
 
@@ -363,13 +373,9 @@ struct InstructionPrinterVisitor {
         print(b.cond);
     }
 
-    void operator()(Assert const& a) {
-        os_ << "assert " << a.cst;
-    }
+    void operator()(Assert const& a) { os_ << "assert " << a.cst; }
 
-    void operator()(IncrementLoopCounter const& a) {
-        os_ << crab::variable_t::loop_counter(to_string(a.name)) << "++";
-    }
+    void operator()(IncrementLoopCounter const& a) { os_ << crab::variable_t::loop_counter(to_string(a.name)) << "++"; }
 };
 
 string to_string(label_t const& label) {
@@ -397,8 +403,9 @@ string to_string(AssertionConstraint const& constraint) {
 
 int size(Instruction inst) {
     if (std::holds_alternative<Bin>(inst)) {
-        if (std::get<Bin>(inst).lddw)
+        if (std::get<Bin>(inst).lddw) {
             return 2;
+        }
     }
     if (std::holds_alternative<LoadMapFd>(inst)) {
         return 2;
@@ -444,8 +451,9 @@ void print(const InstructionSeq& insts, std::ostream& out, std::optional<const l
             }
             if (std::holds_alternative<Jmp>(ins)) {
                 auto const& jmp = std::get<Jmp>(ins);
-                if (pc_of_label.count(jmp.target) == 0)
+                if (pc_of_label.count(jmp.target) == 0) {
                     throw std::runtime_error(string("Cannot find label ") + to_string(jmp.target));
+                }
                 pc_t target_pc = pc_of_label.at(jmp.target);
                 visitor(jmp, target_pc - (int)pc - 1);
             } else {
@@ -459,13 +467,12 @@ void print(const InstructionSeq& insts, std::ostream& out, std::optional<const l
 
 std::ostream& operator<<(std::ostream& o, const EbpfMapDescriptor& desc) {
     return o << "("
-    << "original_fd = " << desc.original_fd << ", "
-    << "inner_map_fd = " << desc.inner_map_fd << ", "
-    << "type = " << desc.type << ", "
-    << "max_entries = " << desc.max_entries << ", "
-    << "value_size = " << desc.value_size << ", "
-    << "key_size = " << desc.key_size <<
-    ")";
+             << "original_fd = " << desc.original_fd << ", "
+             << "inner_map_fd = " << desc.inner_map_fd << ", "
+             << "type = " << desc.type << ", "
+             << "max_entries = " << desc.max_entries << ", "
+             << "value_size = " << desc.value_size << ", "
+             << "key_size = " << desc.key_size << ")";
 }
 
 void print_map_descriptors(const std::vector<EbpfMapDescriptor>& descriptors, std::ostream& o) {
@@ -488,8 +495,9 @@ void print_dot(const cfg_t& cfg, std::ostream& out) {
         }
 
         out << "\"];\n";
-        for (const label_t& next : bb.next_blocks_set())
+        for (const label_t& next : bb.next_blocks_set()) {
             out << "    \"" << label << "\" -> \"" << next << "\";\n";
+        }
         out << "\n";
     }
     out << "}\n";
@@ -497,8 +505,9 @@ void print_dot(const cfg_t& cfg, std::ostream& out) {
 
 void print_dot(const cfg_t& cfg, const std::string& outfile) {
     std::ofstream out{outfile};
-    if (out.fail())
+    if (out.fail()) {
         throw std::runtime_error(std::string("Could not open file ") + outfile);
+    }
     print_dot(cfg, out);
 }
 
@@ -542,8 +551,9 @@ std::ostream& operator<<(std::ostream& o, const cfg_t& cfg) {
     for (const label_t& label : cfg.sorted_labels()) {
         o << cfg.get_node(label);
         o << "edges to:";
-        for (const label_t& next_label : cfg.next_nodes(label))
+        for (const label_t& next_label : cfg.next_nodes(label)) {
             o << " " << next_label;
+        }
         o << "\n";
     }
     return o;
@@ -555,7 +565,6 @@ std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info) {
     return os;
 }
 
-
 std::string crab::z_number::to_string() const { return _n.str(); }
 
 std::string crab::interval_t::to_string() const {
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index e51842cad..89e268e73 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -44,8 +44,9 @@ std::ostream& operator<<(std::ostream& os, Condition::Op op);
 inline std::ostream& operator<<(std::ostream& os, Imm imm) { return os << (int64_t)imm.v; }
 inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << (int)a.v; }
 inline std::ostream& operator<<(std::ostream& os, Value const& a) {
-    if (std::holds_alternative<Imm>(a))
+    if (std::holds_alternative<Imm>(a)) {
         return os << std::get<Imm>(a);
+    }
     return os << std::get<Reg>(a);
 }
 
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index dd15ebbf6..4986491f6 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -3,9 +3,9 @@
 #include <algorithm>
 #include <map>
 #include <regex>
-#include <unordered_set>
 #include <sstream>
 #include <string>
+#include <unordered_set>
 
 #include <boost/lexical_cast.hpp>
 
@@ -16,13 +16,12 @@
 #include "platform.hpp"
 #include "string_constraints.hpp"
 
-
 using std::regex;
 using std::regex_match;
 
-using crab::number_t;
 using crab::linear_constraint_t;
 using crab::linear_expression_t;
+using crab::number_t;
 
 #define REG R"_(\s*(r\d\d?)\s*)_"
 #define WREG R"_(\s*([wr]\d\d?)\s*)_"
@@ -48,7 +47,8 @@ using crab::linear_expression_t;
 #define WRAPPED_LABEL "\\s*" LABEL "\\s*"
 
 #define SPECIAL_VAR R"_(\s*(packet_size|meta_offset)\s*)_"
-#define KIND R"_(\s*(type|svalue|uvalue|ctx_offset|map_fd|packet_offset|shared_offset|stack_offset|shared_region_size|stack_numeric_size)\s*)_"
+#define KIND \
+    R"_(\s*(type|svalue|uvalue|ctx_offset|map_fd|packet_offset|shared_offset|stack_offset|shared_region_size|stack_numeric_size)\s*)_"
 #define INTERVAL R"_(\s*\[([-+]?\d+),\s*([-+]?\d+)\]?\s*)_"
 #define ARRAY_RANGE R"_(\s*\[([-+]?\d+)\.\.\.\s*([-+]?\d+)\]?\s*)_"
 
@@ -56,24 +56,17 @@ using crab::linear_expression_t;
 #define TYPE R"_(\s*(shared|number|packet|stack|ctx|map_fd|map_fd_programs)\s*)_"
 
 static const std::map<std::string, Bin::Op> str_to_binop = {
-    {"", Bin::Op::MOV},   {"+", Bin::Op::ADD},  {"-", Bin::Op::SUB},    {"*", Bin::Op::MUL},
-    {"/", Bin::Op::UDIV}, {"%", Bin::Op::UMOD}, {"|", Bin::Op::OR},     {"&", Bin::Op::AND},
-    {"<<", Bin::Op::LSH}, {">>", Bin::Op::RSH}, {"s>>", Bin::Op::ARSH}, {"^", Bin::Op::XOR},
-    {"s/", Bin::Op::SDIV}, {"s%", Bin::Op::SMOD}, {"s8", Bin::Op::MOVSX8}, {"s16", Bin::Op::MOVSX16},
+    {"", Bin::Op::MOV},        {"+", Bin::Op::ADD},   {"-", Bin::Op::SUB},     {"*", Bin::Op::MUL},
+    {"/", Bin::Op::UDIV},      {"%", Bin::Op::UMOD},  {"|", Bin::Op::OR},      {"&", Bin::Op::AND},
+    {"<<", Bin::Op::LSH},      {">>", Bin::Op::RSH},  {"s>>", Bin::Op::ARSH},  {"^", Bin::Op::XOR},
+    {"s/", Bin::Op::SDIV},     {"s%", Bin::Op::SMOD}, {"s8", Bin::Op::MOVSX8}, {"s16", Bin::Op::MOVSX16},
     {"s32", Bin::Op::MOVSX32},
 };
 
 static const std::map<std::string, Un::Op> str_to_unop = {
-    {"be16", Un::Op::BE16},
-    {"be32", Un::Op::BE32},
-    {"be64", Un::Op::BE64},
-    {"le16", Un::Op::LE16},
-    {"le32", Un::Op::LE32},
-    {"le64", Un::Op::LE64},
-    {"swap16", Un::Op::SWAP16},
-    {"swap32", Un::Op::SWAP32},
-    {"swap64", Un::Op::SWAP64},
-    {"-", Un::Op::NEG},
+    {"be16", Un::Op::BE16},     {"be32", Un::Op::BE32}, {"be64", Un::Op::BE64},     {"le16", Un::Op::LE16},
+    {"le32", Un::Op::LE32},     {"le64", Un::Op::LE64}, {"swap16", Un::Op::SWAP16}, {"swap32", Un::Op::SWAP32},
+    {"swap64", Un::Op::SWAP64}, {"-", Un::Op::NEG},
 };
 
 static const std::map<std::string, Condition::Op> str_to_cmpop = {
@@ -82,13 +75,9 @@ static const std::map<std::string, Condition::Op> str_to_cmpop = {
     {"s<", Condition::Op::SLT}, {"s<=", Condition::Op::SLE}, {"s>", Condition::Op::SGT},  {"s>=", Condition::Op::SGE},
 };
 
-static const std::map<std::string, Atomic::Op> str_to_atomicop = {
-    {"+", Atomic::Op::ADD},
-    {"|", Atomic::Op::OR},
-    {"&", Atomic::Op::AND},
-    {"^", Atomic::Op::XOR},
-    {"x", Atomic::Op::XCHG},
-    {"cx", Atomic::Op::CMPXCHG}};
+static const std::map<std::string, Atomic::Op> str_to_atomicop = {{"+", Atomic::Op::ADD},  {"|", Atomic::Op::OR},
+                                                                  {"&", Atomic::Op::AND},  {"^", Atomic::Op::XOR},
+                                                                  {"x", Atomic::Op::XCHG}, {"cx", Atomic::Op::CMPXCHG}};
 
 static const std::map<std::string, int> str_to_width = {
     {"8", 1},
@@ -107,34 +96,34 @@ static Imm imm(const std::string& s, bool lddw) {
     int base = s.find("0x") != std::string::npos ? 16 : 10;
 
     if (lddw) {
-        if (s.at(0) == '-')
+        if (s.at(0) == '-') {
             return Imm{(uint64_t)std::stoll(s, nullptr, base)};
-        else
+        } else {
             return Imm{std::stoull(s, nullptr, base)};
+        }
     } else {
-        if (s.at(0) == '-')
+        if (s.at(0) == '-') {
             return Imm{(uint64_t)(int64_t)std::stol(s, nullptr, base)};
-        else
+        } else {
             return Imm{(uint64_t)(int64_t)(int32_t)std::stoul(s, nullptr, base)};
+        }
     }
 }
 
-static number_t signed_number(const std::string& s) {
-    return static_cast<int64_t>(std::stoll(s));
-}
+static number_t signed_number(const std::string& s) { return static_cast<int64_t>(std::stoll(s)); }
 
-static number_t unsigned_number(const std::string& s) {
-    return static_cast<uint64_t>(std::stoull(s));
-}
+static number_t unsigned_number(const std::string& s) { return static_cast<uint64_t>(std::stoull(s)); }
 
 static Value reg_or_imm(const std::string& s) {
-    if (s.at(0) == 'w' || s.at(0) == 'r')
+    if (s.at(0) == 'w' || s.at(0) == 'r') {
         return reg(s);
-    else
+    } else {
         return imm(s, false);
+    }
 }
 
-static Deref deref(const std::string& width, const std::string& basereg, const std::string& sign, const std::string& _offset) {
+static Deref deref(const std::string& width, const std::string& basereg, const std::string& sign,
+                   const std::string& _offset) {
     int offset = boost::lexical_cast<int>(_offset);
     return Deref{
         .width = str_to_width.at(width),
@@ -147,8 +136,9 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
     // treat ";" as a comment
     std::string text = line.substr(0, line.find(';'));
     size_t end = text.find_last_not_of(" ");
-    if (end != std::string::npos)
+    if (end != std::string::npos) {
         text = text.substr(0, end + 1);
+    }
     std::smatch m;
     if (regex_match(text, m, regex("exit"))) {
         return Exit{};
@@ -168,7 +158,9 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = reg(m[3]), .is64 = r.at(0) != 'w', .lddw = false};
     }
     if (regex_match(text, m, regex(WREG ASSIGN UNOP WREG))) {
-        if (m[1] != m[3]) throw std::invalid_argument(std::string("Invalid unary operation: ") + text);
+        if (m[1] != m[3]) {
+            throw std::invalid_argument(std::string("Invalid unary operation: ") + text);
+        }
         std::string r = m[1];
         bool is64 = r.at(0) != 'w';
         return Un{.op = str_to_unop.at(m[2]), .dst = reg(m[1]), .is64 = is64};
@@ -177,8 +169,7 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         std::string r = m[1];
         bool is64 = r.at(0) != 'w';
         bool lddw = !m[4].str().empty();
-        return Bin{
-            .op = str_to_binop.at(m[2]), .dst = reg(r), .v = imm(m[3], lddw), .is64 = is64, .lddw = lddw};
+        return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = imm(m[3], lddw), .is64 = is64, .lddw = lddw};
     }
     if (regex_match(text, m, regex(REG ASSIGN DEREF PAREN(REG PLUSMINUS IMM)))) {
         return Mem{
@@ -196,46 +187,43 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
     }
     if (regex_match(text, m, regex("lock " DEREF PAREN(REG PLUSMINUS IMM) " " ATOMICOP " " REG "( fetch)?"))) {
         Atomic::Op op = str_to_atomicop.at(m[5]);
-        return Atomic{
-            .op = op,
-            .fetch = m[7].matched || op == Atomic::Op::XCHG || op == Atomic::Op::CMPXCHG,
-            .access = deref(m[1], m[2], m[3], m[4]),
-            .valreg = reg(m[6])};
+        return Atomic{.op = op,
+                      .fetch = m[7].matched || op == Atomic::Op::XCHG || op == Atomic::Op::CMPXCHG,
+                      .access = deref(m[1], m[2], m[3], m[4]),
+                      .valreg = reg(m[6])};
     }
     if (regex_match(text, m, regex("r0 = " DEREF "skb\\[(.*)\\]"))) {
         auto width = str_to_width.at(m[1]);
         std::string access = m[2].str();
-        if (regex_match(access, m, regex(REG)))
+        if (regex_match(access, m, regex(REG))) {
             return Packet{.width = width, .offset = 0, .regoffset = reg(m[1])};
-        if (regex_match(access, m, regex(IMM)))
+        }
+        if (regex_match(access, m, regex(IMM))) {
             return Packet{.width = width, .offset = (int32_t)imm(m[1], false).v, .regoffset = {}};
-        if (regex_match(access, m, regex(REG PLUSMINUS REG)))
+        }
+        if (regex_match(access, m, regex(REG PLUSMINUS REG))) {
             return Packet{.width = width, .offset = 0 /* ? */, .regoffset = reg(m[2])};
-        if (regex_match(access, m, regex(REG PLUSMINUS IMM)))
+        }
+        if (regex_match(access, m, regex(REG PLUSMINUS IMM))) {
             return Packet{.width = width, .offset = (int32_t)imm(m[2], false).v, .regoffset = reg(m[1])};
+        }
         return Undefined{0};
     }
     if (regex_match(text, m, regex("assume " WREG CMPOP REG_OR_IMM))) {
-        Assume res{
-            Condition{
-                .op = str_to_cmpop.at(m[2]),
-                .left = reg(m[1]),
-                .right = reg_or_imm(m[3]),
-                .is64 = (((const std::string&)m[1]).at(0) == 'r')
-            }
-        };
+        Assume res{Condition{.op = str_to_cmpop.at(m[2]),
+                             .left = reg(m[1]),
+                             .right = reg_or_imm(m[3]),
+                             .is64 = (((const std::string&)m[1]).at(0) == 'r')}};
         return res;
     }
     if (regex_match(text, m, regex("(?:if " WREG CMPOP REG_OR_IMM " )?goto\\s+(?:" IMM ")?" WRAPPED_LABEL))) {
         // We ignore second IMM
         Jmp res{.cond = {}, .target = label_name_to_label.at(m[5])};
         if (m[1].matched) {
-            res.cond = Condition{
-                .op = str_to_cmpop.at(m[2]),
-                .left = reg(m[1]),
-                .right = reg_or_imm(m[3]),
-                .is64 = (((const std::string&)m[1]).at(0) == 'r')
-            };
+            res.cond = Condition{.op = str_to_cmpop.at(m[2]),
+                                 .left = reg(m[1]),
+                                 .right = reg_or_imm(m[3]),
+                                 .is64 = (((const std::string&)m[1]).at(0) == 'r')};
         }
         return res;
     }
@@ -253,61 +241,83 @@ static InstructionSeq parse_program(std::istream& is) {
         std::smatch m;
         if (regex_search(line, m, regex(LABEL ":"))) {
             next_label = label_t(boost::lexical_cast<int>(m[1]));
-            if (seen_labels.count(*next_label) != 0)
+            if (seen_labels.count(*next_label) != 0) {
                 throw std::invalid_argument("duplicate labels");
+            }
             line = m.suffix();
         }
         if (regex_search(line, m, regex(R"(^\s*(\d+:)?\s*)"))) {
             line = m.suffix();
         }
-        if (line.empty())
+        if (line.empty()) {
             continue;
+        }
         Instruction ins = parse_instruction(line, {});
-        if (std::holds_alternative<Undefined>(ins))
+        if (std::holds_alternative<Undefined>(ins)) {
             continue;
+        }
 
-        if (!next_label)
+        if (!next_label) {
             next_label = label_t(static_cast<int>(labeled_insts.size()));
+        }
         labeled_insts.emplace_back(*next_label, ins, std::optional<btf_line_info_t>());
         next_label = {};
     }
     return labeled_insts;
 }
 
-static uint8_t regnum(const std::string& s) {
-    return (uint8_t)boost::lexical_cast<uint16_t>(s.substr(1));
-}
+static uint8_t regnum(const std::string& s) { return (uint8_t)boost::lexical_cast<uint16_t>(s.substr(1)); }
 
 static crab::variable_t special_var(const std::string& s) {
-    if (s == "packet_size") return crab::variable_t::packet_size();
-    if (s == "meta_offset") return crab::variable_t::meta_offset();
+    if (s == "packet_size") {
+        return crab::variable_t::packet_size();
+    }
+    if (s == "meta_offset") {
+        return crab::variable_t::meta_offset();
+    }
     throw std::runtime_error(std::string() + "Bad special variable: " + s);
 }
 
 static crab::data_kind_t regkind(const std::string& s) {
-    if (s == "type") return crab::data_kind_t::types;
-    if (s == "ctx_offset") return crab::data_kind_t::ctx_offsets;
-    if (s == "map_fd") return crab::data_kind_t::map_fds;
-    if (s == "packet_offset") return crab::data_kind_t::packet_offsets;
-    if (s == "shared_offset") return crab::data_kind_t::shared_offsets;
-    if (s == "stack_offset") return crab::data_kind_t::stack_offsets;
-    if (s == "shared_region_size") return crab::data_kind_t::shared_region_sizes;
-    if (s == "stack_numeric_size") return crab::data_kind_t::stack_numeric_sizes;
-    if (s == "svalue") return crab::data_kind_t::svalues;
-    if (s == "uvalue") return crab::data_kind_t::uvalues;
+    if (s == "type") {
+        return crab::data_kind_t::types;
+    }
+    if (s == "ctx_offset") {
+        return crab::data_kind_t::ctx_offsets;
+    }
+    if (s == "map_fd") {
+        return crab::data_kind_t::map_fds;
+    }
+    if (s == "packet_offset") {
+        return crab::data_kind_t::packet_offsets;
+    }
+    if (s == "shared_offset") {
+        return crab::data_kind_t::shared_offsets;
+    }
+    if (s == "stack_offset") {
+        return crab::data_kind_t::stack_offsets;
+    }
+    if (s == "shared_region_size") {
+        return crab::data_kind_t::shared_region_sizes;
+    }
+    if (s == "stack_numeric_size") {
+        return crab::data_kind_t::stack_numeric_sizes;
+    }
+    if (s == "svalue") {
+        return crab::data_kind_t::svalues;
+    }
+    if (s == "uvalue") {
+        return crab::data_kind_t::uvalues;
+    }
     throw std::runtime_error(std::string() + "Bad kind: " + s);
 }
 
 static type_encoding_t string_to_type_encoding(const std::string& s) {
     static std::map<std::string, type_encoding_t> string_to_type{
-        {std::string("uninit"), T_UNINIT},
-        {std::string("map_fd_programs"), T_MAP_PROGRAMS},
-        {std::string("map_fd"), T_MAP},
-        {std::string("number"), T_NUM},
-        {std::string("ctx"), T_CTX},
-        {std::string("stack"), T_STACK},
-        {std::string("packet"), T_PACKET},
-        {std::string("shared"), T_SHARED},
+        {std::string("uninit"), T_UNINIT}, {std::string("map_fd_programs"), T_MAP_PROGRAMS},
+        {std::string("map_fd"), T_MAP},    {std::string("number"), T_NUM},
+        {std::string("ctx"), T_CTX},       {std::string("stack"), T_STACK},
+        {std::string("packet"), T_PACKET}, {std::string("shared"), T_SHARED},
     };
     if (string_to_type.count(s)) {
         return string_to_type[s];
@@ -315,7 +325,8 @@ static type_encoding_t string_to_type_encoding(const std::string& s) {
     throw std::runtime_error(std::string("Unsupported type name: ") + s);
 }
 
-std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::string>& constraints, std::vector<crab::interval_t>& numeric_ranges) {
+std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::string>& constraints,
+                                                          std::vector<crab::interval_t>& numeric_ranges) {
     using namespace crab::dsl_syntax;
     using crab::variable_t;
 
@@ -342,7 +353,9 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
             linear_expression_t d = variable_t::reg(regkind(m[2]), regnum(m[1]));
             linear_expression_t s = variable_t::reg(regkind(m[4]), regnum(m[3]));
             res.push_back(d == s);
-        } else if (regex_match(cst_text, m, regex(REG DOT "type" "=" TYPE))) {
+        } else if (regex_match(cst_text, m,
+                               regex(REG DOT "type"
+                                             "=" TYPE))) {
             variable_t d = variable_t::reg(crab::data_kind_t::types, regnum(m[1]));
             res.push_back(d == string_to_type_encoding(m[2]));
         } else if (regex_match(cst_text, m, regex(REG DOT KIND "=" IMM))) {
@@ -371,7 +384,9 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
             variable_t s = variable_t::reg(regkind(m[4]), regnum(m[3]));
             number_t diff = signed_number(m[5]);
             res.push_back(d - s <= diff);
-        } else if (regex_match(cst_text, m, regex("s" ARRAY_RANGE DOT "type" "=" TYPE))) {
+        } else if (regex_match(cst_text, m,
+                               regex("s" ARRAY_RANGE DOT "type"
+                                     "=" TYPE))) {
             type_encoding_t type = string_to_type_encoding(m[3]);
             if (type == type_encoding_t::T_NUM) {
                 numeric_ranges.emplace_back(signed_number(m[1]), signed_number(m[2]));
@@ -381,12 +396,16 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
                 variable_t d = variable_t::cell_var(crab::data_kind_t::types, lb, ub - lb + 1);
                 res.push_back(d == type);
             }
-        } else if (regex_match(cst_text, m, regex("s" ARRAY_RANGE DOT "svalue" "=" IMM))) {
+        } else if (regex_match(cst_text, m,
+                               regex("s" ARRAY_RANGE DOT "svalue"
+                                     "=" IMM))) {
             number_t lb = signed_number(m[1]);
             number_t ub = signed_number(m[2]);
             variable_t d = variable_t::cell_var(crab::data_kind_t::svalues, lb, ub - lb + 1);
             res.push_back(d == signed_number(m[3]));
-        } else if (regex_match(cst_text, m, regex("s" ARRAY_RANGE DOT "uvalue" "=" IMM))) {
+        } else if (regex_match(cst_text, m,
+                               regex("s" ARRAY_RANGE DOT "uvalue"
+                                     "=" IMM))) {
             number_t lb = signed_number(m[1]);
             number_t ub = signed_number(m[2]);
             variable_t d = variable_t::cell_var(crab::data_kind_t::uvalues, lb, ub - lb + 1);
@@ -400,23 +419,28 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
 
 // return a-b, taking account potential optional-none
 string_invariant string_invariant::operator-(const string_invariant& b) const {
-    if (this->is_bottom()) return string_invariant::bottom();
+    if (this->is_bottom()) {
+        return string_invariant::bottom();
+    }
     string_invariant res = string_invariant::top();
     for (const std::string& cst : this->value()) {
-        if (b.is_bottom() || !b.contains(cst))
+        if (b.is_bottom() || !b.contains(cst)) {
             res.maybe_inv->insert(cst);
+        }
     }
     return res;
 }
 
 // return a+b, taking account potential optional-none
 string_invariant string_invariant::operator+(const string_invariant& b) const {
-    if (this->is_bottom())
+    if (this->is_bottom()) {
         return b;
+    }
     string_invariant res = *this;
     for (const std::string& cst : b.value()) {
-        if (res.is_bottom() || !res.contains(cst))
+        if (res.is_bottom() || !res.contains(cst)) {
             res.maybe_inv->insert(cst);
+        }
     }
     return res;
 }
@@ -431,10 +455,11 @@ std::ostream& operator<<(std::ostream& o, const string_invariant& inv) {
     auto& set = inv.maybe_inv.value();
     std::string lastbase;
     for (const auto& item : set) {
-        if (first)
+        if (first) {
             first = false;
-        else
+        } else {
             o << ", ";
+        }
         size_t pos = item.find_first_of(".=[");
         std::string base = item.substr(0, pos);
         if (base != lastbase) {
diff --git a/src/asm_parse.hpp b/src/asm_parse.hpp
index 6ecaf76df..b0e66f6b7 100644
--- a/src/asm_parse.hpp
+++ b/src/asm_parse.hpp
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+#include <string>
 #include <tuple>
 #include <vector>
-#include <string>
 
 #include "asm_syntax.hpp"
 
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 3d379367c..c7eb28448 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -15,8 +15,8 @@ constexpr char STACK_FRAME_DELIMITER = '/';
 
 namespace crab {
 struct label_t {
-    int from; ///< Jump source, or simply index of instruction
-    int to; ///< Jump target or -1
+    int from;                       ///< Jump source, or simply index of instruction
+    int to;                         ///< Jump target or -1
     std::string stack_frame_prefix; ///< Variable prefix when calling this label.
 
     explicit label_t(int index, int to = -1, std::string stack_frame_prefix = {}) noexcept
@@ -29,25 +29,40 @@ struct label_t {
     bool operator==(const label_t& other) const noexcept = default;
 
     constexpr bool operator<(const label_t& other) const {
-        if (this == &other) return false;
-        if (*this == label_t::exit) return false;
-        if (other == label_t::exit) return true;
-        return (stack_frame_prefix < other.stack_frame_prefix || (stack_frame_prefix == other.stack_frame_prefix && (from < other.from || (from == other.from && to < other.to))));
+        if (this == &other) {
+            return false;
+        }
+        if (*this == label_t::exit) {
+            return false;
+        }
+        if (other == label_t::exit) {
+            return true;
+        }
+        return (stack_frame_prefix < other.stack_frame_prefix ||
+                (stack_frame_prefix == other.stack_frame_prefix &&
+                 (from < other.from || (from == other.from && to < other.to))));
     }
 
     // no hash; intended for use in ordered containers.
 
-    [[nodiscard]] constexpr bool isjump() const { return to != -1; }
+    [[nodiscard]]
+    constexpr bool isjump() const {
+        return to != -1;
+    }
 
     friend std::ostream& operator<<(std::ostream& os, const label_t& label) {
-        if (label == entry)
+        if (label == entry) {
             return os << "entry";
-        if (label == exit)
+        }
+        if (label == exit) {
             return os << "exit";
-        if (!label.stack_frame_prefix.empty())
+        }
+        if (!label.stack_frame_prefix.empty()) {
             os << label.stack_frame_prefix << STACK_FRAME_DELIMITER;
-        if (label.to == -1)
+        }
+        if (label.to == -1) {
             return os << label.from;
+        }
         return os << label.from << ":" << label.to;
     }
 
@@ -101,7 +116,7 @@ struct Bin {
     };
 
     Op op;
-    Reg dst;      ///< Destination.
+    Reg dst; ///< Destination.
     Value v;
     bool is64{};
     bool lddw{};
@@ -111,16 +126,16 @@ struct Bin {
 /// Unary operation.
 struct Un {
     enum class Op {
-        BE16, // dst = htobe16(dst)
-        BE32, // dst = htobe32(dst)
-        BE64, // dst = htobe64(dst)
-        LE16, // dst = htole16(dst)
-        LE32, // dst = htole32(dst)
-        LE64, // dst = htole64(dst)
+        BE16,   // dst = htobe16(dst)
+        BE32,   // dst = htobe32(dst)
+        BE64,   // dst = htobe64(dst)
+        LE16,   // dst = htole16(dst)
+        LE32,   // dst = htole32(dst)
+        LE64,   // dst = htole64(dst)
         SWAP16, // dst = bswap16(dst)
         SWAP32, // dst = bswap32(dst)
         SWAP64, // dst = bswap64(dst)
-        NEG,  // dst = -dst
+        NEG,    // dst = -dst
     };
 
     Op op;
@@ -187,17 +202,15 @@ struct ArgPair {
         PTR_TO_READABLE_MEM_OR_NULL,
         PTR_TO_WRITABLE_MEM,
     } kind{};
-    Reg mem;            ///< Pointer.
-    Reg size;           ///< Size of space pointed to.
+    Reg mem;  ///< Pointer.
+    Reg size; ///< Size of space pointed to.
     bool can_be_zero{};
     constexpr bool operator==(const ArgPair&) const = default;
 };
 
 struct Call {
     int32_t func{};
-    constexpr bool operator==(const Call& other) const {
-        return func == other.func;
-    }
+    constexpr bool operator==(const Call& other) const { return func == other.func; }
 
     // TODO: move name and signature information somewhere else
     std::string name;
@@ -387,12 +400,12 @@ struct ZeroCtxOffset {
     constexpr bool operator==(const ZeroCtxOffset&) const = default;
 };
 
-using AssertionConstraint =
-    std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize, ValidMapKeyValue, ValidCall, TypeConstraint, FuncConstraint, ZeroCtxOffset>;
+using AssertionConstraint = std::variant<Comparable, Addable, ValidDivisor, ValidAccess, ValidStore, ValidSize,
+                                         ValidMapKeyValue, ValidCall, TypeConstraint, FuncConstraint, ZeroCtxOffset>;
 
 struct Assert {
     AssertionConstraint cst;
-    Assert(AssertionConstraint cst): cst(cst) { }
+    Assert(AssertionConstraint cst) : cst(cst) {}
     constexpr bool operator==(const Assert&) const = default;
 };
 
@@ -401,7 +414,8 @@ struct IncrementLoopCounter {
     bool operator==(const IncrementLoopCounter&) const = default;
 };
 
-using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, CallLocal, Callx, Exit, Jmp, Mem, Packet, Atomic, Assume, Assert, IncrementLoopCounter>;
+using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, CallLocal, Callx, Exit, Jmp, Mem, Packet, Atomic,
+                                 Assume, Assert, IncrementLoopCounter>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
@@ -409,7 +423,7 @@ using InstructionSeq = std::vector<LabeledInstruction>;
 // cpu=v4 supports 32-bit PC offsets so we need a large enough type.
 using pc_t = size_t;
 
-}
+} // namespace asm_syntax
 
 using namespace asm_syntax;
 
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index dad788f88..dc9457d43 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -36,8 +36,9 @@ uint8_t width_to_opcode(int width) {
 
 template <typename T>
 void compare(const string& field, T actual, T expected) {
-    if (actual != expected)
+    if (actual != expected) {
         std::cerr << field << ": (actual) " << std::hex << (int)actual << " != " << (int)expected << " (expected)\n";
+    }
 }
 
 static std::string make_opcode_message(const char* msg, uint8_t opcode) {
@@ -50,7 +51,8 @@ struct InvalidInstruction : std::invalid_argument {
     size_t pc;
     explicit InvalidInstruction(size_t pc, const char* what) : std::invalid_argument{what}, pc{pc} {}
     InvalidInstruction(size_t pc, std::string what) : std::invalid_argument{what}, pc{pc} {}
-    InvalidInstruction(size_t pc, uint8_t opcode) : std::invalid_argument{make_opcode_message("bad instruction", opcode)}, pc{pc} {}
+    InvalidInstruction(size_t pc, uint8_t opcode)
+        : std::invalid_argument{make_opcode_message("bad instruction", opcode)}, pc{pc} {}
 };
 
 struct UnsupportedMemoryMode : std::invalid_argument {
@@ -88,7 +90,7 @@ static auto getMemWidth(uint8_t opcode) -> int {
 // }
 
 static Instruction shift32(Reg dst, Bin::Op op) {
-    return (Instruction)Bin{.op=op,.dst = dst, .v = Imm{32}, .is64=true, .lddw=false};
+    return (Instruction)Bin{.op = op, .dst = dst, .v = Imm{32}, .is64 = true, .lddw = false};
 }
 
 struct Unmarshaller {
@@ -96,7 +98,9 @@ struct Unmarshaller {
     const program_info& info;
     void note(const string& what) { notes.back().emplace_back(what); }
     void note_next_pc() { notes.emplace_back(); }
-    explicit Unmarshaller(vector<vector<string>>& notes, const program_info& info) : notes{notes}, info{info} { note_next_pc(); }
+    explicit Unmarshaller(vector<vector<string>>& notes, const program_info& info) : notes{notes}, info{info} {
+        note_next_pc();
+    }
 
     auto getAluOp(size_t pc, ebpf_inst inst) -> std::variant<Bin::Op, Un::Op> {
         // First handle instructions that support a non-zero offset.
@@ -104,8 +108,9 @@ struct Unmarshaller {
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_DIV:
             if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
-                                                    : bpf_conformance_groups_t::divmul32))
+                                                    : bpf_conformance_groups_t::divmul32)) {
                 throw InvalidInstruction(pc, inst.opcode);
+            }
             switch (inst.offset) {
             case 0: return Bin::Op::UDIV;
             case 1: return Bin::Op::SDIV;
@@ -113,16 +118,18 @@ struct Unmarshaller {
             }
         case INST_ALU_OP_MOD:
             if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
-                                                    : bpf_conformance_groups_t::divmul32))
+                                                    : bpf_conformance_groups_t::divmul32)) {
                 throw InvalidInstruction(pc, inst.opcode);
+            }
             switch (inst.offset) {
             case 0: return Bin::Op::UMOD;
             case 1: return Bin::Op::SMOD;
             default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
         case INST_ALU_OP_MOV:
-            if (inst.offset > 0 && !(inst.opcode & INST_SRC_REG))
+            if (inst.offset > 0 && !(inst.opcode & INST_SRC_REG)) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            }
             switch (inst.offset) {
             case 0: return Bin::Op::MOV;
             case 8: return Bin::Op::MOVSX8;
@@ -133,16 +140,18 @@ struct Unmarshaller {
         }
 
         // All the rest require a zero offset.
-        if (inst.offset != 0)
+        if (inst.offset != 0) {
             throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+        }
 
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_ADD: return Bin::Op::ADD;
         case INST_ALU_OP_SUB: return Bin::Op::SUB;
         case INST_ALU_OP_MUL:
             if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
-                                                    : bpf_conformance_groups_t::divmul32))
+                                                    : bpf_conformance_groups_t::divmul32)) {
                 throw InvalidInstruction(pc, inst.opcode);
+            }
             return Bin::Op::MUL;
         case INST_ALU_OP_OR: return Bin::Op::OR;
         case INST_ALU_OP_AND: return Bin::Op::AND;
@@ -150,55 +159,66 @@ struct Unmarshaller {
         case INST_ALU_OP_RSH: return Bin::Op::RSH;
         case INST_ALU_OP_NEG:
             // Negation is a unary operation. The SRC bit, src, and imm must be all 0.
-            if (inst.opcode & INST_SRC_REG)
+            if (inst.opcode & INST_SRC_REG) {
                 throw InvalidInstruction{pc, inst.opcode};
-            if (inst.src != 0)
+            }
+            if (inst.src != 0) {
                 throw InvalidInstruction{pc, inst.opcode};
-            if (inst.imm != 0)
+            }
+            if (inst.imm != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            }
             return Un::Op::NEG;
         case INST_ALU_OP_XOR: return Bin::Op::XOR;
         case INST_ALU_OP_ARSH:
-            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU)
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU) {
                 note("arsh32 is not allowed");
+            }
             return Bin::Op::ARSH;
         case INST_ALU_OP_END:
-            if (inst.src != 0)
+            if (inst.src != 0) {
                 throw InvalidInstruction{pc, inst.opcode};
+            }
             if ((inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64) {
-                if (inst.opcode & INST_END_BE)
+                if (inst.opcode & INST_END_BE) {
                     throw InvalidInstruction(pc, inst.opcode);
+                }
                 switch (inst.imm) {
                 case 16:
-                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                         throw InvalidInstruction(pc, inst.opcode);
+                    }
                     return Un::Op::SWAP16;
                 case 32:
-                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                         throw InvalidInstruction(pc, inst.opcode);
+                    }
                     return Un::Op::SWAP32;
                 case 64:
-                    if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+                    if (!info.platform->supports_group(bpf_conformance_groups_t::base64)) {
                         throw InvalidInstruction(pc, inst.opcode);
+                    }
                     return Un::Op::SWAP64;
                 default: throw InvalidInstruction(pc, "unsupported immediate");
                 }
             }
             switch (inst.imm) {
             case 16:
-                if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                     throw InvalidInstruction(pc, inst.opcode);
+                }
                 return (inst.opcode & INST_END_BE) ? Un::Op::BE16 : Un::Op::LE16;
             case 32:
-                if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                     throw InvalidInstruction(pc, inst.opcode);
+                }
                 return (inst.opcode & INST_END_BE) ? Un::Op::BE32 : Un::Op::LE32;
             case 64:
-                if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+                if (!info.platform->supports_group(bpf_conformance_groups_t::base64)) {
                     throw InvalidInstruction(pc, inst.opcode);
+                }
                 return (inst.opcode & INST_END_BE) ? Un::Op::BE64 : Un::Op::LE64;
-            default:
-                throw InvalidInstruction(pc, "unsupported immediate");
+            default: throw InvalidInstruction(pc, "unsupported immediate");
             }
         case 0xe0: throw InvalidInstruction{pc, inst.opcode};
         case 0xf0: throw InvalidInstruction{pc, inst.opcode};
@@ -211,8 +231,9 @@ struct Unmarshaller {
         switch (op) {
         case Atomic::Op::XCHG:
         case Atomic::Op::CMPXCHG:
-            if ((inst.imm & INST_FETCH) == 0)
+            if ((inst.imm & INST_FETCH) == 0) {
                 throw InvalidInstruction(pc, "unsupported immediate");
+            }
         case Atomic::Op::ADD:
         case Atomic::Op::OR:
         case Atomic::Op::AND:
@@ -227,12 +248,14 @@ struct Unmarshaller {
 
     auto getBinValue(pc_t pc, ebpf_inst inst) -> Value {
         if (inst.opcode & INST_SRC_REG) {
-            if (inst.imm != 0)
+            if (inst.imm != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            }
             return Reg{inst.src};
         } else {
-            if (inst.src != 0)
+            if (inst.src != 0) {
                 throw InvalidInstruction{pc, inst.opcode};
+            }
             // Imm is a signed 32-bit number.  Sign extend it to 64-bits for storage.
             return Imm{sign_extend(inst.imm)};
         }
@@ -262,57 +285,70 @@ struct Unmarshaller {
     }
 
     auto makeMemOp(pc_t pc, ebpf_inst inst) -> Instruction {
-        if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
+        if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
+        }
 
         int width = getMemWidth(inst.opcode);
-        if (!info.platform->supports_group((width == sizeof(uint64_t)) ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+        if (!info.platform->supports_group((width == sizeof(uint64_t)) ? bpf_conformance_groups_t::base64
+                                                                       : bpf_conformance_groups_t::base32)) {
             throw InvalidInstruction(pc, inst.opcode);
+        }
         bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
         switch (inst.opcode & INST_MODE_MASK) {
-        case INST_MODE_IMM:
-            throw InvalidInstruction(pc, inst.opcode);
+        case INST_MODE_IMM: throw InvalidInstruction(pc, inst.opcode);
 
         case INST_MODE_ABS:
-            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) ||
-                !isLD || (width == 8))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) || !isLD || (width == 8)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.dst != 0)
+            }
+            if (inst.dst != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
-            if (inst.src > 0)
+            }
+            if (inst.src > 0) {
                 throw InvalidInstruction(pc, make_opcode_message("bad instruction", inst.opcode));
-            if (inst.offset != 0)
+            }
+            if (inst.offset != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            }
             return Packet{.width = width, .offset = inst.imm, .regoffset = {}};
 
         case INST_MODE_IND:
-            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) ||
-                !isLD || (width == 8))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::packet) || !isLD || (width == 8)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.dst != 0)
+            }
+            if (inst.dst != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
-            if (inst.src > R10_STACK_POINTER)
+            }
+            if (inst.src > R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "bad register");
-            if (inst.offset != 0)
+            }
+            if (inst.offset != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            }
             return Packet{.width = width, .offset = inst.imm, .regoffset = Reg{inst.src}};
 
         case INST_MODE_MEM: {
-            if (isLD)
+            if (isLD) {
                 throw InvalidInstruction(pc, inst.opcode);
+            }
             bool isLoad = getMemIsLoad(inst.opcode);
-            if (isLoad && inst.dst == R10_STACK_POINTER)
+            if (isLoad && inst.dst == R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "cannot modify r10");
+            }
             bool isImm = !(inst.opcode & 1);
-            if (isImm && inst.src != 0)
+            if (isImm && inst.src != 0) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!isImm && inst.imm != 0)
+            }
+            if (!isImm && inst.imm != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            }
 
             assert(!(isLoad && isImm));
             uint8_t basereg = isLoad ? inst.src : inst.dst;
 
-            if (basereg == R10_STACK_POINTER && (inst.offset + opcode_to_width(inst.opcode) > 0 || inst.offset < -EBPF_STACK_SIZE)) {
+            if (basereg == R10_STACK_POINTER &&
+                (inst.offset + opcode_to_width(inst.opcode) > 0 || inst.offset < -EBPF_STACK_SIZE)) {
                 note("Stack access out of bounds");
             }
             auto res = Mem{
@@ -331,11 +367,14 @@ struct Unmarshaller {
 
         case INST_MODE_ATOMIC:
             if (((inst.opcode & INST_CLS_MASK) != INST_CLS_STX) ||
-                ((inst.opcode & INST_SIZE_MASK) != INST_SIZE_W &&
-                 (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW))
+                ((inst.opcode & INST_SIZE_MASK) != INST_SIZE_W && (inst.opcode & INST_SIZE_MASK) != INST_SIZE_DW)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!info.platform->supports_group(((inst.opcode & INST_SIZE_MASK) == INST_SIZE_DW) ? bpf_conformance_groups_t::atomic64 : bpf_conformance_groups_t::atomic32))
-                 throw InvalidInstruction(pc, inst.opcode);
+            }
+            if (!info.platform->supports_group(((inst.opcode & INST_SIZE_MASK) == INST_SIZE_DW)
+                                                   ? bpf_conformance_groups_t::atomic64
+                                                   : bpf_conformance_groups_t::atomic32)) {
+                throw InvalidInstruction(pc, inst.opcode);
+            }
             return Atomic{
                 .op = getAtomicOp(pc, inst),
                 .fetch = (inst.imm & INST_FETCH) == INST_FETCH,
@@ -354,42 +393,56 @@ struct Unmarshaller {
 
     auto makeAluOp(size_t pc, ebpf_inst inst) -> Instruction {
         bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
-        if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+        if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64
+                                                : bpf_conformance_groups_t::base32)) {
             throw InvalidInstruction(pc, inst.opcode);
-        if (inst.dst == R10_STACK_POINTER)
+        }
+        if (inst.dst == R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "invalid target r10");
-        if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER)
+        }
+        if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
-        return std::visit(overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
-                                     [&](Bin::Op op) -> Instruction {
-                                         Bin res{
-                                             .op = op,
-                                             .dst = Reg{inst.dst},
-                                             .v = getBinValue(pc, inst),
-                                             .is64 = is64,
-                                         };
-                                         if (!thread_local_options.allow_division_by_zero && (op == Bin::Op::UDIV || op == Bin::Op::UMOD))
-                                             if (std::holds_alternative<Imm>(res.v) && std::get<Imm>(res.v).v == 0)
-                                                 note("division by zero");
-                                         return res;
-                                     }},
-                          getAluOp(pc, inst));
+        }
+        return std::visit(
+            overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
+                       [&](Bin::Op op) -> Instruction {
+                           Bin res{
+                               .op = op,
+                               .dst = Reg{inst.dst},
+                               .v = getBinValue(pc, inst),
+                               .is64 = is64,
+                           };
+                           if (!thread_local_options.allow_division_by_zero &&
+                               (op == Bin::Op::UDIV || op == Bin::Op::UMOD)) {
+                               if (std::holds_alternative<Imm>(res.v) && std::get<Imm>(res.v).v == 0) {
+                                   note("division by zero");
+                               }
+                           }
+                           return res;
+                       }},
+            getAluOp(pc, inst));
     }
 
     auto makeLddw(ebpf_inst inst, int32_t next_imm, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
-        if (!info.platform->supports_group(bpf_conformance_groups_t::base64))
+        if (!info.platform->supports_group(bpf_conformance_groups_t::base64)) {
             throw InvalidInstruction{pc, inst.opcode};
-        if (pc >= insts.size() - 1)
+        }
+        if (pc >= insts.size() - 1) {
             throw InvalidInstruction(pc, "incomplete lddw");
+        }
         ebpf_inst next = insts[pc + 1];
-        if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0)
+        if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0) {
             throw InvalidInstruction(pc, "invalid lddw");
-        if (inst.src > 1)
+        }
+        if (inst.src > 1) {
             throw InvalidInstruction(pc, make_opcode_message("bad instruction", inst.opcode));
-        if (inst.offset != 0)
+        }
+        if (inst.offset != 0) {
             throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
-        if (inst.dst > R10_STACK_POINTER)
+        }
+        if (inst.dst > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
+        }
 
         if (inst.src == 1) {
             // magic number, meaning we're a per-process file descriptor defining the map.
@@ -442,14 +495,9 @@ struct Unmarshaller {
         res.name = proto.name;
         res.reallocate_packet = proto.reallocate_packet;
         res.is_map_lookup = proto.return_type == EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL;
-        std::array<ebpf_argument_type_t, 7> args = {{
-            EBPF_ARGUMENT_TYPE_DONTCARE,
-            proto.argument_type[0],
-            proto.argument_type[1],
-            proto.argument_type[2],
-            proto.argument_type[3],
-            proto.argument_type[4],
-            EBPF_ARGUMENT_TYPE_DONTCARE}};
+        std::array<ebpf_argument_type_t, 7> args = {
+            {EBPF_ARGUMENT_TYPE_DONTCARE, proto.argument_type[0], proto.argument_type[1], proto.argument_type[2],
+             proto.argument_type[3], proto.argument_type[4], EBPF_ARGUMENT_TYPE_DONTCARE}};
         for (size_t i = 1; i < args.size() - 1; i++) {
             switch (args[i]) {
             case EBPF_ARGUMENT_TYPE_UNSUPPORTED: {
@@ -466,21 +514,33 @@ struct Unmarshaller {
                 break;
             case EBPF_ARGUMENT_TYPE_CONST_SIZE: {
                 // Sanity check: This argument should never be seen in isolation.
-                throw std::runtime_error(std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE: ") + proto.name);
+                throw std::runtime_error(
+                    std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE: ") +
+                    proto.name);
             }
-            case EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO:{
+            case EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: {
                 // Sanity check: This argument should never be seen in isolation.
-                throw std::runtime_error(std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+                throw std::runtime_error(
+                    std::string("mismatched EBPF_ARGUMENT_TYPE_PTR_TO* and EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") +
+                    proto.name);
             }
             case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL:
             case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM:
             case EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM:
-                // Sanity check: This argument must be followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO.
+                // Sanity check: This argument must be followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or
+                // EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO.
                 if (args.size() - i < 2) {
-                    throw std::runtime_error(std::string("missing EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+                    throw std::runtime_error(
+                        std::string(
+                            "missing EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") +
+                        proto.name);
                 }
-                if (args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE && args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO) {
-                    throw std::runtime_error(std::string("Pointer argument not followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") + proto.name);
+                if (args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE &&
+                    args[i + 1] != EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO) {
+                    throw std::runtime_error(
+                        std::string("Pointer argument not followed by EBPF_ARGUMENT_TYPE_CONST_SIZE or "
+                                    "EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") +
+                        proto.name);
                 }
                 bool can_be_zero = (args[i + 1] == EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO);
                 res.pairs.push_back({toArgPairKind(args[i]), Reg{(uint8_t)i}, Reg{(uint8_t)(i + 1)}, can_be_zero});
@@ -494,31 +554,37 @@ struct Unmarshaller {
     /// Given a program counter and an offset, get the label of the target instruction.
     label_t getJumpTarget(int32_t offset, const vector<ebpf_inst>& insts, pc_t pc) const {
         pc_t new_pc = pc + 1 + offset;
-        if (new_pc >= insts.size())
+        if (new_pc >= insts.size()) {
             throw InvalidInstruction(pc, "jump out of bounds");
-        else if (insts[new_pc].opcode == 0)
+        } else if (insts[new_pc].opcode == 0) {
             throw InvalidInstruction(pc, "jump to middle of lddw");
+        }
         return label_t{(int)new_pc};
     }
 
     auto makeCallLocal(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) const {
-        if (inst.opcode & INST_SRC_REG)
+        if (inst.opcode & INST_SRC_REG) {
             throw InvalidInstruction(pc, inst.opcode);
-        if (inst.dst != 0)
+        }
+        if (inst.dst != 0) {
             throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
+        }
         return CallLocal{.target = getJumpTarget(inst.imm, insts, pc)};
     }
 
     auto makeCallx(ebpf_inst inst, pc_t pc) const {
         // callx puts the register number in the 'dst' field rather than the 'src' field.
-        if (inst.dst > R10_STACK_POINTER)
+        if (inst.dst > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
+        }
         if (inst.imm != 0) {
             // Clang prior to v19 put the register number into the 'imm' field.
-            if (inst.dst > 0)
+            if (inst.dst > 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
-            if (inst.imm < 0 || inst.imm > R10_STACK_POINTER)
+            }
+            if (inst.imm < 0 || inst.imm > R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "bad register");
+            }
             return Callx{(uint8_t)inst.imm};
         }
         return Callx{inst.dst};
@@ -527,82 +593,106 @@ struct Unmarshaller {
     auto makeJmp(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
         switch ((inst.opcode >> 4) & 0xF) {
         case INST_CALL:
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP)
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!info.platform->supports_group(bpf_conformance_groups_t::callx) &&
-                (inst.opcode & INST_SRC_REG))
+            }
+            if (!info.platform->supports_group(bpf_conformance_groups_t::callx) && (inst.opcode & INST_SRC_REG)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+            }
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.src >= INST_CALL_BTF_HELPER)
+            }
+            if (inst.src >= INST_CALL_BTF_HELPER) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.offset != 0)
+            }
+            if (inst.offset != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
-            if (inst.src == INST_CALL_LOCAL)
+            }
+            if (inst.src == INST_CALL_LOCAL) {
                 return makeCallLocal(inst, insts, pc);
-            if (inst.opcode & INST_SRC_REG)
+            }
+            if (inst.opcode & INST_SRC_REG) {
                 return makeCallx(inst, pc);
-            if (inst.dst != 0)
+            }
+            if (inst.dst != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
-            if (!info.platform->is_helper_usable(inst.imm))
+            }
+            if (!info.platform->is_helper_usable(inst.imm)) {
                 throw InvalidInstruction(pc, "invalid helper function id " + std::to_string(inst.imm));
+            }
             return makeCall(inst.imm);
         case INST_EXIT:
-            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG))
+            }
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP || (inst.opcode & INST_SRC_REG)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.src != 0)
+            }
+            if (inst.src != 0) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.dst != 0)
+            }
+            if (inst.dst != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
-            if (inst.imm != 0)
+            }
+            if (inst.imm != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
-            if (inst.offset != 0)
+            }
+            if (inst.offset != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
+            }
             return Exit{};
         case INST_JA:
-            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP && (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32)
+            if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP && (inst.opcode & INST_CLS_MASK) != INST_CLS_JMP32) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (!info.platform->supports_group(bpf_conformance_groups_t::base32))
+            }
+            if (!info.platform->supports_group(bpf_conformance_groups_t::base32)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if (inst.opcode & INST_SRC_REG)
+            }
+            if (inst.opcode & INST_SRC_REG) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP && (inst.imm != 0))
+            }
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP && (inst.imm != 0)) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
-            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP32 && (inst.offset != 0))
+            }
+            if ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP32 && (inst.offset != 0)) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero offset for", inst.opcode));
-            if (inst.dst != 0)
+            }
+            if (inst.dst != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero dst for register", inst.opcode));
+            }
         default: {
             // First validate the opcode, src, and imm.
             auto is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_JMP;
-            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64 : bpf_conformance_groups_t::base32))
+            if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64
+                                                    : bpf_conformance_groups_t::base32)) {
                 throw InvalidInstruction(pc, inst.opcode);
+            }
             auto op = getJmpOp(pc, inst.opcode);
-            if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0))
+            if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0)) {
                 throw InvalidInstruction(pc, inst.opcode);
-            if ((inst.opcode & INST_SRC_REG) && (inst.imm != 0))
+            }
+            if ((inst.opcode & INST_SRC_REG) && (inst.imm != 0)) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
+            }
 
             int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
             label_t target = getJumpTarget(offset, insts, pc);
             if (inst.opcode != INST_OP_JA16 && inst.opcode != INST_OP_JA32) {
-                if (inst.dst > R10_STACK_POINTER)
+                if (inst.dst > R10_STACK_POINTER) {
                     throw InvalidInstruction(pc, "bad register");
-                if ((inst.opcode & INST_SRC_REG) && (inst.src > R10_STACK_POINTER))
+                }
+                if ((inst.opcode & INST_SRC_REG) && (inst.src > R10_STACK_POINTER)) {
                     throw InvalidInstruction(pc, "bad register");
+                }
             }
 
             auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
-                                                  ? std::optional<Condition>{}
-                                                  : Condition{
-                                                        .op = op,
-                                                        .left = Reg{inst.dst},
-                                                        .right = (inst.opcode & INST_SRC_REG) ? (Value)Reg{inst.src}
-                                                                                              : Imm{sign_extend(inst.imm)},
-                                                        .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)
-                                                    };
+                            ? std::optional<Condition>{}
+                            : Condition{.op = op,
+                                        .left = Reg{inst.dst},
+                                        .right = (inst.opcode & INST_SRC_REG) ? (Value)Reg{inst.src}
+                                                                              : Imm{sign_extend(inst.imm)},
+                                        .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)};
             return Jmp{.cond = cond, .target = target};
         }
         }
@@ -638,17 +728,20 @@ struct Unmarshaller {
 
                 // Merge (rX <<= 32; rX >>>= 32) into wX = rX
                 //       (rX <<= 32; rX >>= 32)  into rX s32= rX
-                if (pc >= insts.size() - 1)
+                if (pc >= insts.size() - 1) {
                     break;
+                }
                 ebpf_inst next = insts[pc + 1];
                 auto dst = Reg{inst.dst};
 
-                if (new_ins != shift32(dst, Bin::Op::LSH))
+                if (new_ins != shift32(dst, Bin::Op::LSH)) {
                     break;
+                }
 
-                if ((next.opcode & INST_CLS_MASK) != INST_CLS_ALU64)
+                if ((next.opcode & INST_CLS_MASK) != INST_CLS_ALU64) {
                     break;
-                auto next_ins = makeAluOp(pc+1, next);
+                }
+                auto next_ins = makeAluOp(pc + 1, next);
                 if (next_ins == shift32(dst, Bin::Op::RSH)) {
                     new_ins = Bin{.op = Bin::Op::MOV, .dst = dst, .v = dst, .is64 = false};
                     skip_instruction = true;
@@ -668,19 +761,22 @@ struct Unmarshaller {
                     exit_count++;
                 }
                 if (std::holds_alternative<Jmp>(new_ins)) {
-                    if (!std::get<Jmp>(new_ins).cond)
+                    if (!std::get<Jmp>(new_ins).cond) {
                         fallthrough = false;
+                    }
                 }
                 break;
             }
             }
-            if (pc == insts.size() - 1 && fallthrough)
+            if (pc == insts.size() - 1 && fallthrough) {
                 note("fallthrough in last instruction");
+            }
 
             std::optional<btf_line_info_t> current_line_info = {};
 
-            if (pc < line_info.size())
+            if (pc < line_info.size()) {
                 current_line_info = line_info[pc];
+            }
 
             prog.emplace_back(label_t(static_cast<int>(pc)), new_ins, current_line_info);
 
@@ -691,8 +787,9 @@ struct Unmarshaller {
                 note_next_pc();
             }
         }
-        if (exit_count == 0)
+        if (exit_count == 0) {
             note("no exit instruction");
+        }
         return prog;
     }
 };
@@ -713,8 +810,7 @@ std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog)
     return unmarshal(raw_prog, notes);
 }
 
-Call make_call(int imm, const ebpf_platform_t& platform)
-{
+Call make_call(int imm, const ebpf_platform_t& platform) {
     vector<vector<string>> notes;
     program_info info{.platform = &platform};
     return Unmarshaller{notes, info}.makeCall(imm);
diff --git a/src/asm_unmarshal.hpp b/src/asm_unmarshal.hpp
index f5d2ce85f..41a46126d 100644
--- a/src/asm_unmarshal.hpp
+++ b/src/asm_unmarshal.hpp
@@ -9,8 +9,8 @@
 #include <vector>
 
 #include "asm_syntax.hpp"
-#include "spec_type_descriptors.hpp"
 #include "platform.hpp"
+#include "spec_type_descriptors.hpp"
 
 /** Translate a sequence of eBPF instructions (elf binary format) to a sequence
  *  of Instructions.
@@ -19,6 +19,7 @@
  *  \param[out] notes is a vector for storing errors and warnings.
  *  \return a sequence of instruction if successful, an error string otherwise.
  */
-std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog, std::vector<std::vector<std::string>>& notes);
+std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog,
+                                                    std::vector<std::vector<std::string>>& notes);
 std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog);
 Call make_call(int func, const ebpf_platform_t& platform);
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 6c2257d40..1a974abb3 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -6,8 +6,8 @@
 #include <vector>
 
 #include "asm_syntax.hpp"
-#include "platform.hpp"
 #include "crab/cfg.hpp"
+#include "platform.hpp"
 
 using std::string;
 using std::to_string;
@@ -17,13 +17,9 @@ class AssertExtractor {
     program_info info;
     std::optional<label_t> current_label; ///< Pre-simplification label this assert is part of.
 
-    static Reg reg(Value v) {
-        return std::get<Reg>(v);
-    }
+    static Reg reg(Value v) { return std::get<Reg>(v); }
 
-    static Imm imm(Value v) {
-        return std::get<Imm>(v);
-    }
+    static Imm imm(Value v) { return std::get<Imm>(v); }
 
     static vector<Assert> zero_offset_ctx(Reg reg) {
         vector<Assert> res;
@@ -33,13 +29,23 @@ class AssertExtractor {
     }
 
   public:
-    explicit AssertExtractor(program_info info, std::optional<label_t> label) : info{std::move(info)}, current_label(label) {}
+    explicit AssertExtractor(program_info info, std::optional<label_t> label)
+        : info{std::move(info)}, current_label(label) {}
 
-    vector<Assert> operator()(Undefined const& ins) const { assert(false); return {}; }
+    vector<Assert> operator()(Undefined const& ins) const {
+        assert(false);
+        return {};
+    }
 
-    vector<Assert> operator()(Assert const& ins) const { assert(false); return {}; }
+    vector<Assert> operator()(Assert const& ins) const {
+        assert(false);
+        return {};
+    }
 
-    vector<Assert> operator()(IncrementLoopCounter ins) const { assert(false); return {}; }
+    vector<Assert> operator()(IncrementLoopCounter ins) const {
+        assert(false);
+        return {};
+    }
 
     vector<Assert> operator()(LoadMapFd const& ins) const { return {}; }
 
@@ -79,11 +85,10 @@ class AssertExtractor {
             case ArgSingle::Kind::PTR_TO_MAP_VALUE:
                 assert(map_fd_reg);
                 res.emplace_back(TypeConstraint{arg.reg, TypeGroup::mem});
-                res.emplace_back(ValidMapKeyValue{arg.reg, *map_fd_reg,
-                                                  arg.kind == ArgSingle::Kind::PTR_TO_MAP_KEY});
+                res.emplace_back(ValidMapKeyValue{arg.reg, *map_fd_reg, arg.kind == ArgSingle::Kind::PTR_TO_MAP_KEY});
                 break;
             case ArgSingle::Kind::PTR_TO_CTX:
-                for (const Assert& a: zero_offset_ctx(arg.reg)) {
+                for (const Assert& a : zero_offset_ctx(arg.reg)) {
                     res.emplace_back(a);
                 }
                 break;
@@ -124,8 +129,9 @@ class AssertExtractor {
 
     [[nodiscard]]
     vector<Assert> explicate(Condition cond) const {
-        if (info.type.is_privileged)
+        if (info.type.is_privileged) {
             return {};
+        }
         vector<Assert> res;
         if (std::holds_alternative<Imm>(cond.right)) {
             if (imm(cond.right).v != 0) {
@@ -142,7 +148,7 @@ class AssertExtractor {
             if (cond.op != Condition::Op::EQ && cond.op != Condition::Op::NE) {
                 res.emplace_back(TypeConstraint{cond.left, TypeGroup::non_map_fd});
             }
-            res.emplace_back(Comparable{.r1=cond.left, .r2=reg(cond.right), .or_r2_is_number=false});
+            res.emplace_back(Comparable{.r1 = cond.left, .r2 = reg(cond.right), .or_r2_is_number = false});
         }
         return res;
     }
@@ -150,8 +156,9 @@ class AssertExtractor {
     vector<Assert> operator()(Assume ins) const { return explicate(ins.cond); }
 
     vector<Assert> operator()(Jmp ins) const {
-        if (!ins.cond)
+        if (!ins.cond) {
             return {};
+        }
         return explicate(*ins.cond);
     }
 
@@ -164,17 +171,19 @@ class AssertExtractor {
             // We know we are accessing the stack.
             if (offset < -EBPF_STACK_SIZE || offset + (int)width.v >= 0) {
                 // This assertion will fail
-                res.emplace_back(ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
+                res.emplace_back(
+                    ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
             }
         } else {
             res.emplace_back(TypeConstraint{basereg, TypeGroup::pointer});
             res.emplace_back(
                 ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
             if (!info.type.is_privileged && !ins.is_load && std::holds_alternative<Reg>(ins.value)) {
-                if (width.v != 8)
+                if (width.v != 8) {
                     res.emplace_back(TypeConstraint{reg(ins.value), TypeGroup::number});
-                else
+                } else {
                     res.emplace_back(ValidStore{ins.access.basereg, reg(ins.value)});
+                }
             }
         }
         return res;
@@ -183,8 +192,8 @@ class AssertExtractor {
     vector<Assert> operator()(Atomic ins) const {
         vector<Assert> res;
         res.emplace_back(TypeConstraint{ins.access.basereg, TypeGroup::pointer});
-        res.emplace_back(ValidAccess{ins.access.basereg, ins.access.offset,
-                                     Imm{static_cast<uint32_t>(ins.access.width)}, false});
+        res.emplace_back(
+            ValidAccess{ins.access.basereg, ins.access.offset, Imm{static_cast<uint32_t>(ins.access.width)}, false});
         if (ins.op == Atomic::Op::CMPXCHG) {
             // The memory contents pointed to by ins.access will be compared
             // against the value of the ins.valreg register.  Only numbers are
@@ -194,11 +203,7 @@ class AssertExtractor {
         return res;
     }
 
-    vector<Assert> operator()(Un ins) {
-        return {
-            Assert{TypeConstraint{ins.dst, TypeGroup::number}}
-        };
-    }
+    vector<Assert> operator()(Un ins) { return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}}; }
 
     vector<Assert> operator()(Bin ins) const {
         switch (ins.op) {
@@ -214,16 +219,11 @@ class AssertExtractor {
         case Bin::Op::ADD:
             if (std::holds_alternative<Reg>(ins.v)) {
                 auto src = reg(ins.v);
-                return {
-                    Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}},
-                    Assert{TypeConstraint{src, TypeGroup::ptr_or_num}},
-                    Assert{Addable{src, ins.dst}},
-                    Assert{Addable{ins.dst, src}}
-                };
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}},
+                        Assert{TypeConstraint{src, TypeGroup::ptr_or_num}}, Assert{Addable{src, ins.dst}},
+                        Assert{Addable{ins.dst, src}}};
             } else {
-                return {
-                    Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}
-                };
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
             }
         case Bin::Op::SUB:
             if (std::holds_alternative<Reg>(ins.v)) {
@@ -231,12 +231,10 @@ class AssertExtractor {
                 // disallow map-map since same type does not mean same offset
                 // TODO: map identities
                 res.emplace_back(TypeConstraint{ins.dst, TypeGroup::ptr_or_num});
-                res.emplace_back(Comparable{.r1=ins.dst, .r2=reg(ins.v), .or_r2_is_number=true});
+                res.emplace_back(Comparable{.r1 = ins.dst, .r2 = reg(ins.v), .or_r2_is_number = true});
                 return res;
             } else {
-                return {
-                    Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}
-                };
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
             }
         case Bin::Op::UDIV:
         case Bin::Op::UMOD:
@@ -249,8 +247,7 @@ class AssertExtractor {
             } else {
                 return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
             }
-        default:
-            return { Assert{TypeConstraint{ins.dst, TypeGroup::number}} };
+        default: return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
         }
         assert(false);
         return {};
@@ -271,8 +268,9 @@ void explicate_assertions(cfg_t& cfg, const program_info& info) {
         (void)label; // unused
         vector<Instruction> insts;
         for (const auto& ins : vector<Instruction>(bb.begin(), bb.end())) {
-            for (auto a : get_assertions(ins, info, bb.label()))
+            for (auto a : get_assertions(ins, info, bb.label())) {
                 insts.emplace_back(a);
+            }
             insts.push_back(ins);
         }
         bb.swap_instructions(insts);
diff --git a/src/crab/add_bottom.hpp b/src/crab/add_bottom.hpp
index 83e14d4a3..d520a275b 100644
--- a/src/crab/add_bottom.hpp
+++ b/src/crab/add_bottom.hpp
@@ -11,15 +11,13 @@ namespace crab {
 
 namespace domains {
 
-
 class AddBottom final {
     using T = SplitDBM;
     std::optional<T> dom{};
-    AddBottom() { }
+    AddBottom() {}
 
   public:
-
-    template<typename T>
+    template <typename T>
     explicit AddBottom(T&& _dom) : dom{std::forward<T>(_dom)} {}
     AddBottom(const AddBottom& other) = default;
     AddBottom(AddBottom& other) = default;
@@ -36,17 +34,19 @@ class AddBottom final {
         }
     }
 
-    void set_to_bottom() {
-        dom = {};
-    }
+    void set_to_bottom() { dom = {}; }
 
-    [[nodiscard]] bool is_bottom() const { return !dom; }
+    [[nodiscard]]
+    bool is_bottom() const {
+        return !dom;
+    }
 
     static AddBottom top() { return AddBottom(T::top()); }
 
     static AddBottom bottom() { return AddBottom(); }
 
-    [[nodiscard]] bool is_top() const {
+    [[nodiscard]]
+    bool is_top() const {
         return dom && dom->is_top();
     }
 
@@ -82,53 +82,64 @@ class AddBottom final {
         *dom |= std::move(*o.dom);
     }
 
-    template<typename Left, typename Right>
+    template <typename Left, typename Right>
     friend AddBottom operator|(Left&& left, Right&& right) {
         using LDOM = decltype(*std::forward<Left>(left).dom);
         using RDOM = decltype(*std::forward<Right>(right).dom);
-        if (!left.dom)
+        if (!left.dom) {
             return std::forward<Right>(right);
-        if (!right.dom)
+        }
+        if (!right.dom) {
             return std::forward<Left>(left);
+        }
         return AddBottom(std::forward<LDOM>(*left.dom) | std::forward<RDOM>(*right.dom));
     }
 
-
-    [[nodiscard]] AddBottom widen(const AddBottom& o) const {
-        if (!dom)
+    [[nodiscard]]
+    AddBottom widen(const AddBottom& o) const {
+        if (!dom) {
             return o;
-        if (!o.dom)
+        }
+        if (!o.dom) {
             return *this;
+        }
         return AddBottom(dom->widen(*o.dom));
     }
 
     AddBottom operator&(const AddBottom& o) const {
-        if (!dom || !o.dom)
+        if (!dom || !o.dom) {
             return bottom();
-        if (auto res = (*dom).meet(*o.dom))
+        }
+        if (auto res = (*dom).meet(*o.dom)) {
             return AddBottom(*res);
+        }
         return bottom();
     }
 
-    [[nodiscard]] AddBottom narrow(const AddBottom& o) const {
-        if (!dom || !o.dom)
+    [[nodiscard]]
+    AddBottom narrow(const AddBottom& o) const {
+        if (!dom || !o.dom) {
             return bottom();
+        }
         return AddBottom(dom->narrow(*o.dom));
     }
 
-    [[nodiscard]] AddBottom when(const linear_constraint_t& cst) const {
+    [[nodiscard]]
+    AddBottom when(const linear_constraint_t& cst) const {
         if (dom) {
             AddBottom result(*dom);
-            if (!result.dom->add_constraint(cst))
+            if (!result.dom->add_constraint(cst)) {
                 result.dom = {};
+            }
             return result;
         }
         return bottom();
     }
 
     void operator-=(variable_t v) {
-        if (dom)
+        if (dom) {
             (*dom) -= v;
+        }
     }
 
     void assign(std::optional<variable_t> x, const linear_expression_t& e) {
@@ -137,7 +148,7 @@ class AddBottom final {
         }
     }
 
-    template<typename V>
+    template <typename V>
     void assign(variable_t x, const V& value) {
         if (dom) {
             // XXX: maybe needs to return false when becomes bottom
@@ -146,7 +157,7 @@ class AddBottom final {
         }
     };
 
-    template<typename Op, typename Left, typename Right>
+    template <typename Op, typename Left, typename Right>
     void apply(Op op, variable_t x, const Left& left, const Right& right, int finite_width) {
         if (dom) {
             dom->apply(op, x, left, right, finite_width);
@@ -161,15 +172,18 @@ class AddBottom final {
         }
     }
 
-    [[nodiscard]] interval_t eval_interval(const linear_expression_t& e) const {
-        if (dom)
+    [[nodiscard]]
+    interval_t eval_interval(const linear_expression_t& e) const {
+        if (dom) {
             return dom->eval_interval(e);
+        }
         return interval_t::bottom();
     }
 
     interval_t operator[](variable_t x) const {
-        if (dom)
+        if (dom) {
             return (*dom)[x];
+        }
         return interval_t::bottom();
     }
 
@@ -182,7 +196,8 @@ class AddBottom final {
     }
 
     // Return true if inv intersects with cst.
-    [[nodiscard]] bool intersect(const linear_constraint_t& cst) const {
+    [[nodiscard]]
+    bool intersect(const linear_constraint_t& cst) const {
         if (dom) {
             return dom->intersect(cst);
         }
@@ -190,7 +205,8 @@ class AddBottom final {
     }
 
     // Return true if entails rhs.
-    [[nodiscard]] bool entail(const linear_constraint_t& cst) const{
+    [[nodiscard]]
+    bool entail(const linear_constraint_t& cst) const {
         if (dom) {
             return dom->entail(cst);
         }
@@ -204,7 +220,8 @@ class AddBottom final {
         return o << "_|_";
     }
 
-    [[nodiscard]] string_invariant to_set() const {
+    [[nodiscard]]
+    string_invariant to_set() const {
         if (dom) {
             return dom->to_set();
         }
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 9a51ba668..629669da8 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -10,8 +10,8 @@
 
 #include "boost/endian/conversion.hpp"
 
-#include "radix_tree/radix_tree.hpp"
 #include "crab/array_domain.hpp"
+#include "radix_tree/radix_tree.hpp"
 
 #include "asm_ostream.hpp"
 #include "config.hpp"
@@ -20,8 +20,7 @@
 
 namespace crab::domains {
 
-static bool maybe_between(const NumAbsDomain& dom, const bound_t& x,
-                          const linear_expression_t& symb_lb,
+static bool maybe_between(const NumAbsDomain& dom, const bound_t& x, const linear_expression_t& symb_lb,
                           const linear_expression_t& symb_ub) {
     using namespace dsl_syntax;
     assert(x.is_finite());
@@ -43,7 +42,10 @@ class offset_t final {
     offset_t(index_t index, int prefix_length) : _index(index), _prefix_length(prefix_length) {}
     explicit operator int() const { return static_cast<int>(_index); }
     operator index_t() const { return _index; }
-    [[nodiscard]] int prefix_length() const { return _prefix_length; }
+    [[nodiscard]]
+    int prefix_length() const {
+        return _prefix_length;
+    }
 
     index_t operator[](int n) const { return (_index >> (bitsize - 1 - n)) & 1; }
 };
@@ -58,14 +60,14 @@ int radix_length(const offset_t& offset) {
 // NOTE: required by radix_tree
 // Get a range of bits out of the middle of a key, starting at [begin] for a given length.
 [[maybe_unused]]
-offset_t radix_substr(const offset_t& key, int begin, int length)
-{
+offset_t radix_substr(const offset_t& key, int begin, int length) {
     uint64_t mask;
 
-    if (length == offset_t::bitsize)
+    if (length == offset_t::bitsize) {
         mask = 0;
-    else
+    } else {
         mask = ((index_t)1) << length;
+    }
 
     mask -= 1;
     mask <<= offset_t::bitsize - length - begin;
@@ -77,8 +79,7 @@ offset_t radix_substr(const offset_t& key, int begin, int length)
 // NOTE: required by radix_tree
 // Concatenate two bit patterns.
 [[maybe_unused]]
-offset_t radix_join(const offset_t& entry1, const offset_t& entry2)
-{
+offset_t radix_join(const offset_t& entry1, const offset_t& entry2) {
     index_t value1 = (index_t)entry1;
     index_t value2 = (index_t)entry2;
     index_t value = value1 | (value2 >> entry1.prefix_length());
@@ -114,21 +115,34 @@ class cell_t final {
     }
 
   public:
-    [[nodiscard]] interval_t to_interval() const { return to_interval(_offset, _size); }
+    [[nodiscard]]
+    interval_t to_interval() const {
+        return to_interval(_offset, _size);
+    }
 
-    [[nodiscard]] bool is_null() const { return _offset == 0 && _size == 0; }
+    [[nodiscard]]
+    bool is_null() const {
+        return _offset == 0 && _size == 0;
+    }
 
-    [[nodiscard]] offset_t get_offset() const { return _offset; }
+    [[nodiscard]]
+    offset_t get_offset() const {
+        return _offset;
+    }
 
-    [[nodiscard]] variable_t get_scalar(data_kind_t kind) const { return variable_t::cell_var(kind, number_t{_offset}, _size); }
+    [[nodiscard]]
+    variable_t get_scalar(data_kind_t kind) const {
+        return variable_t::cell_var(kind, number_t{_offset}, _size);
+    }
 
     // ignore the scalar variable
     bool operator==(const cell_t& o) const { return to_interval() == o.to_interval(); }
 
     // ignore the scalar variable
     bool operator<(const cell_t& o) const {
-        if (_offset == o._offset)
+        if (_offset == o._offset) {
             return _size < o._size;
+        }
         return _offset < o._offset;
     }
 
@@ -147,9 +161,8 @@ class cell_t final {
     // Return true if [symb_lb, symb_ub] may overlap with the cell,
     // where symb_lb and symb_ub are not constant expressions.
     [[nodiscard]]
-    bool symbolic_overlap(const linear_expression_t& symb_lb,
-                     const linear_expression_t& symb_ub,
-                     const NumAbsDomain& dom) const;
+    bool symbolic_overlap(const linear_expression_t& symb_lb, const linear_expression_t& symb_ub,
+                          const NumAbsDomain& dom) const;
 
     friend std::ostream& operator<<(std::ostream& o, const cell_t& c) { return o << "cell(" << c.to_interval() << ")"; }
 };
@@ -159,8 +172,7 @@ class cell_t final {
 bool cell_t::symbolic_overlap(const linear_expression_t& symb_lb, const linear_expression_t& symb_ub,
                               const NumAbsDomain& dom) const {
     interval_t x = to_interval();
-    return maybe_between(dom, x.lb(), symb_lb, symb_ub)
-        || maybe_between(dom, x.ub(), symb_lb, symb_ub);
+    return maybe_between(dom, x.lb(), symb_lb, symb_ub) || maybe_between(dom, x.ub(), symb_lb, symb_ub);
 }
 
 // Map offsets to cells
@@ -184,8 +196,12 @@ class offset_map_t final {
 
     // for algorithm::lower_bound and algorithm::upper_bound
     struct compare_binding_t {
-        bool operator()(const typename patricia_tree_t::value_type& kv, const offset_t& o) const { return kv.first < o; }
-        bool operator()(const offset_t& o, const typename patricia_tree_t::value_type& kv) const { return o < kv.first; }
+        bool operator()(const typename patricia_tree_t::value_type& kv, const offset_t& o) const {
+            return kv.first < o;
+        }
+        bool operator()(const offset_t& o, const typename patricia_tree_t::value_type& kv) const {
+            return o < kv.first;
+        }
         bool operator()(const typename patricia_tree_t::value_type& kv1,
                         const typename patricia_tree_t::value_type& kv2) const {
             return kv1.first < kv2.first;
@@ -196,16 +212,23 @@ class offset_map_t final {
 
     void insert_cell(const cell_t& c);
 
-    [[nodiscard]] std::optional<cell_t> get_cell(offset_t o, unsigned size);
+    [[nodiscard]]
+    std::optional<cell_t> get_cell(offset_t o, unsigned size);
 
     cell_t mk_cell(offset_t o, unsigned size);
 
   public:
     offset_map_t() = default;
 
-    [[nodiscard]] bool empty() const { return _map.empty(); }
+    [[nodiscard]]
+    bool empty() const {
+        return _map.empty();
+    }
 
-    [[nodiscard]] std::size_t size() const { return _map.size(); }
+    [[nodiscard]]
+    std::size_t size() const {
+        return _map.size();
+    }
 
     void operator-=(const cell_t& c) { remove_cell(c); }
 
@@ -218,15 +241,21 @@ class offset_map_t final {
     // Return in out all cells that might overlap with (o, size).
     std::vector<cell_t> get_overlap_cells(offset_t o, unsigned size);
 
-    [[nodiscard]] std::vector<cell_t> get_overlap_cells_symbolic_offset(const NumAbsDomain& dom,
-                                                                        const linear_expression_t& symb_lb,
-                                                                        const linear_expression_t& symb_ub);
+    [[nodiscard]]
+    std::vector<cell_t> get_overlap_cells_symbolic_offset(const NumAbsDomain& dom, const linear_expression_t& symb_lb,
+                                                          const linear_expression_t& symb_ub);
 
     friend std::ostream& operator<<(std::ostream& o, offset_map_t& m);
 
     /* Operations needed if used as value in a separate_domain */
-    [[nodiscard]] bool is_top() const { return empty(); }
-    [[nodiscard]] bool is_bottom() const { return false; }
+    [[nodiscard]]
+    bool is_top() const {
+        return empty();
+    }
+    [[nodiscard]]
+    bool is_bottom() const {
+        return false;
+    }
     /*
        We don't distinguish between bottom and top.
        This is fine because separate_domain only calls bottom if
@@ -295,8 +324,9 @@ cell_t offset_map_t::mk_cell(offset_t o, unsigned size) {
     // TODO: check array is the array associated to this offset map
 
     auto maybe_c = get_cell(o, size);
-    if (maybe_c)
+    if (maybe_c) {
         return *maybe_c;
+    }
     // create a new scalar variable for representing the contents
     // of bytes array[o,o+1,..., o+size-1]
     cell_t c(o, size);
@@ -404,14 +434,9 @@ using array_map_t = std::unordered_map<data_kind_t, offset_map_t>;
 
 static thread_local crab::lazy_allocator<array_map_t> global_array_map;
 
-void clear_thread_local_state()
-{
-    global_array_map.clear();
-}
+void clear_thread_local_state() { global_array_map.clear(); }
 
-static offset_map_t& lookup_array_map(data_kind_t kind) {
-    return (*global_array_map)[kind];
-}
+static offset_map_t& lookup_array_map(data_kind_t kind) { return (*global_array_map)[kind]; }
 
 /**
     Ugly this needs to be fixed: needed if multiple analyses are
@@ -492,7 +517,8 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         int cell_start_index = (int)*intv.lb().number();
         int cell_end_index = (int)*intv.ub().number();
 
-        if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) || (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
+        if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) ||
+            (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
             // We can only split numeric cells of size 8 or less.
             continue;
         }
@@ -513,8 +539,9 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
 }
 
 // we can only treat this as non-member because we use global state
-static std::optional<std::pair<offset_t, unsigned>>
-kill_and_find_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, const linear_expression_t& elem_size) {
+static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDomain& inv, data_kind_t kind,
+                                                                      const linear_expression_t& i,
+                                                                      const linear_expression_t& elem_size) {
     std::optional<std::pair<offset_t, unsigned>> res;
 
     offset_map_t& offset_map = lookup_array_map(kind);
@@ -556,14 +583,16 @@ kill_and_find_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t
 bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) {
     auto min_lb = inv.eval_interval(lb).lb().number();
     auto max_ub = inv.eval_interval(ub).ub().number();
-    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32())
+    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32()) {
         return false;
+    }
 
     // The all_num() call requires a legal range. If we have an illegal range,
     // we should have already generated an error about the invalid range so just
     // return true now to avoid an extra error about a non-numeric range.
-    if (*min_lb >= *max_ub)
+    if (*min_lb >= *max_ub) {
         return true;
+    }
 
     return this->num_bytes.all_num((int32_t)*min_lb, (int32_t)*max_ub);
 }
@@ -572,8 +601,9 @@ bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, c
 int array_domain_t::min_all_num_size(const NumAbsDomain& inv, variable_t offset) const {
     auto min_lb = inv.eval_interval(offset).lb().number();
     auto max_ub = inv.eval_interval(offset).ub().number();
-    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32())
+    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32()) {
         return 0;
+    }
     auto lb = (int)min_lb.value();
     auto ub = (int)max_ub.value();
     return std::max(0, this->num_bytes.all_num_width(lb) - (ub - lb));
@@ -591,29 +621,33 @@ std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width)
     // Convert value to bytes of the appropriate endian-ness.
     switch (width) {
     case sizeof(uint16_t):
-        if (thread_local_options.big_endian)
+        if (thread_local_options.big_endian) {
             n = boost::endian::native_to_big<uint16_t>(n);
-        else
+        } else {
             n = boost::endian::native_to_little<uint16_t>(n);
+        }
         break;
     case sizeof(uint32_t):
-        if (thread_local_options.big_endian)
+        if (thread_local_options.big_endian) {
             n = boost::endian::native_to_big<uint32_t>(n);
-        else
+        } else {
             n = boost::endian::native_to_little<uint32_t>(n);
+        }
         break;
     case sizeof(uint64_t):
-        if (thread_local_options.big_endian)
+        if (thread_local_options.big_endian) {
             n = boost::endian::native_to_big<uint64_t>(n);
-        else
+        } else {
             n = boost::endian::native_to_little<uint64_t>(n);
+        }
         break;
     }
     uint8_t* bytes = (uint8_t*)&n;
     return bytes[o % width];
 }
 
-std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, int width) {
+std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_kind_t kind,
+                                                        const linear_expression_t& i, int width) {
     interval_t ii = inv.eval_interval(i);
     if (std::optional<number_t> n = ii.singleton()) {
         offset_map_t& offset_map = lookup_array_map(kind);
@@ -665,26 +699,29 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
                 }
                 if (size == 2) {
                     uint16_t b = *(uint16_t*)result_buffer;
-                    if (thread_local_options.big_endian)
+                    if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint16_t>(b);
-                    else
+                    } else {
                         b = boost::endian::native_to_little<uint16_t>(b);
+                    }
                     return number_t{b};
                 }
                 if (size == 4) {
                     uint32_t b = *(uint32_t*)result_buffer;
-                    if (thread_local_options.big_endian)
+                    if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint32_t>(b);
-                    else
+                    } else {
                         b = boost::endian::native_to_little<uint32_t>(b);
+                    }
                     return number_t{b};
                 }
                 if (size == 8) {
                     uint64_t b = *(uint64_t*)result_buffer;
-                    if (thread_local_options.big_endian)
+                    if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint64_t>(b);
-                    else
+                    } else {
                         b = boost::endian::native_to_little<uint64_t>(b);
+                    }
                     return (kind == data_kind_t::uvalues) ? number_t(b) : number_t((int64_t)b);
                 }
             }
@@ -698,8 +735,8 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
             // would be unsound.
             return c.get_scalar(kind);
         } else {
-            CRAB_WARN("Ignored read from cell ", kind, "[", o, "...", o + size - 1, "]",
-                      " because it overlaps with ", cells.size(), " cells");
+            CRAB_WARN("Ignored read from cell ", kind, "[", o, "...", o + size - 1, "]", " because it overlaps with ",
+                      cells.size(), " cells");
             /*
                 TODO: we can apply here "Value Recomposition" 'a la'
                 Mine'06 (https://arxiv.org/pdf/cs/0703074.pdf)
@@ -731,28 +768,28 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
 // We are about to write to a given range of bytes on the stack.
 // Any cells covering that range need to be removed, and any cells that only
 // partially cover that range can be split such that any non-covered portions become new cells.
-static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
+static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv,
+                                                                       data_kind_t kind, const linear_expression_t& idx,
+                                                                       const linear_expression_t& elem_size) {
     if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
         array_domain.split_number_var(inv, kind, idx, elem_size);
     }
     return kill_and_find_var(inv, kind, idx, elem_size);
 }
 
-
-std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind,
-                                                const linear_expression_t& idx,
-                                                const linear_expression_t& elem_size,
-                                                const linear_expression_t& val) {
+std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
+                                                const linear_expression_t& elem_size, const linear_expression_t& val) {
     auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
         if (kind == data_kind_t::types) {
             std::optional<number_t> t = inv.eval_interval(val).singleton();
-            if (t && (int64_t)*t == T_NUM)
+            if (t && (int64_t)*t == T_NUM) {
                 num_bytes.reset(offset, size);
-            else
+            } else {
                 num_bytes.havoc(offset, size);
+            }
         }
         variable_t v = lookup_array_map(kind).mk_cell(offset, size).get_scalar(kind);
         return v;
@@ -760,8 +797,7 @@ std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t k
     return {};
 }
 
-std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
-                                                     const linear_expression_t& idx,
+std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv, const linear_expression_t& idx,
                                                      const linear_expression_t& elem_size,
                                                      const linear_expression_t& val) {
     auto kind = data_kind_t::types;
@@ -770,24 +806,24 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
         // perform strong update
         auto [offset, size] = *maybe_cell;
         std::optional<number_t> t = inv.eval_interval(val).singleton();
-        if (t && (int64_t)*t == T_NUM)
+        if (t && (int64_t)*t == T_NUM) {
             num_bytes.reset(offset, size);
-        else
+        } else {
             num_bytes.havoc(offset, size);
+        }
         variable_t v = lookup_array_map(kind).mk_cell(offset, size).get_scalar(kind);
         return v;
     }
     return {};
 }
 
-std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv,
-                                                     const linear_expression_t& idx,
-                                                     const linear_expression_t& elem_size,
-                                                     const Reg& reg) {
+std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv, const linear_expression_t& idx,
+                                                     const linear_expression_t& elem_size, const Reg& reg) {
     return store_type(inv, idx, elem_size, variable_t::reg(data_kind_t::types, reg.v));
 }
 
-void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size) {
+void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
+                           const linear_expression_t& elem_size) {
     auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell && kind == data_kind_t::types) {
         auto [offset, size] = *maybe_cell;
@@ -800,8 +836,9 @@ void array_domain_t::store_numbers(NumAbsDomain& inv, variable_t _idx, variable_
     // TODO: this should be an user parameter.
     const number_t max_num_elems = EBPF_STACK_SIZE;
 
-    if (is_bottom())
+    if (is_bottom()) {
         return;
+    }
 
     std::optional<number_t> idx_n = inv[_idx].singleton();
     if (!idx_n) {
@@ -823,9 +860,7 @@ void array_domain_t::store_numbers(NumAbsDomain& inv, variable_t _idx, variable_
     num_bytes.reset((int)*idx_n, (int)*width);
 }
 
-void array_domain_t::set_to_top() {
-    num_bytes.set_to_top();
-}
+void array_domain_t::set_to_top() { num_bytes.set_to_top(); }
 
 void array_domain_t::set_to_bottom() { num_bytes.set_to_bottom(); }
 
@@ -837,9 +872,7 @@ string_invariant array_domain_t::to_set() const { return num_bytes.to_set(); }
 
 bool array_domain_t::operator<=(const array_domain_t& other) const { return num_bytes <= other.num_bytes; }
 
-bool array_domain_t::operator==(const array_domain_t& other) const {
-    return num_bytes == other.num_bytes;
-}
+bool array_domain_t::operator==(const array_domain_t& other) const { return num_bytes == other.num_bytes; }
 
 void array_domain_t::operator|=(const array_domain_t& other) {
     if (is_bottom()) {
@@ -861,7 +894,8 @@ array_domain_t array_domain_t::widen(const array_domain_t& other) const {
     return array_domain_t(num_bytes | other.num_bytes);
 }
 
-array_domain_t array_domain_t::widening_thresholds(const array_domain_t& other, const iterators::thresholds_t& ts) const {
+array_domain_t array_domain_t::widening_thresholds(const array_domain_t& other,
+                                                   const iterators::thresholds_t& ts) const {
     return array_domain_t(num_bytes | other.num_bytes);
 }
 
@@ -869,7 +903,5 @@ array_domain_t array_domain_t::narrow(const array_domain_t& other) const {
     return array_domain_t(num_bytes & other.num_bytes);
 }
 
-std::ostream& operator<<(std::ostream& o, const array_domain_t& dom) {
-    return o << dom.num_bytes;
-}
+std::ostream& operator<<(std::ostream& o, const array_domain_t& dom) { return o << dom.num_bytes; }
 } // namespace crab::domains
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index 70525cb90..c90b03d3c 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -27,8 +27,8 @@
 #include <optional>
 #include <utility>
 
-#include "crab/variable.hpp"
 #include "crab/add_bottom.hpp"
+#include "crab/variable.hpp"
 
 #include "crab/bitset_domain.hpp"
 
@@ -47,12 +47,14 @@ class array_domain_t final {
   public:
     array_domain_t() = default;
 
-    array_domain_t(const bitset_domain_t& num_bytes) : num_bytes(num_bytes) { }
+    array_domain_t(const bitset_domain_t& num_bytes) : num_bytes(num_bytes) {}
 
     void set_to_top();
     void set_to_bottom();
-    [[nodiscard]] bool is_bottom() const;
-    [[nodiscard]] bool is_top() const;
+    [[nodiscard]]
+    bool is_bottom() const;
+    [[nodiscard]]
+    bool is_top() const;
 
     bool operator<=(const array_domain_t& other) const;
     bool operator==(const array_domain_t& other) const;
@@ -66,23 +68,23 @@ class array_domain_t final {
     array_domain_t narrow(const array_domain_t& other) const;
 
     friend std::ostream& operator<<(std::ostream& o, const array_domain_t& dom);
-    [[nodiscard]] string_invariant to_set() const;
+    [[nodiscard]]
+    string_invariant to_set() const;
 
     bool all_num(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub);
-    [[nodiscard]] int min_all_num_size(const NumAbsDomain& inv, variable_t offset) const;
-
-    std::optional<linear_expression_t> load(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i, int width);
-    std::optional<variable_t> store(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size,
-                                    const linear_expression_t& val);
-    std::optional<variable_t> store_type(NumAbsDomain& inv,
-                                         const linear_expression_t& idx,
-                                         const linear_expression_t& elem_size,
-                                         const linear_expression_t& val);
-    std::optional<variable_t> store_type(NumAbsDomain& inv,
-                                         const linear_expression_t& idx,
-                                         const linear_expression_t& elem_size,
-                                         const Reg& reg);
-    void havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx, const linear_expression_t& elem_size);
+    [[nodiscard]]
+    int min_all_num_size(const NumAbsDomain& inv, variable_t offset) const;
+
+    std::optional<linear_expression_t> load(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                                            int width);
+    std::optional<variable_t> store(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
+                                    const linear_expression_t& elem_size, const linear_expression_t& val);
+    std::optional<variable_t> store_type(NumAbsDomain& inv, const linear_expression_t& idx,
+                                         const linear_expression_t& elem_size, const linear_expression_t& val);
+    std::optional<variable_t> store_type(NumAbsDomain& inv, const linear_expression_t& idx,
+                                         const linear_expression_t& elem_size, const Reg& reg);
+    void havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
+               const linear_expression_t& elem_size);
 
     // Perform array stores over an array segment
     void store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width);
@@ -94,4 +96,4 @@ class array_domain_t final {
     void initialize_numbers(int lb, int width);
 };
 
-}
+} // namespace crab::domains
diff --git a/src/crab/bitset_domain.cpp b/src/crab/bitset_domain.cpp
index 1d9095b15..e530c40f6 100644
--- a/src/crab/bitset_domain.cpp
+++ b/src/crab/bitset_domain.cpp
@@ -7,18 +7,23 @@ std::ostream& operator<<(std::ostream& o, const bitset_domain_t& b) {
     o << "Numbers -> {";
     bool first = true;
     for (int i = -EBPF_STACK_SIZE; i < 0; i++) {
-        if (b.non_numerical_bytes[EBPF_STACK_SIZE + i])
+        if (b.non_numerical_bytes[EBPF_STACK_SIZE + i]) {
             continue;
-        if (!first)
+        }
+        if (!first) {
             o << ", ";
+        }
         first = false;
         o << "[" << EBPF_STACK_SIZE + i;
         int j = i + 1;
-        for (; j < 0; j++)
-            if (b.non_numerical_bytes[EBPF_STACK_SIZE + j])
+        for (; j < 0; j++) {
+            if (b.non_numerical_bytes[EBPF_STACK_SIZE + j]) {
                 break;
-        if (j > i + 1)
+            }
+        }
+        if (j > i + 1) {
             o << "..." << EBPF_STACK_SIZE + j - 1;
+        }
         o << "]";
         i = j;
     }
@@ -26,8 +31,7 @@ std::ostream& operator<<(std::ostream& o, const bitset_domain_t& b) {
     return o;
 }
 
-string_invariant bitset_domain_t::to_set() const
-{
+string_invariant bitset_domain_t::to_set() const {
     if (this->is_bottom()) {
         return string_invariant::bottom();
     }
@@ -37,15 +41,19 @@ string_invariant bitset_domain_t::to_set() const
 
     std::set<std::string> result;
     for (int i = -EBPF_STACK_SIZE; i < 0; i++) {
-        if (non_numerical_bytes[EBPF_STACK_SIZE + i])
+        if (non_numerical_bytes[EBPF_STACK_SIZE + i]) {
             continue;
+        }
         std::string value = "s[" + std::to_string(EBPF_STACK_SIZE + i);
         int j = i + 1;
-        for (; j < 0; j++)
-            if (non_numerical_bytes[EBPF_STACK_SIZE + j])
+        for (; j < 0; j++) {
+            if (non_numerical_bytes[EBPF_STACK_SIZE + j]) {
                 break;
-        if (j > i + 1)
+            }
+        }
+        if (j > i + 1) {
             value += "..." + std::to_string(EBPF_STACK_SIZE + j - 1);
+        }
         value += "].type=number";
         result.insert(value);
         i = j;
diff --git a/src/crab/bitset_domain.hpp b/src/crab/bitset_domain.hpp
index 16e6ca59c..a9f13654d 100644
--- a/src/crab/bitset_domain.hpp
+++ b/src/crab/bitset_domain.hpp
@@ -1,11 +1,11 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 #pragma once
-#include <cassert>
 #include <bitset>
+#include <cassert>
 
-#include "string_constraints.hpp"
 #include "spec_type_descriptors.hpp" // for EBPF_STACK_SIZE
+#include "string_constraints.hpp"
 
 class bitset_domain_t final {
   private:
@@ -21,11 +21,18 @@ class bitset_domain_t final {
 
     void set_to_bottom() { non_numerical_bytes.reset(); }
 
-    [[nodiscard]] bool is_top() const { return non_numerical_bytes.all(); }
+    [[nodiscard]]
+    bool is_top() const {
+        return non_numerical_bytes.all();
+    }
 
-    [[nodiscard]] bool is_bottom() const { return false; }
+    [[nodiscard]]
+    bool is_bottom() const {
+        return false;
+    }
 
-    [[nodiscard]] string_invariant to_set() const;
+    [[nodiscard]]
+    string_invariant to_set() const;
 
     bool operator<=(const bitset_domain_t& other) const {
         return (non_numerical_bytes | other.non_numerical_bytes) == other.non_numerical_bytes;
@@ -35,9 +42,7 @@ class bitset_domain_t final {
 
     void operator|=(const bitset_domain_t& other) { non_numerical_bytes |= other.non_numerical_bytes; }
 
-    bitset_domain_t operator|(bitset_domain_t&& other) const {
-        return non_numerical_bytes | other.non_numerical_bytes;
-    }
+    bitset_domain_t operator|(bitset_domain_t&& other) const { return non_numerical_bytes | other.non_numerical_bytes; }
 
     bitset_domain_t operator|(const bitset_domain_t& other) const {
         return non_numerical_bytes | other.non_numerical_bytes;
@@ -74,10 +79,12 @@ class bitset_domain_t final {
     }
 
     // Get the number of bytes, starting at lb, known to be numbers.
-    [[nodiscard]] int all_num_width(size_t lb) const {
+    [[nodiscard]]
+    int all_num_width(size_t lb) const {
         size_t ub = lb;
-        while ((ub < EBPF_STACK_SIZE) && !non_numerical_bytes[ub])
+        while ((ub < EBPF_STACK_SIZE) && !non_numerical_bytes[ub]) {
             ub++;
+        }
         return (int)(ub - lb);
     }
 
@@ -103,12 +110,15 @@ class bitset_domain_t final {
         assert(lb < ub);
         lb = std::max(lb, 0);
         ub = std::min(ub, EBPF_STACK_SIZE);
-        if (lb < 0 || ub > (int)non_numerical_bytes.size())
+        if (lb < 0 || ub > (int)non_numerical_bytes.size()) {
             return false;
+        }
 
-        for (int i = lb; i < ub; i++)
-            if (non_numerical_bytes[i])
+        for (int i = lb; i < ub; i++) {
+            if (non_numerical_bytes[i]) {
                 return false;
+            }
+        }
         return true;
     }
 };
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index 1954a75af..64918348b 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -19,15 +19,15 @@
 #include <vector>
 
 #include <boost/iterator/transform_iterator.hpp>
-#include <boost/range/iterator_range.hpp>
 #include <boost/lexical_cast.hpp>
+#include <boost/range/iterator_range.hpp>
 
 #include "crab/variable.hpp"
 #include "crab_utils/bignums.hpp"
 #include "crab_utils/debug.hpp"
 
-#include "asm_syntax.hpp"
 #include "asm_ostream.hpp"
+#include "asm_syntax.hpp"
 #include "spec_type_descriptors.hpp"
 
 namespace crab {
@@ -38,7 +38,6 @@ class basic_block_t final {
     friend class cfg_t;
 
   private:
-
   public:
     basic_block_t(const basic_block_t&) = delete;
 
@@ -72,33 +71,59 @@ class basic_block_t final {
 
     ~basic_block_t() = default;
 
-    [[nodiscard]] label_t label() const { return m_label; }
+    [[nodiscard]]
+    label_t label() const {
+        return m_label;
+    }
 
     iterator begin() { return (m_ts.begin()); }
     iterator end() { return (m_ts.end()); }
-    [[nodiscard]] const_iterator begin() const { return (m_ts.begin()); }
-    [[nodiscard]] const_iterator end() const { return (m_ts.end()); }
+    [[nodiscard]]
+    const_iterator begin() const {
+        return (m_ts.begin());
+    }
+    [[nodiscard]]
+    const_iterator end() const {
+        return (m_ts.end());
+    }
 
     reverse_iterator rbegin() { return (m_ts.rbegin()); }
     reverse_iterator rend() { return (m_ts.rend()); }
-    [[nodiscard]] const_reverse_iterator rbegin() const { return (m_ts.rbegin()); }
-    [[nodiscard]] const_reverse_iterator rend() const { return (m_ts.rend()); }
+    [[nodiscard]]
+    const_reverse_iterator rbegin() const {
+        return (m_ts.rbegin());
+    }
+    [[nodiscard]]
+    const_reverse_iterator rend() const {
+        return (m_ts.rend());
+    }
 
-    [[nodiscard]] size_t size() const { return static_cast<size_t>(std::distance(begin(), end())); }
+    [[nodiscard]]
+    size_t size() const {
+        return static_cast<size_t>(std::distance(begin(), end()));
+    }
 
-    [[nodiscard]] std::pair<neighbour_const_iterator, neighbour_const_iterator> next_blocks() const { return std::make_pair(m_next.begin(), m_next.end()); }
-    [[nodiscard]] std::pair<neighbour_const_reverse_iterator, neighbour_const_reverse_iterator> next_blocks_reversed() const {
+    [[nodiscard]]
+    std::pair<neighbour_const_iterator, neighbour_const_iterator> next_blocks() const {
+        return std::make_pair(m_next.begin(), m_next.end());
+    }
+    [[nodiscard]]
+    std::pair<neighbour_const_reverse_iterator, neighbour_const_reverse_iterator> next_blocks_reversed() const {
         return std::make_pair(m_next.rbegin(), m_next.rend());
     }
 
+    [[nodiscard]]
+    std::pair<neighbour_const_iterator, neighbour_const_iterator> prev_blocks() const {
+        return std::make_pair(m_prev.begin(), m_prev.end());
+    }
 
-    [[nodiscard]] std::pair<neighbour_const_iterator, neighbour_const_iterator> prev_blocks() const { return std::make_pair(m_prev.begin(), m_prev.end()); }
-
-    [[nodiscard]] const label_vec_t& next_blocks_set() const {
+    [[nodiscard]]
+    const label_vec_t& next_blocks_set() const {
         return m_next;
     }
 
-    [[nodiscard]] const label_vec_t& prev_blocks_set() const {
+    [[nodiscard]]
+    const label_vec_t& prev_blocks_set() const {
         return m_prev;
     }
 
@@ -122,11 +147,13 @@ class basic_block_t final {
         std::move(other.m_ts.begin(), other.m_ts.end(), std::back_inserter(m_ts));
     }
 
-    [[nodiscard]] size_t in_degree() const {
+    [[nodiscard]]
+    size_t in_degree() const {
         return m_prev.size();
     }
 
-    [[nodiscard]] size_t out_degree() const {
+    [[nodiscard]]
+    size_t out_degree() const {
         return m_next.size();
     }
 
@@ -147,28 +174,47 @@ class basic_block_rev_t final {
 
     explicit basic_block_rev_t(basic_block_t& bb) : _bb(bb) {}
 
-    [[nodiscard]] label_t label() const { return _bb.label(); }
+    [[nodiscard]]
+    label_t label() const {
+        return _bb.label();
+    }
 
     iterator begin() { return _bb.rbegin(); }
 
     iterator end() { return _bb.rend(); }
 
-    [[nodiscard]] const_iterator begin() const { return _bb.rbegin(); }
-
-    [[nodiscard]] const_iterator end() const { return _bb.rend(); }
+    [[nodiscard]]
+    const_iterator begin() const {
+        return _bb.rbegin();
+    }
 
-    [[nodiscard]] std::size_t size() const { return static_cast<size_t>(std::distance(begin(), end())); }
+    [[nodiscard]]
+    const_iterator end() const {
+        return _bb.rend();
+    }
 
-    [[nodiscard]] std::pair<neighbour_const_iterator, neighbour_const_iterator> next_blocks() const { return _bb.prev_blocks(); }
+    [[nodiscard]]
+    std::size_t size() const {
+        return static_cast<size_t>(std::distance(begin(), end()));
+    }
 
-    [[nodiscard]] std::pair<neighbour_const_iterator, neighbour_const_iterator> prev_blocks() const { return _bb.next_blocks(); }
+    [[nodiscard]]
+    std::pair<neighbour_const_iterator, neighbour_const_iterator> next_blocks() const {
+        return _bb.prev_blocks();
+    }
 
+    [[nodiscard]]
+    std::pair<neighbour_const_iterator, neighbour_const_iterator> prev_blocks() const {
+        return _bb.next_blocks();
+    }
 
-    [[nodiscard]] const basic_block_t::label_vec_t& next_blocks_set() const {
+    [[nodiscard]]
+    const basic_block_t::label_vec_t& next_blocks_set() const {
         return _bb.prev_blocks_set();
     }
 
-    [[nodiscard]] const basic_block_t::label_vec_t& prev_blocks_set() const {
+    [[nodiscard]]
+    const basic_block_t::label_vec_t& prev_blocks_set() const {
         return _bb.next_blocks_set();
     }
 };
@@ -202,8 +248,8 @@ class cfg_t final {
     basic_block_map_t m_blocks;
 
     using visited_t = std::set<label_t>;
-  public:
 
+  public:
     cfg_t() {
         m_blocks.emplace(entry_label(), entry_label());
         m_blocks.emplace(exit_label(), exit_label());
@@ -215,20 +261,29 @@ class cfg_t final {
 
     ~cfg_t() = default;
 
-    [[nodiscard]] label_t exit_label() const { return label_t::exit; }
+    [[nodiscard]]
+    label_t exit_label() const {
+        return label_t::exit;
+    }
 
     // --- Begin ikos fixpoint API
 
-    [[nodiscard]] label_t entry_label() const { return label_t::entry; }
+    [[nodiscard]]
+    label_t entry_label() const {
+        return label_t::entry;
+    }
 
-    [[nodiscard]] neighbour_const_range next_nodes(const label_t& _label) const {
+    [[nodiscard]]
+    neighbour_const_range next_nodes(const label_t& _label) const {
         return boost::make_iterator_range(get_node(_label).next_blocks());
     }
-    [[nodiscard]] neighbour_const_reverse_range next_nodes_reversed(const label_t& _label) const {
+    [[nodiscard]]
+    neighbour_const_reverse_range next_nodes_reversed(const label_t& _label) const {
         return boost::make_iterator_range(get_node(_label).next_blocks_reversed());
     }
 
-    [[nodiscard]] neighbour_const_range prev_nodes(const label_t& _label) const {
+    [[nodiscard]]
+    neighbour_const_range prev_nodes(const label_t& _label) const {
         return boost::make_iterator_range(get_node(_label).prev_blocks());
     }
 
@@ -240,7 +295,8 @@ class cfg_t final {
         return it->second;
     }
 
-    [[nodiscard]] const basic_block_t& get_node(const label_t& _label) const {
+    [[nodiscard]]
+    const basic_block_t& get_node(const label_t& _label) const {
         auto it = m_blocks.find(_label);
         if (it == m_blocks.end()) {
             CRAB_ERROR("Basic block ", _label, " not found in the CFG: ", __LINE__);
@@ -252,19 +308,22 @@ class cfg_t final {
 
     basic_block_t& insert(const label_t& _label) {
         auto it = m_blocks.find(_label);
-        if (it != m_blocks.end())
+        if (it != m_blocks.end()) {
             return it->second;
+        }
 
         m_blocks.emplace(_label, _label);
         return get_node(_label);
     }
 
     void remove(const label_t& _label) {
-        if (_label == entry_label())
+        if (_label == entry_label()) {
             CRAB_ERROR("Cannot remove entry block");
+        }
 
-        if (_label == exit_label())
+        if (_label == exit_label()) {
             CRAB_ERROR("Cannot remove exit block");
+        }
 
         std::vector<std::pair<basic_block_t*, basic_block_t*>> dead_edges;
         auto& bb = get_node(_label);
@@ -294,9 +353,15 @@ class cfg_t final {
     //! return an end iterator of basic_block_t's
     iterator end() { return m_blocks.end(); }
 
-    [[nodiscard]] const_iterator begin() const { return m_blocks.begin(); }
+    [[nodiscard]]
+    const_iterator begin() const {
+        return m_blocks.begin();
+    }
 
-    [[nodiscard]] const_iterator end() const { return m_blocks.end(); }
+    [[nodiscard]]
+    const_iterator end() const {
+        return m_blocks.end();
+    }
 
     //! return a begin iterator of label_t's
     label_iterator label_begin() { return boost::make_transform_iterator(m_blocks.begin(), get_label()); }
@@ -305,15 +370,20 @@ class cfg_t final {
     label_iterator label_end() { return boost::make_transform_iterator(m_blocks.end(), get_label()); }
 
     //! return a begin iterator of label_t's
-    [[nodiscard]] std::vector<label_t> labels() const {
+    [[nodiscard]]
+    std::vector<label_t> labels() const {
         std::vector<label_t> res;
         res.reserve(m_blocks.size());
-        for (const auto& p : m_blocks)
+        for (const auto& p : m_blocks) {
             res.push_back(p.first);
+        }
         return res;
     }
 
-    [[nodiscard]] size_t size() const { return static_cast<size_t>(std::distance(begin(), end())); }
+    [[nodiscard]]
+    size_t size() const {
+        return static_cast<size_t>(std::distance(begin(), end()));
+    }
 
     void simplify() {
         std::set<label_t> worklist(this->label_begin(), this->label_end());
@@ -350,7 +420,8 @@ class cfg_t final {
         }
     }
 
-    [[nodiscard]] std::vector<label_t> sorted_labels() const {
+    [[nodiscard]]
+    std::vector<label_t> sorted_labels() const {
         std::vector<label_t> labels = this->labels();
         std::sort(labels.begin(), labels.end());
         return labels;
@@ -358,12 +429,14 @@ class cfg_t final {
 
   private:
     // Helpers
-    [[nodiscard]] bool has_one_child(const label_t& b) const {
+    [[nodiscard]]
+    bool has_one_child(const label_t& b) const {
         auto rng = next_nodes(b);
         return (std::distance(rng.begin(), rng.end()) == 1);
     }
 
-    [[nodiscard]] bool has_one_parent(const label_t& b) const {
+    [[nodiscard]]
+    bool has_one_parent(const label_t& b) const {
         auto rng = prev_nodes(b);
         return (std::distance(rng.begin(), rng.end()) == 1);
     }
@@ -383,8 +456,9 @@ class cfg_t final {
     // mark reachable blocks from curId
     template <class AnyCfg>
     void mark_alive_blocks(label_t curId, AnyCfg& cfg_t, visited_t& visited) {
-        if (visited.count(curId) > 0)
+        if (visited.count(curId) > 0) {
             return;
+        }
         visited.insert(curId);
         for (const auto& child : cfg_t.next_nodes(curId)) {
             mark_alive_blocks(child, cfg_t, visited);
@@ -432,11 +506,20 @@ class cfg_rev_t final {
 
     cfg_rev_t(cfg_rev_t&& o) noexcept : _cfg(o._cfg), _rev_bbs(std::move(o._rev_bbs)) {}
 
-    [[nodiscard]] label_t entry_label() const { return _cfg.exit_label(); }
+    [[nodiscard]]
+    label_t entry_label() const {
+        return _cfg.exit_label();
+    }
 
-    [[nodiscard]] neighbour_const_range next_nodes(const label_t& bb) const { return _cfg.prev_nodes(bb); }
+    [[nodiscard]]
+    neighbour_const_range next_nodes(const label_t& bb) const {
+        return _cfg.prev_nodes(bb);
+    }
 
-    [[nodiscard]] neighbour_const_range prev_nodes(const label_t& bb) const { return _cfg.next_nodes(bb); }
+    [[nodiscard]]
+    neighbour_const_range prev_nodes(const label_t& bb) const {
+        return _cfg.next_nodes(bb);
+    }
 
     neighbour_const_range next_nodes(const label_t& bb) { return _cfg.prev_nodes(bb); }
 
@@ -444,15 +527,18 @@ class cfg_rev_t final {
 
     basic_block_rev_t& get_node(const label_t& _label) {
         auto it = _rev_bbs.find(_label);
-        if (it == _rev_bbs.end())
+        if (it == _rev_bbs.end()) {
             CRAB_ERROR("Basic block ", _label, " not found in the CFG: ", __LINE__);
+        }
         return it->second;
     }
 
-    [[nodiscard]] const basic_block_rev_t& get_node(const label_t& _label) const {
+    [[nodiscard]]
+    const basic_block_rev_t& get_node(const label_t& _label) const {
         auto it = _rev_bbs.find(_label);
-        if (it == _rev_bbs.end())
+        if (it == _rev_bbs.end()) {
             CRAB_ERROR("Basic block ", _label, " not found in the CFG: ", __LINE__);
+        }
         return it->second;
     }
 
@@ -460,15 +546,24 @@ class cfg_rev_t final {
 
     iterator end() { return _rev_bbs.end(); }
 
-    [[nodiscard]] const_iterator begin() const { return _rev_bbs.begin(); }
+    [[nodiscard]]
+    const_iterator begin() const {
+        return _rev_bbs.begin();
+    }
 
-    [[nodiscard]] const_iterator end() const { return _rev_bbs.end(); }
+    [[nodiscard]]
+    const_iterator end() const {
+        return _rev_bbs.end();
+    }
 
     label_iterator label_begin() { return _cfg.label_begin(); }
 
     label_iterator label_end() { return _cfg.label_end(); }
 
-    [[nodiscard]] label_t exit_label() const { return _cfg.entry_label(); }
+    [[nodiscard]]
+    label_t exit_label() const {
+        return _cfg.entry_label();
+    }
 };
 
 inline void cfg_t::remove_useless_blocks() {
@@ -477,8 +572,9 @@ inline void cfg_t::remove_useless_blocks() {
     visited_t useful, useless;
     mark_alive_blocks(rev_cfg.entry_label(), rev_cfg, useful);
 
-    if (!useful.count(exit_label()))
+    if (!useful.count(exit_label())) {
         CRAB_ERROR("Exit block must be reachable");
+    }
     for (auto const& label : labels()) {
         if (!useful.count(label)) {
             useless.insert(label);
@@ -500,8 +596,9 @@ inline void cfg_t::remove_unreachable_blocks() {
         }
     }
 
-    if (dead.count(exit_label()))
+    if (dead.count(exit_label())) {
         CRAB_ERROR("Exit block must be reachable");
+    }
     for (const auto& _label : dead) {
         remove(_label);
     }
@@ -516,7 +613,7 @@ std::vector<std::string> stats_headers();
 
 std::map<std::string, int> collect_stats(const cfg_t&);
 
-cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit=true);
+cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit = true);
 
 void explicate_assertions(cfg_t& cfg, const program_info& info);
 std::vector<Assert> get_assertions(Instruction ins, const program_info& info, std::optional<label_t> label);
diff --git a/src/crab/cfg_bgl.hpp b/src/crab/cfg_bgl.hpp
index a9bc04729..d1dcbe421 100644
--- a/src/crab/cfg_bgl.hpp
+++ b/src/crab/cfg_bgl.hpp
@@ -62,7 +62,8 @@ struct graph_traits<crab::cfg_t> {
     // iterator of pairs of label_t's
     using in_edge_iterator = transform_iterator<crab::graph::mk_in_edge<graph_t>, typename graph_t::neighbour_iterator>;
     // iterator of pairs of label_t's
-    using out_edge_iterator = transform_iterator<crab::graph::mk_out_edge<graph_t>, typename graph_t::neighbour_iterator>;
+    using out_edge_iterator =
+        transform_iterator<crab::graph::mk_out_edge<graph_t>, typename graph_t::neighbour_iterator>;
 }; // end class graph_traits
 
 // cfg_rev
diff --git a/src/crab/dsl_syntax.hpp b/src/crab/dsl_syntax.hpp
index b86893006..88599abc0 100644
--- a/src/crab/dsl_syntax.hpp
+++ b/src/crab/dsl_syntax.hpp
@@ -15,7 +15,9 @@ inline linear_expression_t operator*(variable_t x, const number_t& n) { return l
 
 inline linear_expression_t operator*(const number_t& n, const linear_expression_t& e) { return e.multiply(n); }
 
-inline linear_expression_t operator+(const linear_expression_t& e1, const linear_expression_t& e2) { return e1.plus(e2); }
+inline linear_expression_t operator+(const linear_expression_t& e1, const linear_expression_t& e2) {
+    return e1.plus(e2);
+}
 
 inline linear_expression_t operator+(const linear_expression_t& e, const number_t& n) { return e.plus(n); }
 
@@ -29,9 +31,7 @@ inline linear_expression_t operator-(const number_t& n, const linear_expression_
     return linear_expression_t(n).subtract(e);
 }
 
-inline linear_expression_t operator-(const linear_expression_t& e, const number_t& n) {
-    return e.subtract(n);
-}
+inline linear_expression_t operator-(const linear_expression_t& e, const number_t& n) { return e.subtract(n); }
 
 inline linear_constraint_t operator<=(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
@@ -57,29 +57,17 @@ inline linear_constraint_t operator<(const number_t& n, const linear_expression_
     return linear_constraint_t(n - e, constraint_kind_t::LESS_THAN_ZERO);
 }
 
-inline linear_constraint_t operator>=(const linear_expression_t& e1, const linear_expression_t& e2) {
-    return e2 <= e1;
-}
+inline linear_constraint_t operator>=(const linear_expression_t& e1, const linear_expression_t& e2) { return e2 <= e1; }
 
-inline linear_constraint_t operator>=(const linear_expression_t& e, const number_t& n) {
-    return n <= e;
-}
+inline linear_constraint_t operator>=(const linear_expression_t& e, const number_t& n) { return n <= e; }
 
-inline linear_constraint_t operator>=(const number_t& n, const linear_expression_t& e) {
-    return e <= n;
-}
+inline linear_constraint_t operator>=(const number_t& n, const linear_expression_t& e) { return e <= n; }
 
-inline linear_constraint_t operator>(const linear_expression_t& e1, const linear_expression_t& e2) {
-    return e2 < e1;
-}
+inline linear_constraint_t operator>(const linear_expression_t& e1, const linear_expression_t& e2) { return e2 < e1; }
 
-inline linear_constraint_t operator>(const linear_expression_t& e, const number_t& n) {
-    return n < e;
-}
+inline linear_constraint_t operator>(const linear_expression_t& e, const number_t& n) { return n < e; }
 
-inline linear_constraint_t operator>(const number_t& n, const linear_expression_t& e) {
-    return e < n;
-}
+inline linear_constraint_t operator>(const number_t& n, const linear_expression_t& e) { return e < n; }
 
 inline linear_constraint_t operator==(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::EQUALS_ZERO);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index b8b5df615..67f510629 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -103,15 +103,18 @@ static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDoma
 
     auto dst_interval = inv.eval_interval(dst_uvalue);
     std::optional<number_t> dst_n = dst_interval.singleton();
-    if (!dst_n || !dst_n.value().fits_cast_to_int64())
+    if (!dst_n || !dst_n.value().fits_cast_to_int64()) {
         return {};
+    }
 
     std::optional<number_t> src_n = src_interval.singleton();
-    if (!src_n || !src_n->fits_cast_to_int64())
+    if (!src_n || !src_n->fits_cast_to_int64()) {
         return {};
+    }
     uint64_t src_int_value = src_n.value().cast_to_uint64();
-    if (!is64)
+    if (!is64) {
         src_int_value = (uint32_t)src_int_value;
+    }
 
     bool result;
     switch (op) {
@@ -128,10 +131,11 @@ static std::vector<linear_constraint_t> assume_signed_64bit_eq(const NumAbsDomai
                                                                const linear_expression_t& right_svalue,
                                                                const linear_expression_t& right_uvalue) {
     using namespace crab::dsl_syntax;
-    if (right_interval <= crab::interval_t::nonnegative_int(true) && !right_interval.is_singleton())
+    if (right_interval <= crab::interval_t::nonnegative_int(true) && !right_interval.is_singleton()) {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue), eq(left_svalue, left_uvalue)};
-    else
+    } else {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue)};
+    }
 }
 
 static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomain& inv, variable_t left_svalue,
@@ -426,10 +430,11 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
 
     if (op == Condition::Op::EQ) {
         // Handle svalue == right.
-        if (is64)
+        if (is64) {
             return assume_signed_64bit_eq(inv, left_svalue, left_uvalue, right_interval, right_svalue, right_uvalue);
-        else
+        } else {
             return assume_signed_32bit_eq(inv, left_svalue, left_uvalue, right_interval);
+        }
     }
 
     const bool is_lt = op == Condition::Op::SLT || op == Condition::Op::SLE;
@@ -455,20 +460,22 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
     }
 
     if (is64) {
-        if (is_lt)
+        if (is_lt) {
             return assume_signed_64bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
-        else
+        } else {
             return assume_signed_64bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
+        }
     } else {
         // 32-bit compare.
-        if (is_lt)
+        if (is_lt) {
             return assume_signed_32bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
-        else
+        } else {
             return assume_signed_32bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
+        }
     }
     return {};
 }
@@ -485,22 +492,24 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     auto lllb = left_interval_low.truncate_to_uint(true).lb();
     if ((right_interval <= interval_t::nonnegative_int(true)) && (strict ? (lllb >= rub) : (lllb > rub))) {
         // The high interval is out of range.
-        if (auto lsubn = inv.eval_interval(left_svalue).ub().number())
+        if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
                     left_uvalue <= *lsubn, left_svalue >= 0};
-        else
+        } else {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
                     left_svalue >= 0};
+        }
     }
     auto lhlb = left_interval_high.truncate_to_uint(true).lb();
     if ((right_interval <= interval_t::unsigned_high(true)) && (strict ? (lhlb >= rub) : (lhlb > rub))) {
         // The high interval is out of range.
-        if (auto lsubn = inv.eval_interval(left_svalue).ub().number())
+        if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
                     left_uvalue <= *lsubn, left_svalue >= 0};
-        else
+        } else {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
                     left_svalue >= 0};
+        }
     }
     if (right_interval <= interval_t::signed_int(true)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
@@ -655,33 +664,37 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left unsigned interval is lower than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
-        if (is64)
+        if (is64) {
             return {strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
-        else
+        } else {
             return {linear_constraint_t::TRUE()};
+        }
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left unsigned interval is higher than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
-        if (is64)
+        if (is64) {
             return {strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue};
-        else
+        } else {
             return {linear_constraint_t::TRUE()};
+        }
     }
 
     if (is64) {
-        if (is_lt)
+        if (is_lt) {
             return assume_unsigned_64bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_low,
                                             left_interval_high, right_svalue, right_uvalue, right_interval);
-        else
+        } else {
             return assume_unsigned_64bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_low,
                                             left_interval_high, right_svalue, right_uvalue, right_interval);
+        }
     } else {
-        if (is_lt)
+        if (is_lt) {
             return assume_unsigned_32bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_low,
                                             left_interval_high, right_svalue, right_uvalue, right_interval);
-        else
+        } else {
             return assume_unsigned_32bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_low,
                                             left_interval_high, right_svalue, right_uvalue, right_interval);
+        }
     }
 }
 
@@ -723,10 +736,11 @@ static std::vector<linear_constraint_t> assume_cst_reg(const NumAbsDomain& inv,
         switch (op) {
         case Op::EQ: {
             crab::interval_t src_interval = inv.eval_interval(src_svalue);
-            if (!src_interval.is_singleton() && (src_interval <= crab::interval_t::nonnegative_int(true)))
+            if (!src_interval.is_singleton() && (src_interval <= crab::interval_t::nonnegative_int(true))) {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue), eq(dst_svalue, dst_uvalue)};
-            else
+            } else {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue)};
+            }
         }
         case Op::NE: return {neq(dst_svalue, src_svalue)};
         case Op::SGE: return {dst_svalue >= src_svalue};
@@ -828,10 +842,11 @@ void ebpf_domain_t::TypeDomain::add_extra_invariant(NumAbsDomain& dst,
 
     // If type is contained in exactly one of dst or src,
     // we need to remember the value.
-    if (dst_has_type && !src_has_type)
+    if (dst_has_type && !src_has_type) {
         extra_invariants.emplace(v, dst.eval_interval(v));
-    else if (!dst_has_type && src_has_type)
+    } else if (!dst_has_type && src_has_type) {
         extra_invariants.emplace(v, src.eval_interval(v));
+    }
 }
 
 void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const {
@@ -947,8 +962,9 @@ static const ebpf_domain_t constant_limits = ebpf_domain_t::calculate_constant_l
 
 ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, bool to_constants) {
     ebpf_domain_t res{m_inv.widen(other.m_inv), stack | other.stack};
-    if (to_constants)
+    if (to_constants) {
         return res & constant_limits;
+    }
     return res;
 }
 
@@ -1002,8 +1018,9 @@ void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
         for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
              kind = (data_kind_t)((int)kind + 1)) {
             variable_t src_var = variable_t::reg(kind, r);
-            if (!m_inv[src_var].is_top())
+            if (!m_inv[src_var].is_top()) {
                 assign(variable_t::stack_frame_var(kind, r, prefix), src_var);
+            }
         }
     }
 }
@@ -1013,10 +1030,11 @@ void ebpf_domain_t::restore_callee_saved_registers(const std::string& prefix) {
         for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
              kind = (data_kind_t)((int)kind + 1)) {
             variable_t src_var = variable_t::stack_frame_var(kind, r, prefix);
-            if (!m_inv[src_var].is_top())
+            if (!m_inv[src_var].is_top()) {
                 assign(variable_t::reg(kind, r), src_var);
-            else
+            } else {
                 havoc(variable_t::reg(kind, r));
+            }
             havoc(src_var);
         }
     }
@@ -1177,8 +1195,9 @@ static void assume(NumAbsDomain& inv, const linear_constraint_t& cst) { inv += c
 void ebpf_domain_t::assume(const linear_constraint_t& cst) { crab::assume(m_inv, cst); }
 
 void ebpf_domain_t::require(NumAbsDomain& inv, const linear_constraint_t& cst, const std::string& s) {
-    if (check_require)
+    if (check_require) {
         check_require(inv, cst, s + " (" + this->current_assertion + ")");
+    }
     if (thread_local_options.assume_assertions) {
         // avoid redundant errors
         crab::assume(inv, cst);
@@ -1249,15 +1268,17 @@ void ebpf_domain_t::TypeDomain::havoc_type(NumAbsDomain& inv, const Reg& r) { in
 
 int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const Reg& r) const {
     auto res = inv[reg_pack(r).type].singleton();
-    if (!res)
+    if (!res) {
         return T_UNINIT;
+    }
     return (int)*res;
 }
 
 int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, variable_t v) const {
     auto res = inv[v].singleton();
-    if (!res)
+    if (!res) {
         return T_UNINIT;
+    }
     return (int)*res;
 }
 
@@ -1266,15 +1287,17 @@ int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const number_t&
 // Check whether a given type value is within the range of a given type variable's value.
 bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const {
     crab::interval_t interval = inv[reg_pack(r).type];
-    if (interval.is_top())
+    if (interval.is_top()) {
         return true;
+    }
     return (interval.lb().number().value_or(INT_MIN) <= type) && (interval.ub().number().value_or(INT_MAX) >= type);
 }
 
 bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const {
     crab::interval_t interval = inv[v];
-    if (interval.is_top())
+    if (interval.is_top()) {
         return true;
+    }
     return (interval.lb().number().value_or(INT_MIN) <= type) && (interval.ub().number().value_or(INT_MAX) >= type);
 }
 
@@ -1286,8 +1309,9 @@ NumAbsDomain ebpf_domain_t::TypeDomain::join_over_types(
     const NumAbsDomain& inv, const Reg& reg,
     const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const {
     crab::interval_t types = inv.eval_interval(reg_pack(reg).type);
-    if (types.is_bottom())
+    if (types.is_bottom()) {
         return NumAbsDomain::bottom();
+    }
     if (types.is_top()) {
         NumAbsDomain res(inv);
         transition(res, static_cast<type_encoding_t>(T_UNINIT));
@@ -1425,11 +1449,12 @@ void ebpf_domain_t::check_access_packet(NumAbsDomain& inv, const linear_expressi
                                         std::optional<variable_t> packet_size) {
     using namespace crab::dsl_syntax;
     require(inv, lb >= variable_t::meta_offset(), "Lower bound must be at least meta_offset");
-    if (packet_size)
+    if (packet_size) {
         require(inv, ub <= *packet_size, "Upper bound must be at most packet_size");
-    else
+    } else {
         require(inv, ub <= MAX_PACKET_SIZE,
                 std::string{"Upper bound must be at most "} + std::to_string(MAX_PACKET_SIZE));
+    }
 }
 
 void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
@@ -1449,14 +1474,17 @@ void ebpf_domain_t::operator()(const Assume& s) {
             m_inv = type_inv.join_over_types(m_inv, cond.left, [&](NumAbsDomain& inv, type_encoding_t type) {
                 if (type == T_NUM) {
                     for (const linear_constraint_t& cst :
-                         assume_cst_reg(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, src.svalue, src.uvalue))
+                         assume_cst_reg(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, src.svalue, src.uvalue)) {
                         inv += cst;
+                    }
                 } else {
                     // Either pointers to a singleton region,
                     // or an equality comparison on map descriptors/pointers to non-singleton locations
-                    if (auto dst_offset = get_type_offset_variable(cond.left, type))
-                        if (auto src_offset = get_type_offset_variable(src_reg, type))
+                    if (auto dst_offset = get_type_offset_variable(cond.left, type)) {
+                        if (auto src_offset = get_type_offset_variable(src_reg, type)) {
                             inv += assume_cst_offsets_reg(cond.op, cond.is64, dst_offset.value(), src_offset.value());
+                        }
+                    }
                 }
             });
         } else {
@@ -1467,8 +1495,9 @@ void ebpf_domain_t::operator()(const Assume& s) {
         }
     } else {
         int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
-        for (const linear_constraint_t& cst : assume_cst_imm(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, imm))
+        for (const linear_constraint_t& cst : assume_cst_imm(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, imm)) {
             assume(cst);
+        }
     }
 }
 
@@ -1571,8 +1600,9 @@ void ebpf_domain_t::operator()(const Un& stmt) {
 void ebpf_domain_t::operator()(const Exit& a) {
     // Clean up any state for the current stack frame.
     std::string prefix = a.stack_frame_prefix;
-    if (prefix.empty())
+    if (prefix.empty()) {
         return;
+    }
     restore_callee_saved_registers(prefix);
 }
 
@@ -1600,15 +1630,17 @@ void ebpf_domain_t::operator()(const Comparable& s) {
 }
 
 void ebpf_domain_t::operator()(const Addable& s) {
-    if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num)))
+    if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num))) {
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be added to pointers");
+    }
 }
 
 void ebpf_domain_t::operator()(const ValidDivisor& s) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
-    if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg)))
+    if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg))) {
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be used as divisors");
+    }
     if (!thread_local_options.allow_division_by_zero) {
         auto v = s.is_signed ? reg.svalue : reg.uvalue;
         require(m_inv, v != 0, "Possible division by zero");
@@ -1616,13 +1648,15 @@ void ebpf_domain_t::operator()(const ValidDivisor& s) {
 }
 
 void ebpf_domain_t::operator()(const ValidStore& s) {
-    if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val)))
+    if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val))) {
         require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be stored to externally-visible regions");
+    }
 }
 
 void ebpf_domain_t::operator()(const TypeConstraint& s) {
-    if (!type_inv.is_in_group(m_inv, s.reg, s.types))
+    if (!type_inv.is_in_group(m_inv, s.reg, s.types)) {
         require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
+    }
 }
 
 void ebpf_domain_t::operator()(const FuncConstraint& s) {
@@ -1660,8 +1694,9 @@ bool ebpf_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, i
     const crab::interval_t& map_fd_interval = m_inv[reg_pack(map_fd_reg).map_fd];
     auto lb = map_fd_interval.lb().number();
     auto ub = map_fd_interval.ub().number();
-    if (!lb || !lb->fits_sint32() || !ub || !ub->fits_sint32())
+    if (!lb || !lb->fits_sint32() || !ub || !ub->fits_sint32()) {
         return false;
+    }
     *start_fd = (int32_t)lb.value();
     *end_fd = (int32_t)ub.value();
 
@@ -1673,18 +1708,21 @@ bool ebpf_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, i
 // All maps in the range must have the same type for us to use it.
 std::optional<uint32_t> ebpf_domain_t::get_map_type(const Reg& map_fd_reg) const {
     int32_t start_fd, end_fd;
-    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
         return std::optional<uint32_t>();
+    }
 
     std::optional<uint32_t> type;
     for (int32_t map_fd = start_fd; map_fd <= end_fd; map_fd++) {
         EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd);
-        if (map == nullptr)
+        if (map == nullptr) {
             return std::optional<uint32_t>();
-        if (!type.has_value())
+        }
+        if (!type.has_value()) {
             type = map->type;
-        else if (map->type != *type)
+        } else if (map->type != *type) {
             return std::optional<uint32_t>();
+        }
     }
     return type;
 }
@@ -1692,18 +1730,21 @@ std::optional<uint32_t> ebpf_domain_t::get_map_type(const Reg& map_fd_reg) const
 // All maps in the range must have the same inner map fd for us to use it.
 std::optional<uint32_t> ebpf_domain_t::get_map_inner_map_fd(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
-    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
         return {};
+    }
 
     std::optional<uint32_t> inner_map_fd;
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
         EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd);
-        if (map == nullptr)
+        if (map == nullptr) {
             return {};
-        if (!inner_map_fd.has_value())
+        }
+        if (!inner_map_fd.has_value()) {
             inner_map_fd = map->inner_map_fd;
-        else if (map->type != *inner_map_fd)
+        } else if (map->type != *inner_map_fd) {
             return {};
+        }
     }
     return inner_map_fd;
 }
@@ -1711,15 +1752,17 @@ std::optional<uint32_t> ebpf_domain_t::get_map_inner_map_fd(const Reg& map_fd_re
 // We can deal with a range of key sizes.
 crab::interval_t ebpf_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
-    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
         return crab::interval_t::top();
+    }
 
     crab::interval_t result = crab::interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
             result = result | crab::interval_t(number_t(map->key_size));
-        else
+        } else {
             return crab::interval_t::top();
+        }
     }
     return result;
 }
@@ -1727,15 +1770,17 @@ crab::interval_t ebpf_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
 // We can deal with a range of value sizes.
 crab::interval_t ebpf_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
-    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
         return crab::interval_t::top();
+    }
 
     crab::interval_t result = crab::interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
             result = result | crab::interval_t(number_t(map->value_size));
-        else
+        } else {
             return crab::interval_t::top();
+        }
     }
     return result;
 }
@@ -1743,15 +1788,17 @@ crab::interval_t ebpf_domain_t::get_map_value_size(const Reg& map_fd_reg) const
 // We can deal with a range of max_entries values.
 crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
-    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
         return crab::interval_t::top();
+    }
 
     crab::interval_t result = crab::interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
             result = result | crab::interval_t(number_t(map->max_entries));
-        else
+        } else {
             return crab::interval_t::top();
+        }
     }
     return result;
 }
@@ -1813,10 +1860,11 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
                         variable_t key_value =
                             variable_t::cell_var(data_kind_t::svalues, (uint64_t)offset.value(), sizeof(uint32_t));
 
-                        if (auto max_entries = get_map_max_entries(s.map_fd_reg).lb().number())
+                        if (auto max_entries = get_map_max_entries(s.map_fd_reg).lb().number()) {
                             require(inv, key_value < *max_entries, "Array index overflow");
-                        else
+                        } else {
                             require(inv, linear_constraint_t::FALSE(), "Max entries is not finite");
+                        }
                         require(inv, key_value >= 0, "Array index underflow");
                     }
                 }
@@ -1914,8 +1962,9 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                                          ? lb + std::get<Imm>(s.width).v
                                          : lb + reg_pack(std::get<Reg>(s.width)).svalue;
             check_access_shared(inv, lb, ub, reg.shared_region_size);
-            if (!is_comparison_check && !s.or_null)
+            if (!is_comparison_check && !s.or_null) {
                 require(inv, reg.svalue > 0, "Possible null access");
+            }
             // Shared memory is zero-initialized when created so is safe to read and write.
             break;
         }
@@ -1952,8 +2001,9 @@ void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, cons
                                   const Reg& src_reg) {
     type_inv.assign_type(inv, target_reg, stack.load(inv, data_kind_t::types, addr, width));
     using namespace crab::dsl_syntax;
-    if (inv.entail(width <= reg_pack(src_reg).stack_numeric_size))
+    if (inv.entail(width <= reg_pack(src_reg).stack_numeric_size)) {
         type_inv.assign_type(inv, target_reg, T_NUM);
+    }
 
     const reg_pack_t& target = reg_pack(target_reg);
     if (width == 1 || width == 2 || width == 4 || width == 8) {
@@ -1965,12 +2015,15 @@ void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, cons
         inv.assign(target.svalue, sresult);
         inv.assign(target.uvalue, uresult);
 
-        if (type_inv.has_type(inv, target.type, T_CTX))
+        if (type_inv.has_type(inv, target.type, T_CTX)) {
             inv.assign(target.ctx_offset, stack.load(inv, data_kind_t::ctx_offsets, addr, width));
-        if (type_inv.has_type(inv, target.type, T_MAP) || type_inv.has_type(inv, target.type, T_MAP_PROGRAMS))
+        }
+        if (type_inv.has_type(inv, target.type, T_MAP) || type_inv.has_type(inv, target.type, T_MAP_PROGRAMS)) {
             inv.assign(target.map_fd, stack.load(inv, data_kind_t::map_fds, addr, width));
-        if (type_inv.has_type(inv, target.type, T_PACKET))
+        }
+        if (type_inv.has_type(inv, target.type, T_PACKET)) {
             inv.assign(target.packet_offset, stack.load(inv, data_kind_t::packet_offsets, addr, width));
+        }
         if (type_inv.has_type(inv, target.type, T_SHARED)) {
             inv.assign(target.shared_offset, stack.load(inv, data_kind_t::shared_offsets, addr, width));
             inv.assign(target.shared_region_size, stack.load(inv, data_kind_t::shared_region_sizes, addr, width));
@@ -1979,15 +2032,17 @@ void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, cons
             inv.assign(target.stack_offset, stack.load(inv, data_kind_t::stack_offsets, addr, width));
             inv.assign(target.stack_numeric_size, stack.load(inv, data_kind_t::stack_numeric_sizes, addr, width));
         }
-    } else
+    } else {
         havoc_register(inv, target_reg);
+    }
 }
 
 void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr_vague,
                                 int width) {
     using namespace crab::dsl_syntax;
-    if (inv.is_bottom())
+    if (inv.is_bottom()) {
         return;
+    }
 
     const ebpf_context_descriptor_t* desc = global_program_info->type.context_descriptor;
 
@@ -2006,10 +2061,11 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
     bool may_touch_ptr = interval[desc->data] || interval[desc->meta] || interval[desc->end];
 
     if (!maybe_addr) {
-        if (may_touch_ptr)
+        if (may_touch_ptr) {
             type_inv.havoc_type(inv, target_reg);
-        else
+        } else {
             type_inv.assign_type(inv, target_reg, T_NUM);
+        }
         return;
     }
 
@@ -2021,19 +2077,23 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
     // at runtime are actually 64-bit memory pointers.
     int offset_width = desc->end - desc->data;
     if (addr == desc->data) {
-        if (width == offset_width)
+        if (width == offset_width) {
             inv.assign(target.packet_offset, 0);
+        }
     } else if (addr == desc->end) {
-        if (width == offset_width)
+        if (width == offset_width) {
             inv.assign(target.packet_offset, variable_t::packet_size());
+        }
     } else if (addr == desc->meta) {
-        if (width == offset_width)
+        if (width == offset_width) {
             inv.assign(target.packet_offset, variable_t::meta_offset());
+        }
     } else {
-        if (may_touch_ptr)
+        if (may_touch_ptr) {
             type_inv.havoc_type(inv, target_reg);
-        else
+        } else {
             type_inv.assign_type(inv, target_reg, T_NUM);
+        }
         return;
     }
     if (width == offset_width) {
@@ -2045,8 +2105,9 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
 
 void ebpf_domain_t::do_load_packet_or_shared(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr,
                                              int width) {
-    if (inv.is_bottom())
+    if (inv.is_bottom()) {
         return;
+    }
     const reg_pack_t& target = reg_pack(target_reg);
 
     type_inv.assign_type(inv, target_reg, T_NUM);
@@ -2178,8 +2239,9 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
     auto updated_lb = m_inv.eval_interval(addr).lb();
     auto updated_ub = m_inv.eval_interval(addr).ub() + width;
     for (variable_t type_variable : variable_t::get_type_variables()) {
-        if (!type_inv.has_type(inv, type_variable, T_STACK))
+        if (!type_inv.has_type(inv, type_variable, T_STACK)) {
             continue;
+        }
         variable_t stack_offset_variable = variable_t::kind_var(data_kind_t::stack_offsets, type_variable);
         variable_t stack_numeric_size_variable = variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
 
@@ -2194,8 +2256,9 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
 }
 
 void ebpf_domain_t::operator()(const Mem& b) {
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
     if (std::holds_alternative<Reg>(b.value)) {
         if (b.is_load) {
             do_load(b, std::get<Reg>(b.value));
@@ -2213,8 +2276,9 @@ void ebpf_domain_t::operator()(const Mem& b) {
 template <typename Type, typename SValue, typename UValue>
 void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue, UValue val_uvalue,
                                  const std::optional<reg_pack_t>& val_reg) {
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
     int width = b.access.width;
     number_t offset{b.access.offset};
     if (b.access.basereg.v == R10_STACK_POINTER) {
@@ -2235,8 +2299,7 @@ void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue,
 
 // Construct a Bin operation that does the main operation that a given Atomic operation does atomically.
 static Bin atomic_to_bin(const Atomic& a) {
-    Bin bin{
-        .dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = (a.access.width == sizeof(uint64_t)), .lddw = false};
+    Bin bin{.dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = (a.access.width == sizeof(uint64_t)), .lddw = false};
     switch (a.op) {
     case Atomic::Op::ADD: bin.op = Bin::Op::ADD; break;
     case Atomic::Op::OR: bin.op = Bin::Op::OR; break;
@@ -2250,8 +2313,9 @@ static Bin atomic_to_bin(const Atomic& a) {
 }
 
 void ebpf_domain_t::operator()(const Atomic& a) {
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
     if (!m_inv.entail(type_is_pointer(reg_pack(a.access.basereg))) ||
         !m_inv.entail(type_is_number(reg_pack(a.valreg)))) {
         return;
@@ -2259,10 +2323,11 @@ void ebpf_domain_t::operator()(const Atomic& a) {
     if (m_inv.entail(type_is_not_stack(reg_pack(a.access.basereg)))) {
         // Shared memory regions are volatile so we can just havoc
         // any register that will be updated.
-        if (a.op == Atomic::Op::CMPXCHG)
+        if (a.op == Atomic::Op::CMPXCHG) {
             havoc_register(m_inv, Reg{R0_RETURN_VALUE});
-        else if (a.fetch)
+        } else if (a.fetch) {
             havoc_register(m_inv, a.valreg);
+        }
         return;
     }
 
@@ -2300,8 +2365,9 @@ void ebpf_domain_t::operator()(const Atomic& a) {
 
 void ebpf_domain_t::operator()(const Call& call) {
     using namespace crab::dsl_syntax;
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
     std::optional<Reg> maybe_fd_reg{};
     for (ArgSingle param : call.singles) {
         switch (param.kind) {
@@ -2397,15 +2463,17 @@ void ebpf_domain_t::operator()(const Call& call) {
 
 void ebpf_domain_t::operator()(const CallLocal& call) {
     using namespace crab::dsl_syntax;
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
     save_callee_saved_registers(call.stack_frame_prefix);
 }
 
 void ebpf_domain_t::operator()(const Callx& callx) {
     using namespace crab::dsl_syntax;
-    if (m_inv.is_bottom())
+    if (m_inv.is_bottom()) {
         return;
+    }
 
     // Look up the helper function id.
     const reg_pack_t& reg = reg_pack(callx.func);
@@ -2458,13 +2526,15 @@ void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
 void ebpf_domain_t::recompute_stack_numeric_size(NumAbsDomain& inv, variable_t type_variable) {
     variable_t stack_numeric_size_variable = variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
 
-    if (!inv.eval_interval(stack_numeric_size_variable).is_top())
+    if (!inv.eval_interval(stack_numeric_size_variable).is_top()) {
         return;
+    }
 
     if (type_inv.has_type(inv, type_variable, T_STACK)) {
         int numeric_size = stack.min_all_num_size(inv, variable_t::kind_var(data_kind_t::stack_offsets, type_variable));
-        if (numeric_size > 0)
+        if (numeric_size > 0) {
             inv.assign(stack_numeric_size_variable, numeric_size);
+        }
     }
 }
 
@@ -2478,12 +2548,13 @@ void ebpf_domain_t::add(const Reg& reg, int imm, int finite_width) {
     add_overflow(dst.svalue, dst.uvalue, imm, finite_width);
     if (offset.has_value()) {
         add(offset.value(), imm);
-        if (imm > 0)
+        if (imm > 0) {
             // Since the start offset is increasing but
             // the end offset is not, the numeric size decreases.
             sub(dst.stack_numeric_size, imm);
-        else if (imm < 0)
+        } else if (imm < 0) {
             havoc(dst.stack_numeric_size);
+        }
         recompute_stack_numeric_size(m_inv, reg);
     }
 }
@@ -2685,13 +2756,15 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             havoc_offsets(bin.dst);
             break;
         case Bin::Op::ADD:
-            if (imm == 0)
+            if (imm == 0) {
                 return;
+            }
             add(bin.dst, (int)imm, finite_width);
             break;
         case Bin::Op::SUB:
-            if (imm == 0)
+            if (imm == 0) {
                 return;
+            }
             add(bin.dst, (int)-imm, finite_width);
             break;
         case Bin::Op::MUL:
@@ -2755,11 +2828,13 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                         if (dst_type == T_NUM && src_type != T_NUM) {
                             // num += ptr
                             type_inv.assign_type(inv, bin.dst, src_type);
-                            if (auto dst_offset = get_type_offset_variable(bin.dst, src_type))
+                            if (auto dst_offset = get_type_offset_variable(bin.dst, src_type)) {
                                 apply(inv, crab::arith_binop_t::ADD, dst_offset.value(), dst.svalue,
                                       get_type_offset_variable(src_reg, src_type).value());
-                            if (src_type == T_SHARED)
+                            }
+                            if (src_type == T_SHARED) {
                                 inv.assign(dst.shared_region_size, src.shared_region_size);
+                            }
                         } else if (dst_type != T_NUM && src_type == T_NUM) {
                             // ptr += num
                             type_inv.assign_type(inv, bin.dst, dst_type);
@@ -2772,9 +2847,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                                     if (m_inv.intersect(src.svalue < 0)) {
                                         inv -= dst.stack_numeric_size;
                                         recompute_stack_numeric_size(inv, dst.type);
-                                    } else
+                                    } else {
                                         apply_signed(inv, crab::arith_binop_t::SUB, dst.stack_numeric_size,
                                                      dst.stack_numeric_size, dst.stack_numeric_size, src.svalue, 0);
+                                    }
                                 }
                             }
                         } else if (dst_type == T_NUM && src_type == T_NUM) {
@@ -2839,9 +2915,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                             if (m_inv.intersect(src.svalue > 0)) {
                                 m_inv -= dst.stack_numeric_size;
                                 recompute_stack_numeric_size(m_inv, dst.type);
-                            } else
+                            } else {
                                 apply(m_inv, crab::arith_binop_t::ADD, dst.stack_numeric_size, dst.stack_numeric_size,
                                       src.svalue);
+                            }
                         }
                     }
                 }
@@ -2930,7 +3007,8 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::MOVSX16:
         case Bin::Op::MOVSX32:
             // Keep relational information if operation is a no-op.
-            if ((dst.svalue == src.svalue) && (m_inv.eval_interval(dst.svalue) <= interval_t::signed_int(_movsx_bits(bin.op)))) {
+            if ((dst.svalue == src.svalue) &&
+                (m_inv.eval_interval(dst.svalue) <= interval_t::signed_int(_movsx_bits(bin.op)))) {
                 return;
             }
             if (m_inv.entail(type_is_number(src_reg))) {
@@ -3082,8 +3160,9 @@ void ebpf_domain_t::initialize_loop_counter(const label_t label) {
 
 bound_t ebpf_domain_t::get_loop_count_upper_bound() {
     crab::bound_t ub{number_t{0}};
-    for (variable_t counter : variable_t::get_loop_counters())
+    for (variable_t counter : variable_t::get_loop_counters()) {
         ub = std::max(ub, m_inv[counter].ub());
+    }
     return ub;
 }
 
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index f9a92a2e2..d6f3aecc6 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -31,8 +31,10 @@ class ebpf_domain_t final {
     static ebpf_domain_t bottom();
     void set_to_top();
     void set_to_bottom();
-    [[nodiscard]] bool is_bottom() const;
-    [[nodiscard]] bool is_top() const;
+    [[nodiscard]]
+    bool is_bottom() const;
+    [[nodiscard]]
+    bool is_top() const;
     bool operator<=(const ebpf_domain_t& other);
     bool operator==(const ebpf_domain_t& other) const;
     void operator|=(ebpf_domain_t&& other);
@@ -85,6 +87,7 @@ class ebpf_domain_t final {
 
     void initialize_loop_counter(label_t label);
     static ebpf_domain_t calculate_constant_limits();
+
   private:
     // private generic domain functions
     void operator+=(const linear_constraint_t& cst);
@@ -155,17 +158,24 @@ class ebpf_domain_t final {
     void havoc_offsets(NumAbsDomain& inv, const Reg& reg);
 
     static std::optional<variable_t> get_type_offset_variable(const Reg& reg, int type);
-    [[nodiscard]] std::optional<variable_t> get_type_offset_variable(const Reg& reg, const NumAbsDomain& inv) const;
-    [[nodiscard]] std::optional<variable_t> get_type_offset_variable(const Reg& reg) const;
+    [[nodiscard]]
+    std::optional<variable_t> get_type_offset_variable(const Reg& reg, const NumAbsDomain& inv) const;
+    [[nodiscard]]
+    std::optional<variable_t> get_type_offset_variable(const Reg& reg) const;
 
     void scratch_caller_saved_registers();
     void save_callee_saved_registers(const std::string& prefix);
     void restore_callee_saved_registers(const std::string& prefix);
-    [[nodiscard]] std::optional<uint32_t> get_map_type(const Reg& map_fd_reg) const;
-    [[nodiscard]] std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
-    [[nodiscard]] crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
-    [[nodiscard]] crab::interval_t get_map_value_size(const Reg& map_fd_reg) const;
-    [[nodiscard]] crab::interval_t get_map_max_entries(const Reg& map_fd_reg) const;
+    [[nodiscard]]
+    std::optional<uint32_t> get_map_type(const Reg& map_fd_reg) const;
+    [[nodiscard]]
+    std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
+    [[nodiscard]]
+    crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
+    [[nodiscard]]
+    crab::interval_t get_map_value_size(const Reg& map_fd_reg) const;
+    [[nodiscard]]
+    crab::interval_t get_map_max_entries(const Reg& map_fd_reg) const;
     void forget_packet_pointers();
     void havoc_register(NumAbsDomain& inv, const Reg& reg);
     void do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null);
@@ -229,30 +239,39 @@ class ebpf_domain_t final {
 
         void havoc_type(NumAbsDomain& inv, const Reg& r);
 
-        [[nodiscard]] int get_type(const NumAbsDomain& inv, variable_t v) const;
-        [[nodiscard]] int get_type(const NumAbsDomain& inv, const Reg& r) const;
-        [[nodiscard]] int get_type(const NumAbsDomain& inv, const number_t& t) const;
-
-        [[nodiscard]] bool has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const;
-        [[nodiscard]] bool has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const;
-        [[nodiscard]] bool has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const;
-
-        [[nodiscard]] bool same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const;
-        [[nodiscard]] bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a,
-                                        const linear_constraint_t& b) const;
-
-        [[nodiscard]] NumAbsDomain
-        join_over_types(const NumAbsDomain& inv, const Reg& reg,
-                        const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
-        [[nodiscard]] NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
-                                                   const std::function<void(NumAbsDomain&)>& if_true,
-                                                   const std::function<void(NumAbsDomain&)>& if_false) const;
+        [[nodiscard]]
+        int get_type(const NumAbsDomain& inv, variable_t v) const;
+        [[nodiscard]]
+        int get_type(const NumAbsDomain& inv, const Reg& r) const;
+        [[nodiscard]]
+        int get_type(const NumAbsDomain& inv, const number_t& t) const;
+
+        [[nodiscard]]
+        bool has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const;
+        [[nodiscard]]
+        bool has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const;
+        [[nodiscard]]
+        bool has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const;
+
+        [[nodiscard]]
+        bool same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const;
+        [[nodiscard]]
+        bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a, const linear_constraint_t& b) const;
+
+        [[nodiscard]]
+        NumAbsDomain join_over_types(const NumAbsDomain& inv, const Reg& reg,
+                                     const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
+        [[nodiscard]]
+        NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
+                                     const std::function<void(NumAbsDomain&)>& if_true,
+                                     const std::function<void(NumAbsDomain&)>& if_false) const;
         void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const;
         void add_extra_invariant(NumAbsDomain& dst, std::map<crab::variable_t, crab::interval_t>& extra_invariants,
                                  variable_t type_variable, type_encoding_t type, crab::data_kind_t kind,
                                  const NumAbsDomain& other) const;
 
-        [[nodiscard]] bool is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const;
+        [[nodiscard]]
+        bool is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const;
     };
 
     TypeDomain type_inv;
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index d08f515d3..726a01ce0 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -30,15 +30,19 @@ class member_component_visitor final {
             _found = (c->head() == _node);
             if (!_found) {
                 for (auto& component : *c) {
-                    if (_found)
+                    if (_found) {
                         break;
+                    }
                     std::visit(*this, *component);
                 }
             }
         }
     }
 
-    [[nodiscard]] bool is_member() const { return _found; }
+    [[nodiscard]]
+    bool is_member() const {
+        return _found;
+    }
 };
 
 class interleaved_fwd_fixpoint_iterator_t final {
@@ -67,8 +71,8 @@ class interleaved_fwd_fixpoint_iterator_t final {
         _post[label] = std::move(pre);
     }
 
-    [[nodiscard]] static ebpf_domain_t extrapolate(ebpf_domain_t before, const ebpf_domain_t& after,
-                                                   unsigned int iteration) {
+    [[nodiscard]]
+    static ebpf_domain_t extrapolate(ebpf_domain_t before, const ebpf_domain_t& after, unsigned int iteration) {
         /// number of iterations until triggering widening
         constexpr auto _widening_delay = 2;
 
@@ -185,8 +189,9 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
         transform_to_post(head, invariant);
         for (auto& component : *cycle) {
             wto_component_t c = *component;
-            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head))
+            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head)) {
                 std::visit(*this, *component);
+            }
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
         if (new_pre <= invariant) {
@@ -205,16 +210,18 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
 
         for (auto& component : *cycle) {
             wto_component_t c = *component;
-            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head))
+            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head)) {
                 std::visit(*this, *component);
+            }
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
         if (invariant <= new_pre) {
             // No more refinement possible(pre == new_pre)
             break;
         } else {
-            if (iteration > _descending_iterations)
+            if (iteration > _descending_iterations) {
                 break;
+            }
             invariant = refine(invariant, new_pre, iteration);
             set_pre(head, invariant);
         }
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index 5aa333004..c121b93e9 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -39,9 +39,10 @@ interval_t interval_t::operator/(const interval_t& x) const {
             return ((l / x) | (u / x) | z_interval(number_t(0)));
         } else {
             // Neither the dividend nor the divisor contains 0
-            z_interval a = (_ub < number_t{0})
-                               ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
-                               : *this;
+            z_interval a =
+                (_ub < number_t{0})
+                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
+                    : *this;
             bound_t ll = a._lb / x._lb;
             bound_t lu = a._lb / x._ub;
             bound_t ul = a._ub / x._lb;
@@ -132,9 +133,10 @@ interval_t interval_t::UDiv(const interval_t& x) const {
             return (l.UDiv(x) | u.UDiv(x) | z_interval(number_t(0)));
         } else {
             // Neither the dividend nor the divisor contains 0
-            z_interval a = (_ub < number_t{0})
-                               ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
-                               : *this;
+            z_interval a =
+                (_ub < number_t{0})
+                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
+                    : *this;
             bound_t ll = a._lb.UDiv(x._lb);
             bound_t lu = a._lb.UDiv(x._ub);
             bound_t ul = a._ub.UDiv(x._lb);
@@ -224,7 +226,7 @@ interval_t interval_t::URem(const interval_t& x) const {
                 // Divisor is infinite. A "negative" dividend could result in anything except
                 // a value between the upper bound and 0, so set to top.  A "positive" dividend
                 // could result in anything between 0 and the dividend - 1.
-                return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t {1})) | interval_t(number_t(0)));
+                return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t{1})) | interval_t(number_t(0)));
             } else if (_ub.is_finite() && (_ub.number()->cast_to_uint64() < x._lb.number()->cast_to_uint64())) {
                 // Dividend lower than divisor, so the dividend is the remainder.
                 return *this;
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 47878de00..5ca32cde6 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -22,13 +22,13 @@ class bound_t final {
     number_t _n;
 
   private:
-
     bound_t(bool is_infinite, const number_t& n) : _is_infinite(is_infinite), _n(n) {
         if (is_infinite) {
-            if (n > 0)
+            if (n > 0) {
                 _n = 1;
-            else
+            } else {
                 _n = -1;
+            }
         }
     }
 
@@ -37,13 +37,17 @@ class bound_t final {
 
     static bound_t min(const bound_t& x, const bound_t& y, const bound_t& z) { return min(x, min(y, z)); }
 
-    static bound_t min(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) { return min(x, min(t, y, z)); }
+    static bound_t min(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) {
+        return min(x, min(t, y, z));
+    }
 
     static bound_t max(const bound_t& x, const bound_t& y) { return (x.operator<=(y) ? y : x); }
 
     static bound_t max(const bound_t& x, const bound_t& y, const bound_t& z) { return max(x, max(y, z)); }
 
-    static bound_t max(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) { return max(x, max(t, y, z)); }
+    static bound_t max(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) {
+        return max(x, max(t, y, z));
+    }
 
     static bound_t plus_infinity() { return bound_t(true, 1); }
 
@@ -74,13 +78,25 @@ class bound_t final {
         return *this;
     }
 
-    [[nodiscard]] bool is_infinite() const { return _is_infinite; }
+    [[nodiscard]]
+    bool is_infinite() const {
+        return _is_infinite;
+    }
 
-    [[nodiscard]] bool is_finite() const { return !_is_infinite; }
+    [[nodiscard]]
+    bool is_finite() const {
+        return !_is_infinite;
+    }
 
-    [[nodiscard]] bool is_plus_infinity() const { return (is_infinite() && _n > 0); }
+    [[nodiscard]]
+    bool is_plus_infinity() const {
+        return (is_infinite() && _n > 0);
+    }
 
-    [[nodiscard]] bool is_minus_infinity() const { return (is_infinite() && _n < 0); }
+    [[nodiscard]]
+    bool is_minus_infinity() const {
+        return (is_infinite() && _n < 0);
+    }
 
     bound_t operator-() const { return bound_t(_is_infinite, -_n); }
 
@@ -105,12 +121,13 @@ class bound_t final {
     bound_t& operator-=(const bound_t& x) { return operator=(operator-(x)); }
 
     bound_t operator*(const bound_t& x) const {
-        if (x._n == 0)
+        if (x._n == 0) {
             return x;
-        else if (_n == 0)
+        } else if (_n == 0) {
             return *this;
-        else
+        } else {
             return bound_t(_is_infinite || x._is_infinite, _n * x._n);
+        }
     }
 
     bound_t& operator*=(const bound_t& x) { return operator=(operator*(x)); }
@@ -133,7 +150,8 @@ class bound_t final {
         }
     }
 
-    [[nodiscard]] bound_t UDiv(const bound_t& x) const {
+    [[nodiscard]]
+    bound_t UDiv(const bound_t& x) const {
         if (x._n == 0) {
             CRAB_ERROR("Bound: division by zero");
         } else if (is_finite() && x.is_finite()) {
@@ -147,7 +165,8 @@ class bound_t final {
         }
     }
 
-    [[nodiscard]] bound_t UMod(const bound_t& x) const {
+    [[nodiscard]]
+    bound_t UMod(const bound_t& x) const {
         if (x._n == 0) {
             CRAB_ERROR("Bound: modulo zero");
         } else if (is_finite() && x.is_finite()) {
@@ -195,7 +214,8 @@ class bound_t final {
         return _n >= x._n;
     }
 
-    [[nodiscard]] bound_t abs() const {
+    [[nodiscard]]
+    bound_t abs() const {
         if (operator>=(number_t{0})) {
             return *this;
         } else {
@@ -203,7 +223,8 @@ class bound_t final {
         }
     }
 
-    [[nodiscard]] std::optional<number_t> number() const {
+    [[nodiscard]]
+    std::optional<number_t> number() const {
         if (is_infinite()) {
             return {};
         } else {
@@ -236,7 +257,10 @@ class interval_t final {
 
     static interval_t bottom() { return interval_t(); }
 
-    [[nodiscard]] std::optional<number_t> finite_size() const { return (_ub - _lb).number(); }
+    [[nodiscard]]
+    std::optional<number_t> finite_size() const {
+        return (_ub - _lb).number();
+    }
 
   private:
     interval_t() : _lb(number_t{0}), _ub(-1) {}
@@ -248,13 +272,11 @@ class interval_t final {
     static number_t min(const number_t& x, const number_t& y) { return x.operator<(y) ? x : y; }
 
   public:
-    interval_t(const bound_t& lb, const bound_t& ub) : _lb(lb > ub ? bound_t{number_t{0}}  : lb),
-                                                       _ub(lb > ub ? bound_t{-1} : ub) {
-    }
+    interval_t(const bound_t& lb, const bound_t& ub)
+        : _lb(lb > ub ? bound_t{number_t{0}} : lb), _ub(lb > ub ? bound_t{-1} : ub) {}
 
-    explicit interval_t(const bound_t& b) : _lb(b.is_infinite() ? bound_t{number_t{0}}  : b),
-                                            _ub(b.is_infinite() ? bound_t{-1} : b) {
-    }
+    explicit interval_t(const bound_t& b)
+        : _lb(b.is_infinite() ? bound_t{number_t{0}} : b), _ub(b.is_infinite() ? bound_t{-1} : b) {}
 
     explicit interval_t(const number_t& n) : _lb(n), _ub(n) {}
 
@@ -262,13 +284,25 @@ class interval_t final {
 
     interval_t& operator=(const interval_t& i) = default;
 
-    [[nodiscard]] bound_t lb() const { return _lb; }
+    [[nodiscard]]
+    bound_t lb() const {
+        return _lb;
+    }
 
-    [[nodiscard]] bound_t ub() const { return _ub; }
+    [[nodiscard]]
+    bound_t ub() const {
+        return _ub;
+    }
 
-    [[nodiscard]] bool is_bottom() const { return (_lb > _ub); }
+    [[nodiscard]]
+    bool is_bottom() const {
+        return (_lb > _ub);
+    }
 
-    [[nodiscard]] bool is_top() const { return (_lb.is_infinite() && _ub.is_infinite()); }
+    [[nodiscard]]
+    bool is_top() const {
+        return (_lb.is_infinite() && _ub.is_infinite());
+    }
 
     bool operator==(const interval_t& x) const {
         if (is_bottom()) {
@@ -308,7 +342,8 @@ class interval_t final {
         }
     }
 
-    [[nodiscard]] interval_t widen(const interval_t& x) const {
+    [[nodiscard]]
+    interval_t widen(const interval_t& x) const {
         if (is_bottom()) {
             return x;
         } else if (x.is_bottom()) {
@@ -332,7 +367,8 @@ class interval_t final {
         }
     }
 
-    [[nodiscard]] interval_t narrow(const interval_t& x) const {
+    [[nodiscard]]
+    interval_t narrow(const interval_t& x) const {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
@@ -387,9 +423,13 @@ class interval_t final {
 
     interval_t& operator/=(const interval_t& x) { return operator=(operator/(x)); }
 
-    [[nodiscard]] bool is_singleton() const { return _lb == _ub; }
+    [[nodiscard]]
+    bool is_singleton() const {
+        return _lb == _ub;
+    }
 
-    [[nodiscard]] std::optional<number_t> singleton() const {
+    [[nodiscard]]
+    std::optional<number_t> singleton() const {
         if (!is_bottom() && _lb == _ub) {
             return _lb.number();
         } else {
@@ -417,28 +457,39 @@ class interval_t final {
 
     // division and remainder operations
 
-    [[nodiscard]] interval_t SDiv(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t SDiv(const interval_t& x) const;
 
-    [[nodiscard]] interval_t UDiv(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t UDiv(const interval_t& x) const;
 
-    [[nodiscard]] interval_t SRem(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t SRem(const interval_t& x) const;
 
-    [[nodiscard]] interval_t URem(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t URem(const interval_t& x) const;
 
     // bitwise operations
-    [[nodiscard]] interval_t And(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t And(const interval_t& x) const;
 
-    [[nodiscard]] interval_t Or(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t Or(const interval_t& x) const;
 
-    [[nodiscard]] interval_t Xor(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t Xor(const interval_t& x) const;
 
-    [[nodiscard]] interval_t Shl(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t Shl(const interval_t& x) const;
 
-    [[nodiscard]] interval_t LShr(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t LShr(const interval_t& x) const;
 
-    [[nodiscard]] interval_t AShr(const interval_t& x) const;
+    [[nodiscard]]
+    interval_t AShr(const interval_t& x) const;
 
-    [[nodiscard]] interval_t truncate_to_sint(bool is64) const {
+    [[nodiscard]]
+    interval_t truncate_to_sint(bool is64) const {
         interval_t new_interval = *this;
         if (!(*this <= interval_t::signed_int(is64))) {
             if (auto size = finite_size()) {
@@ -457,7 +508,8 @@ class interval_t final {
         return new_interval;
     }
 
-    [[nodiscard]] interval_t truncate_to_uint(bool is64) const {
+    [[nodiscard]]
+    interval_t truncate_to_uint(bool is64) const {
         interval_t new_interval = *this;
         if (!(*this <= interval_t::unsigned_int(is64))) {
             if (auto size = finite_size()) {
@@ -527,7 +579,8 @@ class interval_t final {
         }
     }
 
-    [[nodiscard]] std::string to_string() const;
+    [[nodiscard]]
+    std::string to_string() const;
 }; //  class interval
 
 namespace interval_operators {
@@ -548,7 +601,7 @@ inline interval_t operator-(const number_t& c, const interval_t& x) { return int
 
 inline interval_t operator-(const interval_t& x, const number_t& c) { return x - interval_t(c); }
 
-}
+} // namespace interval_operators
 
 inline interval_t trim_interval(const interval_t& i, const interval_t& j) {
     if (std::optional<number_t> c = j.singleton()) {
@@ -563,7 +616,6 @@ inline interval_t trim_interval(const interval_t& i, const interval_t& j) {
     return i;
 }
 
-
 } // namespace crab
 
 std::string to_string(const crab::interval_t& interval);
diff --git a/src/crab/linear_constraint.hpp b/src/crab/linear_constraint.hpp
index e6aa1a2fb..04e747147 100644
--- a/src/crab/linear_constraint.hpp
+++ b/src/crab/linear_constraint.hpp
@@ -8,12 +8,7 @@
 //    <linear expression> <operator> 0
 namespace crab {
 
-enum class constraint_kind_t {
-    EQUALS_ZERO,
-    LESS_THAN_OR_EQUALS_ZERO,
-    LESS_THAN_ZERO,
-    NOT_ZERO
-};
+enum class constraint_kind_t { EQUALS_ZERO, LESS_THAN_OR_EQUALS_ZERO, LESS_THAN_ZERO, NOT_ZERO };
 
 class linear_constraint_t final {
   private:
@@ -21,13 +16,21 @@ class linear_constraint_t final {
     constraint_kind_t _constraint_kind;
 
   public:
-    linear_constraint_t(linear_expression_t expression, constraint_kind_t constraint_kind) : _expression(std::move(expression)), _constraint_kind(constraint_kind) {}
+    linear_constraint_t(linear_expression_t expression, constraint_kind_t constraint_kind)
+        : _expression(std::move(expression)), _constraint_kind(constraint_kind) {}
 
-    [[nodiscard]] const linear_expression_t& expression() const { return _expression; }
-    [[nodiscard]] constraint_kind_t kind() const { return _constraint_kind; }
+    [[nodiscard]]
+    const linear_expression_t& expression() const {
+        return _expression;
+    }
+    [[nodiscard]]
+    constraint_kind_t kind() const {
+        return _constraint_kind;
+    }
 
     // Test whether the constraint is guaranteed to be true.
-    [[nodiscard]] bool is_tautology() const {
+    [[nodiscard]]
+    bool is_tautology() const {
         if (!_expression.is_constant()) {
             return false;
         }
@@ -42,7 +45,8 @@ class linear_constraint_t final {
     }
 
     // Test whether the constraint is guaranteed to be false.
-    [[nodiscard]] bool is_contradiction() const {
+    [[nodiscard]]
+    bool is_contradiction() const {
         if (!_expression.is_constant()) {
             return false;
         }
@@ -50,12 +54,11 @@ class linear_constraint_t final {
     }
 
     // Construct the logical NOT of this constraint.
-    [[nodiscard]] linear_constraint_t negate() const {
+    [[nodiscard]]
+    linear_constraint_t negate() const {
         switch (_constraint_kind) {
-        case constraint_kind_t::NOT_ZERO:
-            return linear_constraint_t(_expression, constraint_kind_t::EQUALS_ZERO);
-        case constraint_kind_t::EQUALS_ZERO:
-            return linear_constraint_t(_expression, constraint_kind_t::NOT_ZERO);
+        case constraint_kind_t::NOT_ZERO: return linear_constraint_t(_expression, constraint_kind_t::EQUALS_ZERO);
+        case constraint_kind_t::EQUALS_ZERO: return linear_constraint_t(_expression, constraint_kind_t::NOT_ZERO);
         case constraint_kind_t::LESS_THAN_ZERO:
             return linear_constraint_t(_expression.negate(), constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
         case constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO:
@@ -71,7 +74,6 @@ class linear_constraint_t final {
     static linear_constraint_t TRUE() {
         return linear_constraint_t{linear_expression_t(0), constraint_kind_t::EQUALS_ZERO};
     };
-
 };
 
 // Output a linear constraint to a stream.
@@ -98,4 +100,4 @@ inline std::ostream& operator<<(std::ostream& o, const linear_constraint_t& cons
     return o;
 }
 
-}
+} // namespace crab
diff --git a/src/crab/linear_expression.hpp b/src/crab/linear_expression.hpp
index 693761e4d..2846f8468 100644
--- a/src/crab/linear_expression.hpp
+++ b/src/crab/linear_expression.hpp
@@ -2,9 +2,8 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <map>
 #include "variable.hpp"
-
+#include <map>
 
 namespace crab {
 // A linear expression is of the form: Ax + By + Cz + ... + N.
@@ -22,7 +21,8 @@ class linear_expression_t final {
     variable_terms_t _variable_terms{};
 
     // Get the coefficient for a given variable, which is 0 if it has no term in the expression.
-    [[nodiscard]] number_t coefficient_of(const variable_t& variable) const {
+    [[nodiscard]]
+    number_t coefficient_of(const variable_t& variable) const {
         auto it = _variable_terms.find(variable);
         if (it == _variable_terms.end()) {
             return 0;
@@ -51,14 +51,24 @@ class linear_expression_t final {
     }
 
     // Allow a caller to access individual terms.
-    [[nodiscard]] const variable_terms_t& variable_terms() const { return _variable_terms; }
-    [[nodiscard]] const number_t& constant_term() const { return _constant_term; }
+    [[nodiscard]]
+    const variable_terms_t& variable_terms() const {
+        return _variable_terms;
+    }
+    [[nodiscard]]
+    const number_t& constant_term() const {
+        return _constant_term;
+    }
 
     // Test whether the expression is a constant.
-    [[nodiscard]] bool is_constant() const { return _variable_terms.empty(); }
+    [[nodiscard]]
+    bool is_constant() const {
+        return _variable_terms.empty();
+    }
 
     // Multiply a linear expression by a constant.
-    [[nodiscard]] linear_expression_t multiply(const number_t& constant) const {
+    [[nodiscard]]
+    linear_expression_t multiply(const number_t& constant) const {
         variable_terms_t variable_terms;
         for (const auto& [variable, coefficient] : _variable_terms) {
             variable_terms.emplace(variable, coefficient * constant);
@@ -67,19 +77,22 @@ class linear_expression_t final {
     }
 
     // Add a constant to a linear expression.
-    [[nodiscard]] linear_expression_t plus(const number_t& constant) const {
+    [[nodiscard]]
+    linear_expression_t plus(const number_t& constant) const {
         return linear_expression_t(variable_terms_t(_variable_terms), _constant_term + constant);
     }
 
     // Add a variable (with coefficient of 1) to a linear expression.
-    [[nodiscard]] linear_expression_t plus(const variable_t& variable) const {
+    [[nodiscard]]
+    linear_expression_t plus(const variable_t& variable) const {
         variable_terms_t variable_terms = _variable_terms;
         variable_terms[variable] = coefficient_of(variable) + 1;
         return linear_expression_t(variable_terms, _constant_term);
     }
 
     // Add two expressions.
-    [[nodiscard]] linear_expression_t plus(const linear_expression_t& expression) const {
+    [[nodiscard]]
+    linear_expression_t plus(const linear_expression_t& expression) const {
         variable_terms_t variable_terms = _variable_terms;
         for (const auto& [variable, coefficient] : expression.variable_terms()) {
             variable_terms[variable] = coefficient_of(variable) + coefficient;
@@ -88,22 +101,28 @@ class linear_expression_t final {
     }
 
     // Apply unary minus to an expression.
-    [[nodiscard]] linear_expression_t negate() const { return multiply(-1); }
+    [[nodiscard]]
+    linear_expression_t negate() const {
+        return multiply(-1);
+    }
 
     // Subtract a constant from a linear expression.
-    [[nodiscard]] linear_expression_t subtract(const number_t& constant) const {
+    [[nodiscard]]
+    linear_expression_t subtract(const number_t& constant) const {
         return linear_expression_t(variable_terms_t(_variable_terms), _constant_term - constant);
     }
 
     // Subtract a variable (with coefficient of 1) from a linear expression.
-    [[nodiscard]] linear_expression_t subtract(const variable_t& variable) const {
+    [[nodiscard]]
+    linear_expression_t subtract(const variable_t& variable) const {
         variable_terms_t variable_terms = _variable_terms;
         variable_terms[variable] = coefficient_of(variable) - 1;
         return linear_expression_t(variable_terms, _constant_term);
     }
 
     // Subtract one expression from another.
-    [[nodiscard]] linear_expression_t subtract(const linear_expression_t& expression) const {
+    [[nodiscard]]
+    linear_expression_t subtract(const linear_expression_t& expression) const {
         variable_terms_t variable_terms = _variable_terms;
         for (const auto& [variable, coefficient] : expression.variable_terms()) {
             variable_terms[variable] = coefficient_of(variable) - coefficient;
@@ -141,4 +160,4 @@ inline std::ostream& operator<<(std::ostream& o, const linear_expression_t& expr
     return o;
 }
 
-}
+} // namespace crab
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index af07d54d5..678aad92c 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -11,14 +11,16 @@ namespace crab::domains {
 
 static std::optional<SplitDBM::vert_id> try_at(const SplitDBM::vert_map_t& map, variable_t v) {
     auto it = map.find(v);
-    if (it == map.end())
+    if (it == map.end()) {
         return std::nullopt;
+    }
     return it->second;
 }
 
 SplitDBM::vert_id SplitDBM::get_vert(variable_t v) {
-    if (auto y = try_at(vert_map, v))
+    if (auto y = try_at(vert_map, v)) {
         return *y;
+    }
 
     vert_id vert(g.new_vertex());
     vert_map.emplace(v, vert);
@@ -240,8 +242,9 @@ bool SplitDBM::add_linear_leq(const linear_expression_t& exp) {
         CRAB_LOG("zones-split", std::cout << var << ">=" << n << "\n");
         vert_id vert = get_vert(var);
         if (auto w = g.lookup(vert, 0)) {
-            if (*w <= -n)
+            if (*w <= -n) {
                 continue;
+            }
         }
         g.set_edge(vert, -n, 0);
 
@@ -253,8 +256,9 @@ bool SplitDBM::add_linear_leq(const linear_expression_t& exp) {
         CRAB_LOG("zones-split", std::cout << var << "<=" << n << "\n");
         vert_id vert = get_vert(var);
         if (auto w = g.lookup(0, vert)) {
-            if (*w <= n)
+            if (*w <= n) {
                 continue;
+            }
         }
         g.set_edge(0, n, vert);
         if (!repair_potential(0, vert)) {
@@ -305,8 +309,9 @@ bool SplitDBM::add_univar_disequation(variable_t x, const number_t& n) {
                 }
                 // Update other bounds
                 for (auto e : g.e_preds(v)) {
-                    if (e.vert == 0)
+                    if (e.vert == 0) {
                         continue;
+                    }
                     g.update_edge(e.vert, e.val + lb_val, 0);
                     if (!repair_potential(e.vert, 0)) {
                         return false;
@@ -331,8 +336,9 @@ bool SplitDBM::add_univar_disequation(variable_t x, const number_t& n) {
                 }
                 // Update other bounds
                 for (auto e : g.e_succs(v)) {
-                    if (e.vert == 0)
+                    if (e.vert == 0) {
                         continue;
+                    }
                     g.update_edge(0, e.val + ub_val, e.vert);
                     if (!repair_potential(0, e.vert)) {
                         return false;
@@ -350,20 +356,24 @@ bool SplitDBM::operator<=(const SplitDBM& o) const {
     ScopedCrabStats __st__("SplitDBM.leq");
 
     // cover all trivial cases to avoid allocating a dbm matrix
-    if (o.is_top())
+    if (o.is_top()) {
         return true;
-    if (is_top())
+    }
+    if (is_top()) {
         return false;
+    }
 
-    if (vert_map.size() < o.vert_map.size())
+    if (vert_map.size() < o.vert_map.size()) {
         return false;
+    }
 
     // Set up a mapping from o to this.
     std::vector<unsigned int> vert_renaming(o.g.size(), -1);
     vert_renaming[0] = 0;
     for (auto [v, n] : o.vert_map) {
-        if (o.g.succs(n).size() == 0 && o.g.preds(n).size() == 0)
+        if (o.g.succs(n).size() == 0 && o.g.preds(n).size() == 0) {
             continue;
+        }
 
         // We can't have this <= o if we're missing some vertex.
         if (auto y = try_at(vert_map, v)) {
@@ -375,8 +385,9 @@ bool SplitDBM::operator<=(const SplitDBM& o) const {
 
     assert(g.size() > 0);
     for (vert_id ox : o.g.verts()) {
-        if (o.g.succs(ox).size() == 0)
+        if (o.g.succs(ox).size() == 0) {
             continue;
+        }
 
         assert(vert_renaming[ox] != (unsigned)-1);
         vert_id x = vert_renaming[ox];
@@ -387,14 +398,16 @@ bool SplitDBM::operator<=(const SplitDBM& o) const {
             Weight ow = edge.val;
 
             if (auto w = g.lookup(x, y)) {
-                if (*w <= ow)
+                if (*w <= ow) {
                     continue;
+                }
             }
 
             if (auto wx = g.lookup(x, 0)) {
                 if (auto wy = g.lookup(0, y)) {
-                    if (*wx + *wy <= ow)
+                    if (*wx + *wy <= ow) {
                         continue;
+                    }
                 }
             }
             return false;
@@ -407,10 +420,12 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
     CrabStats::count("SplitDBM.count.join");
     ScopedCrabStats __st__("SplitDBM.join");
 
-    if (o.is_top())
+    if (o.is_top()) {
         return o;
-    if (is_top())
+    }
+    if (is_top()) {
         return *this;
+    }
     CRAB_LOG("zones-split", std::cout << "Before join:\n"
                                       << "DBM 1\n"
                                       << *this << "\n"
@@ -485,9 +500,11 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
         for (vert_id d : gx_excl.succs(s)) {
             // Assumption: gx.mem(s, d) -> gx.edge_val(s, d) <= ranges[var(s)].ub() - ranges[var(d)].lb()
             // That is, if the relation exists, it's at least as strong as the bounds.
-            if (auto ws = gy.lookup(s, 0))
-                if (auto wd = gy.lookup(0, d))
+            if (auto ws = gy.lookup(s, 0)) {
+                if (auto wd = gy.lookup(0, d)) {
                     g_rx_iy.add_edge(s, *ws + *wd, d);
+                }
+            }
         }
     }
     // Similarly, should use a SubGraph view.
@@ -510,18 +527,22 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
     for (vert_id v : gx_excl.verts()) {
         if (auto wx = gx.lookup(0, v)) {
             if (auto wy = gy.lookup(0, v)) {
-                if (*wx < *wy)
+                if (*wx < *wy) {
                     ub_up.push_back(v);
-                if (*wy < *wx)
+                }
+                if (*wy < *wx) {
                     ub_down.push_back(v);
+                }
             }
         }
         if (auto wx = gx.lookup(v, 0)) {
             if (auto wy = gy.lookup(v, 0)) {
-                if (*wx < *wy)
+                if (*wx < *wy) {
                     lb_down.push_back(v);
-                if (*wy < *wx)
+                }
+                if (*wy < *wx) {
                     lb_up.push_back(v);
+                }
             }
         }
     }
@@ -530,8 +551,9 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
         Weight dx_s = gx.edge_val(s, 0);
         Weight dy_s = gy.edge_val(s, 0);
         for (vert_id d : ub_up) {
-            if (s == d)
+            if (s == d) {
                 continue;
+            }
 
             join_g.update_edge(s, std::max(dx_s + gx.edge_val(0, d), dy_s + gy.edge_val(0, d)), d);
         }
@@ -541,8 +563,9 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
         Weight dx_s = gx.edge_val(s, 0);
         Weight dy_s = gy.edge_val(s, 0);
         for (vert_id d : ub_down) {
-            if (s == d)
+            if (s == d) {
                 continue;
+            }
 
             join_g.update_edge(s, std::max(dx_s + gx.edge_val(0, d), dy_s + gy.edge_val(0, d)), d);
         }
@@ -552,8 +575,9 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
 
     // Now garbage collect any unused vertices
     for (vert_id v : join_g.verts()) {
-        if (v == 0)
+        if (v == 0) {
             continue;
+        }
         if (join_g.succs(v).size() == 0 && join_g.preds(v).size() == 0) {
             join_g.forget(v);
             if (out_revmap[v]) {
@@ -610,10 +634,7 @@ SplitDBM SplitDBM::widen(const SplitDBM& o) const {
     vert_set_t widen_unstable(unstable);
     graph_t widen_g(GrOps::widen(gx, gy, widen_unstable));
 
-    SplitDBM res(std::move(out_vmap),
-                 std::move(out_revmap),
-                 std::move(widen_g),
-                 std::move(widen_pot),
+    SplitDBM res(std::move(out_vmap), std::move(out_revmap), std::move(widen_g), std::move(widen_pot),
                  std::move(widen_unstable));
 
     CRAB_LOG("zones-split", std::cout << "Result widening:\n" << res << "\n");
@@ -624,10 +645,12 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
     CrabStats::count("SplitDBM.count.meet");
     ScopedCrabStats __st__("SplitDBM.meet");
 
-    if (is_top())
+    if (is_top()) {
         return o;
-    if (o.is_top())
+    }
+    if (o.is_top()) {
         return *this;
+    }
     CRAB_LOG("zones-split", std::cout << "Before meet:\n"
                                       << "DBM 1\n"
                                       << *this << "\n"
@@ -716,8 +739,9 @@ bool SplitDBM::add_constraint(const linear_constraint_t& cst) {
     CrabStats::count("SplitDBM.count.add_constraints");
     ScopedCrabStats __st__("SplitDBM.add_constraints");
 
-    if (cst.is_tautology())
+    if (cst.is_tautology()) {
         return true;
+    }
 
     // g.check_adjs();
 
@@ -756,7 +780,7 @@ bool SplitDBM::add_constraint(const linear_constraint_t& cst) {
         break;
     }
     case constraint_kind_t::NOT_ZERO: {
-         // XXX: similar precision as the interval domain
+        // XXX: similar precision as the interval domain
         const linear_expression_t& e = cst.expression();
         for (const auto& [variable, coefficient] : e.variable_terms()) {
             interval_t i = compute_residual(e, variable) / interval_t(coefficient);
@@ -872,14 +896,14 @@ SplitDBM SplitDBM::narrow(const SplitDBM& o) const {
     CrabStats::count("SplitDBM.count.narrowing");
     ScopedCrabStats __st__("SplitDBM.narrowing");
 
-    if (is_top())
+    if (is_top()) {
         return o;
+    }
     // FIXME: Implement properly
     // Narrowing as a no-op should be sound.
     return {*this};
 }
 
-
 class vert_set_wrap_t {
   public:
     explicit vert_set_wrap_t(const SplitDBM::vert_set_t& _vs) : vs(_vs) {}
@@ -894,8 +918,9 @@ void SplitDBM::normalize() {
 
     // dbm_canonical(_dbm);
     // Always maintained in normal form, except for widening
-    if (unstable.empty())
+    if (unstable.empty()) {
         return;
+    }
 
     edge_vector delta;
     // GrOps::close_after_widen(g, potential, vert_set_wrap_t(unstable), delta);
@@ -907,7 +932,6 @@ void SplitDBM::normalize() {
     unstable.clear();
 }
 
-
 void SplitDBM::set(variable_t x, const interval_t& intv) {
     CrabStats::count("SplitDBM.count.assign");
     ScopedCrabStats __st__("SplitDBM.assign");
@@ -1039,21 +1063,21 @@ void SplitDBM::forget(const variable_vector_t& variables) {
 static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Params::Weight& w, bool eq) {
     std::stringstream elem;
     if (eq) {
-        if (w.operator>(0))
+        if (w.operator>(0)) {
             elem << vd << "=" << vs << "+" << w;
-        else if (w.operator<(0))
+        } else if (w.operator<(0)) {
             elem << vs << "=" << vd << "+" << -w;
-        else
+        } else {
             elem << std::min(vs.name(), vd.name()) << "=" << std::max(vs.name(), vd.name());
+        }
     } else {
         elem << vd << "-" << vs << "<=" << w;
     }
     return elem.str();
 }
 
-static const std::vector<std::string> type_string = {
-    "shared", "stack", "packet", "ctx", "number", "map_fd", "map_fd_programs", "uninitialized"
-};
+static const std::vector<std::string> type_string = {"shared", "stack",  "packet",          "ctx",
+                                                     "number", "map_fd", "map_fd_programs", "uninitialized"};
 
 string_invariant SplitDBM::to_set() const {
     if (this->is_top()) {
@@ -1066,12 +1090,15 @@ string_invariant SplitDBM::to_set() const {
     // Extract all the edges
     SubGraph<const SplitDBM::graph_t> g_excl(this->g, 0);
     for (SplitDBM::vert_id v : g_excl.verts()) {
-        if (!this->rev_map[v])
+        if (!this->rev_map[v]) {
             continue;
-        if (!this->g.elem(0, v) && !this->g.elem(v, 0))
+        }
+        if (!this->g.elem(0, v) && !this->g.elem(v, 0)) {
             continue;
-        interval_t v_out = interval_t(this->g.elem(v, 0) ? -number_t(this->g.edge_val(v, 0)) : bound_t::minus_infinity(),
-                                      this->g.elem(0, v) ?  number_t(this->g.edge_val(0, v)) : bound_t::plus_infinity());
+        }
+        interval_t v_out =
+            interval_t(this->g.elem(v, 0) ? -number_t(this->g.edge_val(v, 0)) : bound_t::minus_infinity(),
+                       this->g.elem(0, v) ? number_t(this->g.edge_val(0, v)) : bound_t::plus_infinity());
         assert(!v_out.is_bottom());
 
         variable_t variable = *(this->rev_map[v]);
@@ -1090,8 +1117,9 @@ string_invariant SplitDBM::to_set() const {
             } else {
                 elem << " in {";
                 for (int type = lb; type <= ub; type++) {
-                    if (type > lb)
+                    if (type > lb) {
                         elem << ", ";
+                    }
                     elem << type_string.at(-type);
                 }
                 elem << "}";
@@ -1109,12 +1137,14 @@ string_invariant SplitDBM::to_set() const {
 
     std::set<std::tuple<variable_t, variable_t, Weight>> diff_csts;
     for (SplitDBM::vert_id s : g_excl.verts()) {
-        if (!this->rev_map[s])
+        if (!this->rev_map[s]) {
             continue;
+        }
         variable_t vs = *this->rev_map[s];
         for (SplitDBM::vert_id d : g_excl.succs(s)) {
-            if (!this->rev_map[d])
+            if (!this->rev_map[d]) {
                 continue;
+            }
             variable_t vd = *this->rev_map[d];
             diff_csts.emplace(vd, vs, g_excl.edge_val(s, d));
         }
@@ -1134,9 +1164,7 @@ string_invariant SplitDBM::to_set() const {
     return string_invariant{result};
 }
 
-std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) {
-    return o << dom.to_set();
-}
+std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
 SplitDBM::Weight SplitDBM::eval_expression(const linear_expression_t& e, bool overflow) const {
     if (overflow) {
@@ -1166,49 +1194,59 @@ interval_t SplitDBM::compute_residual(const linear_expression_t& e, variable_t p
 }
 
 SplitDBM::Weight SplitDBM::pot_value(variable_t v) const {
-    if (auto y = try_at(vert_map, v))
+    if (auto y = try_at(vert_map, v)) {
         return potential[*y];
+    }
     return {0};
 }
 
 interval_t SplitDBM::eval_interval(const linear_expression_t& e) const {
     using namespace crab::interval_operators;
     interval_t r{e.constant_term()};
-    for (const auto& [variable, coefficient] : e.variable_terms())
+    for (const auto& [variable, coefficient] : e.variable_terms()) {
         r += coefficient * operator[](variable);
+    }
     return r;
 }
 
 bool SplitDBM::intersect(const linear_constraint_t& cst) const {
-    if (cst.is_contradiction())
+    if (cst.is_contradiction()) {
         return false;
-    if (is_top() || cst.is_tautology())
+    }
+    if (is_top() || cst.is_tautology()) {
         return true;
+    }
     return intersect_aux(cst);
 }
 
 bool SplitDBM::entail(const linear_constraint_t& rhs) const {
-    if (rhs.is_tautology())
+    if (rhs.is_tautology()) {
         return true;
-    if (rhs.is_contradiction())
+    }
+    if (rhs.is_contradiction()) {
         return false;
+    }
     interval_t interval = eval_interval(rhs.expression());
     switch (rhs.kind()) {
     case constraint_kind_t::EQUALS_ZERO:
-        if (interval.singleton() == std::optional<number_t>(number_t(0)))
+        if (interval.singleton() == std::optional<number_t>(number_t(0))) {
             return true;
+        }
         break;
     case constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO:
-        if (interval.ub() <= number_t(0))
+        if (interval.ub() <= number_t(0)) {
             return true;
+        }
         break;
     case constraint_kind_t::LESS_THAN_ZERO:
-        if (interval.ub() < number_t(0))
+        if (interval.ub() < number_t(0)) {
             return true;
+        }
         break;
     case constraint_kind_t::NOT_ZERO:
-        if (interval.ub() < number_t(0) || interval.lb() > number_t(0))
+        if (interval.ub() < number_t(0) || interval.lb() > number_t(0)) {
             return true;
+        }
         break;
     }
     // TODO: copy the implementation from crab
@@ -1217,8 +1255,7 @@ bool SplitDBM::entail(const linear_constraint_t& rhs) const {
         // try to convert the equality into inequalities so when it's
         // negated we do not have disequalities.
         return entail_aux(linear_constraint_t(rhs.expression(), constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO)) &&
-               entail_aux(linear_constraint_t(rhs.expression().negate(),
-                                              constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO));
+               entail_aux(linear_constraint_t(rhs.expression().negate(), constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO));
     } else {
         return entail_aux(rhs);
     }
@@ -1248,12 +1285,14 @@ static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::gr
     SplitDBM::vert_id v = it->second;
     bound_t lb = bound_t::minus_infinity();
     bound_t ub = bound_t::plus_infinity();
-    if (r.elem(v, 0))
+    if (r.elem(v, 0)) {
         lb = x.is_unsigned() ? (-number_t(r.edge_val(v, 0))).truncate_to_unsigned_finite_width(finite_width)
                              : (-number_t(r.edge_val(v, 0))).truncate_to_signed_finite_width(finite_width);
-    if (r.elem(0, v))
+    }
+    if (r.elem(0, v)) {
         ub = x.is_unsigned() ? number_t(r.edge_val(0, v)).truncate_to_unsigned_finite_width(finite_width)
                              : number_t(r.edge_val(0, v)).truncate_to_signed_finite_width(finite_width);
+    }
     return {lb, ub};
 }
 
@@ -1261,8 +1300,6 @@ interval_t SplitDBM::get_interval(variable_t x, int finite_width) const {
     return crab::domains::get_interval(vert_map, g, x, finite_width);
 }
 
-interval_t SplitDBM::operator[](variable_t x) const {
-    return crab::domains::get_interval(vert_map, g, x, 0);
-}
+interval_t SplitDBM::operator[](variable_t x) const { return crab::domains::get_interval(vert_map, g, x, 0); }
 
 } // namespace crab::domains
diff --git a/src/crab/split_dbm.hpp b/src/crab/split_dbm.hpp
index abe0a5bd6..0c509fc79 100644
--- a/src/crab/split_dbm.hpp
+++ b/src/crab/split_dbm.hpp
@@ -45,7 +45,6 @@ enum class arith_binop_t { ADD, SUB, MUL, SDIV, UDIV, SREM, UREM };
 enum class bitwise_binop_t { AND, OR, XOR, SHL, LSHR, ASHR };
 using binop_t = std::variant<arith_binop_t, bitwise_binop_t>;
 
-
 namespace domains {
 
 /** DBM weights (Weight) can be represented using one of the following
@@ -101,18 +100,21 @@ class SplitDBM final {
     // GKG: ranges are now maintained in the graph
     vert_map_t vert_map; // Mapping from variables to vertices
     rev_map_t rev_map;
-    graph_t g;                 // The underlying relation graph
+    graph_t g;                     // The underlying relation graph
     std::vector<Weight> potential; // Stored potential for the vertex
     vert_set_t unstable;
 
     vert_id get_vert(variable_t v);
     // Evaluate the potential value of a variable.
-    [[nodiscard]] Weight pot_value(variable_t v) const;
+    [[nodiscard]]
+    Weight pot_value(variable_t v) const;
 
     // Evaluate an expression under the chosen potentials
-    [[nodiscard]] Weight eval_expression(const linear_expression_t& e, bool overflow) const;
+    [[nodiscard]]
+    Weight eval_expression(const linear_expression_t& e, bool overflow) const;
 
-    [[nodiscard]] interval_t compute_residual(const linear_expression_t& e, variable_t pivot) const;
+    [[nodiscard]]
+    interval_t compute_residual(const linear_expression_t& e, variable_t pivot) const;
 
     /**
      *  Turn an assignment into a set of difference constraints.
@@ -136,7 +138,8 @@ class SplitDBM final {
                             std::vector<std::pair<variable_t, Weight>>& diff_csts) const;
 
     // Turn an assignment into a set of difference constraints.
-    void diffcsts_of_assign(variable_t x, const linear_expression_t& exp, std::vector<std::pair<variable_t, Weight>>& lb,
+    void diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
+                            std::vector<std::pair<variable_t, Weight>>& lb,
                             std::vector<std::pair<variable_t, Weight>>& ub);
 
     /**
@@ -156,7 +159,8 @@ class SplitDBM final {
     // x != n
     bool add_univar_disequation(variable_t x, const number_t& n);
 
-    [[nodiscard]] interval_t get_interval(variable_t x, int finite_width) const;
+    [[nodiscard]]
+    interval_t get_interval(variable_t x, int finite_width) const;
 
     // Restore potential after an edge addition
     bool repair_potential(vert_id src, vert_id dest) { return GrOps::repair_potential(g, potential, src, dest); }
@@ -198,7 +202,8 @@ class SplitDBM final {
 
     static SplitDBM top() { return SplitDBM(); }
 
-    [[nodiscard]] bool is_top() const {
+    [[nodiscard]]
+    bool is_top() const {
         return g.is_empty();
     }
 
@@ -206,42 +211,47 @@ class SplitDBM final {
 
     // FIXME: can be done more efficient
     void operator|=(const SplitDBM& o) { *this = *this | o; }
-    void operator|=(SplitDBM&& o) {
-        *this = *this | o;
-    }
+    void operator|=(SplitDBM&& o) { *this = *this | o; }
 
     SplitDBM operator|(const SplitDBM& o) const&;
 
     SplitDBM operator|(SplitDBM&& o) && {
-        if (o.is_top())
+        if (o.is_top()) {
             return std::move(o);
-        if (is_top())
+        }
+        if (is_top()) {
             return std::move(*this);
+        }
         return ((const SplitDBM&)*this) | (const SplitDBM&)o;
     }
 
     SplitDBM operator|(const SplitDBM& o) && {
-        if (is_top())
+        if (is_top()) {
             return std::move(*this);
+        }
         return ((const SplitDBM&)*this) | o;
     }
 
     SplitDBM operator|(SplitDBM&& o) const& {
-        if (o.is_top())
+        if (o.is_top()) {
             return std::move(o);
+        }
         return (*this) | (const SplitDBM&)o;
     }
 
-    [[nodiscard]] SplitDBM widen(const SplitDBM& o) const;
+    [[nodiscard]]
+    SplitDBM widen(const SplitDBM& o) const;
 
-    [[nodiscard]] SplitDBM widening_thresholds(const SplitDBM& o, const iterators::thresholds_t& ts) const {
+    [[nodiscard]]
+    SplitDBM widening_thresholds(const SplitDBM& o, const iterators::thresholds_t& ts) const {
         // TODO: use thresholds
         return this->widen(o);
     }
 
     std::optional<SplitDBM> meet(const SplitDBM& o) const;
 
-    [[nodiscard]] SplitDBM narrow(const SplitDBM& o) const;
+    [[nodiscard]]
+    SplitDBM narrow(const SplitDBM& o) const;
 
     void operator-=(variable_t v);
 
@@ -254,9 +264,7 @@ class SplitDBM final {
     }
     void assign(variable_t x, signed long long int n) { assign(x, linear_expression_t(n)); }
 
-    void assign(variable_t x, variable_t v) {
-        assign(x, linear_expression_t{v});
-    }
+    void assign(variable_t x, variable_t v) { assign(x, linear_expression_t{v}); }
 
     void assign(variable_t x, const std::optional<linear_expression_t>& e) {
         if (e) {
@@ -285,7 +293,8 @@ class SplitDBM final {
 
     bool add_constraint(const linear_constraint_t& cst);
 
-    [[nodiscard]] interval_t eval_interval(const linear_expression_t& e) const;
+    [[nodiscard]]
+    interval_t eval_interval(const linear_expression_t& e) const;
 
     interval_t operator[](variable_t x) const;
 
@@ -294,34 +303,39 @@ class SplitDBM final {
     void forget(const variable_vector_t& variables);
 
     // return number of vertices and edges
-    [[nodiscard]] std::pair<std::size_t, std::size_t> size() const { return {g.size(), g.num_edges()}; }
+    [[nodiscard]]
+    std::pair<std::size_t, std::size_t> size() const {
+        return {g.size(), g.num_edges()};
+    }
 
   private:
-    [[nodiscard]] bool entail_aux(const linear_constraint_t& cst) const {
+    [[nodiscard]]
+    bool entail_aux(const linear_constraint_t& cst) const {
         // copy is necessary
         return !SplitDBM(*this).add_constraint(cst.negate());
     }
 
-    [[nodiscard]] bool intersect_aux(const linear_constraint_t& cst) const {
+    [[nodiscard]]
+    bool intersect_aux(const linear_constraint_t& cst) const {
         // copy is necessary
         return SplitDBM(*this).add_constraint(cst);
     }
 
   public:
     // Return true if inv intersects with cst.
-    [[nodiscard]] bool intersect(const linear_constraint_t& cst) const;
+    [[nodiscard]]
+    bool intersect(const linear_constraint_t& cst) const;
 
     // Return true if entails rhs.
-    [[nodiscard]] bool entail(const linear_constraint_t& rhs) const;
+    [[nodiscard]]
+    bool entail(const linear_constraint_t& rhs) const;
 
     friend std::ostream& operator<<(std::ostream& o, const SplitDBM& dom);
-    [[nodiscard]] string_invariant to_set() const;
+    [[nodiscard]]
+    string_invariant to_set() const;
 
   public:
-    static void clear_thread_local_state()
-    {
-        GraphOps<crab::AdaptGraph>::clear_thread_local_state();
-    }
+    static void clear_thread_local_state() { GraphOps<crab::AdaptGraph>::clear_thread_local_state(); }
 }; // class SplitDBM
 
 } // namespace domains
diff --git a/src/crab/thresholds.cpp b/src/crab/thresholds.cpp
index 9f6a9e561..3fe432794 100644
--- a/src/crab/thresholds.cpp
+++ b/src/crab/thresholds.cpp
@@ -37,24 +37,25 @@ void thresholds_t::add(bound_t v1) {
 
 std::ostream& operator<<(std::ostream& o, const thresholds_t& t) {
     o << "{";
-    for (typename std::vector<bound_t>::const_iterator it = t.m_thresholds.begin(), et = t.m_thresholds.end(); it != et;) {
+    for (typename std::vector<bound_t>::const_iterator it = t.m_thresholds.begin(), et = t.m_thresholds.end();
+         it != et;) {
         bound_t b(*it);
         o << b;
         ++it;
-        if (it != t.m_thresholds.end())
+        if (it != t.m_thresholds.end()) {
             o << ",";
+        }
     }
     o << "}";
     return o;
 }
 
-void wto_thresholds_t::get_thresholds(const basic_block_t& bb, thresholds_t& thresholds) const {
-
-}
+void wto_thresholds_t::get_thresholds(const basic_block_t& bb, thresholds_t& thresholds) const {}
 
 void wto_thresholds_t::operator()(const label_t& vertex) {
-    if (m_stack.empty())
+    if (m_stack.empty()) {
         return;
+    }
 
     label_t head = m_stack.back();
     auto it = m_head_to_thresholds.find(head);
diff --git a/src/crab/thresholds.hpp b/src/crab/thresholds.hpp
index 14d4de81e..e72135f17 100644
--- a/src/crab/thresholds.hpp
+++ b/src/crab/thresholds.hpp
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 #pragma once
 
-#include <map>
 #include <algorithm>
 #include <climits>
+#include <map>
 
 #include <boost/range/iterator_range.hpp>
 
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index 501c79fe5..d5fc17521 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -22,26 +22,124 @@ variable_t variable_t::make(const std::string& name) {
 
 std::vector<std::string> variable_t::_default_names() {
     return std::vector<std::string>{
-        "r0.svalue", "r0.uvalue", "r0.ctx_offset", "r0.map_fd", "r0.packet_offset", "r0.shared_offset", "r0.stack_offset", "r0.type", "r0.shared_region_size", "r0.stack_numeric_size",
-        "r1.svalue", "r1.uvalue", "r1.ctx_offset", "r1.map_fd", "r1.packet_offset", "r1.shared_offset", "r1.stack_offset", "r1.type", "r1.shared_region_size", "r1.stack_numeric_size",
-        "r2.svalue", "r2.uvalue", "r2.ctx_offset", "r2.map_fd", "r2.packet_offset", "r2.shared_offset", "r2.stack_offset", "r2.type", "r2.shared_region_size", "r2.stack_numeric_size",
-        "r3.svalue", "r3.uvalue", "r3.ctx_offset", "r3.map_fd", "r3.packet_offset", "r3.shared_offset", "r3.stack_offset", "r3.type", "r3.shared_region_size", "r3.stack_numeric_size",
-        "r4.svalue", "r4.uvalue", "r4.ctx_offset", "r4.map_fd", "r4.packet_offset", "r4.shared_offset", "r4.stack_offset", "r4.type", "r4.shared_region_size", "r4.stack_numeric_size",
-        "r5.svalue", "r5.uvalue", "r5.ctx_offset", "r5.map_fd", "r5.packet_offset", "r5.shared_offset", "r5.stack_offset", "r5.type", "r5.shared_region_size", "r5.stack_numeric_size",
-        "r6.svalue", "r6.uvalue", "r6.ctx_offset", "r6.map_fd", "r6.packet_offset", "r6.shared_offset", "r6.stack_offset", "r6.type", "r6.shared_region_size", "r6.stack_numeric_size",
-        "r7.svalue", "r7.uvalue", "r7.ctx_offset", "r7.map_fd", "r7.packet_offset", "r7.shared_offset", "r7.stack_offset", "r7.type", "r7.shared_region_size", "r7.stack_numeric_size",
-        "r8.svalue", "r8.uvalue", "r8.ctx_offset", "r8.map_fd", "r8.packet_offset", "r8.shared_offset", "r8.stack_offset", "r8.type", "r8.shared_region_size", "r8.stack_numeric_size",
-        "r9.svalue", "r9.uvalue", "r9.ctx_offset", "r9.map_fd", "r9.packet_offset", "r9.shared_offset", "r9.stack_offset", "r9.type", "r9.shared_region_size", "r9.stack_numeric_size",
-        "r10.svalue", "r10.uvalue", "r10.ctx_offset", "r10.map_fd", "r10.packet_offset", "r10.shared_offset", "r10.stack_offset", "r10.type", "r10.shared_region_size", "r10.stack_numeric_size",
-        "data_size", "meta_size",
+        "r0.svalue",
+        "r0.uvalue",
+        "r0.ctx_offset",
+        "r0.map_fd",
+        "r0.packet_offset",
+        "r0.shared_offset",
+        "r0.stack_offset",
+        "r0.type",
+        "r0.shared_region_size",
+        "r0.stack_numeric_size",
+        "r1.svalue",
+        "r1.uvalue",
+        "r1.ctx_offset",
+        "r1.map_fd",
+        "r1.packet_offset",
+        "r1.shared_offset",
+        "r1.stack_offset",
+        "r1.type",
+        "r1.shared_region_size",
+        "r1.stack_numeric_size",
+        "r2.svalue",
+        "r2.uvalue",
+        "r2.ctx_offset",
+        "r2.map_fd",
+        "r2.packet_offset",
+        "r2.shared_offset",
+        "r2.stack_offset",
+        "r2.type",
+        "r2.shared_region_size",
+        "r2.stack_numeric_size",
+        "r3.svalue",
+        "r3.uvalue",
+        "r3.ctx_offset",
+        "r3.map_fd",
+        "r3.packet_offset",
+        "r3.shared_offset",
+        "r3.stack_offset",
+        "r3.type",
+        "r3.shared_region_size",
+        "r3.stack_numeric_size",
+        "r4.svalue",
+        "r4.uvalue",
+        "r4.ctx_offset",
+        "r4.map_fd",
+        "r4.packet_offset",
+        "r4.shared_offset",
+        "r4.stack_offset",
+        "r4.type",
+        "r4.shared_region_size",
+        "r4.stack_numeric_size",
+        "r5.svalue",
+        "r5.uvalue",
+        "r5.ctx_offset",
+        "r5.map_fd",
+        "r5.packet_offset",
+        "r5.shared_offset",
+        "r5.stack_offset",
+        "r5.type",
+        "r5.shared_region_size",
+        "r5.stack_numeric_size",
+        "r6.svalue",
+        "r6.uvalue",
+        "r6.ctx_offset",
+        "r6.map_fd",
+        "r6.packet_offset",
+        "r6.shared_offset",
+        "r6.stack_offset",
+        "r6.type",
+        "r6.shared_region_size",
+        "r6.stack_numeric_size",
+        "r7.svalue",
+        "r7.uvalue",
+        "r7.ctx_offset",
+        "r7.map_fd",
+        "r7.packet_offset",
+        "r7.shared_offset",
+        "r7.stack_offset",
+        "r7.type",
+        "r7.shared_region_size",
+        "r7.stack_numeric_size",
+        "r8.svalue",
+        "r8.uvalue",
+        "r8.ctx_offset",
+        "r8.map_fd",
+        "r8.packet_offset",
+        "r8.shared_offset",
+        "r8.stack_offset",
+        "r8.type",
+        "r8.shared_region_size",
+        "r8.stack_numeric_size",
+        "r9.svalue",
+        "r9.uvalue",
+        "r9.ctx_offset",
+        "r9.map_fd",
+        "r9.packet_offset",
+        "r9.shared_offset",
+        "r9.stack_offset",
+        "r9.type",
+        "r9.shared_region_size",
+        "r9.stack_numeric_size",
+        "r10.svalue",
+        "r10.uvalue",
+        "r10.ctx_offset",
+        "r10.map_fd",
+        "r10.packet_offset",
+        "r10.shared_offset",
+        "r10.stack_offset",
+        "r10.type",
+        "r10.shared_region_size",
+        "r10.stack_numeric_size",
+        "data_size",
+        "meta_size",
     };
 };
 
 thread_local crab::lazy_allocator<std::vector<std::string>, variable_t::variable_name_factory> variable_t::names;
 
-void variable_t::clear_thread_local_state() {
-    names.clear();
-}
+void variable_t::clear_thread_local_state() { names.clear(); }
 
 static std::string name_of(data_kind_t kind) {
     switch (kind) {
@@ -59,12 +157,9 @@ static std::string name_of(data_kind_t kind) {
     return {};
 }
 
-variable_t variable_t::reg(data_kind_t kind, int i) {
-    return make("r" + std::to_string(i) + "." + name_of(kind)); }
+variable_t variable_t::reg(data_kind_t kind, int i) { return make("r" + std::to_string(i) + "." + name_of(kind)); }
 
-std::ostream& operator<<(std::ostream& o, const data_kind_t& s) {
-    return o << name_of(s);
-}
+std::ostream& operator<<(std::ostream& o, const data_kind_t& s) { return o << name_of(s); }
 
 static std::string mk_scalar_name(data_kind_t kind, const number_t& o, const number_t& size) {
     std::stringstream os;
@@ -94,29 +189,28 @@ variable_t variable_t::meta_offset() { return make("meta_offset"); }
 variable_t variable_t::packet_size() { return make("packet_size"); }
 variable_t variable_t::loop_counter(const std::string& label) { return make("pc[" + label + "]"); }
 
-static bool ends_with(const std::string& str, const std::string& suffix)
-{
-    return str.size() >= suffix.size() && 0 == str.compare(str.size()-suffix.size(), suffix.size(), suffix);
+static bool ends_with(const std::string& str, const std::string& suffix) {
+    return str.size() >= suffix.size() && 0 == str.compare(str.size() - suffix.size(), suffix.size(), suffix);
 }
 
 std::vector<variable_t> variable_t::get_type_variables() {
     std::vector<variable_t> res;
-    for (const std::string& name: *names) {
-        if (ends_with(name, ".type"))
+    for (const std::string& name : *names) {
+        if (ends_with(name, ".type")) {
             res.push_back(make(name));
+        }
     }
     return res;
 }
 
-bool variable_t::is_in_stack() const {
-    return this->name()[0] == 's';
-}
+bool variable_t::is_in_stack() const { return this->name()[0] == 's'; }
 
 std::vector<variable_t> variable_t::get_loop_counters() {
     std::vector<variable_t> res;
-    for (const std::string& name: *names) {
-        if (name.find("pc") == 0)
+    for (const std::string& name : *names) {
+        if (name.find("pc") == 0) {
             res.push_back(make(name));
+        }
     }
     return res;
 }
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index b594a4243..e531bf99b 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -20,7 +20,18 @@ using index_t = uint64_t;
 namespace crab {
 
 // data_kind_t is eBPF-specific.
-enum class data_kind_t { types, svalues, uvalues, ctx_offsets, map_fds, packet_offsets, shared_offsets, stack_offsets, shared_region_sizes, stack_numeric_sizes };
+enum class data_kind_t {
+    types,
+    svalues,
+    uvalues,
+    ctx_offsets,
+    map_fds,
+    packet_offsets,
+    shared_offsets,
+    stack_offsets,
+    shared_region_sizes,
+    stack_numeric_sizes
+};
 std::ostream& operator<<(std::ostream& o, const data_kind_t& s);
 
 // Wrapper for typed variables used by the crab abstract domains and linear_constraints.
@@ -31,7 +42,10 @@ class variable_t final {
     explicit variable_t(index_t id) : _id(id) {}
 
   public:
-    [[nodiscard]] std::size_t hash() const { return (size_t)_id; }
+    [[nodiscard]]
+    std::size_t hash() const {
+        return (size_t)_id;
+    }
 
     bool operator==(variable_t o) const { return _id == o._id; }
 
@@ -40,14 +54,22 @@ class variable_t final {
     // for flat_map
     bool operator<(variable_t o) const { return _id < o._id; }
 
+    [[nodiscard]]
+    std::string name() const {
+        return names->at(_id);
+    }
 
-    [[nodiscard]] std::string name() const { return names->at(_id); }
+    [[nodiscard]]
+    bool is_type() const {
+        return names->at(_id).find(".type") != std::string::npos;
+    }
 
-    [[nodiscard]] bool is_type() const { return names->at(_id).find(".type") != std::string::npos; }
+    [[nodiscard]]
+    bool is_unsigned() const {
+        return names->at(_id).find(".uvalue") != std::string::npos;
+    }
 
-    [[nodiscard]] bool is_unsigned() const { return names->at(_id).find(".uvalue") != std::string::npos; }
-
-    friend std::ostream& operator<<(std::ostream& o, variable_t v)  { return o << names->at(v._id); }
+    friend std::ostream& operator<<(std::ostream& o, variable_t v) { return o << names->at(v._id); }
 
     // var_factory portion.
     // This singleton is eBPF-specific, to avoid lifetime issues and/or passing factory explicitly everywhere:
@@ -78,7 +100,8 @@ class variable_t final {
     static variable_t packet_size();
     static std::vector<variable_t> get_loop_counters();
     static variable_t loop_counter(const std::string& label);
-    [[nodiscard]] bool is_in_stack() const;
+    [[nodiscard]]
+    bool is_in_stack() const;
 
     struct Hasher {
         std::size_t operator()(const variable_t& v) const { return v.hash(); }
diff --git a/src/crab/wto.cpp b/src/crab/wto.cpp
index 037f8bfc6..f1f1de48d 100644
--- a/src/crab/wto.cpp
+++ b/src/crab/wto.cpp
@@ -32,7 +32,8 @@ void wto_t::push_successors(const label_t& vertex, wto_partition_t& partition,
     }
 }
 
-void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle) {
+void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition,
+                        std::weak_ptr<wto_cycle_t> containing_cycle) {
     wto_vertex_data_t& vertex_data = _vertex_data[vertex];
     int head_dfn = vertex_data.dfn;
     bool loop = false;
@@ -53,7 +54,7 @@ void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition, std::
     // Create a new cycle component inside the containing cycle.
     auto cycle = std::make_shared<wto_cycle_t>(containing_cycle);
 
-    if (head_dfn == vertex_data.dfn) {  
+    if (head_dfn == vertex_data.dfn) {
         vertex_data.dfn = INT_MAX;
         label_t element = _stack.top();
         _stack.pop();
@@ -97,7 +98,7 @@ void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition, std::
 }
 
 void wto_t::continue_visit(const label_t& vertex, wto_partition_t& partition,
-                        std::weak_ptr<wto_cycle_t> containing_cycle) {
+                           std::weak_ptr<wto_cycle_t> containing_cycle) {
     // Add the vertex at the start of the cycle
     // (end of the vector which stores the cycle in reverse order).
     auto cycle = containing_cycle.lock();
@@ -130,9 +131,13 @@ wto_t::wto_t(const cfg_t& cfg) : _cfg(cfg) {
         visit_args_t args2 = _visit_stack.top();
         _visit_stack.pop();
         switch (args2.type) {
-        case visit_task_type_t::PushSuccessors: push_successors(args2.vertex, args2.partition, args2.containing_cycle); break;
+        case visit_task_type_t::PushSuccessors:
+            push_successors(args2.vertex, args2.partition, args2.containing_cycle);
+            break;
         case visit_task_type_t::StartVisit: start_visit(args2.vertex, args2.partition, args2.containing_cycle); break;
-        case visit_task_type_t::ContinueVisit: continue_visit(args2.vertex, args2.partition, args2.containing_cycle); break;
+        case visit_task_type_t::ContinueVisit:
+            continue_visit(args2.vertex, args2.partition, args2.containing_cycle);
+            break;
         default: break;
         }
     }
diff --git a/src/crab/wto.hpp b/src/crab/wto.hpp
index e43299f56..471f9e79f 100644
--- a/src/crab/wto.hpp
+++ b/src/crab/wto.hpp
@@ -28,10 +28,10 @@
 // comparison.
 #undef RECURSIVE_WTO
 
-#include <stack>
-#include <vector>
 #include "crab/cfg.hpp"
 #include "crab/wto_nesting.hpp"
+#include <stack>
+#include <vector>
 
 // Define types used by both this header file and wto_cycle.hpp
 using wto_component_t = std::variant<std::shared_ptr<class wto_cycle_t>, label_t>;
@@ -63,7 +63,7 @@ struct wto_vertex_data_t {
     int head_dfn; // Head value returned from Visit() in the paper.
     std::shared_ptr<wto_cycle_t> containing_cycle;
 
-    wto_vertex_data_t() : dfn(0), head_dfn(0){};
+    wto_vertex_data_t() : dfn(0), head_dfn(0) {};
     wto_vertex_data_t(int d) : dfn(d), head_dfn(0) {};
 };
 #endif
@@ -99,9 +99,9 @@ class wto_t final {
     std::map<label_t, wto_nesting_t> _nesting;
 
 #ifndef RECURSIVE_WTO
-    void push_successors(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle);
-    void start_visit(const label_t& vertex, wto_partition_t& partition,
-                            std::weak_ptr<wto_cycle_t> containing_cycle);
+    void push_successors(const label_t& vertex, wto_partition_t& partition,
+                         std::weak_ptr<wto_cycle_t> containing_cycle);
+    void start_visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle);
     void continue_visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle);
 #else
     // Implementation of the Visit() function defined in Figure 4 of the paper.
@@ -168,12 +168,21 @@ class wto_t final {
     }
 #endif
 
-    public:
-    [[nodiscard]] const crab::cfg_t& cfg() const { return _cfg; }
+  public:
+    [[nodiscard]]
+    const crab::cfg_t& cfg() const {
+        return _cfg;
+    }
 #ifdef RECURSIVE_WTO
-    [[nodiscard]] int dfn(const label_t& vertex) const { return _dfn.at(vertex); }
+    [[nodiscard]]
+    int dfn(const label_t& vertex) const {
+        return _dfn.at(vertex);
+    }
 #else
-    [[nodiscard]] int dfn(const label_t& vertex) const { return _vertex_data.at(vertex).dfn; }
+    [[nodiscard]]
+    int dfn(const label_t& vertex) const {
+        return _vertex_data.at(vertex).dfn;
+    }
 #endif
 
     // Construct a Weak Topological Ordering from a control-flow graph using
@@ -191,8 +200,14 @@ class wto_t final {
     wto_t(const cfg_t& cfg);
 #endif
 
-    [[nodiscard]] wto_partition_t::reverse_iterator begin() { return _components.rbegin(); }
-    [[nodiscard]] wto_partition_t::reverse_iterator end() { return _components.rend(); }
+    [[nodiscard]]
+    wto_partition_t::reverse_iterator begin() {
+        return _components.rbegin();
+    }
+    [[nodiscard]]
+    wto_partition_t::reverse_iterator end() {
+        return _components.rend();
+    }
 
     friend std::ostream& operator<<(std::ostream& o, wto_t& wto) {
         o << wto._components << std::endl;
@@ -247,5 +262,4 @@ class wto_t final {
         _nesting.emplace(label, std::move(n));
         return _nesting.at(label);
     }
-
 };
diff --git a/src/crab/wto_cycle.hpp b/src/crab/wto_cycle.hpp
index 4e26fb22f..b80fea0a3 100644
--- a/src/crab/wto_cycle.hpp
+++ b/src/crab/wto_cycle.hpp
@@ -1,9 +1,9 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 #pragma once
+#include "wto.hpp"
 #include <memory>
 #include <ostream>
-#include "wto.hpp"
 
 // Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
 // section 3 uses the term "nested component" to refer to what wto_cycle_t implements.
@@ -18,18 +18,31 @@ class wto_cycle_t final {
     wto_cycle_t(std::weak_ptr<wto_cycle_t>& containing_cycle) : _containing_cycle(containing_cycle) {}
 
     // Get a vertex of an entry point of the cycle.
-    [[nodiscard]] const label_t& head() const {
+    [[nodiscard]]
+    const label_t& head() const {
         // Any cycle must start with a vertex, not another cycle,
         // per Definition 1 in the paper.  Since the vector is in reverse
         // order, the head is the last element.
         return std::get<label_t>(*_components.back().get());
     }
 
-    [[nodiscard]] wto_partition_t::reverse_iterator begin() { return _components.rbegin(); }
-    [[nodiscard]] wto_partition_t::reverse_iterator end() { return _components.rend(); }
+    [[nodiscard]]
+    wto_partition_t::reverse_iterator begin() {
+        return _components.rbegin();
+    }
+    [[nodiscard]]
+    wto_partition_t::reverse_iterator end() {
+        return _components.rend();
+    }
 
-    [[nodiscard]] std::weak_ptr<wto_cycle_t> containing_cycle() const { return _containing_cycle; }
-    [[nodiscard]] wto_partition_t& components() { return _components; }
+    [[nodiscard]]
+    std::weak_ptr<wto_cycle_t> containing_cycle() const {
+        return _containing_cycle;
+    }
+    [[nodiscard]]
+    wto_partition_t& components() {
+        return _components;
+    }
 };
 
 inline std::ostream& operator<<(std::ostream& o, wto_cycle_t& cycle) {
@@ -43,10 +56,10 @@ inline std::ostream& operator<<(std::ostream& o, wto_cycle_t& cycle) {
         if (std::holds_alternative<std::shared_ptr<class wto_cycle_t>>(*c)) {
             auto ptr = std::get<std::shared_ptr<class wto_cycle_t>>(*c);
             o << *ptr;
-        } else
+        } else {
             std::visit([&o](auto& e) -> std::ostream& { return o << e; }, *component);
+        }
         o << " ";
-
     }
     o << ")";
     return o;
diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index c24ae935c..791cb4225 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -6,8 +6,8 @@
 
 #include <boost/container/flat_map.hpp>
 
-#include "crab_utils/safeint.hpp"
 #include "crab_utils/debug.hpp"
+#include "crab_utils/safeint.hpp"
 // Adaptive sparse-set based weighted graph implementation
 
 namespace crab {
@@ -23,7 +23,10 @@ class TreeSMap final {
 
   public:
     using elt_iter_t = col::const_iterator;
-    [[nodiscard]] size_t size() const { return map.size(); }
+    [[nodiscard]]
+    size_t size() const {
+        return map.size();
+    }
 
     class key_iter_t {
       public:
@@ -34,9 +37,7 @@ class TreeSMap final {
         // for the "empty" iterator, otherwise we can trigger
         // undefined behavior.
         inline static std::unique_ptr<key_iter_t> _empty_iter = std::make_unique<key_iter_t>();
-        static key_iter_t empty_iterator() {
-            return *_empty_iter;
-        }
+        static key_iter_t empty_iterator() { return *_empty_iter; }
 
         key_t operator*() const { return e->first; }
         bool operator!=(const key_iter_t& o) const { return e != o.e; }
@@ -53,10 +54,19 @@ class TreeSMap final {
         using iterator = key_iter_t;
 
         explicit key_const_range_t(const col& c) : c{c} {}
-        [[nodiscard]] size_t size() const { return c.size(); }
+        [[nodiscard]]
+        size_t size() const {
+            return c.size();
+        }
 
-        [[nodiscard]] key_iter_t begin() const { return key_iter_t(c.cbegin()); }
-        [[nodiscard]] key_iter_t end() const { return key_iter_t(c.cend()); }
+        [[nodiscard]]
+        key_iter_t begin() const {
+            return key_iter_t(c.cbegin());
+        }
+        [[nodiscard]]
+        key_iter_t end() const {
+            return key_iter_t(c.cend());
+        }
 
         const col& c;
     };
@@ -64,10 +74,19 @@ class TreeSMap final {
     class elt_range_t {
       public:
         elt_range_t(const col& c) : c{c} {}
-        [[nodiscard]] size_t size() const { return c.size(); }
+        [[nodiscard]]
+        size_t size() const {
+            return c.size();
+        }
 
-        [[nodiscard]] auto begin() const { return c.begin(); }
-        [[nodiscard]] auto end() const { return c.end(); }
+        [[nodiscard]]
+        auto begin() const {
+            return c.begin();
+        }
+        [[nodiscard]]
+        auto end() const {
+            return c.end();
+        }
 
         const col& c;
     };
@@ -75,22 +94,39 @@ class TreeSMap final {
     class elt_const_range_t {
       public:
         elt_const_range_t(const col& c) : c{c} {}
-        [[nodiscard]] size_t size() const { return c.size(); }
+        [[nodiscard]]
+        size_t size() const {
+            return c.size();
+        }
 
-        [[nodiscard]] auto begin() const { return c.cbegin(); }
-        [[nodiscard]] auto end() const { return c.cend(); }
+        [[nodiscard]]
+        auto begin() const {
+            return c.cbegin();
+        }
+        [[nodiscard]]
+        auto end() const {
+            return c.cend();
+        }
 
         const col& c;
     };
 
-    [[nodiscard]] elt_range_t elts() const { return elt_range_t(map); }
-    [[nodiscard]] key_const_range_t keys() const { return key_const_range_t(map); }
+    [[nodiscard]]
+    elt_range_t elts() const {
+        return elt_range_t(map);
+    }
+    [[nodiscard]]
+    key_const_range_t keys() const {
+        return key_const_range_t(map);
+    }
 
-    [[nodiscard]] bool contains(key_t k) const {
+    [[nodiscard]]
+    bool contains(key_t k) const {
         return map.count(k);
     }
 
-    [[nodiscard]] std::optional<val_t> lookup(key_t k) const {
+    [[nodiscard]]
+    std::optional<val_t> lookup(key_t k) const {
         auto v = map.find(k);
         if (v != map.end()) {
             return {v->second};
@@ -99,14 +135,10 @@ class TreeSMap final {
     }
 
     // precondition: k \in S
-    void remove(key_t k) {
-        map.erase(k);
-    }
+    void remove(key_t k) { map.erase(k); }
 
     // precondition: k \notin S
-    void add(key_t k, const val_t& v) {
-        map.insert_or_assign(k, v);
-    }
+    void add(key_t k, const val_t& v) { map.insert_or_assign(k, v); }
     void clear() { map.clear(); }
 };
 
@@ -147,8 +179,9 @@ class AdaptGraph final {
         vert_id operator*() const { return v; }
 
         bool operator!=(const vert_const_iterator& o) {
-            while (v < o.v && is_free[v])
+            while (v < o.v && is_free[v]) {
                 ++v;
+            }
             return v < o.v;
         }
 
@@ -162,12 +195,24 @@ class AdaptGraph final {
 
         explicit vert_const_range(const std::vector<int>& _is_free) : is_free(_is_free) {}
 
-        [[nodiscard]] vert_const_iterator begin() const { return vert_const_iterator{0, is_free}; }
-        [[nodiscard]] vert_const_iterator end() const { return vert_const_iterator{static_cast<vert_id>(is_free.size()), is_free}; }
+        [[nodiscard]]
+        vert_const_iterator begin() const {
+            return vert_const_iterator{0, is_free};
+        }
+        [[nodiscard]]
+        vert_const_iterator end() const {
+            return vert_const_iterator{static_cast<vert_id>(is_free.size()), is_free};
+        }
 
-        [[nodiscard]] size_t size() const { return is_free.size(); }
+        [[nodiscard]]
+        size_t size() const {
+            return is_free.size();
+        }
     };
-    [[nodiscard]] vert_const_range verts() const { return vert_const_range{is_free}; }
+    [[nodiscard]]
+    vert_const_range verts() const {
+        return vert_const_range{is_free};
+    }
 
     struct edge_const_iter {
         struct edge_ref {
@@ -187,9 +232,7 @@ class AdaptGraph final {
         // for the "empty" iterator, otherwise we can trigger
         // undefined behavior.
         inline static std::unique_ptr<edge_const_iter> _empty_iter = std::make_unique<edge_const_iter>();
-        static edge_const_iter empty_iterator() {
-            return *_empty_iter;
-        }
+        static edge_const_iter empty_iterator() { return *_empty_iter; }
 
         edge_ref operator*() const { return edge_ref{it->first, (*ws)[it->second]}; }
         edge_const_iter operator++() {
@@ -199,7 +242,6 @@ class AdaptGraph final {
         bool operator!=(const edge_const_iter& o) const { return it != o.it; }
     };
 
-
     struct edge_const_range_t {
         using elt_range_t = typename smap_t::elt_range_t;
         using iterator = edge_const_iter;
@@ -207,9 +249,18 @@ class AdaptGraph final {
         elt_range_t r;
         const std::vector<Weight>& ws;
 
-        [[nodiscard]] edge_const_iter begin() const { return edge_const_iter(r.begin(), ws); }
-        [[nodiscard]] edge_const_iter end() const { return edge_const_iter(r.end(), ws); }
-        [[nodiscard]] size_t size() const { return r.size(); }
+        [[nodiscard]]
+        edge_const_iter begin() const {
+            return edge_const_iter(r.begin(), ws);
+        }
+        [[nodiscard]]
+        edge_const_iter end() const {
+            return edge_const_iter(r.end(), ws);
+        }
+        [[nodiscard]]
+        size_t size() const {
+            return r.size();
+        }
     };
 
     using fwd_edge_const_iter = edge_const_iter;
@@ -220,21 +271,42 @@ class AdaptGraph final {
     using neighbour_range = adj_range_t;
     using neighbour_const_range = adj_const_range_t;
 
-    [[nodiscard]] adj_const_range_t succs(vert_id v) const { return _succs[v].keys(); }
-    [[nodiscard]] adj_const_range_t preds(vert_id v) const { return _preds[v].keys(); }
+    [[nodiscard]]
+    adj_const_range_t succs(vert_id v) const {
+        return _succs[v].keys();
+    }
+    [[nodiscard]]
+    adj_const_range_t preds(vert_id v) const {
+        return _preds[v].keys();
+    }
 
     using fwd_edge_range = edge_const_range_t;
     using rev_edge_range = edge_const_range_t;
 
-    [[nodiscard]] edge_const_range_t e_succs(vert_id v) const { return {_succs[v].elts(), _ws}; }
-    [[nodiscard]] edge_const_range_t e_preds(vert_id v) const { return {_preds[v].elts(), _ws}; }
+    [[nodiscard]]
+    edge_const_range_t e_succs(vert_id v) const {
+        return {_succs[v].elts(), _ws};
+    }
+    [[nodiscard]]
+    edge_const_range_t e_preds(vert_id v) const {
+        return {_preds[v].elts(), _ws};
+    }
 
     using e_neighbour_const_range = edge_const_range_t;
 
     // Management
-    [[nodiscard]] bool is_empty() const { return edge_count == 0; }
-    [[nodiscard]] size_t size() const { return _succs.size(); }
-    [[nodiscard]] size_t num_edges() const { return edge_count; }
+    [[nodiscard]]
+    bool is_empty() const {
+        return edge_count == 0;
+    }
+    [[nodiscard]]
+    size_t size() const {
+        return _succs.size();
+    }
+    [[nodiscard]]
+    size_t num_edges() const {
+        return edge_count;
+    }
     vert_id new_vertex() {
         vert_id v;
         if (!free_id.empty()) {
@@ -253,13 +325,15 @@ class AdaptGraph final {
     }
 
     void growTo(size_t v) {
-        while (size() < v)
+        while (size() < v) {
             new_vertex();
+        }
     }
 
     void forget(vert_id v) {
-        if (is_free[v])
+        if (is_free[v]) {
             return;
+        }
 
         for (const auto& [key, val] : _succs[v].elts()) {
             free_widx.push_back(val);
@@ -268,8 +342,9 @@ class AdaptGraph final {
         edge_count -= _succs[v].size();
         _succs[v].clear();
 
-        for (smap_t::key_t k : _preds[v].keys())
+        for (smap_t::key_t k : _preds[v].keys()) {
             _succs[k].remove(v);
+        }
         edge_count -= _preds[v].size();
         _preds[v].clear();
 
@@ -296,13 +371,12 @@ class AdaptGraph final {
         edge_count = 0;
     }
 
-    [[nodiscard]] bool elem(vert_id s, vert_id d) const {
+    [[nodiscard]]
+    bool elem(vert_id s, vert_id d) const {
         return _succs[s].contains(d);
     }
 
-    const Weight& edge_val(vert_id s, vert_id d) const {
-        return _ws[*_succs[s].lookup(d)];
-    }
+    const Weight& edge_val(vert_id s, vert_id d) const { return _ws[*_succs[s].lookup(d)]; }
 
     class mut_val_ref_t {
       public:
@@ -311,7 +385,8 @@ class AdaptGraph final {
             assert(w);
             return *w;
         }
-        [[nodiscard]] Weight get() const {
+        [[nodiscard]]
+        Weight get() const {
             assert(w);
             return *w;
         }
@@ -333,7 +408,8 @@ class AdaptGraph final {
         return false;
     }
 
-    [[nodiscard]] std::optional<Weight> lookup(vert_id s, vert_id d) const {
+    [[nodiscard]]
+    std::optional<Weight> lookup(vert_id s, vert_id d) const {
         if (auto idx = _succs[s].lookup(d)) {
             return _ws[*idx];
         }
@@ -381,10 +457,11 @@ class AdaptGraph final {
             auto end = g.e_succs(v).end();
 
             if (it != end) {
-                if (first)
+                if (first) {
                     first = false;
-                else
+                } else {
                     o << ", ";
+                }
 
                 o << "[v" << v << " -> ";
                 o << "(" << (*it).val << ":" << (*it).vert << ")";
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index 5ebb5e1e8..df51d1561 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -67,29 +67,42 @@ class z_number final {
 
     explicit operator cpp_int() const { return _n; }
 
-    [[nodiscard]] std::size_t hash() const {
+    [[nodiscard]]
+    std::size_t hash() const {
         boost::hash<std::string> hasher;
         return hasher(_n.str());
     }
 
-    [[nodiscard]] bool fits_sint32() const {
+    [[nodiscard]]
+    bool fits_sint32() const {
         return ((_n >= INT_MIN) && (_n <= INT_MAX));
     }
 
-    [[nodiscard]] bool fits_uint32() const { return ((_n >= 0) && (_n <= UINT_MAX)); }
+    [[nodiscard]]
+    bool fits_uint32() const {
+        return ((_n >= 0) && (_n <= UINT_MAX));
+    }
 
-    [[nodiscard]] bool fits_sint64() const {
+    [[nodiscard]]
+    bool fits_sint64() const {
         // "long long" is always 64-bits, whereas "long" varies
         // (see https://en.cppreference.com/w/cpp/language/types)
         // so make sure we use 64-bit numbers.
         return ((_n >= LLONG_MIN) && (_n <= LLONG_MAX));
     }
 
-    [[nodiscard]] bool fits_uint64() const { return ((_n >= 0) && (_n <= ULLONG_MAX)); }
+    [[nodiscard]]
+    bool fits_uint64() const {
+        return ((_n >= 0) && (_n <= ULLONG_MAX));
+    }
 
-    [[nodiscard]] bool fits_cast_to_int64() const { return fits_uint64() || fits_sint64(); }
+    [[nodiscard]]
+    bool fits_cast_to_int64() const {
+        return fits_uint64() || fits_sint64();
+    }
 
-    [[nodiscard]] uint64_t cast_to_uint64() const {
+    [[nodiscard]]
+    uint64_t cast_to_uint64() const {
         if (fits_uint64()) {
             return (uint64_t)_n;
         } else if (fits_sint64()) {
@@ -100,7 +113,8 @@ class z_number final {
         }
     }
 
-    [[nodiscard]] uint64_t truncate_to_uint64() const {
+    [[nodiscard]]
+    uint64_t truncate_to_uint64() const {
         if (fits_sint64()) {
             // Convert 64 bits from int64_t to uint64_t.
             return (uint64_t)(int64_t)_n;
@@ -110,7 +124,8 @@ class z_number final {
         }
     }
 
-    [[nodiscard]] uint64_t cast_to_uint32() const {
+    [[nodiscard]]
+    uint64_t cast_to_uint32() const {
         if (fits_uint32()) {
             return (uint32_t)_n;
         } else if (fits_sint32()) {
@@ -121,12 +136,14 @@ class z_number final {
         }
     }
 
-    [[nodiscard]] uint64_t truncate_to_uint32() const {
+    [[nodiscard]]
+    uint64_t truncate_to_uint32() const {
         return (uint32_t)truncate_to_uint64();
     }
 
     // For 64-bit operations, get the value as a signed 64-bit integer.
-    [[nodiscard]] int64_t cast_to_sint64() const {
+    [[nodiscard]]
+    int64_t cast_to_sint64() const {
         if (fits_sint64()) {
             return (int64_t)_n;
         } else if (fits_uint64()) {
@@ -138,7 +155,8 @@ class z_number final {
     }
 
     // For 64-bit operations, get the value as a signed 64-bit integer.
-    [[nodiscard]] int64_t truncate_to_sint64() const {
+    [[nodiscard]]
+    int64_t truncate_to_sint64() const {
         if (fits_sint64()) {
             return (int64_t)_n;
         } else {
@@ -148,17 +166,20 @@ class z_number final {
     }
 
     // For 32-bit operations, get the low 32 bits as a signed integer.
-    [[nodiscard]] int32_t cast_to_sint32() const {
+    [[nodiscard]]
+    int32_t cast_to_sint32() const {
         return (int32_t)cast_to_sint64();
     }
 
     // For 32-bit operations, get the low 32 bits as a signed integer.
-    [[nodiscard]] int32_t truncate_to_sint32() const {
+    [[nodiscard]]
+    int32_t truncate_to_sint32() const {
         return (int32_t)truncate_to_sint64();
     }
 
     // Allow casting to int32_t or int64_t as needed for finite width operations.
-    [[nodiscard]] z_number cast_to_signed_finite_width(int finite_width) const {
+    [[nodiscard]]
+    z_number cast_to_signed_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
         case 32: return cast_to_sint32();
@@ -168,7 +189,8 @@ class z_number final {
     }
 
     // Allow casting to uint32_t or uint64_t as needed for finite width operations.
-    [[nodiscard]] z_number cast_to_unsigned_finite_width(int finite_width) const {
+    [[nodiscard]]
+    z_number cast_to_unsigned_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
         case 32: return cast_to_uint32();
@@ -179,7 +201,8 @@ class z_number final {
 
     // Allow truncating to int32_t or int64_t as needed for finite width operations.
     // Unlike casting, truncating will not throw a crab error if the number doesn't fit.
-    [[nodiscard]] z_number truncate_to_signed_finite_width(int finite_width) const {
+    [[nodiscard]]
+    z_number truncate_to_signed_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
         case 32: return truncate_to_sint32();
@@ -190,7 +213,8 @@ class z_number final {
 
     // Allow truncating to uint32_t or uint64_t as needed for finite width operations.
     // Unlike casting, truncating will not throw a crab error if the number doesn't fit.
-    [[nodiscard]] z_number truncate_to_unsigned_finite_width(int finite_width) const {
+    [[nodiscard]]
+    z_number truncate_to_unsigned_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
         case 32: return truncate_to_uint32();
@@ -199,9 +223,7 @@ class z_number final {
         }
     }
 
-    z_number operator+(const z_number& x) const {
-        return z_number(_n + x._n);
-    }
+    z_number operator+(const z_number& x) const { return z_number(_n + x._n); }
 
     z_number operator*(const z_number& x) const { return z_number(_n * x._n); }
 
@@ -280,9 +302,7 @@ class z_number final {
         return r;
     }
 
-    bool operator==(const z_number& x) const {
-        return (_n == x._n);
-    }
+    bool operator==(const z_number& x) const { return (_n == x._n); }
 
     bool operator!=(const z_number& x) const { return (_n != x._n); }
 
@@ -314,7 +334,8 @@ class z_number final {
         return z_number(_n >> (int32_t)x);
     }
 
-    [[nodiscard]] z_number fill_ones() const {
+    [[nodiscard]]
+    z_number fill_ones() const {
         if (_n.is_zero()) {
             return z_number((signed long long)0);
         }
@@ -325,11 +346,10 @@ class z_number final {
         return result;
     }
 
-    friend std::ostream& operator<<(std::ostream& o, const z_number& z) {
-        return o << z._n.str();
-    }
+    friend std::ostream& operator<<(std::ostream& o, const z_number& z) { return o << z._n.str(); }
 
-    [[nodiscard]] std::string to_string() const;
+    [[nodiscard]]
+    std::string to_string() const;
 };
 // class z_number
 
diff --git a/src/crab_utils/graph_ops.hpp b/src/crab_utils/graph_ops.hpp
index 4dfd503db..4fe3910fa 100644
--- a/src/crab_utils/graph_ops.hpp
+++ b/src/crab_utils/graph_ops.hpp
@@ -21,7 +21,6 @@ namespace crab {
 // of the graph without actually constructing it.
 // ============
 
-
 // Processing a graph under a (possibly incomplete)
 // permutation of vertices.
 // We assume perm[x] is unique; otherwise, we'd have
@@ -36,8 +35,9 @@ class GraphPerm {
 
     GraphPerm(const std::vector<vert_id>& _perm, G& _g) : g(_g), perm(_perm), inv(_g.size(), -1) {
         for (unsigned int vi = 0; vi < perm.size(); vi++) {
-            if (perm[vi] == -1)
+            if (perm[vi] == -1) {
                 continue;
+            }
             assert(inv[perm[vi]] == -1);
             inv[perm[vi]] = vi;
         }
@@ -45,20 +45,23 @@ class GraphPerm {
 
     // Check whether an edge is live
     bool elem(vert_id x, vert_id y) const {
-        if (perm[x] > g.size() || perm[y] > g.size())
+        if (perm[x] > g.size() || perm[y] > g.size()) {
             return false;
+        }
         return g.elem(perm[x], perm[y]);
     }
 
     bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) {
-        if (perm[x] > g.size() || perm[y] > g.size())
+        if (perm[x] > g.size() || perm[y] > g.size()) {
             return false;
+        }
         return g.lookup(perm[x], perm[y], w);
     }
 
     std::optional<Weight> lookup(vert_id x, vert_id y) const {
-        if (perm[x] > g.size() || perm[y] > g.size())
+        if (perm[x] > g.size() || perm[y] > g.size()) {
             return {};
+        }
         return g.lookup(perm[x], perm[y]);
     }
 
@@ -75,7 +78,10 @@ class GraphPerm {
     }
 
     // Number of allocated vertices
-    [[nodiscard]] size_t size() const { return perm.size(); }
+    [[nodiscard]]
+    size_t size() const {
+        return perm.size();
+    }
 
     class vert_const_range final {
       public:
@@ -123,8 +129,9 @@ class GraphPerm {
         }
 
         bool operator!=(const adj_const_iterator& other) {
-            while (v != other.v && inv[*v] == (-1))
+            while (v != other.v && inv[*v] == (-1)) {
                 ++v;
+            }
             return v != other.v;
         }
 
@@ -148,8 +155,9 @@ class GraphPerm {
         }
 
         bool operator!=(const e_adj_const_iterator& other) {
-            while (v != other.v && inv[(*v).vert] == (-1))
+            while (v != other.v && inv[(*v).vert] == (-1)) {
                 ++v;
+            }
             return v != other.v;
         }
 
@@ -171,21 +179,25 @@ class GraphPerm {
         adj_list(const std::vector<vert_id>& _perm, const std::vector<vert_id>& _inv) : perm(_perm), inv(_inv), adj() {}
 
         iterator begin() const {
-            if (adj)
+            if (adj) {
                 return iterator(inv, (*adj).begin());
-            else
+            } else {
                 return iterator(inv, ItG::empty_iterator());
+            }
         }
         iterator end() const {
-            if (adj)
+            if (adj) {
                 return iterator(inv, (*adj).end());
-            else
+            } else {
                 return iterator(inv, ItG::empty_iterator());
+            }
         }
 
-        [[nodiscard]] bool mem(unsigned int v) const {
-            if (!adj || perm[v] == (-1))
+        [[nodiscard]]
+        bool mem(unsigned int v) const {
+            if (!adj || perm[v] == (-1)) {
                 return false;
+            }
             return (*adj).mem(perm[v]);
         }
 
@@ -205,24 +217,29 @@ class GraphPerm {
         const_adj_list(const std::vector<vert_id>& _perm, const std::vector<vert_id>& _inv, const RG& _adj)
             : perm(_perm), inv(_inv), adj(_adj) {}
 
-        const_adj_list(const std::vector<vert_id>& _perm, const std::vector<vert_id>& _inv) : perm(_perm), inv(_inv), adj() {}
+        const_adj_list(const std::vector<vert_id>& _perm, const std::vector<vert_id>& _inv)
+            : perm(_perm), inv(_inv), adj() {}
 
         iterator begin() const {
-            if (adj)
+            if (adj) {
                 return iterator(inv, (*adj).begin());
-            else
+            } else {
                 return iterator(inv, ItG::empty_iterator());
+            }
         }
         iterator end() const {
-            if (adj)
+            if (adj) {
                 return iterator(inv, (*adj).end());
-            else
+            } else {
                 return iterator(inv, ItG::empty_iterator());
+            }
         }
 
-        [[nodiscard]] bool mem(unsigned int v) const {
-            if (!adj || perm[v] == (-1))
+        [[nodiscard]]
+        bool mem(unsigned int v) const {
+            if (!adj || perm[v] == (-1)) {
                 return false;
+            }
             return (*adj).mem(perm[v]);
         }
 
@@ -232,36 +249,43 @@ class GraphPerm {
         std::optional<RG> adj;
     };
 
-//    using neighbour_range = adj_list<typename G::neighbour_range, adj_iterator<typename G::neighbour_range::iterator>>;
-//    using e_neighbour_range = adj_list<typename G::e_neighbour_range, e_adj_iterator<typename G::e_neighbour_range::iterator>>;
+    //    using neighbour_range = adj_list<typename G::neighbour_range, adj_iterator<typename
+    //    G::neighbour_range::iterator>>; using e_neighbour_range = adj_list<typename G::e_neighbour_range,
+    //    e_adj_iterator<typename G::e_neighbour_range::iterator>>;
 
-    using neighbour_const_range = const_adj_list<typename G::neighbour_const_range, adj_const_iterator<typename G::neighbour_const_range::iterator>>;
-    using e_neighbour_const_range = const_adj_list<typename G::e_neighbour_const_range, e_adj_const_iterator<typename G::e_neighbour_const_range::iterator>>;
+    using neighbour_const_range = const_adj_list<typename G::neighbour_const_range,
+                                                 adj_const_iterator<typename G::neighbour_const_range::iterator>>;
+    using e_neighbour_const_range = const_adj_list<typename G::e_neighbour_const_range,
+                                                   e_adj_const_iterator<typename G::e_neighbour_const_range::iterator>>;
 
     neighbour_const_range succs(vert_id v) const {
-        if (perm[v] == (-1))
+        if (perm[v] == (-1)) {
             return neighbour_const_range(perm, inv);
-        else
+        } else {
             return neighbour_const_range(perm, inv, g.succs(perm[v]));
+        }
     }
     neighbour_const_range preds(vert_id v) const {
-        if (perm[v] == (-1))
+        if (perm[v] == (-1)) {
             return neighbour_const_range(perm, inv);
-        else
+        } else {
             return neighbour_const_range(perm, inv, g.preds(perm[v]));
+        }
     }
 
     e_neighbour_const_range e_succs(vert_id v) const {
-        if (perm[v] == (-1))
+        if (perm[v] == (-1)) {
             return e_neighbour_const_range(perm, inv);
-        else
+        } else {
             return e_neighbour_const_range(perm, inv, g.e_succs(perm[v]));
+        }
     }
     e_neighbour_const_range e_preds(vert_id v) const {
-        if (perm[v] == (-1))
+        if (perm[v] == (-1)) {
             return e_neighbour_const_range(perm, inv);
-        else
+        } else {
             return e_neighbour_const_range(perm, inv, g.e_preds(perm[v]));
+        }
     }
 
     const G& g;
@@ -285,9 +309,7 @@ class SubGraph {
 
     bool elem(vert_id x, vert_id y) const { return (x != v_ex && y != v_ex && g.elem(x, y)); }
 
-    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) {
-        return (x != v_ex && y != v_ex && g.lookup(x, y, w));
-    }
+    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) { return (x != v_ex && y != v_ex && g.lookup(x, y, w)); }
 
     std::optional<Weight> lookup(vert_id x, vert_id y) const {
         return (x != v_ex && y != v_ex) ? g.lookup(x, y) : std::optional<Weight>{};
@@ -303,7 +325,10 @@ class SubGraph {
     void clear() { assert(0 && "SubGraph::clear not implemented."); }
 
     // Number of allocated vertices
-    [[nodiscard]] size_t size() const { return g.size(); }
+    [[nodiscard]]
+    size_t size() const {
+        return g.size();
+    }
 
     // Assumption: (x, y) not in mtx
     void add_edge(vert_id x, Weight wt, vert_id y) {
@@ -334,8 +359,9 @@ class SubGraph {
             return *this;
         }
         bool operator!=(const vert_const_iterator& o) {
-            if (iG != o.iG && (*iG) == v_ex)
+            if (iG != o.iG && (*iG) == v_ex) {
                 ++iG;
+            }
             return iG != o.iG;
         }
 
@@ -364,8 +390,9 @@ class SubGraph {
             return *this;
         }
         bool operator!=(const adj_iterator& o) {
-            if (iG != o.iG && (*iG) == v_ex)
+            if (iG != o.iG && (*iG) == v_ex) {
                 ++iG;
+            }
             return iG != o.iG;
         }
 
@@ -385,8 +412,9 @@ class SubGraph {
             return *this;
         }
         bool operator!=(const e_adj_iterator& o) {
-            if (iG != o.iG && (*iG).vert == v_ex)
+            if (iG != o.iG && (*iG).vert == v_ex) {
                 ++iG;
+            }
             return iG != o.iG;
         }
 
@@ -408,8 +436,10 @@ class SubGraph {
         R rG;
         vert_id v_ex;
     };
-    using neighbour_const_range = adj_list<g_neighbour_const_range, adj_iterator<typename g_neighbour_const_range::iterator>>;
-    using e_neighbour_const_range = adj_list<g_e_neighbour_const_range, e_adj_iterator<typename g_e_neighbour_const_range::iterator>>;
+    using neighbour_const_range =
+        adj_list<g_neighbour_const_range, adj_iterator<typename g_neighbour_const_range::iterator>>;
+    using e_neighbour_const_range =
+        adj_list<g_e_neighbour_const_range, e_adj_iterator<typename g_e_neighbour_const_range::iterator>>;
 
     neighbour_const_range succs(vert_id v) const {
         //      assert(v != v_ex);
@@ -442,9 +472,7 @@ class GraphRev {
     // Check whether an edge is live
     bool elem(vert_id x, vert_id y) const { return g.elem(y, x); }
 
-    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) {
-        return g.lookup(y, x, w);
-    }
+    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) { return g.lookup(y, x, w); }
     std::optional<Weight> lookup(vert_id x, vert_id y) const { return g.lookup(y, x); }
 
     // Precondition: elem(x, y) is true.
@@ -454,7 +482,10 @@ class GraphRev {
     Weight operator()(vert_id x, vert_id y) const { return g(y, x); }
 
     // Number of allocated vertices
-    [[nodiscard]] int size() const { return g.size(); }
+    [[nodiscard]]
+    int size() const {
+        return g.size();
+    }
 
     //    using adj_list = typename G::adj_list;
 
@@ -530,8 +561,7 @@ class GraphOps {
     static thread_local unsigned int ts;
     static thread_local unsigned int ts_idx;
 
-    static void clear_thread_local_state()
-    {
+    static void clear_thread_local_state() {
         dists.clear();
         dists_alt.clear();
         dist_ts.clear();
@@ -544,14 +574,17 @@ class GraphOps {
     }
 
     static void grow_scratch(size_t sz) {
-        if (sz <= scratch_sz)
+        if (sz <= scratch_sz) {
             return;
+        }
 
         size_t new_sz = scratch_sz;
-        if (new_sz == 0)
+        if (new_sz == 0) {
             new_sz = 10; // TODO: Introduce enums for init_sz and growth_factor
-        while (new_sz < sz)
+        }
+        while (new_sz < sz) {
             new_sz = static_cast<size_t>(new_sz * 1.5);
+        }
 
         edge_marks->resize(new_sz * new_sz);
         dual_queue->resize(2 * new_sz);
@@ -581,8 +614,9 @@ class GraphOps {
         for (vert_id s : l.verts()) {
             for (auto e : l.e_succs(s)) {
                 vert_id d = e.vert;
-                if (r.lookup(s, d, &wr))
+                if (r.lookup(s, d, &wr)) {
                     g.add_edge(s, std::max(e.val, (Weight)wr), d);
+                }
             }
         }
         return g;
@@ -613,8 +647,9 @@ class GraphOps {
                 if (!g.lookup(s, e.vert, &wg)) {
                     g.add_edge(s, e.val, e.vert);
                 } else {
-                    if (e.val < wg)
+                    if (e.val < wg) {
                         wg = e.val;
+                    }
                 }
             }
         }
@@ -631,9 +666,11 @@ class GraphOps {
         for (vert_id s : r.verts()) {
             for (auto e : r.e_succs(s)) {
                 vert_id d = e.vert;
-                if (auto wl = l.lookup(s, d))
-                    if (e.val <= *wl)
+                if (auto wl = l.lookup(s, d)) {
+                    if (e.val <= *wl) {
                         g.add_edge(s, *wl, d);
+                    }
+                }
             }
 
             // Check if this vertex is stable
@@ -691,13 +728,15 @@ class GraphOps {
         size_t sz = x.size();
         grow_scratch(sz);
 
-        for (vert_id v : x.verts())
+        for (vert_id v : x.verts()) {
             vert_marks->at(v) = 0;
+        }
         int index = 1;
         std::vector<vert_id> stack;
         for (vert_id v : x.verts()) {
-            if (!vert_marks->at(v))
+            if (!vert_marks->at(v)) {
                 strong_connect(x, stack, index, v, out_scc);
+            }
         }
         /*
         printf("[");
@@ -711,8 +750,9 @@ class GraphOps {
         printf("]\n");
         */
 
-        for (vert_id v : x.verts())
+        for (vert_id v : x.verts()) {
             vert_marks->at(v) = 0;
+        }
     }
 
     // Run Bellman-Ford to compute a valid model of a set of difference constraints.
@@ -781,8 +821,9 @@ class GraphOps {
                 std::swap(qhead, next_head);
                 qtail = next_tail;
                 next_tail = next_head;
-                if (qhead == qtail)
+                if (qhead == qtail) {
                     break;
+                }
             }
             // Check if the SCC is feasible.
             for (; qtail != qhead;) {
@@ -792,8 +833,9 @@ class GraphOps {
                     vert_id d = e.vert;
                     if (s_pot + e.val < potentials[d]) {
                         // Cleanup vertex marks
-                        for (vert_id v : g.verts())
+                        for (vert_id v : g.verts()) {
                             vert_marks->at(v) = BF_NONE;
+                        }
                         return false;
                     }
                 }
@@ -820,12 +862,16 @@ class GraphOps {
             for (auto e : g.e_succs(s)) {
                 unsigned char mark = 0;
                 vert_id d = e.vert;
-                if (auto w = l.lookup(s, d))
-                    if (*w == e.val)
+                if (auto w = l.lookup(s, d)) {
+                    if (*w == e.val) {
                         mark |= E_LEFT;
-                if (auto w = r.lookup(s, d))
-                    if (*w == e.val)
+                    }
+                }
+                if (auto w = r.lookup(s, d)) {
+                    if (*w == e.val) {
                         mark |= E_RIGHT;
+                    }
+                }
                 // Add them to the appropriate coloured successor list
                 // Could do it inline, but this'll do.
                 assert(mark != 0);
@@ -847,8 +893,9 @@ class GraphOps {
             adjs.clear();
             chrome_dijkstra(g, pots, colour_succs, v, adjs);
 
-            for (const auto& [d, w] : adjs)
+            for (const auto& [d, w] : adjs) {
                 delta.emplace_back(v, d, w);
+            }
         }
         return delta;
     }
@@ -868,8 +915,9 @@ class GraphOps {
     static void chrome_dijkstra(const G& g, const P& p, std::vector<std::vector<vert_id>>& colour_succs, vert_id src,
                                 std::vector<std::tuple<vert_id, Weight>>& out) {
         size_t sz = g.size();
-        if (sz == 0)
+        if (sz == 0) {
             return;
+        }
         grow_scratch(sz);
 
         // Reset all vertices to infty.
@@ -897,12 +945,14 @@ class GraphOps {
             Weight es_val = es_cost - p[src];
             {
                 auto w = g.lookup(src, es);
-                if (!w || *w > es_val)
+                if (!w || *w > es_val) {
                     out.emplace_back(es, es_val);
+                }
             }
 
-            if (vert_marks->at(es) == (E_LEFT | E_RIGHT))
+            if (vert_marks->at(es) == (E_LEFT | E_RIGHT)) {
                 continue;
+            }
 
             // Pick the appropriate set of successors
             std::vector<vert_id>& es_succs =
@@ -933,10 +983,12 @@ class GraphOps {
     static void dijkstra_recover(const G& g, const P& p, const S& is_stable, vert_id src,
                                  std::vector<std::tuple<vert_id, Weight>>& out) {
         size_t sz = g.size();
-        if (sz == 0)
+        if (sz == 0) {
             return;
-        if (is_stable[src])
+        }
+        if (is_stable[src]) {
             return;
+        }
 
         grow_scratch(sz);
 
@@ -965,11 +1017,13 @@ class GraphOps {
             Weight es_val = es_cost - p[src];
             {
                 auto w = g.lookup(src, es);
-                if (!w || *w > es_val)
+                if (!w || *w > es_val) {
                     out.emplace_back(es, es_val);
+                }
             }
-            if (vert_marks->at(es) == V_STABLE)
+            if (vert_marks->at(es) == V_STABLE) {
                 continue;
+            }
 
             char es_mark = is_stable[es] ? V_STABLE : V_UNSTABLE;
 
@@ -1007,8 +1061,9 @@ class GraphOps {
         }
         dists->at(jj) = p[ii] + g.edge_val(ii, jj) - p[jj];
 
-        if (dists->at(jj) >= Weight(0))
+        if (dists->at(jj) >= Weight(0)) {
             return true;
+        }
 
         WtComp comp(*dists);
         WtHeap heap(comp);
@@ -1035,11 +1090,13 @@ class GraphOps {
                 }
             }
         }
-        if (dists->at(ii) < Weight(0))
+        if (dists->at(ii) < Weight(0)) {
             return false;
+        }
 
-        for (vert_id v : g.verts())
+        for (vert_id v : g.verts()) {
             p[v] = dists_alt->at(v);
+        }
 
         return true;
     }
@@ -1061,8 +1118,9 @@ class GraphOps {
             if (!edge_marks->at(v)) {
                 aux.clear();
                 dijkstra_recover(g, p, edge_marks->begin(), v, aux);
-                for (auto [vid, wt] : aux)
+                for (auto [vid, wt] : aux) {
                     delta.emplace_back(v, vid, wt);
+                }
             }
         }
         return delta;
@@ -1103,10 +1161,12 @@ class GraphOps {
     // Compute the transitive closure of edges reachable from v, assuming
     // (1) the subgraph G \ {v} is closed, and (2) P is a valid model of G.
     template <class G, class P>
-    static void close_after_assign_fwd(const G& g, const P& p, vert_id v, std::vector<std::tuple<vert_id, Weight>>& aux) {
+    static void close_after_assign_fwd(const G& g, const P& p, vert_id v,
+                                       std::vector<std::tuple<vert_id, Weight>>& aux) {
         // Initialize the queue and distances.
-        for (vert_id u : g.verts())
+        for (vert_id u : g.verts()) {
             vert_marks->at(u) = 0;
+        }
 
         vert_marks->at(v) = BF_QUEUED;
         dists->at(v) = Weight(0);
@@ -1166,8 +1226,9 @@ class GraphOps {
             if (se != jj) {
                 typename graph_t::mut_val_ref_t w;
                 if (g_excl.lookup(se, jj, &w)) {
-                    if (w.get() <= wt_sij)
+                    if (w.get() <= wt_sij) {
                         continue;
+                    }
                     w = wt_sij;
                 } else {
                     g_excl.add_edge(se, wt_sij, jj);
@@ -1183,8 +1244,9 @@ class GraphOps {
             if (de != ii) {
                 typename graph_t::mut_val_ref_t w;
                 if (g_excl.lookup(ii, de, &w)) {
-                    if (w.get() <= wt_ijd)
+                    if (w.get() <= wt_ijd) {
                         continue;
+                    }
                     w = wt_ijd;
                 } else {
                     g_excl.add_edge(ii, wt_ijd, de);
@@ -1199,8 +1261,9 @@ class GraphOps {
                 Weight wt_sijd = wt_sij + p2;
                 typename graph_t::mut_val_ref_t w;
                 if (g.lookup(se, de, &w)) {
-                    if (w.get() <= wt_sijd)
+                    if (w.get() <= wt_sijd) {
                         continue;
+                    }
                     w = wt_sijd;
                 } else {
                     g.add_edge(se, wt_sijd, de);
@@ -1219,15 +1282,17 @@ class GraphOps {
         {
             std::vector<std::tuple<vert_id, Weight>> aux;
             close_after_assign_fwd(g, p, v, aux);
-            for (auto [vid, wt] : aux)
+            for (auto [vid, wt] : aux) {
                 delta.emplace_back(v, vid, wt);
+            }
         }
         {
             std::vector<std::tuple<vert_id, Weight>> aux;
             GraphRev<const G> g_rev(g);
             close_after_assign_fwd(g_rev, make_negp(p), v, aux);
-            for (auto [vid, wt] : aux)
+            for (auto [vid, wt] : aux) {
                 delta.emplace_back(vid, v, wt);
+            }
         }
         return delta;
     }
@@ -1247,7 +1312,6 @@ thread_local lazy_allocator<std::vector<int>> GraphOps<Weight>::vert_marks;
 template <class Weight>
 thread_local size_t GraphOps<Weight>::scratch_sz = 0;
 
-
 template <class G>
 thread_local lazy_allocator<std::vector<typename G::Weight>> GraphOps<G>::dists;
 template <class G>
diff --git a/src/crab_utils/heap.hpp b/src/crab_utils/heap.hpp
index fad88c7f4..bc8e8a367 100644
--- a/src/crab_utils/heap.hpp
+++ b/src/crab_utils/heap.hpp
@@ -54,9 +54,11 @@ class Heap {
     inline void percolateDown(int i) {
         int x = heap[i];
         while (static_cast<size_t>(left(i)) < heap.size()) {
-            int child = static_cast<size_t>(right(i)) < heap.size() && lt(heap[right(i)], heap[left(i)]) ? right(i) : left(i);
-            if (!lt(heap[child], x))
+            int child =
+                static_cast<size_t>(right(i)) < heap.size() && lt(heap[right(i)], heap[left(i)]) ? right(i) : left(i);
+            if (!lt(heap[child], x)) {
                 break;
+            }
             heap[i] = heap[child];
             indices[heap[i]] = i;
             i = child;
@@ -65,7 +67,8 @@ class Heap {
         indices[x] = i;
     }
 
-    [[nodiscard]] bool heapProperty(int i) const {
+    [[nodiscard]]
+    bool heapProperty(int i) const {
         return i >= heap.size() ||
                ((i == 0 || !lt(heap[i], heap[parent(i)])) && heapProperty(left(i)) && heapProperty(right(i)));
     }
@@ -73,9 +76,18 @@ class Heap {
   public:
     explicit Heap(const Comp& c) : lt(c) {}
 
-    [[nodiscard]] int size() const { return heap.size(); }
-    [[nodiscard]] bool empty() const { return heap.empty(); }
-    [[nodiscard]] bool inHeap(int n) const { return static_cast<size_t>(n) < indices.size() && indices[n] >= 0; }
+    [[nodiscard]]
+    int size() const {
+        return heap.size();
+    }
+    [[nodiscard]]
+    bool empty() const {
+        return heap.empty();
+    }
+    [[nodiscard]]
+    bool inHeap(int n) const {
+        return static_cast<size_t>(n) < indices.size() && indices[n] >= 0;
+    }
     int operator[](int index) const {
         assert(static_cast<size_t>(index) < heap.size());
         return heap[index];
@@ -88,8 +100,9 @@ class Heap {
 
     void insert(int n) {
         assert(n >= 0);
-        if (static_cast<size_t>(n) >= indices.size())
+        if (static_cast<size_t>(n) >= indices.size()) {
             indices.resize(n + 1, -1);
+        }
         assert(!inHeap(n));
 
         indices[n] = static_cast<int>(heap.size());
@@ -103,17 +116,20 @@ class Heap {
         indices[heap[0]] = 0;
         indices[x] = -1;
         heap.pop_back();
-        if (heap.size() > 1)
+        if (heap.size() > 1) {
             percolateDown(0);
+        }
         return x;
     }
 
     void clear() {
-        for (int i : heap)
+        for (int i : heap) {
             indices[i] = -1;
+        }
 #ifdef NDEBUG
-        for (int i = 0; i < indices.size(); i++)
+        for (int i = 0; i < indices.size(); i++) {
             assert(indices[i] == -1);
+        }
 #endif
         heap.clear();
     }
diff --git a/src/crab_utils/lazy_allocator.hpp b/src/crab_utils/lazy_allocator.hpp
index 9105ddff9..1280eae4b 100644
--- a/src/crab_utils/lazy_allocator.hpp
+++ b/src/crab_utils/lazy_allocator.hpp
@@ -1,103 +1,94 @@
 // Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
 #pragma once
 
 #include "debug.hpp"
 #include <optional>
 
 namespace crab {
+/**
+ * @brief The default factory for lazy_allocator that creates objects using the default constructor.
+ *
+ * @tparam T The type of the object to create.
+ */
+template <typename T>
+struct lazy_allocator_default_factory {
+    T operator()() { return T(); }
+};
+
+/**
+ * @brief A factory that fails the allocation of objects (to enforce setting the value before using it).
+ *
+ * @tparam T The type of the object to create.
+ */
+template <typename T>
+struct lazy_allocator_no_default_factory {
+    T operator()() { CRAB_ERROR("lazy_allocator_no_default"); }
+};
+
+/**
+ * @brief Lazy allocator for objects of type T. The allocator does not allocate the object until it is first accessed.
+ *
+ * @tparam T The type of the object to allocate.
+ * @tparam factory The factory to use to create the object. The factory must be callable with no arguments and return an
+ * object of type T. The default factory creates the object using the default constructor. The no_default_factory fails
+ * the allocation of the object. The caller can provide a custom factory to create the object in a specific way.
+ */
+template <typename T, template <typename TInner> typename factory = lazy_allocator_default_factory>
+class lazy_allocator {
+    std::optional<T> _value;
+
+  public:
     /**
-     * @brief The default factory for lazy_allocator that creates objects using the default constructor.
+     * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
      *
-     * @tparam T The type of the object to create.
+     * @return The allocated object.
      */
-    template <typename T>
-    struct lazy_allocator_default_factory {
-        T operator()() { return T(); }
-    };
+    T& get() {
+        if (!_value.has_value()) {
+            _value = factory<T>()();
+        }
+        return _value.value();
+    }
 
     /**
-     * @brief A factory that fails the allocation of objects (to enforce setting the value before using it).
-     *
-     * @tparam T The type of the object to create.
+     * @brief Delete the currently allocated object.
      */
-    template <typename T>
-    struct lazy_allocator_no_default_factory {
-        T operator()() { CRAB_ERROR("lazy_allocator_no_default"); }
-    };
+    void clear() { _value.reset(); }
 
     /**
-     * @brief Lazy allocator for objects of type T. The allocator does not allocate the object until it is first accessed.
+     * @brief Allocate the object using the value.
      *
-     * @tparam T The type of the object to allocate.
-     * @tparam factory The factory to use to create the object. The factory must be callable with no arguments and return an object of type T.
-     *                The default factory creates the object using the default constructor.
-     *                The no_default_factory fails the allocation of the object.
-     *                The caller can provide a custom factory to create the object in a specific way.
+     * @param[in] value The value to copy.
      */
-    template <typename T, template <typename TInner> typename factory = lazy_allocator_default_factory>
-    class lazy_allocator {
-        std::optional<T> _value;
-
-      public:
-        /**
-         * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
-         *
-         * @return The allocated object.
-         */
-        T& get() {
-            if (!_value.has_value()) {
-                _value = factory<T>()();
-            }
-            return _value.value();
-        }
-
-        /**
-         * @brief Delete the currently allocated object.
-         */
-        void clear() {
-            _value.reset();
-        }
+    void set(T value) { _value = value; }
 
-        /**
-         * @brief Allocate the object using the value.
-         *
-         * @param[in] value The value to copy.
-         */
-        void set(T value) {
-            _value = value;
-        }
-
-        // Ideally we would overload the . operator, but that is not possible
-        // so we use -> instead and modify the callers from . to ->
+    // Ideally we would overload the . operator, but that is not possible
+    // so we use -> instead and modify the callers from . to ->
 
-        /**
-         * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
-         *
-         * @return The allocated object.
-         */
-        T* operator->() {
-            return &get();
-        }
+    /**
+     * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
+     *
+     * @return The allocated object.
+     */
+    T* operator->() { return &get(); }
 
-        /**
-         * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
-         *
-         * @return The allocated object.
-         */
-        T& operator*() {
-            return get();
-        }
+    /**
+     * @brief Get the currently allocated object or allocate it if it has not been allocated yet.
+     *
+     * @return The allocated object.
+     */
+    T& operator*() { return get(); }
 
-        /**
-         * @brief Assign the value to the currently allocated object.
-         *
-         * @param[in] value The value to assign.
-         * @return The allocated object.
-         */
-        T& operator=(const T& value) {
-            _value.emplace(value);
-            return get();
-        }
-    };
-}
+    /**
+     * @brief Assign the value to the currently allocated object.
+     *
+     * @param[in] value The value to assign.
+     * @return The allocated object.
+     */
+    T& operator=(const T& value) {
+        _value.emplace(value);
+        return get();
+    }
+};
+} // namespace crab
diff --git a/src/crab_utils/safeint.hpp b/src/crab_utils/safeint.hpp
index ef79eb411..f2498f109 100644
--- a/src/crab_utils/safeint.hpp
+++ b/src/crab_utils/safeint.hpp
@@ -30,32 +30,42 @@ class safe_i64 {
     using wideint_t = boost::multiprecision::int128_t;
 #endif
 
-    [[nodiscard]] static constexpr int64_t get_max() { return std::numeric_limits<int64_t>::max(); }
-    [[nodiscard]] static constexpr int64_t get_min() { return std::numeric_limits<int64_t>::min(); }
+    [[nodiscard]]
+    static constexpr int64_t get_max() {
+        return std::numeric_limits<int64_t>::max();
+    }
+    [[nodiscard]]
+    static constexpr int64_t get_min() {
+        return std::numeric_limits<int64_t>::min();
+    }
 
     static std::optional<int64_t> checked_add(int64_t a, int64_t b) {
         wideint_t lr = (wideint_t)a + (wideint_t)b;
-        if (lr > get_max() || lr < get_min())
+        if (lr > get_max() || lr < get_min()) {
             return {};
+        }
         return static_cast<int64_t>(lr);
     }
 
     static std::optional<int64_t> checked_sub(int64_t a, int64_t b) {
         wideint_t lr = (wideint_t)a - (wideint_t)b;
-        if (lr > get_max() || lr < get_min())
+        if (lr > get_max() || lr < get_min()) {
             return {};
+        }
         return static_cast<int64_t>(lr);
     }
     static std::optional<int64_t> checked_mul(int64_t a, int64_t b) {
         wideint_t lr = (wideint_t)a * (wideint_t)b;
-        if (lr > get_max() || lr < get_min())
+        if (lr > get_max() || lr < get_min()) {
             return {};
+        }
         return static_cast<int64_t>(lr);
     }
     static std::optional<int64_t> checked_div(int64_t a, int64_t b) {
         wideint_t lr = (wideint_t)a / (wideint_t)b;
-        if (lr > get_max() || lr < get_min())
+        if (lr > get_max() || lr < get_min()) {
             return {};
+        }
         return static_cast<int64_t>(lr);
     }
 
@@ -69,7 +79,7 @@ class safe_i64 {
     operator int64_t() const { return (int64_t)m_num; }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator+(safe_i64 x) const{
+    safe_i64 operator+(safe_i64 x) const {
         if (auto z = checked_add(m_num, x.m_num)) {
             return safe_i64(*z);
         }
@@ -93,7 +103,7 @@ class safe_i64 {
     }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator/(safe_i64 x) const{
+    safe_i64 operator/(safe_i64 x) const {
         if (auto z = checked_div(m_num, x.m_num)) {
             return safe_i64(*z);
         }
@@ -103,16 +113,11 @@ class safe_i64 {
     // TODO: output parameters whether operation overflows
     safe_i64 operator-() const { return safe_i64(0) - *this; }
 
-
     // TODO: output parameters whether operation overflows
-    safe_i64& operator+=(safe_i64 x) {
-        return *this = *this + x;
-    }
+    safe_i64& operator+=(safe_i64 x) { return *this = *this + x; }
 
     // TODO: output parameters whether operation overflows
-    safe_i64& operator-=(safe_i64 x) {
-        return *this = *this - x;
-    }
+    safe_i64& operator-=(safe_i64 x) { return *this = *this - x; }
 
     bool operator==(safe_i64 x) const { return m_num == x.m_num; }
 
@@ -124,7 +129,7 @@ class safe_i64 {
 
     bool operator>(safe_i64 x) const { return m_num > x.m_num; }
 
-    bool operator>=(safe_i64 x) const{ return m_num >= x.m_num; }
+    bool operator>=(safe_i64 x) const { return m_num >= x.m_num; }
 
     friend std::ostream& operator<<(std::ostream& o, const safe_i64& n) { return o << n.m_num; }
 
diff --git a/src/crab_utils/stats.cpp b/src/crab_utils/stats.cpp
index bcc0b0e49..62c823f04 100644
--- a/src/crab_utils/stats.cpp
+++ b/src/crab_utils/stats.cpp
@@ -16,8 +16,7 @@ namespace crab {
 thread_local crab::lazy_allocator<std::map<std::string, unsigned>> CrabStats::counters;
 thread_local crab::lazy_allocator<std::map<std::string, Stopwatch>> CrabStats::sw;
 
-void CrabStats::clear_thread_local_state()
-{
+void CrabStats::clear_thread_local_state() {
     counters.clear();
     sw.clear();
 }
@@ -65,10 +64,11 @@ void Stopwatch::resume() {
 }
 
 long Stopwatch::getTimeElapsed() const {
-    if (finished < started)
+    if (finished < started) {
         return timeElapsed + systemTime() - started;
-    else
+    } else {
         return timeElapsed + finished - started;
+    }
 }
 
 double Stopwatch::toSeconds() {
@@ -82,10 +82,12 @@ void Stopwatch::Print(std::ostream& out) const {
     long m = time / 60000000L - h * 60;
     float s = ((float)time / 1000000L) - m * 60 - h * 3600;
 
-    if (h > 0)
+    if (h > 0) {
         out << h << "h";
-    if (m > 0)
+    }
+    if (m > 0) {
         out << m << "m";
+    }
     out << s << "s";
 }
 
@@ -107,19 +109,23 @@ void CrabStats::resume(const std::string& name) { (*sw)[name].resume(); }
 /** Outputs all statistics to std output */
 void CrabStats::Print(std::ostream& OS) {
     OS << "\n\n************** STATS ***************** \n";
-    for (auto& kv : (*counters))
+    for (auto& kv : (*counters)) {
         OS << kv.first << ": " << kv.second << "\n";
-    for (auto& kv : (*sw))
+    }
+    for (auto& kv : (*sw)) {
         OS << kv.first << ": " << kv.second << "\n";
+    }
     OS << "************** STATS END ***************** \n";
 }
 
 void CrabStats::PrintBrunch(std::ostream& OS) {
     OS << "\n\n************** BRUNCH STATS ***************** \n";
-    for (auto& kv : (*counters))
+    for (auto& kv : (*counters)) {
         OS << "BRUNCH_STAT " << kv.first << " " << kv.second << "\n";
-    for (auto& kv : (*sw))
+    }
+    for (auto& kv : (*sw)) {
         OS << "BRUNCH_STAT " << kv.first << " " << (kv.second).toSeconds() << "sec \n";
+    }
     OS << "************** BRUNCH STATS END ***************** \n";
 }
 
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 06caf8510..7a8c776e5 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -45,12 +45,14 @@ struct checks_db final {
         total_unreachable++;
     }
 
-    [[nodiscard]] int get_max_loop_count() const {
+    [[nodiscard]]
+    int get_max_loop_count() const {
         auto m = this->max_loop_count.number();
-        if (m && m->fits_sint32())
+        if (m && m->fits_sint32()) {
             return m->cast_to_sint32();
-        else
+        } else {
             return std::numeric_limits<int>::max();
+        }
     }
     checks_db() = default;
 };
@@ -63,8 +65,9 @@ static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invari
         ebpf_domain_t from_inv(pre_invariants.at(label));
         from_inv.set_require_check(
             [&m_db, label](auto& inv, const crab::linear_constraint_t& cst, const std::string& s) {
-                if (inv.is_bottom())
+                if (inv.is_bottom()) {
                     return true;
+                }
                 if (cst.is_contradiction()) {
                     m_db.add_warning(label, s);
                     return false;
@@ -102,8 +105,9 @@ static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invari
 static auto get_line_info(const InstructionSeq& insts) {
     std::map<int, btf_line_info_t> label_to_line_info;
     for (auto& [label, inst, line_info] : insts) {
-        if (line_info.has_value())
+        if (line_info.has_value()) {
             label_to_line_info.emplace(label.from, line_info.value());
+        }
     }
     return label_to_line_info;
 }
@@ -115,8 +119,9 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
         for (const auto& msg : messages) {
             if (print_line_info) {
                 auto line_info = label_to_line_info.find(label.from);
-                if (line_info != label_to_line_info.end())
+                if (line_info != label_to_line_info.end()) {
                     os << line_info->second;
+                }
             }
             os << label << ": " << msg << "\n";
         }
@@ -165,8 +170,9 @@ static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
 /// Returned value is true if the program passes verification.
 bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, const ebpf_verifier_options_t* options,
                        ebpf_verifier_stats_t* stats) {
-    if (options == nullptr)
+    if (options == nullptr) {
         options = &ebpf_verifier_default_options;
+    }
     checks_db report = get_ebpf_report(s, cfg, info, options);
     if (stats) {
         stats->total_unreachable = report.total_unreachable;
@@ -195,8 +201,9 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
     global_program_info = info;
     assert(!entry_invariant.is_bottom());
     ebpf_domain_t entry_inv = ebpf_domain_t::from_constraints(entry_invariant.value(), options.setup_constraints);
-    if (entry_inv.is_bottom())
+    if (entry_inv.is_bottom()) {
         throw std::runtime_error("Entry invariant is inconsistent");
+    }
     try {
         cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
         auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
@@ -215,8 +222,9 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
 /// Returned value is true if the program passes verification.
 bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const program_info& info,
                          const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats) {
-    if (options == nullptr)
+    if (options == nullptr) {
         options = &ebpf_verifier_default_options;
+    }
 
     // Convert the instruction sequence to a control-flow graph
     // in a "passive", non-deterministic form.
diff --git a/src/crab_verifier.hpp b/src/crab_verifier.hpp
index 1709104ae..1f425085d 100644
--- a/src/crab_verifier.hpp
+++ b/src/crab_verifier.hpp
@@ -8,14 +8,10 @@
 #include "string_constraints.hpp"
 
 bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, const ebpf_verifier_options_t* options,
-    ebpf_verifier_stats_t* stats);
+                       ebpf_verifier_stats_t* stats);
 
-bool ebpf_verify_program(
-    std::ostream& s,
-    const InstructionSeq& prog,
-    const program_info& info,
-    const ebpf_verifier_options_t* options,
-    ebpf_verifier_stats_t* stats);
+bool ebpf_verify_program(std::ostream& s, const InstructionSeq& prog, const program_info& info,
+                         const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats);
 
 using string_invariant_map = std::map<crab::label_t, string_invariant>;
 
@@ -24,7 +20,8 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
                                                                  const program_info& info,
                                                                  const ebpf_verifier_options_t& options);
 
-int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries, ebpf_verifier_options_t options);
+int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
+                    ebpf_verifier_options_t options);
 
 EbpfMapDescriptor* find_map_descriptor(int map_fd);
 
diff --git a/src/ebpf_base.h b/src/ebpf_base.h
index a61db3aba..e6c96463c 100644
--- a/src/ebpf_base.h
+++ b/src/ebpf_base.h
@@ -29,7 +29,6 @@ typedef enum _ebpf_argument_type {
     EBPF_ARGUMENT_TYPE_UNSUPPORTED,
 } ebpf_argument_type_t;
 
-
 // The following struct describes how to access the layout in
 // memory of the data (e.g., the actual packet).
 typedef struct _ebpf_context_descriptor {
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 4ce58b895..ecad957f5 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -14,7 +14,7 @@ struct ebpf_inst {
     std::uint8_t dst : 4; //< Destination register
     std::uint8_t src : 4; //< Source register
     std::int16_t offset;
-    std::int32_t imm;     //< Immediate constant
+    std::int32_t imm; //< Immediate constant
     constexpr bool operator==(const ebpf_inst&) const = default;
 };
 
@@ -45,10 +45,10 @@ enum {
 
     INST_MODE_MASK = 0xe0,
 
-    INST_MODE_IMM = 0x00, // 64-bit immediate instructions
-    INST_MODE_ABS = 0x20, // legacy BPF packet access (absolute)
-    INST_MODE_IND = 0x40, // legacy BPF packet access (indirect)
-    INST_MODE_MEM = 0x60, // regular load and store operations
+    INST_MODE_IMM = 0x00,   // 64-bit immediate instructions
+    INST_MODE_ABS = 0x20,   // legacy BPF packet access (absolute)
+    INST_MODE_IND = 0x40,   // legacy BPF packet access (indirect)
+    INST_MODE_MEM = 0x60,   // regular load and store operations
     INST_MODE_MEMSX = 0x80, // sign-extension load operations
     INST_MODE_UNUSED1 = 0xa0,
     INST_MODE_ATOMIC = 0xc0, // atomic operations
@@ -72,20 +72,20 @@ enum {
     INST_CALL_LOCAL = 0x1,
     INST_CALL_BTF_HELPER = 0x2,
 
-    INST_ALU_OP_ADD  = 0x00,
-    INST_ALU_OP_SUB  = 0x10,
-    INST_ALU_OP_MUL  = 0x20,
-    INST_ALU_OP_DIV  = 0x30,
-    INST_ALU_OP_OR   = 0x40,
-    INST_ALU_OP_AND  = 0x50,
-    INST_ALU_OP_LSH  = 0x60,
-    INST_ALU_OP_RSH  = 0x70,
-    INST_ALU_OP_NEG  = 0x80,
-    INST_ALU_OP_MOD  = 0x90,
-    INST_ALU_OP_XOR  = 0xa0,
-    INST_ALU_OP_MOV  = 0xb0,
+    INST_ALU_OP_ADD = 0x00,
+    INST_ALU_OP_SUB = 0x10,
+    INST_ALU_OP_MUL = 0x20,
+    INST_ALU_OP_DIV = 0x30,
+    INST_ALU_OP_OR = 0x40,
+    INST_ALU_OP_AND = 0x50,
+    INST_ALU_OP_LSH = 0x60,
+    INST_ALU_OP_RSH = 0x70,
+    INST_ALU_OP_NEG = 0x80,
+    INST_ALU_OP_MOD = 0x90,
+    INST_ALU_OP_XOR = 0xa0,
+    INST_ALU_OP_MOV = 0xb0,
     INST_ALU_OP_ARSH = 0xc0,
-    INST_ALU_OP_END  = 0xd0,
+    INST_ALU_OP_END = 0xd0,
     INST_ALU_OP_MASK = 0xf0,
 
     R0_RETURN_VALUE = 0,
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 497d67ec9..412874c2a 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -11,14 +11,14 @@
 
 #include <yaml-cpp/yaml.h>
 
-#include "asm_parse.hpp"
 #include "asm_ostream.hpp"
+#include "asm_parse.hpp"
 #include "ebpf_verifier.hpp"
 #include "ebpf_yaml.hpp"
 #include "string_constraints.hpp"
 
-using std::vector;
 using std::string;
+using std::vector;
 
 // The YAML tests for Call depend on Linux prototypes.
 // parse_instruction() in asm_parse.cpp explicitly uses
@@ -37,51 +37,45 @@ static EbpfHelperPrototype ebpf_get_helper_prototype(int32_t n) {
     return g_ebpf_platform_linux.get_helper_prototype(n);
 }
 
-static bool ebpf_is_helper_usable(int32_t n) {
-    return g_ebpf_platform_linux.is_helper_usable(n);
-}
+static bool ebpf_is_helper_usable(int32_t n) { return g_ebpf_platform_linux.is_helper_usable(n); }
 
-static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>& map_descriptors, const char* data, size_t map_record_size, int map_count,
-                                    const struct ebpf_platform_t* platform, ebpf_verifier_options_t options) {
-}
+static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>& map_descriptors, const char* data,
+                                    size_t map_record_size, int map_count, const struct ebpf_platform_t* platform,
+                                    ebpf_verifier_options_t options) {}
 
-static EbpfMapDescriptor test_map_descriptor = {
-    .original_fd=0,
-    .type=0,
-    .key_size=sizeof(uint32_t),
-    .value_size=sizeof(uint32_t),
-    .max_entries=4,
-    .inner_map_fd=0
-};
+static EbpfMapDescriptor test_map_descriptor = {.original_fd = 0,
+                                                .type = 0,
+                                                .key_size = sizeof(uint32_t),
+                                                .value_size = sizeof(uint32_t),
+                                                .max_entries = 4,
+                                                .inner_map_fd = 0};
 
 static EbpfMapDescriptor& ebpf_get_map_descriptor(int map_fd) { return test_map_descriptor; }
 
-ebpf_platform_t g_platform_test = {
-    .get_program_type = ebpf_get_program_type,
-    .get_helper_prototype = ebpf_get_helper_prototype,
-    .is_helper_usable = ebpf_is_helper_usable,
-    .map_record_size = 0,
-    .parse_maps_section = ebpf_parse_maps_section,
-    .get_map_descriptor = ebpf_get_map_descriptor,
-    .get_map_type = ebpf_get_map_type,
-    .supported_conformance_groups =
-        bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::packet | bpf_conformance_groups_t::callx
-};
+ebpf_platform_t g_platform_test = {.get_program_type = ebpf_get_program_type,
+                                   .get_helper_prototype = ebpf_get_helper_prototype,
+                                   .is_helper_usable = ebpf_is_helper_usable,
+                                   .map_record_size = 0,
+                                   .parse_maps_section = ebpf_parse_maps_section,
+                                   .get_map_descriptor = ebpf_get_map_descriptor,
+                                   .get_map_type = ebpf_get_map_type,
+                                   .supported_conformance_groups = bpf_conformance_groups_t::default_groups |
+                                                                   bpf_conformance_groups_t::packet |
+                                                                   bpf_conformance_groups_t::callx};
 
 static EbpfProgramType make_program_type(const string& name, ebpf_context_descriptor_t* context_descriptor) {
-    return EbpfProgramType{
-        .name=name,
-        .context_descriptor=context_descriptor,
-        .platform_specific_data=0,
-        .section_prefixes={},
-        .is_privileged=false
-    };
+    return EbpfProgramType{.name = name,
+                           .context_descriptor = context_descriptor,
+                           .platform_specific_data = 0,
+                           .section_prefixes = {},
+                           .is_privileged = false};
 }
 
 static std::set<string> vector_to_set(const vector<string>& s) {
     std::set<string> res;
-    for (const auto& item : s)
+    for (const auto& item : s) {
         res.insert(item);
+    }
     return res;
 }
 
@@ -91,11 +85,11 @@ std::set<string> operator-(const std::set<string>& a, const std::set<string>& b)
     return res;
 }
 
-
 static string_invariant read_invariant(const vector<string>& raw_invariant) {
     std::set<string> res = vector_to_set(raw_invariant);
-    if (res == std::set<string>{"_|_"})
+    if (res == std::set<string>{"_|_"}) {
         return string_invariant{};
+    }
     return string_invariant{res};
 }
 
@@ -112,8 +106,9 @@ static vector<string> parse_block(const YAML::Node& block_node) {
     vector<string> block;
     std::istringstream is{block_node.as<string>()};
     string line;
-    while (std::getline(is, line))
+    while (std::getline(is, line)) {
         block.emplace_back(line);
+    }
     return block;
 }
 
@@ -126,13 +121,14 @@ static auto parse_code(const YAML::Node& code_node) {
 }
 
 static std::set<string> as_set_empty_default(const YAML::Node& optional_node) {
-    if (!optional_node.IsDefined() || optional_node.IsNull())
+    if (!optional_node.IsDefined() || optional_node.IsNull()) {
         return {};
+    }
     return vector_to_set(optional_node.as<vector<string>>());
 }
 
 static RawTestCase parse_case(const YAML::Node& case_node) {
-    return RawTestCase {
+    return RawTestCase{
         .test_case = case_node["test-case"].as<string>(),
         .options = as_set_empty_default(case_node["options"]),
         .pre = case_node["pre"].as<vector<string>>(),
@@ -158,8 +154,9 @@ static InstructionSeq raw_cfg_to_instruction_seq(const vector<std::tuple<string,
         for (const string& line : raw_block) {
             try {
                 const Instruction& ins = parse_instruction(line, label_name_to_label);
-                if (std::holds_alternative<Undefined>(ins))
+                if (std::holds_alternative<Undefined>(ins)) {
                     std::cout << "text:" << line << "; ins: " << ins << "\n";
+                }
                 res.emplace_back(label_index, ins, std::optional<btf_line_info_t>());
             } catch (const std::exception& e) {
                 std::cout << "text:" << line << "; error: " << e.what() << "\n";
@@ -204,14 +201,12 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
 }
 
 static TestCase read_case(const RawTestCase& raw_case) {
-    return TestCase{
-        .name = raw_case.test_case,
-        .options = raw_options_to_options(raw_case.options),
-        .assumed_pre_invariant = read_invariant(raw_case.pre),
-        .instruction_seq = raw_cfg_to_instruction_seq(raw_case.raw_blocks),
-        .expected_post_invariant = read_invariant(raw_case.post),
-        .expected_messages = raw_case.messages
-    };
+    return TestCase{.name = raw_case.test_case,
+                    .options = raw_options_to_options(raw_case.options),
+                    .assumed_pre_invariant = read_invariant(raw_case.pre),
+                    .instruction_seq = raw_cfg_to_instruction_seq(raw_case.raw_blocks),
+                    .expected_post_invariant = read_invariant(raw_case.post),
+                    .expected_messages = raw_case.messages};
 }
 
 static vector<TestCase> read_suite(const string& path) {
@@ -228,17 +223,18 @@ static std::set<string> extract_messages(const string& str) {
     boost::split(output, str, boost::is_any_of("\n"));
 
     std::set<string> actual_messages;
-    for (auto& item: output) {
+    for (auto& item : output) {
         boost::trim(item);
-        if (!item.empty())
+        if (!item.empty()) {
             actual_messages.insert(item);
+        }
     }
     return actual_messages;
 }
 
-template<typename T>
+template <typename T>
 static Diff<T> make_diff(const T& actual, const T& expected) {
-    return Diff<T> {
+    return Diff<T>{
         .unexpected = actual - expected,
         .unseen = expected - actual,
     };
@@ -258,17 +254,14 @@ std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
 
     std::ostringstream ss;
     const auto& [actual_last_invariant, result] = ebpf_analyze_program_for_test(
-        ss, test_case.instruction_seq,
-        test_case.assumed_pre_invariant,
-        info, test_case.options);
+        ss, test_case.instruction_seq, test_case.assumed_pre_invariant, info, test_case.options);
     std::set<string> actual_messages = extract_messages(ss.str());
 
-    if (actual_last_invariant == test_case.expected_post_invariant && actual_messages == test_case.expected_messages)
+    if (actual_last_invariant == test_case.expected_post_invariant && actual_messages == test_case.expected_messages) {
         return {};
-    return Failure{
-        .invariant = make_diff(actual_last_invariant, test_case.expected_post_invariant),
-        .messages = make_diff(actual_messages, test_case.expected_messages)
-    };
+    }
+    return Failure{.invariant = make_diff(actual_last_invariant, test_case.expected_post_invariant),
+                   .messages = make_diff(actual_messages, test_case.expected_messages)};
 }
 
 template <typename T>
@@ -288,10 +281,10 @@ void add_stack_variable(std::set<std::string>& more, int& offset, const std::vec
     TU uvalue;
     memcpy(&svalue, memory_bytes.data() + offset + memory_bytes.size() - EBPF_STACK_SIZE, sizeof(TS));
     memcpy(&uvalue, memory_bytes.data() + offset + memory_bytes.size() - EBPF_STACK_SIZE, sizeof(TU));
-    more.insert("s[" + std::to_string(offset) + "..." + std::to_string(offset + sizeof(TS) - 1) +
-                "].svalue" + "=" + std::to_string(svalue));
-    more.insert("s[" + std::to_string(offset) + "..." + std::to_string(offset + sizeof(TU) - 1) +
-                "].uvalue" + "=" + std::to_string(uvalue));
+    more.insert("s[" + std::to_string(offset) + "..." + std::to_string(offset + sizeof(TS) - 1) + "].svalue" + "=" +
+                std::to_string(svalue));
+    more.insert("s[" + std::to_string(offset) + "..." + std::to_string(offset + sizeof(TU) - 1) + "].uvalue" + "=" +
+                std::to_string(uvalue));
     offset += sizeof(TS);
 }
 
@@ -418,14 +411,14 @@ void print_failure(const Failure& failure, std::ostream& out) {
 
 bool all_suites(const string& path) {
     bool result = true;
-    for (const TestCase& test_case: read_suite(path)) {
+    for (const TestCase& test_case : read_suite(path)) {
         result = result && bool(run_yaml_test_case(test_case));
     }
     return result;
 }
 
 void foreach_suite(const string& path, const std::function<void(const TestCase&)>& f) {
-    for (const TestCase& test_case: read_suite(path)) {
+    for (const TestCase& test_case : read_suite(path)) {
         f(test_case);
     }
 }
diff --git a/src/ebpf_yaml.hpp b/src/ebpf_yaml.hpp
index 183ea3daa..89d7ab592 100644
--- a/src/ebpf_yaml.hpp
+++ b/src/ebpf_yaml.hpp
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 #include <functional>
-#include <string>
 #include <set>
+#include <string>
 
 #include "crab_verifier.hpp"
 
@@ -19,7 +19,7 @@ struct TestCase {
 void foreach_suite(const std::string& path, const std::function<void(const TestCase&)>& f);
 bool all_suites(const std::string& path);
 
-template<typename T>
+template <typename T>
 struct Diff {
     T unexpected;
     T unseen;
@@ -39,6 +39,7 @@ struct ConformanceTestResult {
     crab::interval_t r0_value = crab::interval_t::top();
 };
 
-ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memory_bytes, const std::vector<uint8_t>& program_bytes, bool debug);
+ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memory_bytes,
+                                                const std::vector<uint8_t>& program_bytes, bool debug);
 
 bool run_yaml(const std::string& path);
diff --git a/src/linux/gpl/spec_prototypes.cpp b/src/linux/gpl/spec_prototypes.cpp
index 915432509..b432b4f38 100644
--- a/src/linux/gpl/spec_prototypes.cpp
+++ b/src/linux/gpl/spec_prototypes.cpp
@@ -1,31 +1,31 @@
 #include "platform.hpp"
 #include "spec_type_descriptors.hpp"
 
-#define EBPF_RETURN_TYPE_PTR_TO_SOCK_COMMON_OR_NULL   EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_SOCKET_OR_NULL        EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_TCP_SOCKET_OR_NULL    EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_ALLOC_MEM_OR_NULL     EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL        EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_SOCK_COMMON_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_SOCKET_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_TCP_SOCKET_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_ALLOC_MEM_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
 #define EBPF_RETURN_TYPE_PTR_TO_MEM_OR_BTF_ID_OR_NULL EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_BTF_ID                EBPF_RETURN_TYPE_UNSUPPORTED
-#define EBPF_RETURN_TYPE_PTR_TO_MEM_OR_BTF_ID         EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_BTF_ID EBPF_RETURN_TYPE_UNSUPPORTED
+#define EBPF_RETURN_TYPE_PTR_TO_MEM_OR_BTF_ID EBPF_RETURN_TYPE_UNSUPPORTED
 
 #define EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK          EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON        EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID             EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID EBPF_ARGUMENT_TYPE_UNSUPPORTED
 #define EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_LONG               EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_INT                EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR          EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_FUNC               EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL      EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_CONST_ALLOC_SIZE_OR_ZERO  EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM          EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM          EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE_OR_NULL  EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_TIMER              EBPF_ARGUMENT_TYPE_UNSUPPORTED
-#define EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID      EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_LONG EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_INT EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_FUNC EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_CONST_ALLOC_SIZE_OR_ZERO EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE_OR_NULL EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_TIMER EBPF_ARGUMENT_TYPE_UNSUPPORTED
+#define EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID EBPF_ARGUMENT_TYPE_UNSUPPORTED
 
 const ebpf_context_descriptor_t g_sk_buff = sk_buff;
 const ebpf_context_descriptor_t g_xdp_md = xdp_md;
@@ -42,633 +42,689 @@ const ebpf_context_descriptor_t g_sock_ops_descr = sock_ops_descr;
 // https://github.com/iovisor/bpf-docs/blob/master/bpf_helpers.rst
 // https://www.man7.org/linux/man-pages/man7/bpf-helpers.7.html
 
-static const struct EbpfHelperPrototype bpf_unspec_proto = {
+static constexpr EbpfHelperPrototype bpf_unspec_proto = {
     .name = "unspec",
-    .return_type = EBPF_RETURN_TYPE_UNSUPPORTED
+    .return_type = EBPF_RETURN_TYPE_UNSUPPORTED,
 };
 
-const struct EbpfHelperPrototype bpf_tail_call_proto = {
+constexpr EbpfHelperPrototype bpf_tail_call_proto = {
     .name = "tail_call",
     .return_type = EBPF_RETURN_TYPE_INTEGER_OR_NO_RETURN_IF_SUCCEED,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_OF_PROGRAMS,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_OF_PROGRAMS,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_override_return_proto = {
+static constexpr EbpfHelperPrototype bpf_override_return_proto = {
     .name = "override_return",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_proto = {
     .name = "probe_read",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_str_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_str_proto = {
     .name = "probe_read_str",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_write_user_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_write_user_proto = {
     .name = "probe_write_user",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_trace_printk_proto = {
+static constexpr EbpfHelperPrototype bpf_trace_printk_proto = {
     .name = "trace_printk",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_perf_event_read_proto = {
+static constexpr EbpfHelperPrototype bpf_perf_event_read_proto = {
     .name = "perf_event_read",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_perf_event_read_value_proto = {
+static constexpr EbpfHelperPrototype bpf_perf_event_read_value_proto = {
     .name = "perf_event_read_value",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_perf_event_output_proto = {
+static constexpr EbpfHelperPrototype bpf_perf_event_output_proto = {
     .name = "perf_event_output",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_task_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_task_proto = {
     .name = "get_current_task",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_current_task_under_cgroup_proto = {
+static constexpr EbpfHelperPrototype bpf_current_task_under_cgroup_proto = {
     .name = "current_task_under_cgroup",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_perf_prog_read_value_proto = {
-    .name = "perf_prog_read_value",
-    .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
-    .context_descriptor = &g_perf_event_descr
-};
+static constexpr EbpfHelperPrototype bpf_perf_prog_read_value_proto = {.name = "perf_prog_read_value",
+                                                                       .return_type = EBPF_RETURN_TYPE_INTEGER,
+                                                                       .argument_type =
+                                                                           {
+                                                                               EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+                                                                               EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+                                                                               EBPF_ARGUMENT_TYPE_CONST_SIZE,
+                                                                           },
+                                                                       .context_descriptor = &g_perf_event_descr};
 
-static const struct EbpfHelperPrototype bpf_map_lookup_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_lookup_elem_proto = {
     .name = "map_lookup_elem",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_map_update_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_update_elem_proto = {
     .name = "map_update_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_map_delete_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_delete_elem_proto = {
     .name = "map_delete_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_prandom_u32_proto = {
+static constexpr EbpfHelperPrototype bpf_get_prandom_u32_proto = {
     .name = "get_prandom_u32",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_get_smp_processor_id_proto = {
+static constexpr EbpfHelperPrototype bpf_get_smp_processor_id_proto = {
     .name = "get_smp_processor_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_get_numa_node_id_proto = {
+static constexpr EbpfHelperPrototype bpf_get_numa_node_id_proto = {
     .name = "get_numa_node_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_ktime_get_ns_proto = {
+static constexpr EbpfHelperPrototype bpf_ktime_get_ns_proto = {
     .name = "ktime_get_ns",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_pid_tgid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_pid_tgid_proto = {
     .name = "get_current_pid_tgid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_uid_gid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_uid_gid_proto = {
     .name = "get_current_uid_gid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_comm_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_comm_proto = {
     .name = "get_current_comm",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_cgroup_id_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_cgroup_id_proto = {
     .name = "get_current_cgroup_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_sock_map_update_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_map_update_proto = {
     .name = "sock_map_update",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-    },
-    .context_descriptor = &g_sock_ops_descr
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+        },
+    .context_descriptor = &g_sock_ops_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_sock_hash_update_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_hash_update_proto = {
     .name = "sock_hash_update",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_DONTCARE,
-    },
-    .context_descriptor = &g_sock_ops_descr
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_DONTCARE,
+        },
+    .context_descriptor = &g_sock_ops_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_get_stackid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_stackid_proto = {
     .name = "get_stackid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_stack_proto = {
+static constexpr EbpfHelperPrototype bpf_get_stack_proto = {
     .name = "get_stack",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skb_store_bytes_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_store_bytes_proto = {
     .name = "skb_store_bytes",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_load_bytes_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_load_bytes_proto = {
     .name = "skb_load_bytes",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_load_bytes_relative_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_load_bytes_relative_proto = {
     .name = "skb_load_bytes_relative",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_pull_data_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_pull_data_proto = {
     .name = "skb_pull_data",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_l3_csum_replace_proto = {
+static constexpr EbpfHelperPrototype bpf_l3_csum_replace_proto = {
     .name = "l3_csum_replace",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_l4_csum_replace_proto = {
+static constexpr EbpfHelperPrototype bpf_l4_csum_replace_proto = {
     .name = "l4_csum_replace",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_csum_diff_proto = {
+static constexpr EbpfHelperPrototype bpf_csum_diff_proto = {
     .name = "csum_diff",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_csum_update_proto = {
+static constexpr EbpfHelperPrototype bpf_csum_update_proto = {
     .name = "csum_update",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_clone_redirect_proto = {
+static constexpr EbpfHelperPrototype bpf_clone_redirect_proto = {
     .name = "clone_redirect",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_redirect_proto = {
+static constexpr EbpfHelperPrototype bpf_redirect_proto = {
     .name = "redirect",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_redirect_hash_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_redirect_hash_proto = {
     .name = "sk_redirect_hash",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_sk_redirect_map_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_redirect_map_proto = {
     .name = "sk_redirect_map",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_redirect_hash_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_redirect_hash_proto = {
     .name = "msg_redirect_hash",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_msg_md
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_redirect_map_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_redirect_map_proto = {
     .name = "msg_redirect_map",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_msg_md
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_apply_bytes_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_apply_bytes_proto = {
     .name = "msg_apply_bytes",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_msg_md
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_cork_bytes_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_cork_bytes_proto = {
     .name = "msg_cork_bytes",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_msg_md
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_pull_data_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_pull_data_proto = {
     .name = "msg_pull_data",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_msg_md
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_msg_md,
 };
-static const struct EbpfHelperPrototype bpf_get_cgroup_classid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_cgroup_classid_proto = {
     .name = "get_cgroup_classid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = { EBPF_ARGUMENT_TYPE_PTR_TO_CTX, },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_get_route_realm_proto = {
+static constexpr EbpfHelperPrototype bpf_get_route_realm_proto = {
     .name = "get_route_realm",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = { EBPF_ARGUMENT_TYPE_PTR_TO_CTX, },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_get_hash_recalc_proto = {
+static constexpr EbpfHelperPrototype bpf_get_hash_recalc_proto = {
     .name = "get_hash_recalc",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_set_hash_invalid_proto = {
+static constexpr EbpfHelperPrototype bpf_set_hash_invalid_proto = {
     .name = "set_hash_invalid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_set_hash_proto = {
+static constexpr EbpfHelperPrototype bpf_set_hash_proto = {
     .name = "set_hash",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_vlan_push_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_vlan_push_proto = {
     .name = "skb_vlan_push",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_vlan_pop_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_vlan_pop_proto = {
     .name = "skb_vlan_pop",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_change_proto_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_change_proto_proto = {
     .name = "skb_change_proto",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_change_type_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_change_type_proto = {
     .name = "skb_change_type",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_adjust_room_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_adjust_room_proto = {
     .name = "skb_adjust_room",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_sk_buff
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_change_tail_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_change_tail_proto = {
     .name = "skb_change_tail",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_change_head_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_change_head_proto = {
     .name = "skb_change_head",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_sk_buff
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_xdp_adjust_head_proto = {
+static constexpr EbpfHelperPrototype bpf_xdp_adjust_head_proto = {
     .name = "xdp_adjust_head",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_xdp_descr
+    .context_descriptor = &g_xdp_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_xdp_adjust_tail_proto = {
+static constexpr EbpfHelperPrototype bpf_xdp_adjust_tail_proto = {
     .name = "xdp_adjust_tail",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_xdp_descr
+    .context_descriptor = &g_xdp_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_xdp_adjust_meta_proto = {
+static constexpr EbpfHelperPrototype bpf_xdp_adjust_meta_proto = {
     .name = "xdp_adjust_meta",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_xdp_descr
+    .context_descriptor = &g_xdp_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_get_tunnel_key_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_get_tunnel_key_proto = {
     .name = "skb_get_tunnel_key",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_get_tunnel_opt_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_get_tunnel_opt_proto = {
     .name = "skb_get_tunnel_opt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_set_tunnel_key_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_set_tunnel_key_proto = {
     .name = "skb_set_tunnel_key",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
 /*
@@ -679,209 +735,232 @@ static const struct EbpfHelperPrototype bpf_skb_set_tunnel_key_proto = {
  *     @size: size of @opt
  *     Return: 0 on success or negative error
  */
-static const struct EbpfHelperPrototype bpf_skb_set_tunnel_opt_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_set_tunnel_opt_proto = {
     .name = "skb_set_tunnel_opt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_under_cgroup_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_under_cgroup_proto = {
     .name = "skb_under_cgroup",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_skb_cgroup_id_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_cgroup_id_proto = {
     .name = "skb_cgroup_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_get_socket_cookie_proto = {
+static constexpr EbpfHelperPrototype bpf_get_socket_cookie_proto = {
     .name = "get_socket_cookie",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = { EBPF_ARGUMENT_TYPE_PTR_TO_CTX, },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_get_socket_uid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_socket_uid_proto = {
     .name = "get_socket_uid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = { EBPF_ARGUMENT_TYPE_PTR_TO_CTX, },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_setsockopt_proto = {
+static constexpr EbpfHelperPrototype bpf_setsockopt_proto = {
     .name = "setsockopt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_getsockopt_proto = {
+static constexpr EbpfHelperPrototype bpf_getsockopt_proto = {
     .name = "getsockopt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sock_ops_cb_flags_set_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_ops_cb_flags_set_proto = {
     .name = "sock_ops_cb_flags_set",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sock_ops_descr
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sock_ops_descr,
 };
 
-static const struct EbpfHelperPrototype bpf_bind_proto = {
+static constexpr EbpfHelperPrototype bpf_bind_proto = {
     .name = "bind",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skb_get_xfrm_state_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_get_xfrm_state_proto = {
     .name = "skb_get_xfrm_state",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_fib_lookup_proto = {
+static constexpr EbpfHelperPrototype bpf_fib_lookup_proto = {
     .name = "fib_lookup",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_lwt_push_encap_proto = {
+static constexpr EbpfHelperPrototype bpf_lwt_push_encap_proto = {
     .name = "lwt_push_encap",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_lwt_seg6_store_bytes_proto = {
+static constexpr EbpfHelperPrototype bpf_lwt_seg6_store_bytes_proto = {
     .name = "lwt_seg6_store_bytes",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_lwt_seg6_action_proto = {
+static constexpr EbpfHelperPrototype bpf_lwt_seg6_action_proto = {
     .name = "lwt_seg6_action",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE
-    },
-    .context_descriptor = &g_sk_buff
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_lwt_seg6_adjust_srh_proto = {
+static constexpr EbpfHelperPrototype bpf_lwt_seg6_adjust_srh_proto = {
     .name = "lwt_seg6_adjust_srh",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     .reallocate_packet = true,
-    .context_descriptor = &g_sk_buff
+    .context_descriptor = &g_sk_buff,
 };
 
-static const struct EbpfHelperPrototype bpf_rc_repeat_proto = {
+static constexpr EbpfHelperPrototype bpf_rc_repeat_proto = {
     .name = "rc_repeat",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_rc_keydown_proto = {
+static constexpr EbpfHelperPrototype bpf_rc_keydown_proto = {
     .name = "rc_keydown",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_local_storage_proto = {
+static constexpr EbpfHelperPrototype bpf_get_local_storage_proto = {
     .name = "get_local_storage",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL, // BUT never NULL. TODO: add type
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_redirect_map_proto = {
+static constexpr EbpfHelperPrototype bpf_redirect_map_proto = {
     .name = "redirect_map",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_select_reuseport_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_select_reuseport_proto = {
     .name = "sk_select_reuseport",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
         EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
         EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY,
@@ -889,29 +968,30 @@ static const struct EbpfHelperPrototype bpf_sk_select_reuseport_proto = {
     },
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_ancestor_cgroup_id_proto = {
+static constexpr EbpfHelperPrototype bpf_get_current_ancestor_cgroup_id_proto = {
     .name = "get_current_ancestor_cgroup_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_ANYTHING,
     },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_lookup_tcp_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_lookup_tcp_proto = {
     .name = "sk_lookup_tcp",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_SOCK_COMMON_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
-};
-static const struct EbpfHelperPrototype bpf_sk_lookup_udp_proto = {
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
+};
+static constexpr EbpfHelperPrototype bpf_sk_lookup_udp_proto = {
     .name = "sk_lookup_udp",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_SOCKET_OR_NULL,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
         EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
         EBPF_ARGUMENT_TYPE_CONST_SIZE,
@@ -920,15 +1000,16 @@ static const struct EbpfHelperPrototype bpf_sk_lookup_udp_proto = {
     },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_release_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_release_proto = {
     .name = "sk_release",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_map_push_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_push_elem_proto = {
     .name = "map_push_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
     .argument_type{
@@ -938,7 +1019,7 @@ static const struct EbpfHelperPrototype bpf_map_push_elem_proto = {
     },
 };
 
-static const struct EbpfHelperPrototype bpf_map_pop_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_pop_elem_proto = {
     .name = "map_pop_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
     .argument_type{
@@ -947,974 +1028,1063 @@ static const struct EbpfHelperPrototype bpf_map_pop_elem_proto = {
     },
 };
 
-static const struct EbpfHelperPrototype bpf_map_peek_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_map_peek_elem_proto = {
     .name = "map_peek_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
     .argument_type{
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // TODO: const
+        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,       // TODO: const
         EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: uninit
     },
 };
 
-static const struct EbpfHelperPrototype bpf_msg_push_data_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_push_data_proto = {
     .name = "msg_push_data",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
         EBPF_ARGUMENT_TYPE_ANYTHING,
         EBPF_ARGUMENT_TYPE_ANYTHING,
         EBPF_ARGUMENT_TYPE_ANYTHING,
     },
-    .context_descriptor = &g_sk_msg_md
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_msg_pop_data_proto = {
+static constexpr EbpfHelperPrototype bpf_msg_pop_data_proto = {
     .name = "msg_pop_data",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
         EBPF_ARGUMENT_TYPE_ANYTHING,
         EBPF_ARGUMENT_TYPE_ANYTHING,
         EBPF_ARGUMENT_TYPE_ANYTHING,
     },
-    .context_descriptor = &g_sk_msg_md
+    .context_descriptor = &g_sk_msg_md,
 };
 
-static const struct EbpfHelperPrototype bpf_rc_pointer_rel_proto = {
+static constexpr EbpfHelperPrototype bpf_rc_pointer_rel_proto = {
     .name = "rc_pointer_rel",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type {
+    .argument_type{
         EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
         EBPF_ARGUMENT_TYPE_ANYTHING,
         EBPF_ARGUMENT_TYPE_ANYTHING,
     },
 };
 
-static const struct EbpfHelperPrototype bpf_spin_lock_proto = {
+static constexpr EbpfHelperPrototype bpf_spin_lock_proto = {
     .name = "spin_lock",
     .return_type = EBPF_RETURN_TYPE_INTEGER, // returns 0
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_spin_unlock_proto = {
+static constexpr EbpfHelperPrototype bpf_spin_unlock_proto = {
     .name = "spin_unlock",
     .return_type = EBPF_RETURN_TYPE_INTEGER, // returns 0
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_SPIN_LOCK,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_jiffies64_proto = {
+static constexpr EbpfHelperPrototype bpf_jiffies64_proto = {
     .name = "jiffies64",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_sk_fullsock_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_fullsock_proto = {
     .name = "sk_fullsock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_SOCKET_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_tcp_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_tcp_sock_proto = {
     .name = "tcp_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_TCP_SOCKET_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skb_ecn_set_ce_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_ecn_set_ce_proto = {
     .name = "skb_ecn_set_ce",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_tcp_check_syncookie_proto = {
+static constexpr EbpfHelperPrototype bpf_tcp_check_syncookie_proto = {
     .name = "tcp_check_syncookie",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_listener_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_get_listener_sock_proto = {
     .name = "EbpfHelperPrototype",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_TCP_SOCKET_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skc_lookup_tcp_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_lookup_tcp_proto = {
     .name = "skc_lookup_tcp",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_SOCK_COMMON_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sysctl_get_name_proto = {
+static constexpr EbpfHelperPrototype bpf_sysctl_get_name_proto = {
     .name = "sysctl_get_name",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sysctl_get_current_value_proto = {
+static constexpr EbpfHelperPrototype bpf_sysctl_get_current_value_proto = {
     .name = "sysctl_get_current_value",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sysctl_get_new_value_proto = {
+static constexpr EbpfHelperPrototype bpf_sysctl_get_new_value_proto = {
     .name = "sysctl_get_new_value",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sysctl_set_new_value_proto = {
+static constexpr EbpfHelperPrototype bpf_sysctl_set_new_value_proto = {
     .name = "sysctl_set_new_value",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_strtol_proto = {
+static constexpr EbpfHelperPrototype bpf_strtol_proto = {
     .name = "strtol",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_strtoul_proto = {
+static constexpr EbpfHelperPrototype bpf_strtoul_proto = {
     .name = "strtoul",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_strncmp_proto = {
+static constexpr EbpfHelperPrototype bpf_strncmp_proto = {
     .name = "strncmp",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_storage_get_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_storage_get_proto = {
     .name = "sk_storage_get",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: OR_NULL,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: OR_NULL,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_storage_get_cg_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_storage_get_cg_sock_proto = {
     .name = "sk_storage_get",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX, /* context is 'struct sock' */
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: OR_NULL,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,       /* context is 'struct sock' */
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: OR_NULL,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_storage_delete_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_storage_delete_proto = {
     .name = "sk_storage_delete",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_send_signal_proto = {
+static constexpr EbpfHelperPrototype bpf_send_signal_proto = {
     .name = "send_signal",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_send_signal_thread_proto = {
+static constexpr EbpfHelperPrototype bpf_send_signal_thread_proto = {
     .name = "send_signal_thread",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_tcp_gen_syncookie_proto = {
+static constexpr EbpfHelperPrototype bpf_tcp_gen_syncookie_proto = {
     .name = "tcp_gen_syncookie",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skb_output_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_output_proto = {
     .name = "skb_event_output",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // originally const
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // originally const
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
     //.arg1_btf_id = &bpf_skb_output_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_user_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_user_proto = {
     .name = "probe_read_user",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_user_str_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_user_str_proto = {
     .name = "probe_read_user_str",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_kernel_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_kernel_proto = {
     .name = "probe_read_kernel",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_probe_read_kernel_str_proto = {
+static constexpr EbpfHelperPrototype bpf_probe_read_kernel_str_proto = {
     .name = "probe_read_kernel_str",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_tcp_send_ack_proto = {
+static constexpr EbpfHelperPrototype bpf_tcp_send_ack_proto = {
     .name = "tcp_send_ack",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     //.arg1_btf_id = &tcp_sock_id[0],
 };
 
-static const struct EbpfHelperPrototype bpf_read_branch_records_proto = {
+static constexpr EbpfHelperPrototype bpf_read_branch_records_proto = {
     .name = "read_branch_records",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    }
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_ns_current_pid_tgid_proto = {
+static constexpr EbpfHelperPrototype bpf_get_ns_current_pid_tgid_proto = {
     .name = "get_ns_current_pid_tgid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM, // TODO: or null
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM, // TODO: or null
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_xdp_output_proto = {
+static constexpr EbpfHelperPrototype bpf_xdp_output_proto = {
     .name = "xdp_event_output",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO : readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO : readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
     // .arg1_btf_id = &bpf_xdp_output_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_get_netns_cookie_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_get_netns_cookie_sock_proto = {
     .name = "get_netns_cookie_sock",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX, // TODO: or null
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX, // TODO: or null
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_netns_cookie_sock_addr_proto = {
+static constexpr EbpfHelperPrototype bpf_get_netns_cookie_sock_addr_proto = {
     .name = "get_netns_cookie_sock_addr",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX, // TODO: or null
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX, // TODO: or null
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_assign_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_assign_proto = {
     .name = "get_netns_cookie_sock",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_ktime_get_boot_ns_proto = {
+static constexpr EbpfHelperPrototype bpf_ktime_get_boot_ns_proto = {
     .name = "ktime_get_boot_ns",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
-static const struct EbpfHelperPrototype bpf_seq_printf_proto = {
+static constexpr EbpfHelperPrototype bpf_seq_printf_proto = {
     .name = "seq_printf",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
     // .arg1_btf_id = &btf_seq_file_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_seq_write_proto = {
+static constexpr EbpfHelperPrototype bpf_seq_write_proto = {
     .name = "seq_write",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_cgroup_id_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_cgroup_id_proto = {
     .name = "sk_cgroup_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sk_ancestor_cgroup_id_proto = {
+static constexpr EbpfHelperPrototype bpf_sk_ancestor_cgroup_id_proto = {
     .name = "sk_ancestor_cgroup_id",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-        EBPF_ARGUMENT_TYPE_ANYTHING
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_ringbuf_reserve_proto = {
+static constexpr EbpfHelperPrototype bpf_ringbuf_reserve_proto = {
     .name = "ringbuf_reserve",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_ALLOC_MEM_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_CONST_ALLOC_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_CONST_ALLOC_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_ringbuf_submit_proto = {
+static constexpr EbpfHelperPrototype bpf_ringbuf_submit_proto = {
     .name = "ringbuf_submit",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_ringbuf_discard_proto = {
+static constexpr EbpfHelperPrototype bpf_ringbuf_discard_proto = {
     .name = "ringbuf_discard",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_ALLOC_MEM,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_ringbuf_output_proto = {
+static constexpr EbpfHelperPrototype bpf_ringbuf_output_proto = {
     .name = "ringbuf_output",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-const struct EbpfHelperPrototype bpf_ringbuf_query_proto = {
+constexpr EbpfHelperPrototype bpf_ringbuf_query_proto = {
     .name = "ringbuf_query",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // TODO: const
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // TODO: const
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_csum_level_proto = {
+static constexpr EbpfHelperPrototype bpf_csum_level_proto = {
     .name = "csum_level",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_skc_to_tcp6_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_to_tcp6_sock_proto = {
     .name = "skc_to_tcp6_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
     //.ret_btf_id  = &btf_sock_ids[BTF_SOCK_TYPE_TCP6],
 };
 
-static const struct EbpfHelperPrototype bpf_skc_to_tcp_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_to_tcp_sock_proto = {
     .name = "skc_to_tcp_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
     //.ret_btf_id  = &btf_sock_ids[BTF_SOCK_TYPE_TCP],
 };
 
-static const struct EbpfHelperPrototype bpf_skc_to_tcp_timewait_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_to_tcp_timewait_sock_proto = {
     .name = "skc_to_tcp_timewait_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
     //.ret_btf_id  = &btf_sock_ids[BTF_SOCK_TYPE_TCP_TW],
 };
 
-static const struct EbpfHelperPrototype bpf_skc_to_tcp_request_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_to_tcp_request_sock_proto = {
     .name = "skc_to_tcp_request_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
     //.ret_btf_id  = &btf_sock_ids[BTF_SOCK_TYPE_TCP_REQ],
 };
 
-static const struct EbpfHelperPrototype bpf_skc_to_udp6_sock_proto = {
+static constexpr EbpfHelperPrototype bpf_skc_to_udp6_sock_proto = {
     .name = "skc_to_udp6_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        },
     //.ret_btf_id  = &btf_sock_ids[BTF_SOCK_TYPE_UDP6],
 };
 
-static const struct EbpfHelperPrototype bpf_sock_from_file_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_from_file_proto = {
     .name = "sock_from_file",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+        },
     //.ret_btf_id = &bpf_sock_from_file_btf_ids[0],
     //.arg1_btf_id = &bpf_sock_from_file_btf_ids[1],
 };
 
-static const struct EbpfHelperPrototype bpf_get_task_stack_proto = {
+static constexpr EbpfHelperPrototype bpf_get_task_stack_proto = {
     .name = "get_task_stack",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     // .arg1_btf_id = &bpf_get_task_stack_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_sock_ops_load_hdr_opt_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_ops_load_hdr_opt_proto = {
     .name = "sock_ops_load_hdr_opt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sock_ops_store_hdr_opt_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_ops_store_hdr_opt_proto = {
     .name = "sock_ops_store_hdr_opt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sock_ops_reserve_hdr_opt_proto = {
+static constexpr EbpfHelperPrototype bpf_sock_ops_reserve_hdr_opt_proto = {
     .name = "sock_ops_reserve_hdr_opt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_inode_storage_get_proto = {
+static constexpr EbpfHelperPrototype bpf_inode_storage_get_proto = {
     .name = "inode_storage_get",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE_OR_NULL, // TODO: as argument too
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE_OR_NULL, // TODO: as argument too
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     //.arg2_btf_id = &bpf_inode_storage_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_inode_storage_delete_proto = {
+static constexpr EbpfHelperPrototype bpf_inode_storage_delete_proto = {
     .name = "inode_storage_delete",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+        },
     //.arg2_btf_id = &bpf_inode_storage_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_d_path_proto = {
+static constexpr EbpfHelperPrototype bpf_d_path_proto = {
     .name = "d_path",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
     // .allowed = bpf_d_path_allowed,
     // .arg1_btf_id = &bpf_d_path_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_copy_from_user_proto = {
+static constexpr EbpfHelperPrototype bpf_copy_from_user_proto = {
     .name = "copy_from_user",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_per_cpu_ptr_proto = {
+static constexpr EbpfHelperPrototype bpf_per_cpu_ptr_proto = {
     .name = "per_cpu_ptr",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MEM_OR_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_this_cpu_ptr_proto = {
+static constexpr EbpfHelperPrototype bpf_this_cpu_ptr_proto = {
     .name = "this_cpu_ptr",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MEM_OR_BTF_ID,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_PERCPU_BTF_ID,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_snprintf_btf_proto = {
+static constexpr EbpfHelperPrototype bpf_snprintf_btf_proto = {
     .name = "snprintf_btf",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_seq_printf_btf_proto = {
+static constexpr EbpfHelperPrototype bpf_seq_printf_btf_proto = {
     .name = "seq_printf_btf",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     // .arg1_btf_id	= &btf_seq_file_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_skb_cgroup_classid_proto = {
+static constexpr EbpfHelperPrototype bpf_skb_cgroup_classid_proto = {
     .name = "skb_cgroup_classid",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_redirect_neigh_proto = {
+static constexpr EbpfHelperPrototype bpf_redirect_neigh_proto = {
     .name = "redirect_neigh",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_redirect_peer_proto = {
+static constexpr EbpfHelperPrototype bpf_redirect_peer_proto = {
     .name = "redirect_peer",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_task_storage_get_proto = {
+static constexpr EbpfHelperPrototype bpf_task_storage_get_proto = {
     .name = "task_storage_get",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: or null
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE, // TODO: or null
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     // .arg2_btf_id = &bpf_task_storage_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_task_storage_delete_proto = {
+static constexpr EbpfHelperPrototype bpf_task_storage_delete_proto = {
     .name = "task_storage_delete",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+        },
     // .arg2_btf_id = &bpf_task_storage_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_get_current_task_btf_proto = {
-    .name = "get_current_task_btf",
-    .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID,
+static constexpr EbpfHelperPrototype bpf_get_current_task_btf_proto = {
+    .name = "get_current_task_btf", .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID,
     // .ret_btf_id = &bpf_get_current_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_bprm_opts_set_proto = {
+static constexpr EbpfHelperPrototype bpf_bprm_opts_set_proto = {
     .name = "bprm_opts_set",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    }
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        }
     // .arg1_btf_id	= &bpf_bprm_opts_set_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_ima_inode_hash_proto = {
+static constexpr EbpfHelperPrototype bpf_ima_inode_hash_proto = {
     .name = "ima_inode_hash",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
     //    .allowed	= bpf_ima_inode_hash_allowed,
     //    .arg1_btf_id	= &bpf_ima_inode_hash_btf_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_ktime_get_coarse_ns_proto = {
+static constexpr EbpfHelperPrototype bpf_ktime_get_coarse_ns_proto = {
     .name = "ktime_get_coarse_ns",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
 };
 
 // bpf_skb_check_mtu_proto/bpf_xdp_check_mtu_proto
-static const struct EbpfHelperPrototype bpf_check_mtu_proto = {
+static constexpr EbpfHelperPrototype bpf_check_mtu_proto = {
     .name = "check_mtu",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_INT,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_INT,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_for_each_map_elem_proto = {
+static constexpr EbpfHelperPrototype bpf_for_each_map_elem_proto = {
     .name = "for_each_map_elem",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
-        EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
-        EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP,
+            EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
+            EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_snprintf_proto = {
+static constexpr EbpfHelperPrototype bpf_snprintf_proto = {
     .name = "snprintf",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL, //  TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_PTR_TO_CONST_STR,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL, //  TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sys_bpf_proto = {
+static constexpr EbpfHelperPrototype bpf_sys_bpf_proto = {
     .name = "sys_bpf",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, //  TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, //  TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_btf_find_by_name_kind_proto = {
+static constexpr EbpfHelperPrototype bpf_btf_find_by_name_kind_proto = {
     .name = "btf_find_by_name_kind",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, //  TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, //  TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_sys_close_proto = {
+static constexpr EbpfHelperPrototype bpf_sys_close_proto = {
     .name = "sys_close",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_kallsyms_lookup_name_proto = {
+static constexpr EbpfHelperPrototype bpf_kallsyms_lookup_name_proto = {
     .name = "kallsyms_lookup_name",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
-    }
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_timer_init_proto = {
+static constexpr EbpfHelperPrototype bpf_timer_init_proto = {
     .name = "timer_init",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
-        EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // TODO: const
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
+            EBPF_ARGUMENT_TYPE_PTR_TO_MAP, // TODO: const
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_timer_set_callback_proto = {
+static constexpr EbpfHelperPrototype bpf_timer_set_callback_proto = {
     .name = "timer_set_callback",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
-        EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
+            EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_timer_start_proto = {
+static constexpr EbpfHelperPrototype bpf_timer_start_proto = {
     .name = "timer_start",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_timer_cancel_proto = {
+static constexpr EbpfHelperPrototype bpf_timer_cancel_proto = {
     .name = "timer_cancel",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_TIMER,
+        },
 };
 
 // same signature for bpf_get_func_ip_proto_kprobe/bpf_get_func_ip_proto_tracing
-static const struct EbpfHelperPrototype bpf_get_func_ip_proto = {
+static constexpr EbpfHelperPrototype bpf_get_func_ip_proto = {
     .name = "get_func_ip",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_attach_cookie_proto = {
+static constexpr EbpfHelperPrototype bpf_get_attach_cookie_proto = {
     .name = "get_attach_cookie",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_task_pt_regs_proto = {
+static constexpr EbpfHelperPrototype bpf_task_pt_regs_proto = {
     .name = "task_pt_regs",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+        },
     //    .arg1_btf_id	= &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
     //    .ret_btf_id	= &bpf_task_pt_regs_ids[0],
 };
 
-static const struct EbpfHelperPrototype bpf_get_branch_snapshot_proto = {
+static constexpr EbpfHelperPrototype bpf_get_branch_snapshot_proto = {
     .name = "get_branch_snapshot",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_WRITABLE_MEM,
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_func_arg_proto = {
+static constexpr EbpfHelperPrototype bpf_get_func_arg_proto = {
     .name = "get_func_arg",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_func_ret_proto = {
+static constexpr EbpfHelperPrototype bpf_get_func_ret_proto = {
     .name = "get_func_ret",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-        EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+            EBPF_ARGUMENT_TYPE_PTR_TO_LONG,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_get_func_arg_cnt_proto = {
+static constexpr EbpfHelperPrototype bpf_get_func_arg_cnt_proto = {
     .name = "get_func_arg_cnt",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_CTX,
+        },
 };
 
-static const struct EbpfHelperPrototype bpf_trace_vprintk_proto = {
+static constexpr EbpfHelperPrototype bpf_trace_vprintk_proto = {
     .name = "trace_vprintk",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE,
-        EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL, // TODO: readonly
-        EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE,
+            EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL, // TODO: readonly
+            EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO,
+        },
 };
 
-const struct EbpfHelperPrototype bpf_skc_to_unix_sock_proto = {
+constexpr EbpfHelperPrototype bpf_skc_to_unix_sock_proto = {
     .name = "skc_to_unix_sock",
     .return_type = EBPF_RETURN_TYPE_PTR_TO_BTF_ID_OR_NULL,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
-    }
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID_SOCK_COMMON,
+        }
     //    .ret_btf_id		= &btf_sock_ids[BTF_SOCK_TYPE_UNIX],
 };
 
-const struct EbpfHelperPrototype bpf_find_vma_proto = {
+constexpr EbpfHelperPrototype bpf_find_vma_proto = {
     .name = "find_vma",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
-        EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    },
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_PTR_TO_BTF_ID,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
+            EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
     // .arg1_btf_id = &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
 };
 
-const struct EbpfHelperPrototype bpf_loop_proto = {
+constexpr EbpfHelperPrototype bpf_loop_proto = {
     .name = "loop",
     .return_type = EBPF_RETURN_TYPE_INTEGER,
-    .argument_type = {
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-        EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
-        EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
-        EBPF_ARGUMENT_TYPE_ANYTHING,
-    }
+    .argument_type =
+        {
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+            EBPF_ARGUMENT_TYPE_PTR_TO_FUNC,
+            EBPF_ARGUMENT_TYPE_PTR_TO_STACK_OR_NULL,
+            EBPF_ARGUMENT_TYPE_ANYTHING,
+        },
 };
 
 #define FN(x) bpf_##x##_proto
 // keep this on a round line
-const struct EbpfHelperPrototype prototypes[] = {
+const EbpfHelperPrototype prototypes[] = {
     FN(unspec),
     FN(map_lookup_elem),
     FN(map_update_elem),
@@ -2037,7 +2207,8 @@ const struct EbpfHelperPrototype prototypes[] = {
     FN(read_branch_records),
     FN(get_ns_current_pid_tgid),
     FN(xdp_output),
-    FN(get_netns_cookie_sock), // XXX: same signature for bpf_get_netns_cookie_sock_addr_proto  or bpf_get_netns_cookie_sock_addr_proto
+    FN(get_netns_cookie_sock), // XXX: same signature for bpf_get_netns_cookie_sock_addr_proto  or
+                               // bpf_get_netns_cookie_sock_addr_proto
     FN(get_current_ancestor_cgroup_id),
     FN(sk_assign),
     FN(ktime_get_boot_ns),
@@ -2104,19 +2275,22 @@ const struct EbpfHelperPrototype prototypes[] = {
 };
 
 bool is_helper_usable_linux(int32_t n) {
-    if (n >= (int)(sizeof(prototypes) / sizeof(prototypes[0])) || n < 0)
+    if (n >= (int)(sizeof(prototypes) / sizeof(prototypes[0])) || n < 0) {
         return false;
+    }
 
     // If the helper has a context_descriptor, it must match the hook's context_descriptor.
     if ((prototypes[n].context_descriptor != nullptr) &&
-        (prototypes[n].context_descriptor != global_program_info->type.context_descriptor))
+        (prototypes[n].context_descriptor != global_program_info->type.context_descriptor)) {
         return false;
+    }
 
     return true;
 }
 
 EbpfHelperPrototype get_helper_prototype_linux(int32_t n) {
-    if (!is_helper_usable_linux(n))
+    if (!is_helper_usable_linux(n)) {
         throw std::exception();
+    }
     return prototypes[n];
-}
+}
\ No newline at end of file
diff --git a/src/linux/linux_platform.cpp b/src/linux/linux_platform.cpp
index 01cd9477c..ea752bbac 100644
--- a/src/linux/linux_platform.cpp
+++ b/src/linux/linux_platform.cpp
@@ -3,21 +3,17 @@
 #include <stdexcept>
 #if __linux__
 #include <linux/bpf.h>
-#define PTYPE(name, descr, native_type, prefixes) \
-             {name, descr, native_type, prefixes}
-#define PTYPE_PRIVILEGED(name, descr, native_type, prefixes) \
-                        {name, descr, native_type, prefixes, true}
+#define PTYPE(name, descr, native_type, prefixes) {name, descr, native_type, prefixes}
+#define PTYPE_PRIVILEGED(name, descr, native_type, prefixes) {name, descr, native_type, prefixes, true}
 #else
-#define PTYPE(name, descr, native_type, prefixes) \
-             {name, descr, 0, prefixes}
-#define PTYPE_PRIVILEGED(name, descr, native_type, prefixes) \
-                        {name, descr, 0, prefixes, true}
+#define PTYPE(name, descr, native_type, prefixes) {name, descr, 0, prefixes}
+#define PTYPE_PRIVILEGED(name, descr, native_type, prefixes) {name, descr, 0, prefixes, true}
 #endif
 #include "crab_verifier.hpp"
 #include "helpers.hpp"
-#include "platform.hpp"
-#include "linux_platform.hpp"
 #include "linux/gpl/spec_type_descriptors.hpp"
+#include "linux_platform.hpp"
+#include "platform.hpp"
 
 // Map definitions as they appear in an ELF file, so field width matters.
 struct bpf_load_map_def {
@@ -40,11 +36,9 @@ static int create_map_linux(uint32_t map_type, uint32_t key_size, uint32_t value
 const EbpfProgramType linux_socket_filter_program_type =
     PTYPE("socket_filter", &g_socket_filter_descr, BPF_PROG_TYPE_SOCKET_FILTER, {"socket"});
 
-const EbpfProgramType linux_xdp_program_type =
-    PTYPE("xdp", &g_xdp_descr, BPF_PROG_TYPE_XDP, {"xdp"});
+const EbpfProgramType linux_xdp_program_type = PTYPE("xdp", &g_xdp_descr, BPF_PROG_TYPE_XDP, {"xdp"});
 
-const EbpfProgramType cilium_lxc_program_type =
-    PTYPE("lxc", &g_sched_descr, BPF_PROG_TYPE_SOCKET_FILTER, {});
+const EbpfProgramType cilium_lxc_program_type = PTYPE("lxc", &g_sched_descr, BPF_PROG_TYPE_SOCKET_FILTER, {});
 
 const std::vector<EbpfProgramType> linux_program_types = {
     PTYPE("unspec", &g_unspec_descr, BPF_PROG_TYPE_UNSPEC, {}),
@@ -92,8 +86,9 @@ static EbpfProgramType get_program_type_linux(const std::string& section, const
 
     for (const EbpfProgramType& t : linux_program_types) {
         for (const std::string& prefix : t.section_prefixes) {
-            if (section.find(prefix) == 0)
+            if (section.find(prefix) == 0) {
                 return t;
+            }
         }
     }
 
@@ -135,8 +130,7 @@ static const EbpfMapType linux_map_types[] = {
 #endif
 };
 
-EbpfMapType get_map_type_linux(uint32_t platform_specific_type)
-{
+EbpfMapType get_map_type_linux(uint32_t platform_specific_type) {
     uint32_t index = platform_specific_type;
     if ((index == 0) || (index >= sizeof(linux_map_types) / sizeof(linux_map_types[0]))) {
         return linux_map_types[0];
@@ -179,9 +173,10 @@ void parse_maps_section_linux(std::vector<EbpfMapDescriptor>& map_descriptors, c
 void resolve_inner_map_references_linux(std::vector<EbpfMapDescriptor>& map_descriptors) {
     for (size_t i = 0; i < map_descriptors.size(); i++) {
         unsigned int inner = map_descriptors[i].inner_map_fd; // Get the inner_map_idx back.
-        if (inner >= map_descriptors.size())
-            throw std::runtime_error(std::string("bad inner map index ") + std::to_string(inner)
-                                     + " for map " + std::to_string(i));
+        if (inner >= map_descriptors.size()) {
+            throw std::runtime_error(std::string("bad inner map index ") + std::to_string(inner) + " for map " +
+                                     std::to_string(i));
+        }
         map_descriptors[i].inner_map_fd = map_descriptors.at(inner).original_fd;
     }
 }
@@ -195,15 +190,14 @@ static int do_bpf(bpf_cmd cmd, union bpf_attr& attr) { return syscall(321, cmd,
  *  This function requires admin privileges.
  */
 static int create_map_linux(uint32_t map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
-                            ebpf_verifier_options_t options)
-{
+                            ebpf_verifier_options_t options) {
     if (options.mock_map_fds) {
         EbpfMapType type = get_map_type_linux(map_type);
         return create_map_crab(type, key_size, value_size, max_entries, options);
     }
 
 #if __linux__
-    union bpf_attr attr {};
+    union bpf_attr attr{};
     memset(&attr, '\0', sizeof(attr));
     attr.map_type = map_type;
     attr.key_size = key_size;
@@ -229,8 +223,7 @@ static int create_map_linux(uint32_t map_type, uint32_t key_size, uint32_t value
 #endif
 }
 
-EbpfMapDescriptor& get_map_descriptor_linux(int map_fd)
-{
+EbpfMapDescriptor& get_map_descriptor_linux(int map_fd) {
     // First check if we already have the map descriptor cached.
     EbpfMapDescriptor* map = find_map_descriptor(map_fd);
     if (map != nullptr) {
@@ -246,14 +239,13 @@ EbpfMapDescriptor& get_map_descriptor_linux(int map_fd)
     throw std::runtime_error(std::string("map_fd not found"));
 }
 
-const ebpf_platform_t g_ebpf_platform_linux = {
-    get_program_type_linux,
-    get_helper_prototype_linux,
-    is_helper_usable_linux,
-    sizeof(bpf_load_map_def),
-    parse_maps_section_linux,
-    get_map_descriptor_linux,
-    get_map_type_linux,
-    resolve_inner_map_references_linux,
-    bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::packet
-};
+const ebpf_platform_t g_ebpf_platform_linux = {get_program_type_linux,
+                                               get_helper_prototype_linux,
+                                               is_helper_usable_linux,
+                                               sizeof(bpf_load_map_def),
+                                               parse_maps_section_linux,
+                                               get_map_descriptor_linux,
+                                               get_map_type_linux,
+                                               resolve_inner_map_references_linux,
+                                               bpf_conformance_groups_t::default_groups |
+                                                   bpf_conformance_groups_t::packet};
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 50d6d25aa..5c43972ec 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -111,13 +111,16 @@ int main(int argc, char** argv) {
 
     std::set<std::string> include_groups = _get_conformance_group_names();
     app.add_option("--include_groups", include_groups, "Include conformance groups")
-        ->group("Features")->type_name("GROUPS")
+        ->group("Features")
+        ->type_name("GROUPS")
         ->expected(0, _conformance_groups.size())
         ->check(CLI::IsMember(_get_conformance_group_names()));
 
     std::set<std::string> exclude_groups;
     app.add_option("--exclude_groups", exclude_groups, "Exclude conformance groups")
-        ->group("Features")->type_name("GROUPS")->option_text("")
+        ->group("Features")
+        ->type_name("GROUPS")
+        ->option_text("")
         ->expected(0, _conformance_groups.size())
         ->check(CLI::IsMember(_get_conformance_group_names()));
 
@@ -144,8 +147,9 @@ int main(int argc, char** argv) {
 
     CLI11_PARSE(app, argc, argv);
 
-    if (verbose)
+    if (verbose) {
         ebpf_verifier_options.print_invariants = ebpf_verifier_options.print_failures = true;
+    }
 
     // Enable default conformance groups, which don't include callx or packet.
     ebpf_platform_t platform = g_ebpf_platform_linux;
@@ -182,8 +186,9 @@ int main(int argc, char** argv) {
     }
 #endif
 
-    if (domain == "linux")
+    if (domain == "linux") {
         ebpf_verifier_options.mock_map_fds = false;
+    }
 
     // Read a set of raw program sections from an ELF file.
     vector<raw_program> raw_progs;
diff --git a/src/main/linux_verifier.cpp b/src/main/linux_verifier.cpp
index e5320499d..42996398e 100644
--- a/src/main/linux_verifier.cpp
+++ b/src/main/linux_verifier.cpp
@@ -2,10 +2,10 @@
 // SPDX-License-Identifier: MIT
 #if __linux__
 
-#include <unistd.h>
-#include <linux/bpf.h>
 #include <ctime>
+#include <linux/bpf.h>
 #include <tuple>
+#include <unistd.h>
 
 #include "config.hpp"
 #include "linux_verifier.hpp"
@@ -19,7 +19,8 @@ static int do_bpf(bpf_cmd cmd, union bpf_attr& attr) { return syscall(321, cmd,
  *  \return A pair (passed, elapsec_secs)
  */
 
-std::tuple<bool, double> bpf_verify_program(const EbpfProgramType& type, const std::vector<ebpf_inst>& raw_prog, ebpf_verifier_options_t* options) {
+std::tuple<bool, double> bpf_verify_program(const EbpfProgramType& type, const std::vector<ebpf_inst>& raw_prog,
+                                            ebpf_verifier_options_t* options) {
     std::vector<char> buf(options->print_failures ? 1000000 : 10);
     buf[0] = 0;
     memset(buf.data(), '\0', buf.size());
@@ -38,9 +39,7 @@ std::tuple<bool, double> bpf_verify_program(const EbpfProgramType& type, const s
     attr.kern_version = 0x041800;
     attr.prog_flags = 0;
 
-    const auto [res, elapsed_secs] = timed_execution([&] {
-        return do_bpf(BPF_PROG_LOAD, attr);
-    });
+    const auto [res, elapsed_secs] = timed_execution([&] { return do_bpf(BPF_PROG_LOAD, attr); });
     if (res < 0) {
         if (options->print_failures) {
             std::cerr << "Failed to verify program: " << strerror(errno) << " (" << errno << ")\n";
diff --git a/src/main/linux_verifier.hpp b/src/main/linux_verifier.hpp
index 83cf8211e..8e6f055fe 100644
--- a/src/main/linux_verifier.hpp
+++ b/src/main/linux_verifier.hpp
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <iostream>
 #include "platform.hpp"
+#include <iostream>
 
 #if __linux__
 
@@ -11,18 +11,21 @@
 #include <vector>
 
 #include "asm_syntax.hpp"
-#include "spec_type_descriptors.hpp"
-#include "linux/gpl/spec_type_descriptors.hpp"
 #include "ebpf_vm_isa.hpp"
+#include "linux/gpl/spec_type_descriptors.hpp"
+#include "spec_type_descriptors.hpp"
 
-int create_map_linux(uint32_t map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries, ebpf_verifier_options_t options);
-std::tuple<bool, double> bpf_verify_program(const EbpfProgramType& type, const std::vector<ebpf_inst>& raw_prog, ebpf_verifier_options_t* options);
+int create_map_linux(uint32_t map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
+                     ebpf_verifier_options_t options);
+std::tuple<bool, double> bpf_verify_program(const EbpfProgramType& type, const std::vector<ebpf_inst>& raw_prog,
+                                            ebpf_verifier_options_t* options);
 
 #else
 
 #define create_map_linux (nullptr)
 
-inline std::tuple<bool, double> bpf_verify_program(EbpfProgramType type, const std::vector<ebpf_inst>& raw_prog, ebpf_verifier_options_t* options) {
+inline std::tuple<bool, double> bpf_verify_program(EbpfProgramType type, const std::vector<ebpf_inst>& raw_prog,
+                                                   ebpf_verifier_options_t* options) {
     std::cerr << "linux domain is unsupported on this machine\n";
     exit(64);
     return {{}, {}};
diff --git a/src/main/memsize_windows.hpp b/src/main/memsize_windows.hpp
index 902887471..aefbe0251 100644
--- a/src/main/memsize_windows.hpp
+++ b/src/main/memsize_windows.hpp
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <windows.h>
 #include <Psapi.h>
+#include <windows.h>
 
 inline long resident_set_size_kb() {
     PROCESS_MEMORY_COUNTERS info;
diff --git a/src/main/utils.hpp b/src/main/utils.hpp
index 97c05330e..1cca0dc64 100644
--- a/src/main/utils.hpp
+++ b/src/main/utils.hpp
@@ -1,7 +1,7 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-template<typename F>
+template <typename F>
 auto timed_execution(F f) {
     clock_t begin = clock();
 
diff --git a/src/platform.hpp b/src/platform.hpp
index ab4ddcda5..d52dc6c64 100644
--- a/src/platform.hpp
+++ b/src/platform.hpp
@@ -8,8 +8,8 @@
 
 #include "../external/bpf_conformance/include/bpf_conformance.h"
 #include "config.hpp"
-#include "spec_type_descriptors.hpp"
 #include "helpers.hpp"
+#include "spec_type_descriptors.hpp"
 
 typedef EbpfProgramType (*ebpf_get_program_type_fn)(const std::string& section, const std::string& path);
 
@@ -26,7 +26,9 @@ typedef int (*ebpf_create_map_fn)(uint32_t map_type, uint32_t key_size, uint32_t
 
 // Parse map records and allocate map fd's.
 // In the future we may want to move map fd allocation after the verifier step.
-typedef void (*ebpf_parse_maps_section_fn)(std::vector<EbpfMapDescriptor>& map_descriptors, const char* data, size_t map_record_size, int map_count, const struct ebpf_platform_t* platform, ebpf_verifier_options_t options);
+typedef void (*ebpf_parse_maps_section_fn)(std::vector<EbpfMapDescriptor>& map_descriptors, const char* data,
+                                           size_t map_record_size, int map_count,
+                                           const struct ebpf_platform_t* platform, ebpf_verifier_options_t options);
 typedef void (*ebpf_resolve_inner_map_references_fn)(std::vector<EbpfMapDescriptor>& map_descriptors);
 
 typedef EbpfMapDescriptor& (*ebpf_get_map_descriptor_fn)(int map_fd);
diff --git a/src/spec_type_descriptors.hpp b/src/spec_type_descriptors.hpp
index b827f17db..8ed4d84da 100644
--- a/src/spec_type_descriptors.hpp
+++ b/src/spec_type_descriptors.hpp
@@ -2,25 +2,23 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+#include "ebpf_base.h"
+#include "ebpf_vm_isa.hpp"
 #include <map>
 #include <string>
 #include <vector>
-#include "ebpf_base.h"
-#include "ebpf_vm_isa.hpp"
 
 #include "crab_utils/lazy_allocator.hpp"
 
 constexpr int EBPF_STACK_SIZE = 512;
 
-enum class EbpfMapValueType {
-    ANY, MAP, PROGRAM
-};
+enum class EbpfMapValueType { ANY, MAP, PROGRAM };
 
 struct EbpfMapType {
     uint32_t platform_specific_type; // EbpfMapDescriptor.type value.
-    std::string name; // For ease of display, not used by the verifier.
-    bool is_array; // True if key is integer in range [0,max_entries-1].
-    EbpfMapValueType value_type; // The type of items stored in the map.
+    std::string name;                // For ease of display, not used by the verifier.
+    bool is_array;                   // True if key is integer in range [0,max_entries-1].
+    EbpfMapValueType value_type;     // The type of items stored in the map.
 };
 
 struct EbpfMapDescriptor {
@@ -44,11 +42,8 @@ struct EbpfProgramType {
 
 void print_map_descriptors(const std::vector<EbpfMapDescriptor>& descriptors, std::ostream& o);
 
-using EquivalenceKey = std::tuple<
-    EbpfMapValueType /* value_type */,
-    uint32_t /* key_size */,
-    uint32_t /* value_size */,
-    uint32_t /* max_entries */>;
+using EquivalenceKey = std::tuple<EbpfMapValueType /* value_type */, uint32_t /* key_size */, uint32_t /* value_size */,
+                                  uint32_t /* max_entries */>;
 
 struct program_info {
     const struct ebpf_platform_t* platform{};
diff --git a/src/string_constraints.hpp b/src/string_constraints.hpp
index 278c8f414..a6f050011 100644
--- a/src/string_constraints.hpp
+++ b/src/string_constraints.hpp
@@ -30,19 +30,28 @@ struct string_invariant {
 
     string_invariant() = default;
 
-    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)) { };
+    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)) {};
 
     string_invariant(const string_invariant& inv) = default;
     string_invariant& operator=(const string_invariant& inv) = default;
 
-    [[nodiscard]] bool is_bottom() const { return !maybe_inv; }
-    [[nodiscard]] bool empty() const { return maybe_inv && maybe_inv->empty(); }
+    [[nodiscard]]
+    bool is_bottom() const {
+        return !maybe_inv;
+    }
+    [[nodiscard]]
+    bool empty() const {
+        return maybe_inv && maybe_inv->empty();
+    }
 
-    static string_invariant top() { return string_invariant{ {} }; }
+    static string_invariant top() { return string_invariant{{}}; }
     static string_invariant bottom() { return string_invariant{}; }
 
-    [[nodiscard]] const std::set<std::string>& value() const {
-        if (is_bottom()) throw std::runtime_error("cannot iterate bottom");
+    [[nodiscard]]
+    const std::set<std::string>& value() const {
+        if (is_bottom()) {
+            throw std::runtime_error("cannot iterate bottom");
+        }
         return *maybe_inv;
     }
 
@@ -51,11 +60,13 @@ struct string_invariant {
 
     bool operator==(const string_invariant& other) const { return maybe_inv == other.maybe_inv; }
 
-    [[nodiscard]] bool contains(const std::string& item) const {
+    [[nodiscard]]
+    bool contains(const std::string& item) const {
         return !is_bottom() && maybe_inv.value().count(item);
     }
 
     friend std::ostream& operator<<(std::ostream&, const string_invariant& inv);
 };
 
-std::vector<crab::linear_constraint_t> parse_linear_constraints(const std::set<std::string>& constraints, std::vector<crab::interval_t>& numeric_ranges);
+std::vector<crab::linear_constraint_t> parse_linear_constraints(const std::set<std::string>& constraints,
+                                                                std::vector<crab::interval_t>& numeric_ranges);
diff --git a/src/test/conformance_check.cpp b/src/test/conformance_check.cpp
index b5aa75f9c..dcd892aac 100644
--- a/src/test/conformance_check.cpp
+++ b/src/test/conformance_check.cpp
@@ -6,13 +6,13 @@
 // value of r0 at the end of execution.
 // The program is intended to be used with the bpf conformance test suite.
 
+#include "CLI11.hpp"
+#include "ebpf_verifier.hpp"
+#include "ebpf_yaml.hpp"
 #include <iostream>
 #include <sstream>
 #include <string>
 #include <vector>
-#include "ebpf_verifier.hpp"
-#include "ebpf_yaml.hpp"
-#include "CLI11.hpp"
 
 using string = std::string;
 
@@ -27,8 +27,9 @@ std::vector<uint8_t> base16_decode(const std::string& input) {
     std::stringstream ss(input);
     std::string value;
     while (std::getline(ss, value, ' ')) {
-        if (value.empty())
+        if (value.empty()) {
             continue;
+        }
         try {
             output.push_back(std::stoi(value, nullptr, 16));
         } catch (std::invalid_argument) {
@@ -65,8 +66,7 @@ int main(int argc, char** argv) {
         std::getline(std::cin, program_string);
     }
 
-    const auto& result =
-        run_conformance_test_case(base16_decode(memory_string), base16_decode(program_string), debug);
+    const auto& result = run_conformance_test_case(base16_decode(memory_string), base16_decode(program_string), debug);
     if (!result.success) {
         // Write failure reason to stdout since the bpf conformance library does not look at stderr.
         std::cout << "Verification failed\n";
@@ -82,10 +82,11 @@ int main(int argc, char** argv) {
     }
 
     // Print output so the conformance test suite can check it.
-    if (result.r0_value.singleton() && result.r0_value.singleton().value().fits_cast_to_int64())
+    if (result.r0_value.singleton() && result.r0_value.singleton().value().fits_cast_to_int64()) {
         std::cout << std::hex << result.r0_value.singleton().value().cast_to_uint64() << std::endl;
-    else
+    } else {
         std::cout << result.r0_value << std::endl;
+    }
 
     return 0;
 }
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index ae7f5f9dd..9ab19da5d 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -1,21 +1,22 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include <catch2/catch_all.hpp>
-#include <boost/dll/runtime_symbol_info.hpp>
 #include "../external/bpf_conformance/include/bpf_conformance.h"
+#include <boost/dll/runtime_symbol_info.hpp>
+#include <catch2/catch_all.hpp>
 
 #define CONFORMANCE_TEST_PATH "external/bpf_conformance/tests/"
 
-void test_conformance(std::string filename, bpf_conformance_test_result_t expected_result, std::string expected_reason) {
+void test_conformance(std::string filename, bpf_conformance_test_result_t expected_result,
+                      std::string expected_reason) {
     std::vector<std::filesystem::path> test_files = {CONFORMANCE_TEST_PATH + filename};
     boost::filesystem::path test_path = boost::dll::program_location();
     boost::filesystem::path extension = test_path.extension();
     std::filesystem::path plugin_path =
         test_path.remove_filename().append("conformance_check" + extension.string()).string();
-    std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result = bpf_conformance(
-        test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
-        bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::callx,
-        bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
+    std::map<std::filesystem::path, std::tuple<bpf_conformance_test_result_t, std::string>> result =
+        bpf_conformance(test_files, plugin_path, {}, {}, {}, bpf_conformance_test_CPU_version_t::v4,
+                        bpf_conformance_groups_t::default_groups | bpf_conformance_groups_t::callx,
+                        bpf_conformance_list_instructions_t::LIST_INSTRUCTIONS_NONE, true);
     for (auto file : test_files) {
         auto& [file_result, reason] = result[file];
         REQUIRE(file_result == expected_result);
@@ -26,29 +27,29 @@ void test_conformance(std::string filename, bpf_conformance_test_result_t expect
     }
 }
 
-#define TEST_CONFORMANCE(filename) \
-    TEST_CASE("conformance_check " filename, "[conformance]") { \
+#define TEST_CONFORMANCE(filename)                                                       \
+    TEST_CASE("conformance_check " filename, "[conformance]") {                          \
         test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_PASS, {}); \
     }
 
 // Any tests that fail verification are safe, but might prevent
 // legitimate programs from being usable.
-#define TEST_CONFORMANCE_VERIFICATION_FAILED(filename) \
-    TEST_CASE("conformance_check " filename, "[conformance]") { \
+#define TEST_CONFORMANCE_VERIFICATION_FAILED(filename)                                                       \
+    TEST_CASE("conformance_check " filename, "[conformance]") {                                              \
         test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "Verification failed"); \
     }
 
 // Any tests that return top are safe, but are not as precise as they
 // could be and so may prevent legitimate programs from being usable.
-#define TEST_CONFORMANCE_TOP(filename) \
-    TEST_CASE("conformance_check " filename, "[conformance]") { \
+#define TEST_CONFORMANCE_TOP(filename)                                                                               \
+    TEST_CASE("conformance_check " filename, "[conformance]") {                                                      \
         test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "Couldn't determine r0 value"); \
     }
 
 // Any tests that return a range are safe, but are not as precise as they
 // could be and so may prevent legitimate programs from being usable.
-#define TEST_CONFORMANCE_RANGE(filename, range)                                                                  \
-    TEST_CASE("conformance_check " filename, "[conformance]") {                                                  \
+#define TEST_CONFORMANCE_RANGE(filename, range)                                                                   \
+    TEST_CASE("conformance_check " filename, "[conformance]") {                                                   \
         test_conformance(filename, bpf_conformance_test_result_t::TEST_RESULT_ERROR, "r0 value is range " range); \
     }
 
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index a636fae58..34a173918 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: MIT
 #include <catch2/catch_all.hpp>
 
-#include "asm_ostream.hpp"
 #include "asm_marshal.hpp"
+#include "asm_ostream.hpp"
 #include "asm_unmarshal.hpp"
 
 // Below we define a tample of instruction templates that specify
@@ -13,12 +13,12 @@
 // for the 'offset' field of an instruction.  Any non-sentinel values
 // in an instruction template are treated as literals.
 
-constexpr int MEM_OFFSET = 3; // Any valid memory offset value.
-constexpr int JMP_OFFSET = 5; // Any valid jump offset value.
-constexpr int DST = 7; // Any destination register number.
-constexpr int HELPER_ID = 8; // Any helper ID.
-constexpr int SRC = 9; // Any source register number.
-constexpr int IMM = -1; // Any imm value.
+constexpr int MEM_OFFSET = 3;                           // Any valid memory offset value.
+constexpr int JMP_OFFSET = 5;                           // Any valid jump offset value.
+constexpr int DST = 7;                                  // Any destination register number.
+constexpr int HELPER_ID = 8;                            // Any helper ID.
+constexpr int SRC = 9;                                  // Any source register number.
+constexpr int IMM = -1;                                 // Any imm value.
 constexpr int INVALID_REGISTER = R10_STACK_POINTER + 1; // Not a valid register.
 
 struct ebpf_instruction_template_t {
@@ -211,18 +211,20 @@ static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t&
 }
 
 // Verify that we can successfully unmarshal a 64-bit immediate instruction.
-static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2,
+                                    const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {inst1, inst2, exit, exit}, info}));
+    InstructionSeq parsed =
+        std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {inst1, inst2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
 // Verify that if we unmarshal an instruction and then re-marshal it,
 // we get what we expect.
-static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform,
-                      .type = platform.get_program_type("unspec", "unspec")};
+static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result,
+                                      const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
@@ -241,7 +243,8 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed =
+        std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -259,7 +262,8 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
+    InstructionSeq parsed =
+        std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
     (void)_;  // unused
@@ -274,7 +278,8 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
 
 // Verify that if we marshal an instruction and then unmarshal it,
 // we get the original.
-static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd = false,
+                                      const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", marshal(ins, 0), info}));
     REQUIRE(parsed.size() == 1);
@@ -284,13 +289,15 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
     REQUIRE(single == ins);
 }
 
-static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message,
+                                         const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", 0, "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
 
-static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message,
+                                 const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
@@ -299,7 +306,8 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     REQUIRE(error_message == expected_error_message);
 }
 
-static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message,
+                                      const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     const ebpf_inst exit{.opcode = INST_OP_EXIT};
     std::vector<ebpf_inst> insns{inst, exit, exit};
@@ -310,7 +318,8 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
 }
 
 // Check that unmarshaling a 64-bit immediate instruction fails.
-static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message,
+                                 const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector<ebpf_inst> insns = {inst1, inst2};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
@@ -346,7 +355,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
                     Bin{.op = Bin::Op::MOV, .dst = Reg{1}, .v = Imm{2}, .is64 = true, .lddw = true}, true);
             }
             SECTION("r10") {
-                check_marshal_unmarshal_fail(Bin{.op = Bin::Op::ADD, .dst = Reg{10}, .v = Imm{4}, .is64=true},
+                check_marshal_unmarshal_fail(Bin{.op = Bin::Op::ADD, .dst = Reg{10}, .v = Imm{4}, .is64 = true},
                                              "0: invalid target r10\n");
             }
         }
@@ -356,18 +365,15 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
         compare_marshal_unmarshal(Un{.op = Un::Op::NEG, .dst = Reg{1}, .is64 = true});
     }
     SECTION("Endian") {
-        // FIX: `.is64` comes from the instruction class (BPF_ALU or BPF_ALU64) but is unused since it can be derived from `.op`.
+        // FIX: `.is64` comes from the instruction class (BPF_ALU or BPF_ALU64) but is unused since it can be derived
+        // from `.op`.
         {
             auto ops = {
-                Un::Op::BE16,
-                Un::Op::BE32,
-                Un::Op::BE64,
-                Un::Op::LE16,
-                Un::Op::LE32,
-                Un::Op::LE64,
+                Un::Op::BE16, Un::Op::BE32, Un::Op::BE64, Un::Op::LE16, Un::Op::LE32, Un::Op::LE64,
             };
-            for (auto op : ops)
+            for (auto op : ops) {
                 compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = false});
+            }
         }
         {
             auto ops = {
@@ -375,8 +381,9 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
                 Un::Op::SWAP32,
                 Un::Op::SWAP64,
             };
-            for (auto op : ops)
+            for (auto op : ops) {
                 compare_marshal_unmarshal(Un{.op = op, .dst = Reg{1}, .is64 = true});
+            }
         }
     }
 
@@ -384,7 +391,7 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
 
     SECTION("Jmp") {
         auto ops = {Condition::Op::EQ, Condition::Op::GT, Condition::Op::GE, Condition::Op::SET,
-            // Condition::Op::NSET, does not exist in ebpf
+                    // Condition::Op::NSET, does not exist in ebpf
                     Condition::Op::NE, Condition::Op::SGT, Condition::Op::SGE, Condition::Op::LT, Condition::Op::LE,
                     Condition::Op::SLT, Condition::Op::SLE};
         SECTION("goto offset") {
@@ -415,8 +422,9 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
     }
 
     SECTION("Call") {
-        for (int func : {1, 17})
+        for (int func : {1, 17}) {
             compare_marshal_unmarshal(Call{func});
+        }
 
         // Test callx without support.
         std::ostringstream oss;
@@ -453,22 +461,32 @@ TEST_CASE("disasm_marshal", "[disasm][marshal]") {
         for (int w : ws) {
             if (w == 4 || w == 8) {
                 Deref access{.width = w, .basereg = Reg{2}, .offset = 17};
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::ADD, .fetch = false, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::ADD, .fetch = true, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::OR, .fetch = false, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::OR, .fetch = true, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::AND, .fetch = false, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::AND, .fetch = true, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XOR, .fetch = false, .access = access, .valreg = Reg{1}});
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XOR, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::ADD, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::ADD, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::OR, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::OR, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::AND, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::AND, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::XOR, .fetch = false, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::XOR, .fetch = true, .access = access, .valreg = Reg{1}});
                 check_marshal_unmarshal_fail(
                     Atomic{.op = Atomic::Op::XCHG, .fetch = false, .access = access, .valreg = Reg{1}},
                     "0: unsupported immediate\n");
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::XCHG, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::XCHG, .fetch = true, .access = access, .valreg = Reg{1}});
                 check_marshal_unmarshal_fail(
                     Atomic{.op = Atomic::Op::CMPXCHG, .fetch = false, .access = access, .valreg = Reg{1}},
                     "0: unsupported immediate\n");
-                compare_marshal_unmarshal(Atomic{.op = Atomic::Op::CMPXCHG, .fetch = true, .access = access, .valreg = Reg{1}});
+                compare_marshal_unmarshal(
+                    Atomic{.op = Atomic::Op::CMPXCHG, .fetch = true, .access = access, .valreg = Reg{1}});
             }
         }
     }
@@ -556,10 +574,9 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
 
 TEST_CASE("unmarshal extension opcodes", "[disasm][marshal]") {
     // Merge (rX <<= 32; rX >>>= 32) into wX = rX.
-    compare_unmarshal_marshal(
-        ebpf_inst{.opcode = INST_ALU_OP_LSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
-        ebpf_inst{.opcode = INST_ALU_OP_RSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
-        ebpf_inst{.opcode = INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU, .dst = 1, .src = 1});
+    compare_unmarshal_marshal(ebpf_inst{.opcode = INST_ALU_OP_LSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+                              ebpf_inst{.opcode = INST_ALU_OP_RSH | INST_SRC_IMM | INST_CLS_ALU64, .dst = 1, .imm = 32},
+                              ebpf_inst{.opcode = INST_ALU_OP_MOV | INST_SRC_REG | INST_CLS_ALU, .dst = 1, .src = 1});
 
     // Merge (rX <<= 32; rX >>= 32)  into rX s32= rX.
     compare_unmarshal_marshal(
@@ -569,14 +586,16 @@ TEST_CASE("unmarshal extension opcodes", "[disasm][marshal]") {
 }
 
 // Check that unmarshaling an invalid instruction fails with a given message.
-static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string& message, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
+static void check_unmarshal_instruction_fail(ebpf_inst& inst, const std::string& message,
+                                             const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     if (inst.offset == JMP_OFFSET) {
         inst.offset = 1;
         check_unmarshal_fail_goto(inst, message);
-    } else if (inst.opcode == INST_OP_LDDW_IMM)
+    } else if (inst.opcode == INST_OP_LDDW_IMM) {
         check_unmarshal_fail(inst, ebpf_inst{}, message, platform);
-    else
+    } else {
         check_unmarshal_fail(inst, message, platform);
+    }
 }
 
 static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t& previous_template) {
@@ -587,21 +606,28 @@ static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t&
 
 // Check whether an instruction matches an instruction template that may have wildcards.
 static bool matches_template_inst(ebpf_inst inst, ebpf_inst template_inst) {
-    if (inst.opcode != template_inst.opcode)
+    if (inst.opcode != template_inst.opcode) {
         return false;
-    if (inst.dst != template_inst.dst && template_inst.dst != DST)
+    }
+    if (inst.dst != template_inst.dst && template_inst.dst != DST) {
         return false;
-    if (inst.src != template_inst.src && template_inst.src != SRC)
+    }
+    if (inst.src != template_inst.src && template_inst.src != SRC) {
         return false;
-    if (inst.offset != template_inst.offset && template_inst.offset != MEM_OFFSET && template_inst.offset != JMP_OFFSET)
+    }
+    if (inst.offset != template_inst.offset && template_inst.offset != MEM_OFFSET &&
+        template_inst.offset != JMP_OFFSET) {
         return false;
-    if (inst.imm != template_inst.imm && template_inst.imm != IMM && template_inst.imm != JMP_OFFSET)
+    }
+    if (inst.imm != template_inst.imm && template_inst.imm != IMM && template_inst.imm != JMP_OFFSET) {
         return false;
+    }
     return true;
 }
 
 // Check that various 'dst' variations between two valid instruction templates fail.
-static void check_instruction_dst_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_dst_variations(const ebpf_instruction_template_t& previous_template,
+                                             std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
     ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.dst == DST) {
@@ -613,17 +639,19 @@ static void check_instruction_dst_variations(const ebpf_instruction_template_t&
         inst.dst++;
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
-            if (inst.dst == 1)
+            if (inst.dst == 1) {
                 oss << "0: nonzero dst for register op 0x" << std::hex << (int)inst.opcode << std::endl;
-            else
+            } else {
                 oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
+            }
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 }
 
 // Check that various 'src' variations between two valid instruction templates fail.
-static void check_instruction_src_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_src_variations(const ebpf_instruction_template_t& previous_template,
+                                             std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
     ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.src == SRC) {
@@ -642,7 +670,8 @@ static void check_instruction_src_variations(const ebpf_instruction_template_t&
 }
 
 // Check that various 'offset' variations between two valid instruction templates fail.
-static void check_instruction_offset_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_offset_variations(const ebpf_instruction_template_t& previous_template,
+                                                std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
     ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.offset == JMP_OFFSET) {
@@ -655,17 +684,19 @@ static void check_instruction_offset_variations(const ebpf_instruction_template_
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.offset == 1 &&
-                (!next_template || next_template->inst.opcode != inst.opcode || next_template->inst.offset == 0))
+                (!next_template || next_template->inst.opcode != inst.opcode || next_template->inst.offset == 0)) {
                 oss << "0: nonzero offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
-            else
+            } else {
                 oss << "0: invalid offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
+            }
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
 }
 
 // Check that various 'imm' variations between two valid instruction templates fail.
-static void check_instruction_imm_variations(const ebpf_instruction_template_t& previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_imm_variations(const ebpf_instruction_template_t& previous_template,
+                                             std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
     ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.imm == JMP_OFFSET) {
@@ -677,10 +708,11 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
         inst.imm++;
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
-            if (inst.imm == 1)
+            if (inst.imm == 1) {
                 oss << "0: nonzero imm for op 0x" << std::hex << (int)inst.opcode << std::endl;
-            else
+            } else {
                 oss << "0: unsupported immediate" << std::endl;
+            }
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
@@ -697,7 +729,8 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
 }
 
 // Check that various variations between two valid instruction templates fail.
-static void check_instruction_variations(std::optional<const ebpf_instruction_template_t> previous_template, std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_variations(std::optional<const ebpf_instruction_template_t> previous_template,
+                                         std::optional<const ebpf_instruction_template_t> next_template) {
     if (previous_template) {
         check_instruction_dst_variations(*previous_template, next_template);
         check_instruction_src_variations(*previous_template, next_template);
@@ -722,8 +755,9 @@ TEST_CASE("fail unmarshal bad instructions", "[disasm][marshal]") {
     // Check any variations before the first template.
     check_instruction_variations({}, instruction_template[0]);
 
-    for (int index = 1; index < template_count; index++)
+    for (int index = 1; index < template_count; index++) {
         check_instruction_variations(instruction_template[index - 1], instruction_template[index]);
+    }
 
     // Check any remaining variations after the last template.
     check_instruction_variations(instruction_template[template_count - 1], {});
@@ -741,14 +775,17 @@ TEST_CASE("check unmarshal conformance groups", "[disasm][marshal]") {
         // Try unmarshaling with support.
         platform.supported_conformance_groups |= current.groups;
         ebpf_inst inst = current.inst;
-        if (inst.offset == JMP_OFFSET)
+        if (inst.offset == JMP_OFFSET) {
             inst.offset = 1;
-        if (inst.imm == JMP_OFFSET)
+        }
+        if (inst.imm == JMP_OFFSET) {
             inst.imm = 1;
-        if (inst.opcode == INST_OP_LDDW_IMM)
+        }
+        if (inst.opcode == INST_OP_LDDW_IMM) {
             check_unmarshal_succeed(inst, ebpf_inst{}, platform);
-        else
+        } else {
             check_unmarshal_succeed(inst, platform);
+        }
     }
 }
 
@@ -771,7 +808,8 @@ TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
 
 TEST_CASE("unmarshal 64bit immediate", "[disasm][marshal]") {
     compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2},
-                              ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{.imm = 2});
+                              ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1},
+                              ebpf_inst{.imm = 2});
     compare_unmarshal_marshal(ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{},
                               ebpf_inst{.opcode = /* 0x18 */ INST_OP_LDDW_IMM, .src = 0, .imm = 1}, ebpf_inst{});
 
diff --git a/src/test/test_print.cpp b/src/test/test_print.cpp
index 5980c7852..70cb7a455 100644
--- a/src/test/test_print.cpp
+++ b/src/test/test_print.cpp
@@ -18,14 +18,12 @@
 #define TEST_OBJECT_FILE_DIRECTORY "ebpf-samples/build/"
 #define TEST_ASM_FILE_DIRECTORY "ebpf-samples/asm/"
 #define PRINT_CASE(file) \
-    TEST_CASE("Print suite: " #file, "[print]") { \
-        verify_printed_string(#file);\
-    }
+    TEST_CASE("Print suite: " #file, "[print]") { verify_printed_string(#file); }
 
-void verify_printed_string(const std::string& file)
-{
+void verify_printed_string(const std::string& file) {
     std::stringstream generated_output;
-    auto raw_progs = read_elf(std::string(TEST_OBJECT_FILE_DIRECTORY) + file + ".o", "", nullptr, &g_ebpf_platform_linux);
+    auto raw_progs =
+        read_elf(std::string(TEST_OBJECT_FILE_DIRECTORY) + file + ".o", "", nullptr, &g_ebpf_platform_linux);
     raw_program raw_prog = raw_progs.back();
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
     REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));
@@ -47,7 +45,6 @@ void verify_printed_string(const std::string& file)
     REQUIRE_FALSE(has_more);
 }
 
-
 PRINT_CASE(byteswap)
 PRINT_CASE(ctxoffset)
 PRINT_CASE(exposeptr)
@@ -55,7 +52,7 @@ PRINT_CASE(exposeptr2)
 PRINT_CASE(map_in_map)
 PRINT_CASE(mapoverflow)
 PRINT_CASE(mapunderflow)
-PRINT_CASE(mapvalue-overrun)
+PRINT_CASE(mapvalue - overrun)
 PRINT_CASE(nullmapref)
 PRINT_CASE(packet_access)
 PRINT_CASE(packet_overflow)
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index e5303871e..a41ec685c 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -1,16 +1,16 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include <thread>
-#include <catch2/catch_all.hpp>
 #include "ebpf_verifier.hpp"
+#include <catch2/catch_all.hpp>
+#include <thread>
 
-#define FAIL_LOAD_ELF(dirname, filename, sectionname) \
-    TEST_CASE("Try loading nonexisting program: " dirname "/" filename, "[elf]") { \
-        try { \
+#define FAIL_LOAD_ELF(dirname, filename, sectionname)                                                     \
+    TEST_CASE("Try loading nonexisting program: " dirname "/" filename, "[elf]") {                        \
+        try {                                                                                             \
             read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
-            REQUIRE(false); \
-        } catch (const std::runtime_error&) { \
-        }\
+            REQUIRE(false);                                                                               \
+        } catch (const std::runtime_error&) {                                                             \
+        }                                                                                                 \
     }
 
 // Some intentional failures
@@ -19,13 +19,13 @@ FAIL_LOAD_ELF("cilium", "bpf_lxc.o", "not-found")
 FAIL_LOAD_ELF("build", "badrelo.o", ".text")
 FAIL_LOAD_ELF("invalid", "badsymsize.o", "xdp_redirect_map")
 
-#define FAIL_UNMARSHAL(dirname, filename, sectionname) \
-    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
+#define FAIL_UNMARSHAL(dirname, filename, sectionname)                                                                 \
+    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") {                 \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &g_ebpf_platform_linux); \
-        REQUIRE(raw_progs.size() == 1); \
-        raw_program raw_prog = raw_progs.back(); \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-        REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
+        REQUIRE(raw_progs.size() == 1);                                                                                \
+        raw_program raw_prog = raw_progs.back();                                                                       \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);                                 \
+        REQUIRE(std::holds_alternative<std::string>(prog_or_error));                                                   \
     }
 
 // Some intentional unmarshal failures
@@ -33,82 +33,84 @@ FAIL_UNMARSHAL("build", "wronghelper.o", "xdp")
 FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
 
 // Verify a section with only one program in it.
-#define VERIFY_SECTION(dirname, filename, sectionname, options, platform, pass) \
-    do { \
+#define VERIFY_SECTION(dirname, filename, sectionname, options, platform, pass)                          \
+    do {                                                                                                 \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, platform); \
-        REQUIRE(raw_progs.size() == 1); \
-        raw_program raw_prog = raw_progs.back(); \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-        REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
-        auto& prog = std::get<InstructionSeq>(prog_or_error); \
-        bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
-        if (pass)                                            \
-            REQUIRE(res);                                    \
-        else                                                 \
-            REQUIRE(!res);                                   \
+        REQUIRE(raw_progs.size() == 1);                                                                  \
+        raw_program raw_prog = raw_progs.back();                                                         \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);                   \
+        REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));                                  \
+        auto& prog = std::get<InstructionSeq>(prog_or_error);                                            \
+        bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr);                \
+        if (pass)                                                                                        \
+            REQUIRE(res);                                                                                \
+        else                                                                                             \
+            REQUIRE(!res);                                                                               \
     } while (0)
 
 // Verify a program in a section that may have multiple programs in it.
-#define VERIFY_PROGRAM(dirname, filename, section_name, program_name, options, platform, pass) \
-    do { \
+#define VERIFY_PROGRAM(dirname, filename, section_name, program_name, options, platform, pass)            \
+    do {                                                                                                  \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, section_name, nullptr, platform); \
-        for (auto& raw_prog : raw_progs) { \
-            if (raw_prog.function_name == program_name) { \
-                std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-                REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error)); \
-                auto& prog = std::get<InstructionSeq>(prog_or_error); \
-                bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr); \
-                if (pass) \
-                    REQUIRE(res); \
-                else \
-                    REQUIRE(!res); \
-            } \
-        } \
+        for (auto& raw_prog : raw_progs) {                                                                \
+            if (raw_prog.function_name == program_name) {                                                 \
+                std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);            \
+                REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));                           \
+                auto& prog = std::get<InstructionSeq>(prog_or_error);                                     \
+                bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr);         \
+                if (pass)                                                                                 \
+                    REQUIRE(res);                                                                         \
+                else                                                                                      \
+                    REQUIRE(!res);                                                                        \
+            }                                                                                             \
+        }                                                                                                 \
     } while (0)
 
-#define TEST_SECTION(project, filename, section) \
+#define TEST_SECTION(project, filename, section)                                                            \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true);                  \
     }
 
-#define TEST_PROGRAM(project, filename, section_name, program_name) \
+#define TEST_PROGRAM(project, filename, section_name, program_name)                                              \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
-        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true); \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true);    \
     }
 
-#define TEST_SECTION_REJECT(project, filename, section) \
+#define TEST_SECTION_REJECT(project, filename, section)                                                     \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                 \
     }
 
-#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section) \
+#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section)                                           \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options; \
-        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true); \
-        options.strict = true; \
-        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options;                                    \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);                 \
+        options.strict = true;                                                                              \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                \
     }
 
-#define TEST_SECTION_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+#define TEST_SECTION_FAIL(project, filename, section)                                      \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section,             \
+              "[!shouldfail][verify][samples][" project "]") {                             \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
     }
 
-#define TEST_SECTION_REJECT_FAIL(project, filename, section) \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+#define TEST_SECTION_REJECT_FAIL(project, filename, section)                                \
+    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section,              \
+              "[!shouldfail][verify][samples][" project "]") {                              \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
     }
 
-#define TEST_SECTION_LEGACY(dirname, filename, sectionname) \
-    TEST_SECTION(dirname, filename, sectionname) \
-    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") { \
-        ebpf_platform_t platform = g_ebpf_platform_linux; \
-        platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet; \
+#define TEST_SECTION_LEGACY(dirname, filename, sectionname)                                               \
+    TEST_SECTION(dirname, filename, sectionname)                                                          \
+    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") {    \
+        ebpf_platform_t platform = g_ebpf_platform_linux;                                                 \
+        platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet;                       \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &platform); \
-        REQUIRE(raw_progs.size() == 1); \
-        raw_program raw_prog = raw_progs.back(); \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog); \
-        REQUIRE(std::holds_alternative<std::string>(prog_or_error)); \
+        REQUIRE(raw_progs.size() == 1);                                                                   \
+        raw_program raw_prog = raw_progs.back();                                                          \
+        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);                    \
+        REQUIRE(std::holds_alternative<std::string>(prog_or_error));                                      \
     }
 
 TEST_SECTION("bpf_cilium_test", "bpf_lxc_jit.o", "1/0xdc06")
diff --git a/src/test/test_wto.cpp b/src/test/test_wto.cpp
index 8167bc20f..608e7d5c8 100644
--- a/src/test/test_wto.cpp
+++ b/src/test/test_wto.cpp
@@ -1,8 +1,8 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include <catch2/catch_all.hpp>
 #include "crab/cfg.hpp"
 #include "crab/wto.hpp"
+#include <catch2/catch_all.hpp>
 
 TEST_CASE("wto figure 1", "[wto]") {
     cfg_t cfg;
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 230150802..ded6df9e2 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -7,16 +7,16 @@
 
 // TODO: move out of this framework
 
-#define YAML_CASE(path) \
-    TEST_CASE("YAML suite: " path, "[yaml]") { \
-        foreach_suite(path, [&](const TestCase& test_case){ \
+#define YAML_CASE(path)                                                     \
+    TEST_CASE("YAML suite: " path, "[yaml]") {                              \
+        foreach_suite(path, [&](const TestCase& test_case) {                \
             std::optional<Failure> failure = run_yaml_test_case(test_case); \
-            if (failure) { \
-                std::cout << "test case: " << test_case.name << "\n"; \
-                print_failure(*failure, std::cout); \
-            } \
-            REQUIRE(!failure); \
-        }); \
+            if (failure) {                                                  \
+                std::cout << "test case: " << test_case.name << "\n";       \
+                print_failure(*failure, std::cout);                         \
+            }                                                               \
+            REQUIRE(!failure);                                              \
+        });                                                                 \
     }
 
 YAML_CASE("test-data/add.yaml")

From 40c9079ee7a1ad0d3d53f197f63933bc06becda6 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 3 Sep 2024 11:47:01 +0300
Subject: [PATCH 227/373] Use explicit strings in PRINT_CASE

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/test/test_print.cpp | 46 ++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/src/test/test_print.cpp b/src/test/test_print.cpp
index 70cb7a455..e567f15a6 100644
--- a/src/test/test_print.cpp
+++ b/src/test/test_print.cpp
@@ -18,13 +18,13 @@
 #define TEST_OBJECT_FILE_DIRECTORY "ebpf-samples/build/"
 #define TEST_ASM_FILE_DIRECTORY "ebpf-samples/asm/"
 #define PRINT_CASE(file) \
-    TEST_CASE("Print suite: " #file, "[print]") { verify_printed_string(#file); }
+    TEST_CASE("Print suite: " file, "[print]") { verify_printed_string(file); }
 
 void verify_printed_string(const std::string& file) {
     std::stringstream generated_output;
     auto raw_progs =
         read_elf(std::string(TEST_OBJECT_FILE_DIRECTORY) + file + ".o", "", nullptr, &g_ebpf_platform_linux);
-    raw_program raw_prog = raw_progs.back();
+    const raw_program& raw_prog = raw_progs.back();
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
     REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));
     auto& program = std::get<InstructionSeq>(prog_or_error);
@@ -35,32 +35,32 @@ void verify_printed_string(const std::string& file) {
     std::string expected_line;
     std::string actual_line;
     while (std::getline(expected_stream, expected_line)) {
-        bool has_more = (bool)std::getline(generated_output, actual_line);
+        bool has_more = static_cast<bool>(std::getline(generated_output, actual_line));
         REQUIRE(has_more);
         boost::algorithm::trim_right(expected_line);
         boost::algorithm::trim_right(actual_line);
         REQUIRE(expected_line == actual_line);
     }
-    bool has_more = (bool)std::getline(expected_stream, actual_line);
+    bool has_more = static_cast<bool>(std::getline(expected_stream, actual_line));
     REQUIRE_FALSE(has_more);
 }
 
-PRINT_CASE(byteswap)
-PRINT_CASE(ctxoffset)
-PRINT_CASE(exposeptr)
-PRINT_CASE(exposeptr2)
-PRINT_CASE(map_in_map)
-PRINT_CASE(mapoverflow)
-PRINT_CASE(mapunderflow)
-PRINT_CASE(mapvalue - overrun)
-PRINT_CASE(nullmapref)
-PRINT_CASE(packet_access)
-PRINT_CASE(packet_overflow)
-PRINT_CASE(packet_reallocate)
-PRINT_CASE(packet_start_ok)
-PRINT_CASE(stackok)
-PRINT_CASE(tail_call)
-PRINT_CASE(tail_call_bad)
-PRINT_CASE(twomaps)
-PRINT_CASE(twostackvars)
-PRINT_CASE(twotypes)
+PRINT_CASE("byteswap")
+PRINT_CASE("ctxoffset")
+PRINT_CASE("exposeptr")
+PRINT_CASE("exposeptr2")
+PRINT_CASE("map_in_map")
+PRINT_CASE("mapoverflow")
+PRINT_CASE("mapunderflow")
+PRINT_CASE("mapvalue-overrun")
+PRINT_CASE("nullmapref")
+PRINT_CASE("packet_access")
+PRINT_CASE("packet_overflow")
+PRINT_CASE("packet_reallocate")
+PRINT_CASE("packet_start_ok")
+PRINT_CASE("stackok")
+PRINT_CASE("tail_call")
+PRINT_CASE("tail_call_bad")
+PRINT_CASE("twomaps")
+PRINT_CASE("twostackvars")
+PRINT_CASE("twotypes")

From 525b8b3b2102f641df40a31e8553f00c1c28efc6 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 3 Sep 2024 16:35:56 +0300
Subject: [PATCH 228/373] sort includes. Don't use TRUE and FALSE

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_marshal.hpp               |  3 +-
 src/asm_ostream.hpp               |  1 -
 src/asm_unmarshal.hpp             |  2 --
 src/crab/array_domain.hpp         |  1 -
 src/crab/dsl_syntax.hpp           |  2 --
 src/crab/ebpf_domain.cpp          | 60 +++++++++++++++----------------
 src/crab/fwd_analyzer.cpp         |  2 ++
 src/crab/fwd_analyzer.hpp         |  2 --
 src/crab/linear_constraint.hpp    |  8 ++---
 src/crab/linear_expression.hpp    |  3 +-
 src/crab/split_dbm.hpp            | 27 +++++++-------
 src/crab/thresholds.hpp           |  8 +++--
 src/crab/variable.hpp             |  4 ---
 src/crab/wto.hpp                  |  5 +--
 src/crab_utils/adapt_sgraph.hpp   |  3 +-
 src/crab_utils/bignums.hpp        |  2 +-
 src/crab_utils/lazy_allocator.hpp |  3 +-
 src/crab_utils/stats.hpp          |  1 -
 src/main/memsize_windows.hpp      |  4 ++-
 src/test/conformance_check.cpp    | 13 ++++---
 test-data/calllocal.yaml          | 32 ++++++++---------
 21 files changed, 89 insertions(+), 97 deletions(-)

diff --git a/src/asm_marshal.hpp b/src/asm_marshal.hpp
index e325c3651..17f6782f9 100644
--- a/src/asm_marshal.hpp
+++ b/src/asm_marshal.hpp
@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+#include <vector>
+
 #include "asm_syntax.hpp"
 #include "ebpf_vm_isa.hpp"
-#include <vector>
 
 std::vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc);
 // TODO marshal to ostream?
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index 89e268e73..ae55a6e9c 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -5,7 +5,6 @@
 #include <functional>
 #include <ostream>
 #include <variant>
-#include <vector>
 
 #include <boost/lexical_cast.hpp>
 
diff --git a/src/asm_unmarshal.hpp b/src/asm_unmarshal.hpp
index 41a46126d..af06089d4 100644
--- a/src/asm_unmarshal.hpp
+++ b/src/asm_unmarshal.hpp
@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <istream>
-#include <optional>
 #include <string>
 #include <variant>
 #include <vector>
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index c90b03d3c..6e0f75ff9 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -25,7 +25,6 @@
 
 #include <functional>
 #include <optional>
-#include <utility>
 
 #include "crab/add_bottom.hpp"
 #include "crab/variable.hpp"
diff --git a/src/crab/dsl_syntax.hpp b/src/crab/dsl_syntax.hpp
index 88599abc0..50a7d7a1e 100644
--- a/src/crab/dsl_syntax.hpp
+++ b/src/crab/dsl_syntax.hpp
@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <utility>
-
 #include "crab/cfg.hpp"
 #include "crab/linear_constraint.hpp"
 
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 67f510629..4302e1cfe 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -123,7 +123,7 @@ static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDoma
     default: throw std::exception();
     }
 
-    return {(result) ? linear_constraint_t::TRUE() : linear_constraint_t::FALSE()};
+    return {result ? linear_constraint_t::true_const() : linear_constraint_t::false_const()};
 }
 
 static std::vector<linear_constraint_t> assume_signed_64bit_eq(const NumAbsDomain& inv, variable_t left_svalue,
@@ -446,17 +446,17 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
     auto rub = right_interval.ub();
     if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
         // Left signed interval is lower than right signed interval.
-        return {linear_constraint_t::FALSE()};
+        return {linear_constraint_t::false_const()};
     } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
         // Left signed interval is higher than right signed interval.
-        return {linear_constraint_t::FALSE()};
+        return {linear_constraint_t::false_const()};
     }
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left signed interval is lower than right signed interval.
-        return {linear_constraint_t::TRUE()};
+        return {linear_constraint_t::true_const()};
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left signed interval is higher than right signed interval.
-        return {linear_constraint_t::TRUE()};
+        return {linear_constraint_t::true_const()};
     }
 
     if (is64) {
@@ -656,10 +656,10 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
     auto rub = right_interval.ub();
     if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
         // Left unsigned interval is lower than right unsigned interval.
-        return {linear_constraint_t::FALSE()};
+        return {linear_constraint_t::false_const()};
     } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
         // Left unsigned interval is higher than right unsigned interval.
-        return {linear_constraint_t::FALSE()};
+        return {linear_constraint_t::false_const()};
     }
     if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
         // Left unsigned interval is lower than right unsigned interval. We still add a
@@ -667,7 +667,7 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
         if (is64) {
             return {strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
         } else {
-            return {linear_constraint_t::TRUE()};
+            return {linear_constraint_t::true_const()};
         }
     } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
         // Left unsigned interval is higher than right unsigned interval. We still add a
@@ -675,7 +675,7 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
         if (is64) {
             return {strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue};
         } else {
-            return {linear_constraint_t::TRUE()};
+            return {linear_constraint_t::true_const()};
         }
     }
 
@@ -1616,7 +1616,7 @@ void ebpf_domain_t::operator()(const Comparable& s) {
         // We must check that they belong to a singleton region:
         if (!type_inv.is_in_group(inv, s.r1, TypeGroup::singleton_ptr) &&
             !type_inv.is_in_group(inv, s.r1, TypeGroup::map_fd)) {
-            require(inv, linear_constraint_t::FALSE(), "Cannot subtract pointers to non-singleton regions");
+            require(inv, linear_constraint_t::false_const(), "Cannot subtract pointers to non-singleton regions");
             return;
         }
         // And, to avoid wraparound errors, they must be within bounds.
@@ -1631,7 +1631,7 @@ void ebpf_domain_t::operator()(const Comparable& s) {
 
 void ebpf_domain_t::operator()(const Addable& s) {
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg_pack(s.ptr)), type_is_number(s.num))) {
-        require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be added to pointers");
+        require(m_inv, linear_constraint_t::false_const(), "Only numbers can be added to pointers");
     }
 }
 
@@ -1639,7 +1639,7 @@ void ebpf_domain_t::operator()(const ValidDivisor& s) {
     using namespace crab::dsl_syntax;
     auto reg = reg_pack(s.reg);
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg))) {
-        require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be used as divisors");
+        require(m_inv, linear_constraint_t::false_const(), "Only numbers can be used as divisors");
     }
     if (!thread_local_options.allow_division_by_zero) {
         auto v = s.is_signed ? reg.svalue : reg.uvalue;
@@ -1649,13 +1649,13 @@ void ebpf_domain_t::operator()(const ValidDivisor& s) {
 
 void ebpf_domain_t::operator()(const ValidStore& s) {
     if (!type_inv.implies_type(m_inv, type_is_not_stack(reg_pack(s.mem)), type_is_number(s.val))) {
-        require(m_inv, linear_constraint_t::FALSE(), "Only numbers can be stored to externally-visible regions");
+        require(m_inv, linear_constraint_t::false_const(), "Only numbers can be stored to externally-visible regions");
     }
 }
 
 void ebpf_domain_t::operator()(const TypeConstraint& s) {
     if (!type_inv.is_in_group(m_inv, s.reg, s.types)) {
-        require(m_inv, linear_constraint_t::FALSE(), "Invalid type");
+        require(m_inv, linear_constraint_t::false_const(), "Invalid type");
     }
 }
 
@@ -1668,7 +1668,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
             // We can now process it as if the id was immediate.
             int32_t imm = sn->cast_to_sint32();
             if (!global_program_info->platform->is_helper_usable(imm)) {
-                require(m_inv, linear_constraint_t::FALSE(), "invalid helper function id " + std::to_string(imm));
+                require(m_inv, linear_constraint_t::false_const(), "invalid helper function id " + std::to_string(imm));
                 return;
             }
             Call call = make_call(imm, *global_program_info->platform);
@@ -1678,7 +1678,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
             return;
         }
     }
-    require(m_inv, linear_constraint_t::FALSE(), "callx helper function id is not a valid singleton");
+    require(m_inv, linear_constraint_t::false_const(), "callx helper function id is not a valid singleton");
 }
 
 void ebpf_domain_t::operator()(const ValidSize& s) {
@@ -1807,7 +1807,7 @@ void ebpf_domain_t::operator()(const ValidCall& s) {
     if (!s.stack_frame_prefix.empty()) {
         EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(s.func);
         if (proto.return_type == EBPF_RETURN_TYPE_INTEGER_OR_NO_RETURN_IF_SUCCEED) {
-            require(m_inv, linear_constraint_t::FALSE(), "tail call not supported in subprogram");
+            require(m_inv, linear_constraint_t::false_const(), "tail call not supported in subprogram");
             return;
         }
     }
@@ -1823,14 +1823,14 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
     if (s.key) {
         auto key_size = get_map_key_size(s.map_fd_reg).singleton();
         if (!key_size.has_value()) {
-            require(m_inv, linear_constraint_t::FALSE(), "Map key size is not singleton");
+            require(m_inv, linear_constraint_t::false_const(), "Map key size is not singleton");
             return;
         }
         width = (int)key_size.value();
     } else {
         auto value_size = get_map_value_size(s.map_fd_reg).singleton();
         if (!value_size.has_value()) {
-            require(m_inv, linear_constraint_t::FALSE(), "Map value size is not singleton");
+            require(m_inv, linear_constraint_t::false_const(), "Map value size is not singleton");
             return;
         }
         width = (int)value_size.value();
@@ -1845,7 +1845,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
                 std::string lb_s = lb_is && lb_is->fits_sint32() ? std::to_string((int32_t)*lb_is) : "-oo";
                 auto ub_is = inv.eval_interval(ub).ub().number();
                 std::string ub_s = ub_is && ub_is->fits_sint32() ? std::to_string((int32_t)*ub_is) : "oo";
-                require(inv, linear_constraint_t::FALSE(),
+                require(inv, linear_constraint_t::false_const(),
                         "Illegal map update with a non-numerical value [" + lb_s + "-" + ub_s + ")");
             } else if (thread_local_options.strict && fd_type.has_value()) {
                 EbpfMapType map_type = global_program_info->platform->get_map_type(*fd_type);
@@ -1854,7 +1854,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
                     variable_t key_ptr = access_reg.stack_offset;
                     std::optional<number_t> offset = inv[key_ptr].singleton();
                     if (!offset.has_value()) {
-                        require(inv, linear_constraint_t::FALSE(), "Pointer must be a singleton");
+                        require(inv, linear_constraint_t::false_const(), "Pointer must be a singleton");
                     } else if (s.key) {
                         // Look up the value pointed to by the key pointer.
                         variable_t key_value =
@@ -1863,7 +1863,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
                         if (auto max_entries = get_map_max_entries(s.map_fd_reg).lb().number()) {
                             require(inv, key_value < *max_entries, "Array index overflow");
                         } else {
-                            require(inv, linear_constraint_t::FALSE(), "Max entries is not finite");
+                            require(inv, linear_constraint_t::false_const(), "Max entries is not finite");
                         }
                         require(inv, key_value >= 0, "Array index underflow");
                     }
@@ -1881,7 +1881,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             require(inv, access_reg.svalue > 0, "Possible null access");
             // Shared memory is zero-initialized when created so is safe to read and write.
         } else {
-            require(inv, linear_constraint_t::FALSE(), "Only stack or packet can be used as a parameter");
+            require(inv, linear_constraint_t::false_const(), "Only stack or packet can be used as a parameter");
         }
     });
 }
@@ -1917,14 +1917,14 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                 // Require that the stack range contains numbers.
                 if (!stack.all_num(inv, lb, ub)) {
                     if (s.offset < 0) {
-                        require(inv, linear_constraint_t::FALSE(), "Stack content is not numeric");
+                        require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                     } else if (std::holds_alternative<Imm>(s.width)) {
                         if (!inv.entail(((int)std::get<Imm>(s.width).v) <= reg.stack_numeric_size - s.offset)) {
-                            require(inv, linear_constraint_t::FALSE(), "Stack content is not numeric");
+                            require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                         }
                     } else {
                         if (!inv.entail(reg_pack(std::get<Reg>(s.width)).svalue <= reg.stack_numeric_size - s.offset)) {
-                            require(inv, linear_constraint_t::FALSE(), "Stack content is not numeric");
+                            require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                         }
                     }
                 }
@@ -1946,14 +1946,14 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                 if (s.or_null) {
                     require(inv, reg.svalue == 0, "Non-null number");
                 } else {
-                    require(inv, linear_constraint_t::FALSE(), "Only pointers can be dereferenced");
+                    require(inv, linear_constraint_t::false_const(), "Only pointers can be dereferenced");
                 }
             }
             break;
         case T_MAP:
         case T_MAP_PROGRAMS:
             if (!is_comparison_check) {
-                require(inv, linear_constraint_t::FALSE(), "FDs cannot be dereferenced directly");
+                require(inv, linear_constraint_t::false_const(), "FDs cannot be dereferenced directly");
             }
             break;
         case T_SHARED: {
@@ -1968,7 +1968,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
             // Shared memory is zero-initialized when created so is safe to read and write.
             break;
         }
-        default: require(inv, linear_constraint_t::FALSE(), "Invalid type"); break;
+        default: require(inv, linear_constraint_t::false_const(), "Invalid type"); break;
         }
     });
 }
@@ -2392,7 +2392,7 @@ void ebpf_domain_t::operator()(const Call& call) {
             bool store_numbers = true;
             auto variable = get_type_offset_variable(param.mem);
             if (!variable.has_value()) {
-                require(m_inv, linear_constraint_t::FALSE(), "Argument must be a pointer to writable memory");
+                require(m_inv, linear_constraint_t::false_const(), "Argument must be a pointer to writable memory");
                 return;
             }
             variable_t addr = variable.value();
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index 726a01ce0..ba4d13561 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -9,6 +9,8 @@
 #include "crab/ebpf_domain.hpp"
 #include "crab/fwd_analyzer.hpp"
 
+#include "config.hpp"
+
 namespace crab {
 
 // Simple visitor to check if node is a member of the wto component.
diff --git a/src/crab/fwd_analyzer.hpp b/src/crab/fwd_analyzer.hpp
index a6e35e476..06ebc268a 100644
--- a/src/crab/fwd_analyzer.hpp
+++ b/src/crab/fwd_analyzer.hpp
@@ -3,9 +3,7 @@
 #pragma once
 
 #include <map>
-#include <tuple>
 
-#include "config.hpp"
 #include "crab/cfg.hpp"
 #include "crab/ebpf_domain.hpp"
 
diff --git a/src/crab/linear_constraint.hpp b/src/crab/linear_constraint.hpp
index 04e747147..ed00a6c74 100644
--- a/src/crab/linear_constraint.hpp
+++ b/src/crab/linear_constraint.hpp
@@ -67,13 +67,13 @@ class linear_constraint_t final {
         }
     }
 
-    static linear_constraint_t FALSE() {
+    static linear_constraint_t false_const() {
         return linear_constraint_t{linear_expression_t(0), constraint_kind_t::NOT_ZERO};
-    };
+    }
 
-    static linear_constraint_t TRUE() {
+    static linear_constraint_t true_const() {
         return linear_constraint_t{linear_expression_t(0), constraint_kind_t::EQUALS_ZERO};
-    };
+    }
 };
 
 // Output a linear constraint to a stream.
diff --git a/src/crab/linear_expression.hpp b/src/crab/linear_expression.hpp
index 2846f8468..46f2a7d3a 100644
--- a/src/crab/linear_expression.hpp
+++ b/src/crab/linear_expression.hpp
@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include "variable.hpp"
 #include <map>
 
+#include "variable.hpp"
+
 namespace crab {
 // A linear expression is of the form: Ax + By + Cz + ... + N.
 // That is, a sum of terms where each term is either a
diff --git a/src/crab/split_dbm.hpp b/src/crab/split_dbm.hpp
index 0c509fc79..a1b3be007 100644
--- a/src/crab/split_dbm.hpp
+++ b/src/crab/split_dbm.hpp
@@ -20,7 +20,6 @@
 #pragma once
 
 #include <optional>
-#include <type_traits>
 #include <unordered_set>
 #include <utility>
 
@@ -77,9 +76,9 @@ struct SafeInt64DefaultParams {
 class SplitDBM final {
   public:
     using Params = Z_NumberDefaultParams;
-    using graph_t = typename Params::graph_t;
-    using Weight = typename Params::Weight;
-    using vert_id = typename graph_t::vert_id;
+    using graph_t = Params::graph_t;
+    using Weight = Params::Weight;
+    using vert_id = graph_t::vert_id;
     using vert_map_t = boost::container::flat_map<variable_t, vert_id>;
 
   private:
@@ -87,17 +86,12 @@ class SplitDBM final {
 
     using rev_map_t = std::vector<std::optional<variable_t>>;
     using GrOps = GraphOps<graph_t>;
-    using edge_vector = typename GrOps::edge_vector;
+    using edge_vector = GrOps::edge_vector;
     // < <x, y>, k> == x - y <= k.
     using diffcst_t = std::pair<std::pair<variable_t, variable_t>, Weight>;
     using vert_set_t = std::unordered_set<vert_id>;
     friend class vert_set_wrap_t;
 
-  private:
-    //================
-    // Domain data
-    //================
-    // GKG: ranges are now maintained in the graph
     vert_map_t vert_map; // Mapping from variables to vertices
     rev_map_t rev_map;
     graph_t g;                     // The underlying relation graph
@@ -182,11 +176,14 @@ class SplitDBM final {
         normalize();
     }
 
+    // Serves as a static cast for the default join operation
+    SplitDBM const_join(const SplitDBM& o) const& { return *this | o; }
+
   public:
     explicit SplitDBM() {
         g.growTo(1); // Allocate the zero vector
         potential.emplace_back(0);
-        rev_map.push_back(std::nullopt);
+        rev_map.emplace_back(std::nullopt);
     }
 
     SplitDBM(const SplitDBM& o) = default;
@@ -222,21 +219,21 @@ class SplitDBM final {
         if (is_top()) {
             return std::move(*this);
         }
-        return ((const SplitDBM&)*this) | (const SplitDBM&)o;
+        return const_join(o);
     }
 
     SplitDBM operator|(const SplitDBM& o) && {
         if (is_top()) {
             return std::move(*this);
         }
-        return ((const SplitDBM&)*this) | o;
+        return const_join(o);
     }
 
     SplitDBM operator|(SplitDBM&& o) const& {
         if (o.is_top()) {
             return std::move(o);
         }
-        return (*this) | (const SplitDBM&)o;
+        return const_join(o);
     }
 
     [[nodiscard]]
@@ -272,7 +269,7 @@ class SplitDBM final {
         } else {
             *this -= x;
         }
-    };
+    }
 
     void apply(arith_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
 
diff --git a/src/crab/thresholds.hpp b/src/crab/thresholds.hpp
index e72135f17..9d880218c 100644
--- a/src/crab/thresholds.hpp
+++ b/src/crab/thresholds.hpp
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 #pragma once
 
-#include <algorithm>
 #include <climits>
 #include <map>
 
@@ -31,11 +30,14 @@ class thresholds_t final {
   public:
     explicit thresholds_t(size_t size = UINT_MAX) : m_size(size) {
         m_thresholds.push_back(bound_t::minus_infinity());
-        m_thresholds.emplace_back(0);
+        m_thresholds.emplace_back(number_t{0});
         m_thresholds.push_back(bound_t::plus_infinity());
     }
 
-    size_t size() const { return m_thresholds.size(); }
+    [[nodiscard]]
+    size_t size() const {
+        return m_thresholds.size();
+    }
 
     void add(bound_t v1);
 
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index e531bf99b..66ee9c5b5 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -4,14 +4,10 @@
 
 #include <iosfwd>
 #include <iostream>
-#include <limits>
 #include <memory>
-#include <optional>
 #include <vector>
 
-#include "asm_syntax.hpp"
 #include "crab_utils/bignums.hpp"
-#include "crab_utils/debug.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 using index_t = uint64_t;
 
diff --git a/src/crab/wto.hpp b/src/crab/wto.hpp
index 471f9e79f..c321a8b48 100644
--- a/src/crab/wto.hpp
+++ b/src/crab/wto.hpp
@@ -28,11 +28,12 @@
 // comparison.
 #undef RECURSIVE_WTO
 
-#include "crab/cfg.hpp"
-#include "crab/wto_nesting.hpp"
 #include <stack>
 #include <vector>
 
+#include "crab/cfg.hpp"
+#include "crab/wto_nesting.hpp"
+
 // Define types used by both this header file and wto_cycle.hpp
 using wto_component_t = std::variant<std::shared_ptr<class wto_cycle_t>, label_t>;
 using wto_partition_t = std::vector<std::shared_ptr<wto_component_t>>;
diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index 791cb4225..a7f2cfe16 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -6,9 +6,7 @@
 
 #include <boost/container/flat_map.hpp>
 
-#include "crab_utils/debug.hpp"
 #include "crab_utils/safeint.hpp"
-// Adaptive sparse-set based weighted graph implementation
 
 namespace crab {
 
@@ -142,6 +140,7 @@ class TreeSMap final {
     void clear() { map.clear(); }
 };
 
+// Adaptive sparse-set based weighted graph implementation
 class AdaptGraph final {
     using smap_t = TreeSMap;
 
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index df51d1561..99d190351 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -6,10 +6,10 @@
 #include <iostream>
 #include <sstream>
 #include <string>
+#include <utility>
 
 #include <boost/functional/hash.hpp>
 #include <boost/multiprecision/cpp_int.hpp>
-#include <utility>
 
 #include "debug.hpp"
 using boost::multiprecision::cpp_int;
diff --git a/src/crab_utils/lazy_allocator.hpp b/src/crab_utils/lazy_allocator.hpp
index 1280eae4b..abca4641e 100644
--- a/src/crab_utils/lazy_allocator.hpp
+++ b/src/crab_utils/lazy_allocator.hpp
@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include "debug.hpp"
 #include <optional>
 
+#include "debug.hpp"
+
 namespace crab {
 /**
  * @brief The default factory for lazy_allocator that creates objects using the default constructor.
diff --git a/src/crab_utils/stats.hpp b/src/crab_utils/stats.hpp
index 61853d529..cee0d28ed 100644
--- a/src/crab_utils/stats.hpp
+++ b/src/crab_utils/stats.hpp
@@ -3,7 +3,6 @@
 #pragma once
 
 #include <map>
-#include <optional>
 #include <string>
 
 #include "crab/variable.hpp"
diff --git a/src/main/memsize_windows.hpp b/src/main/memsize_windows.hpp
index aefbe0251..fdd83840c 100644
--- a/src/main/memsize_windows.hpp
+++ b/src/main/memsize_windows.hpp
@@ -2,9 +2,11 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-#include <Psapi.h>
+#include <stdlib.h>
 #include <windows.h>
 
+#include <Psapi.h>
+
 inline long resident_set_size_kb() {
     PROCESS_MEMORY_COUNTERS info;
     BOOL ok = GetProcessMemoryInfo(GetCurrentProcess(), &info, sizeof(info));
diff --git a/src/test/conformance_check.cpp b/src/test/conformance_check.cpp
index dcd892aac..068afbe9c 100644
--- a/src/test/conformance_check.cpp
+++ b/src/test/conformance_check.cpp
@@ -6,15 +6,14 @@
 // value of r0 at the end of execution.
 // The program is intended to be used with the bpf conformance test suite.
 
-#include "CLI11.hpp"
-#include "ebpf_verifier.hpp"
-#include "ebpf_yaml.hpp"
 #include <iostream>
 #include <sstream>
 #include <string>
 #include <vector>
 
-using string = std::string;
+#include "CLI11.hpp"
+#include "ebpf_verifier.hpp"
+#include "ebpf_yaml.hpp"
 
 /**
  * @brief Read in a string of hex bytes and return a vector of bytes.
@@ -32,9 +31,9 @@ std::vector<uint8_t> base16_decode(const std::string& input) {
         }
         try {
             output.push_back(std::stoi(value, nullptr, 16));
-        } catch (std::invalid_argument) {
+        } catch (std::invalid_argument&) {
             std::cerr << "base16_decode failed to decode " << value << "\n";
-        } catch (std::out_of_range) {
+        } catch (std::out_of_range&) {
             std::cerr << "base16_decode failed to decode " << value << "\n";
         }
     }
@@ -43,7 +42,7 @@ std::vector<uint8_t> base16_decode(const std::string& input) {
 
 /**
  * @brief This program reads BPF instructions from stdin and memory contents from
- * the first agument. It then executes the BPF program and prints the
+ * the first argument. It then executes the BPF program and prints the
  * value of r0 at the end of execution.
  */
 int main(int argc, char** argv) {
diff --git a/test-data/calllocal.yaml b/test-data/calllocal.yaml
index 8b407a269..202668a99 100644
--- a/test-data/calllocal.yaml
+++ b/test-data/calllocal.yaml
@@ -226,23 +226,23 @@ post:
   - r0.svalue=0
   - r0.uvalue=0
   - r6.type=packet
-#---
+# ---
 # fails: correlations between callee-saved registers are not preserved
-#test-case: call local must preserve correlations within R6-R9
-#pre: ["r6.type=r7.type"]
-#code:
-#  <start>: |
-#    call <sub>
-#    r0 = 0
-#    exit
-#  <sub>: |
-#    r6 = 1
-#    exit
-#post:
-#  - r0.type=number
-#  - r0.svalue=0
-#  - r0.uvalue=0
-#  - r6.type=r7.type
+# test-case: call local must preserve correlations within R6-R9
+# pre: ["r6.type=r7.type"]
+# code:
+#   <start>: |
+#     call <sub>
+#     r0 = 0
+#     exit
+#   <sub>: |
+#     r6 = 1
+#     exit
+# post:
+#   - r0.type=number
+#   - r0.svalue=0
+#   - r0.uvalue=0
+#   - r6.type=r7.type
 ---
 test-case: disallow tail call from within a subprogram
 

From 8947b92c2506e0145126d2d8ac6fa49e3cc7bdac Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 7 Sep 2024 16:41:17 +0000
Subject: [PATCH 229/373] Bump external/bpf_conformance from `89c3d74` to
 `b2fc14a`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `89c3d74` to `b2fc14a`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/89c3d7400b98e90142d7eedc4564307a11f14dd1...b2fc14a1ff895821f7cd3cfa086a806a7529da6d)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 89c3d7400..b2fc14a1f 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 89c3d7400b98e90142d7eedc4564307a11f14dd1
+Subproject commit b2fc14a1ff895821f7cd3cfa086a806a7529da6d

From 3275280bafacb33df52ccff6ad41bfa8248ab675 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 7 Sep 2024 16:41:15 +0000
Subject: [PATCH 230/373] Bump external/libbtf from `2231942` to `4d33198`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `2231942` to `4d33198`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/2231942ac7a5ed3f21e0d3db97d6a7789105cf15...4d331983e444174a505afe95610ace70028efec5)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 2231942ac..4d331983e 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 2231942ac7a5ed3f21e0d3db97d6a7789105cf15
+Subproject commit 4d331983e444174a505afe95610ace70028efec5

From 04f78a99624dc078030bfce819d77a5dc567b91a Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 8 Sep 2024 03:08:50 +0300
Subject: [PATCH 231/373] remove cfg_bgl.hpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/cfg_bgl.hpp | 203 -------------------------------------------
 1 file changed, 203 deletions(-)
 delete mode 100644 src/crab/cfg_bgl.hpp

diff --git a/src/crab/cfg_bgl.hpp b/src/crab/cfg_bgl.hpp
deleted file mode 100644
index d1dcbe421..000000000
--- a/src/crab/cfg_bgl.hpp
+++ /dev/null
@@ -1,203 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: Apache-2.0
-#pragma once
-
-/*
- * Convert a CFG into a BGL (Boost Graph Library) graph
- */
-#include <boost/graph/graph_traits.hpp>
-#include <boost/graph/properties.hpp>
-#include <boost/iterator/transform_iterator.hpp>
-
-#include "crab/cfg.hpp"
-
-namespace crab {
-
-namespace graph {
-template <typename G>
-struct mk_in_edge {
-    using Node = typename boost::graph_traits<G>::vertex_descriptor;
-    using Edge = typename boost::graph_traits<G>::edge_descriptor;
-
-    Node _dst;
-    mk_in_edge() {}
-    mk_in_edge(const Node& dst) : _dst(dst) {}
-    Edge operator()(const Node& src) const { return Edge(src, _dst); }
-};
-
-template <typename G>
-struct mk_out_edge {
-    using Node = typename boost::graph_traits<G>::vertex_descriptor;
-    using Edge = typename boost::graph_traits<G>::edge_descriptor;
-
-    Node _src;
-    mk_out_edge() {}
-    mk_out_edge(const Node& src) : _src(src) {}
-    Edge operator()(const Node& dst) const { return Edge(_src, dst); }
-};
-} // end namespace graph
-} // end namespace crab
-
-namespace boost {
-
-// cfg
-template <>
-struct graph_traits<crab::cfg_t> {
-    using graph_t = crab::cfg_t;
-    using vertex_descriptor = crab::label_t;
-    using edge_descriptor = std::pair<vertex_descriptor, vertex_descriptor>;
-    using const_edge_descriptor = std::pair<const vertex_descriptor, const vertex_descriptor>;
-
-    using edge_parallel_category = disallow_parallel_edge_tag;
-    using directed_category = bidirectional_tag;
-    struct this_graph_tag : virtual bidirectional_graph_tag, virtual vertex_list_graph_tag {};
-    using traversal_category = this_graph_tag;
-
-    using vertices_size_type = size_t;
-    using edges_size_type = size_t;
-    using degree_size_type = size_t;
-
-    // iterator of label_t's
-    using vertex_iterator = typename graph_t::label_iterator;
-    // iterator of pairs of label_t's
-    using in_edge_iterator = transform_iterator<crab::graph::mk_in_edge<graph_t>, typename graph_t::neighbour_iterator>;
-    // iterator of pairs of label_t's
-    using out_edge_iterator =
-        transform_iterator<crab::graph::mk_out_edge<graph_t>, typename graph_t::neighbour_iterator>;
-}; // end class graph_traits
-
-// cfg_rev
-template <>
-struct graph_traits<crab::cfg_rev_t> {
-    using graph_t = crab::cfg_rev_t;
-    using vertex_descriptor = crab::label_t;
-    using edge_descriptor = std::pair<vertex_descriptor, vertex_descriptor>;
-    using const_edge_descriptor = std::pair<const vertex_descriptor, const vertex_descriptor>;
-
-    using edge_parallel_category = disallow_parallel_edge_tag;
-    using directed_category = bidirectional_tag;
-    struct this_graph_tag : virtual bidirectional_graph_tag, virtual vertex_list_graph_tag {};
-    using traversal_category = this_graph_tag;
-
-    using vertices_size_type = size_t;
-    using edges_size_type = size_t;
-    using degree_size_type = size_t;
-
-    using vertex_iterator = typename graph_t::label_iterator;
-    using in_edge_iterator =
-        boost::transform_iterator<crab::graph::mk_in_edge<graph_t>, typename graph_t::neighbour_iterator>;
-    using out_edge_iterator =
-        boost::transform_iterator<crab::graph::mk_out_edge<graph_t>, typename graph_t::neighbour_iterator>;
-}; // end class graph_traits
-} // namespace boost
-
-// XXX: do not put it in the boost namespace because it won't compile
-namespace crab {
-
-// cfg
-
-//// boost/graph/graph_traits.hpp has already default source/target
-//// functions in case the edge_descriptor is std::pair.
-
-// this is not part of BGL but needed by Crab's algorithms
-inline typename boost::graph_traits<cfg_t>::vertex_descriptor entry(const cfg_t& g) { return g.entry_label(); }
-
-inline std::pair<typename boost::graph_traits<cfg_t>::vertex_iterator,
-                 typename boost::graph_traits<cfg_t>::vertex_iterator>
-vertices(cfg_t& g) {
-    return std::make_pair(g.label_begin(), g.label_end());
-}
-
-inline std::pair<typename boost::graph_traits<cfg_t>::out_edge_iterator,
-                 typename boost::graph_traits<cfg_t>::out_edge_iterator>
-out_edges(typename boost::graph_traits<cfg_t>::vertex_descriptor v, cfg_t& g) {
-    auto& node = g.get_node(v);
-    auto p = node.next_blocks();
-    return std::make_pair(boost::make_transform_iterator(p.first, graph::mk_out_edge<cfg_t>(v)),
-                          boost::make_transform_iterator(p.second, graph::mk_out_edge<cfg_t>(v)));
-}
-
-inline std::pair<typename boost::graph_traits<cfg_t>::in_edge_iterator,
-                 typename boost::graph_traits<cfg_t>::in_edge_iterator>
-in_edges(typename boost::graph_traits<cfg_t>::vertex_descriptor v, cfg_t& g) {
-    auto& node = g.get_node(v);
-    auto p = node.prev_blocks();
-    return std::make_pair(boost::make_transform_iterator(p.first, graph::mk_in_edge<cfg_t>(v)),
-                          boost::make_transform_iterator(p.second, graph::mk_in_edge<cfg_t>(v)));
-}
-
-inline typename boost::graph_traits<cfg_t>::vertices_size_type num_vertices(cfg_t& g) {
-    return std::distance(g.label_begin(), g.label_end());
-}
-
-inline typename boost::graph_traits<cfg_t>::degree_size_type
-in_degree(typename boost::graph_traits<cfg_t>::vertex_descriptor v, const cfg_t& g) {
-    auto preds = g.prev_nodes(v);
-    return std::distance(preds.begin(), preds.end());
-}
-
-inline typename boost::graph_traits<cfg_t>::degree_size_type
-out_degree(typename boost::graph_traits<cfg_t>::vertex_descriptor v, const cfg_t& g) {
-    auto succs = g.next_nodes(v);
-    return std::distance(succs.begin(), succs.end());
-}
-
-inline typename boost::graph_traits<cfg_t>::degree_size_type
-degree(typename boost::graph_traits<cfg_t>::vertex_descriptor v, const cfg_t& g) {
-    return out_degree(v, g) + in_degree(v, g);
-}
-
-// cfg_rev
-
-//// boost/graph/graph_traits.hpp has already default source/target
-//// functions in case the edge_descriptor is std::pair.
-
-// this is not part of BGL but needed by Crab's algorithms
-inline typename boost::graph_traits<cfg_rev_t>::vertex_descriptor entry(const cfg_rev_t& g) { return g.entry_label(); }
-
-inline std::pair<typename boost::graph_traits<cfg_rev_t>::vertex_iterator,
-                 typename boost::graph_traits<cfg_rev_t>::vertex_iterator>
-vertices(cfg_rev_t g) {
-    return std::make_pair(g.label_begin(), g.label_end());
-}
-
-inline std::pair<typename boost::graph_traits<cfg_rev_t>::out_edge_iterator,
-                 typename boost::graph_traits<cfg_rev_t>::out_edge_iterator>
-out_edges(typename boost::graph_traits<cfg_rev_t>::vertex_descriptor v, cfg_rev_t g) {
-    auto& node = g.get_node(v);
-    auto p = node.next_blocks();
-    return std::make_pair(boost::make_transform_iterator(p.first, graph::mk_out_edge<cfg_rev_t>(v)),
-                          boost::make_transform_iterator(p.second, graph::mk_out_edge<cfg_rev_t>(v)));
-}
-
-inline std::pair<typename boost::graph_traits<cfg_rev_t>::in_edge_iterator,
-                 typename boost::graph_traits<cfg_rev_t>::in_edge_iterator>
-in_edges(typename boost::graph_traits<cfg_rev_t>::vertex_descriptor v, cfg_rev_t g) {
-    auto& node = g.get_node(v);
-    auto p = node.prev_blocks();
-    return std::make_pair(boost::make_transform_iterator(p.first, graph::mk_in_edge<cfg_rev_t>(v)),
-                          boost::make_transform_iterator(p.second, graph::mk_in_edge<cfg_rev_t>(v)));
-}
-
-inline typename boost::graph_traits<cfg_rev_t>::vertices_size_type num_vertices(cfg_rev_t g) {
-    return std::distance(g.label_begin(), g.label_end());
-}
-
-inline typename boost::graph_traits<cfg_rev_t>::degree_size_type
-in_degree(typename boost::graph_traits<cfg_rev_t>::vertex_descriptor v, cfg_rev_t g) {
-    auto preds = g.prev_nodes(v);
-    return std::distance(preds.begin(), preds.end());
-}
-
-inline typename boost::graph_traits<cfg_rev_t>::degree_size_type
-out_degree(typename boost::graph_traits<cfg_rev_t>::vertex_descriptor v, cfg_rev_t g) {
-    auto succs = g.next_nodes(v);
-    return std::distance(succs.begin(), succs.end());
-}
-
-inline typename boost::graph_traits<cfg_rev_t>::degree_size_type
-degree(typename boost::graph_traits<cfg_rev_t>::vertex_descriptor v, cfg_rev_t g) {
-    return out_degree(v, g) + in_degree(v, g);
-}
-
-} // namespace crab

From d5df1a0e5ce918127c864b270f7b309e5f50694b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 14 Sep 2024 16:49:34 +0000
Subject: [PATCH 232/373] Bump external/bpf_conformance from `b2fc14a` to
 `62e3f49`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `b2fc14a` to `62e3f49`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/b2fc14a1ff895821f7cd3cfa086a806a7529da6d...62e3f4987351c1b38943e86e4e87529c733d8534)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index b2fc14a1f..62e3f4987 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit b2fc14a1ff895821f7cd3cfa086a806a7529da6d
+Subproject commit 62e3f4987351c1b38943e86e4e87529c733d8534

From 6dc6b83f134541b21ef8c8218c8e3ccdae9ed669 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 21 Sep 2024 16:12:10 +0000
Subject: [PATCH 233/373] Bump external/bpf_conformance from `62e3f49` to
 `7a773b3`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `62e3f49` to `7a773b3`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/62e3f4987351c1b38943e86e4e87529c733d8534...7a773b3d9eb0453a86500d5480d4890b920b5db8)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 62e3f4987..7a773b3d9 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 62e3f4987351c1b38943e86e4e87529c733d8534
+Subproject commit 7a773b3d9eb0453a86500d5480d4890b920b5db8

From 0a56b27c2240ecc797426964b512df37229740f7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 21 Sep 2024 16:12:12 +0000
Subject: [PATCH 234/373] Bump external/libbtf from `4d33198` to `58fcade`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `4d33198` to `58fcade`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/4d331983e444174a505afe95610ace70028efec5...58fcade22600c80b643ef0b80cdf8683c155a286)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 4d331983e..58fcade22 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 4d331983e444174a505afe95610ace70028efec5
+Subproject commit 58fcade22600c80b643ef0b80cdf8683c155a286

From 6d5631c5ac0b8b4279478f4e0adb0cfdcba7f305 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 24 Sep 2024 13:41:00 +0300
Subject: [PATCH 235/373] use template for truncation

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp  |  2 +-
 src/crab/ebpf_domain.cpp   |  6 +--
 src/crab_utils/bignums.hpp | 81 ++++++++++++++------------------------
 3 files changed, 34 insertions(+), 55 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 629669da8..f8043880f 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -132,7 +132,7 @@ class cell_t final {
 
     [[nodiscard]]
     variable_t get_scalar(data_kind_t kind) const {
-        return variable_t::cell_var(kind, number_t{_offset}, _size);
+        return variable_t::cell_var(kind, number_t{static_cast<index_t>(_offset)}, _size);
     }
 
     // ignore the scalar variable
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 4302e1cfe..ae31b40b7 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -224,7 +224,7 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
             // The interval is TOP as a signed interval but is represented precisely as an unsigned interval,
             // so split into two signed intervals that can be treated separately.
             left_interval_positive = left_interval & interval_t::nonnegative_int(true);
-            number_t lih_ub = left_interval.ub().number() ? left_interval.ub().number()->truncate_to_sint64() : -1;
+            number_t lih_ub = left_interval.ub().number() ? left_interval.ub().number()->truncate_to_signed_finite_width(64) : -1;
             left_interval_negative = interval_t(number_t{std::numeric_limits<int64_t>::min()}, lih_ub);
         } else {
             left_interval_positive = interval_t::nonnegative_int(true);
@@ -1394,8 +1394,8 @@ void ebpf_domain_t::overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t
     number_t lb = lb_value.truncate_to_unsigned_finite_width(finite_width);
     number_t ub = ub_value.truncate_to_unsigned_finite_width(finite_width);
     if (issigned) {
-        lb = lb.truncate_to_sint64();
-        ub = ub.truncate_to_sint64();
+        lb = lb.truncate_to_signed_finite_width(64);
+        ub = ub.truncate_to_signed_finite_width(64);
     }
     if (lb > ub) {
         // Range wraps in the middle, so we cannot represent as an unsigned interval.
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index 99d190351..8d2719d70 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -16,21 +16,32 @@ using boost::multiprecision::cpp_int;
 
 namespace crab {
 
+template <typename T>
+concept is_enum = std::is_enum_v<T>;
+
+template <std::integral T>
+T truncate_to(const cpp_int& n) {
+    using U = std::make_unsigned_t<T>;
+    constexpr U mask = std::numeric_limits<U>::max();
+    return static_cast<T>(static_cast<U>(n & mask));
+}
+
+template <std::integral T>
+bool fits(const cpp_int& n) {
+    return std::numeric_limits<T>::min() <= n && n <= std::numeric_limits<T>::max();
+}
+
 class z_number final {
   private:
     cpp_int _n{nullptr};
 
-  public:
+public:
     z_number() = default;
     z_number(cpp_int n) : _n(std::move(n)) {}
+    z_number(std::integral auto n) : _n{n} {}
+    z_number(is_enum auto n) : _n{static_cast<int64_t>(n)} {}
     explicit z_number(const std::string& s) { _n = cpp_int(s); }
 
-    z_number(signed long long int n) { _n = n; }
-    z_number(unsigned long long int n) { _n = n; }
-    z_number(unsigned long int n) { _n = n; }
-    z_number(int n) { _n = n; }
-    z_number(unsigned int n) { _n = n; }
-    z_number(long n) { _n = n; }
 
     // overloaded typecast operators
     explicit operator int64_t() const {
@@ -75,25 +86,22 @@ class z_number final {
 
     [[nodiscard]]
     bool fits_sint32() const {
-        return ((_n >= INT_MIN) && (_n <= INT_MAX));
+        return fits<int32_t>(_n);
     }
 
     [[nodiscard]]
     bool fits_uint32() const {
-        return ((_n >= 0) && (_n <= UINT_MAX));
+        return fits<uint32_t>(_n);
     }
 
     [[nodiscard]]
     bool fits_sint64() const {
-        // "long long" is always 64-bits, whereas "long" varies
-        // (see https://en.cppreference.com/w/cpp/language/types)
-        // so make sure we use 64-bit numbers.
-        return ((_n >= LLONG_MIN) && (_n <= LLONG_MAX));
+        return fits<int64_t>(_n);
     }
 
     [[nodiscard]]
     bool fits_uint64() const {
-        return ((_n >= 0) && (_n <= ULLONG_MAX));
+        return fits<uint64_t>(_n);
     }
 
     [[nodiscard]]
@@ -113,17 +121,6 @@ class z_number final {
         }
     }
 
-    [[nodiscard]]
-    uint64_t truncate_to_uint64() const {
-        if (fits_sint64()) {
-            // Convert 64 bits from int64_t to uint64_t.
-            return (uint64_t)(int64_t)_n;
-        } else {
-            // Truncate to fit into an unsigned 64-bit integer.
-            return (uint64_t)_n;
-        }
-    }
-
     [[nodiscard]]
     uint64_t cast_to_uint32() const {
         if (fits_uint32()) {
@@ -136,11 +133,6 @@ class z_number final {
         }
     }
 
-    [[nodiscard]]
-    uint64_t truncate_to_uint32() const {
-        return (uint32_t)truncate_to_uint64();
-    }
-
     // For 64-bit operations, get the value as a signed 64-bit integer.
     [[nodiscard]]
     int64_t cast_to_sint64() const {
@@ -154,29 +146,12 @@ class z_number final {
         }
     }
 
-    // For 64-bit operations, get the value as a signed 64-bit integer.
-    [[nodiscard]]
-    int64_t truncate_to_sint64() const {
-        if (fits_sint64()) {
-            return (int64_t)_n;
-        } else {
-            // z_number does not fit into a signed 64-bit integer, so truncate it to fit.
-            return (int64_t)(uint64_t)_n;
-        }
-    }
-
     // For 32-bit operations, get the low 32 bits as a signed integer.
     [[nodiscard]]
     int32_t cast_to_sint32() const {
         return (int32_t)cast_to_sint64();
     }
 
-    // For 32-bit operations, get the low 32 bits as a signed integer.
-    [[nodiscard]]
-    int32_t truncate_to_sint32() const {
-        return (int32_t)truncate_to_sint64();
-    }
-
     // Allow casting to int32_t or int64_t as needed for finite width operations.
     [[nodiscard]]
     z_number cast_to_signed_finite_width(int finite_width) const {
@@ -205,8 +180,10 @@ class z_number final {
     z_number truncate_to_signed_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 32: return truncate_to_sint32();
-        case 64: return truncate_to_sint64();
+        case 8: return truncate_to<int8_t>(_n);
+        case 16: return truncate_to<int16_t>(_n);
+        case 32: return truncate_to<int32_t>(_n);
+        case 64: return truncate_to<int64_t>(_n);
         default: CRAB_ERROR("invalid finite width");
         }
     }
@@ -217,8 +194,10 @@ class z_number final {
     z_number truncate_to_unsigned_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 32: return truncate_to_uint32();
-        case 64: return truncate_to_uint64();
+        case 8: return truncate_to<uint8_t>(_n);
+        case 16: return truncate_to<uint16_t>(_n);
+        case 32: return truncate_to<uint32_t>(_n);
+        case 64: return truncate_to<uint64_t>(_n);
         default: CRAB_ERROR("invalid finite width");
         }
     }

From 4ee1d77fff70f789186da56df61b1f92885ed89b Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 24 Sep 2024 14:25:40 +0300
Subject: [PATCH 236/373] bump catch2 to v3.7.1

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 40f43ef5a..fd3a90f3a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -7,7 +7,7 @@ include(FetchContent)
 FetchContent_Declare(
   Catch2
   GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-  GIT_TAG        05e10dfccc28c7f973727c54f850237d07d5e10f # v3.5.2
+  GIT_TAG        fa43b77429ba76c462b1898d6cd2f2d7a9416b14 # v3.7.1
 )
 FetchContent_MakeAvailable(Catch2)
 

From 00955252edf72f6a7d2eb34a019d3fdde4238fa0 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 25 Sep 2024 12:45:52 +0300
Subject: [PATCH 237/373] use explicit width for finite width parameters

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/ebpf_domain.cpp   | 149 ++++++++++++------------
 src/crab/interval.cpp      |  44 +++----
 src/crab/interval.hpp      | 228 +++++++++++++++++++++----------------
 src/crab_utils/bignums.hpp |  57 +++++++---
 4 files changed, 271 insertions(+), 207 deletions(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index ae31b40b7..8a80e6384 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -131,7 +131,7 @@ static std::vector<linear_constraint_t> assume_signed_64bit_eq(const NumAbsDomai
                                                                const linear_expression_t& right_svalue,
                                                                const linear_expression_t& right_uvalue) {
     using namespace crab::dsl_syntax;
-    if (right_interval <= crab::interval_t::nonnegative_int(true) && !right_interval.is_singleton()) {
+    if (right_interval <= crab::interval_t::nonnegative(64) && !right_interval.is_singleton()) {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue), eq(left_svalue, left_uvalue)};
     } else {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue)};
@@ -200,15 +200,14 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
     left_interval = inv.eval_interval(left_svalue);
     right_interval = inv.eval_interval(right_svalue);
     if (!is64) {
-        if ((left_interval <= interval_t::nonnegative_int(false) &&
-             right_interval <= interval_t::nonnegative_int(false)) ||
-            (left_interval <= interval_t::negative_int(false) && right_interval <= interval_t::negative_int(false))) {
+        if ((left_interval <= interval_t::nonnegative(32) && right_interval <= interval_t::nonnegative(32)) ||
+            (left_interval <= interval_t::negative(32) && right_interval <= interval_t::negative(32))) {
             is64 = true;
             // fallthrough as 64bit, including deduction of relational information
         } else {
             for (interval_t* interval : {&left_interval, &right_interval}) {
-                if (!(*interval <= interval_t::signed_int(false))) {
-                    *interval = interval->truncate_to_sint(false);
+                if (!(*interval <= interval_t::signed_int(32))) {
+                    *interval = interval->truncate_to_sint(32);
                 }
             }
             // continue as 32bit
@@ -216,25 +215,26 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
     }
 
     if (!left_interval.is_top()) {
-        left_interval_positive = left_interval & interval_t::nonnegative_int(true);
-        left_interval_negative = left_interval & interval_t::negative_int(true);
+        left_interval_positive = left_interval & interval_t::nonnegative(64);
+        left_interval_negative = left_interval & interval_t::negative(64);
     } else {
         left_interval = inv.eval_interval(left_uvalue);
         if (!left_interval.is_top()) {
             // The interval is TOP as a signed interval but is represented precisely as an unsigned interval,
             // so split into two signed intervals that can be treated separately.
-            left_interval_positive = left_interval & interval_t::nonnegative_int(true);
-            number_t lih_ub = left_interval.ub().number() ? left_interval.ub().number()->truncate_to_signed_finite_width(64) : -1;
+            left_interval_positive = left_interval & interval_t::nonnegative(64);
+            number_t lih_ub =
+                left_interval.ub().number() ? left_interval.ub().number()->truncate_to_signed_finite_width(64) : -1;
             left_interval_negative = interval_t(number_t{std::numeric_limits<int64_t>::min()}, lih_ub);
         } else {
-            left_interval_positive = interval_t::nonnegative_int(true);
-            left_interval_negative = interval_t::negative_int(true);
+            left_interval_positive = interval_t::nonnegative(64);
+            left_interval_negative = interval_t::negative(64);
         }
     }
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::signed_int(true))) {
-            *interval = interval->truncate_to_sint(true);
+        if (!(*interval <= interval_t::signed_int(64))) {
+            *interval = interval->truncate_to_sint(64);
         }
     }
 }
@@ -252,15 +252,14 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
     left_interval = inv.eval_interval(left_uvalue);
     right_interval = inv.eval_interval(right_uvalue);
     if (!is64) {
-        if ((left_interval <= interval_t::nonnegative_int(false) &&
-             right_interval <= interval_t::nonnegative_int(false)) ||
-            (left_interval <= interval_t::unsigned_high(false) && right_interval <= interval_t::unsigned_high(false))) {
+        if ((left_interval <= interval_t::nonnegative(32) && right_interval <= interval_t::nonnegative(32)) ||
+            (left_interval <= interval_t::unsigned_high(32) && right_interval <= interval_t::unsigned_high(32))) {
             is64 = true;
             // fallthrough as 64bit, including deduction of relational information
         } else {
             for (interval_t* interval : {&left_interval, &right_interval}) {
-                if (!(*interval <= interval_t::unsigned_int(false))) {
-                    *interval = interval->truncate_to_uint(false);
+                if (!(*interval <= interval_t::unsigned_int(32))) {
+                    *interval = interval->truncate_to_uint(32);
                 }
             }
             // continue as 32bit
@@ -268,24 +267,24 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
     }
 
     if (!left_interval.is_top()) {
-        left_interval_low = left_interval & interval_t::nonnegative_int(true);
-        left_interval_high = left_interval & interval_t::unsigned_high(true);
+        left_interval_low = left_interval & interval_t::nonnegative(64);
+        left_interval_high = left_interval & interval_t::unsigned_high(64);
     } else {
         left_interval = inv.eval_interval(left_svalue);
         if (!left_interval.is_top()) {
             // The interval is TOP as an unsigned interval but is represented precisely as a signed interval,
             // so split into two unsigned intervals that can be treated separately.
-            left_interval_low = interval_t(number_t{0}, left_interval.ub()).truncate_to_uint(true);
-            left_interval_high = interval_t(left_interval.lb(), number_t{-1}).truncate_to_uint(true);
+            left_interval_low = interval_t(number_t{0}, left_interval.ub()).truncate_to_uint(64);
+            left_interval_high = interval_t(left_interval.lb(), number_t{-1}).truncate_to_uint(64);
         } else {
-            left_interval_low = interval_t::nonnegative_int(true);
-            left_interval_high = interval_t::unsigned_high(true);
+            left_interval_low = interval_t::nonnegative(64);
+            left_interval_high = interval_t::unsigned_high(64);
         }
     }
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::unsigned_int(true))) {
-            *interval = interval->truncate_to_uint(true);
+        if (!(*interval <= interval_t::unsigned_int(64))) {
+            *interval = interval->truncate_to_uint(64);
         }
     }
 }
@@ -298,12 +297,12 @@ assume_signed_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (right_interval <= interval_t::negative_int(true)) {
+    if (right_interval <= interval_t::negative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1].
         return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue), number_t{0} <= left_uvalue,
                 strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
-    } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative_int(true) &&
-               right_interval <= interval_t::nonnegative_int(true)) {
+    } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(64) &&
+               right_interval <= interval_t::nonnegative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue), number_t{0} <= left_uvalue,
                 strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
@@ -321,16 +320,16 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (right_interval <= interval_t::negative_int(false)) {
+    if (right_interval <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
         return {left_uvalue >= (number_t{INT32_MAX} + 1),
                 strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
-    } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative_int(false) &&
-               right_interval <= interval_t::nonnegative_int(false)) {
+    } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(32) &&
+               right_interval <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX]
-        auto lpub = left_interval_positive.truncate_to_sint(false).ub();
+        auto lpub = left_interval_positive.truncate_to_sint(32).ub();
         return {left_svalue >= 0,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue,
                 left_svalue <= left_uvalue,
@@ -338,8 +337,8 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                 left_uvalue >= 0,
                 strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
                 left_uvalue <= *lpub.number()};
-    } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(false) &&
-               inv.eval_interval(right_svalue) <= interval_t::signed_int(false)) {
+    } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(32) &&
+               inv.eval_interval(right_svalue) <= interval_t::signed_int(32)) {
         // Interval can only be represented as an svalue.
         return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
     } else {
@@ -356,9 +355,9 @@ assume_signed_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (right_interval <= interval_t::nonnegative_int(true)) {
+    if (right_interval <= interval_t::nonnegative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to_sint(true).ub();
+        auto lpub = left_interval_positive.truncate_to_sint(64).ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -366,8 +365,8 @@ assume_signed_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                 left_uvalue >= 0,
                 strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 left_uvalue <= *lpub.number()};
-    } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative_int(true) &&
-               right_interval <= interval_t::negative_int(true)) {
+    } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative(64) &&
+               right_interval <= interval_t::negative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
         return {left_uvalue >= (number_t{INT64_MAX} + 1),
@@ -387,9 +386,9 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (right_interval <= interval_t::nonnegative_int(false)) {
+    if (right_interval <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to_sint(false).ub();
+        auto lpub = left_interval_positive.truncate_to_sint(32).ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -397,15 +396,15 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                 left_uvalue >= 0,
                 strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 left_uvalue <= *lpub.number()};
-    } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative_int(false) &&
-               right_interval <= interval_t::negative_int(false)) {
+    } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative(32) &&
+               right_interval <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
         return {left_uvalue >= (number_t{INT32_MAX} + 1),
                 strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
                 strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
-    } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(false) &&
-               inv.eval_interval(right_svalue) <= interval_t::signed_int(false)) {
+    } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(32) &&
+               inv.eval_interval(right_svalue) <= interval_t::signed_int(32)) {
         // Interval can only be represented as an svalue.
         return {strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
     } else {
@@ -489,8 +488,8 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using namespace crab::dsl_syntax;
 
     auto rub = right_interval.ub();
-    auto lllb = left_interval_low.truncate_to_uint(true).lb();
-    if ((right_interval <= interval_t::nonnegative_int(true)) && (strict ? (lllb >= rub) : (lllb > rub))) {
+    auto lllb = left_interval_low.truncate_to_uint(64).lb();
+    if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (lllb >= rub) : (lllb > rub))) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
@@ -500,8 +499,8 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
                     left_svalue >= 0};
         }
     }
-    auto lhlb = left_interval_high.truncate_to_uint(true).lb();
-    if ((right_interval <= interval_t::unsigned_high(true)) && (strict ? (lhlb >= rub) : (lhlb > rub))) {
+    auto lhlb = left_interval_high.truncate_to_uint(64).lb();
+    if ((right_interval <= interval_t::unsigned_high(64)) && (strict ? (lhlb >= rub) : (lhlb > rub))) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
             return {left_uvalue >= 0, ((strict) ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
@@ -511,17 +510,17 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
                     left_svalue >= 0};
         }
     }
-    if (right_interval <= interval_t::signed_int(true)) {
+    if (right_interval <= interval_t::signed_int(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto llub = left_interval_low.truncate_to_uint(true).ub();
+        auto llub = left_interval_low.truncate_to_uint(64).ub();
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 left_uvalue <= *llub.number(), number_t{0} <= left_svalue,
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
-    } else if (left_interval_low.is_bottom() && right_interval <= interval_t::unsigned_high(true)) {
+    } else if (left_interval_low.is_bottom() && right_interval <= interval_t::unsigned_high(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
-    } else if ((left_interval_low | left_interval_high) == interval_t::unsigned_int(true)) {
+    } else if ((left_interval_low | left_interval_high) == interval_t::unsigned_int(64)) {
         // Interval can only be represented as a uvalue, and was TOP before.
         return {strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
     } else {
@@ -538,18 +537,18 @@ assume_unsigned_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (inv.eval_interval(left_uvalue) <= interval_t::nonnegative_int(false) &&
-        inv.eval_interval(right_uvalue) <= interval_t::nonnegative_int(false)) {
+    if (inv.eval_interval(left_uvalue) <= interval_t::nonnegative(32) &&
+        inv.eval_interval(right_uvalue) <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT32_MAX].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
-    } else if (inv.eval_interval(left_svalue) <= interval_t::negative_int(false) &&
-               inv.eval_interval(right_svalue) <= interval_t::negative_int(false)) {
+    } else if (inv.eval_interval(left_svalue) <= interval_t::negative(32) &&
+               inv.eval_interval(right_svalue) <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MIN, -1].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
-    } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(false) &&
-               inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(false)) {
+    } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
+               inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(32)) {
         // Interval can only be represented as a uvalue.
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
     } else {
@@ -567,21 +566,21 @@ assume_unsigned_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using namespace crab::dsl_syntax;
 
     auto rlb = right_interval.lb();
-    auto llub = left_interval_low.truncate_to_uint(true).ub();
-    auto lhlb = left_interval_high.truncate_to_uint(true).lb();
+    auto llub = left_interval_low.truncate_to_uint(64).ub();
+    auto lhlb = left_interval_high.truncate_to_uint(64).lb();
 
-    if ((right_interval <= interval_t::nonnegative_int(true)) && (strict ? (llub <= rlb) : (llub < rlb))) {
+    if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (llub <= rlb) : (llub < rlb))) {
         // The low interval is out of range.
         return {(strict) ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
                 (*lhlb.number() == number_t(std::numeric_limits<uint64_t>::max())) ? (left_uvalue == *lhlb.number())
                                                                                    : (left_uvalue >= *lhlb.number()),
                 left_svalue < 0};
-    } else if (right_interval <= interval_t::unsigned_high(true)) {
+    } else if (right_interval <= interval_t::unsigned_high(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
                 strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
-    } else if ((left_interval_low | left_interval_high) <= interval_t::nonnegative_int(true) &&
-               right_interval <= interval_t::nonnegative_int(true)) {
+    } else if ((left_interval_low | left_interval_high) <= interval_t::nonnegative(64) &&
+               right_interval <= interval_t::nonnegative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
                 strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
@@ -599,12 +598,12 @@ assume_unsigned_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    if (right_interval <= interval_t::unsigned_high(false)) {
+    if (right_interval <= interval_t::unsigned_high(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MAX+1, UINT32_MAX].
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
                 strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
-    } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(false) &&
-               inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(false)) {
+    } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
+               inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(32)) {
         // Interval can only be represented as a uvalue.
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue)};
     } else {
@@ -631,7 +630,7 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
     // Handle uvalue != right.
     if (op == Condition::Op::NE) {
         if (auto rn = right_interval.singleton()) {
-            if (rn == left_interval.truncate_to_uint(is64).lb().number()) {
+            if (rn == left_interval.truncate_to_uint(is64 ? 64 : 32).lb().number()) {
                 // "NE lower bound" is equivalent to "GT lower bound".
                 op = Condition::Op::GT;
                 right_interval = interval_t{left_interval.lb()};
@@ -736,7 +735,7 @@ static std::vector<linear_constraint_t> assume_cst_reg(const NumAbsDomain& inv,
         switch (op) {
         case Op::EQ: {
             crab::interval_t src_interval = inv.eval_interval(src_svalue);
-            if (!src_interval.is_singleton() && (src_interval <= crab::interval_t::nonnegative_int(true))) {
+            if (!src_interval.is_singleton() && (src_interval <= crab::interval_t::nonnegative(64))) {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue), eq(dst_svalue, dst_uvalue)};
             } else {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue)};
@@ -2734,7 +2733,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
     using namespace crab::dsl_syntax;
 
     auto dst = reg_pack(bin.dst);
-    int finite_width = (bin.is64) ? 64 : 32;
+    int finite_width = bin.is64 ? 64 : 32;
 
     if (std::holds_alternative<Imm>(bin.v)) {
         // dst += K
@@ -2751,7 +2750,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::MOV:
             assign(dst.svalue, imm);
             assign(dst.uvalue, imm);
-            overflow_unsigned(m_inv, dst.uvalue, (bin.is64) ? 64 : 32);
+            overflow_unsigned(m_inv, dst.uvalue, bin.is64 ? 64 : 32);
             type_inv.assign_type(m_inv, bin.dst, T_NUM);
             havoc_offsets(bin.dst);
             break;
@@ -2957,6 +2956,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             if (m_inv.entail(type_is_number(src_reg))) {
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
+                    // truncate to uint64?
                     uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
                     if (imm <= INT32_MAX) {
                         if (!bin.is64) {
@@ -3021,7 +3021,8 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             break;
         case Bin::Op::MOV:
             // Keep relational information if operation is a no-op.
-            if ((dst.svalue == src.svalue) && (m_inv.eval_interval(dst.uvalue) <= interval_t::unsigned_int(bin.is64))) {
+            if ((dst.svalue == src.svalue) &&
+                (m_inv.eval_interval(dst.uvalue) <= interval_t::unsigned_int(bin.is64 ? 64 : 32))) {
                 return;
             }
             assign(dst.svalue, src.svalue);
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index c121b93e9..bec4e3ae4 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -29,13 +29,13 @@ interval_t interval_t::operator/(const interval_t& x) const {
         using z_interval = interval_t;
         if (x[0]) {
             // The divisor contains 0.
-            z_interval l(x._lb, z_bound(-1));
-            z_interval u(z_bound(1), x._ub);
+            z_interval l(x._lb, bound_t(-1));
+            z_interval u(bound_t(1), x._ub);
             return (operator/(l) | operator/(u) | z_interval(number_t(0)));
         } else if (operator[](0)) {
             // The dividend contains 0.
-            z_interval l(_lb, z_bound(-1));
-            z_interval u(z_bound(1), _ub);
+            z_interval l(_lb, bound_t(-1));
+            z_interval u(bound_t(1), _ub);
             return ((l / x) | (u / x) | z_interval(number_t(0)));
         } else {
             // Neither the dividend nor the divisor contains 0
@@ -47,7 +47,7 @@ interval_t interval_t::operator/(const interval_t& x) const {
             bound_t lu = a._lb / x._ub;
             bound_t ul = a._ub / x._lb;
             bound_t uu = a._ub / x._ub;
-            return interval_t(bound_t::min(ll, lu, ul, uu), bound_t::max(ll, lu, ul, uu));
+            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
         }
     }
 }
@@ -76,13 +76,13 @@ interval_t interval_t::SDiv(const interval_t& x) const {
         using z_interval = interval_t;
         if (x[0]) {
             // The divisor contains 0.
-            z_interval l(x._lb, z_bound(-1));
-            z_interval u(z_bound(1), x._ub);
+            z_interval l(x._lb, bound_t(-1));
+            z_interval u(bound_t(1), x._ub);
             return (SDiv(l) | SDiv(u) | z_interval(number_t(0)));
         } else if (operator[](0)) {
             // The dividend contains 0.
-            z_interval l(_lb, z_bound(-1));
-            z_interval u(z_bound(1), _ub);
+            z_interval l(_lb, bound_t(-1));
+            z_interval u(bound_t(1), _ub);
             return (l.SDiv(x) | u.SDiv(x) | z_interval(number_t(0)));
         } else {
             // Neither the dividend nor the divisor contains 0
@@ -94,7 +94,7 @@ interval_t interval_t::SDiv(const interval_t& x) const {
             bound_t lu = a._lb / x._ub;
             bound_t ul = a._ub / x._lb;
             bound_t uu = a._ub / x._ub;
-            return interval_t(bound_t::min(ll, lu, ul, uu), bound_t::max(ll, lu, ul, uu));
+            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
         }
     }
 }
@@ -123,13 +123,13 @@ interval_t interval_t::UDiv(const interval_t& x) const {
         using z_interval = interval_t;
         if (x[0]) {
             // The divisor contains 0.
-            z_interval l(x._lb, z_bound(-1));
-            z_interval u(z_bound(1), x._ub);
+            z_interval l(x._lb, bound_t(-1));
+            z_interval u(bound_t(1), x._ub);
             return (UDiv(l) | UDiv(u) | z_interval(number_t(0)));
         } else if (operator[](0)) {
             // The dividend contains 0.
-            z_interval l(_lb, z_bound(-1));
-            z_interval u(z_bound(1), _ub);
+            z_interval l(_lb, bound_t(-1));
+            z_interval u(bound_t(1), _ub);
             return (l.UDiv(x) | u.UDiv(x) | z_interval(number_t(0)));
         } else {
             // Neither the dividend nor the divisor contains 0
@@ -141,7 +141,7 @@ interval_t interval_t::UDiv(const interval_t& x) const {
             bound_t lu = a._lb.UDiv(x._ub);
             bound_t ul = a._ub.UDiv(x._lb);
             bound_t uu = a._ub.UDiv(x._ub);
-            return interval_t(bound_t::min(ll, lu, ul, uu), bound_t::max(ll, lu, ul, uu));
+            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
         }
     }
 }
@@ -163,8 +163,8 @@ interval_t interval_t::SRem(const interval_t& x) const {
         return interval_t(dividend % divisor);
     } else if (x[0]) {
         // The divisor contains 0.
-        interval_t l(x._lb, z_bound(-1));
-        interval_t u(z_bound(1), x._ub);
+        interval_t l(x._lb, bound_t(-1));
+        interval_t u(bound_t(1), x._ub);
         return SRem(l) | SRem(u) | *this;
     } else if (x.ub().is_finite() && x.lb().is_finite()) {
         number_t min_divisor = min(abs(*x.lb().number()), abs(*x.ub().number()));
@@ -212,13 +212,13 @@ interval_t interval_t::URem(const interval_t& x) const {
         using z_interval = interval_t;
         if (x[0]) {
             // The divisor contains 0.
-            z_interval l(x._lb, z_bound(-1));
-            z_interval u(z_bound(1), x._ub);
+            z_interval l(x._lb, bound_t(-1));
+            z_interval u(bound_t(1), x._ub);
             return (URem(l) | URem(u) | *this);
         } else if (operator[](0)) {
             // The dividend contains 0.
-            z_interval l(_lb, z_bound(-1));
-            z_interval u(z_bound(1), _ub);
+            z_interval l(_lb, bound_t(-1));
+            z_interval u(bound_t(1), _ub);
             return (l.URem(x) | u.URem(x) | *this);
         } else {
             // Neither the dividend nor the divisor contains 0
@@ -266,7 +266,7 @@ interval_t interval_t::And(const interval_t& x) const {
             // avoid setting other bits via sign extension.
             return interval_t{number_t{0}, number_t{UINT32_MAX}};
         } else if (!is_top() && !x.is_top()) {
-            return interval_t(number_t{0}, bound_t::min(ub(), x.ub()));
+            return interval_t(number_t{0}, std::min(ub(), x.ub()));
         } else if (!x.is_top()) {
             return interval_t(number_t{0}, x.ub());
         } else if (!is_top()) {
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 5ca32cde6..3c274f4ca 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -17,12 +17,10 @@
 namespace crab {
 
 class bound_t final {
-  private:
     bool _is_infinite;
     number_t _n;
 
-  private:
-    bound_t(bool is_infinite, const number_t& n) : _is_infinite(is_infinite), _n(n) {
+    bound_t(const bool is_infinite, const number_t& n) : _is_infinite(is_infinite), _n(n) {
         if (is_infinite) {
             if (n > 0) {
                 _n = 1;
@@ -33,27 +31,10 @@ class bound_t final {
     }
 
   public:
-    static bound_t min(const bound_t& x, const bound_t& y) { return (x.operator<=(y) ? x : y); }
-
-    static bound_t min(const bound_t& x, const bound_t& y, const bound_t& z) { return min(x, min(y, z)); }
-
-    static bound_t min(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) {
-        return min(x, min(t, y, z));
-    }
-
-    static bound_t max(const bound_t& x, const bound_t& y) { return (x.operator<=(y) ? y : x); }
-
-    static bound_t max(const bound_t& x, const bound_t& y, const bound_t& z) { return max(x, max(y, z)); }
-
-    static bound_t max(const bound_t& x, const bound_t& y, const bound_t& z, const bound_t& t) {
-        return max(x, max(t, y, z));
-    }
-
     static bound_t plus_infinity() { return bound_t(true, 1); }
 
     static bound_t minus_infinity() { return bound_t(true, -1); }
 
-  public:
     explicit bound_t(const std::string& s) : _n(1) {
         if (s == "+oo") {
             _is_infinite = true;
@@ -155,8 +136,8 @@ class bound_t final {
         if (x._n == 0) {
             CRAB_ERROR("Bound: division by zero");
         } else if (is_finite() && x.is_finite()) {
-            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to_uint64()};
-            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to_uint64()};
+            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to<uint64_t>()};
+            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to<uint64_t>()};
             return bound_t(false, dividend / divisor);
         } else if (is_finite() && x.is_infinite()) {
             return number_t{0};
@@ -170,8 +151,8 @@ class bound_t final {
         if (x._n == 0) {
             CRAB_ERROR("Bound: modulo zero");
         } else if (is_finite() && x.is_finite()) {
-            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to_uint64()};
-            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to_uint64()};
+            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to<uint64_t>()};
+            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to<uint64_t>()};
             return bound_t(false, dividend % divisor);
         } else if (is_finite() && x.is_infinite()) {
             return *this;
@@ -245,10 +226,7 @@ class bound_t final {
 
 }; // class bound
 
-using z_bound = bound_t;
-
 class interval_t final {
-  private:
     bound_t _lb;
     bound_t _ub;
 
@@ -275,6 +253,14 @@ class interval_t final {
     interval_t(const bound_t& lb, const bound_t& ub)
         : _lb(lb > ub ? bound_t{number_t{0}} : lb), _ub(lb > ub ? bound_t{-1} : ub) {}
 
+    template <std::integral T>
+    interval_t(T lb, T ub) : _lb(bound_t{lb}), _ub(bound_t{ub}) {
+        if (lb > ub) {
+            _lb = bound_t{number_t{0}};
+            _ub = bound_t{-1};
+        }
+    }
+
     explicit interval_t(const bound_t& b)
         : _lb(b.is_infinite() ? bound_t{number_t{0}} : b), _ub(b.is_infinite() ? bound_t{-1} : b) {}
 
@@ -330,7 +316,7 @@ class interval_t final {
         } else if (x.is_bottom()) {
             return *this;
         } else {
-            return interval_t(bound_t::min(_lb, x._lb), bound_t::max(_ub, x._ub));
+            return interval_t(std::min(_lb, x._lb), std::max(_ub, x._ub));
         }
     }
 
@@ -338,7 +324,7 @@ class interval_t final {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
-            return interval_t(bound_t::max(_lb, x._lb), bound_t::min(_ub, x._ub));
+            return interval_t(std::max(_lb, x._lb), std::min(_ub, x._ub));
         }
     }
 
@@ -413,7 +399,7 @@ class interval_t final {
             bound_t lu = _lb * x._ub;
             bound_t ul = _ub * x._lb;
             bound_t uu = _ub * x._ub;
-            return interval_t(bound_t::min(ll, lu, ul, uu), bound_t::max(ll, lu, ul, uu));
+            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
         }
     }
 
@@ -423,6 +409,13 @@ class interval_t final {
 
     interval_t& operator/=(const interval_t& x) { return operator=(operator/(x)); }
 
+    bound_t size() const {
+        if (is_bottom()) {
+            return bound_t{number_t{0}};
+        }
+        return _ub - _lb;
+    }
+
     [[nodiscard]]
     bool is_singleton() const {
         return _lb == _ub;
@@ -488,94 +481,135 @@ class interval_t final {
     [[nodiscard]]
     interval_t AShr(const interval_t& x) const;
 
+    interval_t truncate_to_sint(bool is64) const = delete;
     [[nodiscard]]
-    interval_t truncate_to_sint(bool is64) const {
-        interval_t new_interval = *this;
-        if (!(*this <= interval_t::signed_int(is64))) {
-            if (auto size = finite_size()) {
-                auto llb = lb().number()->truncate_to_signed_finite_width(is64 ? 64 : 32);
-                auto lub = ub().number()->truncate_to_signed_finite_width(is64 ? 64 : 32);
-                if ((llb <= lub) && (is64 ? size->fits_sint64() : size->fits_sint32())) {
-                    // Interval can be accurately represented in 64 bits.
-                    new_interval = interval_t{llb, lub};
-                } else {
-                    new_interval = interval_t::signed_int(is64);
-                }
-            } else {
-                new_interval = interval_t::signed_int(is64);
-            }
+    interval_t truncate_to_sint(const int width) const {
+        switch (width) {
+        case 8: return truncate_to<int8_t>();
+        case 16: return truncate_to<int16_t>();
+        case 32: return truncate_to<int32_t>();
+        case 64: return truncate_to<int64_t>();
+        default: {
+            CRAB_ERROR("invalid width");
+        }
         }
-        return new_interval;
     }
 
+    interval_t truncate_to_uint(bool is64) const = delete;
     [[nodiscard]]
-    interval_t truncate_to_uint(bool is64) const {
-        interval_t new_interval = *this;
-        if (!(*this <= interval_t::unsigned_int(is64))) {
-            if (auto size = finite_size()) {
-                auto llb = lb().number()->truncate_to_unsigned_finite_width(is64 ? 64 : 32);
-                auto lub = ub().number()->truncate_to_unsigned_finite_width(is64 ? 64 : 32);
-                if ((llb <= lub) && (is64 ? size->fits_uint64() : size->fits_uint32())) {
-                    // Interval can be accurately represented in 64 bits.
-                    new_interval = interval_t{llb, lub};
-                } else {
-                    new_interval = interval_t::unsigned_int(is64);
-                }
-            } else {
-                new_interval = interval_t::unsigned_int(is64);
-            }
+    interval_t truncate_to_uint(const int width) const {
+        switch (width) {
+        case 8: return truncate_to<uint8_t>();
+        case 16: return truncate_to<uint16_t>();
+        case 32: return truncate_to<uint32_t>();
+        case 64: return truncate_to<uint64_t>();
+        default: {
+            CRAB_ERROR("invalid width");
+        }
         }
-        return new_interval;
     }
 
-    // Return a non-negative interval in the range [0, INT_MAX],
-    // which can be represented as both an svalue and a uvalue.
-    static interval_t nonnegative_int(bool is64) {
-        if (is64) {
-            return {number_t{0}, number_t{std::numeric_limits<int64_t>::max()}};
-        } else {
-            return {number_t{0}, number_t{std::numeric_limits<int32_t>::max()}};
+    template <std::integral T>
+    [[nodiscard]]
+    interval_t truncate_to() const {
+        if (*this <= full<T>()) {
+            return *this;
         }
-    }
-    // Return an interval in the range [INT_MIN, -1], which can only
-    // be represented as an svalue.  The uvalue equivalent using the same
-    // bits would be unsigned_high().
-    static interval_t negative_int(bool is64) {
-        if (is64) {
-            return {number_t{std::numeric_limits<int64_t>::min()}, number_t{-1}};
-        } else {
-            return {number_t{std::numeric_limits<int32_t>::min()}, number_t{-1}};
+        if (finite_size()->fits<T>()) {
+            T llb = lb().number()->truncate_to<T>();
+            T lub = ub().number()->truncate_to<T>();
+            if (llb <= lub) {
+                // Interval can be accurately represented in 64 width.
+                return interval_t(llb, lub);
+            }
         }
+        return full<T>();
     }
+
+    interval_t signed_int(bool is64) const = delete;
     // Return an interval in the range [INT_MIN, INT_MAX] which can only
     // be represented as an svalue.
-    static interval_t signed_int(int bits) {
-        switch (bits) {
-        case 64: return {number_t{std::numeric_limits<int64_t>::min()}, number_t{std::numeric_limits<int64_t>::max()}};
-        case 32: return {number_t{std::numeric_limits<int32_t>::min()}, number_t{std::numeric_limits<int32_t>::max()}};
-        case 16: return {number_t{std::numeric_limits<int16_t>::min()}, number_t{std::numeric_limits<int16_t>::max()}};
-        case 8: return {number_t{std::numeric_limits<int8_t>::min()}, number_t{std::numeric_limits<int8_t>::max()}};
+    static interval_t signed_int(const int width) {
+        switch (width) {
+        case 8: return full<int8_t>();
+        case 16: return full<int16_t>();
+        case 32: return full<int32_t>();
+        case 64: return full<int64_t>();
         default: throw std::exception();
         }
     }
-    static interval_t signed_int(bool is64) { return signed_int(is64 ? 64 : 32); }
+
+    interval_t unsigned_int(bool is64) const = delete;
     // Return an interval in the range [0, UINT_MAX] which can only be
     // represented as a uvalue.
-    static interval_t unsigned_int(bool is64) {
-        if (is64) {
-            return {number_t{0}, number_t{std::numeric_limits<uint64_t>::max()}};
-        } else {
-            return {number_t{0}, number_t{std::numeric_limits<uint32_t>::max()}};
+    static interval_t unsigned_int(const int width) {
+        switch (width) {
+        case 8: return full<uint8_t>();
+        case 32: return full<uint32_t>();
+        case 16: return full<uint16_t>();
+        case 64: return full<uint64_t>();
+        default: throw std::exception();
+        }
+    }
+
+    interval_t nonnegative(bool is64) const = delete;
+    // Return a non-negative interval in the range [0, INT_MAX],
+    // which can be represented as both an svalue and a uvalue.
+    static interval_t nonnegative(const int width) {
+        switch (width) {
+        case 8: return nonnegative<int8_t>();
+        case 16: return nonnegative<int16_t>();
+        case 32: return nonnegative<int32_t>();
+        case 64: return nonnegative<int64_t>();
+        default: throw std::exception();
+        }
+    }
+
+    interval_t negative(bool is64) const = delete;
+    // Return a non-negative interval in the range [0, INT_MAX],
+    // which can be represented as both an svalue and a uvalue.
+    static interval_t negative(const int width) {
+        switch (width) {
+        case 8: return negative<int8_t>();
+        case 16: return negative<int16_t>();
+        case 32: return negative<int32_t>();
+        case 64: return negative<int64_t>();
+        default: throw std::exception();
         }
     }
+
+    template <std::integral T>
+    static interval_t nonnegative() {
+        return {number_t{0}, number_t{std::numeric_limits<T>::max()}};
+    }
+
+    template <std::integral T>
+    static interval_t negative() {
+        return {number_t{std::numeric_limits<T>::min()}, number_t{-1}};
+    }
+
+    template <std::integral T>
+    static interval_t full() {
+        return {number_t{std::numeric_limits<T>::min()}, number_t{std::numeric_limits<T>::max()}};
+    }
+
+    template <std::unsigned_integral T>
+    static interval_t high() {
+        return interval_t{number_t{std::numeric_limits<std::make_signed_t<T>>::max()} + 1,
+                          number_t{std::numeric_limits<T>::max()}};
+    }
+
+    interval_t unsigned_high(bool is64) const = delete;
     // Return an interval in the range [INT_MAX+1, UINT_MAX], which can only
     // be represented as a uvalue.  The svalue equivalent using the same
-    // bits would be negative_int().
-    static interval_t unsigned_high(bool is64) {
-        if (is64) {
-            return {number_t{std::numeric_limits<int64_t>::max()} + 1, number_t{std::numeric_limits<uint64_t>::max()}};
-        } else {
-            return {number_t{std::numeric_limits<int32_t>::max()} + 1, number_t{std::numeric_limits<uint32_t>::max()}};
+    // width would be negative_int().
+    static interval_t unsigned_high(const int width) {
+        switch (width) {
+        case 8: return high<uint8_t>(); ;
+        case 16: return high<uint16_t>();
+        case 32: return high<uint32_t>();
+        case 64: return high<uint64_t>();
+        default: throw std::exception();
         }
     }
 
@@ -618,4 +652,4 @@ inline interval_t trim_interval(const interval_t& i, const interval_t& j) {
 
 } // namespace crab
 
-std::string to_string(const crab::interval_t& interval);
+std::string to_string(const crab::interval_t& interval) noexcept;
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index 8d2719d70..6822a1006 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -35,14 +35,13 @@ class z_number final {
   private:
     cpp_int _n{nullptr};
 
-public:
+  public:
     z_number() = default;
     z_number(cpp_int n) : _n(std::move(n)) {}
     z_number(std::integral auto n) : _n{n} {}
     z_number(is_enum auto n) : _n{static_cast<int64_t>(n)} {}
     explicit z_number(const std::string& s) { _n = cpp_int(s); }
 
-
     // overloaded typecast operators
     explicit operator int64_t() const {
         if (!fits_sint64()) {
@@ -84,24 +83,30 @@ class z_number final {
         return hasher(_n.str());
     }
 
+    template <std::integral T>
+    [[nodiscard]]
+    bool fits() const {
+        return crab::fits<T>(_n);
+    }
+
     [[nodiscard]]
     bool fits_sint32() const {
-        return fits<int32_t>(_n);
+        return fits<int32_t>();
     }
 
     [[nodiscard]]
     bool fits_uint32() const {
-        return fits<uint32_t>(_n);
+        return fits<uint32_t>();
     }
 
     [[nodiscard]]
     bool fits_sint64() const {
-        return fits<int64_t>(_n);
+        return fits<int64_t>();
     }
 
     [[nodiscard]]
     bool fits_uint64() const {
-        return fits<uint64_t>(_n);
+        return fits<uint64_t>();
     }
 
     [[nodiscard]]
@@ -121,6 +126,20 @@ class z_number final {
         }
     }
 
+    template <std::unsigned_integral U>
+    [[nodiscard]]
+    uint64_t cast_to() const {
+        using S = std::make_signed_t<U>;
+        if (fits<U>()) {
+            return (U)_n;
+        } else if (fits<S>()) {
+            // Convert 32 bits from int32_t to uint32_t.
+            return (U)(S)_n;
+        } else {
+            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 32-bit integer");
+        }
+    }
+
     [[nodiscard]]
     uint64_t cast_to_uint32() const {
         if (fits_uint32()) {
@@ -133,6 +152,12 @@ class z_number final {
         }
     }
 
+    template <std::signed_integral S>
+    [[nodiscard]]
+    int32_t cast_to() const {
+        return (S)cast_to_sint64();
+    }
+
     // For 64-bit operations, get the value as a signed 64-bit integer.
     [[nodiscard]]
     int64_t cast_to_sint64() const {
@@ -173,6 +198,10 @@ class z_number final {
         default: CRAB_ERROR("invalid finite width");
         }
     }
+    template <std::integral T>
+    T truncate_to() const {
+        return crab::truncate_to<T>(_n);
+    }
 
     // Allow truncating to int32_t or int64_t as needed for finite width operations.
     // Unlike casting, truncating will not throw a crab error if the number doesn't fit.
@@ -180,10 +209,10 @@ class z_number final {
     z_number truncate_to_signed_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 8: return truncate_to<int8_t>(_n);
-        case 16: return truncate_to<int16_t>(_n);
-        case 32: return truncate_to<int32_t>(_n);
-        case 64: return truncate_to<int64_t>(_n);
+        case 8: return truncate_to<int8_t>();
+        case 16: return truncate_to<int16_t>();
+        case 32: return truncate_to<int32_t>();
+        case 64: return truncate_to<int64_t>();
         default: CRAB_ERROR("invalid finite width");
         }
     }
@@ -194,10 +223,10 @@ class z_number final {
     z_number truncate_to_unsigned_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 8: return truncate_to<uint8_t>(_n);
-        case 16: return truncate_to<uint16_t>(_n);
-        case 32: return truncate_to<uint32_t>(_n);
-        case 64: return truncate_to<uint64_t>(_n);
+        case 8: return truncate_to<uint8_t>();
+        case 16: return truncate_to<uint16_t>();
+        case 32: return truncate_to<uint32_t>();
+        case 64: return truncate_to<uint64_t>();
         default: CRAB_ERROR("invalid finite width");
         }
     }

From cbe122474caf2e8085c3e0b16eda83c9176bd88c Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 25 Sep 2024 14:01:38 +0300
Subject: [PATCH 238/373] address review comments by coderabbit

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/interval.hpp      | 26 +++++++++++---------------
 src/crab_utils/bignums.hpp | 30 +++++++++++++++++++++++++-----
 2 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 3c274f4ca..d87d5a9ca 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -489,9 +489,7 @@ class interval_t final {
         case 16: return truncate_to<int16_t>();
         case 32: return truncate_to<int32_t>();
         case 64: return truncate_to<int64_t>();
-        default: {
-            CRAB_ERROR("invalid width");
-        }
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -503,9 +501,7 @@ class interval_t final {
         case 16: return truncate_to<uint16_t>();
         case 32: return truncate_to<uint32_t>();
         case 64: return truncate_to<uint64_t>();
-        default: {
-            CRAB_ERROR("invalid width");
-        }
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -535,7 +531,7 @@ class interval_t final {
         case 16: return full<int16_t>();
         case 32: return full<int32_t>();
         case 64: return full<int64_t>();
-        default: throw std::exception();
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -545,10 +541,10 @@ class interval_t final {
     static interval_t unsigned_int(const int width) {
         switch (width) {
         case 8: return full<uint8_t>();
-        case 32: return full<uint32_t>();
         case 16: return full<uint16_t>();
+        case 32: return full<uint32_t>();
         case 64: return full<uint64_t>();
-        default: throw std::exception();
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -561,7 +557,7 @@ class interval_t final {
         case 16: return nonnegative<int16_t>();
         case 32: return nonnegative<int32_t>();
         case 64: return nonnegative<int64_t>();
-        default: throw std::exception();
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -574,7 +570,7 @@ class interval_t final {
         case 16: return negative<int16_t>();
         case 32: return negative<int32_t>();
         case 64: return negative<int64_t>();
-        default: throw std::exception();
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
@@ -601,15 +597,15 @@ class interval_t final {
 
     interval_t unsigned_high(bool is64) const = delete;
     // Return an interval in the range [INT_MAX+1, UINT_MAX], which can only
-    // be represented as a uvalue.  The svalue equivalent using the same
-    // width would be negative_int().
+    // be represented as a uvalue.
+    // The svalue equivalent using the same width would be negative_int().
     static interval_t unsigned_high(const int width) {
         switch (width) {
-        case 8: return high<uint8_t>(); ;
+        case 8: return high<uint8_t>();
         case 16: return high<uint16_t>();
         case 32: return high<uint32_t>();
         case 64: return high<uint64_t>();
-        default: throw std::exception();
+        default: CRAB_ERROR("Invalid width ", width);
         }
     }
 
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index 6822a1006..d527cec40 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -26,6 +26,26 @@ T truncate_to(const cpp_int& n) {
     return static_cast<T>(static_cast<U>(n & mask));
 }
 
+// coderabbit implementation - TODO try in the future
+template <std::unsigned_integral U>
+U truncate_to_coderabbit(const cpp_int& n) {
+    constexpr U mask = std::numeric_limits<U>::max();
+    return static_cast<U>(n & mask);
+}
+
+// coderabbit implementation - TODO try in the future
+template <std::signed_integral S>
+S truncate_to_coderabbit(const cpp_int& n) {
+    using U = std::make_unsigned_t<S>;
+    constexpr uint32_t size = sizeof(S) * CHAR_BIT;
+    constexpr U mask = (U{1} << size) - 1;
+    const auto truncated = n & mask;
+    if (truncated >= cpp_int{1} << (size - 1)) {
+        truncated -= cpp_int{1} << size;
+    }
+    return static_cast<S>(truncated);
+}
+
 template <std::integral T>
 bool fits(const cpp_int& n) {
     return std::numeric_limits<T>::min() <= n && n <= std::numeric_limits<T>::max();
@@ -128,7 +148,7 @@ class z_number final {
 
     template <std::unsigned_integral U>
     [[nodiscard]]
-    uint64_t cast_to() const {
+    U cast_to() const {
         using S = std::make_signed_t<U>;
         if (fits<U>()) {
             return (U)_n;
@@ -136,7 +156,7 @@ class z_number final {
             // Convert 32 bits from int32_t to uint32_t.
             return (U)(S)_n;
         } else {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 32-bit integer");
+            CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(U).name());
         }
     }
 
@@ -154,8 +174,8 @@ class z_number final {
 
     template <std::signed_integral S>
     [[nodiscard]]
-    int32_t cast_to() const {
-        return (S)cast_to_sint64();
+    S cast_to() const {
+        return static_cast<S>(cast_to_sint64());
     }
 
     // For 64-bit operations, get the value as a signed 64-bit integer.
@@ -174,7 +194,7 @@ class z_number final {
     // For 32-bit operations, get the low 32 bits as a signed integer.
     [[nodiscard]]
     int32_t cast_to_sint32() const {
-        return (int32_t)cast_to_sint64();
+        return cast_to<int32_t>();
     }
 
     // Allow casting to int32_t or int64_t as needed for finite width operations.

From 2ceb6de7252351180d3f6b28fcdfc0caad5dad9b Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 25 Sep 2024 15:23:49 +0300
Subject: [PATCH 239/373] address review comments by coderabbit

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/interval.hpp | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index d87d5a9ca..986148cdd 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -511,12 +511,14 @@ class interval_t final {
         if (*this <= full<T>()) {
             return *this;
         }
-        if (finite_size()->fits<T>()) {
-            T llb = lb().number()->truncate_to<T>();
-            T lub = ub().number()->truncate_to<T>();
-            if (llb <= lub) {
-                // Interval can be accurately represented in 64 width.
-                return interval_t(llb, lub);
+        if (const auto size = finite_size()) {
+            if (size->fits<T>()) {
+                T llb = lb().number()->truncate_to<T>();
+                T lub = ub().number()->truncate_to<T>();
+                if (llb <= lub) {
+                    // Interval can be accurately represented in 64 width.
+                    return interval_t(llb, lub);
+                }
             }
         }
         return full<T>();
@@ -562,7 +564,7 @@ class interval_t final {
     }
 
     interval_t negative(bool is64) const = delete;
-    // Return a non-negative interval in the range [0, INT_MAX],
+    // Return a negative interval in the range [INT_MIN, -1],
     // which can be represented as both an svalue and a uvalue.
     static interval_t negative(const int width) {
         switch (width) {

From 84ab5a0d840ebe3bdeb9dff08ab36dc4165019d3 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 25 Sep 2024 17:10:59 +0300
Subject: [PATCH 240/373] refactor handling of division

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/ebpf_domain.cpp   |   2 +-
 src/crab/interval.cpp      | 475 ++++++++++++++++++-------------------
 src/crab/interval.hpp      |  92 ++++---
 src/crab_utils/bignums.hpp |   2 +-
 4 files changed, 271 insertions(+), 300 deletions(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 8a80e6384..90949380c 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2057,7 +2057,7 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
     std::optional<number_t> maybe_addr = interval.singleton();
     havoc_register(inv, target_reg);
 
-    bool may_touch_ptr = interval[desc->data] || interval[desc->meta] || interval[desc->end];
+    bool may_touch_ptr = interval.contains(desc->data) || interval.contains(desc->meta) || interval.contains(desc->end);
 
     if (!maybe_addr) {
         if (may_touch_ptr) {
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index bec4e3ae4..42e760c53 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -8,60 +8,57 @@ namespace crab {
 interval_t interval_t::operator/(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
+    }
+    if (const auto n = x.singleton()) {
         // Divisor is a singleton:
         //   the linear interval solver can perform many divisions where
         //   the divisor is a singleton interval. We optimize for this case.
-        if (std::optional<number_t> n = x.singleton()) {
-            number_t c = *n;
-            if (c == number_t{1}) {
-                return *this;
-            } else if (c > number_t{0}) {
-                return interval_t(_lb / bound_t{c}, _ub / bound_t{c});
-            } else if (c < number_t{0}) {
-                return interval_t(_ub / bound_t{c}, _lb / bound_t{c});
-            } else {
-                // The eBPF ISA defines division by 0 as resulting in 0.
-                return interval_t(number_t(0));
-            }
-        }
-        // Divisor is not a singleton
-        using z_interval = interval_t;
-        if (x[0]) {
-            // The divisor contains 0.
-            z_interval l(x._lb, bound_t(-1));
-            z_interval u(bound_t(1), x._ub);
-            return (operator/(l) | operator/(u) | z_interval(number_t(0)));
-        } else if (operator[](0)) {
-            // The dividend contains 0.
-            z_interval l(_lb, bound_t(-1));
-            z_interval u(bound_t(1), _ub);
-            return ((l / x) | (u / x) | z_interval(number_t(0)));
+        number_t c = *n;
+        if (c == number_t{1}) {
+            return *this;
+        } else if (c > number_t{0}) {
+            return interval_t(_lb / bound_t{c}, _ub / bound_t{c});
+        } else if (c < number_t{0}) {
+            return interval_t(_ub / bound_t{c}, _lb / bound_t{c});
         } else {
-            // Neither the dividend nor the divisor contains 0
-            z_interval a =
-                (_ub < number_t{0})
-                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
-                    : *this;
-            bound_t ll = a._lb / x._lb;
-            bound_t lu = a._lb / x._ub;
-            bound_t ul = a._ub / x._lb;
-            bound_t uu = a._ub / x._ub;
-            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+            // The eBPF ISA defines division by 0 as resulting in 0.
+            return interval_t(number_t(0));
         }
     }
+    if (x.contains(0)) {
+        // The divisor contains 0.
+        interval_t l(x._lb, bound_t(-1));
+        interval_t u(bound_t(1), x._ub);
+        return (operator/(l) | operator/(u) | interval_t(number_t(0)));
+    } else if (contains(0)) {
+        // The dividend contains 0.
+        interval_t l(_lb, bound_t(-1));
+        interval_t u(bound_t(1), _ub);
+        return ((l / x) | (u / x) | interval_t(number_t(0)));
+    } else {
+        // Neither the dividend nor the divisor contains 0
+        interval_t a =
+            (_ub < number_t{0})
+                ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
+                : *this;
+        bound_t ll = a._lb / x._lb;
+        bound_t lu = a._lb / x._ub;
+        bound_t ul = a._ub / x._lb;
+        bound_t uu = a._ub / x._ub;
+        return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+    }
 }
 
 // Signed division.
 interval_t interval_t::SDiv(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        // Divisor is a singleton:
-        //   the linear interval solver can perform many divisions where
-        //   the divisor is a singleton interval. We optimize for this case.
-        std::optional<number_t> n = x.singleton();
-        if (n && n->fits_cast_to_int64()) {
+    }
+    if (const auto n = x.singleton()) {
+        if (n->fits_cast_to_int64()) {
+            // Divisor is a singleton:
+            //   the linear interval solver can perform many divisions where
+            //   the divisor is a singleton interval. We optimize for this case.
             number_t c{n->cast_to_sint64()};
             if (c == 1) {
                 return *this;
@@ -72,30 +69,28 @@ interval_t interval_t::SDiv(const interval_t& x) const {
                 return interval_t(number_t(0));
             }
         }
-        // Divisor is not a singleton
-        using z_interval = interval_t;
-        if (x[0]) {
-            // The divisor contains 0.
-            z_interval l(x._lb, bound_t(-1));
-            z_interval u(bound_t(1), x._ub);
-            return (SDiv(l) | SDiv(u) | z_interval(number_t(0)));
-        } else if (operator[](0)) {
-            // The dividend contains 0.
-            z_interval l(_lb, bound_t(-1));
-            z_interval u(bound_t(1), _ub);
-            return (l.SDiv(x) | u.SDiv(x) | z_interval(number_t(0)));
-        } else {
-            // Neither the dividend nor the divisor contains 0
-            z_interval a =
-                (_ub < number_t{0})
-                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
-                    : *this;
-            bound_t ll = a._lb / x._lb;
-            bound_t lu = a._lb / x._ub;
-            bound_t ul = a._ub / x._lb;
-            bound_t uu = a._ub / x._ub;
-            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
-        }
+    }
+    if (x.contains(0)) {
+        // The divisor contains 0.
+        interval_t l(x._lb, bound_t(-1));
+        interval_t u(bound_t(1), x._ub);
+        return (SDiv(l) | SDiv(u) | interval_t(number_t(0)));
+    } else if (contains(0)) {
+        // The dividend contains 0.
+        interval_t l(_lb, bound_t(-1));
+        interval_t u(bound_t(1), _ub);
+        return (l.SDiv(x) | u.SDiv(x) | interval_t(number_t(0)));
+    } else {
+        // Neither the dividend nor the divisor contains 0
+        interval_t a =
+            (_ub < number_t{0})
+                ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
+                : *this;
+        bound_t ll = a._lb / x._lb;
+        bound_t lu = a._lb / x._ub;
+        bound_t ul = a._ub / x._lb;
+        bound_t uu = a._ub / x._ub;
+        return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
     }
 }
 
@@ -103,12 +98,12 @@ interval_t interval_t::SDiv(const interval_t& x) const {
 interval_t interval_t::UDiv(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        // Divisor is a singleton:
-        //   the linear interval solver can perform many divisions where
-        //   the divisor is a singleton interval. We optimize for this case.
-        std::optional<number_t> n = x.singleton();
-        if (n && n->fits_cast_to_int64()) {
+    }
+    if (const auto n = x.singleton()) {
+        if (n->fits_cast_to_int64()) {
+            // Divisor is a singleton:
+            //   the linear interval solver can perform many divisions where
+            //   the divisor is a singleton interval. We optimize for this case.
             number_t c{n->cast_to_uint64()};
             if (c == 1) {
                 return *this;
@@ -119,31 +114,29 @@ interval_t interval_t::UDiv(const interval_t& x) const {
                 return interval_t(number_t(0));
             }
         }
-        // Divisor is not a singleton
-        using z_interval = interval_t;
-        if (x[0]) {
-            // The divisor contains 0.
-            z_interval l(x._lb, bound_t(-1));
-            z_interval u(bound_t(1), x._ub);
-            return (UDiv(l) | UDiv(u) | z_interval(number_t(0)));
-        } else if (operator[](0)) {
-            // The dividend contains 0.
-            z_interval l(_lb, bound_t(-1));
-            z_interval u(bound_t(1), _ub);
-            return (l.UDiv(x) | u.UDiv(x) | z_interval(number_t(0)));
-        } else {
-            // Neither the dividend nor the divisor contains 0
-            z_interval a =
-                (_ub < number_t{0})
-                    ? (*this + ((x._ub < number_t{0}) ? (x + z_interval(number_t(1))) : (z_interval(number_t(1)) - x)))
-                    : *this;
-            bound_t ll = a._lb.UDiv(x._lb);
-            bound_t lu = a._lb.UDiv(x._ub);
-            bound_t ul = a._ub.UDiv(x._lb);
-            bound_t uu = a._ub.UDiv(x._ub);
-            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
-        }
     }
+    if (x.contains(0)) {
+        // The divisor contains 0.
+        interval_t l(x._lb, bound_t(-1));
+        interval_t u(bound_t(1), x._ub);
+        return UDiv(l) | UDiv(u) | interval_t(number_t(0));
+    }
+    if (contains(0)) {
+        // The dividend contains 0.
+        interval_t l(_lb, bound_t(-1));
+        interval_t u(bound_t(1), _ub);
+        return l.UDiv(x) | u.UDiv(x) | interval_t(number_t(0));
+    }
+    // Neither the dividend nor the divisor contains 0
+    interval_t a =
+        (_ub < number_t{0})
+            ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
+            : *this;
+    bound_t ll = a._lb.UDiv(x._lb);
+    bound_t lu = a._lb.UDiv(x._ub);
+    bound_t ul = a._ub.UDiv(x._lb);
+    bound_t uu = a._ub.UDiv(x._ub);
+    return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
 }
 
 // Signed remainder (modulo).
@@ -152,21 +145,22 @@ interval_t interval_t::SRem(const interval_t& x) const {
 
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else if (singleton() && x.singleton()) {
-        number_t dividend = *singleton();
-        number_t divisor = *x.singleton();
-
-        if (divisor == 0) {
-            return interval_t(dividend);
+    }
+    if (const auto dividend = singleton()) {
+        if (const auto divisor = x.singleton()) {
+            if (*divisor == 0) {
+                return interval_t(*dividend);
+            }
+            return interval_t(*dividend % *divisor);
         }
-
-        return interval_t(dividend % divisor);
-    } else if (x[0]) {
+    }
+    if (x.contains(0)) {
         // The divisor contains 0.
         interval_t l(x._lb, bound_t(-1));
         interval_t u(bound_t(1), x._ub);
         return SRem(l) | SRem(u) | *this;
-    } else if (x.ub().is_finite() && x.lb().is_finite()) {
+    }
+    if (x.ub().is_finite() && x.lb().is_finite()) {
         number_t min_divisor = min(abs(*x.lb().number()), abs(*x.ub().number()));
         number_t max_divisor = max(abs(*x.lb().number()), abs(*x.ub().number()));
 
@@ -181,59 +175,52 @@ interval_t interval_t::SRem(const interval_t& x) const {
             } else {
                 return interval_t(-(max_divisor - 1), number_t{0});
             }
-        } else {
-            return interval_t(number_t{0}, max_divisor - 1);
         }
-    } else {
-        // Divisor has infinite range, so result can be anything between the dividend and zero.
-        return *this | interval_t(number_t(0));
+        return interval_t(number_t{0}, max_divisor - 1);
     }
+    // Divisor has infinite range, so result can be anything between the dividend and zero.
+    return *this | interval_t(number_t(0));
 }
 
 // Unsigned remainder (modulo).
 interval_t interval_t::URem(const interval_t& x) const {
-
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
+    }
+    if (const auto n = x.singleton()) {
         // Divisor is a singleton:
         //   the linear interval solver can perform many divisions where
         //   the divisor is a singleton interval. We optimize for this case.
-        if (std::optional<number_t> n = x.singleton()) {
-            number_t c = *n;
-            if (c > number_t{0}) {
-                return interval_t(_lb.UMod(bound_t{c}), _ub.UMod(bound_t{c}));
-            } else {
-                // The eBPF ISA defines modulo 0 as being unchanged.
-                return *this;
-            }
+        number_t c = *n;
+        if (c > number_t{0}) {
+            return interval_t(_lb.URem(bound_t{c}), _ub.URem(bound_t{c}));
         }
-        // Divisor is not a singleton
-        using z_interval = interval_t;
-        if (x[0]) {
-            // The divisor contains 0.
-            z_interval l(x._lb, bound_t(-1));
-            z_interval u(bound_t(1), x._ub);
-            return (URem(l) | URem(u) | *this);
-        } else if (operator[](0)) {
-            // The dividend contains 0.
-            z_interval l(_lb, bound_t(-1));
-            z_interval u(bound_t(1), _ub);
-            return (l.URem(x) | u.URem(x) | *this);
+        // The eBPF ISA defines modulo 0 as being unchanged.
+        return *this;
+    }
+    if (x.contains(0)) {
+        // The divisor contains 0.
+        interval_t l(x._lb, bound_t(-1));
+        interval_t u(bound_t(1), x._ub);
+        return URem(l) | URem(u) | *this;
+    } else if (contains(0)) {
+        // The dividend contains 0.
+        interval_t l(_lb, bound_t(-1));
+        interval_t u(bound_t(1), _ub);
+        return l.URem(x) | u.URem(x) | *this;
+    } else {
+        // Neither the dividend nor the divisor contains 0
+        if (x._lb.is_infinite() || x._ub.is_infinite()) {
+            // Divisor is infinite. A "negative" dividend could result in anything except
+            // a value between the upper bound and 0, so set to top.  A "positive" dividend
+            // could result in anything between 0 and the dividend - 1.
+            return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t{1})) | interval_t(number_t(0)));
+        } else if (_ub.is_finite() && (_ub.number()->cast_to_uint64() < x._lb.number()->cast_to_uint64())) {
+            // Dividend lower than divisor, so the dividend is the remainder.
+            return *this;
         } else {
-            // Neither the dividend nor the divisor contains 0
-            if (x._lb.is_infinite() || x._ub.is_infinite()) {
-                // Divisor is infinite. A "negative" dividend could result in anything except
-                // a value between the upper bound and 0, so set to top.  A "positive" dividend
-                // could result in anything between 0 and the dividend - 1.
-                return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t{1})) | interval_t(number_t(0)));
-            } else if (_ub.is_finite() && (_ub.number()->cast_to_uint64() < x._lb.number()->cast_to_uint64())) {
-                // Dividend lower than divisor, so the dividend is the remainder.
-                return *this;
-            } else {
-                number_t max_divisor{x._ub.number()->cast_to_uint64()};
-                return interval_t(number_t{0}, max_divisor - 1);
-            }
+            number_t max_divisor{x._ub.number()->cast_to_uint64()};
+            return interval_t(number_t{0}, max_divisor - 1);
         }
     }
 }
@@ -242,154 +229,142 @@ interval_t interval_t::URem(const interval_t& x) const {
 interval_t interval_t::And(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        std::optional<number_t> left_op = singleton();
-        std::optional<number_t> right_op = x.singleton();
-
-        assert(is_top() || (lb() >= number_t{0}));
-        assert(x.is_top() || (x.lb() >= number_t{0}));
+    }
+    assert(is_top() || (lb() >= number_t{0}));
+    assert(x.is_top() || (x.lb() >= number_t{0}));
 
-        if (left_op && right_op) {
-            return interval_t((*left_op) & (*right_op));
-        } else if (right_op && right_op.value().fits_uint32() && right_op.value().cast_to_uint32() == UINT32_MAX) {
-            // Handle bitwise-AND with UINT32_MAX, which we do for 32-bit operations.
-            if (auto width = finite_size()) {
-                number_t lb32_n = (uint32_t)lb().number()->cast_to_uint64();
-                number_t ub32_n = (uint32_t)ub().number()->cast_to_uint64();
-                number_t width32_n = (uint32_t)width->cast_to_uint64();
-                if ((width->cast_to_uint64() <= UINT32_MAX) && (lb32_n < ub32_n) && (lb32_n + width32_n == ub32_n)) {
-                    return interval_t{lb32_n, ub32_n};
-                }
+    if (const auto left = singleton()) {
+        if (const auto right = x.singleton()) {
+            return interval_t(*left & *right);
+        }
+    }
+    if (x == interval_t{std::numeric_limits<uint32_t>::max()}) {
+        // Handle bitwise-AND with UINT32_MAX, which we do for 32-bit operations.
+        if (const auto width = finite_size()) {
+            const number_t lb32_n = lb().number()->truncate_to<uint32_t>();
+            const number_t ub32_n = ub().number()->truncate_to<uint32_t>();
+            if (width->fits_uint32() && lb32_n < ub32_n && lb32_n + width->truncate_to<uint32_t>() == ub32_n) {
+                return interval_t{lb32_n, ub32_n};
             }
-
-            // Return the full range of all 32-bit numbers.  Use unsigned bounds to
-            // avoid setting other bits via sign extension.
-            return interval_t{number_t{0}, number_t{UINT32_MAX}};
-        } else if (!is_top() && !x.is_top()) {
-            return interval_t(number_t{0}, std::min(ub(), x.ub()));
-        } else if (!x.is_top()) {
-            return interval_t(number_t{0}, x.ub());
-        } else if (!is_top()) {
-            return interval_t(number_t{0}, ub());
-        } else {
-            return top();
         }
+        return full<uint32_t>();
+    }
+    if (x.contains(std::numeric_limits<uint64_t>::max())) {
+        return truncate_to<uint64_t>();
+    } else if (!is_top() && !x.is_top()) {
+        return interval_t(number_t{0}, std::min(ub(), x.ub()));
+    } else if (!x.is_top()) {
+        return interval_t(number_t{0}, x.ub());
+    } else if (!is_top()) {
+        return interval_t(number_t{0}, ub());
+    } else {
+        return top();
     }
 }
 
 interval_t interval_t::Or(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        std::optional<number_t> left_op = singleton();
-        std::optional<number_t> right_op = x.singleton();
-
-        if (left_op && right_op) {
-            return interval_t((*left_op) | (*right_op));
-        } else if (lb() >= number_t{0} && x.lb() >= number_t{0}) {
-            std::optional<number_t> left_ub = ub().number();
-            std::optional<number_t> right_ub = x.ub().number();
-
-            if (left_ub && right_ub) {
-                number_t m = (*left_ub > *right_ub ? *left_ub : *right_ub);
+    }
+    if (const auto left_op = singleton()) {
+        if (const auto right_op = x.singleton()) {
+            return interval_t(*left_op | *right_op);
+        }
+    }
+    if (lb() >= number_t{0} && x.lb() >= number_t{0}) {
+        if (const auto left_ub = ub().number()) {
+            if (const auto right_ub = x.ub().number()) {
+                const number_t m = *left_ub > *right_ub ? *left_ub : *right_ub;
                 return interval_t(number_t{0}, m.fill_ones());
-            } else {
-                return interval_t(number_t{0}, bound_t::plus_infinity());
             }
-        } else {
-            return top();
         }
+        return interval_t(number_t{0}, bound_t::plus_infinity());
     }
+    return top();
 }
 
 interval_t interval_t::Xor(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        std::optional<number_t> left_op = singleton();
-        std::optional<number_t> right_op = x.singleton();
-
-        if (left_op && right_op) {
-            return interval_t((*left_op) ^ (*right_op));
-        } else {
-            return Or(x);
+    }
+    if (const auto left_op = singleton()) {
+        if (const auto right_op = x.singleton()) {
+            return interval_t(*left_op ^ *right_op);
         }
     }
+    return Or(x);
 }
 
 interval_t interval_t::Shl(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        if (std::optional<number_t> shift = x.singleton()) {
-            number_t k = *shift;
-            if (k < number_t{0}) {
-                // CRAB_ERROR("lshr shift operand cannot be negative");
-                return top();
-            }
-            // Some crazy linux drivers generate shl instructions with
-            // huge shifts.  We limit the number of times the loop is run
-            // to avoid wasting too much time on it.
-            if (k <= 128) {
-                number_t factor = 1;
-                for (int i = 0; k > i; i++) {
-                    factor *= 2;
-                }
-                return this->operator*(interval_t{factor});
+    }
+    if (const auto shift = x.singleton()) {
+        const number_t k = *shift;
+        if (k < number_t{0}) {
+            // CRAB_ERROR("lshr shift operand cannot be negative");
+            return top();
+        }
+        // Some crazy linux drivers generate shl instructions with
+        // huge shifts.  We limit the number of times the loop is run
+        // to avoid wasting too much time on it.
+        if (k <= 128) {
+            number_t factor = 1;
+            for (int i = 0; k > i; i++) {
+                factor *= 2;
             }
+            return this->operator*(interval_t{factor});
         }
-        return top();
     }
+    return top();
 }
 
 interval_t interval_t::AShr(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        if (std::optional<number_t> shift = x.singleton()) {
-            number_t k = *shift;
-            if (k < number_t{0}) {
-                // CRAB_ERROR("ashr shift operand cannot be negative");
-                return top();
-            }
-            // Some crazy linux drivers generate ashr instructions with
-            // huge shifts.  We limit the number of times the loop is run
-            // to avoid wasting too much time on it.
-            if (k <= 128) {
-                number_t factor = 1;
-                for (int i = 0; k > i; i++) {
-                    factor *= 2;
-                }
-                return this->operator/(interval_t{factor});
+    }
+    if (const auto shift = x.singleton()) {
+        const number_t k = *shift;
+        if (k < number_t{0}) {
+            // CRAB_ERROR("ashr shift operand cannot be negative");
+            return top();
+        }
+        // Some crazy linux drivers generate ashr instructions with
+        // huge shifts.  We limit the number of times the loop is run
+        // to avoid wasting too much time on it.
+        if (k <= 128) {
+            number_t factor = 1;
+            for (int i = 0; k > i; i++) {
+                factor *= 2;
             }
+            return this->operator/(interval_t{factor});
         }
-        return top();
     }
+    return top();
 }
 
 interval_t interval_t::LShr(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
-    } else {
-        if (std::optional<number_t> shift = x.singleton()) {
-            number_t k = *shift;
-            if (k < number_t{0}) {
-                // CRAB_ERROR("lshr shift operand cannot be negative");
-                return top();
-            }
-            // Some crazy linux drivers generate lshr instructions with
-            // huge shifts.  We limit the number of times the loop is run
-            // to avoid wasting too much time on it.
-            if (k <= 128) {
-                if (lb() >= number_t{0} && ub().is_finite() && shift) {
-                    number_t lb = *this->lb().number();
-                    number_t ub = *this->ub().number();
-                    return interval_t(lb >> k, ub >> k);
-                }
+    }
+    if (const auto shift = x.singleton()) {
+        const number_t k = *shift;
+        if (k < number_t{0}) {
+            // CRAB_ERROR("lshr shift operand cannot be negative");
+            return top();
+        }
+        // Some crazy linux drivers generate lshr instructions with
+        // huge shifts.  We limit the number of times the loop is run
+        // to avoid wasting too much time on it.
+        if (k <= 128) {
+            if (lb() >= number_t{0} && ub().is_finite() && shift) {
+                const number_t lb = *this->lb().number();
+                const number_t ub = *this->ub().number();
+                return interval_t(lb >> k, ub >> k);
             }
         }
-        return top();
     }
+    return top();
 }
 
 } // namespace crab
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 986148cdd..25fadc980 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -82,17 +82,16 @@ class bound_t final {
     bound_t operator-() const { return bound_t(_is_infinite, -_n); }
 
     bound_t operator+(const bound_t& x) const {
-        if (is_finite() && x.is_finite()) {
-            return bound_t(_n + x._n);
-        } else if (is_finite() && x.is_infinite()) {
+        if (is_finite()) {
+            if (x.is_finite()) {
+                return bound_t(_n + x._n);
+            }
             return x;
-        } else if (is_infinite() && x.is_finite()) {
-            return *this;
-        } else if (_n == x._n) {
+        }
+        if (x.is_finite() || x._n == _n) {
             return *this;
-        } else {
-            CRAB_ERROR("Bound: undefined operation -oo + +oo");
         }
+        CRAB_ERROR("Bound: undefined operation -oo + +oo");
     }
 
     bound_t& operator+=(const bound_t& x) { return operator=(operator+(x)); }
@@ -113,52 +112,50 @@ class bound_t final {
 
     bound_t& operator*=(const bound_t& x) { return operator=(operator*(x)); }
 
-    bound_t operator/(const bound_t& x) const {
+  private:
+    bound_t AbsDiv(const bound_t& x, bound_t (*f)(number_t, number_t)) const {
         if (x._n == 0) {
             CRAB_ERROR("Bound: division by zero");
-        } else if (is_finite() && x.is_finite()) {
-            return bound_t(false, _n / x._n);
-        } else if (is_finite() && x.is_infinite()) {
-            return number_t{0};
-        } else if (is_infinite() && x.is_finite()) {
-            if (x._n > 0) {
-                return *this;
-            } else {
-                return operator-();
+        }
+        if (x.is_infinite()) {
+            if (is_infinite()) {
+                CRAB_ERROR("Bound: inf / inf");
             }
-        } else {
-            return bound_t(true, _n * x._n);
+            return number_t{0};
         }
+        if (is_infinite()) {
+            return *this;
+        }
+        return f(_n, x._n);
+    }
+
+  public:
+    bound_t operator/(const bound_t& x) const {
+        return AbsDiv(x, [](number_t dividend, number_t divisor) { return bound_t{dividend / divisor}; });
+    }
+
+    bound_t operator%(const bound_t& x) const {
+        return AbsDiv(x, [](number_t dividend, number_t divisor) { return bound_t{dividend % divisor}; });
     }
 
     [[nodiscard]]
     bound_t UDiv(const bound_t& x) const {
-        if (x._n == 0) {
-            CRAB_ERROR("Bound: division by zero");
-        } else if (is_finite() && x.is_finite()) {
-            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to<uint64_t>()};
-            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to<uint64_t>()};
-            return bound_t(false, dividend / divisor);
-        } else if (is_finite() && x.is_infinite()) {
-            return number_t{0};
-        } else {
-            return plus_infinity();
-        }
+        using M = uint64_t;
+        return AbsDiv(x, [](number_t dividend, number_t divisor) {
+            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
+            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
+            return bound_t{dividend / divisor};
+        });
     }
 
     [[nodiscard]]
-    bound_t UMod(const bound_t& x) const {
-        if (x._n == 0) {
-            CRAB_ERROR("Bound: modulo zero");
-        } else if (is_finite() && x.is_finite()) {
-            number_t dividend = (_n >= 0) ? _n : number_t{_n.cast_to<uint64_t>()};
-            number_t divisor = (x._n >= 0) ? x._n : number_t{x._n.cast_to<uint64_t>()};
-            return bound_t(false, dividend % divisor);
-        } else if (is_finite() && x.is_infinite()) {
-            return *this;
-        } else {
-            return plus_infinity();
-        }
+    bound_t URem(const bound_t& x) const {
+        using M = uint64_t;
+        return AbsDiv(x, [](number_t dividend, number_t divisor) {
+            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
+            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
+            return bound_t{dividend % divisor};
+        });
     }
 
     bound_t& operator/=(const bound_t& x) { return operator=(operator/(x)); }
@@ -430,13 +427,12 @@ class interval_t final {
         }
     }
 
-    bool operator[](const number_t& n) const {
+    bool contains(const number_t& n) const {
         if (is_bottom()) {
             return false;
-        } else {
-            bound_t b(n);
-            return (_lb <= b) && (b <= _ub);
         }
+        bound_t b(n);
+        return (_lb <= b) && (b <= _ub);
     }
 
     friend std::ostream& operator<<(std::ostream& o, const interval_t& interval) {
@@ -600,7 +596,7 @@ class interval_t final {
     interval_t unsigned_high(bool is64) const = delete;
     // Return an interval in the range [INT_MAX+1, UINT_MAX], which can only
     // be represented as a uvalue.
-    // The svalue equivalent using the same width would be negative_int().
+    // The svalue equivalent using the same width would be negative().
     static interval_t unsigned_high(const int width) {
         switch (width) {
         case 8: return high<uint8_t>();
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index d527cec40..eddc23ebb 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -161,7 +161,7 @@ class z_number final {
     }
 
     [[nodiscard]]
-    uint64_t cast_to_uint32() const {
+    uint32_t cast_to_uint32() const {
         if (fits_uint32()) {
             return (uint32_t)_n;
         } else if (fits_sint32()) {

From 3d14be07d9687b55d02d6fbe754d28ba677e60d9 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 25 Sep 2024 17:47:01 +0300
Subject: [PATCH 241/373] use only generic conversion functions

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp      |   8 +--
 src/crab/ebpf_domain.cpp       |  68 ++++++++++----------
 src/crab/interval.cpp          |  14 ++--
 src/crab/split_dbm.cpp         |   4 +-
 src/crab/var_factory.cpp       |   2 +-
 src/crab_utils/bignums.hpp     | 113 +++++++++------------------------
 src/crab_verifier.cpp          |   4 +-
 src/test/conformance_check.cpp |   4 +-
 8 files changed, 83 insertions(+), 134 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index f8043880f..8fb85b064 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -583,7 +583,7 @@ static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDoma
 bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) {
     auto min_lb = inv.eval_interval(lb).lb().number();
     auto max_ub = inv.eval_interval(ub).ub().number();
-    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32()) {
+    if (!min_lb || !max_ub || !min_lb->fits<int32_t>() || !max_ub->fits<int32_t>()) {
         return false;
     }
 
@@ -601,7 +601,7 @@ bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, c
 int array_domain_t::min_all_num_size(const NumAbsDomain& inv, variable_t offset) const {
     auto min_lb = inv.eval_interval(offset).lb().number();
     auto max_ub = inv.eval_interval(offset).ub().number();
-    if (!min_lb || !max_ub || !min_lb->fits_sint32() || !max_ub->fits_sint32()) {
+    if (!min_lb || !max_ub || !min_lb->fits<int32_t>() || !max_ub->fits<int32_t>()) {
         return 0;
     }
     auto lb = (int)min_lb.value();
@@ -616,7 +616,7 @@ std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width)
     if (!t) {
         return {};
     }
-    uint64_t n = t->cast_to_uint64();
+    uint64_t n = t->cast_to<uint64_t>();
 
     // Convert value to bytes of the appropriate endian-ness.
     switch (width) {
@@ -751,7 +751,7 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
         auto ub = ii.ub().number();
         if (lb.has_value() && ub.has_value()) {
             z_number fullwidth = ub.value() - lb.value() + width;
-            if (lb.value().fits_uint32() && fullwidth.fits_uint32()) {
+            if (lb.value().fits<uint32_t>() && fullwidth.fits<uint32_t>()) {
                 auto [only_num, only_non_num] = num_bytes.uniformity((uint32_t)lb.value(), (uint32_t)fullwidth);
                 if (only_num) {
                     return number_t{T_NUM};
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 90949380c..51fe15308 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -103,23 +103,23 @@ static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDoma
 
     auto dst_interval = inv.eval_interval(dst_uvalue);
     std::optional<number_t> dst_n = dst_interval.singleton();
-    if (!dst_n || !dst_n.value().fits_cast_to_int64()) {
+    if (!dst_n || !dst_n.value().fits_cast_to<int64_t>()) {
         return {};
     }
 
     std::optional<number_t> src_n = src_interval.singleton();
-    if (!src_n || !src_n->fits_cast_to_int64()) {
+    if (!src_n || !src_n->fits_cast_to<int64_t>()) {
         return {};
     }
-    uint64_t src_int_value = src_n.value().cast_to_uint64();
+    uint64_t src_int_value = src_n.value().cast_to<uint64_t>();
     if (!is64) {
         src_int_value = (uint32_t)src_int_value;
     }
 
     bool result;
     switch (op) {
-    case Op::SET: result = ((dst_n.value().cast_to_uint64() & src_int_value) != 0); break;
-    case Op::NSET: result = ((dst_n.value().cast_to_uint64() & src_int_value) == 0); break;
+    case Op::SET: result = ((dst_n.value().cast_to<uint64_t>() & src_int_value) != 0); break;
+    case Op::NSET: result = ((dst_n.value().cast_to<uint64_t>() & src_int_value) == 0); break;
     default: throw std::exception();
     }
 
@@ -148,11 +148,11 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
             // Find the lowest 64-bit svalue whose low 32 bits match the singleton.
 
             // Get lower bound as a 64-bit value.
-            int64_t lb = inv.eval_interval(left_svalue).lb().number()->cast_to_sint64();
+            int64_t lb = inv.eval_interval(left_svalue).lb().number()->cast_to<int64_t>();
 
             // Use the high 32-bits from the left lower bound and the low 32-bits from the right singleton.
             // The result might be lower than the lower bound.
-            int64_t lb_match = ((lb & 0xFFFFFFFF00000000) | (rn->cast_to_sint64() & 0xFFFFFFFF));
+            int64_t lb_match = ((lb & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF));
             if (lb_match < lb) {
                 // The result is lower than the left interval, so try the next higher matching 64-bit value.
                 // It's ok if this goes higher than the left upper bound.
@@ -162,11 +162,11 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
             // Find the highest 64-bit svalue whose low 32 bits match the singleton.
 
             // Get upper bound as a 64-bit value.
-            int64_t ub = inv.eval_interval(left_svalue).ub().number()->cast_to_sint64();
+            int64_t ub = inv.eval_interval(left_svalue).ub().number()->cast_to<int64_t>();
 
             // Use the high 32-bits from the left upper bound and the low 32-bits from the right singleton.
             // The result might be higher than the upper bound.
-            int64_t ub_match = ((ub & 0xFFFFFFFF00000000) | (rn->cast_to_sint64() & 0xFFFFFFFF));
+            int64_t ub_match = ((ub & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF));
             if (ub_match > ub) {
                 // The result is higher than the left interval, so try the next lower matching 64-bit value.
                 // It's ok if this goes lower than the left lower bound.
@@ -1514,8 +1514,8 @@ void ebpf_domain_t::operator()(const Un& stmt) {
         if (m_inv.entail(type_is_number(stmt.dst))) {
             auto interval = m_inv.eval_interval(v);
             if (std::optional<number_t> n = interval.singleton()) {
-                if (n->fits_cast_to_int64()) {
-                    input = (decltype(input))n.value().cast_to_sint64();
+                if (n->fits_cast_to<int64_t>()) {
+                    input = (decltype(input))n.value().cast_to<int64_t>();
                     decltype(input) output = be_or_le(input);
                     m_inv.set(v, crab::interval_t(number_t(output), number_t(output)));
                     return;
@@ -1663,9 +1663,9 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
     const reg_pack_t& reg = reg_pack(s.reg);
     auto src_interval = m_inv.eval_interval(reg.svalue);
     if (auto sn = src_interval.singleton()) {
-        if (sn->fits_sint32()) {
+        if (sn->fits<int32_t>()) {
             // We can now process it as if the id was immediate.
-            int32_t imm = sn->cast_to_sint32();
+            int32_t imm = sn->cast_to<int32_t>();
             if (!global_program_info->platform->is_helper_usable(imm)) {
                 require(m_inv, linear_constraint_t::false_const(), "invalid helper function id " + std::to_string(imm));
                 return;
@@ -1693,7 +1693,7 @@ bool ebpf_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, i
     const crab::interval_t& map_fd_interval = m_inv[reg_pack(map_fd_reg).map_fd];
     auto lb = map_fd_interval.lb().number();
     auto ub = map_fd_interval.ub().number();
-    if (!lb || !lb->fits_sint32() || !ub || !ub->fits_sint32()) {
+    if (!lb || !lb->fits<int32_t>() || !ub || !ub->fits<int32_t>()) {
         return false;
     }
     *start_fd = (int32_t)lb.value();
@@ -1841,9 +1841,9 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             linear_expression_t ub = lb + width;
             if (!stack.all_num(inv, lb, ub)) {
                 auto lb_is = inv[lb].lb().number();
-                std::string lb_s = lb_is && lb_is->fits_sint32() ? std::to_string((int32_t)*lb_is) : "-oo";
+                std::string lb_s = lb_is && lb_is->fits<int32_t>() ? std::to_string((int32_t)*lb_is) : "-oo";
                 auto ub_is = inv.eval_interval(ub).ub().number();
-                std::string ub_s = ub_is && ub_is->fits_sint32() ? std::to_string((int32_t)*ub_is) : "oo";
+                std::string ub_s = ub_is && ub_is->fits<int32_t>() ? std::to_string((int32_t)*ub_is) : "oo";
                 require(inv, linear_constraint_t::false_const(),
                         "Illegal map update with a non-numerical value [" + lb_s + "-" + ub_s + ")");
             } else if (thread_local_options.strict && fd_type.has_value()) {
@@ -2478,9 +2478,9 @@ void ebpf_domain_t::operator()(const Callx& callx) {
     const reg_pack_t& reg = reg_pack(callx.func);
     auto src_interval = m_inv.eval_interval(reg.svalue);
     if (auto sn = src_interval.singleton()) {
-        if (sn->fits_sint32()) {
+        if (sn->fits<int32_t>()) {
             // We can now process it as if the id was immediate.
-            int32_t imm = sn->cast_to_sint32();
+            int32_t imm = sn->cast_to<int32_t>();
             if (!global_program_info->platform->is_helper_usable(imm)) {
                 return;
             }
@@ -2569,8 +2569,8 @@ void ebpf_domain_t::shl(const Reg& dst_reg, int imm, int finite_width) {
         if (interval.finite_size()) {
             number_t lb = interval.lb().number().value();
             number_t ub = interval.ub().number().value();
-            uint64_t lb_n = lb.cast_to_uint64();
-            uint64_t ub_n = ub.cast_to_uint64();
+            uint64_t lb_n = lb.cast_to<uint64_t>();
+            uint64_t ub_n = ub.cast_to<uint64_t>();
             uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
             if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
                 // The bits that will be shifted out to the left are different,
@@ -2611,13 +2611,13 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
             number_t lb = interval.lb().number().value();
             number_t ub = interval.ub().number().value();
             if (finite_width == 64) {
-                lb_n = lb.cast_to_uint64() >> imm;
-                ub_n = ub.cast_to_uint64() >> imm;
+                lb_n = lb.cast_to<uint64_t>() >> imm;
+                ub_n = ub.cast_to<uint64_t>() >> imm;
             } else {
                 number_t lb_w = lb.cast_to_signed_finite_width(finite_width);
                 number_t ub_w = ub.cast_to_signed_finite_width(finite_width);
-                lb_n = lb_w.cast_to_uint32() >> imm;
-                ub_n = ub_w.cast_to_uint32() >> imm;
+                lb_n = lb_w.cast_to<uint32_t>() >> imm;
+                ub_n = ub_w.cast_to<uint32_t>() >> imm;
 
                 // The interval must be valid since a signed range crossing 0
                 // was earlier converted to a full unsigned range.
@@ -2668,10 +2668,10 @@ void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& r
     int64_t mask = 1ULL << (bits - 1);
 
     // Sign extend each bound.
-    int64_t lb = right_interval.lb().number().value().cast_to_sint64();
+    int64_t lb = right_interval.lb().number().value().cast_to<int64_t>();
     lb &= (span - 1);
     lb = (lb ^ mask) - mask;
-    int64_t ub = right_interval.ub().number().value().cast_to_sint64();
+    int64_t ub = right_interval.ub().number().value().cast_to<int64_t>();
     ub &= (span - 1);
     ub = (ub ^ mask) - mask;
     m_inv.set(dst.svalue, crab::interval_t{number_t{lb}, number_t{ub}});
@@ -2696,7 +2696,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                              right_interval, left_interval_positive, left_interval_negative);
         if (auto sn = right_interval.singleton()) {
             // The BPF ISA requires masking the imm.
-            int64_t imm = sn->cast_to_sint64() & (finite_width - 1);
+            int64_t imm = sn->cast_to<int64_t>() & (finite_width - 1);
 
             int64_t lb_n = INT64_MIN >> imm;
             int64_t ub_n = INT64_MAX >> imm;
@@ -2704,14 +2704,14 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                 number_t lb = left_interval.lb().number().value();
                 number_t ub = left_interval.ub().number().value();
                 if (finite_width == 64) {
-                    lb_n = lb.cast_to_sint64() >> imm;
-                    ub_n = ub.cast_to_sint64() >> imm;
+                    lb_n = lb.cast_to<int64_t>() >> imm;
+                    ub_n = ub.cast_to<int64_t>() >> imm;
                 } else {
                     number_t lb_w = lb.cast_to_signed_finite_width(finite_width) >> (int)imm;
                     number_t ub_w = ub.cast_to_signed_finite_width(finite_width) >> (int)imm;
-                    if (lb_w.cast_to_uint32() <= ub_w.cast_to_uint32()) {
-                        lb_n = lb_w.cast_to_uint32();
-                        ub_n = ub_w.cast_to_uint32();
+                    if (lb_w.cast_to<uint32_t>() <= ub_w.cast_to<uint32_t>()) {
+                        lb_n = lb_w.cast_to<uint32_t>();
+                        ub_n = ub_w.cast_to<uint32_t>();
                     }
                 }
             }
@@ -2957,7 +2957,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
                     // truncate to uint64?
-                    uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
+                    uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
                     if (imm <= INT32_MAX) {
                         if (!bin.is64) {
                             // Use only the low 32 bits of the value.
@@ -2975,7 +2975,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             if (m_inv.entail(type_is_number(src_reg))) {
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
-                    uint64_t imm = sn->cast_to_uint64() & (bin.is64 ? 63 : 31);
+                    uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
                     if (imm <= INT32_MAX) {
                         if (!bin.is64) {
                             // Use only the low 32 bits of the value.
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index 42e760c53..c6313e8a4 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -55,11 +55,11 @@ interval_t interval_t::SDiv(const interval_t& x) const {
         return bottom();
     }
     if (const auto n = x.singleton()) {
-        if (n->fits_cast_to_int64()) {
+        if (n->fits_cast_to<int64_t>()) {
             // Divisor is a singleton:
             //   the linear interval solver can perform many divisions where
             //   the divisor is a singleton interval. We optimize for this case.
-            number_t c{n->cast_to_sint64()};
+            number_t c{n->cast_to<int64_t>()};
             if (c == 1) {
                 return *this;
             } else if (c != 0) {
@@ -100,11 +100,11 @@ interval_t interval_t::UDiv(const interval_t& x) const {
         return bottom();
     }
     if (const auto n = x.singleton()) {
-        if (n->fits_cast_to_int64()) {
+        if (n->fits_cast_to<int64_t>()) {
             // Divisor is a singleton:
             //   the linear interval solver can perform many divisions where
             //   the divisor is a singleton interval. We optimize for this case.
-            number_t c{n->cast_to_uint64()};
+            number_t c{n->cast_to<uint64_t>()};
             if (c == 1) {
                 return *this;
             } else if (c > number_t{0}) {
@@ -215,11 +215,11 @@ interval_t interval_t::URem(const interval_t& x) const {
             // a value between the upper bound and 0, so set to top.  A "positive" dividend
             // could result in anything between 0 and the dividend - 1.
             return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t{1})) | interval_t(number_t(0)));
-        } else if (_ub.is_finite() && (_ub.number()->cast_to_uint64() < x._lb.number()->cast_to_uint64())) {
+        } else if (_ub.is_finite() && (_ub.number()->cast_to<uint64_t>() < x._lb.number()->cast_to<uint64_t>())) {
             // Dividend lower than divisor, so the dividend is the remainder.
             return *this;
         } else {
-            number_t max_divisor{x._ub.number()->cast_to_uint64()};
+            number_t max_divisor{x._ub.number()->cast_to<uint64_t>()};
             return interval_t(number_t{0}, max_divisor - 1);
         }
     }
@@ -243,7 +243,7 @@ interval_t interval_t::And(const interval_t& x) const {
         if (const auto width = finite_size()) {
             const number_t lb32_n = lb().number()->truncate_to<uint32_t>();
             const number_t ub32_n = ub().number()->truncate_to<uint32_t>();
-            if (width->fits_uint32() && lb32_n < ub32_n && lb32_n + width->truncate_to<uint32_t>() == ub32_n) {
+            if (width->fits<uint32_t>() && lb32_n < ub32_n && lb32_n + width->truncate_to<uint32_t>() == ub32_n) {
                 return interval_t{lb32_n, ub32_n};
             }
         }
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 678aad92c..b704f0482 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -47,7 +47,7 @@ SplitDBM::vert_id SplitDBM::get_vert(variable_t v) {
  **/
 SafeInt64DefaultParams::Weight SafeInt64DefaultParams::convert_NtoW(const z_number& n, bool& overflow) {
     overflow = false;
-    if (!n.fits_sint64()) {
+    if (!n.fits<int64_t>()) {
         overflow = true;
         return 0;
     }
@@ -1031,7 +1031,7 @@ void SplitDBM::apply(bitwise_binop_t op, variable_t x, variable_t y, const numbe
     // Convert to intervals and perform the operation
     normalize();
     interval_t yi = this->operator[](y);
-    interval_t zi(number_t(k.cast_to_uint64()));
+    interval_t zi(number_t(k.cast_to<uint64_t>()));
     interval_t xi = interval_t::bottom();
 
     switch (op) {
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index d5fc17521..e09296f54 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -176,7 +176,7 @@ variable_t variable_t::stack_frame_var(data_kind_t kind, int i, std::string pref
 }
 
 variable_t variable_t::cell_var(data_kind_t array, const number_t& offset, const number_t& size) {
-    return make(mk_scalar_name(array, offset.cast_to_uint64(), size));
+    return make(mk_scalar_name(array, offset.cast_to<uint64_t>(), size));
 }
 
 // Given a type variable, get the associated variable of a given kind.
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index eddc23ebb..3631ef19a 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -64,7 +64,7 @@ class z_number final {
 
     // overloaded typecast operators
     explicit operator int64_t() const {
-        if (!fits_sint64()) {
+        if (!fits<int64_t>()) {
             CRAB_ERROR("z_number ", _n.str(), " does not fit into a signed 64-bit integer");
         } else {
             return (int64_t)_n;
@@ -72,7 +72,7 @@ class z_number final {
     }
 
     explicit operator uint64_t() const {
-        if (!fits_uint64()) {
+        if (!fits<uint64_t>()) {
             CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 64-bit integer");
         } else {
             return (uint64_t)_n;
@@ -80,7 +80,7 @@ class z_number final {
     }
 
     explicit operator int32_t() const {
-        if (!fits_sint32()) {
+        if (!fits<int32_t>()) {
             CRAB_ERROR("z_number ", _n.str(), " does not fit into a signed integer");
         } else {
             return (int)_n;
@@ -88,7 +88,7 @@ class z_number final {
     }
 
     explicit operator uint32_t() const {
-        if (!fits_uint32()) {
+        if (!fits<uint32_t>()) {
             CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned integer");
         } else {
             return (unsigned int)_n;
@@ -109,115 +109,64 @@ class z_number final {
         return crab::fits<T>(_n);
     }
 
+    template <std::integral T>
     [[nodiscard]]
-    bool fits_sint32() const {
-        return fits<int32_t>();
-    }
-
-    [[nodiscard]]
-    bool fits_uint32() const {
-        return fits<uint32_t>();
-    }
-
-    [[nodiscard]]
-    bool fits_sint64() const {
-        return fits<int64_t>();
-    }
-
-    [[nodiscard]]
-    bool fits_uint64() const {
-        return fits<uint64_t>();
-    }
-
-    [[nodiscard]]
-    bool fits_cast_to_int64() const {
-        return fits_uint64() || fits_sint64();
-    }
-
-    [[nodiscard]]
-    uint64_t cast_to_uint64() const {
-        if (fits_uint64()) {
-            return (uint64_t)_n;
-        } else if (fits_sint64()) {
-            // Convert 64 bits from int64_t to uint64_t.
-            return (uint64_t)(int64_t)_n;
-        } else {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 64-bit integer");
-        }
+    bool fits_cast_to() const {
+        return crab::fits<std::make_signed_t<T>>(_n) || crab::fits<std::make_unsigned_t<T>>(_n);
     }
 
     template <std::unsigned_integral U>
     [[nodiscard]]
     U cast_to() const {
-        using S = std::make_signed_t<U>;
         if (fits<U>()) {
             return (U)_n;
-        } else if (fits<S>()) {
-            // Convert 32 bits from int32_t to uint32_t.
-            return (U)(S)_n;
-        } else {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(U).name());
         }
-    }
-
-    [[nodiscard]]
-    uint32_t cast_to_uint32() const {
-        if (fits_uint32()) {
-            return (uint32_t)_n;
-        } else if (fits_sint32()) {
-            // Convert 32 bits from int32_t to uint32_t.
-            return (uint32_t)(int32_t)_n;
-        } else {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 32-bit integer");
+        using S = std::make_signed_t<U>;
+        if (fits<S>()) {
+            return (U)(S)_n;
         }
+        CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(U).name());
     }
 
     template <std::signed_integral S>
     [[nodiscard]]
     S cast_to() const {
-        return static_cast<S>(cast_to_sint64());
-    }
-
-    // For 64-bit operations, get the value as a signed 64-bit integer.
-    [[nodiscard]]
-    int64_t cast_to_sint64() const {
-        if (fits_sint64()) {
-            return (int64_t)_n;
-        } else if (fits_uint64()) {
-            // Convert 64 bits from uint64_t to int64_t.
-            return (int64_t)(uint64_t)_n;
-        } else {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into a signed 64-bit integer");
+        if (fits<S>()) {
+            return (S)_n;
         }
+        using U = std::make_unsigned_t<S>;
+        if (fits<U>()) {
+            return (S)(U)_n;
+        }
+        CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(S).name());
     }
 
-    // For 32-bit operations, get the low 32 bits as a signed integer.
-    [[nodiscard]]
-    int32_t cast_to_sint32() const {
-        return cast_to<int32_t>();
-    }
-
-    // Allow casting to int32_t or int64_t as needed for finite width operations.
+    // Allow casting to intX_t as needed for finite width operations.
     [[nodiscard]]
     z_number cast_to_signed_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 32: return cast_to_sint32();
-        case 64: return cast_to_sint64();
+        case 8: return cast_to<int8_t>();
+        case 16: return cast_to<int16_t>();
+        case 32: return cast_to<int32_t>();
+        case 64: return cast_to<int64_t>();
         default: CRAB_ERROR("invalid finite width");
         }
     }
 
-    // Allow casting to uint32_t or uint64_t as needed for finite width operations.
+    // Allow casting to uintX_t as needed for finite width operations.
     [[nodiscard]]
     z_number cast_to_unsigned_finite_width(int finite_width) const {
         switch (finite_width) {
         case 0: return *this; // No finite width.
-        case 32: return cast_to_uint32();
-        case 64: return cast_to_uint64();
+        case 8: return cast_to<uint8_t>();
+        case 16: return cast_to<uint16_t>();
+        case 32: return cast_to<uint32_t>();
+        case 64: return cast_to<uint64_t>();
         default: CRAB_ERROR("invalid finite width");
         }
     }
+
     template <std::integral T>
     T truncate_to() const {
         return crab::truncate_to<T>(_n);
@@ -349,14 +298,14 @@ class z_number final {
     z_number operator^(const z_number& x) const { return z_number(_n ^ x._n); }
 
     z_number operator<<(z_number x) const {
-        if (!x.fits_sint32()) {
+        if (!x.fits<int32_t>()) {
             CRAB_ERROR("z_number ", x._n.str(), " does not fit into an int32");
         }
         return z_number(_n << (int32_t)x);
     }
 
     z_number operator>>(z_number x) const {
-        if (!x.fits_sint32()) {
+        if (!x.fits<int32_t>()) {
             CRAB_ERROR("z_number ", x._n.str(), " does not fit into an int32");
         }
         return z_number(_n >> (int32_t)x);
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 7a8c776e5..a7f2c90d5 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -48,8 +48,8 @@ struct checks_db final {
     [[nodiscard]]
     int get_max_loop_count() const {
         auto m = this->max_loop_count.number();
-        if (m && m->fits_sint32()) {
-            return m->cast_to_sint32();
+        if (m && m->fits<int32_t>()) {
+            return m->cast_to<int32_t>();
         } else {
             return std::numeric_limits<int>::max();
         }
diff --git a/src/test/conformance_check.cpp b/src/test/conformance_check.cpp
index 068afbe9c..0abc7952a 100644
--- a/src/test/conformance_check.cpp
+++ b/src/test/conformance_check.cpp
@@ -81,8 +81,8 @@ int main(int argc, char** argv) {
     }
 
     // Print output so the conformance test suite can check it.
-    if (result.r0_value.singleton() && result.r0_value.singleton().value().fits_cast_to_int64()) {
-        std::cout << std::hex << result.r0_value.singleton().value().cast_to_uint64() << std::endl;
+    if (result.r0_value.singleton() && result.r0_value.singleton().value().fits_cast_to<int64_t>()) {
+        std::cout << std::hex << result.r0_value.singleton().value().cast_to<uint64_t>() << std::endl;
     } else {
         std::cout << result.r0_value << std::endl;
     }

From 47c68ba9670f812e6b7779b66cd4b61509a64331 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 01:45:16 +0300
Subject: [PATCH 242/373] cleanup number_t interface and implementation

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_ostream.cpp             |   2 +-
 src/crab/array_domain.cpp       |   2 +-
 src/crab/ebpf_domain.cpp        |  55 ++++---
 src/crab/split_dbm.cpp          |  14 +-
 src/crab/split_dbm.hpp          |   8 +-
 src/crab/variable.hpp           |   4 -
 src/crab_utils/adapt_sgraph.hpp |   2 +-
 src/crab_utils/bignums.hpp      | 251 +++++++++++---------------------
 src/crab_utils/safeint.hpp      |   2 +-
 9 files changed, 128 insertions(+), 212 deletions(-)

diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 9b7558149..db5d4e706 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -565,7 +565,7 @@ std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info) {
     return os;
 }
 
-std::string crab::z_number::to_string() const { return _n.str(); }
+std::string crab::number_t::to_string() const { return _n.str(); }
 
 std::string crab::interval_t::to_string() const {
     std::ostringstream s;
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 8fb85b064..d404223c5 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -750,7 +750,7 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
         auto lb = ii.lb().number();
         auto ub = ii.ub().number();
         if (lb.has_value() && ub.has_value()) {
-            z_number fullwidth = ub.value() - lb.value() + width;
+            number_t fullwidth = ub.value() - lb.value() + width;
             if (lb.value().fits<uint32_t>() && fullwidth.fits<uint32_t>()) {
                 auto [only_num, only_non_num] = num_bytes.uniformity((uint32_t)lb.value(), (uint32_t)fullwidth);
                 if (only_num) {
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 51fe15308..6904ce002 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -207,7 +207,7 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
         } else {
             for (interval_t* interval : {&left_interval, &right_interval}) {
                 if (!(*interval <= interval_t::signed_int(32))) {
-                    *interval = interval->truncate_to_sint(32);
+                    *interval = interval->truncate_to<int32_t>();
                 }
             }
             // continue as 32bit
@@ -223,8 +223,7 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
             // The interval is TOP as a signed interval but is represented precisely as an unsigned interval,
             // so split into two signed intervals that can be treated separately.
             left_interval_positive = left_interval & interval_t::nonnegative(64);
-            number_t lih_ub =
-                left_interval.ub().number() ? left_interval.ub().number()->truncate_to_signed_finite_width(64) : -1;
+            number_t lih_ub = left_interval.ub().number() ? left_interval.ub().number()->truncate_to<int64_t>() : -1;
             left_interval_negative = interval_t(number_t{std::numeric_limits<int64_t>::min()}, lih_ub);
         } else {
             left_interval_positive = interval_t::nonnegative(64);
@@ -234,7 +233,7 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
         if (!(*interval <= interval_t::signed_int(64))) {
-            *interval = interval->truncate_to_sint(64);
+            *interval = interval->truncate_to<int64_t>();
         }
     }
 }
@@ -259,7 +258,7 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
         } else {
             for (interval_t* interval : {&left_interval, &right_interval}) {
                 if (!(*interval <= interval_t::unsigned_int(32))) {
-                    *interval = interval->truncate_to_uint(32);
+                    *interval = interval->truncate_to<uint32_t>();
                 }
             }
             // continue as 32bit
@@ -274,8 +273,8 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
         if (!left_interval.is_top()) {
             // The interval is TOP as an unsigned interval but is represented precisely as a signed interval,
             // so split into two unsigned intervals that can be treated separately.
-            left_interval_low = interval_t(number_t{0}, left_interval.ub()).truncate_to_uint(64);
-            left_interval_high = interval_t(left_interval.lb(), number_t{-1}).truncate_to_uint(64);
+            left_interval_low = interval_t(number_t{0}, left_interval.ub()).truncate_to<uint64_t>();
+            left_interval_high = interval_t(left_interval.lb(), number_t{-1}).truncate_to<uint64_t>();
         } else {
             left_interval_low = interval_t::nonnegative(64);
             left_interval_high = interval_t::unsigned_high(64);
@@ -284,7 +283,7 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
 
     for (interval_t* interval : {&left_interval, &right_interval}) {
         if (!(*interval <= interval_t::unsigned_int(64))) {
-            *interval = interval->truncate_to_uint(64);
+            *interval = interval->truncate_to<uint64_t>();
         }
     }
 }
@@ -329,7 +328,7 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(32) &&
                right_interval <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX]
-        auto lpub = left_interval_positive.truncate_to_sint(32).ub();
+        auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue,
                 left_svalue <= left_uvalue,
@@ -357,7 +356,7 @@ assume_signed_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
 
     if (right_interval <= interval_t::nonnegative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to_sint(64).ub();
+        auto lpub = left_interval_positive.truncate_to<int64_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -388,7 +387,7 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
 
     if (right_interval <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to_sint(32).ub();
+        auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -488,7 +487,7 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using namespace crab::dsl_syntax;
 
     auto rub = right_interval.ub();
-    auto lllb = left_interval_low.truncate_to_uint(64).lb();
+    auto lllb = left_interval_low.truncate_to<uint64_t>().lb();
     if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (lllb >= rub) : (lllb > rub))) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
@@ -499,7 +498,7 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
                     left_svalue >= 0};
         }
     }
-    auto lhlb = left_interval_high.truncate_to_uint(64).lb();
+    auto lhlb = left_interval_high.truncate_to<uint64_t>().lb();
     if ((right_interval <= interval_t::unsigned_high(64)) && (strict ? (lhlb >= rub) : (lhlb > rub))) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
@@ -512,7 +511,7 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     }
     if (right_interval <= interval_t::signed_int(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto llub = left_interval_low.truncate_to_uint(64).ub();
+        auto llub = left_interval_low.truncate_to<uint64_t>().ub();
         return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
                 left_uvalue <= *llub.number(), number_t{0} <= left_svalue,
                 strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
@@ -566,8 +565,8 @@ assume_unsigned_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_s
     using namespace crab::dsl_syntax;
 
     auto rlb = right_interval.lb();
-    auto llub = left_interval_low.truncate_to_uint(64).ub();
-    auto lhlb = left_interval_high.truncate_to_uint(64).lb();
+    auto llub = left_interval_low.truncate_to<uint64_t>().ub();
+    auto lhlb = left_interval_high.truncate_to<uint64_t>().lb();
 
     if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (llub <= rlb) : (llub < rlb))) {
         // The low interval is out of range.
@@ -1390,11 +1389,11 @@ void ebpf_domain_t::overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t
     // For a signed result, we need to ensure the signed and unsigned results match
     // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
     // a sign extended negative one.
-    number_t lb = lb_value.truncate_to_unsigned_finite_width(finite_width);
-    number_t ub = ub_value.truncate_to_unsigned_finite_width(finite_width);
+    number_t lb = lb_value.truncate_to_uint(finite_width);
+    number_t ub = ub_value.truncate_to_uint(finite_width);
     if (issigned) {
-        lb = lb.truncate_to_signed_finite_width(64);
-        ub = ub.truncate_to_signed_finite_width(64);
+        lb = lb.truncate_to<int64_t>();
+        ub = ub.truncate_to<int64_t>();
     }
     if (lb > ub) {
         // Range wraps in the middle, so we cannot represent as an unsigned interval.
@@ -1409,15 +1408,15 @@ void ebpf_domain_t::overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t
 }
 
 void ebpf_domain_t::overflow_signed(NumAbsDomain& inv, variable_t lhs, int finite_width) {
-    auto span{finite_width == 64   ? crab::z_number{std::numeric_limits<uint64_t>::max()}
-              : finite_width == 32 ? crab::z_number{std::numeric_limits<uint32_t>::max()}
+    auto span{finite_width == 64   ? crab::number_t{std::numeric_limits<uint64_t>::max()}
+              : finite_width == 32 ? crab::number_t{std::numeric_limits<uint32_t>::max()}
                                    : throw std::exception()};
     overflow_bounds(inv, lhs, span, finite_width, true);
 }
 
 void ebpf_domain_t::overflow_unsigned(NumAbsDomain& inv, variable_t lhs, int finite_width) {
-    auto span{finite_width == 64   ? crab::z_number{std::numeric_limits<uint64_t>::max()}
-              : finite_width == 32 ? crab::z_number{std::numeric_limits<uint32_t>::max()}
+    auto span{finite_width == 64   ? crab::number_t{std::numeric_limits<uint64_t>::max()}
+              : finite_width == 32 ? crab::number_t{std::numeric_limits<uint32_t>::max()}
                                    : throw std::exception()};
     overflow_bounds(inv, lhs, span, finite_width, false);
 }
@@ -2614,8 +2613,8 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
                 lb_n = lb.cast_to<uint64_t>() >> imm;
                 ub_n = ub.cast_to<uint64_t>() >> imm;
             } else {
-                number_t lb_w = lb.cast_to_signed_finite_width(finite_width);
-                number_t ub_w = ub.cast_to_signed_finite_width(finite_width);
+                number_t lb_w = lb.cast_to_sint(finite_width);
+                number_t ub_w = ub.cast_to_sint(finite_width);
                 lb_n = lb_w.cast_to<uint32_t>() >> imm;
                 ub_n = ub_w.cast_to<uint32_t>() >> imm;
 
@@ -2707,8 +2706,8 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                     lb_n = lb.cast_to<int64_t>() >> imm;
                     ub_n = ub.cast_to<int64_t>() >> imm;
                 } else {
-                    number_t lb_w = lb.cast_to_signed_finite_width(finite_width) >> (int)imm;
-                    number_t ub_w = ub.cast_to_signed_finite_width(finite_width) >> (int)imm;
+                    number_t lb_w = lb.cast_to_sint(finite_width) >> (int)imm;
+                    number_t ub_w = ub.cast_to_sint(finite_width) >> (int)imm;
                     if (lb_w.cast_to<uint32_t>() <= ub_w.cast_to<uint32_t>()) {
                         lb_n = lb_w.cast_to<uint32_t>();
                         ub_n = ub_w.cast_to<uint32_t>();
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index b704f0482..b624c99d7 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -45,7 +45,7 @@ SplitDBM::vert_id SplitDBM::get_vert(variable_t v) {
  * used to be the template parameter of the DBM-based abstract domain to
  * represent a number. Number might not fit into Weight type.
  **/
-SafeInt64DefaultParams::Weight SafeInt64DefaultParams::convert_NtoW(const z_number& n, bool& overflow) {
+SafeInt64DefaultParams::Weight SafeInt64DefaultParams::convert_NtoW(const number_t& n, bool& overflow) {
     overflow = false;
     if (!n.fits<int64_t>()) {
         overflow = true;
@@ -54,7 +54,7 @@ SafeInt64DefaultParams::Weight SafeInt64DefaultParams::convert_NtoW(const z_numb
     return {n};
 }
 
-Z_NumberDefaultParams::Weight Z_NumberDefaultParams::convert_NtoW(const z_number& n, bool& overflow) {
+Z_NumberDefaultParams::Weight Z_NumberDefaultParams::convert_NtoW(const number_t& n, bool& overflow) {
     overflow = false;
     return {n};
 }
@@ -908,7 +908,7 @@ class vert_set_wrap_t {
   public:
     explicit vert_set_wrap_t(const SplitDBM::vert_set_t& _vs) : vs(_vs) {}
 
-    bool operator[](SplitDBM::vert_id v) const { return vs.find(v) != vs.end(); }
+    bool operator[](SplitDBM::vert_id v) const { return vs.contains(v); }
     const SplitDBM::vert_set_t& vs;
 };
 
@@ -1286,12 +1286,12 @@ static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::gr
     bound_t lb = bound_t::minus_infinity();
     bound_t ub = bound_t::plus_infinity();
     if (r.elem(v, 0)) {
-        lb = x.is_unsigned() ? (-number_t(r.edge_val(v, 0))).truncate_to_unsigned_finite_width(finite_width)
-                             : (-number_t(r.edge_val(v, 0))).truncate_to_signed_finite_width(finite_width);
+        lb = x.is_unsigned() ? (-number_t(r.edge_val(v, 0))).truncate_to_uint(finite_width)
+                             : (-number_t(r.edge_val(v, 0))).truncate_to_sint(finite_width);
     }
     if (r.elem(0, v)) {
-        ub = x.is_unsigned() ? number_t(r.edge_val(0, v)).truncate_to_unsigned_finite_width(finite_width)
-                             : number_t(r.edge_val(0, v)).truncate_to_signed_finite_width(finite_width);
+        ub = x.is_unsigned() ? number_t(r.edge_val(0, v)).truncate_to_uint(finite_width)
+                             : number_t(r.edge_val(0, v)).truncate_to_sint(finite_width);
     }
     return {lb, ub};
 }
diff --git a/src/crab/split_dbm.hpp b/src/crab/split_dbm.hpp
index a1b3be007..10f2122b9 100644
--- a/src/crab/split_dbm.hpp
+++ b/src/crab/split_dbm.hpp
@@ -51,7 +51,7 @@ namespace domains {
  *
  * 1) basic integer type: e.g., long
  * 2) safei64
- * 3) z_number
+ * 3) number_t
  *
  * 1) is the fastest but things can go wrong if some DBM
  * operation overflows. 2) is slower than 1) but it checks for
@@ -62,15 +62,15 @@ namespace domains {
  **/
 
 struct Z_NumberDefaultParams {
-    using Weight = z_number;
+    using Weight = number_t;
     using graph_t = AdaptGraph;
-    static Weight convert_NtoW(const z_number& n, bool& overflow);
+    static Weight convert_NtoW(const number_t& n, bool& overflow);
 };
 
 struct SafeInt64DefaultParams {
     using Weight = safe_i64;
     using graph_t = AdaptGraph;
-    static Weight convert_NtoW(const z_number& n, bool& overflow);
+    static Weight convert_NtoW(const number_t& n, bool& overflow);
 };
 
 class SplitDBM final {
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 66ee9c5b5..071c63070 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -98,10 +98,6 @@ class variable_t final {
     static variable_t loop_counter(const std::string& label);
     [[nodiscard]]
     bool is_in_stack() const;
-
-    struct Hasher {
-        std::size_t operator()(const variable_t& v) const { return v.hash(); }
-    };
 }; // class variable_t
 
 } // namespace crab
diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index a7f2cfe16..d14f2af4d 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -145,7 +145,7 @@ class AdaptGraph final {
     using smap_t = TreeSMap;
 
   public:
-    using Weight = z_number; // same as SafeInt64DefaultParams::Weight; previously template
+    using Weight = number_t; // same as SafeInt64DefaultParams::Weight; previously template
     using vert_id = unsigned int;
 
     AdaptGraph() : edge_count(0) {}
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/bignums.hpp
index 3631ef19a..de3551848 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/bignums.hpp
@@ -3,7 +3,6 @@
 #pragma once
 
 #include <climits>
-#include <iostream>
 #include <sstream>
 #include <string>
 #include <utility>
@@ -20,131 +19,62 @@ template <typename T>
 concept is_enum = std::is_enum_v<T>;
 
 template <std::integral T>
-T truncate_to(const cpp_int& n) {
-    using U = std::make_unsigned_t<T>;
-    constexpr U mask = std::numeric_limits<U>::max();
-    return static_cast<T>(static_cast<U>(n & mask));
-}
-
-// coderabbit implementation - TODO try in the future
-template <std::unsigned_integral U>
-U truncate_to_coderabbit(const cpp_int& n) {
-    constexpr U mask = std::numeric_limits<U>::max();
-    return static_cast<U>(n & mask);
-}
-
-// coderabbit implementation - TODO try in the future
-template <std::signed_integral S>
-S truncate_to_coderabbit(const cpp_int& n) {
-    using U = std::make_unsigned_t<S>;
-    constexpr uint32_t size = sizeof(S) * CHAR_BIT;
-    constexpr U mask = (U{1} << size) - 1;
-    const auto truncated = n & mask;
-    if (truncated >= cpp_int{1} << (size - 1)) {
-        truncated -= cpp_int{1} << size;
-    }
-    return static_cast<S>(truncated);
-}
-
-template <std::integral T>
-bool fits(const cpp_int& n) {
-    return std::numeric_limits<T>::min() <= n && n <= std::numeric_limits<T>::max();
-}
+using swap_signedness = std::conditional_t<std::is_signed_v<T>, std::make_unsigned_t<T>, std::make_signed_t<T>>;
 
-class z_number final {
-  private:
+class number_t final {
     cpp_int _n{nullptr};
 
   public:
-    z_number() = default;
-    z_number(cpp_int n) : _n(std::move(n)) {}
-    z_number(std::integral auto n) : _n{n} {}
-    z_number(is_enum auto n) : _n{static_cast<int64_t>(n)} {}
-    explicit z_number(const std::string& s) { _n = cpp_int(s); }
-
-    // overloaded typecast operators
-    explicit operator int64_t() const {
-        if (!fits<int64_t>()) {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into a signed 64-bit integer");
-        } else {
-            return (int64_t)_n;
-        }
-    }
-
-    explicit operator uint64_t() const {
-        if (!fits<uint64_t>()) {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned 64-bit integer");
-        } else {
-            return (uint64_t)_n;
-        }
-    }
-
-    explicit operator int32_t() const {
-        if (!fits<int32_t>()) {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into a signed integer");
-        } else {
-            return (int)_n;
-        }
-    }
+    number_t() = default;
+    number_t(cpp_int n) : _n(std::move(n)) {}
+    number_t(std::integral auto n) : _n{n} {}
+    number_t(is_enum auto n) : _n{static_cast<int64_t>(n)} {}
+    explicit number_t(const std::string& s) { _n = cpp_int(s); }
 
-    explicit operator uint32_t() const {
-        if (!fits<uint32_t>()) {
-            CRAB_ERROR("z_number ", _n.str(), " does not fit into an unsigned integer");
-        } else {
-            return (unsigned int)_n;
+    template <std::integral T>
+    explicit operator T() const {
+        if (!fits<T>()) {
+            CRAB_ERROR("number_t ", _n, " does not fit into ", typeid(T).name());
         }
+        return static_cast<T>(_n);
     }
 
     explicit operator cpp_int() const { return _n; }
 
     [[nodiscard]]
-    std::size_t hash() const {
-        boost::hash<std::string> hasher;
-        return hasher(_n.str());
+    friend std::size_t hash_value(const number_t& z) {
+        return boost::hash_value(z._n.str());
     }
 
     template <std::integral T>
     [[nodiscard]]
     bool fits() const {
-        return crab::fits<T>(_n);
+        return std::numeric_limits<T>::min() <= _n && _n <= std::numeric_limits<T>::max();
     }
 
     template <std::integral T>
     [[nodiscard]]
     bool fits_cast_to() const {
-        return crab::fits<std::make_signed_t<T>>(_n) || crab::fits<std::make_unsigned_t<T>>(_n);
-    }
-
-    template <std::unsigned_integral U>
-    [[nodiscard]]
-    U cast_to() const {
-        if (fits<U>()) {
-            return (U)_n;
-        }
-        using S = std::make_signed_t<U>;
-        if (fits<S>()) {
-            return (U)(S)_n;
-        }
-        CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(U).name());
+        return fits<T>() || fits<swap_signedness<T>>();
     }
 
-    template <std::signed_integral S>
+    template <std::integral T>
     [[nodiscard]]
-    S cast_to() const {
-        if (fits<S>()) {
-            return (S)_n;
+    T cast_to() const {
+        if (fits<T>()) {
+            return static_cast<T>(_n);
         }
-        using U = std::make_unsigned_t<S>;
-        if (fits<U>()) {
-            return (S)(U)_n;
+        using Q = swap_signedness<T>;
+        if (fits<Q>()) {
+            return static_cast<T>(static_cast<Q>(_n));
         }
-        CRAB_ERROR("z_number ", _n.str(), " does not fit into ", typeid(S).name());
+        CRAB_ERROR("number_t ", _n, " does not fit into ", typeid(T).name());
     }
 
     // Allow casting to intX_t as needed for finite width operations.
     [[nodiscard]]
-    z_number cast_to_signed_finite_width(int finite_width) const {
-        switch (finite_width) {
+    number_t cast_to_sint(const int width) const {
+        switch (width) {
         case 0: return *this; // No finite width.
         case 8: return cast_to<int8_t>();
         case 16: return cast_to<int16_t>();
@@ -156,8 +86,8 @@ class z_number final {
 
     // Allow casting to uintX_t as needed for finite width operations.
     [[nodiscard]]
-    z_number cast_to_unsigned_finite_width(int finite_width) const {
-        switch (finite_width) {
+    number_t cast_to_uint(const int width) const {
+        switch (width) {
         case 0: return *this; // No finite width.
         case 8: return cast_to<uint8_t>();
         case 16: return cast_to<uint16_t>();
@@ -169,14 +99,16 @@ class z_number final {
 
     template <std::integral T>
     T truncate_to() const {
-        return crab::truncate_to<T>(_n);
+        using U = std::make_unsigned_t<T>;
+        constexpr U mask = std::numeric_limits<U>::max();
+        return static_cast<T>(static_cast<U>(_n & mask));
     }
 
     // Allow truncating to int32_t or int64_t as needed for finite width operations.
     // Unlike casting, truncating will not throw a crab error if the number doesn't fit.
     [[nodiscard]]
-    z_number truncate_to_signed_finite_width(int finite_width) const {
-        switch (finite_width) {
+    number_t truncate_to_sint(const int width) const {
+        switch (width) {
         case 0: return *this; // No finite width.
         case 8: return truncate_to<int8_t>();
         case 16: return truncate_to<int16_t>();
@@ -189,8 +121,8 @@ class z_number final {
     // Allow truncating to uint32_t or uint64_t as needed for finite width operations.
     // Unlike casting, truncating will not throw a crab error if the number doesn't fit.
     [[nodiscard]]
-    z_number truncate_to_unsigned_finite_width(int finite_width) const {
-        switch (finite_width) {
+    number_t truncate_to_uint(const int width) const {
+        switch (width) {
         case 0: return *this; // No finite width.
         case 8: return truncate_to<uint8_t>();
         case 16: return truncate_to<uint16_t>();
@@ -200,137 +132,126 @@ class z_number final {
         }
     }
 
-    z_number operator+(const z_number& x) const { return z_number(_n + x._n); }
+    number_t operator+(const number_t& x) const { return number_t(_n + x._n); }
 
-    z_number operator*(const z_number& x) const { return z_number(_n * x._n); }
+    number_t operator*(const number_t& x) const { return number_t(_n * x._n); }
 
-    z_number operator-(const z_number& x) const { return z_number(_n - x._n); }
+    number_t operator-(const number_t& x) const { return number_t(_n - x._n); }
 
-    z_number operator-() const { return z_number(-_n); }
+    number_t operator-() const { return number_t(-_n); }
 
-    z_number operator/(const z_number& x) const {
+    number_t operator/(const number_t& x) const {
         if (x._n.is_zero()) {
-            CRAB_ERROR("z_number: division by zero [1]");
-        } else {
-            return z_number(_n / x._n);
+            CRAB_ERROR("number_t: division by zero [1]");
         }
+        return number_t(_n / x._n);
     }
 
-    z_number operator%(const z_number& x) const {
+    number_t operator%(const number_t& x) const {
         if (x._n.is_zero()) {
-            CRAB_ERROR("z_number: division by zero [2]");
-        } else {
-            return z_number(_n % x._n);
+            CRAB_ERROR("number_t: division by zero [2]");
         }
+        return number_t(_n % x._n);
     }
 
-    z_number& operator+=(const z_number& x) {
+    number_t& operator+=(const number_t& x) {
         _n += x._n;
         return *this;
     }
 
-    z_number& operator*=(const z_number& x) {
+    number_t& operator*=(const number_t& x) {
         _n *= x._n;
         return *this;
     }
 
-    z_number& operator-=(const z_number& x) {
+    number_t& operator-=(const number_t& x) {
         _n -= x._n;
         return *this;
     }
 
-    z_number& operator/=(const z_number& x) {
+    number_t& operator/=(const number_t& x) {
         if (x._n.is_zero()) {
-            CRAB_ERROR("z_number: division by zero [3]");
-        } else {
-            _n /= x._n;
-            return *this;
+            CRAB_ERROR("number_t: division by zero [3]");
         }
+        _n /= x._n;
+        return *this;
     }
 
-    z_number& operator%=(const z_number& x) {
+    number_t& operator%=(const number_t& x) {
         if (x._n.is_zero()) {
-            CRAB_ERROR("z_number: division by zero [4]");
-        } else {
-            _n %= x._n;
-            return *this;
+            CRAB_ERROR("number_t: division by zero [4]");
         }
+        _n %= x._n;
+        return *this;
     }
 
-    z_number& operator--() & {
-        _n--;
+    number_t& operator--() & {
+        --_n;
         return *this;
     }
 
-    z_number& operator++() & {
-        _n++;
+    number_t& operator++() & {
+        ++_n;
         return *this;
     }
 
-    z_number operator++(int) & {
-        z_number r(*this);
-        ++(*this);
+    number_t operator++(int) & {
+        number_t r(*this);
+        ++*this;
         return r;
     }
 
-    z_number operator--(int) & {
-        z_number r(*this);
-        --(*this);
+    number_t operator--(int) & {
+        number_t r(*this);
+        --*this;
         return r;
     }
 
-    bool operator==(const z_number& x) const { return (_n == x._n); }
+    bool operator==(const number_t& x) const { return _n == x._n; }
 
-    bool operator!=(const z_number& x) const { return (_n != x._n); }
+    bool operator!=(const number_t& x) const { return _n != x._n; }
 
-    bool operator<(const z_number& x) const { return (_n < x._n); }
+    bool operator<(const number_t& x) const { return _n < x._n; }
 
-    bool operator<=(const z_number& x) const { return (_n <= x._n); }
+    bool operator<=(const number_t& x) const { return _n <= x._n; }
 
-    bool operator>(const z_number& x) const { return (_n > x._n); }
+    bool operator>(const number_t& x) const { return _n > x._n; }
 
-    bool operator>=(const z_number& x) const { return (_n >= x._n); }
+    bool operator>=(const number_t& x) const { return _n >= x._n; }
 
-    z_number operator&(const z_number& x) const { return z_number(_n & x._n); }
+    number_t operator&(const number_t& x) const { return number_t(_n & x._n); }
 
-    z_number operator|(const z_number& x) const { return z_number(_n | x._n); }
+    number_t operator|(const number_t& x) const { return number_t(_n | x._n); }
 
-    z_number operator^(const z_number& x) const { return z_number(_n ^ x._n); }
+    number_t operator^(const number_t& x) const { return number_t(_n ^ x._n); }
 
-    z_number operator<<(z_number x) const {
+    number_t operator<<(const number_t x) const {
         if (!x.fits<int32_t>()) {
-            CRAB_ERROR("z_number ", x._n.str(), " does not fit into an int32");
+            CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }
-        return z_number(_n << (int32_t)x);
+        return number_t(_n << static_cast<int32_t>(x));
     }
 
-    z_number operator>>(z_number x) const {
+    number_t operator>>(const number_t x) const {
         if (!x.fits<int32_t>()) {
-            CRAB_ERROR("z_number ", x._n.str(), " does not fit into an int32");
+            CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }
-        return z_number(_n >> (int32_t)x);
+        return number_t(_n >> static_cast<int32_t>(x));
     }
 
     [[nodiscard]]
-    z_number fill_ones() const {
+    number_t fill_ones() const {
         if (_n.is_zero()) {
-            return z_number((signed long long)0);
+            return number_t(static_cast<signed long long>(0));
         }
-
-        z_number result;
-        for (result = 1; result < *this; result = result * 2 + 1)
-            ;
-        return result;
+        return number_t{(cpp_int(1) << msb(_n) + 1) - 1};
     }
 
-    friend std::ostream& operator<<(std::ostream& o, const z_number& z) { return o << z._n.str(); }
+    friend std::ostream& operator<<(std::ostream& o, const number_t& z) { return o << z._n.str(); }
 
     [[nodiscard]]
     std::string to_string() const;
 };
-// class z_number
-
-using number_t = z_number;
+// class number_t
 
-inline std::size_t hash_value(const z_number& z) { return z.hash(); }
 } // namespace crab
diff --git a/src/crab_utils/safeint.hpp b/src/crab_utils/safeint.hpp
index f2498f109..740a8f5d6 100644
--- a/src/crab_utils/safeint.hpp
+++ b/src/crab_utils/safeint.hpp
@@ -74,7 +74,7 @@ class safe_i64 {
 
     safe_i64(int64_t num) : m_num(num) {}
 
-    safe_i64(const z_number& n) : m_num((int64_t)n) {}
+    safe_i64(const number_t& n) : m_num((int64_t)n) {}
 
     operator int64_t() const { return (int64_t)m_num; }
 

From 696ee743d26fab263b0371a9570a38a8ae8f3d20 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 03:23:49 +0300
Subject: [PATCH 243/373] consistent weight handling

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 scripts/.check-license.ignore                 |   3 +-
 src/crab/cfg.hpp                              |   2 +-
 src/crab/interval.hpp                         | 210 +----------------
 src/crab/split_dbm.cpp                        | 116 +++++----
 src/crab/split_dbm.hpp                        |  38 +--
 src/crab/variable.hpp                         |   2 +-
 src/crab_utils/adapt_sgraph.hpp               |  18 +-
 src/crab_utils/{bignums.hpp => num_big.hpp}   |   2 +-
 src/crab_utils/num_extended.hpp               | 223 ++++++++++++++++++
 .../{safeint.hpp => num_safeint.hpp}          |   2 +-
 10 files changed, 308 insertions(+), 308 deletions(-)
 rename src/crab_utils/{bignums.hpp => num_big.hpp} (99%)
 create mode 100644 src/crab_utils/num_extended.hpp
 rename src/crab_utils/{safeint.hpp => num_safeint.hpp} (99%)

diff --git a/scripts/.check-license.ignore b/scripts/.check-license.ignore
index 654539be7..90c3875be 100644
--- a/scripts/.check-license.ignore
+++ b/scripts/.check-license.ignore
@@ -34,7 +34,8 @@ src/crab_utils/debug.cpp
 src/crab_utils/debug.hpp
 src/crab_utils/graph_ops.cpp
 src/crab_utils/graph_ops.hpp
-src/crab_utils/safeint.hpp
+src/crab_utils/num_safeint.hpp
+src/crab_utils/num_extended.hpp
 src/crab_utils/stats.cpp
 src/crab_utils/stats.hpp
 
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index 64918348b..d93130855 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -23,8 +23,8 @@
 #include <boost/range/iterator_range.hpp>
 
 #include "crab/variable.hpp"
-#include "crab_utils/bignums.hpp"
 #include "crab_utils/debug.hpp"
+#include "crab_utils/num_big.hpp"
 
 #include "asm_ostream.hpp"
 #include "asm_syntax.hpp"
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 25fadc980..7c0629b6e 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -11,218 +11,12 @@
 #include <optional>
 #include <utility>
 
-#include "crab_utils/bignums.hpp"
+#include "crab_utils/num_big.hpp"
+#include "crab_utils/num_extended.hpp"
 #include "crab_utils/stats.hpp"
 
 namespace crab {
 
-class bound_t final {
-    bool _is_infinite;
-    number_t _n;
-
-    bound_t(const bool is_infinite, const number_t& n) : _is_infinite(is_infinite), _n(n) {
-        if (is_infinite) {
-            if (n > 0) {
-                _n = 1;
-            } else {
-                _n = -1;
-            }
-        }
-    }
-
-  public:
-    static bound_t plus_infinity() { return bound_t(true, 1); }
-
-    static bound_t minus_infinity() { return bound_t(true, -1); }
-
-    explicit bound_t(const std::string& s) : _n(1) {
-        if (s == "+oo") {
-            _is_infinite = true;
-        } else if (s == "-oo") {
-            _is_infinite = true;
-            _n = -1;
-        } else {
-            _is_infinite = false;
-            _n = number_t(s);
-        }
-    }
-
-    bound_t(number_t n) : _is_infinite(false), _n(std::move(n)) {}
-
-    bound_t(const bound_t& o) = default;
-
-    bound_t& operator=(const bound_t& o) {
-        if (this != &o) {
-            _is_infinite = o._is_infinite;
-            _n = o._n;
-        }
-        return *this;
-    }
-
-    [[nodiscard]]
-    bool is_infinite() const {
-        return _is_infinite;
-    }
-
-    [[nodiscard]]
-    bool is_finite() const {
-        return !_is_infinite;
-    }
-
-    [[nodiscard]]
-    bool is_plus_infinity() const {
-        return (is_infinite() && _n > 0);
-    }
-
-    [[nodiscard]]
-    bool is_minus_infinity() const {
-        return (is_infinite() && _n < 0);
-    }
-
-    bound_t operator-() const { return bound_t(_is_infinite, -_n); }
-
-    bound_t operator+(const bound_t& x) const {
-        if (is_finite()) {
-            if (x.is_finite()) {
-                return bound_t(_n + x._n);
-            }
-            return x;
-        }
-        if (x.is_finite() || x._n == _n) {
-            return *this;
-        }
-        CRAB_ERROR("Bound: undefined operation -oo + +oo");
-    }
-
-    bound_t& operator+=(const bound_t& x) { return operator=(operator+(x)); }
-
-    bound_t operator-(const bound_t& x) const { return operator+(x.operator-()); }
-
-    bound_t& operator-=(const bound_t& x) { return operator=(operator-(x)); }
-
-    bound_t operator*(const bound_t& x) const {
-        if (x._n == 0) {
-            return x;
-        } else if (_n == 0) {
-            return *this;
-        } else {
-            return bound_t(_is_infinite || x._is_infinite, _n * x._n);
-        }
-    }
-
-    bound_t& operator*=(const bound_t& x) { return operator=(operator*(x)); }
-
-  private:
-    bound_t AbsDiv(const bound_t& x, bound_t (*f)(number_t, number_t)) const {
-        if (x._n == 0) {
-            CRAB_ERROR("Bound: division by zero");
-        }
-        if (x.is_infinite()) {
-            if (is_infinite()) {
-                CRAB_ERROR("Bound: inf / inf");
-            }
-            return number_t{0};
-        }
-        if (is_infinite()) {
-            return *this;
-        }
-        return f(_n, x._n);
-    }
-
-  public:
-    bound_t operator/(const bound_t& x) const {
-        return AbsDiv(x, [](number_t dividend, number_t divisor) { return bound_t{dividend / divisor}; });
-    }
-
-    bound_t operator%(const bound_t& x) const {
-        return AbsDiv(x, [](number_t dividend, number_t divisor) { return bound_t{dividend % divisor}; });
-    }
-
-    [[nodiscard]]
-    bound_t UDiv(const bound_t& x) const {
-        using M = uint64_t;
-        return AbsDiv(x, [](number_t dividend, number_t divisor) {
-            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
-            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
-            return bound_t{dividend / divisor};
-        });
-    }
-
-    [[nodiscard]]
-    bound_t URem(const bound_t& x) const {
-        using M = uint64_t;
-        return AbsDiv(x, [](number_t dividend, number_t divisor) {
-            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
-            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
-            return bound_t{dividend % divisor};
-        });
-    }
-
-    bound_t& operator/=(const bound_t& x) { return operator=(operator/(x)); }
-
-    bool operator<(const bound_t& x) const { return !operator>=(x); }
-
-    bool operator>(const bound_t& x) const { return !operator<=(x); }
-
-    bool operator==(const bound_t& x) const { return (_is_infinite == x._is_infinite && _n == x._n); }
-
-    bool operator!=(const bound_t& x) const { return !operator==(x); }
-
-    /*	operator<= and operator>= use a somewhat optimized implementation.
-     *	results include up to 20% improvements in performance in the octagon domain
-     *	over a more naive implementation.
-     */
-    bool operator<=(const bound_t& x) const {
-        if (_is_infinite xor x._is_infinite) {
-            if (_is_infinite) {
-                return _n < 0;
-            }
-            return x._n > 0;
-        }
-        return _n <= x._n;
-    }
-
-    bool operator>=(const bound_t& x) const {
-        if (_is_infinite xor x._is_infinite) {
-            if (_is_infinite) {
-                return _n > 0;
-            }
-            return x._n < 0;
-        }
-        return _n >= x._n;
-    }
-
-    [[nodiscard]]
-    bound_t abs() const {
-        if (operator>=(number_t{0})) {
-            return *this;
-        } else {
-            return operator-();
-        }
-    }
-
-    [[nodiscard]]
-    std::optional<number_t> number() const {
-        if (is_infinite()) {
-            return {};
-        } else {
-            return {_n};
-        }
-    }
-
-    friend std::ostream& operator<<(std::ostream& o, const bound_t& b) {
-        if (b.is_plus_infinity()) {
-            o << "+oo";
-        } else if (b.is_minus_infinity()) {
-            o << "-oo";
-        } else {
-            o << b._n;
-        }
-        return o;
-    }
-
-}; // class bound
-
 class interval_t final {
     bound_t _lb;
     bound_t _ub;
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index b624c99d7..ca9648872 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -45,18 +45,19 @@ SplitDBM::vert_id SplitDBM::get_vert(variable_t v) {
  * used to be the template parameter of the DBM-based abstract domain to
  * represent a number. Number might not fit into Weight type.
  **/
-SafeInt64DefaultParams::Weight SafeInt64DefaultParams::convert_NtoW(const number_t& n, bool& overflow) {
-    overflow = false;
-    if (!n.fits<int64_t>()) {
-        overflow = true;
-        return 0;
+[[maybe_unused]]
+static bool convert_NtoW_overflow(const number_t& n, safe_i64& out) {
+    if (n.fits<int64_t>()) {
+        out = n;
+        return false;
     }
-    return {n};
+    return true;
 }
 
-Z_NumberDefaultParams::Weight Z_NumberDefaultParams::convert_NtoW(const number_t& n, bool& overflow) {
-    overflow = false;
-    return {n};
+[[maybe_unused]]
+static bool convert_NtoW_overflow(const number_t& n, number_t& out) {
+    out = n;
+    return false;
 }
 
 void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
@@ -69,16 +70,15 @@ void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
 
     std::optional<variable_t> unbounded_var;
     std::vector<std::pair<variable_t, Weight>> terms;
-    bool overflow;
 
-    Weight residual(Params::convert_NtoW(exp.constant_term(), overflow));
-    if (overflow) {
+    Weight residual;
+    if (convert_NtoW_overflow(exp.constant_term(), residual)) {
         return;
     }
 
     for (auto [y, n] : exp.variable_terms()) {
-        Weight coeff(Params::convert_NtoW(n, overflow));
-        if (overflow) {
+        Weight coeff;
+        if (convert_NtoW_overflow(n, coeff)) {
             continue;
         }
 
@@ -89,11 +89,12 @@ void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
             if (y_val.is_infinite()) {
                 return;
             }
-            residual += Params::convert_NtoW(*(y_val.number()), overflow) * coeff;
-            if (overflow) {
+            Weight ymax;
+            if (convert_NtoW_overflow(*y_val.number(), ymax)) {
                 continue;
             }
-
+            // was before the condition
+            residual += ymax * coeff;
         } else {
             auto y_val = (extract_upper_bounds ? this->operator[](y).ub() : this->operator[](y).lb());
 
@@ -103,8 +104,8 @@ void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
                 }
                 unbounded_var = y;
             } else {
-                Weight ymax(Params::convert_NtoW(*(y_val.number()), overflow));
-                if (overflow) {
+                Weight ymax;
+                if (convert_NtoW_overflow(*y_val.number(), ymax)) {
                     continue;
                 }
                 residual += ymax * coeff;
@@ -131,16 +132,15 @@ void SplitDBM::diffcsts_of_lin_leq(const linear_expression_t& exp,
                                    std::vector<std::pair<variable_t, Weight>>& lbs,
                                    /* x <= ub for each {x,ub} in ubs */
                                    std::vector<std::pair<variable_t, Weight>>& ubs) const {
-    bool underflow, overflow;
-
-    Weight exp_ub = -Params::convert_NtoW(exp.constant_term(), overflow);
-    if (overflow) {
+    Weight exp_ub;
+    if (convert_NtoW_overflow(exp.constant_term(), exp_ub)) {
         return;
     }
+    exp_ub = -exp_ub;
 
     // temporary hack
-    Params::convert_NtoW(exp.constant_term() - 1, underflow);
-    if (underflow) {
+    Weight _tmp;
+    if (convert_NtoW_overflow(exp.constant_term() - 1, _tmp)) {
         // We don't like MIN either because the code will compute
         // minus MIN, and it will silently overflow.
         return;
@@ -153,8 +153,8 @@ void SplitDBM::diffcsts_of_lin_leq(const linear_expression_t& exp,
 
     std::vector<std::pair<std::pair<Weight, variable_t>, Weight>> pos_terms, neg_terms;
     for (auto [y, n] : exp.variable_terms()) {
-        Weight coeff(Params::convert_NtoW(n, overflow));
-        if (overflow) {
+        Weight coeff;
+        if (convert_NtoW_overflow(n, coeff)) {
             continue;
         }
         if (coeff > Weight(0)) {
@@ -166,8 +166,8 @@ void SplitDBM::diffcsts_of_lin_leq(const linear_expression_t& exp,
                 unbounded_lbvar = y;
                 unbounded_lbcoeff = coeff;
             } else {
-                Weight ymin(Params::convert_NtoW(*y_lb.number(), overflow));
-                if (overflow) {
+                Weight ymin;
+                if (convert_NtoW_overflow(*y_lb.number(), ymin)) {
                     continue;
                 }
                 exp_ub -= ymin * coeff;
@@ -182,8 +182,8 @@ void SplitDBM::diffcsts_of_lin_leq(const linear_expression_t& exp,
                 unbounded_ubvar = y;
                 unbounded_ubcoeff = -coeff;
             } else {
-                Weight ymax(Params::convert_NtoW(*y_ub.number(), overflow));
-                if (overflow) {
+                Weight ymax;
+                if (convert_NtoW_overflow(*y_ub.number(), ymax)) {
                     continue;
                 }
                 exp_ub -= ymax * coeff;
@@ -295,9 +295,8 @@ bool SplitDBM::add_univar_disequation(variable_t x, const number_t& n) {
     vert_id v = get_vert(x);
     if (new_i.lb().is_finite()) {
         // strengthen lb
-        bool overflow;
-        Weight lb_val = Params::convert_NtoW(-(*new_i.lb().number()), overflow);
-        if (overflow) {
+        Weight lb_val;
+        if (convert_NtoW_overflow(-*new_i.lb().number(), lb_val)) {
             return true;
         }
 
@@ -322,9 +321,8 @@ bool SplitDBM::add_univar_disequation(variable_t x, const number_t& n) {
     }
     if (new_i.ub().is_finite()) {
         // strengthen ub
-        bool overflow;
-        Weight ub_val = Params::convert_NtoW(*new_i.ub().number(), overflow);
-        if (overflow) {
+        Weight ub_val;
+        if (convert_NtoW_overflow(*new_i.ub().number(), ub_val)) {
             return true;
         }
 
@@ -809,24 +807,25 @@ void SplitDBM::assign(variable_t lhs, const linear_expression_t& e) {
     interval_t value_interval = eval_interval(e);
 
     std::optional<Weight> lb_w, ub_w;
-    bool overflow{};
     if (value_interval.lb().is_finite()) {
-        lb_w = Params::convert_NtoW(-(*value_interval.lb().number()), overflow);
-        if (overflow) {
+        Weight tmp;
+        if (convert_NtoW_overflow(-*value_interval.lb().number(), tmp)) {
             operator-=(lhs);
             CRAB_LOG("zones-split", std::cout << "---" << lhs << ":=" << e << "\n" << *this << "\n");
             normalize();
             return;
         }
+        lb_w = tmp;
     }
     if (value_interval.ub().is_finite()) {
-        ub_w = Params::convert_NtoW(*value_interval.ub().number(), overflow);
-        if (overflow) {
+        Weight tmp;
+        if (convert_NtoW_overflow(*value_interval.ub().number(), tmp)) {
             operator-=(lhs);
             CRAB_LOG("zones-split", std::cout << "---" << lhs << ":=" << e << "\n" << *this << "\n");
             normalize();
             return;
         }
+        ub_w = tmp;
     }
 
     // JN: it seems that we can only do this if
@@ -847,8 +846,8 @@ void SplitDBM::assign(variable_t lhs, const linear_expression_t& e) {
         return;
     }
 
-    Weight e_val = eval_expression(e, overflow);
-    if (overflow) {
+    Weight e_val;
+    if (eval_expression_overflow(e, e_val)) {
         operator-=(lhs);
         return;
     }
@@ -946,8 +945,8 @@ void SplitDBM::set(variable_t x, const interval_t& intv) {
     vert_id v = get_vert(x);
     bool overflow;
     if (intv.ub().is_finite()) {
-        Weight ub = Params::convert_NtoW(*(intv.ub().number()), overflow);
-        if (overflow) {
+        Weight ub;
+        if (convert_NtoW_overflow(*intv.ub().number(), ub)) {
             normalize();
             return;
         }
@@ -955,8 +954,8 @@ void SplitDBM::set(variable_t x, const interval_t& intv) {
         g.set_edge(0, ub, v);
     }
     if (intv.lb().is_finite()) {
-        Weight lb = Params::convert_NtoW(*(intv.lb().number()), overflow);
-        if (overflow) {
+        Weight lb;
+        if (convert_NtoW_overflow(*intv.lb().number(), lb)) {
             normalize();
             return;
         }
@@ -1060,7 +1059,7 @@ void SplitDBM::forget(const variable_vector_t& variables) {
     normalize();
 }
 
-static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Params::Weight& w, bool eq) {
+static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Weight& w, bool eq) {
     std::stringstream elem;
     if (eq) {
         if (w.operator>(0)) {
@@ -1166,21 +1165,18 @@ string_invariant SplitDBM::to_set() const {
 
 std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
-SplitDBM::Weight SplitDBM::eval_expression(const linear_expression_t& e, bool overflow) const {
-    if (overflow) {
-        return {0};
-    }
-
-    Weight res(Params::convert_NtoW(e.constant_term(), overflow));
+bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& out) const {
+    bool overflow = convert_NtoW_overflow(e.constant_term(), out);
     assert(!overflow);
     for (const auto& [variable, coefficient] : e.variable_terms()) {
-        Weight coef = Params::convert_NtoW(coefficient, overflow);
-        if (overflow) {
-            return Weight(0);
+        Weight coef;
+        if (convert_NtoW_overflow(coefficient, coef)) {
+            out = Weight(0);
+            return true;
         }
-        res += (pot_value(variable) - potential[0]) * coef;
+        out += (pot_value(variable) - potential[0]) * coef;
     }
-    return res;
+    return false;
 }
 
 interval_t SplitDBM::compute_residual(const linear_expression_t& e, variable_t pivot) const {
diff --git a/src/crab/split_dbm.hpp b/src/crab/split_dbm.hpp
index 10f2122b9..ca72395ed 100644
--- a/src/crab/split_dbm.hpp
+++ b/src/crab/split_dbm.hpp
@@ -30,10 +30,10 @@
 #include "crab/thresholds.hpp"
 #include "crab/variable.hpp"
 #include "crab_utils/adapt_sgraph.hpp"
-#include "crab_utils/bignums.hpp"
 #include "crab_utils/debug.hpp"
 #include "crab_utils/graph_ops.hpp"
-#include "crab_utils/safeint.hpp"
+#include "crab_utils/num_big.hpp"
+#include "crab_utils/num_safeint.hpp"
 #include "crab_utils/stats.hpp"
 
 #include "string_constraints.hpp"
@@ -46,38 +46,10 @@ using binop_t = std::variant<arith_binop_t, bitwise_binop_t>;
 
 namespace domains {
 
-/** DBM weights (Weight) can be represented using one of the following
- * types:
- *
- * 1) basic integer type: e.g., long
- * 2) safei64
- * 3) number_t
- *
- * 1) is the fastest but things can go wrong if some DBM
- * operation overflows. 2) is slower than 1) but it checks for
- * overflow before any DBM operation. 3) is the slowest and it
- * represents weights using unbounded mathematical integers so
- * overflow is not a concern but it might not be what you need
- * when reasoning about programs with wraparound semantics.
- **/
-
-struct Z_NumberDefaultParams {
-    using Weight = number_t;
-    using graph_t = AdaptGraph;
-    static Weight convert_NtoW(const number_t& n, bool& overflow);
-};
-
-struct SafeInt64DefaultParams {
-    using Weight = safe_i64;
-    using graph_t = AdaptGraph;
-    static Weight convert_NtoW(const number_t& n, bool& overflow);
-};
-
 class SplitDBM final {
   public:
-    using Params = Z_NumberDefaultParams;
-    using graph_t = Params::graph_t;
-    using Weight = Params::Weight;
+    using graph_t = AdaptGraph;
+    using Weight = AdaptGraph::Weight;
     using vert_id = graph_t::vert_id;
     using vert_map_t = boost::container::flat_map<variable_t, vert_id>;
 
@@ -105,7 +77,7 @@ class SplitDBM final {
 
     // Evaluate an expression under the chosen potentials
     [[nodiscard]]
-    Weight eval_expression(const linear_expression_t& e, bool overflow) const;
+    bool eval_expression_overflow(const linear_expression_t& e, Weight& out) const;
 
     [[nodiscard]]
     interval_t compute_residual(const linear_expression_t& e, variable_t pivot) const;
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 071c63070..8491ef81d 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -7,8 +7,8 @@
 #include <memory>
 #include <vector>
 
-#include "crab_utils/bignums.hpp"
 #include "crab_utils/lazy_allocator.hpp"
+#include "crab_utils/num_big.hpp"
 using index_t = uint64_t;
 
 /* Basic type definitions */
diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index d14f2af4d..e131044f0 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -6,7 +6,7 @@
 
 #include <boost/container/flat_map.hpp>
 
-#include "crab_utils/safeint.hpp"
+#include "crab_utils/num_safeint.hpp"
 
 namespace crab {
 
@@ -145,7 +145,21 @@ class AdaptGraph final {
     using smap_t = TreeSMap;
 
   public:
-    using Weight = number_t; // same as SafeInt64DefaultParams::Weight; previously template
+    /** DBM weights (Weight) can be represented using one of the following
+     * types:
+     *
+     * 1) basic integer type: e.g., long
+     * 2) safei64
+     * 3) number_t
+     *
+     * 1) is the fastest but things can go wrong if some DBM
+     * operation overflows. 2) is slower than 1) but it checks for
+     * overflow before any DBM operation. 3) is the slowest, and it
+     * represents weights using unbounded mathematical integers so
+     * overflow is not a concern, but it might not be what you need
+     * when reasoning about programs with wraparound semantics.
+     **/
+    using Weight = number_t; // previously template
     using vert_id = unsigned int;
 
     AdaptGraph() : edge_count(0) {}
diff --git a/src/crab_utils/bignums.hpp b/src/crab_utils/num_big.hpp
similarity index 99%
rename from src/crab_utils/bignums.hpp
rename to src/crab_utils/num_big.hpp
index de3551848..8438db1c1 100644
--- a/src/crab_utils/bignums.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -244,7 +244,7 @@ class number_t final {
         if (_n.is_zero()) {
             return number_t(static_cast<signed long long>(0));
         }
-        return number_t{(cpp_int(1) << msb(_n) + 1) - 1};
+        return number_t{(cpp_int(1) << (msb(_n) + 1)) - 1};
     }
 
     friend std::ostream& operator<<(std::ostream& o, const number_t& z) { return o << z._n.str(); }
diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
new file mode 100644
index 000000000..704fe524b
--- /dev/null
+++ b/src/crab_utils/num_extended.hpp
@@ -0,0 +1,223 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <optional>
+#include <utility>
+
+#include "crab_utils/num_big.hpp"
+#include "crab_utils/stats.hpp"
+
+namespace crab {
+
+class extended_number final {
+    bool _is_infinite;
+    number_t _n;
+
+    extended_number(const bool is_infinite, const number_t& n) : _is_infinite(is_infinite), _n(n) {
+        if (is_infinite) {
+            if (n > 0) {
+                _n = 1;
+            } else {
+                _n = -1;
+            }
+        }
+    }
+
+  public:
+    static extended_number plus_infinity() { return extended_number(true, 1); }
+
+    static extended_number minus_infinity() { return extended_number(true, -1); }
+
+    explicit extended_number(const std::string& s) : _n(1) {
+        if (s == "+oo") {
+            _is_infinite = true;
+        } else if (s == "-oo") {
+            _is_infinite = true;
+            _n = -1;
+        } else {
+            _is_infinite = false;
+            _n = number_t(s);
+        }
+    }
+
+    extended_number(number_t n) : _is_infinite(false), _n(std::move(n)) {}
+
+    extended_number(const extended_number& o) = default;
+
+    extended_number& operator=(const extended_number& o) {
+        if (this != &o) {
+            _is_infinite = o._is_infinite;
+            _n = o._n;
+        }
+        return *this;
+    }
+
+    [[nodiscard]]
+    bool is_infinite() const {
+        return _is_infinite;
+    }
+
+    [[nodiscard]]
+    bool is_finite() const {
+        return !_is_infinite;
+    }
+
+    [[nodiscard]]
+    bool is_plus_infinity() const {
+        return (is_infinite() && _n > 0);
+    }
+
+    [[nodiscard]]
+    bool is_minus_infinity() const {
+        return (is_infinite() && _n < 0);
+    }
+
+    extended_number operator-() const { return extended_number(_is_infinite, -_n); }
+
+    extended_number operator+(const extended_number& x) const {
+        if (is_finite()) {
+            if (x.is_finite()) {
+                return extended_number(_n + x._n);
+            }
+            return x;
+        }
+        if (x.is_finite() || x._n == _n) {
+            return *this;
+        }
+        CRAB_ERROR("Bound: undefined operation -oo + +oo");
+    }
+
+    extended_number& operator+=(const extended_number& x) { return operator=(operator+(x)); }
+
+    extended_number operator-(const extended_number& x) const { return operator+(x.operator-()); }
+
+    extended_number& operator-=(const extended_number& x) { return operator=(operator-(x)); }
+
+    extended_number operator*(const extended_number& x) const {
+        if (x._n == 0) {
+            return x;
+        } else if (_n == 0) {
+            return *this;
+        } else {
+            return extended_number(_is_infinite || x._is_infinite, _n * x._n);
+        }
+    }
+
+    extended_number& operator*=(const extended_number& x) { return operator=(operator*(x)); }
+
+  private:
+    extended_number AbsDiv(const extended_number& x, extended_number (*f)(number_t, number_t)) const {
+        if (x._n == 0) {
+            CRAB_ERROR("Bound: division by zero");
+        }
+        if (x.is_infinite()) {
+            if (is_infinite()) {
+                CRAB_ERROR("Bound: inf / inf");
+            }
+            return number_t{0};
+        }
+        if (is_infinite()) {
+            return *this;
+        }
+        return f(_n, x._n);
+    }
+
+  public:
+    extended_number operator/(const extended_number& x) const {
+        return AbsDiv(x, [](number_t dividend, number_t divisor) { return extended_number{dividend / divisor}; });
+    }
+
+    extended_number operator%(const extended_number& x) const {
+        return AbsDiv(x, [](number_t dividend, number_t divisor) { return extended_number{dividend % divisor}; });
+    }
+
+    [[nodiscard]]
+    extended_number UDiv(const extended_number& x) const {
+        using M = uint64_t;
+        return AbsDiv(x, [](number_t dividend, number_t divisor) {
+            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
+            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
+            return extended_number{dividend / divisor};
+        });
+    }
+
+    [[nodiscard]]
+    extended_number URem(const extended_number& x) const {
+        using M = uint64_t;
+        return AbsDiv(x, [](number_t dividend, number_t divisor) {
+            dividend = dividend >= 0 ? dividend : number_t{dividend.cast_to<M>()};
+            divisor = divisor >= 0 ? divisor : number_t{divisor.cast_to<M>()};
+            return extended_number{dividend % divisor};
+        });
+    }
+
+    extended_number& operator/=(const extended_number& x) { return operator=(operator/(x)); }
+
+    bool operator<(const extended_number& x) const { return !operator>=(x); }
+
+    bool operator>(const extended_number& x) const { return !operator<=(x); }
+
+    bool operator==(const extended_number& x) const { return (_is_infinite == x._is_infinite && _n == x._n); }
+
+    bool operator!=(const extended_number& x) const { return !operator==(x); }
+
+    /*	operator<= and operator>= use a somewhat optimized implementation.
+     *	results include up to 20% improvements in performance in the octagon domain
+     *	over a more naive implementation.
+     */
+    bool operator<=(const extended_number& x) const {
+        if (_is_infinite xor x._is_infinite) {
+            if (_is_infinite) {
+                return _n < 0;
+            }
+            return x._n > 0;
+        }
+        return _n <= x._n;
+    }
+
+    bool operator>=(const extended_number& x) const {
+        if (_is_infinite xor x._is_infinite) {
+            if (_is_infinite) {
+                return _n > 0;
+            }
+            return x._n < 0;
+        }
+        return _n >= x._n;
+    }
+
+    [[nodiscard]]
+    extended_number abs() const {
+        if (operator>=(number_t{0})) {
+            return *this;
+        } else {
+            return operator-();
+        }
+    }
+
+    [[nodiscard]]
+    std::optional<number_t> number() const {
+        if (is_infinite()) {
+            return {};
+        } else {
+            return {_n};
+        }
+    }
+
+    friend std::ostream& operator<<(std::ostream& o, const extended_number& b) {
+        if (b.is_plus_infinity()) {
+            o << "+oo";
+        } else if (b.is_minus_infinity()) {
+            o << "-oo";
+        } else {
+            o << b._n;
+        }
+        return o;
+    }
+
+}; // class extended_number
+
+using bound_t = extended_number;
+
+} // namespace crab
diff --git a/src/crab_utils/safeint.hpp b/src/crab_utils/num_safeint.hpp
similarity index 99%
rename from src/crab_utils/safeint.hpp
rename to src/crab_utils/num_safeint.hpp
index 740a8f5d6..e8c12ed6b 100644
--- a/src/crab_utils/safeint.hpp
+++ b/src/crab_utils/num_safeint.hpp
@@ -12,7 +12,7 @@
 #include <boost/multiprecision/cpp_int.hpp>
 #endif
 
-#include "crab_utils/bignums.hpp"
+#include "crab_utils/num_big.hpp"
 
 namespace crab {
 

From 20ab9d58dbf1f2f50fe00abad6f26d3770b918c6 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 03:39:18 +0300
Subject: [PATCH 244/373] do not check before truncating

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/ebpf_domain.cpp   | 28 ++++++++--------------------
 src/crab_utils/num_big.hpp | 10 ++++++++--
 2 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 6904ce002..76b18ada1 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -205,11 +205,8 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
             is64 = true;
             // fallthrough as 64bit, including deduction of relational information
         } else {
-            for (interval_t* interval : {&left_interval, &right_interval}) {
-                if (!(*interval <= interval_t::signed_int(32))) {
-                    *interval = interval->truncate_to<int32_t>();
-                }
-            }
+            left_interval = left_interval.truncate_to<int32_t>();
+            right_interval = right_interval.truncate_to<int32_t>();
             // continue as 32bit
         }
     }
@@ -231,11 +228,8 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
         }
     }
 
-    for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::signed_int(64))) {
-            *interval = interval->truncate_to<int64_t>();
-        }
-    }
+    left_interval = left_interval.truncate_to<int64_t>();
+    right_interval = right_interval.truncate_to<int64_t>();
 }
 
 // Given left and right values, get the left and right intervals, and also split
@@ -256,11 +250,8 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
             is64 = true;
             // fallthrough as 64bit, including deduction of relational information
         } else {
-            for (interval_t* interval : {&left_interval, &right_interval}) {
-                if (!(*interval <= interval_t::unsigned_int(32))) {
-                    *interval = interval->truncate_to<uint32_t>();
-                }
-            }
+            left_interval = left_interval.truncate_to<uint32_t>();
+            right_interval = right_interval.truncate_to<uint32_t>();
             // continue as 32bit
         }
     }
@@ -281,11 +272,8 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
         }
     }
 
-    for (interval_t* interval : {&left_interval, &right_interval}) {
-        if (!(*interval <= interval_t::unsigned_int(64))) {
-            *interval = interval->truncate_to<uint64_t>();
-        }
-    }
+    left_interval = left_interval.truncate_to<uint64_t>();
+    right_interval = right_interval.truncate_to<uint64_t>();
 }
 
 static std::vector<linear_constraint_t>
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index 8438db1c1..640da3256 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -225,14 +225,20 @@ class number_t final {
 
     number_t operator^(const number_t& x) const { return number_t(_n ^ x._n); }
 
-    number_t operator<<(const number_t x) const {
+    number_t operator<<(const number_t& x) const {
+        if (x < 0) {
+            CRAB_ERROR("Shift amount cannot be negative");
+        }
         if (!x.fits<int32_t>()) {
             CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }
         return number_t(_n << static_cast<int32_t>(x));
     }
 
-    number_t operator>>(const number_t x) const {
+    number_t operator>>(const number_t& x) const {
+        if (x < 0) {
+            CRAB_ERROR("Shift amount cannot be negative");
+        }
         if (!x.fits<int32_t>()) {
             CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }

From 519c3cda2e49a2b67f253f3123314d43fe1e97e6 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 03:45:03 +0300
Subject: [PATCH 245/373] hash_value()

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/num_big.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index 640da3256..634f61ddf 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -43,7 +43,7 @@ class number_t final {
 
     [[nodiscard]]
     friend std::size_t hash_value(const number_t& z) {
-        return boost::hash_value(z._n.str());
+        return hash_value(z._n);
     }
 
     template <std::integral T>

From 0852a8c85aa4bc3ffd8020ffdc5dd1925d0ab194 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 03:52:27 +0300
Subject: [PATCH 246/373] hash_value()

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/num_big.hpp | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index 634f61ddf..147c89ddf 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -7,7 +7,6 @@
 #include <string>
 #include <utility>
 
-#include <boost/functional/hash.hpp>
 #include <boost/multiprecision/cpp_int.hpp>
 
 #include "debug.hpp"
@@ -22,7 +21,7 @@ template <std::integral T>
 using swap_signedness = std::conditional_t<std::is_signed_v<T>, std::make_unsigned_t<T>, std::make_signed_t<T>>;
 
 class number_t final {
-    cpp_int _n{nullptr};
+    cpp_int _n{};
 
   public:
     number_t() = default;

From 4907f1b0cd29ac77e73a7c908ebba60127bce1c2 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 04:09:32 +0300
Subject: [PATCH 247/373] move semantics for extended integers

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/num_extended.hpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
index 704fe524b..1c9703a77 100644
--- a/src/crab_utils/num_extended.hpp
+++ b/src/crab_utils/num_extended.hpp
@@ -46,6 +46,10 @@ class extended_number final {
 
     extended_number(const extended_number& o) = default;
 
+    extended_number(extended_number&&) noexcept = default;
+
+    extended_number& operator=(extended_number&&) noexcept = default;
+
     extended_number& operator=(const extended_number& o) {
         if (this != &o) {
             _is_infinite = o._is_infinite;

From 4d0a5a77a217429b4e4b69c1740364e0cad39f09 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 19:08:12 +0300
Subject: [PATCH 248/373] cleanup and modernize

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/dsl_syntax.hpp         |   49 --
 src/crab/ebpf_domain.cpp        | 1258 ++++++++++++++++---------------
 src/crab/ebpf_domain.hpp        |   78 +-
 src/crab/interval.hpp           |    1 +
 src/crab/linear_expression.hpp  |    8 +-
 src/crab_utils/num_big.hpp      |    6 +
 src/crab_utils/num_extended.hpp |    1 +
 7 files changed, 691 insertions(+), 710 deletions(-)

diff --git a/src/crab/dsl_syntax.hpp b/src/crab/dsl_syntax.hpp
index 50a7d7a1e..52b571a3c 100644
--- a/src/crab/dsl_syntax.hpp
+++ b/src/crab/dsl_syntax.hpp
@@ -17,77 +17,28 @@ inline linear_expression_t operator+(const linear_expression_t& e1, const linear
     return e1.plus(e2);
 }
 
-inline linear_expression_t operator+(const linear_expression_t& e, const number_t& n) { return e.plus(n); }
-
-inline linear_expression_t operator+(const number_t& n, const linear_expression_t& e) { return e.plus(n); }
-
 inline linear_expression_t operator-(const linear_expression_t& e1, const linear_expression_t& e2) {
     return e1.subtract(e2);
 }
 
-inline linear_expression_t operator-(const number_t& n, const linear_expression_t& e) {
-    return linear_expression_t(n).subtract(e);
-}
-
-inline linear_expression_t operator-(const linear_expression_t& e, const number_t& n) { return e.subtract(n); }
-
 inline linear_constraint_t operator<=(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
 }
 
-inline linear_constraint_t operator<=(const linear_expression_t& e, const number_t& n) {
-    return linear_constraint_t(e - n, constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
-}
-
-inline linear_constraint_t operator<=(const number_t& n, const linear_expression_t& e) {
-    return linear_constraint_t(n - e, constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
-}
-
 inline linear_constraint_t operator<(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::LESS_THAN_ZERO);
 }
 
-inline linear_constraint_t operator<(const linear_expression_t& e, const number_t& n) {
-    return linear_constraint_t(e - n, constraint_kind_t::LESS_THAN_ZERO);
-}
-
-inline linear_constraint_t operator<(const number_t& n, const linear_expression_t& e) {
-    return linear_constraint_t(n - e, constraint_kind_t::LESS_THAN_ZERO);
-}
-
 inline linear_constraint_t operator>=(const linear_expression_t& e1, const linear_expression_t& e2) { return e2 <= e1; }
 
-inline linear_constraint_t operator>=(const linear_expression_t& e, const number_t& n) { return n <= e; }
-
-inline linear_constraint_t operator>=(const number_t& n, const linear_expression_t& e) { return e <= n; }
-
 inline linear_constraint_t operator>(const linear_expression_t& e1, const linear_expression_t& e2) { return e2 < e1; }
 
-inline linear_constraint_t operator>(const linear_expression_t& e, const number_t& n) { return n < e; }
-
-inline linear_constraint_t operator>(const number_t& n, const linear_expression_t& e) { return e < n; }
-
 inline linear_constraint_t operator==(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::EQUALS_ZERO);
 }
 
-inline linear_constraint_t operator==(const linear_expression_t& e, const number_t& n) {
-    return linear_constraint_t(e - n, constraint_kind_t::EQUALS_ZERO);
-}
-
-inline linear_constraint_t operator==(const number_t& n, const linear_expression_t& e) {
-    return linear_constraint_t(e - n, constraint_kind_t::EQUALS_ZERO);
-}
-
 inline linear_constraint_t operator!=(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::NOT_ZERO);
 }
 
-inline linear_constraint_t operator!=(const linear_expression_t& e, const number_t& n) {
-    return linear_constraint_t(e - n, constraint_kind_t::NOT_ZERO);
-}
-
-inline linear_constraint_t operator!=(const number_t& n, const linear_expression_t& e) {
-    return linear_constraint_t(e - n, constraint_kind_t::NOT_ZERO);
-}
 } // end namespace crab::dsl_syntax
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 76b18ada1..9485f9ba7 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -9,7 +9,6 @@
 #include <vector>
 
 #include "boost/endian/conversion.hpp"
-#include "boost/range/algorithm/set_algorithm.hpp"
 
 #include "crab/array_domain.hpp"
 #include "crab/ebpf_domain.hpp"
@@ -36,7 +35,7 @@ struct reg_pack_t {
     variable_t stack_numeric_size;
 };
 
-reg_pack_t reg_pack(int i) {
+reg_pack_t reg_pack(const int i) {
     return {
         variable_t::reg(data_kind_t::svalues, i),
         variable_t::reg(data_kind_t::uvalues, i),
@@ -50,16 +49,16 @@ reg_pack_t reg_pack(int i) {
         variable_t::reg(data_kind_t::stack_numeric_sizes, i),
     };
 }
-reg_pack_t reg_pack(Reg r) { return reg_pack(r.v); }
+reg_pack_t reg_pack(const Reg r) { return reg_pack(r.v); }
 
-static linear_constraint_t eq(variable_t a, variable_t b) {
+static linear_constraint_t eq(const variable_t a, const variable_t b) {
     using namespace crab::dsl_syntax;
     return {a - b, constraint_kind_t::EQUALS_ZERO};
 }
 
 static linear_constraint_t eq_types(const Reg& a, const Reg& b) { return eq(reg_pack(a).type, reg_pack(b).type); }
 
-static linear_constraint_t neq(variable_t a, variable_t b) {
+static linear_constraint_t neq(const variable_t a, const variable_t b) {
     using namespace crab::dsl_syntax;
     return {a - b, constraint_kind_t::NOT_ZERO};
 }
@@ -76,8 +75,8 @@ constexpr int64_t PTR_MAX = std::numeric_limits<int32_t>::max() - MAX_PACKET_SIZ
 
 /** Linear constraint for a pointer comparison.
  */
-static linear_constraint_t assume_cst_offsets_reg(Condition::Op op, bool is64, variable_t dst_offset,
-                                                  variable_t src_offset) {
+static linear_constraint_t assume_cst_offsets_reg(const Condition::Op op, bool is64, const variable_t dst_offset,
+                                                  const variable_t src_offset) {
     using namespace crab::dsl_syntax;
     using Op = Condition::Op;
     switch (op) {
@@ -97,7 +96,7 @@ static linear_constraint_t assume_cst_offsets_reg(Condition::Op op, bool is64, v
 }
 
 static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDomain& inv, Condition::Op op, bool is64,
-                                                                variable_t dst_uvalue, crab::interval_t src_interval) {
+                                                                variable_t dst_uvalue, interval_t src_interval) {
     using namespace crab::dsl_syntax;
     using Op = Condition::Op;
 
@@ -113,37 +112,38 @@ static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDoma
     }
     uint64_t src_int_value = src_n.value().cast_to<uint64_t>();
     if (!is64) {
-        src_int_value = (uint32_t)src_int_value;
+        src_int_value = static_cast<uint32_t>(src_int_value);
     }
 
     bool result;
     switch (op) {
-    case Op::SET: result = ((dst_n.value().cast_to<uint64_t>() & src_int_value) != 0); break;
-    case Op::NSET: result = ((dst_n.value().cast_to<uint64_t>() & src_int_value) == 0); break;
+    case Op::SET: result = (dst_n.value().cast_to<uint64_t>() & src_int_value) != 0; break;
+    case Op::NSET: result = (dst_n.value().cast_to<uint64_t>() & src_int_value) == 0; break;
     default: throw std::exception();
     }
 
     return {result ? linear_constraint_t::true_const() : linear_constraint_t::false_const()};
 }
 
-static std::vector<linear_constraint_t> assume_signed_64bit_eq(const NumAbsDomain& inv, variable_t left_svalue,
-                                                               variable_t left_uvalue, crab::interval_t& right_interval,
+static std::vector<linear_constraint_t> assume_signed_64bit_eq(const NumAbsDomain& inv, const variable_t left_svalue,
+                                                               const variable_t left_uvalue,
+                                                               const interval_t& right_interval,
                                                                const linear_expression_t& right_svalue,
                                                                const linear_expression_t& right_uvalue) {
     using namespace crab::dsl_syntax;
-    if (right_interval <= crab::interval_t::nonnegative(64) && !right_interval.is_singleton()) {
+    if (right_interval <= interval_t::nonnegative(64) && !right_interval.is_singleton()) {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue), eq(left_svalue, left_uvalue)};
     } else {
         return {(left_svalue == right_svalue), (left_uvalue == right_uvalue)};
     }
 }
 
-static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomain& inv, variable_t left_svalue,
-                                                               variable_t left_uvalue,
-                                                               crab::interval_t& right_interval) {
+static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomain& inv, const variable_t left_svalue,
+                                                               const variable_t left_uvalue,
+                                                               const interval_t& right_interval) {
     using namespace crab::dsl_syntax;
 
-    if (auto rn = right_interval.singleton()) {
+    if (const auto rn = right_interval.singleton()) {
         if (auto size = inv.eval_interval(left_svalue).finite_size()) {
             // Find the lowest 64-bit svalue whose low 32 bits match the singleton.
 
@@ -152,7 +152,7 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
 
             // Use the high 32-bits from the left lower bound and the low 32-bits from the right singleton.
             // The result might be lower than the lower bound.
-            int64_t lb_match = ((lb & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF));
+            const int64_t lb_match = lb & 0xFFFFFFFF00000000 | rn->cast_to<int64_t>() & 0xFFFFFFFF;
             if (lb_match < lb) {
                 // The result is lower than the left interval, so try the next higher matching 64-bit value.
                 // It's ok if this goes higher than the left upper bound.
@@ -162,22 +162,22 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
             // Find the highest 64-bit svalue whose low 32 bits match the singleton.
 
             // Get upper bound as a 64-bit value.
-            int64_t ub = inv.eval_interval(left_svalue).ub().number()->cast_to<int64_t>();
+            const int64_t ub = inv.eval_interval(left_svalue).ub().number()->cast_to<int64_t>();
 
             // Use the high 32-bits from the left upper bound and the low 32-bits from the right singleton.
             // The result might be higher than the upper bound.
-            int64_t ub_match = ((ub & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF));
+            const int64_t ub_match = ub & 0xFFFFFFFF00000000 | rn->cast_to<int64_t>() & 0xFFFFFFFF;
             if (ub_match > ub) {
                 // The result is higher than the left interval, so try the next lower matching 64-bit value.
                 // It's ok if this goes lower than the left lower bound.
                 lb -= 0x100000000;
             }
 
-            if ((uint64_t)lb_match <= (uint64_t)ub_match) {
+            if (static_cast<uint64_t>(lb_match) <= static_cast<uint64_t>(ub_match)) {
                 // The interval is also valid when cast to a uvalue, meaning
                 // both bounds are positive or both are negative.
-                return {left_svalue >= lb_match, left_svalue <= ub_match, left_uvalue >= number_t((uint64_t)lb_match),
-                        left_uvalue <= number_t((uint64_t)ub_match)};
+                return {left_svalue >= lb_match, left_svalue <= ub_match,
+                        left_uvalue >= static_cast<uint64_t>(lb_match), left_uvalue <= static_cast<uint64_t>(ub_match)};
             } else {
                 // The interval can only be represented as an svalue.
                 return {left_svalue >= lb_match, left_svalue <= ub_match};
@@ -189,10 +189,10 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
 
 // Given left and right values, get the left and right intervals, and also split
 // the left interval into separate negative and positive intervals.
-static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t left_svalue, variable_t left_uvalue,
-                                 const linear_expression_t& right_svalue, crab::interval_t& left_interval,
-                                 crab::interval_t& right_interval, crab::interval_t& left_interval_positive,
-                                 crab::interval_t& left_interval_negative) {
+static void get_signed_intervals(const NumAbsDomain& inv, bool is64, const variable_t left_svalue,
+                                 const variable_t left_uvalue, const linear_expression_t& right_svalue,
+                                 interval_t& left_interval, interval_t& right_interval,
+                                 interval_t& left_interval_positive, interval_t& left_interval_negative) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
@@ -220,8 +220,9 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
             // The interval is TOP as a signed interval but is represented precisely as an unsigned interval,
             // so split into two signed intervals that can be treated separately.
             left_interval_positive = left_interval & interval_t::nonnegative(64);
-            number_t lih_ub = left_interval.ub().number() ? left_interval.ub().number()->truncate_to<int64_t>() : -1;
-            left_interval_negative = interval_t(number_t{std::numeric_limits<int64_t>::min()}, lih_ub);
+            const number_t lih_ub =
+                left_interval.ub().number() ? left_interval.ub().number()->truncate_to<int64_t>() : -1;
+            left_interval_negative = interval_t{std::numeric_limits<int64_t>::min(), lih_ub};
         } else {
             left_interval_positive = interval_t::nonnegative(64);
             left_interval_negative = interval_t::negative(64);
@@ -234,10 +235,10 @@ static void get_signed_intervals(const NumAbsDomain& inv, bool is64, variable_t
 
 // Given left and right values, get the left and right intervals, and also split
 // the left interval into separate low and high intervals.
-static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_t left_svalue, variable_t left_uvalue,
-                                   const linear_expression_t& right_uvalue, crab::interval_t& left_interval,
-                                   crab::interval_t& right_interval, crab::interval_t& left_interval_low,
-                                   crab::interval_t& left_interval_high) {
+static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, const variable_t left_svalue,
+                                   const variable_t left_uvalue, const linear_expression_t& right_uvalue,
+                                   interval_t& left_interval, interval_t& right_interval, interval_t& left_interval_low,
+                                   interval_t& left_interval_high) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
@@ -264,8 +265,8 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
         if (!left_interval.is_top()) {
             // The interval is TOP as an unsigned interval but is represented precisely as a signed interval,
             // so split into two unsigned intervals that can be treated separately.
-            left_interval_low = interval_t(number_t{0}, left_interval.ub()).truncate_to<uint64_t>();
-            left_interval_high = interval_t(left_interval.lb(), number_t{-1}).truncate_to<uint64_t>();
+            left_interval_low = interval_t(0, left_interval.ub()).truncate_to<uint64_t>();
+            left_interval_high = interval_t(left_interval.lb(), -1).truncate_to<uint64_t>();
         } else {
             left_interval_low = interval_t::nonnegative(64);
             left_interval_high = interval_t::unsigned_high(64);
@@ -277,46 +278,48 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, variable_
 }
 
 static std::vector<linear_constraint_t>
-assume_signed_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                       const crab::interval_t& left_interval_positive, const crab::interval_t& left_interval_negative,
-                       const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                       const crab::interval_t& right_interval) {
+assume_signed_64bit_lt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                       const variable_t left_uvalue, const interval_t& left_interval_positive,
+                       const interval_t& left_interval_negative, const linear_expression_t& right_svalue,
+                       const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::negative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1].
-        return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue), number_t{0} <= left_uvalue,
-                strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
+        return {strict ? left_svalue < right_svalue : left_svalue <= right_svalue, 0 <= left_uvalue,
+                strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(64) &&
                right_interval <= interval_t::nonnegative(64)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue), number_t{0} <= left_uvalue,
-                strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
+        return {strict ? left_svalue < right_svalue : left_svalue <= right_svalue, 0 <= left_uvalue,
+                strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
     } else {
         // Interval can only be represented as an svalue.
-        return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        return {strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     }
 }
 
 static std::vector<linear_constraint_t>
-assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                       const crab::interval_t& left_interval_positive, const crab::interval_t& left_interval_negative,
-                       const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                       const crab::interval_t& right_interval) {
+assume_signed_32bit_lt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                       const variable_t left_uvalue, const interval_t& left_interval_positive,
+                       const interval_t& left_interval_negative, const linear_expression_t& right_svalue,
+                       const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::negative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
-        // aka [INT_MAX+1, UINT_MAX].
-        return {left_uvalue >= (number_t{INT32_MAX} + 1),
-                strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
-                strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        // Interval can be represented as both an svalue and a uvalue since it fits in
+        // [std::numeric_limits<int32_t>::min(), -1], aka [std::numeric_limits<int32_t>::max()+1,
+        // Ustd::numeric_limits<int32_t>::max()].
+        return {std::numeric_limits<int32_t>::max() < left_uvalue,
+                strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
+                strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(32) &&
                right_interval <= interval_t::nonnegative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX]
-        auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
+        // std::numeric_limits<int32_t>::max()]
+        const auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue,
                 left_svalue <= left_uvalue,
@@ -327,7 +330,7 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
     } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(32) &&
                inv.eval_interval(right_svalue) <= interval_t::signed_int(32)) {
         // Interval can only be represented as an svalue.
-        return {strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        return {strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else {
         // We can't directly compare the svalues since they may differ in high order bits.
         return {};
@@ -335,16 +338,17 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_sva
 }
 
 static std::vector<linear_constraint_t>
-assume_signed_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                       const crab::interval_t& left_interval_positive, const crab::interval_t& left_interval_negative,
+assume_signed_64bit_gt(const bool strict, const variable_t left_svalue, const variable_t left_uvalue,
+                       const interval_t& left_interval_positive, const interval_t& left_interval_negative,
                        const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                       const crab::interval_t& right_interval) {
+                       const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::nonnegative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to<int64_t>().ub();
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
+        // std::numeric_limits<int32_t>::max()].
+        const auto lpub = left_interval_positive.truncate_to<int64_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -354,28 +358,30 @@ assume_signed_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                 left_uvalue <= *lpub.number()};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative(64) &&
                right_interval <= interval_t::negative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
-        // aka [INT_MAX+1, UINT_MAX].
-        return {left_uvalue >= (number_t{INT64_MAX} + 1),
-                strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        // Interval can be represented as both an svalue and a uvalue since it fits in
+        // [std::numeric_limits<int32_t>::min(), -1], aka [std::numeric_limits<int32_t>::max()+1,
+        // Ustd::numeric_limits<int32_t>::max()].
+        return {std::numeric_limits<int64_t>::max() < left_uvalue,
+                strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else {
         // Interval can only be represented as an svalue.
-        return {strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        return {strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     }
 }
 
 static std::vector<linear_constraint_t>
-assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                       const crab::interval_t& left_interval_positive, const crab::interval_t& left_interval_negative,
-                       const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                       const crab::interval_t& right_interval) {
+assume_signed_32bit_gt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                       const variable_t left_uvalue, const interval_t& left_interval_positive,
+                       const interval_t& left_interval_negative, const linear_expression_t& right_svalue,
+                       const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::nonnegative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
+        // std::numeric_limits<int32_t>::max()].
+        const auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
                 left_svalue <= left_uvalue,
@@ -387,13 +393,13 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_sva
                right_interval <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
-        return {left_uvalue >= (number_t{INT32_MAX} + 1),
-                strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        return {left_uvalue >= number_t{INT32_MAX} + 1,
+                strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(32) &&
                inv.eval_interval(right_svalue) <= interval_t::signed_int(32)) {
         // Interval can only be represented as an svalue.
-        return {strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        return {strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else {
         // We can't directly compare the svalues since they may differ in high order bits.
         return {};
@@ -430,17 +436,17 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
     auto lub = left_interval.ub();
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
-    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
+    if (!is_lt && (strict ? lub <= rlb : lub < rlb)) {
         // Left signed interval is lower than right signed interval.
         return {linear_constraint_t::false_const()};
-    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
+    } else if (is_lt && (strict ? llb >= rub : llb > rub)) {
         // Left signed interval is higher than right signed interval.
         return {linear_constraint_t::false_const()};
     }
-    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
+    if (is_lt && (strict ? lub < rlb : lub <= rlb)) {
         // Left signed interval is lower than right signed interval.
         return {linear_constraint_t::true_const()};
-    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
+    } else if (!is_lt && (strict ? llb > rub : llb >= rub)) {
         // Left signed interval is higher than right signed interval.
         return {linear_constraint_t::true_const()};
     }
@@ -450,7 +456,7 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
             return assume_signed_64bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
         } else {
-            return assume_signed_64bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
+            return assume_signed_64bit_gt(strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
         }
     } else {
@@ -468,76 +474,78 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
 
 static std::vector<linear_constraint_t>
 assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                         const crab::interval_t& left_interval_low, const crab::interval_t& left_interval_high,
+                         const interval_t& left_interval_low, const interval_t& left_interval_high,
                          const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                         const crab::interval_t& right_interval) {
+                         const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     auto rub = right_interval.ub();
     auto lllb = left_interval_low.truncate_to<uint64_t>().lb();
-    if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (lllb >= rub) : (lllb > rub))) {
+    if (right_interval <= interval_t::nonnegative(64) && (strict ? lllb >= rub : lllb > rub)) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
-            return {left_uvalue >= 0, ((strict) ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
+            return {left_uvalue >= 0, (strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
                     left_uvalue <= *lsubn, left_svalue >= 0};
         } else {
-            return {left_uvalue >= 0, ((strict) ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
+            return {left_uvalue >= 0, (strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue),
                     left_svalue >= 0};
         }
     }
     auto lhlb = left_interval_high.truncate_to<uint64_t>().lb();
-    if ((right_interval <= interval_t::unsigned_high(64)) && (strict ? (lhlb >= rub) : (lhlb > rub))) {
+    if (right_interval <= interval_t::unsigned_high(64) && (strict ? lhlb >= rub : lhlb > rub)) {
         // The high interval is out of range.
         if (auto lsubn = inv.eval_interval(left_svalue).ub().number()) {
-            return {left_uvalue >= 0, ((strict) ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
+            return {left_uvalue >= 0, (strict ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
                     left_uvalue <= *lsubn, left_svalue >= 0};
         } else {
-            return {left_uvalue >= 0, ((strict) ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
+            return {left_uvalue >= 0, (strict ? left_uvalue < *rub.number() : left_uvalue <= *rub.number()),
                     left_svalue >= 0};
         }
     }
     if (right_interval <= interval_t::signed_int(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
+        // std::numeric_limits<int32_t>::max()].
         auto llub = left_interval_low.truncate_to<uint64_t>().ub();
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
-                left_uvalue <= *llub.number(), number_t{0} <= left_svalue,
-                strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
+                left_uvalue <= *llub.number(), 0 <= left_svalue,
+                strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if (left_interval_low.is_bottom() && right_interval <= interval_t::unsigned_high(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
-                strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        // Interval can be represented as both an svalue and a uvalue since it fits in
+        // [std::numeric_limits<int32_t>::max()+1, Ustd::numeric_limits<int32_t>::max()].
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
+                strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if ((left_interval_low | left_interval_high) == interval_t::unsigned_int(64)) {
         // Interval can only be represented as a uvalue, and was TOP before.
-        return {strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
+        return {strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
     } else {
         // Interval can only be represented as a uvalue.
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
     }
 }
 
 static std::vector<linear_constraint_t>
-assume_unsigned_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                         const crab::interval_t& left_interval_low, const crab::interval_t& left_interval_high,
-                         const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                         const crab::interval_t& right_interval) {
+assume_unsigned_32bit_lt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                         const variable_t left_uvalue, const interval_t& left_interval_low,
+                         const interval_t& left_interval_high, const linear_expression_t& right_svalue,
+                         const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (inv.eval_interval(left_uvalue) <= interval_t::nonnegative(32) &&
         inv.eval_interval(right_uvalue) <= interval_t::nonnegative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT32_MAX].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
-                strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
+                strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if (inv.eval_interval(left_svalue) <= interval_t::negative(32) &&
                inv.eval_interval(right_svalue) <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MIN, -1].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue),
-                strict ? (left_svalue < right_svalue) : (left_svalue <= right_svalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
+                strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
                inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(32)) {
         // Interval can only be represented as a uvalue.
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue < right_uvalue) : (left_uvalue <= right_uvalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
     } else {
         // We can't directly compare the uvalues since they may differ in high order bits.
         return {};
@@ -545,54 +553,56 @@ assume_unsigned_32bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
 }
 
 static std::vector<linear_constraint_t>
-assume_unsigned_64bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                         const crab::interval_t& left_interval_low, const crab::interval_t& left_interval_high,
-                         const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                         const crab::interval_t& right_interval) {
+assume_unsigned_64bit_gt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                         const variable_t left_uvalue, const interval_t& left_interval_low,
+                         const interval_t& left_interval_high, const linear_expression_t& right_svalue,
+                         const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
-    auto rlb = right_interval.lb();
-    auto llub = left_interval_low.truncate_to<uint64_t>().ub();
-    auto lhlb = left_interval_high.truncate_to<uint64_t>().lb();
+    const auto rlb = right_interval.lb();
+    const auto llub = left_interval_low.truncate_to<uint64_t>().ub();
+    const auto lhlb = left_interval_high.truncate_to<uint64_t>().lb();
 
-    if ((right_interval <= interval_t::nonnegative(64)) && (strict ? (llub <= rlb) : (llub < rlb))) {
+    if (right_interval <= interval_t::nonnegative(64) && (strict ? llub <= rlb : llub < rlb)) {
         // The low interval is out of range.
-        return {(strict) ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                (*lhlb.number() == number_t(std::numeric_limits<uint64_t>::max())) ? (left_uvalue == *lhlb.number())
-                                                                                   : (left_uvalue >= *lhlb.number()),
+        return {strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                *lhlb.number() == std::numeric_limits<uint64_t>::max() ? left_uvalue == *lhlb.number()
+                                                                       : left_uvalue >= *lhlb.number(),
                 left_svalue < 0};
     } else if (right_interval <= interval_t::unsigned_high(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        // Interval can be represented as both an svalue and a uvalue since it fits in
+        // [std::numeric_limits<int32_t>::max()+1, Ustd::numeric_limits<int32_t>::max()].
+        return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if ((left_interval_low | left_interval_high) <= interval_t::nonnegative(64) &&
                right_interval <= interval_t::nonnegative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
+        // std::numeric_limits<int32_t>::max()].
+        return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else {
         // Interval can only be represented as a uvalue.
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue};
     }
 }
 
 static std::vector<linear_constraint_t>
-assume_unsigned_32bit_gt(const NumAbsDomain& inv, bool strict, variable_t left_svalue, variable_t left_uvalue,
-                         const crab::interval_t& left_interval_low, const crab::interval_t& left_interval_high,
-                         const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
-                         const crab::interval_t& right_interval) {
+assume_unsigned_32bit_gt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
+                         const variable_t left_uvalue, const interval_t& left_interval_low,
+                         const interval_t& left_interval_high, const linear_expression_t& right_svalue,
+                         const linear_expression_t& right_uvalue, const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::unsigned_high(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MAX+1, UINT32_MAX].
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue),
-                strict ? (left_svalue > right_svalue) : (left_svalue >= right_svalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
+                strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
                inv.eval_interval(right_uvalue) <= interval_t::unsigned_int(32)) {
         // Interval can only be represented as a uvalue.
-        return {number_t{0} <= left_uvalue, strict ? (left_uvalue > right_uvalue) : (left_uvalue >= right_uvalue)};
+        return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue};
     } else {
         // We can't directly compare the uvalues since they may differ in high order bits.
         return {};
@@ -640,14 +650,14 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
     auto lub = left_interval.ub();
     auto rlb = right_interval.lb();
     auto rub = right_interval.ub();
-    if (!is_lt && (strict ? (lub <= rlb) : (lub < rlb))) {
+    if (!is_lt && (strict ? lub <= rlb : lub < rlb)) {
         // Left unsigned interval is lower than right unsigned interval.
         return {linear_constraint_t::false_const()};
-    } else if (is_lt && (strict ? (llb >= rub) : (llb > rub))) {
+    } else if (is_lt && (strict ? llb >= rub : llb > rub)) {
         // Left unsigned interval is higher than right unsigned interval.
         return {linear_constraint_t::false_const()};
     }
-    if (is_lt && (strict ? (lub < rlb) : (lub <= rlb))) {
+    if (is_lt && (strict ? lub < rlb : lub <= rlb)) {
         // Left unsigned interval is lower than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
         if (is64) {
@@ -655,7 +665,7 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
         } else {
             return {linear_constraint_t::true_const()};
         }
-    } else if (!is_lt && (strict ? (llb > rub) : (llb >= rub))) {
+    } else if (!is_lt && (strict ? llb > rub : llb >= rub)) {
         // Left unsigned interval is higher than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
         if (is64) {
@@ -686,8 +696,9 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
 
 /** Linear constraints for a comparison with a constant.
  */
-static std::vector<linear_constraint_t> assume_cst_imm(const NumAbsDomain& inv, Condition::Op op, bool is64,
-                                                       variable_t dst_svalue, variable_t dst_uvalue, int64_t imm) {
+static std::vector<linear_constraint_t> assume_cst_imm(const NumAbsDomain& inv, const Condition::Op op, const bool is64,
+                                                       const variable_t dst_svalue, const variable_t dst_uvalue,
+                                                       const int64_t imm) {
     using namespace crab::dsl_syntax;
     using Op = Condition::Op;
     switch (op) {
@@ -696,33 +707,31 @@ static std::vector<linear_constraint_t> assume_cst_imm(const NumAbsDomain& inv,
     case Op::SLE:
     case Op::SGT:
     case Op::SLT:
-        return assume_signed_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, number_t{imm},
-                                          number_t{(uint64_t)imm});
+        return assume_signed_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm, static_cast<uint64_t>(imm));
     case Op::SET:
-    case Op::NSET: return assume_bit_cst_interval(inv, op, is64, dst_uvalue, crab::interval_t(imm));
+    case Op::NSET: return assume_bit_cst_interval(inv, op, is64, dst_uvalue, interval_t{imm});
     case Op::NE:
     case Op::GE:
     case Op::LE:
     case Op::GT:
     case Op::LT:
-        return assume_unsigned_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, number_t{imm},
-                                            number_t{(uint64_t)imm});
+        return assume_unsigned_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm, static_cast<uint64_t>(imm));
     }
     return {};
 }
 
 /** Linear constraint for a numerical comparison between registers.
  */
-static std::vector<linear_constraint_t> assume_cst_reg(const NumAbsDomain& inv, Condition::Op op, bool is64,
-                                                       variable_t dst_svalue, variable_t dst_uvalue,
-                                                       variable_t src_svalue, variable_t src_uvalue) {
+static std::vector<linear_constraint_t> assume_cst_reg(const NumAbsDomain& inv, const Condition::Op op, const bool is64,
+                                                       const variable_t dst_svalue, const variable_t dst_uvalue,
+                                                       const variable_t src_svalue, const variable_t src_uvalue) {
     using namespace crab::dsl_syntax;
     using Op = Condition::Op;
     if (is64) {
         switch (op) {
         case Op::EQ: {
-            crab::interval_t src_interval = inv.eval_interval(src_svalue);
-            if (!src_interval.is_singleton() && (src_interval <= crab::interval_t::nonnegative(64))) {
+            const interval_t src_interval = inv.eval_interval(src_svalue);
+            if (!src_interval.is_singleton() && src_interval <= interval_t::nonnegative(64)) {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue), eq(dst_svalue, dst_uvalue)};
             } else {
                 return {eq(dst_svalue, src_svalue), eq(dst_uvalue, src_uvalue)};
@@ -761,7 +770,7 @@ static std::vector<linear_constraint_t> assume_cst_reg(const NumAbsDomain& inv,
     throw std::exception();
 }
 
-std::optional<variable_t> ebpf_domain_t::get_type_offset_variable(const Reg& reg, int type) {
+std::optional<variable_t> ebpf_domain_t::get_type_offset_variable(const Reg& reg, const int type) {
     reg_pack_t r = reg_pack(reg);
     switch (type) {
     case T_CTX: return r.ctx_offset;
@@ -798,8 +807,8 @@ ebpf_domain_t ebpf_domain_t::bottom() {
 
 ebpf_domain_t::ebpf_domain_t() : m_inv(NumAbsDomain::top()) {}
 
-ebpf_domain_t::ebpf_domain_t(NumAbsDomain inv, crab::domains::array_domain_t stack)
-    : m_inv(std::move(inv)), stack(stack) {}
+ebpf_domain_t::ebpf_domain_t(NumAbsDomain inv, domains::array_domain_t stack)
+    : m_inv(std::move(inv)), stack(std::move(stack)) {}
 
 void ebpf_domain_t::set_to_top() {
     m_inv.set_to_top();
@@ -812,18 +821,20 @@ bool ebpf_domain_t::is_bottom() const { return m_inv.is_bottom(); }
 
 bool ebpf_domain_t::is_top() const { return m_inv.is_top() && stack.is_top(); }
 
-bool ebpf_domain_t::operator<=(const ebpf_domain_t& other) { return m_inv <= other.m_inv && stack <= other.stack; }
+bool ebpf_domain_t::operator<=(const ebpf_domain_t& other) const {
+    return m_inv <= other.m_inv && stack <= other.stack;
+}
 
 bool ebpf_domain_t::operator==(const ebpf_domain_t& other) const {
     return stack == other.stack && m_inv <= other.m_inv && other.m_inv <= m_inv;
 }
 
-void ebpf_domain_t::TypeDomain::add_extra_invariant(NumAbsDomain& dst,
-                                                    std::map<crab::variable_t, crab::interval_t>& extra_invariants,
-                                                    variable_t type_variable, type_encoding_t type, data_kind_t kind,
-                                                    const NumAbsDomain& src) const {
-    bool dst_has_type = has_type(dst, type_variable, type);
-    bool src_has_type = has_type(src, type_variable, type);
+void ebpf_domain_t::TypeDomain::add_extra_invariant(const NumAbsDomain& dst,
+                                                    std::map<variable_t, interval_t>& extra_invariants,
+                                                    const variable_t type_variable, const type_encoding_t type,
+                                                    const data_kind_t kind, const NumAbsDomain& src) const {
+    const bool dst_has_type = has_type(dst, type_variable, type);
+    const bool src_has_type = has_type(src, type_variable, type);
     variable_t v = variable_t::kind_var(kind, type_variable);
 
     // If type is contained in exactly one of dst or src,
@@ -860,9 +871,9 @@ void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst
     // Output:
     //   r1.type={stack,packet}, r1.stack_offset=100, r1.packet_offset=4
 
-    std::map<crab::variable_t, crab::interval_t> extra_invariants;
+    std::map<variable_t, interval_t> extra_invariants;
     if (!dst.is_bottom()) {
-        for (variable_t v : variable_t::get_type_variables()) {
+        for (const variable_t v : variable_t::get_type_variables()) {
             add_extra_invariant(dst, extra_invariants, v, T_CTX, data_kind_t::ctx_offsets, src);
             add_extra_invariant(dst, extra_invariants, v, T_MAP, data_kind_t::map_fds, src);
             add_extra_invariant(dst, extra_invariants, v, T_MAP_PROGRAMS, data_kind_t::map_fds, src);
@@ -921,8 +932,8 @@ ebpf_domain_t ebpf_domain_t::operator&(const ebpf_domain_t& other) const {
 ebpf_domain_t ebpf_domain_t::calculate_constant_limits() {
     ebpf_domain_t inv;
     using namespace crab::dsl_syntax;
-    for (int i : {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}) {
-        auto r = reg_pack(i);
+    for (const int i : {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}) {
+        const auto r = reg_pack(i);
         inv += r.svalue <= std::numeric_limits<int32_t>::max();
         inv += r.svalue >= std::numeric_limits<int32_t>::min();
         inv += r.uvalue <= std::numeric_limits<uint32_t>::max();
@@ -934,7 +945,7 @@ ebpf_domain_t ebpf_domain_t::calculate_constant_limits() {
         inv += r.packet_offset <= variable_t::packet_size();
         inv += r.packet_offset >= 0;
         if (thread_local_options.check_termination) {
-            for (variable_t counter : variable_t::get_loop_counters()) {
+            for (const variable_t counter : variable_t::get_loop_counters()) {
                 inv += counter <= std::numeric_limits<int32_t>::max();
                 inv += counter >= 0;
                 inv += counter <= r.svalue;
@@ -946,7 +957,7 @@ ebpf_domain_t ebpf_domain_t::calculate_constant_limits() {
 
 static const ebpf_domain_t constant_limits = ebpf_domain_t::calculate_constant_limits();
 
-ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, bool to_constants) {
+ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, const bool to_constants) const {
     ebpf_domain_t res{m_inv.widen(other.m_inv), stack | other.stack};
     if (to_constants) {
         return res & constant_limits;
@@ -954,44 +965,65 @@ ebpf_domain_t ebpf_domain_t::widen(const ebpf_domain_t& other, bool to_constants
     return res;
 }
 
-ebpf_domain_t ebpf_domain_t::narrow(const ebpf_domain_t& other) {
+ebpf_domain_t ebpf_domain_t::narrow(const ebpf_domain_t& other) const {
     return ebpf_domain_t(m_inv.narrow(other.m_inv), stack & other.stack);
 }
 
 void ebpf_domain_t::operator+=(const linear_constraint_t& cst) { m_inv += cst; }
 
-void ebpf_domain_t::operator-=(variable_t var) { m_inv -= var; }
+void ebpf_domain_t::operator-=(const variable_t var) { m_inv -= var; }
 
-void ebpf_domain_t::assign(variable_t x, const linear_expression_t& e) { m_inv.assign(x, e); }
-void ebpf_domain_t::assign(variable_t x, int64_t e) { m_inv.set(x, crab::interval_t(number_t(e))); }
+void ebpf_domain_t::assign(const variable_t x, const linear_expression_t& e) { m_inv.assign(x, e); }
+void ebpf_domain_t::assign(const variable_t x, const int64_t e) { m_inv.set(x, interval_t(e)); }
 
-void ebpf_domain_t::apply(crab::arith_binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width) {
+void ebpf_domain_t::apply(const arith_binop_t op, const variable_t x, const variable_t y, const number_t& z,
+                          const int finite_width) {
     m_inv.apply(op, x, y, z, finite_width);
 }
 
-void ebpf_domain_t::apply(crab::arith_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width) {
+void ebpf_domain_t::apply(const arith_binop_t op, const variable_t x, const variable_t y, const variable_t z,
+                          const int finite_width) {
     m_inv.apply(op, x, y, z, finite_width);
 }
 
-void ebpf_domain_t::apply(crab::bitwise_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width) {
+void ebpf_domain_t::apply(const bitwise_binop_t op, const variable_t x, const variable_t y, const variable_t z,
+                          const int finite_width) {
     m_inv.apply(op, x, y, z, finite_width);
 }
 
-void ebpf_domain_t::apply(crab::bitwise_binop_t op, variable_t x, variable_t y, const number_t& k, int finite_width) {
+void ebpf_domain_t::apply(const bitwise_binop_t op, const variable_t x, const variable_t y, const number_t& k,
+                          const int finite_width) {
     m_inv.apply(op, x, y, k, finite_width);
 }
 
-void ebpf_domain_t::apply(crab::binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width) {
+void ebpf_domain_t::apply(binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width) {
     std::visit([&](auto top) { apply(top, x, y, z, finite_width); }, op);
 }
 
-void ebpf_domain_t::apply(crab::binop_t op, variable_t x, variable_t y, variable_t z, int finite_width) {
+void ebpf_domain_t::apply(binop_t op, variable_t x, variable_t y, variable_t z, int finite_width) {
     std::visit([&](auto top) { apply(top, x, y, z, finite_width); }, op);
 }
 
+static void havoc_offsets(NumAbsDomain& inv, const Reg& reg) {
+    const reg_pack_t r = reg_pack(reg);
+    inv -= r.ctx_offset;
+    inv -= r.map_fd;
+    inv -= r.packet_offset;
+    inv -= r.shared_offset;
+    inv -= r.shared_region_size;
+    inv -= r.stack_offset;
+    inv -= r.stack_numeric_size;
+}
+static void havoc_register(NumAbsDomain& inv, const Reg& reg) {
+    const reg_pack_t r = reg_pack(reg);
+    havoc_offsets(inv, reg);
+    inv -= r.svalue;
+    inv -= r.uvalue;
+}
+
 void ebpf_domain_t::scratch_caller_saved_registers() {
     for (int i = R1_ARG; i <= R5_ARG; i++) {
-        Reg r{(uint8_t)i};
+        Reg r{static_cast<uint8_t>(i)};
         havoc_register(m_inv, r);
         type_inv.havoc_type(m_inv, r);
     }
@@ -1002,8 +1034,8 @@ void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
     // copies of the states of r6 through r9.
     for (int r = R6; r <= R9; r++) {
         for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
-             kind = (data_kind_t)((int)kind + 1)) {
-            variable_t src_var = variable_t::reg(kind, r);
+             kind = static_cast<data_kind_t>(static_cast<int>(kind) + 1)) {
+            const variable_t src_var = variable_t::reg(kind, r);
             if (!m_inv[src_var].is_top()) {
                 assign(variable_t::stack_frame_var(kind, r, prefix), src_var);
             }
@@ -1014,8 +1046,8 @@ void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
 void ebpf_domain_t::restore_callee_saved_registers(const std::string& prefix) {
     for (int r = R6; r <= R9; r++) {
         for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
-             kind = (data_kind_t)((int)kind + 1)) {
-            variable_t src_var = variable_t::stack_frame_var(kind, r, prefix);
+             kind = static_cast<data_kind_t>(static_cast<int>(kind) + 1)) {
+            const variable_t src_var = variable_t::stack_frame_var(kind, r, prefix);
             if (!m_inv[src_var].is_top()) {
                 assign(variable_t::reg(kind, r), src_var);
             } else {
@@ -1029,7 +1061,7 @@ void ebpf_domain_t::restore_callee_saved_registers(const std::string& prefix) {
 void ebpf_domain_t::forget_packet_pointers() {
     using namespace crab::dsl_syntax;
 
-    for (variable_t type_variable : variable_t::get_type_variables()) {
+    for (const variable_t type_variable : variable_t::get_type_variables()) {
         if (type_inv.has_type(m_inv, type_variable, T_PACKET)) {
             havoc(variable_t::kind_var(data_kind_t::types, type_variable));
             havoc(variable_t::kind_var(data_kind_t::packet_offsets, type_variable));
@@ -1041,8 +1073,58 @@ void ebpf_domain_t::forget_packet_pointers() {
     initialize_packet(*this);
 }
 
-void ebpf_domain_t::apply_signed(NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                                 const number_t& z, int finite_width) {
+static void overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t span, int finite_width, bool issigned) {
+    using namespace crab::dsl_syntax;
+    auto interval = inv[lhs];
+    if (interval.ub() - interval.lb() >= span) {
+        // Interval covers the full space.
+        inv -= lhs;
+        return;
+    }
+    if (interval.is_bottom()) {
+        inv -= lhs;
+        return;
+    }
+    number_t lb_value = interval.lb().number().value();
+    number_t ub_value = interval.ub().number().value();
+
+    // Compute the interval, taking overflow into account.
+    // For a signed result, we need to ensure the signed and unsigned results match
+    // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
+    // a sign extended negative one.
+    number_t lb = lb_value.truncate_to_uint(finite_width);
+    number_t ub = ub_value.truncate_to_uint(finite_width);
+    if (issigned) {
+        lb = lb.truncate_to<int64_t>();
+        ub = ub.truncate_to<int64_t>();
+    }
+    if (lb > ub) {
+        // Range wraps in the middle, so we cannot represent as an unsigned interval.
+        inv -= lhs;
+        return;
+    }
+    auto new_interval = interval_t{lb, ub};
+    if (new_interval != interval) {
+        // Update the variable, which will lose any relationships to other variables.
+        inv.set(lhs, new_interval);
+    }
+}
+
+static void overflow_signed(NumAbsDomain& inv, const variable_t lhs, const int finite_width) {
+    const auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
+                    : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
+                                         : throw std::exception()};
+    overflow_bounds(inv, lhs, span, finite_width, true);
+}
+
+static void overflow_unsigned(NumAbsDomain& inv, const variable_t lhs, const int finite_width) {
+    const auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
+                    : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
+                                         : throw std::exception()};
+    overflow_bounds(inv, lhs, span, finite_width, false);
+}
+static void apply_signed(NumAbsDomain& inv, const binop_t& op, const variable_t xs, const variable_t xu,
+                         const variable_t y, const number_t& z, const int finite_width) {
     inv.apply(op, xs, y, z, finite_width);
     if (finite_width) {
         inv.assign(xu, xs);
@@ -1051,8 +1133,8 @@ void ebpf_domain_t::apply_signed(NumAbsDomain& inv, crab::binop_t op, variable_t
     }
 }
 
-void ebpf_domain_t::apply_unsigned(NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                                   const number_t& z, int finite_width) {
+static void apply_unsigned(NumAbsDomain& inv, const binop_t& op, const variable_t xs, const variable_t xu,
+                           const variable_t y, const number_t& z, const int finite_width) {
     inv.apply(op, xu, y, z, finite_width);
     if (finite_width) {
         inv.assign(xs, xu);
@@ -1061,8 +1143,8 @@ void ebpf_domain_t::apply_unsigned(NumAbsDomain& inv, crab::binop_t op, variable
     }
 }
 
-void ebpf_domain_t::apply_signed(NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                                 variable_t z, int finite_width) {
+static void apply_signed(NumAbsDomain& inv, const binop_t& op, const variable_t xs, const variable_t xu,
+                         const variable_t y, const variable_t z, const int finite_width) {
     inv.apply(op, xs, y, z, finite_width);
     if (finite_width) {
         inv.assign(xu, xs);
@@ -1071,8 +1153,8 @@ void ebpf_domain_t::apply_signed(NumAbsDomain& inv, crab::binop_t op, variable_t
     }
 }
 
-void ebpf_domain_t::apply_unsigned(NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                                   variable_t z, int finite_width) {
+static void apply_unsigned(NumAbsDomain& inv, const binop_t& op, const variable_t xs, const variable_t xu,
+                           const variable_t y, const variable_t z, const int finite_width) {
     inv.apply(op, xu, y, z, finite_width);
     if (finite_width) {
         inv.assign(xs, xu);
@@ -1081,106 +1163,109 @@ void ebpf_domain_t::apply_unsigned(NumAbsDomain& inv, crab::binop_t op, variable
     }
 }
 
-void ebpf_domain_t::apply(NumAbsDomain& inv, crab::binop_t op, variable_t x, variable_t y, variable_t z) {
-    inv.apply(op, x, y, z, 0);
+void ebpf_domain_t::add(const variable_t lhs, const variable_t op2) {
+    apply_signed(m_inv, arith_binop_t::ADD, lhs, lhs, lhs, op2, 0);
 }
-
-void ebpf_domain_t::add(variable_t lhs, variable_t op2) {
-    apply_signed(m_inv, crab::arith_binop_t::ADD, lhs, lhs, lhs, op2, 0);
-}
-void ebpf_domain_t::add(variable_t lhs, const number_t& op2) {
-    apply_signed(m_inv, crab::arith_binop_t::ADD, lhs, lhs, lhs, op2, 0);
+void ebpf_domain_t::add(const variable_t lhs, const number_t& op2) {
+    apply_signed(m_inv, arith_binop_t::ADD, lhs, lhs, lhs, op2, 0);
 }
-void ebpf_domain_t::sub(variable_t lhs, variable_t op2) {
-    apply_signed(m_inv, crab::arith_binop_t::SUB, lhs, lhs, lhs, op2, 0);
+void ebpf_domain_t::sub(const variable_t lhs, const variable_t op2) {
+    apply_signed(m_inv, arith_binop_t::SUB, lhs, lhs, lhs, op2, 0);
 }
-void ebpf_domain_t::sub(variable_t lhs, const number_t& op2) {
-    apply_signed(m_inv, crab::arith_binop_t::SUB, lhs, lhs, lhs, op2, 0);
+void ebpf_domain_t::sub(const variable_t lhs, const number_t& op2) {
+    apply_signed(m_inv, arith_binop_t::SUB, lhs, lhs, lhs, op2, 0);
 }
 
 // Add/subtract with overflow are both signed and unsigned. We can use either one of the two to compute the
 // result before adjusting for overflow, though if one is top we want to use the other to retain precision.
-void ebpf_domain_t::add_overflow(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::ADD, lhss, lhsu, ((!m_inv.eval_interval(lhss).is_top()) ? lhss : lhsu),
-                 op2, finite_width);
+void ebpf_domain_t::add_overflow(const variable_t lhss, const variable_t lhsu, const variable_t op2,
+                                 const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::ADD, lhss, lhsu, !m_inv.eval_interval(lhss).is_top() ? lhss : lhsu, op2,
+                 finite_width);
 }
-void ebpf_domain_t::add_overflow(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::ADD, lhss, lhsu, ((!m_inv.eval_interval(lhss).is_top()) ? lhss : lhsu),
-                 op2, finite_width);
+void ebpf_domain_t::add_overflow(const variable_t lhss, const variable_t lhsu, const number_t& op2,
+                                 const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::ADD, lhss, lhsu, !m_inv.eval_interval(lhss).is_top() ? lhss : lhsu, op2,
+                 finite_width);
 }
-void ebpf_domain_t::sub_overflow(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SUB, lhss, lhsu, ((!m_inv.eval_interval(lhss).is_top()) ? lhss : lhsu),
-                 op2, finite_width);
+void ebpf_domain_t::sub_overflow(const variable_t lhss, const variable_t lhsu, const variable_t op2,
+                                 const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SUB, lhss, lhsu, !m_inv.eval_interval(lhss).is_top() ? lhss : lhsu, op2,
+                 finite_width);
 }
-void ebpf_domain_t::sub_overflow(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SUB, lhss, lhsu, ((!m_inv.eval_interval(lhss).is_top()) ? lhss : lhsu),
-                 op2, finite_width);
+void ebpf_domain_t::sub_overflow(const variable_t lhss, const variable_t lhsu, const number_t& op2,
+                                 const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SUB, lhss, lhsu, !m_inv.eval_interval(lhss).is_top() ? lhss : lhsu, op2,
+                 finite_width);
 }
 
-void ebpf_domain_t::neg(variable_t lhss, variable_t lhsu, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::MUL, lhss, lhsu, lhss, (number_t)-1, finite_width);
+void ebpf_domain_t::neg(const variable_t lhss, const variable_t lhsu, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::MUL, lhss, lhsu, lhss, -1, finite_width);
 }
-void ebpf_domain_t::mul(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::MUL, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::mul(const variable_t lhss, const variable_t lhsu, const variable_t op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::MUL, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::mul(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::MUL, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::mul(const variable_t lhss, const variable_t lhsu, const number_t& op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::MUL, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::sdiv(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SDIV, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::sdiv(const variable_t lhss, const variable_t lhsu, const variable_t op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SDIV, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::sdiv(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SDIV, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::sdiv(const variable_t lhss, const variable_t lhsu, const number_t& op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SDIV, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::udiv(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_unsigned(m_inv, crab::arith_binop_t::UDIV, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::udiv(const variable_t lhss, const variable_t lhsu, const variable_t op2, const int finite_width) {
+    apply_unsigned(m_inv, arith_binop_t::UDIV, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::udiv(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_unsigned(m_inv, crab::arith_binop_t::UDIV, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::udiv(const variable_t lhss, const variable_t lhsu, const number_t& op2, const int finite_width) {
+    apply_unsigned(m_inv, arith_binop_t::UDIV, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::srem(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SREM, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::srem(const variable_t lhss, const variable_t lhsu, const variable_t op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SREM, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::srem(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_signed(m_inv, crab::arith_binop_t::SREM, lhss, lhsu, lhss, op2, finite_width);
+void ebpf_domain_t::srem(const variable_t lhss, const variable_t lhsu, const number_t& op2, const int finite_width) {
+    apply_signed(m_inv, arith_binop_t::SREM, lhss, lhsu, lhss, op2, finite_width);
 }
-void ebpf_domain_t::urem(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_unsigned(m_inv, crab::arith_binop_t::UREM, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::urem(const variable_t lhss, const variable_t lhsu, const variable_t op2, const int finite_width) {
+    apply_unsigned(m_inv, arith_binop_t::UREM, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::urem(variable_t lhss, variable_t lhsu, const number_t& op2, int finite_width) {
-    apply_unsigned(m_inv, crab::arith_binop_t::UREM, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::urem(const variable_t lhss, const variable_t lhsu, const number_t& op2, const int finite_width) {
+    apply_unsigned(m_inv, arith_binop_t::UREM, lhss, lhsu, lhsu, op2, finite_width);
 }
 
-void ebpf_domain_t::bitwise_and(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::AND, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::bitwise_and(const variable_t lhss, const variable_t lhsu, const variable_t op2,
+                                const int finite_width) {
+    apply_unsigned(m_inv, bitwise_binop_t::AND, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::bitwise_and(variable_t lhss, variable_t lhsu, const number_t& op2) {
+void ebpf_domain_t::bitwise_and(const variable_t lhss, const variable_t lhsu, const number_t& op2) {
     // Use finite width 64 to make the svalue be set as well as the uvalue.
-    apply_unsigned(m_inv, crab::bitwise_binop_t::AND, lhss, lhsu, lhsu, op2, 64);
+    apply_unsigned(m_inv, bitwise_binop_t::AND, lhss, lhsu, lhsu, op2, 64);
 }
-void ebpf_domain_t::bitwise_or(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::OR, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::bitwise_or(const variable_t lhss, const variable_t lhsu, const variable_t op2,
+                               const int finite_width) {
+    apply_unsigned(m_inv, bitwise_binop_t::OR, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::bitwise_or(variable_t lhss, variable_t lhsu, const number_t& op2) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::OR, lhss, lhsu, lhsu, op2, 64);
+void ebpf_domain_t::bitwise_or(const variable_t lhss, const variable_t lhsu, const number_t& op2) {
+    apply_unsigned(m_inv, bitwise_binop_t::OR, lhss, lhsu, lhsu, op2, 64);
 }
-void ebpf_domain_t::bitwise_xor(variable_t lhss, variable_t lhsu, variable_t op2, int finite_width) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::XOR, lhss, lhsu, lhsu, op2, finite_width);
+void ebpf_domain_t::bitwise_xor(const variable_t lhss, const variable_t lhsu, const variable_t op2,
+                                const int finite_width) {
+    apply_unsigned(m_inv, bitwise_binop_t::XOR, lhss, lhsu, lhsu, op2, finite_width);
 }
-void ebpf_domain_t::bitwise_xor(variable_t lhss, variable_t lhsu, const number_t& op2) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::XOR, lhss, lhsu, lhsu, op2, 64);
+void ebpf_domain_t::bitwise_xor(const variable_t lhss, const variable_t lhsu, const number_t& op2) {
+    apply_unsigned(m_inv, bitwise_binop_t::XOR, lhss, lhsu, lhsu, op2, 64);
 }
-void ebpf_domain_t::shl_overflow(variable_t lhss, variable_t lhsu, variable_t op2) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::SHL, lhss, lhsu, lhsu, op2, 64);
+void ebpf_domain_t::shl_overflow(const variable_t lhss, const variable_t lhsu, const variable_t op2) {
+    apply_unsigned(m_inv, bitwise_binop_t::SHL, lhss, lhsu, lhsu, op2, 64);
 }
-void ebpf_domain_t::shl_overflow(variable_t lhss, variable_t lhsu, const number_t& op2) {
-    apply_unsigned(m_inv, crab::bitwise_binop_t::SHL, lhss, lhsu, lhsu, op2, 64);
+void ebpf_domain_t::shl_overflow(const variable_t lhss, const variable_t lhsu, const number_t& op2) {
+    apply_unsigned(m_inv, bitwise_binop_t::SHL, lhss, lhsu, lhsu, op2, 64);
 }
 
 static void assume(NumAbsDomain& inv, const linear_constraint_t& cst) { inv += cst; }
 void ebpf_domain_t::assume(const linear_constraint_t& cst) { crab::assume(m_inv, cst); }
 
-void ebpf_domain_t::require(NumAbsDomain& inv, const linear_constraint_t& cst, const std::string& s) {
+void ebpf_domain_t::require(NumAbsDomain& inv, const linear_constraint_t& cst, const std::string& s) const {
     if (check_require) {
         check_require(inv, cst, s + " (" + this->current_assertion + ")");
     }
@@ -1191,26 +1276,10 @@ void ebpf_domain_t::require(NumAbsDomain& inv, const linear_constraint_t& cst, c
 }
 
 /// Forget everything we know about the value of a variable.
-void ebpf_domain_t::havoc(variable_t v) { m_inv -= v; }
-void ebpf_domain_t::havoc_offsets(NumAbsDomain& inv, const Reg& reg) {
-    reg_pack_t r = reg_pack(reg);
-    inv -= r.ctx_offset;
-    inv -= r.map_fd;
-    inv -= r.packet_offset;
-    inv -= r.shared_offset;
-    inv -= r.shared_region_size;
-    inv -= r.stack_offset;
-    inv -= r.stack_numeric_size;
-}
-void ebpf_domain_t::havoc_offsets(const Reg& reg) { havoc_offsets(m_inv, reg); }
-void ebpf_domain_t::havoc_register(NumAbsDomain& inv, const Reg& reg) {
-    reg_pack_t r = reg_pack(reg);
-    havoc_offsets(inv, reg);
-    inv -= r.svalue;
-    inv -= r.uvalue;
-}
+void ebpf_domain_t::havoc(const variable_t v) { m_inv -= v; }
+void ebpf_domain_t::havoc_offsets(const Reg& reg) { crab::havoc_offsets(m_inv, reg); }
 
-void ebpf_domain_t::assign(variable_t lhs, variable_t rhs) { m_inv.assign(lhs, rhs); }
+void ebpf_domain_t::assign(const variable_t lhs, const variable_t rhs) { m_inv.assign(lhs, rhs); }
 
 static linear_constraint_t type_is_pointer(const reg_pack_t& r) {
     using namespace crab::dsl_syntax;
@@ -1229,7 +1298,7 @@ static linear_constraint_t type_is_not_stack(const reg_pack_t& r) {
     return r.type != T_STACK;
 }
 
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, type_encoding_t t) {
+void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const type_encoding_t t) {
     inv.assign(reg_pack(lhs).type, t);
 }
 
@@ -1237,11 +1306,12 @@ void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, c
     inv.assign(reg_pack(lhs).type, reg_pack(rhs).type);
 }
 
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const Reg& rhs) {
+void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs, const Reg& rhs) {
     inv.assign(lhs, reg_pack(rhs).type);
 }
 
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const number_t& rhs) {
+void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs,
+                                            const number_t& rhs) {
     inv.assign(lhs, rhs);
 }
 
@@ -1253,60 +1323,67 @@ void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs,
 void ebpf_domain_t::TypeDomain::havoc_type(NumAbsDomain& inv, const Reg& r) { inv -= reg_pack(r).type; }
 
 int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const Reg& r) const {
-    auto res = inv[reg_pack(r).type].singleton();
+    const auto res = inv[reg_pack(r).type].singleton();
     if (!res) {
         return T_UNINIT;
     }
-    return (int)*res;
+    return static_cast<int>(*res);
 }
 
-int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, variable_t v) const {
-    auto res = inv[v].singleton();
+int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const variable_t v) const {
+    const auto res = inv[v].singleton();
     if (!res) {
         return T_UNINIT;
     }
-    return (int)*res;
+    return static_cast<int>(*res);
 }
 
-int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const number_t& t) const { return (int)t; }
+int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const number_t& t) const {
+    return static_cast<int>(t);
+}
 
 // Check whether a given type value is within the range of a given type variable's value.
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const {
-    crab::interval_t interval = inv[reg_pack(r).type];
+bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const Reg& r, const type_encoding_t type) const {
+    const interval_t interval = inv[reg_pack(r).type];
     if (interval.is_top()) {
         return true;
     }
-    return (interval.lb().number().value_or(INT_MIN) <= type) && (interval.ub().number().value_or(INT_MAX) >= type);
+    return interval.lb().number().value_or(std::numeric_limits<int32_t>::min()) <= type &&
+           interval.ub().number().value_or(std::numeric_limits<int32_t>::max()) >= type;
 }
 
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const {
-    crab::interval_t interval = inv[v];
+bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const variable_t v,
+                                         const type_encoding_t type) const {
+    const interval_t interval = inv[v];
     if (interval.is_top()) {
         return true;
     }
-    return (interval.lb().number().value_or(INT_MIN) <= type) && (interval.ub().number().value_or(INT_MAX) >= type);
+    return interval.lb().number().value_or(std::numeric_limits<int32_t>::min()) <= type &&
+           type <= interval.ub().number().value_or(std::numeric_limits<int32_t>::max());
 }
 
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const {
-    return t == number_t{type};
+bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const number_t& t, const type_encoding_t type) const {
+    return t == type;
 }
 
 NumAbsDomain ebpf_domain_t::TypeDomain::join_over_types(
     const NumAbsDomain& inv, const Reg& reg,
     const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const {
-    crab::interval_t types = inv.eval_interval(reg_pack(reg).type);
+    interval_t types = inv.eval_interval(reg_pack(reg).type);
     if (types.is_bottom()) {
         return NumAbsDomain::bottom();
     }
     if (types.is_top()) {
         NumAbsDomain res(inv);
-        transition(res, static_cast<type_encoding_t>(T_UNINIT));
+        transition(res, T_UNINIT);
         return res;
     }
     NumAbsDomain res = NumAbsDomain::bottom();
-    auto lb = types.lb().is_finite() ? (type_encoding_t)(int)(types.lb().number().value()) : T_MAP_PROGRAMS;
-    auto ub = types.ub().is_finite() ? (type_encoding_t)(int)(types.ub().number().value()) : T_SHARED;
-    for (type_encoding_t type = lb; type <= ub; type = (type_encoding_t)((int)type + 1)) {
+    auto lb = types.lb().is_finite() ? static_cast<type_encoding_t>(static_cast<int>(types.lb().number().value()))
+                                     : T_MAP_PROGRAMS;
+    auto ub =
+        types.ub().is_finite() ? static_cast<type_encoding_t>(static_cast<int>(types.ub().number().value())) : T_SHARED;
+    for (type_encoding_t type = lb; type <= ub; type = static_cast<type_encoding_t>(static_cast<int>(type) + 1)) {
         NumAbsDomain tmp(inv);
         transition(tmp, type);
         selectively_join_based_on_type(res, tmp); // res |= tmp;
@@ -1335,9 +1412,9 @@ bool ebpf_domain_t::TypeDomain::implies_type(const NumAbsDomain& inv, const line
     return inv.when(a).entail(b);
 }
 
-bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const {
+bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg& r, const TypeGroup group) const {
     using namespace crab::dsl_syntax;
-    variable_t t = reg_pack(r).type;
+    const variable_t t = reg_pack(r).type;
     switch (group) {
     case TypeGroup::number: return inv.entail(t == T_NUM);
     case TypeGroup::map_fd: return inv.entail(t == T_MAP);
@@ -1358,57 +1435,6 @@ bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg&
     return false;
 }
 
-void ebpf_domain_t::overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t span, int finite_width, bool issigned) {
-    using namespace crab::dsl_syntax;
-    auto interval = inv[lhs];
-    if (interval.ub() - interval.lb() >= span) {
-        // Interval covers the full space.
-        inv -= lhs;
-        return;
-    }
-    if (interval.is_bottom()) {
-        inv -= lhs;
-        return;
-    }
-    number_t lb_value = interval.lb().number().value();
-    number_t ub_value = interval.ub().number().value();
-
-    // Compute the interval, taking overflow into account.
-    // For a signed result, we need to ensure the signed and unsigned results match
-    // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
-    // a sign extended negative one.
-    number_t lb = lb_value.truncate_to_uint(finite_width);
-    number_t ub = ub_value.truncate_to_uint(finite_width);
-    if (issigned) {
-        lb = lb.truncate_to<int64_t>();
-        ub = ub.truncate_to<int64_t>();
-    }
-    if (lb > ub) {
-        // Range wraps in the middle, so we cannot represent as an unsigned interval.
-        inv -= lhs;
-        return;
-    }
-    auto new_interval = crab::interval_t{lb, ub};
-    if (new_interval != interval) {
-        // Update the variable, which will lose any relationships to other variables.
-        inv.set(lhs, new_interval);
-    }
-}
-
-void ebpf_domain_t::overflow_signed(NumAbsDomain& inv, variable_t lhs, int finite_width) {
-    auto span{finite_width == 64   ? crab::number_t{std::numeric_limits<uint64_t>::max()}
-              : finite_width == 32 ? crab::number_t{std::numeric_limits<uint32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(inv, lhs, span, finite_width, true);
-}
-
-void ebpf_domain_t::overflow_unsigned(NumAbsDomain& inv, variable_t lhs, int finite_width) {
-    auto span{finite_width == 64   ? crab::number_t{std::numeric_limits<uint64_t>::max()}
-              : finite_width == 32 ? crab::number_t{std::numeric_limits<uint32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(inv, lhs, span, finite_width, false);
-}
-
 void ebpf_domain_t::operator()(const basic_block_t& bb) {
     for (const Instruction& statement : bb) {
         std::visit(*this, statement);
@@ -1416,14 +1442,14 @@ void ebpf_domain_t::operator()(const basic_block_t& bb) {
 }
 
 void ebpf_domain_t::check_access_stack(NumAbsDomain& inv, const linear_expression_t& lb,
-                                       const linear_expression_t& ub) {
+                                       const linear_expression_t& ub) const {
     using namespace crab::dsl_syntax;
     require(inv, lb >= 0, "Lower bound must be at least 0");
     require(inv, ub <= EBPF_STACK_SIZE, "Upper bound must be at most EBPF_STACK_SIZE");
 }
 
 void ebpf_domain_t::check_access_context(NumAbsDomain& inv, const linear_expression_t& lb,
-                                         const linear_expression_t& ub) {
+                                         const linear_expression_t& ub) const {
     using namespace crab::dsl_syntax;
     require(inv, lb >= 0, "Lower bound must be at least 0");
     require(inv, ub <= global_program_info->type.context_descriptor->size,
@@ -1432,7 +1458,7 @@ void ebpf_domain_t::check_access_context(NumAbsDomain& inv, const linear_express
 }
 
 void ebpf_domain_t::check_access_packet(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                                        std::optional<variable_t> packet_size) {
+                                        const std::optional<variable_t> packet_size) const {
     using namespace crab::dsl_syntax;
     require(inv, lb >= variable_t::meta_offset(), "Lower bound must be at least meta_offset");
     if (packet_size) {
@@ -1444,20 +1470,20 @@ void ebpf_domain_t::check_access_packet(NumAbsDomain& inv, const linear_expressi
 }
 
 void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                                        variable_t region_size) {
+                                        const variable_t region_size) const {
     using namespace crab::dsl_syntax;
     require(inv, lb >= 0, "Lower bound must be at least 0");
     require(inv, ub <= region_size, std::string("Upper bound must be at most ") + region_size.name());
 }
 
 void ebpf_domain_t::operator()(const Assume& s) {
-    Condition cond = s.cond;
-    auto dst = reg_pack(cond.left);
+    const Condition cond = s.cond;
+    const auto dst = reg_pack(cond.left);
     if (std::holds_alternative<Reg>(cond.right)) {
-        auto src_reg = std::get<Reg>(cond.right);
-        auto src = reg_pack(src_reg);
+        const auto src_reg = std::get<Reg>(cond.right);
+        const auto src = reg_pack(src_reg);
         if (type_inv.same_type(m_inv, cond.left, std::get<Reg>(cond.right))) {
-            m_inv = type_inv.join_over_types(m_inv, cond.left, [&](NumAbsDomain& inv, type_encoding_t type) {
+            m_inv = type_inv.join_over_types(m_inv, cond.left, [&](NumAbsDomain& inv, const type_encoding_t type) {
                 if (type == T_NUM) {
                     for (const linear_constraint_t& cst :
                          assume_cst_reg(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, src.svalue, src.uvalue)) {
@@ -1466,8 +1492,8 @@ void ebpf_domain_t::operator()(const Assume& s) {
                 } else {
                     // Either pointers to a singleton region,
                     // or an equality comparison on map descriptors/pointers to non-singleton locations
-                    if (auto dst_offset = get_type_offset_variable(cond.left, type)) {
-                        if (auto src_offset = get_type_offset_variable(src_reg, type)) {
+                    if (const auto dst_offset = get_type_offset_variable(cond.left, type)) {
+                        if (const auto src_offset = get_type_offset_variable(src_reg, type)) {
                             inv += assume_cst_offsets_reg(cond.op, cond.is64, dst_offset.value(), src_offset.value());
                         }
                     }
@@ -1480,7 +1506,7 @@ void ebpf_domain_t::operator()(const Assume& s) {
             m_inv.set_to_top();
         }
     } else {
-        int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
+        const int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
         for (const linear_constraint_t& cst : assume_cst_imm(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, imm)) {
             assume(cst);
         }
@@ -1491,20 +1517,17 @@ void ebpf_domain_t::operator()(const Undefined& a) {}
 
 // Simple truncation function usable with swap_endianness().
 template <class T>
-BOOST_CONSTEXPR T truncate(T x) BOOST_NOEXCEPT {
+constexpr T truncate(T x) noexcept {
     return x;
 }
 
 void ebpf_domain_t::operator()(const Un& stmt) {
-    auto dst = reg_pack(stmt.dst);
-    auto swap_endianness = [&](variable_t v, auto input, const auto& be_or_le) {
+    const auto dst = reg_pack(stmt.dst);
+    auto swap_endianness = [&](const variable_t v, auto be_or_le) {
         if (m_inv.entail(type_is_number(stmt.dst))) {
-            auto interval = m_inv.eval_interval(v);
-            if (std::optional<number_t> n = interval.singleton()) {
+            if (const auto n = m_inv.eval_interval(v).singleton()) {
                 if (n->fits_cast_to<int64_t>()) {
-                    input = (decltype(input))n.value().cast_to<int64_t>();
-                    decltype(input) output = be_or_le(input);
-                    m_inv.set(v, crab::interval_t(number_t(output), number_t(output)));
+                    m_inv.set(v, interval_t{be_or_le(n->cast_to<int64_t>())});
                     return;
                 }
             }
@@ -1518,63 +1541,63 @@ void ebpf_domain_t::operator()(const Un& stmt) {
     switch (stmt.op) {
     case Un::Op::BE16:
         if (!thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
-            swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint16_t>);
         } else {
-            swap_endianness(dst.svalue, uint16_t(0), truncate<uint16_t>);
-            swap_endianness(dst.uvalue, uint16_t(0), truncate<uint16_t>);
+            swap_endianness(dst.svalue, truncate<uint16_t>);
+            swap_endianness(dst.uvalue, truncate<uint16_t>);
         }
         break;
     case Un::Op::BE32:
         if (!thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
-            swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint32_t>);
         } else {
-            swap_endianness(dst.svalue, uint32_t(0), truncate<uint32_t>);
-            swap_endianness(dst.uvalue, uint32_t(0), truncate<uint32_t>);
+            swap_endianness(dst.svalue, truncate<uint32_t>);
+            swap_endianness(dst.uvalue, truncate<uint32_t>);
         }
         break;
     case Un::Op::BE64:
         if (!thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
-            swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<int64_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint64_t>);
         }
         break;
     case Un::Op::LE16:
         if (thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
-            swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<uint16_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint16_t>);
         } else {
-            swap_endianness(dst.svalue, uint16_t(0), truncate<uint16_t>);
-            swap_endianness(dst.uvalue, uint16_t(0), truncate<uint16_t>);
+            swap_endianness(dst.svalue, truncate<uint16_t>);
+            swap_endianness(dst.uvalue, truncate<uint16_t>);
         }
         break;
     case Un::Op::LE32:
         if (thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
-            swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<uint32_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint32_t>);
         } else {
-            swap_endianness(dst.svalue, uint32_t(0), truncate<uint32_t>);
-            swap_endianness(dst.uvalue, uint32_t(0), truncate<uint32_t>);
+            swap_endianness(dst.svalue, truncate<uint32_t>);
+            swap_endianness(dst.uvalue, truncate<uint32_t>);
         }
         break;
     case Un::Op::LE64:
         if (thread_local_options.big_endian) {
-            swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
-            swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+            swap_endianness(dst.svalue, boost::endian::endian_reverse<int64_t>);
+            swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint64_t>);
         }
         break;
     case Un::Op::SWAP16:
-        swap_endianness(dst.svalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
-        swap_endianness(dst.uvalue, uint16_t(0), boost::endian::endian_reverse<uint16_t>);
+        swap_endianness(dst.svalue, boost::endian::endian_reverse<uint16_t>);
+        swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint16_t>);
         break;
     case Un::Op::SWAP32:
-        swap_endianness(dst.svalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
-        swap_endianness(dst.uvalue, uint32_t(0), boost::endian::endian_reverse<uint32_t>);
+        swap_endianness(dst.svalue, boost::endian::endian_reverse<uint32_t>);
+        swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint32_t>);
         break;
     case Un::Op::SWAP64:
-        swap_endianness(dst.svalue, int64_t(0), boost::endian::endian_reverse<int64_t>);
-        swap_endianness(dst.uvalue, uint64_t(0), boost::endian::endian_reverse<uint64_t>);
+        swap_endianness(dst.svalue, boost::endian::endian_reverse<int64_t>);
+        swap_endianness(dst.uvalue, boost::endian::endian_reverse<uint64_t>);
         break;
     case Un::Op::NEG:
         neg(dst.svalue, dst.uvalue, stmt.is64 ? 64 : 32);
@@ -1585,7 +1608,7 @@ void ebpf_domain_t::operator()(const Un& stmt) {
 
 void ebpf_domain_t::operator()(const Exit& a) {
     // Clean up any state for the current stack frame.
-    std::string prefix = a.stack_frame_prefix;
+    const std::string prefix = a.stack_frame_prefix;
     if (prefix.empty()) {
         return;
     }
@@ -1623,12 +1646,12 @@ void ebpf_domain_t::operator()(const Addable& s) {
 
 void ebpf_domain_t::operator()(const ValidDivisor& s) {
     using namespace crab::dsl_syntax;
-    auto reg = reg_pack(s.reg);
+    const auto reg = reg_pack(s.reg);
     if (!type_inv.implies_type(m_inv, type_is_pointer(reg), type_is_number(s.reg))) {
         require(m_inv, linear_constraint_t::false_const(), "Only numbers can be used as divisors");
     }
     if (!thread_local_options.allow_division_by_zero) {
-        auto v = s.is_signed ? reg.svalue : reg.uvalue;
+        const auto v = s.is_signed ? reg.svalue : reg.uvalue;
         require(m_inv, v != 0, "Possible division by zero");
     }
 }
@@ -1669,7 +1692,7 @@ void ebpf_domain_t::operator()(const FuncConstraint& s) {
 
 void ebpf_domain_t::operator()(const ValidSize& s) {
     using namespace crab::dsl_syntax;
-    auto r = reg_pack(s.reg);
+    const auto r = reg_pack(s.reg);
     require(m_inv, s.can_be_zero ? r.svalue >= 0 : r.svalue > 0, "Invalid size");
 }
 
@@ -1677,18 +1700,18 @@ void ebpf_domain_t::operator()(const ValidSize& s) {
 // In the future, it would be cleaner to use a set rather than an interval
 // for map fds.
 bool ebpf_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, int32_t* end_fd) const {
-    const crab::interval_t& map_fd_interval = m_inv[reg_pack(map_fd_reg).map_fd];
-    auto lb = map_fd_interval.lb().number();
-    auto ub = map_fd_interval.ub().number();
+    const interval_t& map_fd_interval = m_inv[reg_pack(map_fd_reg).map_fd];
+    const auto lb = map_fd_interval.lb().number();
+    const auto ub = map_fd_interval.ub().number();
     if (!lb || !lb->fits<int32_t>() || !ub || !ub->fits<int32_t>()) {
         return false;
     }
-    *start_fd = (int32_t)lb.value();
-    *end_fd = (int32_t)ub.value();
+    *start_fd = static_cast<int32_t>(lb.value());
+    *end_fd = static_cast<int32_t>(ub.value());
 
     // Cap the maximum range we'll check.
-    const int max_range = 32;
-    return (*map_fd_interval.finite_size() < max_range);
+    constexpr int max_range = 32;
+    return *map_fd_interval.finite_size() < max_range;
 }
 
 // All maps in the range must have the same type for us to use it.
@@ -1736,54 +1759,54 @@ std::optional<uint32_t> ebpf_domain_t::get_map_inner_map_fd(const Reg& map_fd_re
 }
 
 // We can deal with a range of key sizes.
-crab::interval_t ebpf_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
+interval_t ebpf_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
     if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
-        return crab::interval_t::top();
+        return interval_t::top();
     }
 
-    crab::interval_t result = crab::interval_t::bottom();
+    interval_t result = interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
-            result = result | crab::interval_t(number_t(map->key_size));
+        if (const EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t{map->key_size};
         } else {
-            return crab::interval_t::top();
+            return interval_t::top();
         }
     }
     return result;
 }
 
 // We can deal with a range of value sizes.
-crab::interval_t ebpf_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
+interval_t ebpf_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
     if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
-        return crab::interval_t::top();
+        return interval_t::top();
     }
 
-    crab::interval_t result = crab::interval_t::bottom();
+    interval_t result = interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
-            result = result | crab::interval_t(number_t(map->value_size));
+        if (const EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t(map->value_size);
         } else {
-            return crab::interval_t::top();
+            return interval_t::top();
         }
     }
     return result;
 }
 
 // We can deal with a range of max_entries values.
-crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const {
+interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const {
     int start_fd, end_fd;
     if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd)) {
-        return crab::interval_t::top();
+        return interval_t::top();
     }
 
-    crab::interval_t result = crab::interval_t::bottom();
+    interval_t result = interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
-            result = result | crab::interval_t(number_t(map->max_entries));
+        if (const EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t(map->max_entries);
         } else {
-            return crab::interval_t::top();
+            return interval_t::top();
         }
     }
     return result;
@@ -1791,7 +1814,7 @@ crab::interval_t ebpf_domain_t::get_map_max_entries(const Reg& map_fd_reg) const
 
 void ebpf_domain_t::operator()(const ValidCall& s) {
     if (!s.stack_frame_prefix.empty()) {
-        EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(s.func);
+        const EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(s.func);
         if (proto.return_type == EBPF_RETURN_TYPE_INTEGER_OR_NO_RETURN_IF_SUCCEED) {
             require(m_inv, linear_constraint_t::false_const(), "tail call not supported in subprogram");
             return;
@@ -1802,24 +1825,24 @@ void ebpf_domain_t::operator()(const ValidCall& s) {
 void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
     using namespace crab::dsl_syntax;
 
-    auto fd_type = get_map_type(s.map_fd_reg);
+    const auto fd_type = get_map_type(s.map_fd_reg);
 
-    auto access_reg = reg_pack(s.access_reg);
+    const auto access_reg = reg_pack(s.access_reg);
     int width;
     if (s.key) {
-        auto key_size = get_map_key_size(s.map_fd_reg).singleton();
+        const auto key_size = get_map_key_size(s.map_fd_reg).singleton();
         if (!key_size.has_value()) {
             require(m_inv, linear_constraint_t::false_const(), "Map key size is not singleton");
             return;
         }
-        width = (int)key_size.value();
+        width = static_cast<int>(key_size.value());
     } else {
-        auto value_size = get_map_value_size(s.map_fd_reg).singleton();
+        const auto value_size = get_map_value_size(s.map_fd_reg).singleton();
         if (!value_size.has_value()) {
             require(m_inv, linear_constraint_t::false_const(), "Map value size is not singleton");
             return;
         }
-        width = (int)value_size.value();
+        width = static_cast<int>(value_size.value());
     }
 
     m_inv = type_inv.join_over_types(m_inv, s.access_reg, [&](NumAbsDomain& inv, type_encoding_t access_reg_type) {
@@ -1828,9 +1851,11 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             linear_expression_t ub = lb + width;
             if (!stack.all_num(inv, lb, ub)) {
                 auto lb_is = inv[lb].lb().number();
-                std::string lb_s = lb_is && lb_is->fits<int32_t>() ? std::to_string((int32_t)*lb_is) : "-oo";
+                std::string lb_s =
+                    lb_is && lb_is->fits<int32_t>() ? std::to_string(static_cast<int32_t>(*lb_is)) : "-oo";
                 auto ub_is = inv.eval_interval(ub).ub().number();
-                std::string ub_s = ub_is && ub_is->fits<int32_t>() ? std::to_string((int32_t)*ub_is) : "oo";
+                std::string ub_s =
+                    ub_is && ub_is->fits<int32_t>() ? std::to_string(static_cast<int32_t>(*ub_is)) : "oo";
                 require(inv, linear_constraint_t::false_const(),
                         "Illegal map update with a non-numerical value [" + lb_s + "-" + ub_s + ")");
             } else if (thread_local_options.strict && fd_type.has_value()) {
@@ -1844,7 +1869,7 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
                     } else if (s.key) {
                         // Look up the value pointed to by the key pointer.
                         variable_t key_value =
-                            variable_t::cell_var(data_kind_t::svalues, (uint64_t)offset.value(), sizeof(uint32_t));
+                            variable_t::cell_var(data_kind_t::svalues, offset.value(), sizeof(uint32_t));
 
                         if (auto max_entries = get_map_max_entries(s.map_fd_reg).lb().number()) {
                             require(inv, key_value < *max_entries, "Array index overflow");
@@ -1875,9 +1900,9 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
 void ebpf_domain_t::operator()(const ValidAccess& s) {
     using namespace crab::dsl_syntax;
 
-    bool is_comparison_check = s.width == (Value)Imm{0};
+    const bool is_comparison_check = s.width == static_cast<Value>(Imm{0});
 
-    auto reg = reg_pack(s.reg);
+    const auto reg = reg_pack(s.reg);
     // join_over_types instead of simple iteration is only needed for assume-assert
     m_inv = type_inv.join_over_types(m_inv, s.reg, [&](NumAbsDomain& inv, type_encoding_t type) {
         switch (type) {
@@ -1905,7 +1930,8 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                     if (s.offset < 0) {
                         require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                     } else if (std::holds_alternative<Imm>(s.width)) {
-                        if (!inv.entail(((int)std::get<Imm>(s.width).v) <= reg.stack_numeric_size - s.offset)) {
+                        if (!inv.entail(static_cast<int>(std::get<Imm>(s.width).v) <=
+                                        reg.stack_numeric_size - s.offset)) {
                             require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                         }
                     } else {
@@ -1961,7 +1987,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
 
 void ebpf_domain_t::operator()(const ZeroCtxOffset& s) {
     using namespace crab::dsl_syntax;
-    auto reg = reg_pack(s.reg);
+    const auto reg = reg_pack(s.reg);
     require(m_inv, reg.ctx_offset == 0, "Nonzero context offset");
 }
 
@@ -1974,8 +2000,8 @@ void ebpf_domain_t::operator()(const Assert& stmt) {
 }
 
 void ebpf_domain_t::operator()(const Packet& a) {
-    auto reg = reg_pack(R0_RETURN_VALUE);
-    Reg r0_reg{(uint8_t)R0_RETURN_VALUE};
+    const auto reg = reg_pack(R0_RETURN_VALUE);
+    constexpr Reg r0_reg{R0_RETURN_VALUE};
     type_inv.assign_type(m_inv, r0_reg, T_NUM);
     havoc_offsets(r0_reg);
     havoc(reg.svalue);
@@ -1983,8 +2009,8 @@ void ebpf_domain_t::operator()(const Packet& a) {
     scratch_caller_saved_registers();
 }
 
-void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr, int width,
-                                  const Reg& src_reg) {
+void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr,
+                                  const int width, const Reg& src_reg) {
     type_inv.assign_type(inv, target_reg, stack.load(inv, data_kind_t::types, addr, width));
     using namespace crab::dsl_syntax;
     if (inv.entail(width <= reg_pack(src_reg).stack_numeric_size)) {
@@ -1995,8 +2021,8 @@ void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, cons
     if (width == 1 || width == 2 || width == 4 || width == 8) {
         // Use the addr before we havoc the destination register since we might be getting the
         // addr from that same register.
-        std::optional<linear_expression_t> sresult = stack.load(inv, data_kind_t::svalues, addr, width);
-        std::optional<linear_expression_t> uresult = stack.load(inv, data_kind_t::uvalues, addr, width);
+        const std::optional<linear_expression_t> sresult = stack.load(inv, data_kind_t::svalues, addr, width);
+        const std::optional<linear_expression_t> uresult = stack.load(inv, data_kind_t::uvalues, addr, width);
         havoc_register(inv, target_reg);
         inv.assign(target.svalue, sresult);
         inv.assign(target.uvalue, uresult);
@@ -2024,7 +2050,7 @@ void ebpf_domain_t::do_load_stack(NumAbsDomain& inv, const Reg& target_reg, cons
 }
 
 void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr_vague,
-                                int width) {
+                                const int width) {
     using namespace crab::dsl_syntax;
     if (inv.is_bottom()) {
         return;
@@ -2040,11 +2066,12 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
         return;
     }
 
-    crab::interval_t interval = inv.eval_interval(addr_vague);
-    std::optional<number_t> maybe_addr = interval.singleton();
+    const interval_t interval = inv.eval_interval(addr_vague);
+    const std::optional<number_t> maybe_addr = interval.singleton();
     havoc_register(inv, target_reg);
 
-    bool may_touch_ptr = interval.contains(desc->data) || interval.contains(desc->meta) || interval.contains(desc->end);
+    const bool may_touch_ptr =
+        interval.contains(desc->data) || interval.contains(desc->meta) || interval.contains(desc->end);
 
     if (!maybe_addr) {
         if (may_touch_ptr) {
@@ -2055,13 +2082,13 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
         return;
     }
 
-    number_t addr = *maybe_addr;
+    const number_t addr = *maybe_addr;
 
     // We use offsets for packet data, data_end, and meta during verification,
     // but at runtime they will be 64-bit pointers.  We can use the offset values
     // for verification like we use map_fd's as a proxy for maps which
     // at runtime are actually 64-bit memory pointers.
-    int offset_width = desc->end - desc->data;
+    const int offset_width = desc->end - desc->data;
     if (addr == desc->data) {
         if (width == offset_width) {
             inv.assign(target.packet_offset, 0);
@@ -2090,7 +2117,7 @@ void ebpf_domain_t::do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const
 }
 
 void ebpf_domain_t::do_load_packet_or_shared(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr,
-                                             int width) {
+                                             const int width) {
     if (inv.is_bottom()) {
         return;
     }
@@ -2101,23 +2128,23 @@ void ebpf_domain_t::do_load_packet_or_shared(NumAbsDomain& inv, const Reg& targe
 
     // A 1 or 2 byte copy results in a limited range of values that may be used as array indices.
     if (width == 1) {
-        inv.set(target.svalue, crab::interval_t(number_t{0}, number_t{UINT8_MAX}));
-        inv.set(target.uvalue, crab::interval_t(number_t{0}, number_t{UINT8_MAX}));
+        inv.set(target.svalue, interval_t::full<int16_t>());
+        inv.set(target.uvalue, interval_t::full<uint8_t>());
     } else if (width == 2) {
-        inv.set(target.svalue, crab::interval_t(number_t{0}, number_t{UINT16_MAX}));
-        inv.set(target.uvalue, crab::interval_t(number_t{0}, number_t{UINT16_MAX}));
+        inv.set(target.svalue, interval_t::full<int16_t>());
+        inv.set(target.uvalue, interval_t::full<uint16_t>());
     }
 }
 
 void ebpf_domain_t::do_load(const Mem& b, const Reg& target_reg) {
     using namespace crab::dsl_syntax;
 
-    auto mem_reg = reg_pack(b.access.basereg);
-    int width = b.access.width;
-    int offset = b.access.offset;
+    const auto mem_reg = reg_pack(b.access.basereg);
+    const int width = b.access.width;
+    const int offset = b.access.offset;
 
     if (b.access.basereg.v == R10_STACK_POINTER) {
-        linear_expression_t addr = mem_reg.stack_offset + (number_t)offset;
+        const linear_expression_t addr = mem_reg.stack_offset + offset;
         do_load_stack(m_inv, target_reg, addr, width, b.access.basereg);
         return;
     }
@@ -2129,22 +2156,22 @@ void ebpf_domain_t::do_load(const Mem& b, const Reg& target_reg) {
         case T_MAP_PROGRAMS: return;
         case T_NUM: return;
         case T_CTX: {
-            linear_expression_t addr = mem_reg.ctx_offset + (number_t)offset;
+            linear_expression_t addr = mem_reg.ctx_offset + offset;
             do_load_ctx(inv, target_reg, addr, width);
             break;
         }
         case T_STACK: {
-            linear_expression_t addr = mem_reg.stack_offset + (number_t)offset;
+            linear_expression_t addr = mem_reg.stack_offset + offset;
             do_load_stack(inv, target_reg, addr, width, b.access.basereg);
             break;
         }
         case T_PACKET: {
-            linear_expression_t addr = mem_reg.packet_offset + (number_t)offset;
+            linear_expression_t addr = mem_reg.packet_offset + offset;
             do_load_packet_or_shared(inv, target_reg, addr, width);
             break;
         }
         default: {
-            linear_expression_t addr = mem_reg.shared_offset + (number_t)offset;
+            linear_expression_t addr = mem_reg.shared_offset + offset;
             do_load_packet_or_shared(inv, target_reg, addr, width);
             break;
         }
@@ -2224,17 +2251,18 @@ void ebpf_domain_t::do_store_stack(NumAbsDomain& inv, const number_t& width, con
     // stack_numeric_size holds the number of continuous bytes starting from stack_offset that are known to be numeric.
     auto updated_lb = m_inv.eval_interval(addr).lb();
     auto updated_ub = m_inv.eval_interval(addr).ub() + width;
-    for (variable_t type_variable : variable_t::get_type_variables()) {
+    for (const variable_t type_variable : variable_t::get_type_variables()) {
         if (!type_inv.has_type(inv, type_variable, T_STACK)) {
             continue;
         }
-        variable_t stack_offset_variable = variable_t::kind_var(data_kind_t::stack_offsets, type_variable);
-        variable_t stack_numeric_size_variable = variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
+        const variable_t stack_offset_variable = variable_t::kind_var(data_kind_t::stack_offsets, type_variable);
+        const variable_t stack_numeric_size_variable =
+            variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
 
         using namespace crab::dsl_syntax;
         // See if the variable's numeric interval overlaps with changed bytes.
-        if (m_inv.intersect(crab::dsl_syntax::operator<=(addr, stack_offset_variable + stack_numeric_size_variable)) &&
-            m_inv.intersect(crab::dsl_syntax::operator>=(addr + width, stack_offset_variable))) {
+        if (m_inv.intersect(dsl_syntax::operator<=(addr, stack_offset_variable + stack_numeric_size_variable)) &&
+            m_inv.intersect(operator>=(addr + width, stack_offset_variable))) {
             havoc(stack_numeric_size_variable);
             recompute_stack_numeric_size(m_inv, type_variable);
         }
@@ -2249,13 +2277,13 @@ void ebpf_domain_t::operator()(const Mem& b) {
         if (b.is_load) {
             do_load(b, std::get<Reg>(b.value));
         } else {
-            auto data = std::get<Reg>(b.value);
+            const auto data = std::get<Reg>(b.value);
             auto data_reg = reg_pack(data);
             do_mem_store(b, data, data_reg.svalue, data_reg.uvalue, data_reg);
         }
     } else {
-        do_mem_store(b, number_t{T_NUM}, number_t{(int64_t)std::get<Imm>(b.value).v},
-                     number_t{(uint64_t)std::get<Imm>(b.value).v}, {});
+        do_mem_store(b, number_t{T_NUM}, number_t{static_cast<int64_t>(std::get<Imm>(b.value).v)},
+                     number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}, {});
     }
 }
 
@@ -2266,17 +2294,17 @@ void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue,
         return;
     }
     int width = b.access.width;
-    number_t offset{b.access.offset};
+    const number_t offset{b.access.offset};
     if (b.access.basereg.v == R10_STACK_POINTER) {
-        number_t base_addr{EBPF_STACK_SIZE};
+        const number_t base_addr{EBPF_STACK_SIZE};
         do_store_stack(m_inv, width, base_addr + offset, val_type, val_svalue, val_uvalue, val_reg);
         return;
     }
-    m_inv = type_inv.join_over_types(m_inv, b.access.basereg, [&](NumAbsDomain& inv, type_encoding_t type) {
+    m_inv = type_inv.join_over_types(m_inv, b.access.basereg, [&](NumAbsDomain& inv, const type_encoding_t type) {
         if (type == T_STACK) {
-            linear_expression_t base_addr =
+            const linear_expression_t base_addr =
                 linear_expression_t(get_type_offset_variable(b.access.basereg, type).value());
-            do_store_stack(inv, width, crab::dsl_syntax::operator+(base_addr, offset), val_type, val_svalue, val_uvalue,
+            do_store_stack(inv, width, dsl_syntax::operator+(base_addr, offset), val_type, val_svalue, val_uvalue,
                            val_reg);
         }
         // do nothing for any other type
@@ -2285,7 +2313,7 @@ void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue,
 
 // Construct a Bin operation that does the main operation that a given Atomic operation does atomically.
 static Bin atomic_to_bin(const Atomic& a) {
-    Bin bin{.dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = (a.access.width == sizeof(uint64_t)), .lddw = false};
+    Bin bin{.dst = Reg{R11_ATOMIC_SCRATCH}, .v = a.valreg, .is64 = a.access.width == sizeof(uint64_t), .lddw = false};
     switch (a.op) {
     case Atomic::Op::ADD: bin.op = Bin::Op::ADD; break;
     case Atomic::Op::OR: bin.op = Bin::Op::OR; break;
@@ -2318,7 +2346,7 @@ void ebpf_domain_t::operator()(const Atomic& a) {
     }
 
     // Fetch the current value into the R11 pseudo-register.
-    const Reg r11{R11_ATOMIC_SCRATCH};
+    constexpr Reg r11{R11_ATOMIC_SCRATCH};
     (*this)(Mem{.access = a.access, .value = r11, .is_load = true});
 
     // Compute the new value in R11.
@@ -2384,7 +2412,7 @@ void ebpf_domain_t::operator()(const Call& call) {
             variable_t addr = variable.value();
             variable_t width = reg_pack(param.size).svalue;
 
-            m_inv = type_inv.join_over_types(m_inv, param.mem, [&](NumAbsDomain& inv, type_encoding_t type) {
+            m_inv = type_inv.join_over_types(m_inv, param.mem, [&](NumAbsDomain& inv, const type_encoding_t type) {
                 if (type == T_STACK) {
                     // Pointer to a memory region that the called function may change,
                     // so we must havoc.
@@ -2410,16 +2438,16 @@ void ebpf_domain_t::operator()(const Call& call) {
         }
     }
 
-    Reg r0_reg{(uint8_t)R0_RETURN_VALUE};
-    auto r0_pack = reg_pack(r0_reg);
+    constexpr Reg r0_reg{R0_RETURN_VALUE};
+    const auto r0_pack = reg_pack(r0_reg);
     havoc(r0_pack.stack_numeric_size);
     if (call.is_map_lookup) {
         // This is the only way to get a null pointer
         if (maybe_fd_reg) {
-            if (auto map_type = get_map_type(*maybe_fd_reg)) {
+            if (const auto map_type = get_map_type(*maybe_fd_reg)) {
                 if (global_program_info->platform->get_map_type(*map_type).value_type == EbpfMapValueType::MAP) {
-                    if (auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
-                        do_load_mapfd(r0_reg, (int)*inner_map_fd, true);
+                    if (const auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
+                        do_load_mapfd(r0_reg, static_cast<int>(*inner_map_fd), true);
                         goto out;
                     }
                 } else {
@@ -2463,22 +2491,21 @@ void ebpf_domain_t::operator()(const Callx& callx) {
 
     // Look up the helper function id.
     const reg_pack_t& reg = reg_pack(callx.func);
-    auto src_interval = m_inv.eval_interval(reg.svalue);
-    if (auto sn = src_interval.singleton()) {
+    const auto src_interval = m_inv.eval_interval(reg.svalue);
+    if (const auto sn = src_interval.singleton()) {
         if (sn->fits<int32_t>()) {
             // We can now process it as if the id was immediate.
-            int32_t imm = sn->cast_to<int32_t>();
+            const int32_t imm = sn->cast_to<int32_t>();
             if (!global_program_info->platform->is_helper_usable(imm)) {
                 return;
             }
-            Call call = make_call(imm, *global_program_info->platform);
+            const Call call = make_call(imm, *global_program_info->platform);
             (*this)(call);
-            return;
         }
     }
 }
 
-void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null) {
+void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, const int mapfd, const bool maybe_null) {
     const EbpfMapDescriptor& desc = global_program_info->platform->get_map_descriptor(mapfd);
     const EbpfMapType& type = global_program_info->platform->get_map_type(desc.type);
     if (type.value_type == EbpfMapValueType::PROGRAM) {
@@ -2493,7 +2520,7 @@ void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null
 
 void ebpf_domain_t::operator()(const LoadMapFd& ins) { do_load_mapfd(ins.dst, ins.mapfd, false); }
 
-void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
+void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, const bool maybe_null) {
     using namespace crab::dsl_syntax;
     const reg_pack_t& reg = reg_pack(dst_reg);
     havoc(reg.svalue);
@@ -2509,28 +2536,30 @@ void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, bool maybe_null) {
 
 // If nothing is known of the stack_numeric_size,
 // try to recompute the stack_numeric_size.
-void ebpf_domain_t::recompute_stack_numeric_size(NumAbsDomain& inv, variable_t type_variable) {
-    variable_t stack_numeric_size_variable = variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
+void ebpf_domain_t::recompute_stack_numeric_size(NumAbsDomain& inv, const variable_t type_variable) const {
+    const variable_t stack_numeric_size_variable =
+        variable_t::kind_var(data_kind_t::stack_numeric_sizes, type_variable);
 
     if (!inv.eval_interval(stack_numeric_size_variable).is_top()) {
         return;
     }
 
     if (type_inv.has_type(inv, type_variable, T_STACK)) {
-        int numeric_size = stack.min_all_num_size(inv, variable_t::kind_var(data_kind_t::stack_offsets, type_variable));
+        const int numeric_size =
+            stack.min_all_num_size(inv, variable_t::kind_var(data_kind_t::stack_offsets, type_variable));
         if (numeric_size > 0) {
             inv.assign(stack_numeric_size_variable, numeric_size);
         }
     }
 }
 
-void ebpf_domain_t::recompute_stack_numeric_size(NumAbsDomain& inv, const Reg& reg) {
+void ebpf_domain_t::recompute_stack_numeric_size(NumAbsDomain& inv, const Reg& reg) const {
     recompute_stack_numeric_size(inv, reg_pack(reg).type);
 }
 
-void ebpf_domain_t::add(const Reg& reg, int imm, int finite_width) {
-    auto dst = reg_pack(reg);
-    auto offset = get_type_offset_variable(reg);
+void ebpf_domain_t::add(const Reg& reg, const int imm, const int finite_width) {
+    const auto dst = reg_pack(reg);
+    const auto offset = get_type_offset_variable(reg);
     add_overflow(dst.svalue, dst.uvalue, imm, finite_width);
     if (offset.has_value()) {
         add(offset.value(), imm);
@@ -2545,34 +2574,35 @@ void ebpf_domain_t::add(const Reg& reg, int imm, int finite_width) {
     }
 }
 
-void ebpf_domain_t::shl(const Reg& dst_reg, int imm, int finite_width) {
-    reg_pack_t dst = reg_pack(dst_reg);
+void ebpf_domain_t::shl(const Reg& dst_reg, int imm, const int finite_width) {
+    const reg_pack_t dst = reg_pack(dst_reg);
 
     // The BPF ISA requires masking the imm.
     imm &= finite_width - 1;
 
     if (m_inv.entail(type_is_number(dst))) {
-        auto interval = m_inv.eval_interval(dst.uvalue);
+        const auto interval = m_inv.eval_interval(dst.uvalue);
         if (interval.finite_size()) {
-            number_t lb = interval.lb().number().value();
-            number_t ub = interval.ub().number().value();
+            const number_t lb = interval.lb().number().value();
+            const number_t ub = interval.ub().number().value();
             uint64_t lb_n = lb.cast_to<uint64_t>();
             uint64_t ub_n = ub.cast_to<uint64_t>();
-            uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
-            if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
+            const uint64_t uint_max = finite_width == 64 ? std::numeric_limits<uint64_t>::max()
+                                                         : static_cast<uint64_t>(std::numeric_limits<uint32_t>::max());
+            if (lb_n >> finite_width - imm != ub_n >> finite_width - imm) {
                 // The bits that will be shifted out to the left are different,
                 // which means all combinations of remaining bits are possible.
                 lb_n = 0;
-                ub_n = (uint_max << imm) & uint_max;
+                ub_n = uint_max << imm & uint_max;
             } else {
                 // The bits that will be shifted out to the left are identical
                 // for all values in the interval, so we can safely shift left
                 // to get a new interval.
-                lb_n = (lb_n << imm) & uint_max;
-                ub_n = (ub_n << imm) & uint_max;
+                lb_n = lb_n << imm & uint_max;
+                ub_n = ub_n << imm & uint_max;
             }
-            m_inv.set(dst.uvalue, crab::interval_t{number_t(lb_n), number_t(ub_n)});
-            if ((int64_t)ub_n >= (int64_t)lb_n) {
+            m_inv.set(dst.uvalue, interval_t{lb_n, ub_n});
+            if (static_cast<int64_t>(ub_n) >= static_cast<int64_t>(lb_n)) {
                 m_inv.assign(dst.svalue, dst.uvalue);
             } else {
                 havoc(dst.svalue);
@@ -2593,7 +2623,7 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
     if (m_inv.entail(type_is_number(dst))) {
         auto interval = m_inv.eval_interval(dst.uvalue);
         number_t lb_n{0};
-        number_t ub_n{UINT64_MAX >> imm};
+        number_t ub_n{std::numeric_limits<uint64_t>::max() >> imm};
         if (interval.finite_size()) {
             number_t lb = interval.lb().number().value();
             number_t ub = interval.ub().number().value();
@@ -2611,8 +2641,8 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
                 assert(lb_n <= ub_n);
             }
         }
-        m_inv.set(dst.uvalue, crab::interval_t{lb_n, ub_n});
-        if ((int64_t)ub_n >= (int64_t)lb_n) {
+        m_inv.set(dst.uvalue, interval_t{lb_n, ub_n});
+        if (static_cast<int64_t>(ub_n) >= static_cast<int64_t>(lb_n)) {
             // ? m_inv.set(dst.svalue, crab::interval_t{number_t{(int64_t)lb_n}, number_t{(int64_t)ub_n}});
             m_inv.assign(dst.svalue, dst.uvalue);
         } else {
@@ -2625,7 +2655,7 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
     havoc_offsets(dst_reg);
 }
 
-static inline int _movsx_bits(Bin::Op op) {
+static int _movsx_bits(const Bin::Op op) {
     switch (op) {
     case Bin::Op::MOVSX8: return 8;
     case Bin::Op::MOVSX16: return 16;
@@ -2634,17 +2664,17 @@ static inline int _movsx_bits(Bin::Op op) {
     }
 }
 
-void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width,
-                                Bin::Op op) {
+void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, const int finite_width,
+                                const Bin::Op op) {
     using namespace crab;
 
-    int bits = _movsx_bits(op);
-    reg_pack_t dst = reg_pack(dst_reg);
+    const int bits = _movsx_bits(op);
+    const reg_pack_t dst = reg_pack(dst_reg);
     interval_t right_interval = m_inv.eval_interval(right_svalue);
     type_inv.assign_type(m_inv, dst_reg, T_NUM);
     havoc_offsets(dst_reg);
-    int64_t span = 1ULL << bits;
-    if (right_interval.ub() - right_interval.lb() >= number_t{span}) {
+    const int64_t span = 1ULL << bits;
+    if (right_interval.ub() - right_interval.lb() >= span) {
         // Interval covers the full space.
         if (bits == 64) {
             havoc(dst.svalue);
@@ -2652,16 +2682,16 @@ void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& r
         }
         right_interval = interval_t::signed_int(bits);
     }
-    int64_t mask = 1ULL << (bits - 1);
+    const int64_t mask = 1ULL << bits - 1;
 
     // Sign extend each bound.
     int64_t lb = right_interval.lb().number().value().cast_to<int64_t>();
-    lb &= (span - 1);
+    lb &= span - 1;
     lb = (lb ^ mask) - mask;
     int64_t ub = right_interval.ub().number().value().cast_to<int64_t>();
-    ub &= (span - 1);
+    ub &= span - 1;
     ub = (ub ^ mask) - mask;
-    m_inv.set(dst.svalue, crab::interval_t{number_t{lb}, number_t{ub}});
+    m_inv.set(dst.svalue, interval_t{lb, ub});
 
     if (finite_width) {
         m_inv.assign(dst.uvalue, dst.svalue);
@@ -2679,14 +2709,14 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
         interval_t right_interval = interval_t::bottom();
         interval_t left_interval_positive = interval_t::bottom();
         interval_t left_interval_negative = interval_t::bottom();
-        get_signed_intervals(m_inv, (finite_width == 64), dst.svalue, dst.uvalue, right_svalue, left_interval,
+        get_signed_intervals(m_inv, finite_width == 64, dst.svalue, dst.uvalue, right_svalue, left_interval,
                              right_interval, left_interval_positive, left_interval_negative);
         if (auto sn = right_interval.singleton()) {
             // The BPF ISA requires masking the imm.
-            int64_t imm = sn->cast_to<int64_t>() & (finite_width - 1);
+            int64_t imm = sn->cast_to<int64_t>() & finite_width - 1;
 
-            int64_t lb_n = INT64_MIN >> imm;
-            int64_t ub_n = INT64_MAX >> imm;
+            int64_t lb_n = std::numeric_limits<int64_t>::min() >> imm;
+            int64_t ub_n = std::numeric_limits<int64_t>::max() >> imm;
             if (left_interval.finite_size()) {
                 number_t lb = left_interval.lb().number().value();
                 number_t ub = left_interval.ub().number().value();
@@ -2694,16 +2724,16 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                     lb_n = lb.cast_to<int64_t>() >> imm;
                     ub_n = ub.cast_to<int64_t>() >> imm;
                 } else {
-                    number_t lb_w = lb.cast_to_sint(finite_width) >> (int)imm;
-                    number_t ub_w = ub.cast_to_sint(finite_width) >> (int)imm;
+                    number_t lb_w = lb.cast_to_sint(finite_width) >> static_cast<int>(imm);
+                    number_t ub_w = ub.cast_to_sint(finite_width) >> static_cast<int>(imm);
                     if (lb_w.cast_to<uint32_t>() <= ub_w.cast_to<uint32_t>()) {
                         lb_n = lb_w.cast_to<uint32_t>();
                         ub_n = ub_w.cast_to<uint32_t>();
                     }
                 }
             }
-            m_inv.set(dst.svalue, crab::interval_t{number_t{lb_n}, number_t{ub_n}});
-            if ((uint64_t)ub_n >= (uint64_t)lb_n) {
+            m_inv.set(dst.svalue, interval_t{lb_n, ub_n});
+            if (static_cast<uint64_t>(ub_n) >= static_cast<uint64_t>(lb_n)) {
                 m_inv.assign(dst.uvalue, dst.svalue);
             } else {
                 havoc(dst.uvalue);
@@ -2716,6 +2746,10 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
     havoc_offsets(dst_reg);
 }
 
+static void apply(NumAbsDomain& inv, const binop_t& op, const variable_t x, const variable_t y, const variable_t z) {
+    inv.apply(op, x, y, z, 0);
+}
+
 void ebpf_domain_t::operator()(const Bin& bin) {
     using namespace crab::dsl_syntax;
 
@@ -2745,13 +2779,13 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             if (imm == 0) {
                 return;
             }
-            add(bin.dst, (int)imm, finite_width);
+            add(bin.dst, static_cast<int>(imm), finite_width);
             break;
         case Bin::Op::SUB:
             if (imm == 0) {
                 return;
             }
-            add(bin.dst, (int)-imm, finite_width);
+            add(bin.dst, static_cast<int>(-imm), finite_width);
             break;
         case Bin::Op::MUL:
             mul(dst.svalue, dst.uvalue, imm, finite_width);
@@ -2780,7 +2814,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::AND:
             // FIX: what to do with ptr&-8 as in counter/simple_loop_unrolled?
             bitwise_and(dst.svalue, dst.uvalue, imm);
-            if ((int32_t)imm > 0) {
+            if (static_cast<int32_t>(imm) > 0) {
                 // AND with immediate is only a 32-bit operation so svalue and uvalue are the same.
                 assume(dst.svalue <= imm);
                 assume(dst.uvalue <= imm);
@@ -2789,9 +2823,9 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             }
             havoc_offsets(bin.dst);
             break;
-        case Bin::Op::LSH: shl(bin.dst, (int32_t)imm, finite_width); break;
-        case Bin::Op::RSH: lshr(bin.dst, (int32_t)imm, finite_width); break;
-        case Bin::Op::ARSH: ashr(bin.dst, number_t{(int32_t)imm}, finite_width); break;
+        case Bin::Op::LSH: shl(bin.dst, static_cast<int32_t>(imm), finite_width); break;
+        case Bin::Op::RSH: lshr(bin.dst, static_cast<int32_t>(imm), finite_width); break;
+        case Bin::Op::ARSH: ashr(bin.dst, static_cast<int32_t>(imm), finite_width); break;
         case Bin::Op::XOR:
             bitwise_xor(dst.svalue, dst.uvalue, imm);
             havoc_offsets(bin.dst);
@@ -2809,76 +2843,78 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             } else {
                 // Here we're not sure that lhs and rhs are the same type; they might be.
                 // But previous assertions should fail unless we know that exactly one of lhs or rhs is a pointer.
-                m_inv = type_inv.join_over_types(m_inv, bin.dst, [&](NumAbsDomain& inv, type_encoding_t dst_type) {
-                    inv = type_inv.join_over_types(inv, src_reg, [&](NumAbsDomain& inv, type_encoding_t src_type) {
-                        if (dst_type == T_NUM && src_type != T_NUM) {
-                            // num += ptr
-                            type_inv.assign_type(inv, bin.dst, src_type);
-                            if (auto dst_offset = get_type_offset_variable(bin.dst, src_type)) {
-                                apply(inv, crab::arith_binop_t::ADD, dst_offset.value(), dst.svalue,
-                                      get_type_offset_variable(src_reg, src_type).value());
-                            }
-                            if (src_type == T_SHARED) {
-                                inv.assign(dst.shared_region_size, src.shared_region_size);
-                            }
-                        } else if (dst_type != T_NUM && src_type == T_NUM) {
-                            // ptr += num
-                            type_inv.assign_type(inv, bin.dst, dst_type);
-                            if (auto dst_offset = get_type_offset_variable(bin.dst, dst_type)) {
-                                apply(inv, crab::arith_binop_t::ADD, dst_offset.value(), dst_offset.value(),
-                                      src.svalue);
-                                if (dst_type == T_STACK) {
-                                    // Reduce the numeric size.
-                                    using namespace crab::dsl_syntax;
-                                    if (m_inv.intersect(src.svalue < 0)) {
-                                        inv -= dst.stack_numeric_size;
-                                        recompute_stack_numeric_size(inv, dst.type);
-                                    } else {
-                                        apply_signed(inv, crab::arith_binop_t::SUB, dst.stack_numeric_size,
-                                                     dst.stack_numeric_size, dst.stack_numeric_size, src.svalue, 0);
+                m_inv =
+                    type_inv.join_over_types(m_inv, bin.dst, [&](NumAbsDomain& inv, const type_encoding_t dst_type) {
+                        inv = type_inv.join_over_types(
+                            inv, src_reg, [&](NumAbsDomain& inv, const type_encoding_t src_type) {
+                                if (dst_type == T_NUM && src_type != T_NUM) {
+                                    // num += ptr
+                                    type_inv.assign_type(inv, bin.dst, src_type);
+                                    if (const auto dst_offset = get_type_offset_variable(bin.dst, src_type)) {
+                                        crab::apply(inv, arith_binop_t::ADD, dst_offset.value(), dst.svalue,
+                                                    get_type_offset_variable(src_reg, src_type).value());
+                                    }
+                                    if (src_type == T_SHARED) {
+                                        inv.assign(dst.shared_region_size, src.shared_region_size);
+                                    }
+                                } else if (dst_type != T_NUM && src_type == T_NUM) {
+                                    // ptr += num
+                                    type_inv.assign_type(inv, bin.dst, dst_type);
+                                    if (const auto dst_offset = get_type_offset_variable(bin.dst, dst_type)) {
+                                        crab::apply(inv, arith_binop_t::ADD, dst_offset.value(), dst_offset.value(),
+                                                    src.svalue);
+                                        if (dst_type == T_STACK) {
+                                            // Reduce the numeric size.
+                                            using namespace crab::dsl_syntax;
+                                            if (m_inv.intersect(src.svalue < 0)) {
+                                                inv -= dst.stack_numeric_size;
+                                                recompute_stack_numeric_size(inv, dst.type);
+                                            } else {
+                                                apply_signed(inv, arith_binop_t::SUB, dst.stack_numeric_size,
+                                                             dst.stack_numeric_size, dst.stack_numeric_size, src.svalue,
+                                                             0);
+                                            }
+                                        }
                                     }
+                                } else if (dst_type == T_NUM && src_type == T_NUM) {
+                                    // dst and src don't necessarily have the same type, but among the possibilities
+                                    // enumerated is the case where they are both numbers.
+                                    apply_signed(inv, arith_binop_t::ADD, dst.svalue, dst.uvalue, dst.svalue,
+                                                 src.svalue, finite_width);
+                                } else {
+                                    // We ignore the cases here that do not match the assumption described
+                                    // above.  Joining bottom with another results will leave the other
+                                    // results unchanged.
+                                    inv.set_to_bottom();
                                 }
-                            }
-                        } else if (dst_type == T_NUM && src_type == T_NUM) {
-                            // dst and src don't necessarily have the same type, but among the possibilities
-                            // enumerated is the case where they are both numbers.
-                            apply_signed(inv, crab::arith_binop_t::ADD, dst.svalue, dst.uvalue, dst.svalue, src.svalue,
-                                         finite_width);
-                        } else {
-                            // We ignore the cases here that do not match the assumption described
-                            // above.  Joining bottom with another results will leave the other
-                            // results unchanged.
-                            inv.set_to_bottom();
-                        }
+                            });
                     });
-                });
                 // careful: change dst.value only after dealing with offset
-                apply_signed(m_inv, crab::arith_binop_t::ADD, dst.svalue, dst.uvalue, dst.svalue, src.svalue,
-                             finite_width);
+                apply_signed(m_inv, arith_binop_t::ADD, dst.svalue, dst.uvalue, dst.svalue, src.svalue, finite_width);
             }
             break;
         }
         case Bin::Op::SUB: {
             if (type_inv.same_type(m_inv, bin.dst, std::get<Reg>(bin.v))) {
                 // src and dest have the same type.
-                m_inv = type_inv.join_over_types(m_inv, bin.dst, [&](NumAbsDomain& inv, type_encoding_t type) {
+                m_inv = type_inv.join_over_types(m_inv, bin.dst, [&](NumAbsDomain& inv, const type_encoding_t type) {
                     switch (type) {
                     case T_NUM:
                         // This is: sub_overflow(inv, dst.value, src.value, finite_width);
-                        apply_signed(inv, crab::arith_binop_t::SUB, dst.svalue, dst.uvalue, dst.svalue, src.svalue,
+                        apply_signed(inv, arith_binop_t::SUB, dst.svalue, dst.uvalue, dst.svalue, src.svalue,
                                      finite_width);
                         type_inv.assign_type(inv, bin.dst, T_NUM);
-                        havoc_offsets(inv, bin.dst);
+                        crab::havoc_offsets(inv, bin.dst);
                         break;
                     default:
                         // ptr -= ptr
                         // Assertions should make sure we only perform this on non-shared pointers.
-                        if (auto dst_offset = get_type_offset_variable(bin.dst, type)) {
-                            apply_signed(inv, crab::arith_binop_t::SUB, dst.svalue, dst.uvalue, dst_offset.value(),
+                        if (const auto dst_offset = get_type_offset_variable(bin.dst, type)) {
+                            apply_signed(inv, arith_binop_t::SUB, dst.svalue, dst.uvalue, dst_offset.value(),
                                          get_type_offset_variable(src_reg, type).value(), finite_width);
                             inv -= dst_offset.value();
                         }
-                        havoc_offsets(inv, bin.dst);
+                        crab::havoc_offsets(inv, bin.dst);
                         type_inv.assign_type(inv, bin.dst, T_NUM);
                         break;
                     }
@@ -2902,8 +2938,8 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                                 m_inv -= dst.stack_numeric_size;
                                 recompute_stack_numeric_size(m_inv, dst.type);
                             } else {
-                                apply(m_inv, crab::arith_binop_t::ADD, dst.stack_numeric_size, dst.stack_numeric_size,
-                                      src.svalue);
+                                crab::apply(m_inv, arith_binop_t::ADD, dst.stack_numeric_size, dst.stack_numeric_size,
+                                            src.svalue);
                             }
                         }
                     }
@@ -2950,7 +2986,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                             // Use only the low 32 bits of the value.
                             bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
                         }
-                        shl(bin.dst, (int32_t)imm, finite_width);
+                        shl(bin.dst, static_cast<int32_t>(imm), finite_width);
                         break;
                     }
                 }
@@ -2968,7 +3004,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                             // Use only the low 32 bits of the value.
                             bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
                         }
-                        lshr(bin.dst, (int32_t)imm, finite_width);
+                        lshr(bin.dst, static_cast<int32_t>(imm), finite_width);
                         break;
                     }
                 }
@@ -2994,8 +3030,8 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::MOVSX16:
         case Bin::Op::MOVSX32:
             // Keep relational information if operation is a no-op.
-            if ((dst.svalue == src.svalue) &&
-                (m_inv.eval_interval(dst.svalue) <= interval_t::signed_int(_movsx_bits(bin.op)))) {
+            if (dst.svalue == src.svalue &&
+                m_inv.eval_interval(dst.svalue) <= interval_t::signed_int(_movsx_bits(bin.op))) {
                 return;
             }
             if (m_inv.entail(type_is_number(src_reg))) {
@@ -3008,14 +3044,14 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             break;
         case Bin::Op::MOV:
             // Keep relational information if operation is a no-op.
-            if ((dst.svalue == src.svalue) &&
-                (m_inv.eval_interval(dst.uvalue) <= interval_t::unsigned_int(bin.is64 ? 64 : 32))) {
+            if (dst.svalue == src.svalue &&
+                m_inv.eval_interval(dst.uvalue) <= interval_t::unsigned_int(bin.is64 ? 64 : 32)) {
                 return;
             }
             assign(dst.svalue, src.svalue);
             assign(dst.uvalue, src.uvalue);
             havoc_offsets(bin.dst);
-            m_inv = type_inv.join_over_types(m_inv, src_reg, [&](NumAbsDomain& inv, type_encoding_t type) {
+            m_inv = type_inv.join_over_types(m_inv, src_reg, [&](NumAbsDomain& inv, const type_encoding_t type) {
                 switch (type) {
                 case T_CTX:
                     if (bin.is64) {
@@ -3055,7 +3091,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             });
             if (bin.is64) {
                 // Add dst.type=src.type invariant.
-                if ((bin.dst.v != std::get<Reg>(bin.v).v) || (type_inv.get_type(m_inv, dst.type) == T_UNINIT)) {
+                if (bin.dst.v != std::get<Reg>(bin.v).v || type_inv.get_type(m_inv, dst.type) == T_UNINIT) {
                     // Only forget the destination type if we're copying from a different register,
                     // or from the same uninitialized register.
                     havoc(dst.type);
@@ -3070,7 +3106,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
     }
 }
 
-string_invariant ebpf_domain_t::to_set() { return this->m_inv.to_set() + this->stack.to_set(); }
+string_invariant ebpf_domain_t::to_set() const { return this->m_inv.to_set() + this->stack.to_set(); }
 
 std::ostream& operator<<(std::ostream& o, const ebpf_domain_t& dom) {
     if (dom.is_bottom()) {
@@ -3089,7 +3125,7 @@ void ebpf_domain_t::initialize_packet(ebpf_domain_t& inv) {
 
     inv += 0 <= variable_t::packet_size();
     inv += variable_t::packet_size() < MAX_PACKET_SIZE;
-    auto info = *global_program_info;
+    const auto info = *global_program_info;
     if (info.type.context_descriptor->meta >= 0) {
         inv += variable_t::meta_offset() <= 0;
         inv += variable_t::meta_offset() >= -4098;
@@ -3098,30 +3134,30 @@ void ebpf_domain_t::initialize_packet(ebpf_domain_t& inv) {
     }
 }
 
-ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& constraints, bool setup_constraints) {
+ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& constraints, const bool setup_constraints) {
     ebpf_domain_t inv;
     if (setup_constraints) {
-        inv = ebpf_domain_t::setup_entry(false);
+        inv = setup_entry(false);
     }
-    auto numeric_ranges = std::vector<crab::interval_t>();
+    auto numeric_ranges = std::vector<interval_t>();
     for (const auto& cst : parse_linear_constraints(constraints, numeric_ranges)) {
         inv += cst;
     }
-    for (const crab::interval_t& range : numeric_ranges) {
-        int start = (int)range.lb().number().value();
-        int width = 1 + (int)range.finite_size().value();
+    for (const interval_t& range : numeric_ranges) {
+        const int start = static_cast<int>(range.lb().number().value());
+        const int width = 1 + static_cast<int>(range.finite_size().value());
         inv.stack.initialize_numbers(start, width);
     }
     // TODO: handle other stack type constraints
     return inv;
 }
 
-ebpf_domain_t ebpf_domain_t::setup_entry(bool init_r1) {
+ebpf_domain_t ebpf_domain_t::setup_entry(const bool init_r1) {
     using namespace crab::dsl_syntax;
 
     ebpf_domain_t inv;
-    auto r10 = reg_pack(R10_STACK_POINTER);
-    Reg r10_reg{(uint8_t)R10_STACK_POINTER};
+    const auto r10 = reg_pack(R10_STACK_POINTER);
+    constexpr Reg r10_reg{R10_STACK_POINTER};
     inv += EBPF_STACK_SIZE <= r10.svalue;
     inv += r10.svalue <= PTR_MAX;
     inv.assign(r10.stack_offset, EBPF_STACK_SIZE);
@@ -3130,8 +3166,8 @@ ebpf_domain_t ebpf_domain_t::setup_entry(bool init_r1) {
     inv.type_inv.assign_type(inv.m_inv, r10_reg, T_STACK);
 
     if (init_r1) {
-        auto r1 = reg_pack(R1_ARG);
-        Reg r1_reg{(uint8_t)R1_ARG};
+        const auto r1 = reg_pack(R1_ARG);
+        constexpr Reg r1_reg{R1_ARG};
         inv += 1 <= r1.svalue;
         inv += r1.svalue <= PTR_MAX;
         inv.assign(r1.ctx_offset, 0);
@@ -3142,13 +3178,13 @@ ebpf_domain_t ebpf_domain_t::setup_entry(bool init_r1) {
     return inv;
 }
 
-void ebpf_domain_t::initialize_loop_counter(const label_t label) {
+void ebpf_domain_t::initialize_loop_counter(const label_t& label) {
     m_inv.assign(variable_t::loop_counter(to_string(label)), 0);
 }
 
-bound_t ebpf_domain_t::get_loop_count_upper_bound() {
-    crab::bound_t ub{number_t{0}};
-    for (variable_t counter : variable_t::get_loop_counters()) {
+bound_t ebpf_domain_t::get_loop_count_upper_bound() const {
+    bound_t ub{0};
+    for (const variable_t counter : variable_t::get_loop_counters()) {
         ub = std::max(ub, m_inv[counter].ub());
     }
     return ub;
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index d6f3aecc6..9a203b9ba 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -24,7 +24,7 @@ class ebpf_domain_t final {
 
   public:
     ebpf_domain_t();
-    ebpf_domain_t(crab::domains::NumAbsDomain inv, crab::domains::array_domain_t stack);
+    ebpf_domain_t(domains::NumAbsDomain inv, domains::array_domain_t stack);
 
     // Generic abstract domain operations
     static ebpf_domain_t top();
@@ -35,7 +35,7 @@ class ebpf_domain_t final {
     bool is_bottom() const;
     [[nodiscard]]
     bool is_top() const;
-    bool operator<=(const ebpf_domain_t& other);
+    bool operator<=(const ebpf_domain_t& other) const;
     bool operator==(const ebpf_domain_t& other) const;
     void operator|=(ebpf_domain_t&& other);
     void operator|=(const ebpf_domain_t& other);
@@ -43,17 +43,17 @@ class ebpf_domain_t final {
     ebpf_domain_t operator|(const ebpf_domain_t& other) const&;
     ebpf_domain_t operator|(const ebpf_domain_t& other) &&;
     ebpf_domain_t operator&(const ebpf_domain_t& other) const;
-    ebpf_domain_t widen(const ebpf_domain_t& other, bool to_constants);
-    ebpf_domain_t widening_thresholds(const ebpf_domain_t& other, const crab::iterators::thresholds_t& ts);
-    ebpf_domain_t narrow(const ebpf_domain_t& other);
+    ebpf_domain_t widen(const ebpf_domain_t& other, bool to_constants) const;
+    ebpf_domain_t widening_thresholds(const ebpf_domain_t& other, const thresholds_t& ts);
+    ebpf_domain_t narrow(const ebpf_domain_t& other) const;
 
     typedef bool check_require_func_t(NumAbsDomain&, const linear_constraint_t&, std::string);
     void set_require_check(std::function<check_require_func_t> f);
-    bound_t get_loop_count_upper_bound();
+    bound_t get_loop_count_upper_bound() const;
     static ebpf_domain_t setup_entry(bool init_r1);
 
     static ebpf_domain_t from_constraints(const std::set<std::string>& constraints, bool setup_constraints);
-    string_invariant to_set();
+    string_invariant to_set() const;
 
     // abstract transformers
     void operator()(const basic_block_t& bb);
@@ -85,7 +85,7 @@ class ebpf_domain_t final {
     void operator()(const ZeroCtxOffset&);
     void operator()(const IncrementLoopCounter&);
 
-    void initialize_loop_counter(label_t label);
+    void initialize_loop_counter(const label_t& label);
     static ebpf_domain_t calculate_constant_limits();
 
   private:
@@ -97,22 +97,12 @@ class ebpf_domain_t final {
     void assign(variable_t x, const linear_expression_t& e);
     void assign(variable_t x, int64_t e);
 
-    void apply(crab::arith_binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width);
-    void apply(crab::arith_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
-    void apply(crab::bitwise_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
-    void apply(crab::bitwise_binop_t op, variable_t x, variable_t y, const number_t& k, int finite_width);
-    void apply(crab::binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width);
-    void apply(crab::binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
-
-    void apply(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t x, variable_t y, variable_t z);
-    void apply_signed(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                      const number_t& z, int finite_width);
-    void apply_unsigned(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                        const number_t& z, int finite_width);
-    void apply_signed(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                      variable_t z, int finite_width);
-    void apply_unsigned(crab::domains::NumAbsDomain& inv, crab::binop_t op, variable_t xs, variable_t xu, variable_t y,
-                        variable_t z, int finite_width);
+    void apply(arith_binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width);
+    void apply(arith_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
+    void apply(bitwise_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
+    void apply(bitwise_binop_t op, variable_t x, variable_t y, const number_t& k, int finite_width);
+    void apply(binop_t op, variable_t x, variable_t y, const number_t& z, int finite_width);
+    void apply(binop_t op, variable_t x, variable_t y, variable_t z, int finite_width);
 
     void add(const Reg& reg, int imm, int finite_width);
     void add(variable_t lhs, variable_t op2);
@@ -145,7 +135,7 @@ class ebpf_domain_t final {
     void shl_overflow(variable_t lhss, variable_t lhsu, variable_t op2);
     void shl_overflow(variable_t lhss, variable_t lhsu, const number_t& op2);
     void lshr(const Reg& reg, int imm, int finite_width);
-    void ashr(const Reg& reg, const linear_expression_t& right_svalue, int finite_width);
+    void ashr(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width);
     void sign_extend(const Reg& dst_reg, const linear_expression_t& right_svalue, int finite_width, Bin::Op op);
 
     void assume(const linear_constraint_t& cst);
@@ -155,7 +145,6 @@ class ebpf_domain_t final {
 
     /// Forget everything about all offset variables for a given register.
     void havoc_offsets(const Reg& reg);
-    void havoc_offsets(NumAbsDomain& inv, const Reg& reg);
 
     static std::optional<variable_t> get_type_offset_variable(const Reg& reg, int type);
     [[nodiscard]]
@@ -171,33 +160,28 @@ class ebpf_domain_t final {
     [[nodiscard]]
     std::optional<uint32_t> get_map_inner_map_fd(const Reg& map_fd_reg) const;
     [[nodiscard]]
-    crab::interval_t get_map_key_size(const Reg& map_fd_reg) const;
+    interval_t get_map_key_size(const Reg& map_fd_reg) const;
     [[nodiscard]]
-    crab::interval_t get_map_value_size(const Reg& map_fd_reg) const;
+    interval_t get_map_value_size(const Reg& map_fd_reg) const;
     [[nodiscard]]
-    crab::interval_t get_map_max_entries(const Reg& map_fd_reg) const;
+    interval_t get_map_max_entries(const Reg& map_fd_reg) const;
     void forget_packet_pointers();
-    void havoc_register(NumAbsDomain& inv, const Reg& reg);
     void do_load_mapfd(const Reg& dst_reg, int mapfd, bool maybe_null);
 
-    static void overflow_signed(NumAbsDomain& inv, variable_t lhs, int finite_width);
-    static void overflow_unsigned(NumAbsDomain& inv, variable_t lhs, int finite_width);
-    static void overflow_bounds(NumAbsDomain& inv, variable_t lhs, number_t span, int finite_width, bool issigned);
-
     void assign_valid_ptr(const Reg& dst_reg, bool maybe_null);
 
-    void require(crab::domains::NumAbsDomain& inv, const linear_constraint_t& cst, const std::string& s);
+    void require(domains::NumAbsDomain& inv, const linear_constraint_t& cst, const std::string& s) const;
 
     // memory check / load / store
-    void check_access_stack(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub);
-    void check_access_context(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub);
+    void check_access_stack(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) const;
+    void check_access_context(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) const;
     void check_access_packet(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                             std::optional<variable_t> shared_region_size);
+                             std::optional<variable_t> shared_region_size) const;
     void check_access_shared(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                             variable_t shared_region_size);
+                             variable_t shared_region_size) const;
 
-    void recompute_stack_numeric_size(NumAbsDomain& inv, const Reg& reg);
-    void recompute_stack_numeric_size(NumAbsDomain& inv, variable_t type_variable);
+    void recompute_stack_numeric_size(NumAbsDomain& inv, const Reg& reg) const;
+    void recompute_stack_numeric_size(NumAbsDomain& inv, variable_t type_variable) const;
     void do_load_stack(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr, int width,
                        const Reg& src_reg);
     void do_load_ctx(NumAbsDomain& inv, const Reg& target_reg, const linear_expression_t& addr_vague, int width);
@@ -205,8 +189,8 @@ class ebpf_domain_t final {
     void do_load(const Mem& b, const Reg& target_reg);
 
     template <typename X, typename Y, typename Z>
-    void do_store_stack(crab::domains::NumAbsDomain& inv, const number_t& width, const linear_expression_t& addr,
-                        X val_type, Y val_svalue, Z val_uvalue, const std::optional<reg_pack_t>& opt_val_reg);
+    void do_store_stack(domains::NumAbsDomain& inv, const number_t& width, const linear_expression_t& addr, X val_type,
+                        Y val_svalue, Z val_uvalue, const std::optional<reg_pack_t>& opt_val_reg);
 
     template <typename Type, typename SValue, typename UValue>
     void do_mem_store(const Mem& b, Type val_type, SValue val_svalue, UValue val_uvalue,
@@ -220,12 +204,12 @@ class ebpf_domain_t final {
     /// Mapping from variables (including registers, types, offsets,
     /// memory locations, etc.) to numeric intervals or relationships
     /// to other variables.
-    crab::domains::NumAbsDomain m_inv;
+    domains::NumAbsDomain m_inv;
 
     /// Represents the stack as a memory region, i.e., an array of bytes,
     /// allowing mapping to variable in the m_inv numeric domains
     /// while dealing with overlapping byte ranges.
-    crab::domains::array_domain_t stack;
+    domains::array_domain_t stack;
 
     std::function<check_require_func_t> check_require{};
     bool get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, int32_t* end_fd) const;
@@ -266,8 +250,8 @@ class ebpf_domain_t final {
                                      const std::function<void(NumAbsDomain&)>& if_true,
                                      const std::function<void(NumAbsDomain&)>& if_false) const;
         void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const;
-        void add_extra_invariant(NumAbsDomain& dst, std::map<crab::variable_t, crab::interval_t>& extra_invariants,
-                                 variable_t type_variable, type_encoding_t type, crab::data_kind_t kind,
+        void add_extra_invariant(const NumAbsDomain& dst, std::map<variable_t, interval_t>& extra_invariants,
+                                 variable_t type_variable, type_encoding_t type, data_kind_t kind,
                                  const NumAbsDomain& other) const;
 
         [[nodiscard]]
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 7c0629b6e..60328d6fb 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -56,6 +56,7 @@ class interval_t final {
         : _lb(b.is_infinite() ? bound_t{number_t{0}} : b), _ub(b.is_infinite() ? bound_t{-1} : b) {}
 
     explicit interval_t(const number_t& n) : _lb(n), _ub(n) {}
+    explicit interval_t(std::integral auto n) : _lb(n), _ub(n) {}
 
     interval_t(const interval_t& i) = default;
 
diff --git a/src/crab/linear_expression.hpp b/src/crab/linear_expression.hpp
index 46f2a7d3a..d6f6adafc 100644
--- a/src/crab/linear_expression.hpp
+++ b/src/crab/linear_expression.hpp
@@ -34,6 +34,8 @@ class linear_expression_t final {
   public:
     linear_expression_t(number_t coefficient) : _constant_term(std::move(coefficient)) {}
 
+    linear_expression_t(std::integral auto coefficient) : _constant_term(coefficient) {}
+    linear_expression_t(is_enum auto coefficient) : _constant_term(coefficient) {}
     linear_expression_t(variable_t variable) { _variable_terms[variable] = 1; }
 
     linear_expression_t(const number_t& coefficient, const variable_t& variable) {
@@ -69,7 +71,7 @@ class linear_expression_t final {
 
     // Multiply a linear expression by a constant.
     [[nodiscard]]
-    linear_expression_t multiply(const number_t& constant) const {
+    linear_expression_t multiply(const finite_integral auto& constant) const {
         variable_terms_t variable_terms;
         for (const auto& [variable, coefficient] : _variable_terms) {
             variable_terms.emplace(variable, coefficient * constant);
@@ -79,7 +81,7 @@ class linear_expression_t final {
 
     // Add a constant to a linear expression.
     [[nodiscard]]
-    linear_expression_t plus(const number_t& constant) const {
+    linear_expression_t plus(const finite_integral auto& constant) const {
         return linear_expression_t(variable_terms_t(_variable_terms), _constant_term + constant);
     }
 
@@ -109,7 +111,7 @@ class linear_expression_t final {
 
     // Subtract a constant from a linear expression.
     [[nodiscard]]
-    linear_expression_t subtract(const number_t& constant) const {
+    linear_expression_t subtract(const finite_integral auto& constant) const {
         return linear_expression_t(variable_terms_t(_variable_terms), _constant_term - constant);
     }
 
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index 147c89ddf..f93b0c532 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -259,4 +259,10 @@ class number_t final {
 };
 // class number_t
 
+bool operator<=(std::integral auto left, const number_t& rhs) { return rhs >= left; }
+bool operator<=(is_enum auto left, const number_t& rhs) { return rhs >= left; }
+
+template <typename T>
+concept finite_integral = std::integral<T> || std::is_same_v<T, number_t>;
+
 } // namespace crab
diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
index 1c9703a77..f397e3578 100644
--- a/src/crab_utils/num_extended.hpp
+++ b/src/crab_utils/num_extended.hpp
@@ -43,6 +43,7 @@ class extended_number final {
     }
 
     extended_number(number_t n) : _is_infinite(false), _n(std::move(n)) {}
+    extended_number(std::integral auto n) : _is_infinite(false), _n{n} {}
 
     extended_number(const extended_number& o) = default;
 

From 90182d4aaa1b920c35d9ca66929add249691b775 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 19:20:10 +0300
Subject: [PATCH 249/373] minor

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/linear_expression.hpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/crab/linear_expression.hpp b/src/crab/linear_expression.hpp
index d6f6adafc..7bf3ef91c 100644
--- a/src/crab/linear_expression.hpp
+++ b/src/crab/linear_expression.hpp
@@ -4,7 +4,8 @@
 
 #include <map>
 
-#include "variable.hpp"
+#include "crab/variable.hpp"
+#include "crab_utils/num_big.hpp"
 
 namespace crab {
 // A linear expression is of the form: Ax + By + Cz + ... + N.

From feb3d8e89f3dcd25f54259ee551f30ac38c71ebc Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 19:36:04 +0300
Subject: [PATCH 250/373] rename bound_t to extended_number everywhere except
 in interval files

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp       | 2 +-
 src/crab/ebpf_domain.cpp        | 4 ++--
 src/crab/ebpf_domain.hpp        | 2 +-
 src/crab/interval.hpp           | 2 ++
 src/crab/split_dbm.cpp          | 8 ++++----
 src/crab/thresholds.cpp         | 8 ++++----
 src/crab/thresholds.hpp         | 8 ++++----
 src/crab_utils/num_extended.hpp | 2 --
 src/crab_verifier.cpp           | 2 +-
 9 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index d404223c5..e4768b5e3 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -20,7 +20,7 @@
 
 namespace crab::domains {
 
-static bool maybe_between(const NumAbsDomain& dom, const bound_t& x, const linear_expression_t& symb_lb,
+static bool maybe_between(const NumAbsDomain& dom, const extended_number& x, const linear_expression_t& symb_lb,
                           const linear_expression_t& symb_ub) {
     using namespace dsl_syntax;
     assert(x.is_finite());
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 9485f9ba7..ff613cefc 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -3182,8 +3182,8 @@ void ebpf_domain_t::initialize_loop_counter(const label_t& label) {
     m_inv.assign(variable_t::loop_counter(to_string(label)), 0);
 }
 
-bound_t ebpf_domain_t::get_loop_count_upper_bound() const {
-    bound_t ub{0};
+extended_number ebpf_domain_t::get_loop_count_upper_bound() const {
+    extended_number ub{0};
     for (const variable_t counter : variable_t::get_loop_counters()) {
         ub = std::max(ub, m_inv[counter].ub());
     }
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 9a203b9ba..b97d7bb25 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -49,7 +49,7 @@ class ebpf_domain_t final {
 
     typedef bool check_require_func_t(NumAbsDomain&, const linear_constraint_t&, std::string);
     void set_require_check(std::function<check_require_func_t> f);
-    bound_t get_loop_count_upper_bound() const;
+    extended_number get_loop_count_upper_bound() const;
     static ebpf_domain_t setup_entry(bool init_r1);
 
     static ebpf_domain_t from_constraints(const std::set<std::string>& constraints, bool setup_constraints);
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 60328d6fb..1a98ccc99 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -17,6 +17,8 @@
 
 namespace crab {
 
+using bound_t = extended_number;
+
 class interval_t final {
     bound_t _lb;
     bound_t _ub;
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index ca9648872..eefaf0f61 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1096,8 +1096,8 @@ string_invariant SplitDBM::to_set() const {
             continue;
         }
         interval_t v_out =
-            interval_t(this->g.elem(v, 0) ? -number_t(this->g.edge_val(v, 0)) : bound_t::minus_infinity(),
-                       this->g.elem(0, v) ? number_t(this->g.edge_val(0, v)) : bound_t::plus_infinity());
+            interval_t(this->g.elem(v, 0) ? -number_t(this->g.edge_val(v, 0)) : extended_number::minus_infinity(),
+                       this->g.elem(0, v) ? number_t(this->g.edge_val(0, v)) : extended_number::plus_infinity());
         assert(!v_out.is_bottom());
 
         variable_t variable = *(this->rev_map[v]);
@@ -1279,8 +1279,8 @@ static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::gr
         return interval_t::top();
     }
     SplitDBM::vert_id v = it->second;
-    bound_t lb = bound_t::minus_infinity();
-    bound_t ub = bound_t::plus_infinity();
+    extended_number lb = extended_number::minus_infinity();
+    extended_number ub = extended_number::plus_infinity();
     if (r.elem(v, 0)) {
         lb = x.is_unsigned() ? (-number_t(r.edge_val(v, 0))).truncate_to_uint(finite_width)
                              : (-number_t(r.edge_val(v, 0))).truncate_to_sint(finite_width);
diff --git a/src/crab/thresholds.cpp b/src/crab/thresholds.cpp
index 3fe432794..b460b736e 100644
--- a/src/crab/thresholds.cpp
+++ b/src/crab/thresholds.cpp
@@ -7,9 +7,9 @@ namespace crab {
 
 inline namespace iterators {
 
-void thresholds_t::add(bound_t v1) {
+void thresholds_t::add(extended_number v1) {
     if (m_thresholds.size() < m_size) {
-        bound_t v = (v1);
+        extended_number v = (v1);
         if (std::find(m_thresholds.begin(), m_thresholds.end(), v) == m_thresholds.end()) {
             auto ub = std::upper_bound(m_thresholds.begin(), m_thresholds.end(), v);
 
@@ -37,9 +37,9 @@ void thresholds_t::add(bound_t v1) {
 
 std::ostream& operator<<(std::ostream& o, const thresholds_t& t) {
     o << "{";
-    for (typename std::vector<bound_t>::const_iterator it = t.m_thresholds.begin(), et = t.m_thresholds.end();
+    for (typename std::vector<extended_number>::const_iterator it = t.m_thresholds.begin(), et = t.m_thresholds.end();
          it != et;) {
-        bound_t b(*it);
+        extended_number b(*it);
         o << b;
         ++it;
         if (it != t.m_thresholds.end()) {
diff --git a/src/crab/thresholds.hpp b/src/crab/thresholds.hpp
index 9d880218c..d1e69de27 100644
--- a/src/crab/thresholds.hpp
+++ b/src/crab/thresholds.hpp
@@ -24,14 +24,14 @@ inline namespace iterators {
 class thresholds_t final {
 
   private:
-    std::vector<bound_t> m_thresholds;
+    std::vector<extended_number> m_thresholds;
     size_t m_size;
 
   public:
     explicit thresholds_t(size_t size = UINT_MAX) : m_size(size) {
-        m_thresholds.push_back(bound_t::minus_infinity());
+        m_thresholds.push_back(extended_number::minus_infinity());
         m_thresholds.emplace_back(number_t{0});
-        m_thresholds.push_back(bound_t::plus_infinity());
+        m_thresholds.push_back(extended_number::plus_infinity());
     }
 
     [[nodiscard]]
@@ -39,7 +39,7 @@ class thresholds_t final {
         return m_thresholds.size();
     }
 
-    void add(bound_t v1);
+    void add(extended_number v1);
 
     friend std::ostream& operator<<(std::ostream& o, const thresholds_t& t);
 };
diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
index f397e3578..f072b11e1 100644
--- a/src/crab_utils/num_extended.hpp
+++ b/src/crab_utils/num_extended.hpp
@@ -223,6 +223,4 @@ class extended_number final {
 
 }; // class extended_number
 
-using bound_t = extended_number;
-
 } // namespace crab
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index a7f2c90d5..d7e720064 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -31,7 +31,7 @@ struct checks_db final {
     std::map<label_t, std::vector<std::string>> m_db{};
     int total_warnings{};
     int total_unreachable{};
-    crab::bound_t max_loop_count{crab::number_t{0}};
+    crab::extended_number max_loop_count{crab::number_t{0}};
 
     void add(const label_t& label, const std::string& msg) { m_db[label].emplace_back(msg); }
 

From c50905bf4dcaba8aa0a759bbe7fa00279421e111 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Thu, 26 Sep 2024 23:56:00 +0300
Subject: [PATCH 251/373] cleanup and modernize array_domain

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_files.cpp         |   2 +-
 src/crab/array_domain.cpp | 280 ++++++++++++++++++--------------------
 src/crab/array_domain.hpp |  20 ++-
 src/crab/ebpf_domain.cpp  |  27 ++--
 src/crab/interval.cpp     |   2 +-
 src/crab/split_dbm.cpp    |   1 -
 src/ebpf_yaml.cpp         |   2 +-
 7 files changed, 156 insertions(+), 178 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 6045be64c..c10dd200c 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -22,7 +22,7 @@ using std::vector;
 
 template <typename T>
 static vector<T> vector_of(const char* data, ELFIO::Elf_Xword size) {
-    if ((size % sizeof(T) != 0) || size > UINT32_MAX || !data) {
+    if ((size % sizeof(T) != 0) || size > std::numeric_limits<uint32_t>::max() || !data) {
         throw std::runtime_error("Invalid argument to vector_of");
     }
     return {(T*)data, (T*)(data + size)};
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index e4768b5e3..798e626ba 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -10,12 +10,11 @@
 
 #include "boost/endian/conversion.hpp"
 
-#include "crab/array_domain.hpp"
 #include "radix_tree/radix_tree.hpp"
 
-#include "asm_ostream.hpp"
 #include "config.hpp"
-#include "dsl_syntax.hpp"
+#include "crab/array_domain.hpp"
+#include "crab/dsl_syntax.hpp"
 #include "spec_type_descriptors.hpp"
 
 namespace crab::domains {
@@ -24,7 +23,7 @@ static bool maybe_between(const NumAbsDomain& dom, const extended_number& x, con
                           const linear_expression_t& symb_ub) {
     using namespace dsl_syntax;
     assert(x.is_finite());
-    linear_expression_t num(*x.number());
+    const linear_expression_t num(*x.number());
     NumAbsDomain tmp(dom);
     tmp += num >= symb_lb;
     tmp += num <= symb_ub;
@@ -38,8 +37,8 @@ class offset_t final {
   public:
     static constexpr int bitsize = 8 * sizeof(index_t);
     offset_t() : _prefix_length(bitsize) {}
-    offset_t(index_t index) : _index(index), _prefix_length(bitsize) {}
-    offset_t(index_t index, int prefix_length) : _index(index), _prefix_length(prefix_length) {}
+    explicit offset_t(const index_t index) : _index(index), _prefix_length(bitsize) {}
+    offset_t(const index_t index, const int prefix_length) : _index(index), _prefix_length(prefix_length) {}
     explicit operator int() const { return static_cast<int>(_index); }
     operator index_t() const { return _index; }
     [[nodiscard]]
@@ -47,7 +46,7 @@ class offset_t final {
         return _prefix_length;
     }
 
-    index_t operator[](int n) const { return (_index >> (bitsize - 1 - n)) & 1; }
+    index_t operator[](const int n) const { return (_index >> (bitsize - 1 - n)) & 1; }
 };
 
 // NOTE: required by radix_tree
@@ -60,19 +59,19 @@ int radix_length(const offset_t& offset) {
 // NOTE: required by radix_tree
 // Get a range of bits out of the middle of a key, starting at [begin] for a given length.
 [[maybe_unused]]
-offset_t radix_substr(const offset_t& key, int begin, int length) {
+offset_t radix_substr(const offset_t& key, const int begin, const int length) {
     uint64_t mask;
 
     if (length == offset_t::bitsize) {
         mask = 0;
     } else {
-        mask = ((index_t)1) << length;
+        mask = static_cast<index_t>(1) << length;
     }
 
     mask -= 1;
     mask <<= offset_t::bitsize - length - begin;
 
-    index_t value = (((index_t)key) & mask) << begin;
+    const index_t value = (static_cast<index_t>(key) & mask) << begin;
     return offset_t{value, length};
 }
 
@@ -80,10 +79,10 @@ offset_t radix_substr(const offset_t& key, int begin, int length) {
 // Concatenate two bit patterns.
 [[maybe_unused]]
 offset_t radix_join(const offset_t& entry1, const offset_t& entry2) {
-    index_t value1 = (index_t)entry1;
-    index_t value2 = (index_t)entry2;
-    index_t value = value1 | (value2 >> entry1.prefix_length());
-    int prefix_length = entry1.prefix_length() + entry2.prefix_length();
+    const index_t value1 = (index_t)entry1;
+    const index_t value2 = (index_t)entry2;
+    const index_t value = value1 | (value2 >> entry1.prefix_length());
+    const int prefix_length = entry1.prefix_length() + entry2.prefix_length();
 
     return offset_t{value, prefix_length};
 }
@@ -108,10 +107,10 @@ class cell_t final {
     // Only offset_map_t can create cells
     cell_t() = default;
 
-    cell_t(offset_t offset, unsigned size) : _offset(offset), _size(size) {}
+    cell_t(const offset_t offset, const unsigned size) : _offset(offset), _size(size) {}
 
-    static interval_t to_interval(const offset_t o, unsigned size) {
-        return {number_t{static_cast<int>(o)}, number_t{static_cast<int>(o)} + number_t{static_cast<int>(size - 1)}};
+    static interval_t to_interval(const offset_t o, const unsigned size) {
+        return {static_cast<int>(o), number_t{static_cast<int>(o)} + size - 1};
     }
 
   public:
@@ -131,8 +130,8 @@ class cell_t final {
     }
 
     [[nodiscard]]
-    variable_t get_scalar(data_kind_t kind) const {
-        return variable_t::cell_var(kind, number_t{static_cast<index_t>(_offset)}, _size);
+    variable_t get_scalar(const data_kind_t kind) const {
+        return variable_t::cell_var(kind, static_cast<index_t>(_offset), _size);
     }
 
     // ignore the scalar variable
@@ -149,10 +148,10 @@ class cell_t final {
     // Return true if [o, o + size) definitely overlaps with the cell,
     // where o is a constant expression.
     [[nodiscard]]
-    bool overlap(const offset_t& o, unsigned size) const {
-        interval_t x = to_interval();
-        interval_t y = to_interval(o, size);
-        bool res = (!(x & y).is_bottom());
+    bool overlap(const offset_t& o, const unsigned size) const {
+        const interval_t x = to_interval();
+        const interval_t y = to_interval(o, size);
+        const bool res = (!(x & y).is_bottom());
         CRAB_LOG("array-expansion-overlap",
                  std::cout << "**Checking if " << x << " overlaps with " << y << "=" << res << "\n";);
         return res;
@@ -171,7 +170,7 @@ class cell_t final {
 // where symb_lb and symb_ub are not constant expressions.
 bool cell_t::symbolic_overlap(const linear_expression_t& symb_lb, const linear_expression_t& symb_ub,
                               const NumAbsDomain& dom) const {
-    interval_t x = to_interval();
+    const interval_t x = to_interval();
     return maybe_between(dom, x.lb(), symb_lb, symb_ub) || maybe_between(dom, x.ub(), symb_lb, symb_ub);
 }
 
@@ -183,12 +182,10 @@ class offset_map_t final {
     using cell_set_t = std::set<cell_t>;
 
     /*
-      The keys in the patricia tree are processing in big-endian
-      order. This means that the keys are sorted. Sortedness is
-      very important to efficiently perform operations such as
-      checking for overlap cells. Since keys are treated as bit
-      patterns, negative offsets can be used but they are treated
-      as large unsigned numbers.
+      The keys in the patricia tree are processing in big-endian order. This means that the keys are sorted.
+      Sortedness is very important to efficiently perform operations such as checking for overlap cells.
+      Since keys are treated as bit patterns, negative offsets can be used, but they are treated as large unsigned
+      numbers.
     */
     using patricia_tree_t = radix_tree<offset_t, cell_set_t>;
 
@@ -196,14 +193,9 @@ class offset_map_t final {
 
     // for algorithm::lower_bound and algorithm::upper_bound
     struct compare_binding_t {
-        bool operator()(const typename patricia_tree_t::value_type& kv, const offset_t& o) const {
-            return kv.first < o;
-        }
-        bool operator()(const offset_t& o, const typename patricia_tree_t::value_type& kv) const {
-            return o < kv.first;
-        }
-        bool operator()(const typename patricia_tree_t::value_type& kv1,
-                        const typename patricia_tree_t::value_type& kv2) const {
+        bool operator()(const patricia_tree_t::value_type& kv, const offset_t& o) const { return kv.first < o; }
+        bool operator()(const offset_t& o, const patricia_tree_t::value_type& kv) const { return o < kv.first; }
+        bool operator()(const patricia_tree_t::value_type& kv1, const patricia_tree_t::value_type& kv2) const {
             return kv1.first < kv2.first;
         }
     };
@@ -252,22 +244,23 @@ class offset_map_t final {
     bool is_top() const {
         return empty();
     }
+
     [[nodiscard]]
+    // ReSharper disable once CppMemberFunctionMayBeStatic
     bool is_bottom() const {
         return false;
     }
     /*
        We don't distinguish between bottom and top.
-       This is fine because separate_domain only calls bottom if
-       operator[] is called over a bottom state. Thus, we will make
-       sure that we don't call operator[] in that case.
+       This is fine because separate_domain only calls bottom if operator[] is called over a bottom state.
+       Thus, we will make sure that we don't call operator[] in that case.
     */
     static offset_map_t bottom() { return offset_map_t(); }
     static offset_map_t top() { return offset_map_t(); }
 };
 
 void offset_map_t::remove_cell(const cell_t& c) {
-    offset_t key = c.get_offset();
+    const offset_t key = c.get_offset();
     _map[key].erase(c);
 }
 
@@ -281,7 +274,7 @@ std::vector<cell_t> offset_map_t::get_overlap_cells_symbolic_offset(const NumAbs
         // If the largest cell overlaps with [offset, offset + size)
         // then the rest of cells are considered to overlap.
         // This is an over-approximation because [offset, offset+size) can overlap
-        // with the largest cell but it doesn't necessarily overlap with smaller cells.
+        // with the largest cell, but it doesn't necessarily overlap with smaller cells.
         // For efficiency, we assume it overlaps with all.
         cell_t largest_cell;
         for (const cell_t& c : o_cells) {
@@ -305,39 +298,34 @@ std::vector<cell_t> offset_map_t::get_overlap_cells_symbolic_offset(const NumAbs
     return out;
 }
 
-void offset_map_t::insert_cell(const cell_t& c) {
-    offset_t key = c.get_offset();
-    _map[key].insert(c);
-}
+void offset_map_t::insert_cell(const cell_t& c) { _map[c.get_offset()].insert(c); }
 
-std::optional<cell_t> offset_map_t::get_cell(offset_t o, unsigned size) {
+std::optional<cell_t> offset_map_t::get_cell(const offset_t o, const unsigned size) {
     cell_set_t& cells = _map[o];
-    auto it = cells.find(cell_t(o, size));
+    const auto it = cells.find(cell_t(o, size));
     if (it != cells.end()) {
         return *it;
     }
-    // not found
     return {};
 }
 
-cell_t offset_map_t::mk_cell(offset_t o, unsigned size) {
+cell_t offset_map_t::mk_cell(const offset_t o, const unsigned size) {
     // TODO: check array is the array associated to this offset map
 
-    auto maybe_c = get_cell(o, size);
-    if (maybe_c) {
+    if (const auto maybe_c = get_cell(o, size)) {
         return *maybe_c;
     }
     // create a new scalar variable for representing the contents
     // of bytes array[o,o+1,..., o+size-1]
-    cell_t c(o, size);
+    const cell_t c(o, size);
     insert_cell(c);
     return c;
 }
 
 // Return all cells that might overlap with (o, size).
-std::vector<cell_t> offset_map_t::get_overlap_cells(offset_t o, unsigned size) {
+std::vector<cell_t> offset_map_t::get_overlap_cells(const offset_t o, const unsigned size) {
     std::vector<cell_t> out;
-    compare_binding_t comp;
+    constexpr compare_binding_t comp;
 
     bool added = false;
     auto maybe_c = get_cell(o, size);
@@ -371,9 +359,9 @@ std::vector<cell_t> offset_map_t::get_overlap_cells(offset_t o, unsigned size) {
             bool continue_outer_loop = false;
             for (const cell_t& x : upto_lb[i]) {
                 if (x.overlap(o, size)) {
-                    if (!(x == *maybe_c)) {
+                    if (x != *maybe_c) {
                         // FIXME: we might have some duplicates. this is a very drastic solution.
-                        if (std::find(out.begin(), out.end(), x) == out.end()) {
+                        if (std::ranges::find(out, x) == out.end()) {
                             out.push_back(x);
                         }
                     }
@@ -393,7 +381,7 @@ std::vector<cell_t> offset_map_t::get_overlap_cells(offset_t o, unsigned size) {
         for (const cell_t& x : ub_it->second) {
             if (x.overlap(o, size)) {
                 // FIXME: we might have some duplicates. this is a very drastic solution.
-                if (std::find(out.begin(), out.end(), x) == out.end()) {
+                if (std::ranges::find(out, x) == out.end()) {
                     out.push_back(x);
                 }
                 continue_outer_loop = true;
@@ -408,11 +396,11 @@ std::vector<cell_t> offset_map_t::get_overlap_cells(offset_t o, unsigned size) {
     for (auto it = ++lb_it, et = ub_it; it != et; ++it) {
         bool continue_outer_loop = false;
         for (const cell_t& x : it->second) {
-            if (x == *maybe_c) { // we dont put it in out
+            if (x == *maybe_c) { // we don't put it in out
                 continue;
             }
             if (x.overlap(o, size)) {
-                if (std::find(out.begin(), out.end(), x) == out.end()) {
+                if (std::ranges::find(out, x) == out.end()) {
                     out.push_back(x);
                 }
                 continue_outer_loop = true;
@@ -432,28 +420,21 @@ std::vector<cell_t> offset_map_t::get_overlap_cells(offset_t o, unsigned size) {
 // We use a global array map
 using array_map_t = std::unordered_map<data_kind_t, offset_map_t>;
 
-static thread_local crab::lazy_allocator<array_map_t> global_array_map;
+static thread_local lazy_allocator<array_map_t> global_array_map;
 
 void clear_thread_local_state() { global_array_map.clear(); }
 
-static offset_map_t& lookup_array_map(data_kind_t kind) { return (*global_array_map)[kind]; }
+static offset_map_t& lookup_array_map(const data_kind_t kind) { return (*global_array_map)[kind]; }
 
 /**
     Ugly this needs to be fixed: needed if multiple analyses are
     run so we can clear the array map from one run to another.
 **/
-void clear_global_state() {
-    if (!global_array_map->empty()) {
-        if constexpr (crab::CrabSanityCheckFlag) {
-            CRAB_WARN("array_expansion static variable map is being cleared");
-        }
-        global_array_map->clear();
-    }
-}
+void clear_global_state() { global_array_map->clear(); }
 
-void array_domain_t::initialize_numbers(int lb, int width) {
+void array_domain_t::initialize_numbers(const int lb, const int width) {
     num_bytes.reset(lb, width);
-    lookup_array_map(data_kind_t::svalues).mk_cell(lb, width);
+    lookup_array_map(data_kind_t::svalues).mk_cell(offset_t{static_cast<index_t>(lb)}, width);
 }
 
 std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
@@ -476,16 +457,17 @@ std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
 }
 
 // Create a new cell that is a subset of an existing cell.
-void array_domain_t::split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len) {
+void array_domain_t::split_cell(NumAbsDomain& inv, const data_kind_t kind, const int cell_start_index,
+                                const unsigned int len) const {
     assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
 
     // Get the values from the indicated stack range.
-    std::optional<linear_expression_t> svalue = load(inv, data_kind_t::svalues, number_t(cell_start_index), len);
-    std::optional<linear_expression_t> uvalue = load(inv, data_kind_t::uvalues, number_t(cell_start_index), len);
+    const std::optional<linear_expression_t> svalue = load(inv, data_kind_t::svalues, number_t(cell_start_index), len);
+    const std::optional<linear_expression_t> uvalue = load(inv, data_kind_t::uvalues, number_t(cell_start_index), len);
 
     // Create a new cell for that range.
     offset_map_t& offset_map = lookup_array_map(kind);
-    cell_t new_cell = offset_map.mk_cell(cell_start_index, len);
+    const cell_t new_cell = offset_map.mk_cell(offset_t{static_cast<index_t>(cell_start_index)}, len);
     inv.assign(new_cell.get_scalar(data_kind_t::svalues), svalue);
     inv.assign(new_cell.get_scalar(data_kind_t::uvalues), uvalue);
 }
@@ -493,7 +475,7 @@ void array_domain_t::split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_st
 // Prepare to havoc bytes in the middle of a cell by potentially splitting the cell if it is numeric,
 // into the part to the left of the havoced portion, and the part to the right of the havoced portion.
 void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
-                                      const linear_expression_t& elem_size) {
+                                      const linear_expression_t& elem_size) const {
     assert(kind == data_kind_t::svalues || kind == data_kind_t::uvalues);
     offset_map_t& offset_map = lookup_array_map(kind);
     interval_t ii = inv.eval_interval(i);
@@ -509,16 +491,16 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         return;
     }
     auto size = static_cast<unsigned int>(*n_bytes);
-    offset_t o((uint64_t)*n);
+    offset_t o(static_cast<uint64_t>(*n));
 
     std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
     for (cell_t const& c : cells) {
         interval_t intv = c.to_interval();
-        int cell_start_index = (int)*intv.lb().number();
-        int cell_end_index = (int)*intv.ub().number();
+        int cell_start_index = static_cast<int>(*intv.lb().number());
+        int cell_end_index = static_cast<int>(*intv.ub().number());
 
         if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) ||
-            (cell_end_index + 1 < cell_start_index + sizeof(int64_t))) {
+            cell_end_index + 1 < cell_start_index + sizeof(int64_t)) {
             // We can only split numeric cells of size 8 or less.
             continue;
         }
@@ -529,11 +511,12 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         }
         if (cell_start_index < o) {
             // Use the bytes to the left of the specified range.
-            split_cell(inv, kind, cell_start_index, (unsigned int)(o - cell_start_index));
+            split_cell(inv, kind, cell_start_index, static_cast<unsigned int>(o - cell_start_index));
         }
         if (o + size - 1 < cell_end_index) {
             // Use the bytes to the right of the specified range.
-            split_cell(inv, kind, (int)(o + size), (unsigned int)(cell_end_index - (o + size - 1)));
+            split_cell(inv, kind, static_cast<int>(o + size),
+                       static_cast<unsigned int>(cell_end_index - (o + size - 1)));
         }
     }
 }
@@ -549,11 +532,10 @@ static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDoma
     std::vector<cell_t> cells;
     if (std::optional<number_t> n = ii.singleton()) {
         interval_t i_elem_size = inv.eval_interval(elem_size);
-        std::optional<number_t> n_bytes = i_elem_size.singleton();
-        if (n_bytes) {
+        if (auto n_bytes = i_elem_size.singleton()) {
             auto size = static_cast<unsigned int>(*n_bytes);
             // -- Constant index: kill overlapping cells
-            offset_t o((uint64_t)*n);
+            offset_t o(static_cast<uint64_t>(*n));
             cells = offset_map.get_overlap_cells(o, size);
             res = std::make_pair(o, size);
         }
@@ -580,9 +562,10 @@ static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDoma
     return res;
 }
 
-bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) {
-    auto min_lb = inv.eval_interval(lb).lb().number();
-    auto max_ub = inv.eval_interval(ub).ub().number();
+bool array_domain_t::all_num(const NumAbsDomain& inv, const linear_expression_t& lb,
+                             const linear_expression_t& ub) const {
+    const auto min_lb = inv.eval_interval(lb).lb().number();
+    const auto max_ub = inv.eval_interval(ub).ub().number();
     if (!min_lb || !max_ub || !min_lb->fits<int32_t>() || !max_ub->fits<int32_t>()) {
         return false;
     }
@@ -594,25 +577,25 @@ bool array_domain_t::all_num(NumAbsDomain& inv, const linear_expression_t& lb, c
         return true;
     }
 
-    return this->num_bytes.all_num((int32_t)*min_lb, (int32_t)*max_ub);
+    return this->num_bytes.all_num(static_cast<int32_t>(*min_lb), static_cast<int32_t>(*max_ub));
 }
 
 // Get the number of bytes, starting at offset, that are known to be numbers.
-int array_domain_t::min_all_num_size(const NumAbsDomain& inv, variable_t offset) const {
-    auto min_lb = inv.eval_interval(offset).lb().number();
-    auto max_ub = inv.eval_interval(offset).ub().number();
+int array_domain_t::min_all_num_size(const NumAbsDomain& inv, const variable_t offset) const {
+    const auto min_lb = inv.eval_interval(offset).lb().number();
+    const auto max_ub = inv.eval_interval(offset).ub().number();
     if (!min_lb || !max_ub || !min_lb->fits<int32_t>() || !max_ub->fits<int32_t>()) {
         return 0;
     }
-    auto lb = (int)min_lb.value();
-    auto ub = (int)max_ub.value();
+    const auto lb = static_cast<int>(min_lb.value());
+    const auto ub = static_cast<int>(max_ub.value());
     return std::max(0, this->num_bytes.all_num_width(lb) - (ub - lb));
 }
 
 // Get one byte of a value.
-std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width) {
-    variable_t v = variable_t::cell_var(data_kind_t::svalues, (o / width) * width, width);
-    std::optional<number_t> t = inv.eval_interval(v).singleton();
+std::optional<uint8_t> get_value_byte(const NumAbsDomain& inv, const offset_t o, const int width) {
+    const variable_t v = variable_t::cell_var(data_kind_t::svalues, (o / width) * width, width);
+    const std::optional<number_t> t = inv.eval_interval(v).singleton();
     if (!t) {
         return {};
     }
@@ -620,6 +603,7 @@ std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width)
 
     // Convert value to bytes of the appropriate endian-ness.
     switch (width) {
+    case sizeof(uint8_t): break;
     case sizeof(uint16_t):
         if (thread_local_options.big_endian) {
             n = boost::endian::native_to_big<uint16_t>(n);
@@ -641,38 +625,39 @@ std::optional<uint8_t> get_value_byte(NumAbsDomain& inv, offset_t o, int width)
             n = boost::endian::native_to_little<uint64_t>(n);
         }
         break;
+    default: CRAB_ERROR("Unexpected width ", width);
     }
-    uint8_t* bytes = (uint8_t*)&n;
+    const auto bytes = reinterpret_cast<uint8_t*>(&n);
     return bytes[o % width];
 }
 
-std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_kind_t kind,
-                                                        const linear_expression_t& i, int width) {
+std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv, data_kind_t kind,
+                                                        const linear_expression_t& i, int width) const {
     interval_t ii = inv.eval_interval(i);
     if (std::optional<number_t> n = ii.singleton()) {
         offset_map_t& offset_map = lookup_array_map(kind);
-        int64_t k = (int64_t)*n;
+        int64_t k = static_cast<int64_t>(*n);
         if (kind == data_kind_t::types) {
             auto [only_num, only_non_num] = num_bytes.uniformity(k, width);
             if (only_num) {
-                return number_t{T_NUM};
+                return T_NUM;
             }
             if (!only_non_num || width != 8) {
                 return {};
             }
         }
         offset_t o(k);
-        unsigned size = (long)width;
+        unsigned size = static_cast<long>(width);
         if (auto cell = lookup_array_map(kind).get_cell(o, size)) {
             return cell->get_scalar(kind);
         }
-        if ((kind == data_kind_t::svalues) || (kind == data_kind_t::uvalues)) {
+        if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
             // Copy bytes into result_buffer, taking into account that the
             // bytes might be in different stack variables and might be unaligned.
             uint8_t result_buffer[8];
             bool found = true;
             for (unsigned int index = 0; index < size; index++) {
-                offset_t byte_offset = o + index;
+                offset_t byte_offset{o + index};
                 std::optional<uint8_t> b = get_value_byte(inv, byte_offset, 8);
                 if (!b) {
                     b = get_value_byte(inv, byte_offset, 4);
@@ -694,35 +679,34 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
                 // We have an aligned result in result_buffer so we can now
                 // convert to an integer.
                 if (size == 1) {
-                    uint8_t b = *result_buffer;
-                    return number_t{b};
+                    return *result_buffer;
                 }
                 if (size == 2) {
-                    uint16_t b = *(uint16_t*)result_buffer;
+                    uint16_t b = *reinterpret_cast<uint16_t*>(result_buffer);
                     if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint16_t>(b);
                     } else {
                         b = boost::endian::native_to_little<uint16_t>(b);
                     }
-                    return number_t{b};
+                    return b;
                 }
                 if (size == 4) {
-                    uint32_t b = *(uint32_t*)result_buffer;
+                    uint32_t b = *reinterpret_cast<uint32_t*>(result_buffer);
                     if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint32_t>(b);
                     } else {
                         b = boost::endian::native_to_little<uint32_t>(b);
                     }
-                    return number_t{b};
+                    return b;
                 }
                 if (size == 8) {
-                    uint64_t b = *(uint64_t*)result_buffer;
+                    uint64_t b = *reinterpret_cast<uint64_t*>(result_buffer);
                     if (thread_local_options.big_endian) {
                         b = boost::endian::native_to_big<uint64_t>(b);
                     } else {
                         b = boost::endian::native_to_little<uint64_t>(b);
                     }
-                    return (kind == data_kind_t::uvalues) ? number_t(b) : number_t((int64_t)b);
+                    return kind == data_kind_t::uvalues ? number_t(b) : number_t(static_cast<int64_t>(b));
                 }
             }
         }
@@ -730,21 +714,17 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
         std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
         if (cells.empty()) {
             cell_t c = offset_map.mk_cell(o, size);
-            // Here it's ok to do assignment (instead of expand)
-            // because c is not a summarized variable. Otherwise, it
-            // would be unsound.
+            // Here it's ok to do assignment (instead of expand) because c is not a summarized variable.
+            // Otherwise, it would be unsound.
             return c.get_scalar(kind);
-        } else {
-            CRAB_WARN("Ignored read from cell ", kind, "[", o, "...", o + size - 1, "]", " because it overlaps with ",
-                      cells.size(), " cells");
-            /*
-                TODO: we can apply here "Value Recomposition" 'a la'
-                Mine'06 (https://arxiv.org/pdf/cs/0703074.pdf)
-                to construct values of some type from a sequence
-                of bytes. It can be endian-independent but it would more
-                precise if we choose between little- and big-endian.
-            */
         }
+        CRAB_WARN("Ignored read from cell ", kind, "[", o, "...", o + size - 1, "]", " because it overlaps with ",
+                  cells.size(), " cells");
+        /*
+            TODO: we can apply here "Value Recomposition" a la Mine'06 (https://arxiv.org/pdf/cs/0703074.pdf)
+                to construct values of some type from a sequence of bytes.
+                It can be endian-independent but it would more precise if we choose between little- and big-endian.
+        */
     } else if (kind == data_kind_t::types) {
         // Check whether the kind is uniform across the entire interval.
         auto lb = ii.lb().number();
@@ -752,9 +732,10 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
         if (lb.has_value() && ub.has_value()) {
             number_t fullwidth = ub.value() - lb.value() + width;
             if (lb.value().fits<uint32_t>() && fullwidth.fits<uint32_t>()) {
-                auto [only_num, only_non_num] = num_bytes.uniformity((uint32_t)lb.value(), (uint32_t)fullwidth);
+                auto [only_num, only_non_num] =
+                    num_bytes.uniformity(static_cast<uint32_t>(lb.value()), static_cast<uint32_t>(fullwidth));
                 if (only_num) {
-                    return number_t{T_NUM};
+                    return T_NUM;
                 }
             }
         }
@@ -768,8 +749,9 @@ std::optional<linear_expression_t> array_domain_t::load(NumAbsDomain& inv, data_
 // We are about to write to a given range of bytes on the stack.
 // Any cells covering that range need to be removed, and any cells that only
 // partially cover that range can be split such that any non-covered portions become new cells.
-static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_domain_t& array_domain, NumAbsDomain& inv,
-                                                                       data_kind_t kind, const linear_expression_t& idx,
+static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(const array_domain_t& array_domain,
+                                                                       NumAbsDomain& inv, const data_kind_t kind,
+                                                                       const linear_expression_t& idx,
                                                                        const linear_expression_t& elem_size) {
     if (kind == data_kind_t::svalues || kind == data_kind_t::uvalues) {
         array_domain.split_number_var(inv, kind, idx, elem_size);
@@ -777,15 +759,15 @@ static std::optional<std::pair<offset_t, unsigned>> split_and_find_var(array_dom
     return kill_and_find_var(inv, kind, idx, elem_size);
 }
 
-std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
-                                                const linear_expression_t& elem_size, const linear_expression_t& val) {
-    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
-    if (maybe_cell) {
+std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, const data_kind_t kind,
+                                                const linear_expression_t& idx, const linear_expression_t& elem_size,
+                                                const linear_expression_t& val) {
+    if (auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size)) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
         if (kind == data_kind_t::types) {
-            std::optional<number_t> t = inv.eval_interval(val).singleton();
-            if (t && (int64_t)*t == T_NUM) {
+            const std::optional<number_t> t = inv.eval_interval(val).singleton();
+            if (t && static_cast<int64_t>(*t) == T_NUM) {
                 num_bytes.reset(offset, size);
             } else {
                 num_bytes.havoc(offset, size);
@@ -800,13 +782,12 @@ std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, data_kind_t k
 std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv, const linear_expression_t& idx,
                                                      const linear_expression_t& elem_size,
                                                      const linear_expression_t& val) {
-    auto kind = data_kind_t::types;
-    auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
-    if (maybe_cell) {
+    constexpr auto kind = data_kind_t::types;
+    if (auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size)) {
         // perform strong update
         auto [offset, size] = *maybe_cell;
-        std::optional<number_t> t = inv.eval_interval(val).singleton();
-        if (t && (int64_t)*t == T_NUM) {
+        const std::optional<number_t> t = inv.eval_interval(val).singleton();
+        if (t && static_cast<int64_t>(*t) == T_NUM) {
             num_bytes.reset(offset, size);
         } else {
             num_bytes.havoc(offset, size);
@@ -822,7 +803,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv, const li
     return store_type(inv, idx, elem_size, variable_t::reg(data_kind_t::types, reg.v));
 }
 
-void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
+void array_domain_t::havoc(NumAbsDomain& inv, const data_kind_t kind, const linear_expression_t& idx,
                            const linear_expression_t& elem_size) {
     auto maybe_cell = split_and_find_var(*this, inv, kind, idx, elem_size);
     if (maybe_cell && kind == data_kind_t::types) {
@@ -831,7 +812,7 @@ void array_domain_t::havoc(NumAbsDomain& inv, data_kind_t kind, const linear_exp
     }
 }
 
-void array_domain_t::store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width) {
+void array_domain_t::store_numbers(const NumAbsDomain& inv, const variable_t _idx, const variable_t _width) {
 
     // TODO: this should be an user parameter.
     const number_t max_num_elems = EBPF_STACK_SIZE;
@@ -840,13 +821,13 @@ void array_domain_t::store_numbers(NumAbsDomain& inv, variable_t _idx, variable_
         return;
     }
 
-    std::optional<number_t> idx_n = inv[_idx].singleton();
+    const std::optional<number_t> idx_n = inv[_idx].singleton();
     if (!idx_n) {
         CRAB_WARN("array expansion store range ignored because ", "lower bound is not constant");
         return;
     }
 
-    std::optional<number_t> width = inv[_width].singleton();
+    const std::optional<number_t> width = inv[_width].singleton();
     if (!width) {
         CRAB_WARN("array expansion store range ignored because ", "upper bound is not constant");
         return;
@@ -857,7 +838,7 @@ void array_domain_t::store_numbers(NumAbsDomain& inv, variable_t _idx, variable_
                   "the number of elements is larger than default limit of ", max_num_elems);
         return;
     }
-    num_bytes.reset((int)*idx_n, (int)*width);
+    num_bytes.reset(static_cast<int>(*idx_n), static_cast<int>(*width));
 }
 
 void array_domain_t::set_to_top() { num_bytes.set_to_top(); }
@@ -894,8 +875,7 @@ array_domain_t array_domain_t::widen(const array_domain_t& other) const {
     return array_domain_t(num_bytes | other.num_bytes);
 }
 
-array_domain_t array_domain_t::widening_thresholds(const array_domain_t& other,
-                                                   const iterators::thresholds_t& ts) const {
+array_domain_t array_domain_t::widening_thresholds(const array_domain_t& other, const thresholds_t& ts) const {
     return array_domain_t(num_bytes | other.num_bytes);
 }
 
diff --git a/src/crab/array_domain.hpp b/src/crab/array_domain.hpp
index 6e0f75ff9..0768927a1 100644
--- a/src/crab/array_domain.hpp
+++ b/src/crab/array_domain.hpp
@@ -23,13 +23,11 @@
 
 #pragma once
 
-#include <functional>
 #include <optional>
 
 #include "crab/add_bottom.hpp"
-#include "crab/variable.hpp"
-
 #include "crab/bitset_domain.hpp"
+#include "crab/variable.hpp"
 
 namespace crab::domains {
 
@@ -46,7 +44,7 @@ class array_domain_t final {
   public:
     array_domain_t() = default;
 
-    array_domain_t(const bitset_domain_t& num_bytes) : num_bytes(num_bytes) {}
+    explicit array_domain_t(const bitset_domain_t& num_bytes) : num_bytes(num_bytes) {}
 
     void set_to_top();
     void set_to_bottom();
@@ -63,19 +61,19 @@ class array_domain_t final {
     array_domain_t operator|(const array_domain_t& other) const;
     array_domain_t operator&(const array_domain_t& other) const;
     array_domain_t widen(const array_domain_t& other) const;
-    array_domain_t widening_thresholds(const array_domain_t& other, const iterators::thresholds_t& ts) const;
+    array_domain_t widening_thresholds(const array_domain_t& other, const thresholds_t& ts) const;
     array_domain_t narrow(const array_domain_t& other) const;
 
     friend std::ostream& operator<<(std::ostream& o, const array_domain_t& dom);
     [[nodiscard]]
     string_invariant to_set() const;
 
-    bool all_num(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub);
+    bool all_num(const NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) const;
     [[nodiscard]]
     int min_all_num_size(const NumAbsDomain& inv, variable_t offset) const;
 
-    std::optional<linear_expression_t> load(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
-                                            int width);
+    std::optional<linear_expression_t> load(const NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
+                                            int width) const;
     std::optional<variable_t> store(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& idx,
                                     const linear_expression_t& elem_size, const linear_expression_t& val);
     std::optional<variable_t> store_type(NumAbsDomain& inv, const linear_expression_t& idx,
@@ -86,11 +84,11 @@ class array_domain_t final {
                const linear_expression_t& elem_size);
 
     // Perform array stores over an array segment
-    void store_numbers(NumAbsDomain& inv, variable_t _idx, variable_t _width);
+    void store_numbers(const NumAbsDomain& inv, variable_t _idx, variable_t _width);
 
     void split_number_var(NumAbsDomain& inv, data_kind_t kind, const linear_expression_t& i,
-                          const linear_expression_t& elem_size);
-    void split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len);
+                          const linear_expression_t& elem_size) const;
+    void split_cell(NumAbsDomain& inv, data_kind_t kind, int cell_start_index, unsigned int len) const;
 
     void initialize_numbers(int lb, int width);
 };
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index ff613cefc..76d364c50 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -152,7 +152,7 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
 
             // Use the high 32-bits from the left lower bound and the low 32-bits from the right singleton.
             // The result might be lower than the lower bound.
-            const int64_t lb_match = lb & 0xFFFFFFFF00000000 | rn->cast_to<int64_t>() & 0xFFFFFFFF;
+            const int64_t lb_match = (lb & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF);
             if (lb_match < lb) {
                 // The result is lower than the left interval, so try the next higher matching 64-bit value.
                 // It's ok if this goes higher than the left upper bound.
@@ -166,7 +166,7 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
 
             // Use the high 32-bits from the left upper bound and the low 32-bits from the right singleton.
             // The result might be higher than the upper bound.
-            const int64_t ub_match = ub & 0xFFFFFFFF00000000 | rn->cast_to<int64_t>() & 0xFFFFFFFF;
+            const int64_t ub_match = (ub & 0xFFFFFFFF00000000) | (rn->cast_to<int64_t>() & 0xFFFFFFFF);
             if (ub_match > ub) {
                 // The result is higher than the left interval, so try the next lower matching 64-bit value.
                 // It's ok if this goes lower than the left lower bound.
@@ -393,7 +393,7 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, const bool strict, const variabl
                right_interval <= interval_t::negative(32)) {
         // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
         // aka [INT_MAX+1, UINT_MAX].
-        return {left_uvalue >= number_t{INT32_MAX} + 1,
+        return {left_uvalue >= number_t{std::numeric_limits<int32_t>::max()} + 1,
                 strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if (inv.eval_interval(left_svalue) <= interval_t::signed_int(32) &&
@@ -596,7 +596,8 @@ assume_unsigned_32bit_gt(const NumAbsDomain& inv, const bool strict, const varia
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::unsigned_high(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MAX+1, UINT32_MAX].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MAX+1,
+        // std::numeric_limits<uint32_t>::max()].
         return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
@@ -2589,7 +2590,7 @@ void ebpf_domain_t::shl(const Reg& dst_reg, int imm, const int finite_width) {
             uint64_t ub_n = ub.cast_to<uint64_t>();
             const uint64_t uint_max = finite_width == 64 ? std::numeric_limits<uint64_t>::max()
                                                          : static_cast<uint64_t>(std::numeric_limits<uint32_t>::max());
-            if (lb_n >> finite_width - imm != ub_n >> finite_width - imm) {
+            if (lb_n >> (finite_width - imm) != ub_n >> (finite_width - imm)) {
                 // The bits that will be shifted out to the left are different,
                 // which means all combinations of remaining bits are possible.
                 lb_n = 0;
@@ -2682,7 +2683,7 @@ void ebpf_domain_t::sign_extend(const Reg& dst_reg, const linear_expression_t& r
         }
         right_interval = interval_t::signed_int(bits);
     }
-    const int64_t mask = 1ULL << bits - 1;
+    const int64_t mask = 1ULL << (bits - 1);
 
     // Sign extend each bound.
     int64_t lb = right_interval.lb().number().value().cast_to<int64_t>();
@@ -2713,7 +2714,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                              right_interval, left_interval_positive, left_interval_negative);
         if (auto sn = right_interval.singleton()) {
             // The BPF ISA requires masking the imm.
-            int64_t imm = sn->cast_to<int64_t>() & finite_width - 1;
+            int64_t imm = sn->cast_to<int64_t>() & (finite_width - 1);
 
             int64_t lb_n = std::numeric_limits<int64_t>::min() >> imm;
             int64_t ub_n = std::numeric_limits<int64_t>::max() >> imm;
@@ -2765,7 +2766,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         } else {
             // Use only the low 32 bits of the value.
             imm = static_cast<int>(std::get<Imm>(bin.v).v);
-            bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
+            bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
         }
         switch (bin.op) {
         case Bin::Op::MOV:
@@ -2981,10 +2982,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                 if (std::optional<number_t> sn = src_interval.singleton()) {
                     // truncate to uint64?
                     uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
-                    if (imm <= INT32_MAX) {
+                    if (imm <= std::numeric_limits<int32_t>::max()) {
                         if (!bin.is64) {
                             // Use only the low 32 bits of the value.
-                            bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
+                            bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
                         }
                         shl(bin.dst, static_cast<int32_t>(imm), finite_width);
                         break;
@@ -2999,10 +3000,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                 auto src_interval = m_inv.eval_interval(src.uvalue);
                 if (std::optional<number_t> sn = src_interval.singleton()) {
                     uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
-                    if (imm <= INT32_MAX) {
+                    if (imm <= std::numeric_limits<int32_t>::max()) {
                         if (!bin.is64) {
                             // Use only the low 32 bits of the value.
-                            bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
+                            bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
                         }
                         lshr(bin.dst, static_cast<int32_t>(imm), finite_width);
                         break;
@@ -3102,7 +3103,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         }
     }
     if (!bin.is64) {
-        bitwise_and(dst.svalue, dst.uvalue, UINT32_MAX);
+        bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
     }
 }
 
diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index c6313e8a4..8db510e2a 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -239,7 +239,7 @@ interval_t interval_t::And(const interval_t& x) const {
         }
     }
     if (x == interval_t{std::numeric_limits<uint32_t>::max()}) {
-        // Handle bitwise-AND with UINT32_MAX, which we do for 32-bit operations.
+        // Handle bitwise-AND with std::numeric_limits<uint32_t>::max(), which we do for 32-bit operations.
         if (const auto width = finite_size()) {
             const number_t lb32_n = lb().number()->truncate_to<uint32_t>();
             const number_t ub32_n = ub().number()->truncate_to<uint32_t>();
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index eefaf0f61..ae9d1a411 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -943,7 +943,6 @@ void SplitDBM::set(variable_t x, const interval_t& intv) {
     }
 
     vert_id v = get_vert(x);
-    bool overflow;
     if (intv.ub().is_finite()) {
         Weight ub;
         if (convert_NtoW_overflow(*intv.ub().number(), ub)) {
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 412874c2a..cc7752f3a 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -268,7 +268,7 @@ template <typename T>
 static vector<T> vector_of(const std::vector<uint8_t>& bytes) {
     auto data = bytes.data();
     auto size = bytes.size();
-    if ((size % sizeof(T) != 0) || size > UINT32_MAX || !data) {
+    if ((size % sizeof(T) != 0) || size > std::numeric_limits<uint32_t>::max() || !data) {
         throw std::runtime_error("Invalid argument to vector_of");
     }
     return {(T*)data, (T*)(data + size)};

From 28a9aee7a96bc9ec2c77ce3c97234a753c05da1f Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Fri, 27 Sep 2024 00:51:41 -0700
Subject: [PATCH 252/373] Support bpf2bpf calls from ELF files (#693)

* Support bpf2bpf calls from ELF files

---------
Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_files.cpp        | 91 +++++++++++++++++++++++++++++++++++-----
 src/test/test_verify.cpp |  7 ++++
 2 files changed, 88 insertions(+), 10 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index c10dd200c..d7664f177 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -60,7 +60,7 @@ bool is_map_section(const std::string& name) {
     return name == "maps" || (name.length() > 5 && name.compare(0, maps_prefix.length(), maps_prefix) == 0);
 }
 
-std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::const_symbol_section_accessor& symbols,
+std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(const ELFIO::const_symbol_section_accessor& symbols,
                                                                       ELFIO::Elf_Xword index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
@@ -74,7 +74,7 @@ std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(ELFIO::con
 }
 
 std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols,
-                                                       ELFIO::Elf_Word index) {
+                                                       ELFIO::Elf_Xword index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -162,12 +162,6 @@ std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& s
     return {program_name, size};
 }
 
-void relocate_function(ebpf_inst& inst, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index,
-                       const ELFIO::const_symbol_section_accessor& symbols) {
-    auto [relocation_offset, relocation_type] = get_value(symbols, index);
-    inst.imm = ((relocation_offset - offset) / sizeof(ebpf_inst)) - 1;
-}
-
 void relocate_map(ebpf_inst& inst, const std::string& symbol_name,
                   const std::variant<size_t, std::map<std::string, size_t>>& map_record_size_or_map_offsets,
                   const program_info& info, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index,
@@ -205,6 +199,69 @@ void relocate_map(ebpf_inst& inst, const std::string& symbol_name,
     }
 }
 
+// Structure used to keep track of subprogram relocation data until any subprograms
+// are loaded and can be appended to the calling program.
+struct function_relocation {
+    size_t prog_index{};              // Index of source program in vector of raw programs.
+    ELFIO::Elf_Xword source_offset{}; // Instruction offset in source section of source instruction.
+    ELFIO::Elf_Xword relocation_entry_index{};
+    std::string target_function_name;
+};
+
+static void append_subprogram(raw_program& prog, ELFIO::section& subprogram_section,
+                              ELFIO::const_symbol_section_accessor& symbols, const std::string& symbol_name) {
+    // Find subprogram by name.
+    for (ELFIO::Elf_Xword subprogram_offset = 0; subprogram_offset < subprogram_section.get_size();) {
+        auto [subprogram_name, subprogram_size] =
+            get_program_name_and_size(subprogram_section, subprogram_offset, symbols);
+        if (subprogram_size == 0) {
+            throw std::runtime_error("Zero-size subprogram '" + subprogram_name + "' in section '" +
+                                     subprogram_section.get_name() + "'");
+        }
+        if (subprogram_name == symbol_name) {
+            // Append subprogram instructions to the main program.
+            auto subprogram = vector_of<ebpf_inst>(subprogram_section.get_data() + subprogram_offset, subprogram_size);
+            prog.prog.insert(prog.prog.end(), subprogram.begin(), subprogram.end());
+            return;
+        }
+        subprogram_offset += subprogram_size;
+    }
+    throw std::runtime_error("Subprogram '" + symbol_name + "' not found in section '" +
+                             subprogram_section.get_name() + "'");
+}
+
+static void append_subprograms(raw_program& prog, vector<raw_program>& res, const vector<function_relocation>& function_relocations, ELFIO::elfio& reader,
+                               ELFIO::const_symbol_section_accessor& symbols) {
+    // Perform function relocations and fill in the inst.imm values of CallLocal instructions.
+    std::map<std::string, ELFIO::Elf_Xword> subprogram_offsets;
+    for (auto& reloc : function_relocations) {
+        if (reloc.prog_index >= res.size()) {
+            continue;
+        }
+        if (res[reloc.prog_index].function_name != prog.function_name) {
+            continue;
+        }
+
+        // Check whether we already appended the target program, and append it if not.
+        if (subprogram_offsets.find(reloc.target_function_name) == subprogram_offsets.end()) {
+            subprogram_offsets[reloc.target_function_name] = prog.prog.size();
+
+            auto [symbol_name, section_index] = get_symbol_name_and_section_index(symbols, reloc.relocation_entry_index);
+            ELFIO::section& subprogram_section = *reader.sections[section_index];
+            append_subprogram(prog, subprogram_section, symbols, symbol_name);
+        }
+
+        // Fill in the PC offset into the imm field of the CallLocal instruction.
+        ELFIO::Elf_Xword target_offset = subprogram_offsets[reloc.target_function_name];
+        int64_t offset_diff = (int64_t)(target_offset - reloc.source_offset - 1);
+        if (offset_diff < INT32_MIN || offset_diff > INT32_MAX) {
+            throw std::runtime_error("Offset difference out of int32_t range for instruction at source offset " +
+                                     std::to_string(reloc.source_offset));
+        }
+        prog.prog[reloc.source_offset].imm = (int32_t)offset_diff;
+    }
+}
+
 vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section,
                              const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
     if (options == nullptr) {
@@ -298,6 +355,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
     vector<raw_program> res;
     vector<string> unresolved_symbols;
 
+    vector<function_relocation> function_relocations;
     for (const auto& section : reader.sections) {
         const string name = section->get_name();
         if (!desired_section.empty() && name != desired_section) {
@@ -322,6 +380,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                              program_name,
                              vector_of<ebpf_inst>(section->get_data() + program_offset, program_size),
                              info};
+
             auto prelocs = reader.sections[string(".rel") + name];
             if (!prelocs) {
                 prelocs = reader.sections[string(".rela") + name];
@@ -357,10 +416,14 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
                     auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
 
-                    // Perform relocation for function symbols.
+                    // Queue up relocation for function symbols.
                     if ((inst.opcode == INST_OP_CALL) && (inst.src == INST_CALL_LOCAL) &&
                         (reader.sections[symbol_section_index] == section.get())) {
-                        relocate_function(inst, offset, index, symbols);
+                        function_relocation fr{.prog_index = res.size(),
+                                               .source_offset = offset / sizeof(ebpf_inst),
+                                               .relocation_entry_index = index,
+                                               .target_function_name = symbol_name};
+                        function_relocations.push_back(fr);
                         continue;
                     }
 
@@ -381,6 +444,14 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         }
     }
 
+    // Now that we have all programs in the list, we can recursively append any subprograms
+    // to the calling programs.  We have to keep them as programs themselves in case the caller
+    // wants to verify them separately, but we also have to append them if used as subprograms to
+    // allow the caller to be fully verified since inst.imm can only point into the same program.
+    for (auto& prog : res) {
+        append_subprograms(prog, res, function_relocations, reader, symbols);
+    }
+
     // Below, only relocations of symbols located in the map sections are allowed,
     // so if there are relocations there needs to be a maps section.
     if (!unresolved_symbols.empty()) {
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index a41ec685c..810ea82f8 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -76,6 +76,11 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true);    \
     }
 
+#define TEST_PROGRAM_REJECT(project, filename, section_name, program_name) \
+    TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false);    \
+    }
+
 #define TEST_SECTION_REJECT(project, filename, section)                                                     \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                 \
@@ -497,6 +502,8 @@ TEST_SECTION("raw_tracepoint/filler/sys_sendmsg_x")
 TEST_SECTION("raw_tracepoint/filler/proc_startupdate_2")
 TEST_SECTION("raw_tracepoint/filler/sys_recvfrom_x")
 */
+TEST_PROGRAM_REJECT("build", "bpf2bpf.o", ".text", "plus1"); // Subprogram will fail verification.
+TEST_PROGRAM("build", "bpf2bpf.o", ".text", "func"); // Subprogram can be called from main program.
 TEST_SECTION("build", "byteswap.o", ".text")
 TEST_SECTION("build", "stackok.o", ".text")
 TEST_SECTION("build", "packet_start_ok.o", "xdp")

From 149a915aa29e96fc630806f235701c8a3740f172 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Fri, 27 Sep 2024 10:52:15 +0300
Subject: [PATCH 253/373] Cleanup interval bound handling (#692)

---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/ebpf_domain.cpp   | 104 +++++++++++++++----------------------
 src/crab/ebpf_domain.hpp   |   4 +-
 src/crab/interval.hpp      |  42 ++++++++++-----
 src/crab/split_dbm.cpp     |  15 +++++-
 src/crab_utils/num_big.hpp |   7 ++-
 src/string_constraints.hpp |   4 +-
 6 files changed, 96 insertions(+), 80 deletions(-)

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 76d364c50..555a13de9 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -144,11 +144,12 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
     using namespace crab::dsl_syntax;
 
     if (const auto rn = right_interval.singleton()) {
-        if (auto size = inv.eval_interval(left_svalue).finite_size()) {
+        const auto left_svalue_interval = inv.eval_interval(left_svalue);
+        if (auto size = left_svalue_interval.finite_size()) {
             // Find the lowest 64-bit svalue whose low 32 bits match the singleton.
 
             // Get lower bound as a 64-bit value.
-            int64_t lb = inv.eval_interval(left_svalue).lb().number()->cast_to<int64_t>();
+            int64_t lb = left_svalue_interval.lb().number()->cast_to<int64_t>();
 
             // Use the high 32-bits from the left lower bound and the low 32-bits from the right singleton.
             // The result might be lower than the lower bound.
@@ -162,7 +163,7 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
             // Find the highest 64-bit svalue whose low 32 bits match the singleton.
 
             // Get upper bound as a 64-bit value.
-            const int64_t ub = inv.eval_interval(left_svalue).ub().number()->cast_to<int64_t>();
+            const int64_t ub = left_svalue_interval.ub().number()->cast_to<int64_t>();
 
             // Use the high 32-bits from the left upper bound and the low 32-bits from the right singleton.
             // The result might be higher than the upper bound.
@@ -278,10 +279,10 @@ static void get_unsigned_intervals(const NumAbsDomain& inv, bool is64, const var
 }
 
 static std::vector<linear_constraint_t>
-assume_signed_64bit_lt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
-                       const variable_t left_uvalue, const interval_t& left_interval_positive,
-                       const interval_t& left_interval_negative, const linear_expression_t& right_svalue,
-                       const linear_expression_t& right_uvalue, const interval_t& right_interval) {
+assume_signed_64bit_lt(const bool strict, const variable_t left_svalue, const variable_t left_uvalue,
+                       const interval_t& left_interval_positive, const interval_t& left_interval_negative,
+                       const linear_expression_t& right_svalue, const linear_expression_t& right_uvalue,
+                       const interval_t& right_interval) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
@@ -309,16 +310,14 @@ assume_signed_32bit_lt(const NumAbsDomain& inv, const bool strict, const variabl
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::negative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in
-        // [std::numeric_limits<int32_t>::min(), -1], aka [std::numeric_limits<int32_t>::max()+1,
-        // Ustd::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
+        // aka [INT_MAX+1, UINT_MAX].
         return {std::numeric_limits<int32_t>::max() < left_uvalue,
                 strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::nonnegative(32) &&
                right_interval <= interval_t::nonnegative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
-        // std::numeric_limits<int32_t>::max()]
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX]
         const auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue,
@@ -346,8 +345,7 @@ assume_signed_64bit_gt(const bool strict, const variable_t left_svalue, const va
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::nonnegative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
-        // std::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         const auto lpub = left_interval_positive.truncate_to<int64_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
@@ -358,9 +356,8 @@ assume_signed_64bit_gt(const bool strict, const variable_t left_svalue, const va
                 left_uvalue <= *lpub.number()};
     } else if ((left_interval_negative | left_interval_positive) <= interval_t::negative(64) &&
                right_interval <= interval_t::negative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in
-        // [std::numeric_limits<int32_t>::min(), -1], aka [std::numeric_limits<int32_t>::max()+1,
-        // Ustd::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MIN, -1],
+        // aka [INT_MAX+1, UINT_MAX].
         return {std::numeric_limits<int64_t>::max() < left_uvalue,
                 strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
@@ -379,8 +376,7 @@ assume_signed_32bit_gt(const NumAbsDomain& inv, const bool strict, const variabl
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::nonnegative(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
-        // std::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         const auto lpub = left_interval_positive.truncate_to<int32_t>().ub();
         return {left_svalue >= 0,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue,
@@ -453,7 +449,7 @@ static std::vector<linear_constraint_t> assume_signed_cst_interval(const NumAbsD
 
     if (is64) {
         if (is_lt) {
-            return assume_signed_64bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_positive,
+            return assume_signed_64bit_lt(strict, left_svalue, left_uvalue, left_interval_positive,
                                           left_interval_negative, right_svalue, right_uvalue, right_interval);
         } else {
             return assume_signed_64bit_gt(strict, left_svalue, left_uvalue, left_interval_positive,
@@ -504,15 +500,13 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
         }
     }
     if (right_interval <= interval_t::signed_int(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
-        // std::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         auto llub = left_interval_low.truncate_to<uint64_t>().ub();
         return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
                 left_uvalue <= *llub.number(), 0 <= left_svalue,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if (left_interval_low.is_bottom() && right_interval <= interval_t::unsigned_high(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in
-        // [std::numeric_limits<int32_t>::max()+1, Ustd::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
         return {0 <= left_uvalue, strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue,
                 strict ? left_svalue < right_svalue : left_svalue <= right_svalue};
     } else if ((left_interval_low | left_interval_high) == interval_t::unsigned_int(64)) {
@@ -524,11 +518,11 @@ assume_unsigned_64bit_lt(const NumAbsDomain& inv, bool strict, variable_t left_s
     }
 }
 
-static std::vector<linear_constraint_t>
-assume_unsigned_32bit_lt(const NumAbsDomain& inv, const bool strict, const variable_t left_svalue,
-                         const variable_t left_uvalue, const interval_t& left_interval_low,
-                         const interval_t& left_interval_high, const linear_expression_t& right_svalue,
-                         const linear_expression_t& right_uvalue, const interval_t& right_interval) {
+static std::vector<linear_constraint_t> assume_unsigned_32bit_lt(const NumAbsDomain& inv, const bool strict,
+                                                                 const variable_t left_svalue,
+                                                                 const variable_t left_uvalue,
+                                                                 const linear_expression_t& right_svalue,
+                                                                 const linear_expression_t& right_uvalue) {
     using crab::interval_t;
     using namespace crab::dsl_syntax;
 
@@ -571,14 +565,12 @@ assume_unsigned_64bit_gt(const NumAbsDomain& inv, const bool strict, const varia
                                                                        : left_uvalue >= *lhlb.number(),
                 left_svalue < 0};
     } else if (right_interval <= interval_t::unsigned_high(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in
-        // [std::numeric_limits<int32_t>::max()+1, Ustd::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
         return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if ((left_interval_low | left_interval_high) <= interval_t::nonnegative(64) &&
                right_interval <= interval_t::nonnegative(64)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [0,
-        // std::numeric_limits<int32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [0, INT_MAX].
         return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else {
@@ -596,8 +588,7 @@ assume_unsigned_32bit_gt(const NumAbsDomain& inv, const bool strict, const varia
     using namespace crab::dsl_syntax;
 
     if (right_interval <= interval_t::unsigned_high(32)) {
-        // Interval can be represented as both an svalue and a uvalue since it fits in [INT32_MAX+1,
-        // std::numeric_limits<uint32_t>::max()].
+        // Interval can be represented as both an svalue and a uvalue since it fits in [INT_MAX+1, UINT_MAX].
         return {0 <= left_uvalue, strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue,
                 strict ? left_svalue > right_svalue : left_svalue >= right_svalue};
     } else if (inv.eval_interval(left_uvalue) <= interval_t::unsigned_int(32) &&
@@ -647,32 +638,26 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
     const bool is_lt = op == Condition::Op::LT || op == Condition::Op::LE;
     bool strict = op == Condition::Op::LT || op == Condition::Op::GT;
 
-    auto llb = left_interval.lb();
-    auto lub = left_interval.ub();
-    auto rlb = right_interval.lb();
-    auto rub = right_interval.ub();
-    if (!is_lt && (strict ? lub <= rlb : lub < rlb)) {
+    auto [llb, lub] = left_interval.pair();
+    auto [rlb, rub] = right_interval.pair();
+    if (is_lt ? (strict ? llb >= rub : llb > rub) : (strict ? lub <= rlb : lub < rlb)) {
         // Left unsigned interval is lower than right unsigned interval.
         return {linear_constraint_t::false_const()};
-    } else if (is_lt && (strict ? llb >= rub : llb > rub)) {
-        // Left unsigned interval is higher than right unsigned interval.
-        return {linear_constraint_t::false_const()};
     }
     if (is_lt && (strict ? lub < rlb : lub <= rlb)) {
         // Left unsigned interval is lower than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
         if (is64) {
             return {strict ? left_uvalue < right_uvalue : left_uvalue <= right_uvalue};
-        } else {
-            return {linear_constraint_t::true_const()};
         }
+        return {};
     } else if (!is_lt && (strict ? llb > rub : llb >= rub)) {
         // Left unsigned interval is higher than right unsigned interval. We still add a
         // relationship for use when widening, such as is used in the prime conformance test.
         if (is64) {
             return {strict ? left_uvalue > right_uvalue : left_uvalue >= right_uvalue};
         } else {
-            return {linear_constraint_t::true_const()};
+            return {};
         }
     }
 
@@ -686,8 +671,7 @@ static std::vector<linear_constraint_t> assume_unsigned_cst_interval(const NumAb
         }
     } else {
         if (is_lt) {
-            return assume_unsigned_32bit_lt(inv, strict, left_svalue, left_uvalue, left_interval_low,
-                                            left_interval_high, right_svalue, right_uvalue, right_interval);
+            return assume_unsigned_32bit_lt(inv, strict, left_svalue, left_uvalue, right_svalue, right_uvalue);
         } else {
             return assume_unsigned_32bit_gt(inv, strict, left_svalue, left_uvalue, left_interval_low,
                                             left_interval_high, right_svalue, right_uvalue, right_interval);
@@ -847,7 +831,7 @@ void ebpf_domain_t::TypeDomain::add_extra_invariant(const NumAbsDomain& dst,
     }
 }
 
-void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const {
+void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const {
     // Some variables are type-specific.  Type-specific variables
     // for a register can exist in the domain whenever the associated
     // type value is present in the register's types interval (and the
@@ -897,16 +881,16 @@ void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst
 
 void ebpf_domain_t::operator|=(ebpf_domain_t&& other) {
     if (is_bottom()) {
-        *this = other;
+        *this = std::move(other);
         return;
     }
     if (other.is_bottom()) {
         return;
     }
 
-    type_inv.selectively_join_based_on_type(m_inv, other.m_inv);
+    type_inv.selectively_join_based_on_type(m_inv, std::move(other.m_inv));
 
-    stack |= other.stack;
+    stack |= std::move(other.stack);
 }
 
 void ebpf_domain_t::operator|=(const ebpf_domain_t& other) {
@@ -1359,8 +1343,7 @@ bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const variable
     if (interval.is_top()) {
         return true;
     }
-    return interval.lb().number().value_or(std::numeric_limits<int32_t>::min()) <= type &&
-           type <= interval.ub().number().value_or(std::numeric_limits<int32_t>::max());
+    return interval.contains(type);
 }
 
 bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const number_t& t, const type_encoding_t type) const {
@@ -1380,14 +1363,11 @@ NumAbsDomain ebpf_domain_t::TypeDomain::join_over_types(
         return res;
     }
     NumAbsDomain res = NumAbsDomain::bottom();
-    auto lb = types.lb().is_finite() ? static_cast<type_encoding_t>(static_cast<int>(types.lb().number().value()))
-                                     : T_MAP_PROGRAMS;
-    auto ub =
-        types.ub().is_finite() ? static_cast<type_encoding_t>(static_cast<int>(types.ub().number().value())) : T_SHARED;
-    for (type_encoding_t type = lb; type <= ub; type = static_cast<type_encoding_t>(static_cast<int>(type) + 1)) {
+    auto [lb, ub] = types.bound(T_MIN, T_MAX);
+    for (type_encoding_t type = lb; type <= ub; type = static_cast<type_encoding_t>(type + 1)) {
         NumAbsDomain tmp(inv);
         transition(tmp, type);
-        selectively_join_based_on_type(res, tmp); // res |= tmp;
+        selectively_join_based_on_type(res, std::move(tmp)); // res |= tmp;
     }
     return res;
 }
@@ -1471,10 +1451,10 @@ void ebpf_domain_t::check_access_packet(NumAbsDomain& inv, const linear_expressi
 }
 
 void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                                        const variable_t region_size) const {
+                                        const variable_t shared_region_size) const {
     using namespace crab::dsl_syntax;
     require(inv, lb >= 0, "Lower bound must be at least 0");
-    require(inv, ub <= region_size, std::string("Upper bound must be at most ") + region_size.name());
+    require(inv, ub <= shared_region_size, std::string("Upper bound must be at most ") + shared_region_size.name());
 }
 
 void ebpf_domain_t::operator()(const Assume& s) {
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index b97d7bb25..63f3749ba 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -176,7 +176,7 @@ class ebpf_domain_t final {
     void check_access_stack(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) const;
     void check_access_context(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub) const;
     void check_access_packet(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
-                             std::optional<variable_t> shared_region_size) const;
+                             std::optional<variable_t> packet_size) const;
     void check_access_shared(NumAbsDomain& inv, const linear_expression_t& lb, const linear_expression_t& ub,
                              variable_t shared_region_size) const;
 
@@ -249,7 +249,7 @@ class ebpf_domain_t final {
         NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
                                      const std::function<void(NumAbsDomain&)>& if_true,
                                      const std::function<void(NumAbsDomain&)>& if_false) const;
-        void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain& src) const;
+        void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const;
         void add_extra_invariant(const NumAbsDomain& dst, std::map<variable_t, interval_t>& extra_invariants,
                                  variable_t type_variable, type_encoding_t type, data_kind_t kind,
                                  const NumAbsDomain& other) const;
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 1a98ccc99..22d5124f5 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -54,6 +54,13 @@ class interval_t final {
         }
     }
 
+    template <is_enum T>
+    interval_t(T lb, T ub) : _lb(bound_t{lb}), _ub(bound_t{ub}) {
+        if (lb > ub) {
+            _lb = bound_t{number_t{0}};
+            _ub = bound_t{-1};
+        }
+    }
     explicit interval_t(const bound_t& b)
         : _lb(b.is_infinite() ? bound_t{number_t{0}} : b), _ub(b.is_infinite() ? bound_t{-1} : b) {}
 
@@ -74,6 +81,28 @@ class interval_t final {
         return _ub;
     }
 
+    [[nodiscard]]
+    std::tuple<bound_t, bound_t> pair() const {
+        return {_lb, _ub};
+    }
+
+    template <std::integral T>
+    [[nodiscard]]
+    std::tuple<T, T> bound(T lb, T ub) const {
+        interval_t b = interval_t(lb, ub) & *this;
+        if (b.is_bottom()) {
+            CRAB_ERROR("Cannot convert bottom to tuple");
+        }
+        return {static_cast<T>(*b._lb.number()), static_cast<T>(*b._ub.number())};
+    }
+
+    template <is_enum T>
+    [[nodiscard]]
+    std::tuple<T, T> bound(T elb, T eub) const {
+        auto [lb, ub] = bound(static_cast<std::underlying_type_t<T>>(elb), static_cast<std::underlying_type_t<T>>(eub));
+        return {static_cast<T>(lb), static_cast<T>(ub)};
+    }
+
     [[nodiscard]]
     bool is_bottom() const {
         return (_lb > _ub);
@@ -428,19 +457,6 @@ inline interval_t operator-(const interval_t& x, const number_t& c) { return x -
 
 } // namespace interval_operators
 
-inline interval_t trim_interval(const interval_t& i, const interval_t& j) {
-    if (std::optional<number_t> c = j.singleton()) {
-        if (i.lb() == bound_t{*c}) {
-            return interval_t(bound_t{*c + 1}, i.ub());
-        } else if (i.ub() == bound_t{*c}) {
-            return interval_t(i.lb(), bound_t{*c - 1});
-        } else if (i.is_top() && (*c == 0)) {
-            return {number_t{1}, number_t{std::numeric_limits<uint64_t>::max()}};
-        }
-    }
-    return i;
-}
-
 } // namespace crab
 
 std::string to_string(const crab::interval_t& interval) noexcept;
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index ae9d1a411..1fcd2bbd1 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -282,9 +282,22 @@ bool SplitDBM::add_linear_leq(const linear_expression_t& exp) {
     return true;
 }
 
+static interval_t trim_interval(const interval_t& i, const number_t& n) {
+    if (i.lb() == n) {
+        return interval_t{n + 1, i.ub()};
+    }
+    if (i.ub() == n) {
+        return interval_t{i.lb(), n - 1};
+    }
+    if (i.is_top() && n == 0) {
+        return interval_t{1, std::numeric_limits<uint64_t>::max()};
+    }
+    return i;
+}
+
 bool SplitDBM::add_univar_disequation(variable_t x, const number_t& n) {
     interval_t i = get_interval(x, 0);
-    interval_t new_i = trim_interval(i, interval_t(n));
+    interval_t new_i = trim_interval(i, n);
     if (new_i.is_bottom()) {
         return false;
     }
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index f93b0c532..e57232c6b 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -27,7 +27,7 @@ class number_t final {
     number_t() = default;
     number_t(cpp_int n) : _n(std::move(n)) {}
     number_t(std::integral auto n) : _n{n} {}
-    number_t(is_enum auto n) : _n{static_cast<int64_t>(n)} {}
+    number_t(is_enum auto n) : _n{static_cast<std::underlying_type_t<decltype(n)>>(n)} {}
     explicit number_t(const std::string& s) { _n = cpp_int(s); }
 
     template <std::integral T>
@@ -38,6 +38,11 @@ class number_t final {
         return static_cast<T>(_n);
     }
 
+    template <is_enum T>
+    T cast_to() const {
+        return static_cast<T>(static_cast<std::underlying_type_t<T>>(_n));
+    }
+
     explicit operator cpp_int() const { return _n; }
 
     [[nodiscard]]
diff --git a/src/string_constraints.hpp b/src/string_constraints.hpp
index a6f050011..273a772c9 100644
--- a/src/string_constraints.hpp
+++ b/src/string_constraints.hpp
@@ -24,13 +24,15 @@ enum type_encoding_t {
     T_STACK = -1,
     T_SHARED = 0
 };
+constexpr type_encoding_t T_MIN = T_MAP_PROGRAMS;
+constexpr type_encoding_t T_MAX = T_SHARED;
 
 struct string_invariant {
     std::optional<std::set<std::string>> maybe_inv{};
 
     string_invariant() = default;
 
-    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)) {};
+    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)){};
 
     string_invariant(const string_invariant& inv) = default;
     string_invariant& operator=(const string_invariant& inv) = default;

From 07a6da07d721ca80ee43ae02d1ce0b2f51f8b1fd Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Fri, 27 Sep 2024 16:14:37 +0300
Subject: [PATCH 254/373] Cleanup asm_files.cpp (#694)

---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_files.cpp         | 260 +++++++++++++++++++-------------------
 src/test/test_marshal.cpp |   4 +-
 2 files changed, 133 insertions(+), 131 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index d7664f177..f6134e4c8 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -16,36 +16,33 @@
 #include "asm_files.hpp"
 #include "platform.hpp"
 
-using std::cout;
 using std::string;
 using std::vector;
 
 template <typename T>
-static vector<T> vector_of(const char* data, ELFIO::Elf_Xword size) {
-    if ((size % sizeof(T) != 0) || size > std::numeric_limits<uint32_t>::max() || !data) {
+static vector<T> vector_of(const char* data, const ELFIO::Elf_Xword size) {
+    if (size % sizeof(T) != 0 || size > std::numeric_limits<uint32_t>::max() || !data) {
         throw std::runtime_error("Invalid argument to vector_of");
     }
-    return {(T*)data, (T*)(data + size)};
+    return {reinterpret_cast<const T*>(data), reinterpret_cast<const T*>(data + size)};
 }
 
 template <typename T>
 static vector<T> vector_of(const ELFIO::section& sec) {
-    auto data = sec.get_data();
-    auto size = sec.get_size();
-    return vector_of<T>(data, size);
+    return vector_of<T>(sec.get_data(), sec.get_size());
 }
 
 int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
                     ebpf_verifier_options_t options) {
-    EquivalenceKey equiv{map_type.value_type, key_size, value_size, map_type.is_array ? max_entries : 0};
-    if (!global_program_info->cache.count(equiv)) {
+    const EquivalenceKey equiv{map_type.value_type, key_size, value_size, map_type.is_array ? max_entries : 0};
+    if (!global_program_info->cache.contains(equiv)) {
         // +1 so 0 is the null FD
-        global_program_info->cache[equiv] = (int)global_program_info->cache.size() + 1;
+        global_program_info->cache[equiv] = static_cast<int>(global_program_info->cache.size()) + 1;
     }
     return global_program_info->cache.at(equiv);
 }
 
-EbpfMapDescriptor* find_map_descriptor(int map_fd) {
+EbpfMapDescriptor* find_map_descriptor(const int map_fd) {
     for (EbpfMapDescriptor& map : global_program_info->map_descriptors) {
         if (map.original_fd == map_fd) {
             return &map;
@@ -55,13 +52,13 @@ EbpfMapDescriptor* find_map_descriptor(int map_fd) {
 }
 
 // Maps sections are identified as any section called "maps", or matching "maps/<map-name>".
-bool is_map_section(const std::string& name) {
-    std::string maps_prefix = "maps/";
+static bool is_map_section(const string& name) {
+    const string maps_prefix = "maps/";
     return name == "maps" || (name.length() > 5 && name.compare(0, maps_prefix.length(), maps_prefix) == 0);
 }
 
-std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(const ELFIO::const_symbol_section_accessor& symbols,
-                                                                      ELFIO::Elf_Xword index) {
+static std::tuple<string, ELFIO::Elf_Half>
+get_symbol_name_and_section_index(const ELFIO::const_symbol_section_accessor& symbols, const ELFIO::Elf_Xword index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -73,8 +70,8 @@ std::tuple<string, ELFIO::Elf_Half> get_symbol_name_and_section_index(const ELFI
     return {symbol_name, section_index};
 }
 
-std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols,
-                                                       ELFIO::Elf_Xword index) {
+static std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol_section_accessor& symbols,
+                                                              const ELFIO::Elf_Xword index) {
     string symbol_name;
     ELFIO::Elf64_Addr value{};
     ELFIO::Elf_Xword size{};
@@ -86,15 +83,15 @@ std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const_symbol
     return {value, type};
 }
 
-// parse_maps_sections processes all maps sections in the provided ELF file by calling the platform-specific maps
+// parse_maps_sections processes all maps sections in the provided ELF file by calling the platform-specific maps'
 // parser. The section index of each maps section is inserted into section_indices.
 static size_t parse_map_sections(const ebpf_verifier_options_t* options, const ebpf_platform_t* platform,
-                                 const ELFIO::elfio& reader, std::vector<EbpfMapDescriptor>& map_descriptors,
+                                 const ELFIO::elfio& reader, vector<EbpfMapDescriptor>& map_descriptors,
                                  std::set<ELFIO::Elf_Half>& section_indices,
-                                 ELFIO::const_symbol_section_accessor& symbols) {
+                                 const ELFIO::const_symbol_section_accessor& symbols) {
     size_t map_record_size = platform->map_record_size;
     for (ELFIO::Elf_Half i = 0; i < reader.sections.size(); ++i) {
-        auto s = reader.sections[i];
+        const auto s = reader.sections[i];
         if (!is_map_section(s->get_name())) {
             continue;
         }
@@ -103,18 +100,18 @@ static size_t parse_map_sections(const ebpf_verifier_options_t* options, const e
         int map_count = 0;
         for (ELFIO::Elf_Xword index = 0; index < symbols.get_symbols_num(); index++) {
             auto [symbol_name, section_index] = get_symbol_name_and_section_index(symbols, index);
-            if ((section_index == i) && !symbol_name.empty()) {
+            if (section_index == i && !symbol_name.empty()) {
                 map_count++;
             }
         }
 
         if (map_count > 0) {
             map_record_size = s->get_size() / map_count;
-            if ((s->get_data() == nullptr) || (map_record_size == 0)) {
-                throw std::runtime_error(std::string("bad maps section"));
+            if (s->get_data() == nullptr || map_record_size == 0) {
+                throw std::runtime_error("bad maps section");
             }
             if (s->get_size() % map_record_size != 0) {
-                throw std::runtime_error(std::string("bad maps section size"));
+                throw std::runtime_error("bad maps section size");
             }
             platform->parse_maps_section(map_descriptors, s->get_data(), map_record_size, map_count, platform,
                                          *options);
@@ -125,8 +122,8 @@ static size_t parse_map_sections(const ebpf_verifier_options_t* options, const e
     return map_record_size;
 }
 
-vector<raw_program> read_elf(const std::string& path, const std::string& desired_section,
-                             const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
+vector<raw_program> read_elf(const string& path, const string& desired_section, const ebpf_verifier_options_t* options,
+                             const ebpf_platform_t* platform) {
     if (std::ifstream stream{path, std::ios::in | std::ios::binary}) {
         return read_elf(stream, path, desired_section, options, platform);
     }
@@ -134,13 +131,14 @@ vector<raw_program> read_elf(const std::string& path, const std::string& desired
     if (stat(path.c_str(), &st)) {
         throw std::runtime_error(string(strerror(errno)) + " opening " + path);
     }
-    throw std::runtime_error(string("Can't process ELF file ") + path);
+    throw std::runtime_error("Can't process ELF file " + path);
 }
 
-std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& sec, ELFIO::Elf_Xword start,
-                                                               ELFIO::const_symbol_section_accessor& symbols) {
-    ELFIO::Elf_Xword symbol_count = symbols.get_symbols_num();
-    ELFIO::Elf_Half section_index = sec.get_index();
+static std::tuple<string, ELFIO::Elf_Xword>
+get_program_name_and_size(const ELFIO::section& sec, const ELFIO::Elf_Xword start,
+                          const ELFIO::const_symbol_section_accessor& symbols) {
+    const ELFIO::Elf_Xword symbol_count = symbols.get_symbols_num();
+    const ELFIO::Elf_Half section_index = sec.get_index();
     string program_name = sec.get_name();
     ELFIO::Elf_Xword size = sec.get_size() - start;
     for (ELFIO::Elf_Xword index = 0; index < symbol_count; index++) {
@@ -164,7 +162,7 @@ std::tuple<string, ELFIO::Elf_Xword> get_program_name_and_size(ELFIO::section& s
 
 void relocate_map(ebpf_inst& inst, const std::string& symbol_name,
                   const std::variant<size_t, std::map<std::string, size_t>>& map_record_size_or_map_offsets,
-                  const program_info& info, ELFIO::Elf64_Addr offset, ELFIO::Elf_Word index,
+                  const program_info& info, const ELFIO::Elf64_Addr offset, const ELFIO::Elf_Word index,
                   const ELFIO::const_symbol_section_accessor& symbols) {
     // Only permit loading the address of the map.
     if ((inst.opcode & INST_CLS_MASK) != INST_CLS_LD) {
@@ -174,29 +172,26 @@ void relocate_map(ebpf_inst& inst, const std::string& symbol_name,
     inst.src = 1; // magic number for LoadFd
 
     // Relocation value is an offset into the "maps" or ".maps" section.
-    auto [relocation_offset, relocation_type] = get_value(symbols, index);
+    size_t reloc_value = std::numeric_limits<size_t>::max();
     if (map_record_size_or_map_offsets.index() == 0) {
         // The older maps section format uses a single map_record_size value, so we can
         // calculate the map descriptor index directly.
-        size_t reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
-        if (reloc_value >= info.map_descriptors.size()) {
-            throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). " +
-                                     "Make sure to compile with -O2.");
-        }
-
-        inst.imm = info.map_descriptors.at(reloc_value).original_fd;
+        auto [relocation_offset, relocation_type] = get_value(symbols, index);
+        reloc_value = relocation_offset / std::get<0>(map_record_size_or_map_offsets);
     } else {
         // The newer .maps section format uses a variable-length map descriptor array,
         // so we need to look up the map descriptor index in a map.
         auto& map_descriptors_offsets = std::get<1>(map_record_size_or_map_offsets);
-        auto it = map_descriptors_offsets.find(symbol_name);
-
-        if (it == map_descriptors_offsets.end()) {
-            throw std::runtime_error("Bad reloc value (" + std::to_string(index) + "). " +
-                                     "Make sure to compile with -O2.");
+        const auto it = map_descriptors_offsets.find(symbol_name);
+        if (it != map_descriptors_offsets.end()) {
+            reloc_value = it->second;
         }
-        inst.imm = info.map_descriptors.at(it->second).original_fd;
     }
+    if (reloc_value >= info.map_descriptors.size()) {
+        throw std::runtime_error("Bad reloc value (" + std::to_string(reloc_value) + "). " +
+                                 "Make sure to compile with -O2.");
+    }
+    inst.imm = info.map_descriptors.at(reloc_value).original_fd;
 }
 
 // Structure used to keep track of subprogram relocation data until any subprograms
@@ -205,11 +200,12 @@ struct function_relocation {
     size_t prog_index{};              // Index of source program in vector of raw programs.
     ELFIO::Elf_Xword source_offset{}; // Instruction offset in source section of source instruction.
     ELFIO::Elf_Xword relocation_entry_index{};
-    std::string target_function_name;
+    string target_function_name;
 };
 
-static void append_subprogram(raw_program& prog, ELFIO::section& subprogram_section,
-                              ELFIO::const_symbol_section_accessor& symbols, const std::string& symbol_name) {
+static vector<ebpf_inst> read_subprogram(const ELFIO::section& subprogram_section,
+                                         const ELFIO::const_symbol_section_accessor& symbols,
+                                         const string& symbol_name) {
     // Find subprogram by name.
     for (ELFIO::Elf_Xword subprogram_offset = 0; subprogram_offset < subprogram_section.get_size();) {
         auto [subprogram_name, subprogram_size] =
@@ -220,46 +216,64 @@ static void append_subprogram(raw_program& prog, ELFIO::section& subprogram_sect
         }
         if (subprogram_name == symbol_name) {
             // Append subprogram instructions to the main program.
-            auto subprogram = vector_of<ebpf_inst>(subprogram_section.get_data() + subprogram_offset, subprogram_size);
-            prog.prog.insert(prog.prog.end(), subprogram.begin(), subprogram.end());
-            return;
+            return vector_of<ebpf_inst>(subprogram_section.get_data() + subprogram_offset, subprogram_size);
         }
         subprogram_offset += subprogram_size;
     }
-    throw std::runtime_error("Subprogram '" + symbol_name + "' not found in section '" +
-                             subprogram_section.get_name() + "'");
+    throw std::runtime_error("Subprogram '" + symbol_name + "' not found in section '" + subprogram_section.get_name() +
+                             "'");
 }
 
-static void append_subprograms(raw_program& prog, vector<raw_program>& res, const vector<function_relocation>& function_relocations, ELFIO::elfio& reader,
-                               ELFIO::const_symbol_section_accessor& symbols) {
+static void append_subprograms(raw_program& prog, const vector<raw_program>& programs,
+                               const vector<function_relocation>& function_relocations, const ELFIO::elfio& reader,
+                               const ELFIO::const_symbol_section_accessor& symbols) {
     // Perform function relocations and fill in the inst.imm values of CallLocal instructions.
-    std::map<std::string, ELFIO::Elf_Xword> subprogram_offsets;
+    std::map<string, ELFIO::Elf_Xword> subprogram_offsets;
     for (auto& reloc : function_relocations) {
-        if (reloc.prog_index >= res.size()) {
+        if (reloc.prog_index >= programs.size()) {
             continue;
         }
-        if (res[reloc.prog_index].function_name != prog.function_name) {
+        if (programs[reloc.prog_index].function_name != prog.function_name) {
             continue;
         }
 
         // Check whether we already appended the target program, and append it if not.
-        if (subprogram_offsets.find(reloc.target_function_name) == subprogram_offsets.end()) {
+        if (!subprogram_offsets.contains(reloc.target_function_name)) {
             subprogram_offsets[reloc.target_function_name] = prog.prog.size();
 
-            auto [symbol_name, section_index] = get_symbol_name_and_section_index(symbols, reloc.relocation_entry_index);
+            auto [symbol_name, section_index] =
+                get_symbol_name_and_section_index(symbols, reloc.relocation_entry_index);
             ELFIO::section& subprogram_section = *reader.sections[section_index];
-            append_subprogram(prog, subprogram_section, symbols, symbol_name);
+            auto subprogram = read_subprogram(subprogram_section, symbols, symbol_name);
+            prog.prog.insert(prog.prog.end(), subprogram.begin(), subprogram.end());
         }
 
         // Fill in the PC offset into the imm field of the CallLocal instruction.
-        ELFIO::Elf_Xword target_offset = subprogram_offsets[reloc.target_function_name];
-        int64_t offset_diff = (int64_t)(target_offset - reloc.source_offset - 1);
-        if (offset_diff < INT32_MIN || offset_diff > INT32_MAX) {
+        const ELFIO::Elf_Xword target_offset = subprogram_offsets[reloc.target_function_name];
+        const int64_t offset_diff = static_cast<int64_t>(target_offset - reloc.source_offset - 1);
+        if (offset_diff < std::numeric_limits<int32_t>::min() || offset_diff > std::numeric_limits<int32_t>::max()) {
             throw std::runtime_error("Offset difference out of int32_t range for instruction at source offset " +
                                      std::to_string(reloc.source_offset));
         }
-        prog.prog[reloc.source_offset].imm = (int32_t)offset_diff;
+        prog.prog[reloc.source_offset].imm = static_cast<int32_t>(offset_diff);
+    }
+}
+
+std::map<std::string, size_t> parse_map_section(const libbtf::btf_type_data& btf_data,
+                                                std::vector<EbpfMapDescriptor>& map_descriptors) {
+    std::map<std::string, size_t> map_offsets;
+    for (auto& map : parse_btf_map_section(btf_data)) {
+        map_offsets.emplace(map.name, map_descriptors.size());
+        map_descriptors.push_back({
+            .original_fd = static_cast<int>(map.type_id),
+            .type = map.map_type,
+            .key_size = map.key_size,
+            .value_size = map.value_size,
+            .max_entries = map.max_entries,
+            .inner_map_fd = map.inner_map_type_id != 0 ? map.inner_map_type_id : DEFAULT_MAP_FD,
+        });
     }
+    return map_offsets;
 }
 
 vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section,
@@ -269,30 +283,27 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
     }
     ELFIO::elfio reader;
     if (!reader.load(input_stream)) {
-        throw std::runtime_error(string("Can't process ELF file ") + path);
+        throw std::runtime_error("Can't process ELF file " + path);
     }
 
-    program_info info{platform};
-    std::set<ELFIO::Elf_Half> map_section_indices;
-
-    auto btf = reader.sections[string(".BTF")];
-    auto btf_ext = reader.sections[string(".BTF.ext")];
-    std::optional<libbtf::btf_type_data> btf_data;
-
     auto symbol_section = reader.sections[".symtab"];
     if (!symbol_section) {
-        throw std::runtime_error(string("No symbol section found in ELF file ") + path);
+        throw std::runtime_error("No symbol section found in ELF file " + path);
     }
 
     // Make sure the ELFIO library will be able to parse the symbol section correctly.
     auto expected_entry_size =
-        (reader.get_class() == ELFIO::ELFCLASS32) ? sizeof(ELFIO::Elf32_Sym) : sizeof(ELFIO::Elf64_Sym);
+        reader.get_class() == ELFIO::ELFCLASS32 ? sizeof(ELFIO::Elf32_Sym) : sizeof(ELFIO::Elf64_Sym);
 
     if (symbol_section->get_entry_size() != expected_entry_size) {
-        throw std::runtime_error(string("Invalid symbol section found in ELF file ") + path);
+        throw std::runtime_error("Invalid symbol section found in ELF file " + path);
     }
 
-    ELFIO::const_symbol_section_accessor symbols{reader, symbol_section};
+    program_info info{platform};
+    std::set<ELFIO::Elf_Half> map_section_indices;
+
+    auto btf = reader.sections[".BTF"];
+    std::optional<libbtf::btf_type_data> btf_data;
 
     if (btf) {
         // Parse the BTF type data.
@@ -307,25 +318,16 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         }
     }
 
-    std::variant<size_t, std::map<std::string, size_t>> map_record_size_or_map_offsets = size_t(0);
-    if (reader.sections[string(".maps")]) {
+    std::variant<size_t, std::map<std::string, size_t>> map_record_size_or_map_offsets = size_t{0};
+    ELFIO::const_symbol_section_accessor symbols{reader, symbol_section};
+    if (!reader.sections[".maps"]) {
+        map_record_size_or_map_offsets =
+            parse_map_sections(options, platform, reader, info.map_descriptors, map_section_indices, symbols);
+    } else {
         if (!btf_data.has_value()) {
-            throw std::runtime_error(string("No BTF section found in ELF file ") + path);
+            throw std::runtime_error("No BTF section found in ELF file " + path);
         }
-        auto map_data = libbtf::parse_btf_map_section(btf_data.value());
-        std::map<std::string, size_t> map_offsets;
-        for (auto& map : map_data) {
-            map_offsets.insert({map.name, info.map_descriptors.size()});
-            info.map_descriptors.push_back({
-                .original_fd = static_cast<int>(map.type_id),
-                .type = map.map_type,
-                .key_size = map.key_size,
-                .value_size = map.value_size,
-                .max_entries = map.max_entries,
-                .inner_map_fd = map.inner_map_type_id != 0 ? map.inner_map_type_id : DEFAULT_MAP_FD,
-            });
-        }
-        map_record_size_or_map_offsets = map_offsets;
+        map_record_size_or_map_offsets = parse_map_section(*btf_data, info.map_descriptors);
         // Prevail requires:
         // Map fds are sequential starting from 1.
         // Map fds are assigned in the order of the maps in the ELF file.
@@ -335,7 +337,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         int pseudo_fd = 1;
         // Gather the typeids for each map and assign a pseudo-fd to each map.
         for (auto& map_descriptor : info.map_descriptors) {
-            if (type_id_to_fd_map.find(map_descriptor.original_fd) == type_id_to_fd_map.end()) {
+            if (!type_id_to_fd_map.contains(map_descriptor.original_fd)) {
                 type_id_to_fd_map[map_descriptor.original_fd] = pseudo_fd++;
             }
         }
@@ -346,15 +348,11 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                 map_descriptor.inner_map_fd = type_id_to_fd_map[map_descriptor.inner_map_fd];
             }
         }
-        map_section_indices.insert(reader.sections[string(".maps")]->get_index());
-    } else {
-        map_record_size_or_map_offsets =
-            parse_map_sections(options, platform, reader, info.map_descriptors, map_section_indices, symbols);
+        map_section_indices.insert(reader.sections[".maps"]->get_index());
     }
 
     vector<raw_program> res;
-    vector<string> unresolved_symbols;
-
+    vector<string> unresolved_symbols_errors;
     vector<function_relocation> function_relocations;
     for (const auto& section : reader.sections) {
         const string name = section->get_name();
@@ -367,23 +365,28 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         if (name != ".text" && name.find('.') == 0) {
             continue;
         }
-        if ((section->get_size() == 0) || (section->get_data() == nullptr)) {
+        const auto section_size = section->get_size();
+        if (section_size == 0) {
+            continue;
+        }
+        const auto section_data = section->get_data();
+        if (section_data == nullptr) {
             continue;
         }
         info.type = platform->get_program_type(name, path);
 
-        for (ELFIO::Elf_Xword program_offset = 0; program_offset < section->get_size();) {
+        for (ELFIO::Elf_Xword program_offset = 0; program_offset < section_size;) {
             auto [program_name, program_size] = get_program_name_and_size(*section, program_offset, symbols);
             raw_program prog{path,
                              name,
-                             program_offset,
+                             static_cast<uint32_t>(program_offset),
                              program_name,
-                             vector_of<ebpf_inst>(section->get_data() + program_offset, program_size),
+                             vector_of<ebpf_inst>(section_data + program_offset, program_size),
                              info};
 
-            auto prelocs = reader.sections[string(".rel") + name];
+            auto prelocs = reader.sections[".rel" + name];
             if (!prelocs) {
-                prelocs = reader.sections[string(".rela") + name];
+                prelocs = reader.sections[".rela" + name];
             }
 
             if (prelocs) {
@@ -394,9 +397,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
                 // Fetch and store relocation count locally to permit static
                 // analysis tools to correctly reason about the code below.
-                ELFIO::Elf_Xword relocation_count = reloc.get_entries_num();
-
-                for (ELFIO::Elf_Xword i = 0; i < relocation_count; i++) {
+                for (ELFIO::Elf_Xword i = 0; i < reloc.get_entries_num(); i++) {
                     ELFIO::Elf64_Addr offset{};
                     ELFIO::Elf_Word index{};
                     unsigned type{};
@@ -409,7 +410,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                         continue;
                     }
                     offset -= program_offset;
-                    if ((offset / sizeof(ebpf_inst)) >= prog.prog.size()) {
+                    if (offset / sizeof(ebpf_inst) >= prog.prog.size()) {
                         throw std::runtime_error("Invalid relocation data");
                     }
                     ebpf_inst& inst = prog.prog[offset / sizeof(ebpf_inst)];
@@ -417,8 +418,8 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                     auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
 
                     // Queue up relocation for function symbols.
-                    if ((inst.opcode == INST_OP_CALL) && (inst.src == INST_CALL_LOCAL) &&
-                        (reader.sections[symbol_section_index] == section.get())) {
+                    if (inst.opcode == INST_OP_CALL && inst.src == INST_CALL_LOCAL &&
+                        reader.sections[symbol_section_index] == section.get()) {
                         function_relocation fr{.prog_index = res.size(),
                                                .source_offset = offset / sizeof(ebpf_inst),
                                                .relocation_entry_index = index,
@@ -433,9 +434,9 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                         continue;
                     }
 
-                    std::string unresolved_symbol = "Unresolved external symbol " + symbol_name + " in section " +
-                                                    name + " at location " + std::to_string(offset / sizeof(ebpf_inst));
-                    unresolved_symbols.push_back(unresolved_symbol);
+                    string unresolved_symbol = "Unresolved external symbol " + symbol_name + " in section " + name +
+                                               " at location " + std::to_string(offset / sizeof(ebpf_inst));
+                    unresolved_symbols_errors.push_back(unresolved_symbol);
                 }
             }
             prog.line_info.resize(prog.prog.size());
@@ -454,21 +455,22 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
     // Below, only relocations of symbols located in the map sections are allowed,
     // so if there are relocations there needs to be a maps section.
-    if (!unresolved_symbols.empty()) {
-        for (const auto& unresolved_symbol : unresolved_symbols) {
+    if (!unresolved_symbols_errors.empty()) {
+        for (const auto& unresolved_symbol : unresolved_symbols_errors) {
             std::cerr << unresolved_symbol << std::endl;
         }
         throw std::runtime_error("There are relocations in section but no maps sections in file " + path +
                                  "\nMake sure to inline all function calls.");
     }
 
-    if (btf != nullptr && btf_ext != nullptr) {
-        auto visitor = [&](const std::string& section, uint32_t instruction_offset, const std::string& file_name,
-                           const std::string& source, uint32_t line_number, uint32_t column_number) {
+    auto btf_ext = reader.sections[".BTF.ext"];
+    if (btf && btf_ext) {
+        auto visitor = [&](const string& section, const uint32_t instruction_offset, const string& file_name,
+                           const string& source, const uint32_t line_number, const uint32_t column_number) {
             for (auto& program : res) {
-                if ((program.section_name == section) && (instruction_offset >= program.insn_off) &&
-                    (instruction_offset < program.insn_off + program.prog.size() * sizeof(ebpf_inst))) {
-                    size_t inst_index = (instruction_offset - program.insn_off) / sizeof(ebpf_inst);
+                if (program.section_name == section && instruction_offset >= program.insn_off &&
+                    instruction_offset < program.insn_off + program.prog.size() * sizeof(ebpf_inst)) {
+                    const size_t inst_index = (instruction_offset - program.insn_off) / sizeof(ebpf_inst);
                     if (inst_index >= program.line_info.size()) {
                         throw std::runtime_error("Invalid BTF data");
                     }
@@ -484,7 +486,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
         for (auto& program : res) {
             for (size_t i = 1; i < program.line_info.size(); i++) {
                 // If the previous PC has line info, copy it.
-                if ((program.line_info[i].line_number == 0) && (program.line_info[i - 1].line_number != 0)) {
+                if (program.line_info[i].line_number == 0 && program.line_info[i - 1].line_number != 0) {
                     program.line_info[i] = program.line_info[i - 1];
                 }
             }
@@ -493,9 +495,9 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
 
     if (res.empty()) {
         if (desired_section.empty()) {
-            throw std::runtime_error(string("Can't find any non-empty TEXT sections in file ") + path);
+            throw std::runtime_error("Can't find any non-empty TEXT sections in file " + path);
         }
-        throw std::runtime_error(string("Can't find section ") + desired_section + " in file " + path);
+        throw std::runtime_error("Can't find section " + desired_section + " in file " + path);
     }
     return res;
 }
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 34a173918..2d84c76c2 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -750,12 +750,12 @@ static void check_instruction_variations(std::optional<const ebpf_instruction_te
 }
 
 TEST_CASE("fail unmarshal bad instructions", "[disasm][marshal]") {
-    size_t template_count = std::size(instruction_template);
+    constexpr size_t template_count = std::size(instruction_template);
 
     // Check any variations before the first template.
     check_instruction_variations({}, instruction_template[0]);
 
-    for (int index = 1; index < template_count; index++) {
+    for (size_t index = 1; index < template_count; index++) {
         check_instruction_variations(instruction_template[index - 1], instruction_template[index]);
     }
 

From 9e5781b71e654aa2b724432ab554f2be865f57ae Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sat, 28 Sep 2024 11:41:30 -0700
Subject: [PATCH 255/373] Fail verification on infinite calllocal recursion
 (#695)

Previously the code would simply throw an exception.
This change adds an error message and test cases.

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_cfg.cpp          |  6 +++++-
 test-data/calllocal.yaml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 7e9a2971c..d922c33b3 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -57,13 +57,17 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
     }
 
     // Walk the transitive closure of CFG nodes starting at entry_label and ending at
-    // any exit instruction,
+    // any exit instruction.
     std::queue<label_t> macro_labels{{entry_label}};
     std::set seen_labels{entry_label};
     while (!macro_labels.empty()) {
         label_t macro_label = macro_labels.front();
         macro_labels.pop();
 
+        if (stack_frame_prefix == macro_label.stack_frame_prefix) {
+            throw std::runtime_error{stack_frame_prefix + ": illegal recursion"};
+        }
+
         // Clone the macro block into a new block with the new stack frame prefix.
         const label_t label(macro_label.from, macro_label.to, stack_frame_prefix);
         auto& bb = cfg.insert(label);
diff --git a/test-data/calllocal.yaml b/test-data/calllocal.yaml
index 202668a99..4bb735ad0 100644
--- a/test-data/calllocal.yaml
+++ b/test-data/calllocal.yaml
@@ -279,3 +279,34 @@ post:
   - r0.svalue=0
   - r0.uvalue=0
   - r6.type=packet
+---
+test-case: fail infinite self-recursion
+
+pre: []
+
+code:
+  <start>: |
+    call <start>
+    exit
+
+post: []
+
+messages:
+  - "0: illegal recursion"
+---
+test-case: fail infinite recursion with subprogram
+
+pre: []
+
+code:
+  <start>: |
+    call <sub>
+    exit
+  <sub>: |
+    call <start>
+    exit
+
+post: []
+
+messages:
+  - "0/2: illegal recursion"

From f2f9c6c4f4062bd96ec62789613b607b2de81ba6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 28 Sep 2024 16:47:31 +0000
Subject: [PATCH 256/373] Bump external/libbtf from `58fcade` to `18569b3`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `58fcade` to `18569b3`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/58fcade22600c80b643ef0b80cdf8683c155a286...18569b38b5b809b4c513e24ed012f55f4309f0ff)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 58fcade22..18569b38b 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 58fcade22600c80b643ef0b80cdf8683c155a286
+Subproject commit 18569b38b5b809b4c513e24ed012f55f4309f0ff

From 55bac8e2839e7e66ff5e47c61a40df5222333490 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 28 Sep 2024 16:47:34 +0000
Subject: [PATCH 257/373] Bump external/bpf_conformance from `7a773b3` to
 `8bd493f`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `7a773b3` to `8bd493f`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/7a773b3d9eb0453a86500d5480d4890b920b5db8...8bd493feff99805383ced4858abddbe44e9067c9)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 7a773b3d9..8bd493fef 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 7a773b3d9eb0453a86500d5480d4890b920b5db8
+Subproject commit 8bd493feff99805383ced4858abddbe44e9067c9

From 231c98cc3b1a88a82f7384ab0fe1352fe1b7b567 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sat, 28 Sep 2024 23:24:11 +0300
Subject: [PATCH 258/373] simplify lazy_allocator.hpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/var_factory.cpp          |  4 ++--
 src/crab/variable.hpp             | 10 ++++-----
 src/crab_utils/lazy_allocator.hpp | 35 ++++++++-----------------------
 src/crab_utils/stats.hpp          |  4 ++--
 4 files changed, 17 insertions(+), 36 deletions(-)

diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index e09296f54..6f05c9e19 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -20,7 +20,7 @@ variable_t variable_t::make(const std::string& name) {
     }
 }
 
-std::vector<std::string> variable_t::_default_names() {
+std::vector<std::string> default_variable_names() {
     return std::vector<std::string>{
         "r0.svalue",
         "r0.uvalue",
@@ -137,7 +137,7 @@ std::vector<std::string> variable_t::_default_names() {
     };
 };
 
-thread_local crab::lazy_allocator<std::vector<std::string>, variable_t::variable_name_factory> variable_t::names;
+thread_local lazy_allocator<std::vector<std::string>, default_variable_names> variable_t::names;
 
 void variable_t::clear_thread_local_state() { names.clear(); }
 
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 8491ef81d..4b64c2e63 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -7,6 +7,7 @@
 #include <memory>
 #include <vector>
 
+#include "crab/variable.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 #include "crab_utils/num_big.hpp"
 using index_t = uint64_t;
@@ -30,6 +31,8 @@ enum class data_kind_t {
 };
 std::ostream& operator<<(std::ostream& o, const data_kind_t& s);
 
+std::vector<std::string> default_variable_names();
+
 // Wrapper for typed variables used by the crab abstract domains and linear_constraints.
 // Being a class (instead of a type alias) enables overloading in dsl_syntax
 class variable_t final {
@@ -71,18 +74,13 @@ class variable_t final {
     // This singleton is eBPF-specific, to avoid lifetime issues and/or passing factory explicitly everywhere:
   private:
     static variable_t make(const std::string& name);
-    static std::vector<std::string> _default_names();
 
     /**
      * @brief Factory to always return the initial variable names.
      *
      * @tparam[in] T Should always be std::vector<std::string>.
      */
-    template <typename T>
-    struct variable_name_factory {
-        T operator()() { return _default_names(); }
-    };
-    static thread_local crab::lazy_allocator<std::vector<std::string>, variable_name_factory> names;
+    static thread_local lazy_allocator<std::vector<std::string>, default_variable_names> names;
 
   public:
     static void clear_thread_local_state();
diff --git a/src/crab_utils/lazy_allocator.hpp b/src/crab_utils/lazy_allocator.hpp
index abca4641e..d1409e7c9 100644
--- a/src/crab_utils/lazy_allocator.hpp
+++ b/src/crab_utils/lazy_allocator.hpp
@@ -4,38 +4,17 @@
 
 #include <optional>
 
-#include "debug.hpp"
-
 namespace crab {
-/**
- * @brief The default factory for lazy_allocator that creates objects using the default constructor.
- *
- * @tparam T The type of the object to create.
- */
-template <typename T>
-struct lazy_allocator_default_factory {
-    T operator()() { return T(); }
-};
-
-/**
- * @brief A factory that fails the allocation of objects (to enforce setting the value before using it).
- *
- * @tparam T The type of the object to create.
- */
-template <typename T>
-struct lazy_allocator_no_default_factory {
-    T operator()() { CRAB_ERROR("lazy_allocator_no_default"); }
-};
 
 /**
  * @brief Lazy allocator for objects of type T. The allocator does not allocate the object until it is first accessed.
  *
  * @tparam T The type of the object to allocate.
- * @tparam factory The factory to use to create the object. The factory must be callable with no arguments and return an
- * object of type T. The default factory creates the object using the default constructor. The no_default_factory fails
- * the allocation of the object. The caller can provide a custom factory to create the object in a specific way.
+ * @tparam factory The factory function to use to create the object.
+ * The default factory creates the object using the default constructor.
+ * The caller can provide a custom factory to create the object in a specific way.
  */
-template <typename T, template <typename TInner> typename factory = lazy_allocator_default_factory>
+template <typename T, T (*factory)() = nullptr>
 class lazy_allocator {
     std::optional<T> _value;
 
@@ -47,7 +26,11 @@ class lazy_allocator {
      */
     T& get() {
         if (!_value.has_value()) {
-            _value = factory<T>()();
+            if constexpr (factory != nullptr) {
+                _value = factory();
+            } else {
+                _value = T{};
+            }
         }
         return _value.value();
     }
diff --git a/src/crab_utils/stats.hpp b/src/crab_utils/stats.hpp
index cee0d28ed..d55654376 100644
--- a/src/crab_utils/stats.hpp
+++ b/src/crab_utils/stats.hpp
@@ -33,8 +33,8 @@ inline std::ostream& operator<<(std::ostream& OS, const Stopwatch& sw) {
 }
 
 class CrabStats {
-    static thread_local crab::lazy_allocator<std::map<std::string, unsigned>> counters;
-    static thread_local crab::lazy_allocator<std::map<std::string, Stopwatch>> sw;
+    static thread_local lazy_allocator<std::map<std::string, unsigned>> counters;
+    static thread_local lazy_allocator<std::map<std::string, Stopwatch>> sw;
 
   public:
     static void clear_thread_local_state();

From fba0299ce17883e4771392beb70473f67a28c095 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 04:05:32 +0300
Subject: [PATCH 259/373] Cleanup wto: cpp+hpp, remove recursive version (#699)

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/fwd_analyzer.cpp |  24 ++--
 src/crab/thresholds.cpp   |   4 +-
 src/crab/thresholds.hpp   |   2 +-
 src/crab/wto.cpp          | 236 ++++++++++++++++++++++++++------
 src/crab/wto.hpp          | 274 ++++++++++----------------------------
 src/crab/wto_cycle.hpp    |  81 -----------
 src/crab/wto_nesting.hpp  |  43 ------
 7 files changed, 274 insertions(+), 390 deletions(-)
 delete mode 100644 src/crab/wto_cycle.hpp
 delete mode 100644 src/crab/wto_nesting.hpp

diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index ba4d13561..ffebe5105 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -27,7 +27,7 @@ class member_component_visitor final {
         }
     }
 
-    void operator()(std::shared_ptr<wto_cycle_t>& c) {
+    void operator()(const std::shared_ptr<wto_cycle_t>& c) {
         if (!_found) {
             _found = (c->head() == _node);
             if (!_found) {
@@ -35,7 +35,7 @@ class member_component_visitor final {
                     if (_found) {
                         break;
                     }
-                    std::visit(*this, *component);
+                    std::visit(*this, component);
                 }
             }
         }
@@ -114,7 +114,7 @@ class interleaved_fwd_fixpoint_iterator_t final {
 
     void operator()(const label_t& node);
 
-    void operator()(std::shared_ptr<wto_cycle_t>& cycle);
+    void operator()(const std::shared_ptr<wto_cycle_t>& cycle);
 
     friend std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg, ebpf_domain_t entry_inv);
 };
@@ -125,8 +125,8 @@ std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg,
     if (thread_local_options.check_termination) {
         std::vector<label_t> cycle_heads;
         for (auto& component : analyzer._wto) {
-            if (std::holds_alternative<std::shared_ptr<wto_cycle_t>>(*component)) {
-                cycle_heads.push_back(std::get<std::shared_ptr<wto_cycle_t>>(*component)->head());
+            if (std::holds_alternative<std::shared_ptr<wto_cycle_t>>(component)) {
+                cycle_heads.push_back(std::get<std::shared_ptr<wto_cycle_t>>(component)->head());
             }
         }
         for (const label_t& label : cycle_heads) {
@@ -136,7 +136,7 @@ std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg,
     }
     analyzer.set_pre(cfg.entry_label(), entry_inv);
     for (auto& component : analyzer._wto) {
-        std::visit(analyzer, *component);
+        std::visit(analyzer, component);
     }
     return std::make_pair(analyzer._pre, analyzer._post);
 }
@@ -156,7 +156,7 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(const label_t& node) {
     transform_to_post(node, pre);
 }
 
-void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t>& cycle) {
+void interleaved_fwd_fixpoint_iterator_t::operator()(const std::shared_ptr<wto_cycle_t>& cycle) {
     label_t head = cycle->head();
 
     /** decide whether to skip cycle or not **/
@@ -190,9 +190,8 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
         set_pre(head, invariant);
         transform_to_post(head, invariant);
         for (auto& component : *cycle) {
-            wto_component_t c = *component;
-            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head)) {
-                std::visit(*this, *component);
+            if (!std::holds_alternative<label_t>(component) || (std::get<label_t>(component) != head)) {
+                std::visit(*this, component);
             }
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
@@ -211,9 +210,8 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(std::shared_ptr<wto_cycle_t
         transform_to_post(head, invariant);
 
         for (auto& component : *cycle) {
-            wto_component_t c = *component;
-            if (!std::holds_alternative<label_t>(c) || (std::get<label_t>(c) != head)) {
-                std::visit(*this, *component);
+            if (!std::holds_alternative<label_t>(component) || (std::get<label_t>(component) != head)) {
+                std::visit(*this, component);
             }
         }
         ebpf_domain_t new_pre = join_all_prevs(head);
diff --git a/src/crab/thresholds.cpp b/src/crab/thresholds.cpp
index b460b736e..d07753dfb 100644
--- a/src/crab/thresholds.cpp
+++ b/src/crab/thresholds.cpp
@@ -68,7 +68,7 @@ void wto_thresholds_t::operator()(const label_t& vertex) {
     }
 }
 
-void wto_thresholds_t::operator()(std::shared_ptr<wto_cycle_t>& cycle) {
+void wto_thresholds_t::operator()(const std::shared_ptr<wto_cycle_t>& cycle) {
     thresholds_t thresholds(m_max_size);
     auto& bb = m_cfg.get_node(cycle->head());
     get_thresholds(bb, thresholds);
@@ -85,7 +85,7 @@ void wto_thresholds_t::operator()(std::shared_ptr<wto_cycle_t>& cycle) {
     m_head_to_thresholds.insert(std::make_pair(cycle->head(), thresholds));
     m_stack.push_back(cycle->head());
     for (auto& component : *cycle) {
-        std::visit(*this, *component);
+        std::visit(*this, component);
     }
     m_stack.pop_back();
 }
diff --git a/src/crab/thresholds.hpp b/src/crab/thresholds.hpp
index d1e69de27..c3427c97e 100644
--- a/src/crab/thresholds.hpp
+++ b/src/crab/thresholds.hpp
@@ -65,7 +65,7 @@ class wto_thresholds_t final {
 
     void operator()(const label_t& vertex);
 
-    void operator()(std::shared_ptr<wto_cycle_t>& cycle);
+    void operator()(const std::shared_ptr<wto_cycle_t>& cycle);
 
     friend std::ostream& operator<<(std::ostream& o, const wto_thresholds_t& t);
 
diff --git a/src/crab/wto.cpp b/src/crab/wto.cpp
index f1f1de48d..0baf28685 100644
--- a/src/crab/wto.cpp
+++ b/src/crab/wto.cpp
@@ -1,18 +1,88 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include "wto.hpp"
+#include <ranges>
 
-#ifndef RECURSIVE_WTO
+#include "wto.hpp"
 
 // This file contains an iterative implementation of the recursive algorithm in
 // Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
 // http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.38.3574
-// where _visit_stack is roughly equivalent to a stack trace in the recursive
-// algorithm.  However, this scales much higher since it does not run out of
-// stack memory.
+// where _visit_stack is roughly equivalent to a stack trace in the recursive algorithm.
+// However, this scales much higher since it does not run out of stack memory.
+
+bool wto_nesting_t::operator>(const wto_nesting_t& nesting) const {
+    const size_t this_size = this->_heads.size();
+    const size_t other_size = nesting._heads.size();
+    if (this_size <= other_size) {
+        // Can't be a superset.
+        return false;
+    }
+
+    // Compare entries one at a time starting from the outermost
+    // (i.e., end of the vectors).
+    for (size_t index = 0; index < other_size; index++) {
+        if (this->_heads[this_size - 1 - index] != nesting._heads[other_size - 1 - index]) {
+            return false;
+        }
+    }
+    return true;
+}
+
+enum class visit_task_type_t {
+    PushSuccessors = 0,
+    StartVisit = 1, // Start of the Visit() function defined in Figure 4 of the paper.
+    ContinueVisit = 2,
+};
+
+struct visit_args_t {
+    visit_task_type_t type;
+    label_t vertex;
+    wto_partition_t& partition;
+    std::weak_ptr<wto_cycle_t> containing_cycle;
+
+    visit_args_t(const visit_task_type_t t, label_t v, wto_partition_t& p, std::weak_ptr<wto_cycle_t> cc)
+        : type(t), vertex(std::move(v)), partition(p), containing_cycle(std::move(cc)){};
+};
+
+struct wto_vertex_data_t {
+    // Bourdoncle's thesis (reference [4]) is all in French but expands
+    // DFN as "depth first number".
+    int dfn{};
+    int head_dfn{}; // Head value returned from Visit() in the paper.
+
+    std::shared_ptr<wto_cycle_t> containing_cycle;
+};
+constexpr static int DFN_INF = std::numeric_limits<decltype(wto_vertex_data_t::dfn)>::max();
 
-void wto_t::push_successors(const label_t& vertex, wto_partition_t& partition,
-                            std::weak_ptr<wto_cycle_t> containing_cycle) {
+class wto_builder_t final {
+    // Original control-flow graph.
+    const cfg_t& _cfg;
+
+    // The following members are named to match the names in the paper.
+    std::map<label_t, wto_vertex_data_t> _vertex_data;
+    int _num; // Highest DFN used so far.
+    std::stack<label_t> _stack;
+
+    std::stack<visit_args_t> _visit_stack;
+
+    void push_successors(const label_t& vertex, wto_partition_t& partition,
+                         const std::weak_ptr<wto_cycle_t>& containing_cycle);
+    void start_visit(const label_t& vertex, wto_partition_t& partition,
+                     const std::weak_ptr<wto_cycle_t>& containing_cycle);
+    void continue_visit(const label_t& vertex, wto_partition_t& partition,
+                        const std::weak_ptr<wto_cycle_t>& containing_cycle);
+
+  public:
+    wto_t wto;
+    // Construct a Weak Topological Ordering from a control-flow graph using
+    // the algorithm of figure 4 in the paper, where this constructor matches
+    // what is shown there as the Partition function.
+    explicit wto_builder_t(const cfg_t& cfg);
+    friend std::ostream& operator<<(std::ostream& o, const wto_builder_t& wto);
+};
+
+void wto_builder_t::push_successors(const label_t& vertex, wto_partition_t& partition,
+                                    const std::weak_ptr<wto_cycle_t>& containing_cycle) {
     if (_vertex_data[vertex].dfn != 0) {
         // We found an alternate path to a node already visited, so nothing to do.
         return;
@@ -21,29 +91,25 @@ void wto_t::push_successors(const label_t& vertex, wto_partition_t& partition,
     _stack.push(vertex);
 
     // Schedule the next task for this vertex once we're done with anything else.
-    visit_args_t args(visit_task_type_t::StartVisit, vertex, partition, containing_cycle);
-    _visit_stack.push(args);
+    _visit_stack.emplace(visit_task_type_t::StartVisit, vertex, partition, containing_cycle);
 
     for (const label_t& succ : _cfg.next_nodes_reversed(vertex)) {
         if (_vertex_data[succ].dfn == 0) {
-            visit_args_t args(visit_task_type_t::PushSuccessors, succ, partition, containing_cycle);
-            _visit_stack.push(args);
+            _visit_stack.emplace(visit_task_type_t::PushSuccessors, succ, partition, containing_cycle);
         }
     }
 }
 
-void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition,
-                        std::weak_ptr<wto_cycle_t> containing_cycle) {
+void wto_builder_t::start_visit(const label_t& vertex, wto_partition_t& partition,
+                                const std::weak_ptr<wto_cycle_t>& containing_cycle) {
     wto_vertex_data_t& vertex_data = _vertex_data[vertex];
     int head_dfn = vertex_data.dfn;
     bool loop = false;
-    int min_dfn = INT_MAX;
     for (const label_t& succ : _cfg.next_nodes(vertex)) {
-        wto_vertex_data_t& data = _vertex_data[succ];
-        if (data.head_dfn != 0 && data.dfn != INT_MAX) {
+        const wto_vertex_data_t& data = _vertex_data[succ];
+        int min_dfn = data.dfn;
+        if (data.head_dfn != 0 && data.dfn != DFN_INF) {
             min_dfn = data.head_dfn;
-        } else {
-            min_dfn = data.dfn;
         }
         if (min_dfn <= head_dfn) {
             head_dfn = min_dfn;
@@ -52,10 +118,10 @@ void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition,
     }
 
     // Create a new cycle component inside the containing cycle.
-    auto cycle = std::make_shared<wto_cycle_t>(containing_cycle);
+    const auto cycle = std::make_shared<wto_cycle_t>(containing_cycle);
 
     if (head_dfn == vertex_data.dfn) {
-        vertex_data.dfn = INT_MAX;
+        vertex_data.dfn = DFN_INF;
         label_t element = _stack.top();
         _stack.pop();
         if (loop) {
@@ -71,49 +137,42 @@ void wto_t::start_visit(const label_t& vertex, wto_partition_t& partition,
             _vertex_data[vertex].containing_cycle = cycle;
 
             // Schedule the next task for this vertex once we're done with anything else.
-            visit_args_t args2(visit_task_type_t::ContinueVisit, vertex, partition, cycle);
-            _visit_stack.push(args2);
+            _visit_stack.emplace(visit_task_type_t::ContinueVisit, vertex, partition, cycle);
 
             // Walk the control flow graph, adding nodes to this cycle.
             // This is the Component() function described in figure 4 of the paper.
             for (const label_t& succ : _cfg.next_nodes_reversed(vertex)) {
-                if (dfn(succ) == 0) {
-                    visit_args_t args(visit_task_type_t::PushSuccessors, succ, cycle->components(), cycle);
-                    _visit_stack.push(args);
+                if (_vertex_data.at(succ).dfn == 0) {
+                    _visit_stack.emplace(visit_task_type_t::PushSuccessors, succ, cycle->_components, cycle);
                 }
             }
             return;
-        } else {
-            // Create a new vertex component.
-            auto component = std::make_shared<wto_component_t>(wto_component_t(vertex));
-
-            // Insert the vertex into the current partition.
-            partition.push_back(component);
-
-            // Remember that we put the vertex into the caller's cycle.
-            _containing_cycle.emplace(vertex, containing_cycle);
         }
+        // Insert a new vertex component vertex into the current partition.
+        partition.emplace_back(vertex);
+
+        // Remember that we put the vertex into the caller's cycle.
+        wto._containing_cycle.emplace(vertex, containing_cycle);
     }
     vertex_data.head_dfn = head_dfn;
 }
 
-void wto_t::continue_visit(const label_t& vertex, wto_partition_t& partition,
-                           std::weak_ptr<wto_cycle_t> containing_cycle) {
+void wto_builder_t::continue_visit(const label_t& vertex, wto_partition_t& partition,
+                                   const std::weak_ptr<wto_cycle_t>& containing_cycle) {
     // Add the vertex at the start of the cycle
     // (end of the vector which stores the cycle in reverse order).
     auto cycle = containing_cycle.lock();
 
-    cycle->components().push_back(std::make_shared<wto_component_t>(vertex));
+    cycle->_components.push_back(vertex);
 
     // Insert the component into the current partition.
-    auto component = std::make_shared<wto_component_t>(cycle);
-    partition.emplace_back(component);
+    partition.emplace_back(cycle);
 
     // Remember that we put the vertex into the new cycle.
-    _containing_cycle.emplace(vertex, cycle);
+    wto._containing_cycle.emplace(vertex, cycle);
 }
 
-wto_t::wto_t(const cfg_t& cfg) : _cfg(cfg) {
+wto_builder_t::wto_builder_t(const cfg_t& cfg) : _cfg(cfg) {
     // Create a map for holding a "depth-first number (DFN)" for each vertex.
     for (const label_t& label : cfg.labels()) {
         _vertex_data.emplace(label, 0);
@@ -123,8 +182,7 @@ wto_t::wto_t(const cfg_t& cfg) : _cfg(cfg) {
     _num = 0;
 
     // Push the entry vertex on the stack to process.
-    visit_args_t args(visit_task_type_t::PushSuccessors, cfg.entry_label(), _components, {});
-    _visit_stack.push(args);
+    _visit_stack.emplace(visit_args_t(visit_task_type_t::PushSuccessors, cfg.entry_label(), wto._components, {}));
 
     // Keep processing tasks until we're done.
     while (!_visit_stack.empty()) {
@@ -142,4 +200,94 @@ wto_t::wto_t(const cfg_t& cfg) : _cfg(cfg) {
         }
     }
 }
-#endif
+
+class print_visitor {
+    std::ostream& o;
+
+  public:
+    explicit print_visitor(std::ostream& o) : o(o) {}
+
+    void operator()(const label_t& label) { o << label; }
+
+    void operator()(const wto_cycle_t& cycle) {
+        o << "( ";
+        for (const auto& component : cycle) {
+            std::visit(*this, component);
+            o << " ";
+        }
+        o << ")";
+    }
+
+    void operator()(const std::shared_ptr<wto_cycle_t>& e) {
+        if (e != nullptr) {
+            (*this)(*e);
+        }
+    }
+
+    void operator()(const wto_partition_t& partition) {
+        for (auto& p : std::ranges::reverse_view(partition)) {
+            std::visit(*this, p);
+            o << " ";
+        }
+    }
+
+    // Output the nesting in order from outermost to innermost.
+    void operator()(const wto_nesting_t& nesting) {
+        for (const auto& _head : std::ranges::reverse_view(nesting._heads)) {
+            o << _head << " ";
+        }
+    }
+};
+
+std::ostream& operator<<(std::ostream& o, const wto_t& wto) {
+    print_visitor{o}(wto._components);
+    return o << std::endl;
+}
+
+// Get the vertex at the head of the component containing a given
+// label, as discussed in section 4.2 of the paper.  If the label
+// is itself a head of a component, we want the head of whatever
+// contains that entire component.  Returns nullopt if the label is
+// not nested, i.e., the head is logically the entry point of the CFG.
+std::optional<label_t> wto_t::head(const label_t& label) {
+    const auto it = _containing_cycle.find(label);
+    if (it == _containing_cycle.end()) {
+        // Label is not in any cycle.
+        return {};
+    }
+    const std::shared_ptr<wto_cycle_t> cycle = it->second.lock();
+    if (cycle == nullptr) {
+        return {};
+    }
+    if (const label_t& first = cycle->head(); first != label) {
+        // Return the head of the cycle the label is inside.
+        return first;
+    }
+
+    // This label is already the head of a cycle, so get the cycle's parent.
+    if (const auto parent = cycle->_containing_cycle.lock()) {
+        return parent->head();
+    }
+    return {};
+}
+
+wto_t::wto_t(const cfg_t& cfg) : wto_t{std::move(wto_builder_t(cfg).wto)} {}
+
+std::vector<label_t> wto_t::collect_heads(const label_t& label) {
+    std::vector<label_t> heads;
+    for (auto h = head(label); h; h = head(*h)) {
+        heads.push_back(*h);
+    }
+    return heads;
+}
+
+// Compute the set of heads of the nested components containing a given label.
+// See section 3.1 of the paper for discussion, which uses the notation w(c).
+const wto_nesting_t& wto_t::nesting(const label_t& label) {
+    if (!_nesting.contains(label)) {
+        // Not found in the cache yet, so construct the list of heads of the
+        // nested components containing the label, stored in reverse order.
+        _nesting.emplace(label, collect_heads(label));
+    }
+    return _nesting.at(label);
+}
diff --git a/src/crab/wto.hpp b/src/crab/wto.hpp
index c321a8b48..a0ca2e4fa 100644
--- a/src/crab/wto.hpp
+++ b/src/crab/wto.hpp
@@ -19,75 +19,80 @@
 // results in the WTO: 1 2 (3 4 (5 6) 7) 8
 // where a single vertex is represented via label_t, and a
 // cycle such as (5 6) is represented via a wto_cycle_t.
-// Each arrow points to a wto_component_t, which can be either a
+// Each arrow points to a cycle_or_label, which can be either a
 // single vertex such as 8, or a cycle such as (5 6).
 
-// Define this to use the old recursive algorithm instead of the new
-// iterative algorithm.  The recursive algorithm can result in a stack
-// overflow but we keep it for now to allow doing a performance
-// comparison.
-#undef RECURSIVE_WTO
-
+#include <memory>
 #include <stack>
+#include <utility>
 #include <vector>
 
 #include "crab/cfg.hpp"
-#include "crab/wto_nesting.hpp"
 
-// Define types used by both this header file and wto_cycle.hpp
-using wto_component_t = std::variant<std::shared_ptr<class wto_cycle_t>, label_t>;
-using wto_partition_t = std::vector<std::shared_ptr<wto_component_t>>;
+// Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
+// uses the notation w(c) to refer to the set of heads of the nested components
+// containing a vertex c.  This class holds such a set of heads.  The table
+// mapping c to w(c) is stored outside the class, in wto_collector_t._nesting.
+class wto_nesting_t final {
+    // To optimize insertion performance, the list of heads is stored in reverse
+    // order, i.e., from innermost to outermost cycle.
+    std::vector<label_t> _heads;
 
-#include "crab/wto_cycle.hpp"
+    friend class print_visitor;
 
-#ifndef RECURSIVE_WTO
-enum class visit_task_type_t {
-    PushSuccessors = 0,
-    StartVisit = 1, // Start of the Visit() function defined in Figure 4 of the paper.
-    ContinueVisit = 2,
+  public:
+    explicit wto_nesting_t(std::vector<label_t>&& heads) : _heads(std::move(heads)) {}
+
+    // Test whether this nesting is a longer subset of another nesting.
+    bool operator>(const wto_nesting_t& nesting) const;
 };
 
-struct visit_args_t {
-    visit_task_type_t type;
-    label_t vertex;
-    wto_partition_t& partition;
-    std::weak_ptr<wto_cycle_t> containing_cycle;
+// Define types used by both this header file and wto_cycle.hpp
+using cycle_or_label = std::variant<std::shared_ptr<class wto_cycle_t>, label_t>;
+using wto_partition_t = std::vector<cycle_or_label>;
 
-    visit_args_t(visit_task_type_t t, label_t v, wto_partition_t& p, std::weak_ptr<wto_cycle_t> cc)
-        : type(t), vertex(v), partition(p), containing_cycle(cc) {};
-};
+// Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
+// section 3 uses the term "nested component" to refer to what wto_cycle_t implements.
+class wto_cycle_t final {
+    // List of subcomponents (i.e., vertices or other cycles) contained in this cycle.
+    wto_partition_t _components;
 
-struct wto_vertex_data_t {
-    // Bourdoncle's thesis (reference [4]) is all in French but expands
-    // DFN as "depth first number".
-    int dfn;
-    int head_dfn; // Head value returned from Visit() in the paper.
-    std::shared_ptr<wto_cycle_t> containing_cycle;
+    // The cycle containing this cycle, or null if there is no parent cycle.
+    std::weak_ptr<wto_cycle_t> _containing_cycle;
 
-    wto_vertex_data_t() : dfn(0), head_dfn(0) {};
-    wto_vertex_data_t(int d) : dfn(d), head_dfn(0) {};
-};
-#endif
+    friend class wto_t;
+    friend class wto_builder_t;
 
-class wto_t final {
-    // Original control-flow graph.
-    const crab::cfg_t& _cfg;
+  public:
+    explicit wto_cycle_t(const std::weak_ptr<wto_cycle_t>& containing_cycle) : _containing_cycle(containing_cycle) {}
+
+    // Get a vertex of an entry point of the cycle.
+    [[nodiscard]]
+    const label_t& head() const {
+        // Any cycle must start with a vertex, not another cycle,
+        // per Definition 1 in the paper.  Since the vector is in reverse
+        // order, the head is the last element.
+        if (_components.empty()) {
+            CRAB_ERROR("Empty cycle");
+        }
+        if (const auto label = std::get_if<label_t>(&_components.back())) {
+            return *label;
+        }
+        CRAB_ERROR("Expected label_t at the back of _components");
+    }
 
-    // The following members are named to match the names in the paper.
-#ifdef RECURSIVE_WTO
-    // Bourdoncle's thesis (reference [4]) is all in French but
-    // expands DFN as "depth first number".
-    std::map<label_t, int> _dfn;
-#else
-    std::map<label_t, wto_vertex_data_t> _vertex_data;
-#endif
-    int _num; // Highest DFN used so far.
-    std::stack<label_t> _stack;
+    [[nodiscard]]
+    wto_partition_t::const_reverse_iterator begin() const {
+        return _components.crbegin();
+    }
 
-#ifndef RECURSIVE_WTO
-    std::stack<visit_args_t> _visit_stack;
-#endif
+    [[nodiscard]]
+    wto_partition_t::const_reverse_iterator end() const {
+        return _components.crend();
+    }
+};
 
+class wto_t final {
     // Top level components, in reverse order.
     wto_partition_t _components;
 
@@ -99,168 +104,25 @@ class wto_t final {
     // looked at so we only create a wto_nesting_t for cases we actually need it.
     std::map<label_t, wto_nesting_t> _nesting;
 
-#ifndef RECURSIVE_WTO
-    void push_successors(const label_t& vertex, wto_partition_t& partition,
-                         std::weak_ptr<wto_cycle_t> containing_cycle);
-    void start_visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle);
-    void continue_visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle);
-#else
-    // Implementation of the Visit() function defined in Figure 4 of the paper.
-    int visit(const label_t& vertex, wto_partition_t& partition, std::weak_ptr<wto_cycle_t> containing_cycle) {
-        _stack.push(vertex);
-        _num++;
-        int head = _dfn[vertex] = _num;
-        bool loop = false;
-        int min = INT_MAX;
-        for (const label_t& succ : _cfg.next_nodes(vertex)) {
-            if (_dfn[succ] == 0) {
-                min = visit(succ, partition, containing_cycle);
-            } else {
-                min = _dfn[succ];
-            }
-            if (min <= head) {
-                head = min;
-                loop = true;
-            }
-        }
-        if (head == _dfn[vertex]) {
-            _dfn[vertex] = INT_MAX;
-            label_t& element = _stack.top();
-            _stack.pop();
-            if (loop) {
-                while (element != vertex) {
-                    _dfn[element] = 0;
-                    element = _stack.top();
-                    _stack.pop();
-                }
-
-                // Create a new cycle component.
-                // Walk the control flow graph, adding nodes to this cycle.
-                // This is the Component() function described in figure 4 of the paper.
-                auto cycle = std::make_shared<wto_cycle_t>(containing_cycle);
-                auto component = std::make_shared<wto_component_t>(cycle);
-                for (const label_t& succ : _cfg.next_nodes(vertex)) {
-                    if (dfn(succ) == 0) {
-                        visit(succ, cycle->components(), cycle);
-                    }
-                }
-
-                // Finally, add the vertex at the start of the cycle
-                // (end of the vector which stores the cycle in reverse order).
-                cycle->components().push_back(std::make_shared<wto_component_t>(vertex));
-
-                // Insert the component into the current partition.
-                partition.emplace_back(component);
-
-                // Remember that we put the vertex into the new cycle.
-                _containing_cycle.emplace(vertex, cycle);
-            } else {
-                // Create a new vertex component.
-                auto component = std::make_shared<wto_component_t>(wto_component_t(vertex));
+    std::vector<label_t> collect_heads(const label_t& label);
+    std::optional<label_t> head(const label_t& label);
 
-                // Insert the vertex into the current partition.
-                partition.push_back(component);
-
-                // Remember that we put the vertex into the caller's cycle.
-                _containing_cycle.emplace(vertex, containing_cycle);
-            }
-        }
-        return head;
-    }
-#endif
+    wto_t() = default;
+    friend class wto_builder_t;
 
   public:
-    [[nodiscard]]
-    const crab::cfg_t& cfg() const {
-        return _cfg;
-    }
-#ifdef RECURSIVE_WTO
-    [[nodiscard]]
-    int dfn(const label_t& vertex) const {
-        return _dfn.at(vertex);
-    }
-#else
-    [[nodiscard]]
-    int dfn(const label_t& vertex) const {
-        return _vertex_data.at(vertex).dfn;
-    }
-#endif
+    explicit wto_t(const cfg_t& cfg);
 
-    // Construct a Weak Topological Ordering from a control-flow graph using
-    // the algorithm of figure 4 in the paper, where this constructor matches
-    // what is shown there as the Partition function.
-#ifdef RECURSIVE_WTO
-    wto_t(const cfg_t& cfg) : _cfg(cfg) {
-        for (const label_t& label : cfg.labels()) {
-            _dfn.emplace(label, 0);
-        }
-        _num = 0;
-        visit(cfg.entry_label(), _components, {});
-    }
-#else
-    wto_t(const cfg_t& cfg);
-#endif
-
-    [[nodiscard]]
-    wto_partition_t::reverse_iterator begin() {
-        return _components.rbegin();
-    }
     [[nodiscard]]
-    wto_partition_t::reverse_iterator end() {
-        return _components.rend();
+    wto_partition_t::const_reverse_iterator begin() const {
+        return _components.crbegin();
     }
 
-    friend std::ostream& operator<<(std::ostream& o, wto_t& wto) {
-        o << wto._components << std::endl;
-        return o;
-    }
-
-    // Get the vertex at the head of the component containing a given
-    // label, as discussed in section 4.2 of the paper.  If the label
-    // is itself a head of a component, we want the head of whatever
-    // contains that entire component.  Returns nullopt if the label is
-    // not nested, i.e., the head is logically the entry point of the CFG.
-    std::optional<label_t> head(const label_t& label) {
-        auto it = _containing_cycle.find(label);
-        if (it == _containing_cycle.end()) {
-            // Label is not in any cycle.
-            return {};
-        }
-        std::shared_ptr<wto_cycle_t> cycle = it->second.lock();
-        if (cycle == nullptr) {
-            return {};
-        }
-        const label_t& first = cycle->head();
-        if (first != label) {
-            // Return the head of the cycle the label is inside.
-            return first;
-        }
-
-        // This label is already the head of a cycle, so get the cycle's parent.
-        std::shared_ptr<wto_cycle_t> parent = cycle->containing_cycle().lock();
-        if (parent == nullptr) {
-            return {};
-        }
-        return parent->head();
+    [[nodiscard]]
+    wto_partition_t::const_reverse_iterator end() const {
+        return _components.crend();
     }
 
-    // Compute the set of heads of the nested components containing a given label.
-    // See section 3.1 of the paper for discussion, which uses the notation w(c).
-    const wto_nesting_t& nesting(const label_t& label) {
-        auto it = _nesting.find(label);
-        if (it != _nesting.end()) {
-            return it->second;
-        }
-
-        // Not found in the cache yet, so construct the list of heads of the
-        // nested components containing the label, stored in reverse order.
-        std::vector<label_t> heads;
-        for (std::optional<label_t> h = head(label); h.has_value(); h = head(h.value())) {
-            heads.push_back(h.value());
-        }
-
-        wto_nesting_t n = wto_nesting_t(std::move(heads));
-        _nesting.emplace(label, std::move(n));
-        return _nesting.at(label);
-    }
+    friend std::ostream& operator<<(std::ostream& o, const wto_t& wto);
+    const wto_nesting_t& nesting(const label_t& label);
 };
diff --git a/src/crab/wto_cycle.hpp b/src/crab/wto_cycle.hpp
deleted file mode 100644
index b80fea0a3..000000000
--- a/src/crab/wto_cycle.hpp
+++ /dev/null
@@ -1,81 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#pragma once
-#include "wto.hpp"
-#include <memory>
-#include <ostream>
-
-// Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
-// section 3 uses the term "nested component" to refer to what wto_cycle_t implements.
-class wto_cycle_t final {
-    // The cycle containing this cycle, or null if there is no parent cycle.
-    std::weak_ptr<wto_cycle_t> _containing_cycle;
-
-    // List of subcomponents (i.e., vertices or other cycles) contained in this cycle.
-    wto_partition_t _components;
-
-  public:
-    wto_cycle_t(std::weak_ptr<wto_cycle_t>& containing_cycle) : _containing_cycle(containing_cycle) {}
-
-    // Get a vertex of an entry point of the cycle.
-    [[nodiscard]]
-    const label_t& head() const {
-        // Any cycle must start with a vertex, not another cycle,
-        // per Definition 1 in the paper.  Since the vector is in reverse
-        // order, the head is the last element.
-        return std::get<label_t>(*_components.back().get());
-    }
-
-    [[nodiscard]]
-    wto_partition_t::reverse_iterator begin() {
-        return _components.rbegin();
-    }
-    [[nodiscard]]
-    wto_partition_t::reverse_iterator end() {
-        return _components.rend();
-    }
-
-    [[nodiscard]]
-    std::weak_ptr<wto_cycle_t> containing_cycle() const {
-        return _containing_cycle;
-    }
-    [[nodiscard]]
-    wto_partition_t& components() {
-        return _components;
-    }
-};
-
-inline std::ostream& operator<<(std::ostream& o, wto_cycle_t& cycle) {
-    o << "( ";
-    for (auto& component : cycle) {
-        wto_component_t* c = component.get();
-
-        // For some reason, an Ubuntu Release build can't find the right
-        // function to call via std::visit and just outputs a pointer
-        // value, so we force it to use the right one here.
-        if (std::holds_alternative<std::shared_ptr<class wto_cycle_t>>(*c)) {
-            auto ptr = std::get<std::shared_ptr<class wto_cycle_t>>(*c);
-            o << *ptr;
-        } else {
-            std::visit([&o](auto& e) -> std::ostream& { return o << e; }, *component);
-        }
-        o << " ";
-    }
-    o << ")";
-    return o;
-}
-
-inline std::ostream& operator<<(std::ostream& o, std::shared_ptr<wto_cycle_t>& e) {
-    if (e != nullptr) {
-        o << *e;
-    }
-    return o;
-}
-
-inline std::ostream& operator<<(std::ostream& o, wto_partition_t& partition) {
-    for (auto it = partition.rbegin(); it != partition.rend(); it++) {
-        wto_component_t* component = it->get();
-        std::visit([&o](auto& e) -> std::ostream& { return o << e; }, *component) << " ";
-    }
-    return o;
-}
diff --git a/src/crab/wto_nesting.hpp b/src/crab/wto_nesting.hpp
deleted file mode 100644
index e614be1cb..000000000
--- a/src/crab/wto_nesting.hpp
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#pragma once
-
-// Bourdoncle, "Efficient chaotic iteration strategies with widenings", 1993
-// uses the notation w(c) to refer to the set of heads of the nested components
-// containing a vertex c.  This class holds such a set of heads.  The table
-// mapping c to w(c) is stored outside the class, in wto_t._nesting.
-class wto_nesting_t final {
-    // To optimize insertion performance, the list of heads is stored in reverse
-    // order, i.e., from innermost to outermost cycle.
-    std::vector<label_t> _heads;
-
-  public:
-    wto_nesting_t(std::vector<label_t>&& heads) : _heads(std::move(heads)) {}
-
-    // Test whether this nesting is a longer subset of another nesting.
-    bool operator>(const wto_nesting_t& nesting) const {
-        size_t this_size = this->_heads.size();
-        size_t other_size = nesting._heads.size();
-        if (this_size <= other_size) {
-            // Can't be a superset.
-            return false;
-        }
-
-        // Compare entries one at a time starting from the outermost
-        // (i.e., end of the vectors).
-        for (size_t index = 0; index < other_size; index++) {
-            if (this->_heads[this_size - 1 - index] != nesting._heads[other_size - 1 - index]) {
-                return false;
-            }
-        }
-        return true;
-    };
-
-    // Output the nesting in order from outermost to innermost.
-    friend std::ostream& operator<<(std::ostream& o, const wto_nesting_t& nesting) {
-        for (auto it = nesting._heads.rbegin(); it != nesting._heads.rend(); it++) {
-            o << *it << " ";
-        }
-        return o;
-    }
-};

From 12d3121891d6ef434cc723d3595676626cf827d2 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 05:41:05 +0300
Subject: [PATCH 260/373] modernize heap.hpp (#700)

modernize Heap, remove unused .clear() method

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/heap.hpp | 68 +++++++++++++++++------------------------
 1 file changed, 28 insertions(+), 40 deletions(-)

diff --git a/src/crab_utils/heap.hpp b/src/crab_utils/heap.hpp
index bc8e8a367..c95cbf1f5 100644
--- a/src/crab_utils/heap.hpp
+++ b/src/crab_utils/heap.hpp
@@ -23,44 +23,44 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ******************************************************************************************/
 #include <vector>
 
-//=========================================================================================
-// A heap implementation with support for decrease/increase key.
-//=========================================================================================
-
 namespace crab {
 
-template <class Comp>
+// A heap implementation with support for decrease/increase key.
+// @tparam Comp a predicate that compares two integers.
+template <std::predicate<int, int> Comparator>
 class Heap {
-    Comp lt;
+    Comparator lt;
     std::vector<int> heap;    // heap of ints
     std::vector<int> indices; // int -> index in heap
 
     // Index "traversal" functions
-    static inline int left(int i) { return i * 2 + 1; }
-    static inline int right(int i) { return (i + 1) * 2; }
-    static inline int parent(int i) { return (i - 1) >> 1; }
+    static int left(const int i) { return i * 2 + 1; }
+    static int right(const int i) { return (i + 1) * 2; }
+    static int parent(const int i) { return (i - 1) >> 1; }
 
-    inline void percolateUp(int i) {
+    void percolateUp(int i) {
         int x = heap[i];
         while (i != 0 && lt(x, heap[parent(i)])) {
-            heap[i] = heap[parent(i)];
-            indices[heap[i]] = i;
+            const int v = heap[i] = heap[parent(i)];
+            indices[v] = i;
             i = parent(i);
         }
         heap[i] = x;
         indices[x] = i;
     }
 
-    inline void percolateDown(int i) {
-        int x = heap[i];
-        while (static_cast<size_t>(left(i)) < heap.size()) {
-            int child =
-                static_cast<size_t>(right(i)) < heap.size() && lt(heap[right(i)], heap[left(i)]) ? right(i) : left(i);
+    void percolateDown(int i) {
+        const int x = heap[i];
+        const int size = heap.size();
+        while (left(i) < size) {
+            int ri = right(i);
+            int li = left(i);
+            const int child = static_cast<size_t>(ri) < size && lt(heap[ri], heap[li]) ? ri : li;
             if (!lt(heap[child], x)) {
                 break;
             }
-            heap[i] = heap[child];
-            indices[heap[i]] = i;
+            const int v = heap[i] = heap[child];
+            indices[v] = i;
             i = child;
         }
         heap[i] = x;
@@ -68,13 +68,13 @@ class Heap {
     }
 
     [[nodiscard]]
-    bool heapProperty(int i) const {
+    bool heapProperty(const int i) const {
         return i >= heap.size() ||
                ((i == 0 || !lt(heap[i], heap[parent(i)])) && heapProperty(left(i)) && heapProperty(right(i)));
     }
 
   public:
-    explicit Heap(const Comp& c) : lt(c) {}
+    explicit Heap(const Comparator& c) : lt(c) {}
 
     [[nodiscard]]
     int size() const {
@@ -85,20 +85,20 @@ class Heap {
         return heap.empty();
     }
     [[nodiscard]]
-    bool inHeap(int n) const {
+    bool inHeap(const int n) const {
         return static_cast<size_t>(n) < indices.size() && indices[n] >= 0;
     }
-    int operator[](int index) const {
+    int operator[](const int index) const {
         assert(static_cast<size_t>(index) < heap.size());
         return heap[index];
     }
 
-    void decrease(int n) {
+    void decrease(const int n) {
         assert(inHeap(n));
         percolateUp(indices[n]);
     }
 
-    void insert(int n) {
+    void insert(const int n) {
         assert(n >= 0);
         if (static_cast<size_t>(n) >= indices.size()) {
             indices.resize(n + 1, -1);
@@ -111,9 +111,9 @@ class Heap {
     }
 
     int removeMin() {
-        int x = heap[0];
-        heap[0] = heap.back();
-        indices[heap[0]] = 0;
+        const int x = heap[0];
+        const int v = heap[0] = heap.back();
+        indices[v] = 0;
         indices[x] = -1;
         heap.pop_back();
         if (heap.size() > 1) {
@@ -121,17 +121,5 @@ class Heap {
         }
         return x;
     }
-
-    void clear() {
-        for (int i : heap) {
-            indices[i] = -1;
-        }
-#ifdef NDEBUG
-        for (int i = 0; i < indices.size(); i++) {
-            assert(indices[i] == -1);
-        }
-#endif
-        heap.clear();
-    }
 };
 } // namespace crab

From 7b6a27f19d421bba8b3eb4d13c14f2a2f54c4f5f Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 17:33:21 +0300
Subject: [PATCH 261/373] reorganize type domain (#701)

* reorganize type domain
* streamline type set handling
---------

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_ostream.cpp        |  30 +---
 src/asm_parse.cpp          |  59 +-----
 src/asm_syntax.hpp         |  18 +-
 src/assertions.cpp         |   3 +-
 src/crab/dsl_syntax.hpp    |  10 ++
 src/crab/ebpf_domain.cpp   | 245 +------------------------
 src/crab/ebpf_domain.hpp   |  54 +-----
 src/crab/split_dbm.cpp     |  60 +++----
 src/crab/type_domain.cpp   | 359 +++++++++++++++++++++++++++++++++++++
 src/crab/type_domain.hpp   |  79 ++++++++
 src/crab/type_encoding.hpp |  67 +++++++
 src/crab/var_factory.cpp   |  19 +-
 src/crab/variable.hpp      |  18 +-
 src/crab/wto.cpp           |   2 +-
 src/crab_utils/heap.hpp    |   2 +-
 src/crab_utils/num_big.hpp |   5 +
 src/string_constraints.hpp |  20 +--
 src/test/test_verify.cpp   |   6 +-
 test-data/jump.yaml        |   2 +-
 19 files changed, 575 insertions(+), 483 deletions(-)
 create mode 100644 src/crab/type_domain.cpp
 create mode 100644 src/crab/type_domain.hpp
 create mode 100644 src/crab/type_encoding.hpp

diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index db5d4e706..682dba033 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -10,11 +10,13 @@
 #include "asm_syntax.hpp"
 #include "crab/cfg.hpp"
 #include "crab/interval.hpp"
+#include "crab/type_encoding.hpp"
 #include "crab/variable.hpp"
 #include "helpers.hpp"
 #include "platform.hpp"
 #include "spec_type_descriptors.hpp"
 
+using crab::TypeGroup;
 using std::optional;
 using std::string;
 using std::vector;
@@ -103,29 +105,6 @@ std::ostream& operator<<(std::ostream& os, Condition::Op op) {
 
 static string size(int w) { return string("u") + std::to_string(w * 8); }
 
-static std::string to_string(TypeGroup ts) {
-    switch (ts) {
-    case TypeGroup::number: return "number";
-    case TypeGroup::map_fd: return "map_fd";
-    case TypeGroup::map_fd_programs: return "map_fd_programs";
-    case TypeGroup::ctx: return "ctx";
-    case TypeGroup::packet: return "packet";
-    case TypeGroup::stack: return "stack";
-    case TypeGroup::shared: return "shared";
-    case TypeGroup::mem: return "{stack, packet, shared}";
-    case TypeGroup::pointer: return "{ctx, stack, packet, shared}";
-    case TypeGroup::non_map_fd: return "non_map_fd";
-    case TypeGroup::ptr_or_num: return "{number, ctx, stack, packet, shared}";
-    case TypeGroup::stack_or_packet: return "{stack, packet}";
-    case TypeGroup::singleton_ptr: return "{ctx, stack, packet}";
-    case TypeGroup::mem_or_num: return "{number, stack, packet, shared}";
-    default: assert(false);
-    }
-    return {};
-}
-
-std::ostream& operator<<(std::ostream& os, TypeGroup ts) { return os << to_string(ts); }
-
 std::ostream& operator<<(std::ostream& os, ValidStore const& a) {
     return os << a.mem << ".type != stack -> " << TypeConstraint{a.val, TypeGroup::number};
 }
@@ -181,7 +160,7 @@ std::ostream& operator<<(std::ostream& os, Comparable const& a) {
     if (a.or_r2_is_number) {
         os << TypeConstraint{a.r2, TypeGroup::number} << " or ";
     }
-    return os << typereg(a.r1) << " == " << typereg(a.r2) << " in " << to_string(TypeGroup::singleton_ptr);
+    return os << typereg(a.r1) << " == " << typereg(a.r2) << " in " << TypeGroup::singleton_ptr;
 }
 
 std::ostream& operator<<(std::ostream& os, Addable const& a) {
@@ -191,8 +170,7 @@ std::ostream& operator<<(std::ostream& os, Addable const& a) {
 std::ostream& operator<<(std::ostream& os, ValidDivisor const& a) { return os << a.reg << " != 0"; }
 
 std::ostream& operator<<(std::ostream& os, TypeConstraint const& tc) {
-    string types = to_string(tc.types);
-    string cmp_op = types[0] == '{' ? "in" : "==";
+    const string cmp_op = is_singleton_type(tc.types) ? "==" : "in";
     return os << typereg(tc.reg) << " " << cmp_op << " " << tc.types;
 }
 
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index 4986491f6..bba263b25 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -1,11 +1,9 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
-#include <algorithm>
 #include <map>
 #include <regex>
 #include <sstream>
 #include <string>
-#include <unordered_set>
 
 #include <boost/lexical_cast.hpp>
 
@@ -13,6 +11,7 @@
 #include "asm_unmarshal.hpp"
 #include "crab/dsl_syntax.hpp"
 #include "crab/linear_constraint.hpp"
+#include "crab/type_encoding.hpp"
 #include "platform.hpp"
 #include "string_constraints.hpp"
 
@@ -241,7 +240,7 @@ static InstructionSeq parse_program(std::istream& is) {
         std::smatch m;
         if (regex_search(line, m, regex(LABEL ":"))) {
             next_label = label_t(boost::lexical_cast<int>(m[1]));
-            if (seen_labels.count(*next_label) != 0) {
+            if (seen_labels.contains(*next_label)) {
                 throw std::invalid_argument("duplicate labels");
             }
             line = m.suffix();
@@ -278,56 +277,10 @@ static crab::variable_t special_var(const std::string& s) {
     throw std::runtime_error(std::string() + "Bad special variable: " + s);
 }
 
-static crab::data_kind_t regkind(const std::string& s) {
-    if (s == "type") {
-        return crab::data_kind_t::types;
-    }
-    if (s == "ctx_offset") {
-        return crab::data_kind_t::ctx_offsets;
-    }
-    if (s == "map_fd") {
-        return crab::data_kind_t::map_fds;
-    }
-    if (s == "packet_offset") {
-        return crab::data_kind_t::packet_offsets;
-    }
-    if (s == "shared_offset") {
-        return crab::data_kind_t::shared_offsets;
-    }
-    if (s == "stack_offset") {
-        return crab::data_kind_t::stack_offsets;
-    }
-    if (s == "shared_region_size") {
-        return crab::data_kind_t::shared_region_sizes;
-    }
-    if (s == "stack_numeric_size") {
-        return crab::data_kind_t::stack_numeric_sizes;
-    }
-    if (s == "svalue") {
-        return crab::data_kind_t::svalues;
-    }
-    if (s == "uvalue") {
-        return crab::data_kind_t::uvalues;
-    }
-    throw std::runtime_error(std::string() + "Bad kind: " + s);
-}
-
-static type_encoding_t string_to_type_encoding(const std::string& s) {
-    static std::map<std::string, type_encoding_t> string_to_type{
-        {std::string("uninit"), T_UNINIT}, {std::string("map_fd_programs"), T_MAP_PROGRAMS},
-        {std::string("map_fd"), T_MAP},    {std::string("number"), T_NUM},
-        {std::string("ctx"), T_CTX},       {std::string("stack"), T_STACK},
-        {std::string("packet"), T_PACKET}, {std::string("shared"), T_SHARED},
-    };
-    if (string_to_type.count(s)) {
-        return string_to_type[s];
-    }
-    throw std::runtime_error(std::string("Unsupported type name: ") + s);
-}
-
 std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::string>& constraints,
                                                           std::vector<crab::interval_t>& numeric_ranges) {
     using namespace crab::dsl_syntax;
+    using crab::regkind;
     using crab::variable_t;
 
     std::vector<linear_constraint_t> res;
@@ -357,7 +310,7 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
                                regex(REG DOT "type"
                                              "=" TYPE))) {
             variable_t d = variable_t::reg(crab::data_kind_t::types, regnum(m[1]));
-            res.push_back(d == string_to_type_encoding(m[2]));
+            res.push_back(d == crab::string_to_type_encoding(m[2]));
         } else if (regex_match(cst_text, m, regex(REG DOT KIND "=" IMM))) {
             variable_t d = variable_t::reg(regkind(m[2]), regnum(m[1]));
             number_t value;
@@ -387,8 +340,8 @@ std::vector<linear_constraint_t> parse_linear_constraints(const std::set<std::st
         } else if (regex_match(cst_text, m,
                                regex("s" ARRAY_RANGE DOT "type"
                                      "=" TYPE))) {
-            type_encoding_t type = string_to_type_encoding(m[3]);
-            if (type == type_encoding_t::T_NUM) {
+            crab::type_encoding_t type = crab::string_to_type_encoding(m[3]);
+            if (type == crab::type_encoding_t::T_NUM) {
                 numeric_ranges.emplace_back(signed_number(m[1]), signed_number(m[2]));
             } else {
                 number_t lb = signed_number(m[1]);
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index c7eb28448..3cc7c0992 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -298,23 +298,6 @@ struct Assume {
     constexpr bool operator==(const Assume&) const = default;
 };
 
-enum class TypeGroup {
-    number,
-    map_fd,
-    ctx,             ///< pointer to the special memory region named 'ctx'
-    packet,          ///< pointer to the packet
-    stack,           ///< pointer to the stack
-    shared,          ///< pointer to shared memory
-    map_fd_programs, ///< reg == T_MAP_PROGRAMS
-    non_map_fd,      ///< reg >= T_NUM
-    mem,             ///< shared | stack | packet = reg >= T_PACKET
-    mem_or_num,      ///< reg >= T_NUM && reg != T_CTX
-    pointer,         ///< reg >= T_CTX
-    ptr_or_num,      ///< reg >= T_NUM
-    stack_or_packet, ///< reg <= T_STACK && reg >= T_PACKET
-    singleton_ptr,   ///< reg <= T_STACK && reg >= T_CTX
-};
-
 /// Condition check whether something is a valid size.
 struct ValidSize {
     Reg reg;
@@ -383,6 +366,7 @@ struct ValidStore {
     constexpr bool operator==(const ValidStore&) const = default;
 };
 
+using crab::TypeGroup;
 struct TypeConstraint {
     Reg reg;
     TypeGroup types;
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 1a974abb3..4a53e68ca 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -9,6 +9,7 @@
 #include "crab/cfg.hpp"
 #include "platform.hpp"
 
+using crab::TypeGroup;
 using std::string;
 using std::to_string;
 using std::vector;
@@ -146,7 +147,7 @@ class AssertExtractor {
             res.emplace_back(ValidAccess{cond.left});
             res.emplace_back(ValidAccess{reg(cond.right)});
             if (cond.op != Condition::Op::EQ && cond.op != Condition::Op::NE) {
-                res.emplace_back(TypeConstraint{cond.left, TypeGroup::non_map_fd});
+                res.emplace_back(TypeConstraint{cond.left, TypeGroup::ptr_or_num});
             }
             res.emplace_back(Comparable{.r1 = cond.left, .r2 = reg(cond.right), .or_r2_is_number = false});
         }
diff --git a/src/crab/dsl_syntax.hpp b/src/crab/dsl_syntax.hpp
index 52b571a3c..c65e9d48b 100644
--- a/src/crab/dsl_syntax.hpp
+++ b/src/crab/dsl_syntax.hpp
@@ -33,6 +33,16 @@ inline linear_constraint_t operator>=(const linear_expression_t& e1, const linea
 
 inline linear_constraint_t operator>(const linear_expression_t& e1, const linear_expression_t& e2) { return e2 < e1; }
 
+inline linear_constraint_t eq(const variable_t a, const variable_t b) {
+    using namespace crab::dsl_syntax;
+    return {a - b, constraint_kind_t::EQUALS_ZERO};
+}
+
+inline linear_constraint_t neq(const variable_t a, const variable_t b) {
+    using namespace crab::dsl_syntax;
+    return {a - b, constraint_kind_t::NOT_ZERO};
+}
+
 inline linear_constraint_t operator==(const linear_expression_t& e1, const linear_expression_t& e2) {
     return linear_constraint_t(e1 - e2, constraint_kind_t::EQUALS_ZERO);
 }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 555a13de9..98b42cfc6 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -22,46 +22,6 @@
 
 using crab::domains::NumAbsDomain;
 namespace crab {
-struct reg_pack_t {
-    variable_t svalue; // int64_t value.
-    variable_t uvalue; // uint64_t value.
-    variable_t ctx_offset;
-    variable_t map_fd;
-    variable_t packet_offset;
-    variable_t shared_offset;
-    variable_t stack_offset;
-    variable_t type;
-    variable_t shared_region_size;
-    variable_t stack_numeric_size;
-};
-
-reg_pack_t reg_pack(const int i) {
-    return {
-        variable_t::reg(data_kind_t::svalues, i),
-        variable_t::reg(data_kind_t::uvalues, i),
-        variable_t::reg(data_kind_t::ctx_offsets, i),
-        variable_t::reg(data_kind_t::map_fds, i),
-        variable_t::reg(data_kind_t::packet_offsets, i),
-        variable_t::reg(data_kind_t::shared_offsets, i),
-        variable_t::reg(data_kind_t::stack_offsets, i),
-        variable_t::reg(data_kind_t::types, i),
-        variable_t::reg(data_kind_t::shared_region_sizes, i),
-        variable_t::reg(data_kind_t::stack_numeric_sizes, i),
-    };
-}
-reg_pack_t reg_pack(const Reg r) { return reg_pack(r.v); }
-
-static linear_constraint_t eq(const variable_t a, const variable_t b) {
-    using namespace crab::dsl_syntax;
-    return {a - b, constraint_kind_t::EQUALS_ZERO};
-}
-
-static linear_constraint_t eq_types(const Reg& a, const Reg& b) { return eq(reg_pack(a).type, reg_pack(b).type); }
-
-static linear_constraint_t neq(const variable_t a, const variable_t b) {
-    using namespace crab::dsl_syntax;
-    return {a - b, constraint_kind_t::NOT_ZERO};
-}
 
 constexpr int MAX_PACKET_SIZE = 0xffff;
 
@@ -75,7 +35,7 @@ constexpr int64_t PTR_MAX = std::numeric_limits<int32_t>::max() - MAX_PACKET_SIZ
 
 /** Linear constraint for a pointer comparison.
  */
-static linear_constraint_t assume_cst_offsets_reg(const Condition::Op op, bool is64, const variable_t dst_offset,
+static linear_constraint_t assume_cst_offsets_reg(const Condition::Op op, const variable_t dst_offset,
                                                   const variable_t src_offset) {
     using namespace crab::dsl_syntax;
     using Op = Condition::Op;
@@ -814,71 +774,6 @@ bool ebpf_domain_t::operator==(const ebpf_domain_t& other) const {
     return stack == other.stack && m_inv <= other.m_inv && other.m_inv <= m_inv;
 }
 
-void ebpf_domain_t::TypeDomain::add_extra_invariant(const NumAbsDomain& dst,
-                                                    std::map<variable_t, interval_t>& extra_invariants,
-                                                    const variable_t type_variable, const type_encoding_t type,
-                                                    const data_kind_t kind, const NumAbsDomain& src) const {
-    const bool dst_has_type = has_type(dst, type_variable, type);
-    const bool src_has_type = has_type(src, type_variable, type);
-    variable_t v = variable_t::kind_var(kind, type_variable);
-
-    // If type is contained in exactly one of dst or src,
-    // we need to remember the value.
-    if (dst_has_type && !src_has_type) {
-        extra_invariants.emplace(v, dst.eval_interval(v));
-    } else if (!dst_has_type && src_has_type) {
-        extra_invariants.emplace(v, src.eval_interval(v));
-    }
-}
-
-void ebpf_domain_t::TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const {
-    // Some variables are type-specific.  Type-specific variables
-    // for a register can exist in the domain whenever the associated
-    // type value is present in the register's types interval (and the
-    // value is not Top), and are absent otherwise.  That is, we want
-    // to keep track of implications of the form
-    // "if register R has type=T then R.T_offset has value ...".
-    //
-    // If a type value is legal in exactly one of the two domains, a
-    // normal join operation would remove any type-specific variables
-    // from the resulting merged domain since absence from the other
-    // would be interpreted to mean Top.
-    //
-    // However, when the type value is not present in one domain,
-    // any type-specific variables for that type are instead to be
-    // interpreted as Bottom, so we want to preserve the values of any
-    // type-specific variables from the other domain where the type
-    // value is legal.
-    //
-    // Example input:
-    //   r1.type=stack, r1.stack_offset=100
-    //   r1.type=packet, r1.packet_offset=4
-    // Output:
-    //   r1.type={stack,packet}, r1.stack_offset=100, r1.packet_offset=4
-
-    std::map<variable_t, interval_t> extra_invariants;
-    if (!dst.is_bottom()) {
-        for (const variable_t v : variable_t::get_type_variables()) {
-            add_extra_invariant(dst, extra_invariants, v, T_CTX, data_kind_t::ctx_offsets, src);
-            add_extra_invariant(dst, extra_invariants, v, T_MAP, data_kind_t::map_fds, src);
-            add_extra_invariant(dst, extra_invariants, v, T_MAP_PROGRAMS, data_kind_t::map_fds, src);
-            add_extra_invariant(dst, extra_invariants, v, T_PACKET, data_kind_t::packet_offsets, src);
-            add_extra_invariant(dst, extra_invariants, v, T_SHARED, data_kind_t::shared_offsets, src);
-            add_extra_invariant(dst, extra_invariants, v, T_STACK, data_kind_t::stack_offsets, src);
-            add_extra_invariant(dst, extra_invariants, v, T_SHARED, data_kind_t::shared_region_sizes, src);
-            add_extra_invariant(dst, extra_invariants, v, T_STACK, data_kind_t::stack_numeric_sizes, src);
-        }
-    }
-
-    // Do a normal join operation on the domain.
-    dst |= std::move(src);
-
-    // Now add in the extra invariants saved above.
-    for (auto& [variable, interval] : extra_invariants) {
-        dst.set(variable, interval);
-    }
-}
-
 void ebpf_domain_t::operator|=(ebpf_domain_t&& other) {
     if (is_bottom()) {
         *this = std::move(other);
@@ -1283,139 +1178,6 @@ static linear_constraint_t type_is_not_stack(const reg_pack_t& r) {
     return r.type != T_STACK;
 }
 
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const type_encoding_t t) {
-    inv.assign(reg_pack(lhs).type, t);
-}
-
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const Reg& rhs) {
-    inv.assign(reg_pack(lhs).type, reg_pack(rhs).type);
-}
-
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs, const Reg& rhs) {
-    inv.assign(lhs, reg_pack(rhs).type);
-}
-
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs,
-                                            const number_t& rhs) {
-    inv.assign(lhs, rhs);
-}
-
-void ebpf_domain_t::TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs,
-                                            const std::optional<linear_expression_t>& rhs) {
-    inv.assign(reg_pack(lhs).type, rhs);
-}
-
-void ebpf_domain_t::TypeDomain::havoc_type(NumAbsDomain& inv, const Reg& r) { inv -= reg_pack(r).type; }
-
-int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const Reg& r) const {
-    const auto res = inv[reg_pack(r).type].singleton();
-    if (!res) {
-        return T_UNINIT;
-    }
-    return static_cast<int>(*res);
-}
-
-int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const variable_t v) const {
-    const auto res = inv[v].singleton();
-    if (!res) {
-        return T_UNINIT;
-    }
-    return static_cast<int>(*res);
-}
-
-int ebpf_domain_t::TypeDomain::get_type(const NumAbsDomain& inv, const number_t& t) const {
-    return static_cast<int>(t);
-}
-
-// Check whether a given type value is within the range of a given type variable's value.
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const Reg& r, const type_encoding_t type) const {
-    const interval_t interval = inv[reg_pack(r).type];
-    if (interval.is_top()) {
-        return true;
-    }
-    return interval.lb().number().value_or(std::numeric_limits<int32_t>::min()) <= type &&
-           interval.ub().number().value_or(std::numeric_limits<int32_t>::max()) >= type;
-}
-
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const variable_t v,
-                                         const type_encoding_t type) const {
-    const interval_t interval = inv[v];
-    if (interval.is_top()) {
-        return true;
-    }
-    return interval.contains(type);
-}
-
-bool ebpf_domain_t::TypeDomain::has_type(const NumAbsDomain& inv, const number_t& t, const type_encoding_t type) const {
-    return t == type;
-}
-
-NumAbsDomain ebpf_domain_t::TypeDomain::join_over_types(
-    const NumAbsDomain& inv, const Reg& reg,
-    const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const {
-    interval_t types = inv.eval_interval(reg_pack(reg).type);
-    if (types.is_bottom()) {
-        return NumAbsDomain::bottom();
-    }
-    if (types.is_top()) {
-        NumAbsDomain res(inv);
-        transition(res, T_UNINIT);
-        return res;
-    }
-    NumAbsDomain res = NumAbsDomain::bottom();
-    auto [lb, ub] = types.bound(T_MIN, T_MAX);
-    for (type_encoding_t type = lb; type <= ub; type = static_cast<type_encoding_t>(type + 1)) {
-        NumAbsDomain tmp(inv);
-        transition(tmp, type);
-        selectively_join_based_on_type(res, std::move(tmp)); // res |= tmp;
-    }
-    return res;
-}
-
-NumAbsDomain ebpf_domain_t::TypeDomain::join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
-                                                        const std::function<void(NumAbsDomain&)>& if_true,
-                                                        const std::function<void(NumAbsDomain&)>& if_false) const {
-    NumAbsDomain true_case(inv.when(condition));
-    if_true(true_case);
-
-    NumAbsDomain false_case(inv.when(condition.negate()));
-    if_false(false_case);
-
-    return true_case | false_case;
-}
-
-bool ebpf_domain_t::TypeDomain::same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const {
-    return inv.entail(eq_types(a, b));
-}
-
-bool ebpf_domain_t::TypeDomain::implies_type(const NumAbsDomain& inv, const linear_constraint_t& a,
-                                             const linear_constraint_t& b) const {
-    return inv.when(a).entail(b);
-}
-
-bool ebpf_domain_t::TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg& r, const TypeGroup group) const {
-    using namespace crab::dsl_syntax;
-    const variable_t t = reg_pack(r).type;
-    switch (group) {
-    case TypeGroup::number: return inv.entail(t == T_NUM);
-    case TypeGroup::map_fd: return inv.entail(t == T_MAP);
-    case TypeGroup::map_fd_programs: return inv.entail(t == T_MAP_PROGRAMS);
-    case TypeGroup::ctx: return inv.entail(t == T_CTX);
-    case TypeGroup::packet: return inv.entail(t == T_PACKET);
-    case TypeGroup::stack: return inv.entail(t == T_STACK);
-    case TypeGroup::shared: return inv.entail(t == T_SHARED);
-    case TypeGroup::non_map_fd: return inv.entail(t >= T_NUM);
-    case TypeGroup::mem: return inv.entail(t >= T_PACKET);
-    case TypeGroup::mem_or_num: return inv.entail(t >= T_NUM) && inv.entail(t != T_CTX);
-    case TypeGroup::pointer: return inv.entail(t >= T_CTX);
-    case TypeGroup::ptr_or_num: return inv.entail(t >= T_NUM);
-    case TypeGroup::stack_or_packet: return inv.entail(t >= T_PACKET) && inv.entail(t <= T_STACK);
-    case TypeGroup::singleton_ptr: return inv.entail(t >= T_CTX) && inv.entail(t <= T_STACK);
-    }
-    assert(false);
-    return false;
-}
-
 void ebpf_domain_t::operator()(const basic_block_t& bb) {
     for (const Instruction& statement : bb) {
         std::visit(*this, statement);
@@ -1475,7 +1237,7 @@ void ebpf_domain_t::operator()(const Assume& s) {
                     // or an equality comparison on map descriptors/pointers to non-singleton locations
                     if (const auto dst_offset = get_type_offset_variable(cond.left, type)) {
                         if (const auto src_offset = get_type_offset_variable(src_reg, type)) {
-                            inv += assume_cst_offsets_reg(cond.op, cond.is64, dst_offset.value(), src_offset.value());
+                            inv += assume_cst_offsets_reg(cond.op, dst_offset.value(), src_offset.value());
                         }
                     }
                 }
@@ -2283,8 +2045,7 @@ void ebpf_domain_t::do_mem_store(const Mem& b, Type val_type, SValue val_svalue,
     }
     m_inv = type_inv.join_over_types(m_inv, b.access.basereg, [&](NumAbsDomain& inv, const type_encoding_t type) {
         if (type == T_STACK) {
-            const linear_expression_t base_addr =
-                linear_expression_t(get_type_offset_variable(b.access.basereg, type).value());
+            const auto base_addr = linear_expression_t(get_type_offset_variable(b.access.basereg, type).value());
             do_store_stack(inv, width, dsl_syntax::operator+(base_addr, offset), val_type, val_svalue, val_uvalue,
                            val_reg);
         }
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 63f3749ba..9113df8ce 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -6,25 +6,19 @@
 
 #include <functional>
 #include <optional>
-#include <vector>
 
 #include "crab/array_domain.hpp"
 #include "crab/split_dbm.hpp"
+#include "crab/type_domain.hpp"
 #include "crab/variable.hpp"
 #include "string_constraints.hpp"
 
 namespace crab {
 
-using NumAbsDomain = domains::NumAbsDomain;
-
-struct reg_pack_t;
-
 class ebpf_domain_t final {
-    struct TypeDomain;
-
   public:
     ebpf_domain_t();
-    ebpf_domain_t(domains::NumAbsDomain inv, domains::array_domain_t stack);
+    ebpf_domain_t(NumAbsDomain inv, domains::array_domain_t stack);
 
     // Generic abstract domain operations
     static ebpf_domain_t top();
@@ -214,50 +208,6 @@ class ebpf_domain_t final {
     std::function<check_require_func_t> check_require{};
     bool get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, int32_t* end_fd) const;
 
-    struct TypeDomain {
-        void assign_type(NumAbsDomain& inv, const Reg& lhs, type_encoding_t t);
-        void assign_type(NumAbsDomain& inv, const Reg& lhs, const Reg& rhs);
-        void assign_type(NumAbsDomain& inv, const Reg& lhs, const std::optional<linear_expression_t>& rhs);
-        void assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const Reg& rhs);
-        void assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const number_t& rhs);
-
-        void havoc_type(NumAbsDomain& inv, const Reg& r);
-
-        [[nodiscard]]
-        int get_type(const NumAbsDomain& inv, variable_t v) const;
-        [[nodiscard]]
-        int get_type(const NumAbsDomain& inv, const Reg& r) const;
-        [[nodiscard]]
-        int get_type(const NumAbsDomain& inv, const number_t& t) const;
-
-        [[nodiscard]]
-        bool has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const;
-        [[nodiscard]]
-        bool has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const;
-        [[nodiscard]]
-        bool has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const;
-
-        [[nodiscard]]
-        bool same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const;
-        [[nodiscard]]
-        bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a, const linear_constraint_t& b) const;
-
-        [[nodiscard]]
-        NumAbsDomain join_over_types(const NumAbsDomain& inv, const Reg& reg,
-                                     const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
-        [[nodiscard]]
-        NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
-                                     const std::function<void(NumAbsDomain&)>& if_true,
-                                     const std::function<void(NumAbsDomain&)>& if_false) const;
-        void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const;
-        void add_extra_invariant(const NumAbsDomain& dst, std::map<variable_t, interval_t>& extra_invariants,
-                                 variable_t type_variable, type_encoding_t type, data_kind_t kind,
-                                 const NumAbsDomain& other) const;
-
-        [[nodiscard]]
-        bool is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const;
-    };
-
     TypeDomain type_inv;
     std::string current_assertion;
 }; // end ebpf_domain_t
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 1fcd2bbd1..4baee4589 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -6,6 +6,7 @@
 #include "crab_utils/debug.hpp"
 #include "crab_utils/stats.hpp"
 #include "string_constraints.hpp"
+#include "type_encoding.hpp"
 
 namespace crab::domains {
 
@@ -479,14 +480,14 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
 
     // Build the permuted view of x and y.
     assert(g.size() > 0);
-    GraphPerm<const graph_t> gx(perm_x, g);
+    GraphPerm gx(perm_x, g);
     assert(o.g.size() > 0);
-    GraphPerm<const graph_t> gy(perm_y, o.g);
+    GraphPerm gy(perm_y, o.g);
 
     // Compute the deferred relations
     graph_t g_ix_ry;
     g_ix_ry.growTo(sz);
-    SubGraph<GraphPerm<const graph_t>> gy_excl(gy, 0);
+    SubGraph gy_excl(gy, 0);
     for (vert_id s : gy_excl.verts()) {
         for (vert_id d : gy_excl.succs(s)) {
             if (auto ws = gx.lookup(s, 0)) {
@@ -500,13 +501,13 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
     bool is_closed;
     graph_t g_rx(GrOps::meet(gx, g_ix_ry, is_closed));
     if (!is_closed) {
-        GrOps::apply_delta(g_rx, GrOps::close_after_meet(SubGraph<graph_t>(g_rx, 0), pot_rx, gx, g_ix_ry));
+        GrOps::apply_delta(g_rx, GrOps::close_after_meet(SubGraph(g_rx, 0), pot_rx, gx, g_ix_ry));
     }
 
     graph_t g_rx_iy;
     g_rx_iy.growTo(sz);
 
-    SubGraph<GraphPerm<const graph_t>> gx_excl(gx, 0);
+    SubGraph gx_excl(gx, 0);
     for (vert_id s : gx_excl.verts()) {
         for (vert_id d : gx_excl.succs(s)) {
             // Assumption: gx.mem(s, d) -> gx.edge_val(s, d) <= ranges[var(s)].ub() - ranges[var(d)].lb()
@@ -521,7 +522,7 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
     // Similarly, should use a SubGraph view.
     graph_t g_ry(GrOps::meet(gy, g_rx_iy, is_closed));
     if (!is_closed) {
-        GrOps::apply_delta(g_ry, GrOps::close_after_meet(SubGraph<graph_t>(g_ry, 0), pot_ry, gy, g_rx_iy));
+        GrOps::apply_delta(g_ry, GrOps::close_after_meet(SubGraph(g_ry, 0), pot_ry, gy, g_rx_iy));
     }
 
     // We now have the relevant set of relations. Because g_rx and g_ry are closed,
@@ -637,9 +638,9 @@ SplitDBM SplitDBM::widen(const SplitDBM& o) const {
 
     // Build the permuted view of x and y.
     assert(g.size() > 0);
-    GraphPerm<const graph_t> gx(perm_x, g);
+    GraphPerm gx(perm_x, g);
     assert(o.g.size() > 0);
-    GraphPerm<const graph_t> gy(perm_y, o.g);
+    GraphPerm gy(perm_y, o.g);
 
     // Now perform the widening
     vert_set_t widen_unstable(unstable);
@@ -709,9 +710,9 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
 
     // Build the permuted view of x and y.
     assert(g.size() > 0);
-    GraphPerm<const graph_t> gx(perm_x, g);
+    GraphPerm gx(perm_x, g);
     assert(o.g.size() > 0);
-    GraphPerm<const graph_t> gy(perm_y, o.g);
+    GraphPerm gy(perm_y, o.g);
 
     // Compute the syntactic meet of the permuted graphs.
     bool is_closed;
@@ -726,7 +727,7 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
     }
 
     if (!is_closed) {
-        GrOps::apply_delta(meet_g, GrOps::close_after_meet(SubGraph<graph_t>(meet_g, 0), meet_pi, gx, gy));
+        GrOps::apply_delta(meet_g, GrOps::close_after_meet(SubGraph(meet_g, 0), meet_pi, gx, gy));
 
         // Recover updated LBs and UBs.<
 
@@ -888,7 +889,7 @@ void SplitDBM::assign(variable_t lhs, const linear_expression_t& e) {
         // apply_delta should be safe here, as x has no edges in G.
         GrOps::apply_delta(g, delta);
     }
-    GrOps::apply_delta(g, GrOps::close_after_assign(SubGraph<graph_t>(g, 0), potential, vert));
+    GrOps::apply_delta(g, GrOps::close_after_assign(SubGraph(g, 0), potential, vert));
 
     if (lb_w) {
         g.update_edge(vert, *lb_w, 0);
@@ -937,7 +938,7 @@ void SplitDBM::normalize() {
     edge_vector delta;
     // GrOps::close_after_widen(g, potential, vert_set_wrap_t(unstable), delta);
     // GKG: Check
-    GrOps::apply_delta(g, GrOps::close_after_widen(SubGraph<graph_t>(g, 0), potential, vert_set_wrap_t(unstable)));
+    GrOps::apply_delta(g, GrOps::close_after_widen(SubGraph(g, 0), potential, vert_set_wrap_t(unstable)));
     // Retrieve variable bounds
     GrOps::apply_delta(g, GrOps::close_after_assign(g, potential, 0));
 
@@ -1087,9 +1088,6 @@ static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Weigh
     return elem.str();
 }
 
-static const std::vector<std::string> type_string = {"shared", "stack",  "packet",          "ctx",
-                                                     "number", "map_fd", "map_fd_programs", "uninitialized"};
-
 string_invariant SplitDBM::to_set() const {
     if (this->is_top()) {
         return string_invariant::top();
@@ -1099,8 +1097,8 @@ string_invariant SplitDBM::to_set() const {
     // Intervals
 
     // Extract all the edges
-    SubGraph<const SplitDBM::graph_t> g_excl(this->g, 0);
-    for (SplitDBM::vert_id v : g_excl.verts()) {
+    SubGraph g_excl(this->g, 0);
+    for (vert_id v : g_excl.verts()) {
         if (!this->rev_map[v]) {
             continue;
         }
@@ -1112,28 +1110,20 @@ string_invariant SplitDBM::to_set() const {
                        this->g.elem(0, v) ? number_t(this->g.edge_val(0, v)) : extended_number::plus_infinity());
         assert(!v_out.is_bottom());
 
-        variable_t variable = *(this->rev_map[v]);
+        variable_t variable = *this->rev_map[v];
 
         std::stringstream elem;
         elem << variable;
         if (variable.is_type()) {
-            int lb = (int)v_out.lb().number().value();
-            int ub = (int)v_out.ub().number().value();
+            auto [lb, ub] = v_out.bound(T_MIN, T_MAX);
             if (lb == ub) {
                 if (variable.is_in_stack() && lb == T_NUM) {
                     // no need to show this
                     continue;
                 }
-                elem << "=" << type_string.at(-lb);
+                elem << "=" << lb;
             } else {
-                elem << " in {";
-                for (int type = lb; type <= ub; type++) {
-                    if (type > lb) {
-                        elem << ", ";
-                    }
-                    elem << type_string.at(-type);
-                }
-                elem << "}";
+                elem << " in " << typeset_to_string(iterate_types(lb, ub));
             }
         } else {
             elem << "=";
@@ -1147,12 +1137,12 @@ string_invariant SplitDBM::to_set() const {
     }
 
     std::set<std::tuple<variable_t, variable_t, Weight>> diff_csts;
-    for (SplitDBM::vert_id s : g_excl.verts()) {
+    for (vert_id s : g_excl.verts()) {
         if (!this->rev_map[s]) {
             continue;
         }
         variable_t vs = *this->rev_map[s];
-        for (SplitDBM::vert_id d : g_excl.succs(s)) {
+        for (vert_id d : g_excl.succs(s)) {
             if (!this->rev_map[d]) {
                 continue;
             }
@@ -1237,7 +1227,7 @@ bool SplitDBM::entail(const linear_constraint_t& rhs) const {
     interval_t interval = eval_interval(rhs.expression());
     switch (rhs.kind()) {
     case constraint_kind_t::EQUALS_ZERO:
-        if (interval.singleton() == std::optional<number_t>(number_t(0))) {
+        if (interval.singleton() == std::optional(number_t(0))) {
             return true;
         }
         break;
@@ -1305,9 +1295,9 @@ static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::gr
 }
 
 interval_t SplitDBM::get_interval(variable_t x, int finite_width) const {
-    return crab::domains::get_interval(vert_map, g, x, finite_width);
+    return domains::get_interval(vert_map, g, x, finite_width);
 }
 
-interval_t SplitDBM::operator[](variable_t x) const { return crab::domains::get_interval(vert_map, g, x, 0); }
+interval_t SplitDBM::operator[](variable_t x) const { return domains::get_interval(vert_map, g, x, 0); }
 
 } // namespace crab::domains
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
new file mode 100644
index 000000000..09d3de00f
--- /dev/null
+++ b/src/crab/type_domain.cpp
@@ -0,0 +1,359 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+// ReSharper disable CppMemberFunctionMayBeStatic
+
+// This file is eBPF-specific, not derived from CRAB.
+#include <functional>
+#include <map>
+#include <optional>
+
+#include "crab/array_domain.hpp"
+#include "crab/split_dbm.hpp"
+#include "crab/type_domain.hpp"
+#include "crab/type_encoding.hpp"
+#include "crab/variable.hpp"
+#include "crab_utils/debug.hpp"
+#include "dsl_syntax.hpp"
+
+namespace crab {
+
+static void operator++(type_encoding_t& t) { t = static_cast<type_encoding_t>(1 + static_cast<int>(t)); }
+
+std::vector<type_encoding_t> iterate_types(const type_encoding_t lb, const type_encoding_t ub) {
+    if (lb > ub) {
+        CRAB_ERROR("iterate_types: lower bound ", lb, " is greater than upper bound ", ub);
+    }
+    if (lb < T_MIN || ub > T_MAX) {
+        CRAB_ERROR("iterate_types: bounds ", lb, " and ", ub, " are out of range");
+    }
+    std::vector<type_encoding_t> res;
+    for (type_encoding_t i = lb; i <= ub; ++i) {
+        res.push_back(i);
+    }
+    return res;
+}
+
+static constexpr auto S_UNINIT = "uninit";
+static constexpr auto S_STACK = "stack";
+static constexpr auto S_PACKET = "packet";
+static constexpr auto S_CTX = "ctx";
+static constexpr auto S_MAP_PROGRAMS = "map_fd_programs";
+static constexpr auto S_MAP = "map_fd";
+static constexpr auto S_NUM = "number";
+static constexpr auto S_SHARED = "shared";
+
+std::string name_of(const data_kind_t kind) {
+    switch (kind) {
+    case data_kind_t::ctx_offsets: return "ctx_offset";
+    case data_kind_t::map_fds: return "map_fd";
+    case data_kind_t::packet_offsets: return "packet_offset";
+    case data_kind_t::shared_offsets: return "shared_offset";
+    case data_kind_t::shared_region_sizes: return "shared_region_size";
+    case data_kind_t::stack_numeric_sizes: return "stack_numeric_size";
+    case data_kind_t::stack_offsets: return "stack_offset";
+    case data_kind_t::svalues: return "svalue";
+    case data_kind_t::types: return "type";
+    case data_kind_t::uvalues: return "uvalue";
+    }
+    return {};
+}
+
+data_kind_t regkind(const std::string& s) {
+    static const std::map<std::string, data_kind_t> string_to_kind{
+        {"type", data_kind_t::types},
+        {"ctx_offset", data_kind_t::ctx_offsets},
+        {"map_fd", data_kind_t::map_fds},
+        {"packet_offset", data_kind_t::packet_offsets},
+        {"shared_offset", data_kind_t::shared_offsets},
+        {"stack_offset", data_kind_t::stack_offsets},
+        {"shared_region_size", data_kind_t::shared_region_sizes},
+        {"stack_numeric_size", data_kind_t::stack_numeric_sizes},
+        {"svalue", data_kind_t::svalues},
+        {"uvalue", data_kind_t::uvalues},
+    };
+    if (string_to_kind.contains(s)) {
+        return string_to_kind.at(s);
+    }
+    throw std::runtime_error(std::string() + "Bad kind: " + s);
+}
+
+std::ostream& operator<<(std::ostream& os, const type_encoding_t s) {
+    switch (s) {
+    case T_SHARED: return os << S_SHARED;
+    case T_STACK: return os << S_STACK;
+    case T_PACKET: return os << S_PACKET;
+    case T_CTX: return os << S_CTX;
+    case T_NUM: return os << S_NUM;
+    case T_MAP: return os << S_MAP;
+    case T_MAP_PROGRAMS: return os << S_MAP_PROGRAMS;
+    case T_UNINIT: return os << S_UNINIT;
+    default: CRAB_ERROR("Unsupported type encoding", s);
+    }
+}
+
+type_encoding_t string_to_type_encoding(const std::string& s) {
+    static std::map<std::string, type_encoding_t> string_to_type{
+        {S_UNINIT, T_UNINIT}, {S_MAP_PROGRAMS, T_MAP_PROGRAMS},
+        {S_MAP, T_MAP},       {S_NUM, T_NUM},
+        {S_CTX, T_CTX},       {S_STACK, T_STACK},
+        {S_PACKET, T_PACKET}, {S_SHARED, T_SHARED},
+    };
+    if (string_to_type.contains(s)) {
+        return string_to_type[s];
+    }
+    throw std::runtime_error(std::string("Unsupported type name: ") + s);
+}
+reg_pack_t reg_pack(const int i) {
+    return {
+        variable_t::reg(data_kind_t::svalues, i),
+        variable_t::reg(data_kind_t::uvalues, i),
+        variable_t::reg(data_kind_t::ctx_offsets, i),
+        variable_t::reg(data_kind_t::map_fds, i),
+        variable_t::reg(data_kind_t::packet_offsets, i),
+        variable_t::reg(data_kind_t::shared_offsets, i),
+        variable_t::reg(data_kind_t::stack_offsets, i),
+        variable_t::reg(data_kind_t::types, i),
+        variable_t::reg(data_kind_t::shared_region_sizes, i),
+        variable_t::reg(data_kind_t::stack_numeric_sizes, i),
+    };
+}
+
+void TypeDomain::add_extra_invariant(const NumAbsDomain& dst, std::map<variable_t, interval_t>& extra_invariants,
+                                     const variable_t type_variable, const type_encoding_t type, const data_kind_t kind,
+                                     const NumAbsDomain& src) const {
+    const bool dst_has_type = has_type(dst, type_variable, type);
+    const bool src_has_type = has_type(src, type_variable, type);
+    variable_t v = variable_t::kind_var(kind, type_variable);
+
+    // If type is contained in exactly one of dst or src,
+    // we need to remember the value.
+    if (dst_has_type && !src_has_type) {
+        extra_invariants.emplace(v, dst.eval_interval(v));
+    } else if (!dst_has_type && src_has_type) {
+        extra_invariants.emplace(v, src.eval_interval(v));
+    }
+}
+
+void TypeDomain::selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const {
+    // Some variables are type-specific.  Type-specific variables
+    // for a register can exist in the domain whenever the associated
+    // type value is present in the register's types interval (and the
+    // value is not Top), and are absent otherwise.  That is, we want
+    // to keep track of implications of the form
+    // "if register R has type=T then R.T_offset has value ...".
+    //
+    // If a type value is legal in exactly one of the two domains, a
+    // normal join operation would remove any type-specific variables
+    // from the resulting merged domain since absence from the other
+    // would be interpreted to mean Top.
+    //
+    // However, when the type value is not present in one domain,
+    // any type-specific variables for that type are instead to be
+    // interpreted as Bottom, so we want to preserve the values of any
+    // type-specific variables from the other domain where the type
+    // value is legal.
+    //
+    // Example input:
+    //   r1.type=stack, r1.stack_offset=100
+    //   r1.type=packet, r1.packet_offset=4
+    // Output:
+    //   r1.type={stack,packet}, r1.stack_offset=100, r1.packet_offset=4
+
+    std::map<variable_t, interval_t> extra_invariants;
+    if (!dst.is_bottom()) {
+        for (const variable_t v : variable_t::get_type_variables()) {
+            add_extra_invariant(dst, extra_invariants, v, T_CTX, data_kind_t::ctx_offsets, src);
+            add_extra_invariant(dst, extra_invariants, v, T_MAP, data_kind_t::map_fds, src);
+            add_extra_invariant(dst, extra_invariants, v, T_MAP_PROGRAMS, data_kind_t::map_fds, src);
+            add_extra_invariant(dst, extra_invariants, v, T_PACKET, data_kind_t::packet_offsets, src);
+            add_extra_invariant(dst, extra_invariants, v, T_SHARED, data_kind_t::shared_offsets, src);
+            add_extra_invariant(dst, extra_invariants, v, T_STACK, data_kind_t::stack_offsets, src);
+            add_extra_invariant(dst, extra_invariants, v, T_SHARED, data_kind_t::shared_region_sizes, src);
+            add_extra_invariant(dst, extra_invariants, v, T_STACK, data_kind_t::stack_numeric_sizes, src);
+        }
+    }
+
+    // Do a normal join operation on the domain.
+    dst |= std::move(src);
+
+    // Now add in the extra invariants saved above.
+    for (auto& [variable, interval] : extra_invariants) {
+        dst.set(variable, interval);
+    }
+}
+
+void TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const type_encoding_t t) {
+    inv.assign(reg_pack(lhs).type, t);
+}
+
+void TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const Reg& rhs) {
+    inv.assign(reg_pack(lhs).type, reg_pack(rhs).type);
+}
+
+void TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs, const Reg& rhs) {
+    inv.assign(lhs, reg_pack(rhs).type);
+}
+
+void TypeDomain::assign_type(NumAbsDomain& inv, const std::optional<variable_t> lhs, const number_t& rhs) {
+    inv.assign(lhs, rhs);
+}
+
+void TypeDomain::assign_type(NumAbsDomain& inv, const Reg& lhs, const std::optional<linear_expression_t>& rhs) {
+    inv.assign(reg_pack(lhs).type, rhs);
+}
+
+void TypeDomain::havoc_type(NumAbsDomain& inv, const Reg& r) { inv -= reg_pack(r).type; }
+
+type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const Reg& r) const {
+    const auto res = inv[reg_pack(r).type].singleton();
+    if (!res) {
+        return T_UNINIT;
+    }
+    return static_cast<type_encoding_t>(*res);
+}
+
+type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const variable_t v) const {
+    const auto res = inv[v].singleton();
+    if (!res) {
+        return T_UNINIT;
+    }
+    return static_cast<type_encoding_t>(*res);
+}
+
+type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const number_t& t) const {
+    return static_cast<type_encoding_t>(t);
+}
+
+// Check whether a given type value is within the range of a given type variable's value.
+bool TypeDomain::has_type(const NumAbsDomain& inv, const Reg& r, const type_encoding_t type) const {
+    const interval_t interval = inv[reg_pack(r).type];
+    return interval.contains(type);
+}
+
+bool TypeDomain::has_type(const NumAbsDomain& inv, const variable_t v, const type_encoding_t type) const {
+    const interval_t interval = inv[v];
+    return interval.contains(type);
+}
+
+bool TypeDomain::has_type(const NumAbsDomain& inv, const number_t& t, const type_encoding_t type) const {
+    return t == number_t{type};
+}
+
+NumAbsDomain TypeDomain::join_over_types(const NumAbsDomain& inv, const Reg& reg,
+                                         const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const {
+    interval_t types = inv.eval_interval(reg_pack(reg).type);
+    if (types.is_bottom()) {
+        return NumAbsDomain::bottom();
+    }
+    if (types.is_top()) {
+        NumAbsDomain res(inv);
+        transition(res, T_UNINIT);
+        return res;
+    }
+    NumAbsDomain res = NumAbsDomain::bottom();
+    auto [lb, ub] = types.bound(T_MIN, T_MAX);
+    for (type_encoding_t type : iterate_types(lb, ub)) {
+        NumAbsDomain tmp(inv);
+        transition(tmp, type);
+        selectively_join_based_on_type(res, std::move(tmp)); // res |= tmp;
+    }
+    return res;
+}
+
+NumAbsDomain TypeDomain::join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
+                                         const std::function<void(NumAbsDomain&)>& if_true,
+                                         const std::function<void(NumAbsDomain&)>& if_false) const {
+    NumAbsDomain true_case(inv.when(condition));
+    if_true(true_case);
+
+    NumAbsDomain false_case(inv.when(condition.negate()));
+    if_false(false_case);
+
+    return true_case | false_case;
+}
+
+static linear_constraint_t eq_types(const Reg& a, const Reg& b) {
+    using namespace crab::dsl_syntax;
+    return eq(reg_pack(a).type, reg_pack(b).type);
+}
+
+bool TypeDomain::same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const {
+    return inv.entail(eq_types(a, b));
+}
+
+bool TypeDomain::implies_type(const NumAbsDomain& inv, const linear_constraint_t& a,
+                              const linear_constraint_t& b) const {
+    return inv.when(a).entail(b);
+}
+
+bool TypeDomain::is_in_group(const NumAbsDomain& inv, const Reg& r, const TypeGroup group) const {
+    using namespace crab::dsl_syntax;
+    const variable_t t = reg_pack(r).type;
+    switch (group) {
+    case TypeGroup::number: return inv.entail(t == T_NUM);
+    case TypeGroup::map_fd: return inv.entail(t == T_MAP);
+    case TypeGroup::map_fd_programs: return inv.entail(t == T_MAP_PROGRAMS);
+    case TypeGroup::ctx: return inv.entail(t == T_CTX);
+    case TypeGroup::packet: return inv.entail(t == T_PACKET);
+    case TypeGroup::stack: return inv.entail(t == T_STACK);
+    case TypeGroup::shared: return inv.entail(t == T_SHARED);
+    case TypeGroup::mem: return inv.entail(t >= T_PACKET);
+    case TypeGroup::mem_or_num: return inv.entail(t >= T_NUM) && inv.entail(t != T_CTX);
+    case TypeGroup::pointer: return inv.entail(t >= T_CTX);
+    case TypeGroup::ptr_or_num: return inv.entail(t >= T_NUM);
+    case TypeGroup::stack_or_packet: return inv.entail(t >= T_PACKET) && inv.entail(t <= T_STACK);
+    case TypeGroup::singleton_ptr: return inv.entail(t >= T_CTX) && inv.entail(t <= T_STACK);
+    default: CRAB_ERROR("Unsupported type group", group);
+    }
+}
+
+std::string typeset_to_string(const std::vector<crab::type_encoding_t>& items) {
+    std::stringstream ss;
+    ss << "{";
+    for (auto it = items.begin(); it != items.end(); ++it) {
+        ss << *it;
+        if (std::next(it) != items.end()) {
+            ss << ", ";
+        }
+    }
+    ss << "}";
+    return ss.str();
+}
+
+bool is_singleton_type(const TypeGroup t) {
+    switch (t) {
+    case TypeGroup::number:
+    case TypeGroup::map_fd:
+    case TypeGroup::map_fd_programs:
+    case TypeGroup::ctx:
+    case TypeGroup::packet:
+    case TypeGroup::stack:
+    case TypeGroup::shared: return true;
+    default: return false;
+    }
+}
+
+std::ostream& operator<<(std::ostream& os, const TypeGroup ts) {
+    using namespace crab;
+    static const std::map<TypeGroup, std::string> string_to_type{
+        {TypeGroup::number, S_NUM},
+        {TypeGroup::map_fd, S_MAP},
+        {TypeGroup::map_fd_programs, S_MAP_PROGRAMS},
+        {TypeGroup::ctx, S_CTX},
+        {TypeGroup::packet, S_PACKET},
+        {TypeGroup::stack, S_STACK},
+        {TypeGroup::shared, S_SHARED},
+        {TypeGroup::mem, typeset_to_string({T_STACK, T_PACKET, T_SHARED})},
+        {TypeGroup::pointer, typeset_to_string({T_CTX, T_STACK, T_PACKET, T_SHARED})},
+        {TypeGroup::ptr_or_num, typeset_to_string({T_NUM, T_CTX, T_STACK, T_PACKET, T_SHARED})},
+        {TypeGroup::stack_or_packet, typeset_to_string({T_STACK, T_PACKET})},
+        {TypeGroup::singleton_ptr, typeset_to_string({T_CTX, T_STACK, T_PACKET})},
+        {TypeGroup::mem_or_num, typeset_to_string({T_NUM, T_STACK, T_PACKET, T_SHARED})},
+    };
+    if (string_to_type.contains(ts)) {
+        return os << string_to_type.at(ts);
+    }
+    CRAB_ERROR("Unsupported type group", ts);
+}
+
+} // namespace crab
diff --git a/src/crab/type_domain.hpp b/src/crab/type_domain.hpp
new file mode 100644
index 000000000..8b0b11a78
--- /dev/null
+++ b/src/crab/type_domain.hpp
@@ -0,0 +1,79 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+// This file is eBPF-specific, not derived from CRAB.
+
+#include <functional>
+#include <optional>
+
+#include "crab/array_domain.hpp"
+#include "crab/split_dbm.hpp"
+#include "crab/type_encoding.hpp"
+#include "crab/variable.hpp"
+
+namespace crab {
+
+using domains::NumAbsDomain;
+
+struct reg_pack_t {
+    variable_t svalue; // int64_t value.
+    variable_t uvalue; // uint64_t value.
+    variable_t ctx_offset;
+    variable_t map_fd;
+    variable_t packet_offset;
+    variable_t shared_offset;
+    variable_t stack_offset;
+    variable_t type;
+    variable_t shared_region_size;
+    variable_t stack_numeric_size;
+};
+
+reg_pack_t reg_pack(int i);
+inline reg_pack_t reg_pack(const Reg r) { return reg_pack(r.v); }
+
+struct TypeDomain {
+    void assign_type(NumAbsDomain& inv, const Reg& lhs, type_encoding_t t);
+    void assign_type(NumAbsDomain& inv, const Reg& lhs, const Reg& rhs);
+    void assign_type(NumAbsDomain& inv, const Reg& lhs, const std::optional<linear_expression_t>& rhs);
+    void assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const Reg& rhs);
+    void assign_type(NumAbsDomain& inv, std::optional<variable_t> lhs, const number_t& rhs);
+
+    void havoc_type(NumAbsDomain& inv, const Reg& r);
+
+    [[nodiscard]]
+    type_encoding_t get_type(const NumAbsDomain& inv, variable_t v) const;
+    [[nodiscard]]
+    type_encoding_t get_type(const NumAbsDomain& inv, const Reg& r) const;
+    [[nodiscard]]
+    type_encoding_t get_type(const NumAbsDomain& inv, const number_t& t) const;
+
+    [[nodiscard]]
+    bool has_type(const NumAbsDomain& inv, variable_t v, type_encoding_t type) const;
+    [[nodiscard]]
+    bool has_type(const NumAbsDomain& inv, const Reg& r, type_encoding_t type) const;
+    [[nodiscard]]
+    bool has_type(const NumAbsDomain& inv, const number_t& t, type_encoding_t type) const;
+
+    [[nodiscard]]
+    bool same_type(const NumAbsDomain& inv, const Reg& a, const Reg& b) const;
+    [[nodiscard]]
+    bool implies_type(const NumAbsDomain& inv, const linear_constraint_t& a, const linear_constraint_t& b) const;
+
+    [[nodiscard]]
+    NumAbsDomain join_over_types(const NumAbsDomain& inv, const Reg& reg,
+                                 const std::function<void(NumAbsDomain&, type_encoding_t)>& transition) const;
+    [[nodiscard]]
+    NumAbsDomain join_by_if_else(const NumAbsDomain& inv, const linear_constraint_t& condition,
+                                 const std::function<void(NumAbsDomain&)>& if_true,
+                                 const std::function<void(NumAbsDomain&)>& if_false) const;
+    void selectively_join_based_on_type(NumAbsDomain& dst, NumAbsDomain&& src) const;
+    void add_extra_invariant(const NumAbsDomain& dst, std::map<variable_t, interval_t>& extra_invariants,
+                             variable_t type_variable, type_encoding_t type, data_kind_t kind,
+                             const NumAbsDomain& src) const;
+
+    [[nodiscard]]
+    bool is_in_group(const NumAbsDomain& inv, const Reg& r, TypeGroup group) const;
+};
+
+} // namespace crab
diff --git a/src/crab/type_encoding.hpp b/src/crab/type_encoding.hpp
new file mode 100644
index 000000000..77f3c2be2
--- /dev/null
+++ b/src/crab/type_encoding.hpp
@@ -0,0 +1,67 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <string>
+
+namespace crab {
+
+// data_kind_t is eBPF-specific.
+enum class data_kind_t {
+    types,
+    svalues,
+    uvalues,
+    ctx_offsets,
+    map_fds,
+    packet_offsets,
+    shared_offsets,
+    stack_offsets,
+    shared_region_sizes,
+    stack_numeric_sizes
+};
+
+std::string name_of(data_kind_t kind);
+data_kind_t regkind(const std::string& s);
+std::ostream& operator<<(std::ostream& o, const data_kind_t& s);
+
+// The exact numbers are taken advantage of in ebpf_domain_t
+enum type_encoding_t {
+    T_UNINIT = -7,
+    T_MAP_PROGRAMS = -6,
+    T_MAP = -5,
+    T_NUM = -4,
+    T_CTX = -3,
+    T_PACKET = -2,
+    T_STACK = -1,
+    T_SHARED = 0
+};
+
+constexpr type_encoding_t T_MIN = T_MAP_PROGRAMS;
+constexpr type_encoding_t T_MAX = T_SHARED;
+
+std::vector<type_encoding_t> iterate_types(type_encoding_t lb, type_encoding_t ub);
+std::string typeset_to_string(const std::vector<type_encoding_t>& items);
+
+std::ostream& operator<<(std::ostream& os, type_encoding_t s);
+type_encoding_t string_to_type_encoding(const std::string& s);
+
+enum class TypeGroup {
+    number,
+    map_fd,
+    ctx,             ///< pointer to the special memory region named 'ctx'
+    packet,          ///< pointer to the packet
+    stack,           ///< pointer to the stack
+    shared,          ///< pointer to shared memory
+    map_fd_programs, ///< reg == T_MAP_PROGRAMS
+    mem,             ///< shared | stack | packet = reg >= T_PACKET
+    mem_or_num,      ///< reg >= T_NUM && reg != T_CTX
+    pointer,         ///< reg >= T_CTX
+    ptr_or_num,      ///< reg >= T_NUM
+    stack_or_packet, ///< reg <= T_STACK && reg >= T_PACKET
+    singleton_ptr,   ///< reg <= T_STACK && reg >= T_CTX
+};
+
+bool is_singleton_type(TypeGroup t);
+std::ostream& operator<<(std::ostream& os, TypeGroup ts);
+} // namespace crab
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index 6f05c9e19..d4fc83c56 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -141,29 +141,14 @@ thread_local lazy_allocator<std::vector<std::string>, default_variable_names> va
 
 void variable_t::clear_thread_local_state() { names.clear(); }
 
-static std::string name_of(data_kind_t kind) {
-    switch (kind) {
-    case data_kind_t::ctx_offsets: return "ctx_offset";
-    case data_kind_t::map_fds: return "map_fd";
-    case data_kind_t::packet_offsets: return "packet_offset";
-    case data_kind_t::shared_offsets: return "shared_offset";
-    case data_kind_t::shared_region_sizes: return "shared_region_size";
-    case data_kind_t::stack_numeric_sizes: return "stack_numeric_size";
-    case data_kind_t::stack_offsets: return "stack_offset";
-    case data_kind_t::svalues: return "svalue";
-    case data_kind_t::types: return "type";
-    case data_kind_t::uvalues: return "uvalue";
-    }
-    return {};
-}
-
 variable_t variable_t::reg(data_kind_t kind, int i) { return make("r" + std::to_string(i) + "." + name_of(kind)); }
 
 std::ostream& operator<<(std::ostream& o, const data_kind_t& s) { return o << name_of(s); }
 
 static std::string mk_scalar_name(data_kind_t kind, const number_t& o, const number_t& size) {
     std::stringstream os;
-    os << "s" << "[" << o;
+    os << "s"
+       << "[" << o;
     if (size != 1) {
         os << "..." << o + size - 1;
     }
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 4b64c2e63..bf768e629 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -7,30 +7,16 @@
 #include <memory>
 #include <vector>
 
-#include "crab/variable.hpp"
+#include "crab/type_encoding.hpp"
 #include "crab_utils/lazy_allocator.hpp"
 #include "crab_utils/num_big.hpp"
+
 using index_t = uint64_t;
 
 /* Basic type definitions */
 
 namespace crab {
 
-// data_kind_t is eBPF-specific.
-enum class data_kind_t {
-    types,
-    svalues,
-    uvalues,
-    ctx_offsets,
-    map_fds,
-    packet_offsets,
-    shared_offsets,
-    stack_offsets,
-    shared_region_sizes,
-    stack_numeric_sizes
-};
-std::ostream& operator<<(std::ostream& o, const data_kind_t& s);
-
 std::vector<std::string> default_variable_names();
 
 // Wrapper for typed variables used by the crab abstract domains and linear_constraints.
diff --git a/src/crab/wto.cpp b/src/crab/wto.cpp
index 0baf28685..eb6577b03 100644
--- a/src/crab/wto.cpp
+++ b/src/crab/wto.cpp
@@ -41,7 +41,7 @@ struct visit_args_t {
     std::weak_ptr<wto_cycle_t> containing_cycle;
 
     visit_args_t(const visit_task_type_t t, label_t v, wto_partition_t& p, std::weak_ptr<wto_cycle_t> cc)
-        : type(t), vertex(std::move(v)), partition(p), containing_cycle(std::move(cc)){};
+        : type(t), vertex(std::move(v)), partition(p), containing_cycle(std::move(cc)) {};
 };
 
 struct wto_vertex_data_t {
diff --git a/src/crab_utils/heap.hpp b/src/crab_utils/heap.hpp
index c95cbf1f5..c9df640b5 100644
--- a/src/crab_utils/heap.hpp
+++ b/src/crab_utils/heap.hpp
@@ -55,7 +55,7 @@ class Heap {
         while (left(i) < size) {
             int ri = right(i);
             int li = left(i);
-            const int child = static_cast<size_t>(ri) < size && lt(heap[ri], heap[li]) ? ri : li;
+            const int child = ri < size && lt(heap[ri], heap[li]) ? ri : li;
             if (!lt(heap[child], x)) {
                 break;
             }
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index e57232c6b..ae9e6220c 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -38,6 +38,11 @@ class number_t final {
         return static_cast<T>(_n);
     }
 
+    template <is_enum T>
+    explicit operator T() const {
+        return static_cast<T>(static_cast<std::underlying_type_t<T>>(_n));
+    }
+
     template <is_enum T>
     T cast_to() const {
         return static_cast<T>(static_cast<std::underlying_type_t<T>>(_n));
diff --git a/src/string_constraints.hpp b/src/string_constraints.hpp
index 273a772c9..c3192081f 100644
--- a/src/string_constraints.hpp
+++ b/src/string_constraints.hpp
@@ -11,28 +11,12 @@
 #include "crab/interval.hpp"
 #include "crab/linear_constraint.hpp"
 
-// These constants are mostly used in ebpf_domain.cpp, but some uses
-// in split_dbm.cpp and array_domain.cpp require them to be declared here.
-// The exact numbers are taken advantage of in ebpf_domain_t
-enum type_encoding_t {
-    T_UNINIT = -7,
-    T_MAP_PROGRAMS = -6,
-    T_MAP = -5,
-    T_NUM = -4,
-    T_CTX = -3,
-    T_PACKET = -2,
-    T_STACK = -1,
-    T_SHARED = 0
-};
-constexpr type_encoding_t T_MIN = T_MAP_PROGRAMS;
-constexpr type_encoding_t T_MAX = T_SHARED;
-
 struct string_invariant {
     std::optional<std::set<std::string>> maybe_inv{};
 
     string_invariant() = default;
 
-    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)){};
+    explicit string_invariant(std::set<std::string> inv) : maybe_inv(std::move(inv)) {};
 
     string_invariant(const string_invariant& inv) = default;
     string_invariant& operator=(const string_invariant& inv) = default;
@@ -64,7 +48,7 @@ struct string_invariant {
 
     [[nodiscard]]
     bool contains(const std::string& item) const {
-        return !is_bottom() && maybe_inv.value().count(item);
+        return maybe_inv.value().contains(item);
     }
 
     friend std::ostream& operator<<(std::ostream&, const string_invariant& inv);
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 810ea82f8..7c42f219b 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -76,9 +76,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true);    \
     }
 
-#define TEST_PROGRAM_REJECT(project, filename, section_name, program_name) \
+#define TEST_PROGRAM_REJECT(project, filename, section_name, program_name)                                       \
     TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
-        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false);    \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false);   \
     }
 
 #define TEST_SECTION_REJECT(project, filename, section)                                                     \
@@ -503,7 +503,7 @@ TEST_SECTION("raw_tracepoint/filler/proc_startupdate_2")
 TEST_SECTION("raw_tracepoint/filler/sys_recvfrom_x")
 */
 TEST_PROGRAM_REJECT("build", "bpf2bpf.o", ".text", "plus1"); // Subprogram will fail verification.
-TEST_PROGRAM("build", "bpf2bpf.o", ".text", "func"); // Subprogram can be called from main program.
+TEST_PROGRAM("build", "bpf2bpf.o", ".text", "func");         // Subprogram can be called from main program.
 TEST_SECTION("build", "byteswap.o", ".text")
 TEST_SECTION("build", "stackok.o", ".text")
 TEST_SECTION("build", "packet_start_ok.o", "xdp")
diff --git a/test-data/jump.yaml b/test-data/jump.yaml
index 940b70179..edc063911 100644
--- a/test-data/jump.yaml
+++ b/test-data/jump.yaml
@@ -714,4 +714,4 @@ post:
   - r1.map_fd-r2.map_fd<=-1
 
 messages:
-  - "0: Invalid type (r1.type == non_map_fd)"
+  - "0: Invalid type (r1.type in {number, ctx, stack, packet, shared})"

From 6842a10fab0140abd9c4ccbcd9377c3bf52943d0 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 18:17:35 +0300
Subject: [PATCH 262/373] shorten test names

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/test/test_verify.cpp | 52 +++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 27 deletions(-)

diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 7c42f219b..be7fa62b2 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -66,49 +66,47 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         }                                                                                                 \
     } while (0)
 
-#define TEST_SECTION(project, filename, section)                                                            \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true);                  \
+#define TEST_SECTION(project, filename, section)                                           \
+    TEST_CASE(project "/" filename " " section, "[verify][samples][" project "]") {        \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
     }
 
-#define TEST_PROGRAM(project, filename, section_name, program_name)                                              \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
-        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true);    \
+#define TEST_PROGRAM(project, filename, section_name, program_name)                                           \
+    TEST_CASE(project "/" filename " " program_name, "[verify][samples][" project "]") {                      \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true); \
     }
 
-#define TEST_PROGRAM_REJECT(project, filename, section_name, program_name)                                       \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " program_name, "[verify][samples][" project "]") { \
-        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false);   \
+#define TEST_PROGRAM_REJECT(project, filename, section_name, program_name)                                     \
+    TEST_CASE(project "/" filename " " program_name, "[verify][samples][" project "]") {                       \
+        VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false); \
     }
 
-#define TEST_SECTION_REJECT(project, filename, section)                                                     \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                 \
+#define TEST_SECTION_REJECT(project, filename, section)                                     \
+    TEST_CASE(project "/" filename " " section, "[verify][samples][" project "]") {         \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
     }
 
-#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section)                                           \
-    TEST_CASE("./check ebpf-samples/" project "/" filename " " section, "[verify][samples][" project "]") { \
-        ebpf_verifier_options_t options = ebpf_verifier_default_options;                                    \
-        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);                 \
-        options.strict = true;                                                                              \
-        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                \
+#define TEST_SECTION_REJECT_IF_STRICT(project, filename, section)                            \
+    TEST_CASE(project "/" filename " " section, "[verify][samples][" project "]") {          \
+        ebpf_verifier_options_t options = ebpf_verifier_default_options;                     \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);  \
+        options.strict = true;                                                               \
+        VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false); \
     }
 
-#define TEST_SECTION_FAIL(project, filename, section)                                      \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section,             \
-              "[!shouldfail][verify][samples][" project "]") {                             \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true); \
+#define TEST_SECTION_FAIL(project, filename, section)                                                              \
+    TEST_CASE("expect failure " project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true);                         \
     }
 
-#define TEST_SECTION_REJECT_FAIL(project, filename, section)                                \
-    TEST_CASE("expect failure ebpf-samples/" project "/" filename " " section,              \
-              "[!shouldfail][verify][samples][" project "]") {                              \
-        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false); \
+#define TEST_SECTION_REJECT_FAIL(project, filename, section)                                                       \
+    TEST_CASE("expect failure " project "/" filename " " section, "[!shouldfail][verify][samples][" project "]") { \
+        VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                        \
     }
 
 #define TEST_SECTION_LEGACY(dirname, filename, sectionname)                                               \
     TEST_SECTION(dirname, filename, sectionname)                                                          \
-    TEST_CASE("Try unmarshalling bad program: " dirname "/" filename " " sectionname, "[unmarshal]") {    \
+    TEST_CASE("Fail unmarshalling: " dirname "/" filename " " sectionname, "[unmarshal]") {               \
         ebpf_platform_t platform = g_ebpf_platform_linux;                                                 \
         platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet;                       \
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, &platform); \

From 17f2bb956a0012dae0d4082b0801d6eddfe50ade Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 20:03:22 +0300
Subject: [PATCH 263/373] use get_if instead of holds_alternative to avoid
 repetition

also some more modernization

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_cfg.cpp           |  77 ++++++++++---------
 src/asm_marshal.cpp       |  20 ++---
 src/asm_ostream.cpp       |  43 +++++------
 src/asm_ostream.hpp       |   6 +-
 src/asm_unmarshal.cpp     | 151 +++++++++++++++++++-------------------
 src/assertions.cpp        |  89 +++++++++++-----------
 src/crab/cfg.hpp          |   2 +-
 src/crab/ebpf_domain.cpp  |  69 ++++++++---------
 src/crab/fwd_analyzer.cpp |  18 +++--
 src/ebpf_yaml.cpp         |   4 +-
 src/main/check.cpp        |   4 +-
 src/test/test_marshal.cpp |  26 +++----
 src/test/test_print.cpp   |   6 +-
 src/test/test_verify.cpp  |  32 ++++----
 14 files changed, 268 insertions(+), 279 deletions(-)

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index d922c33b3..37afdbf29 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -11,7 +11,6 @@
 
 #include "asm_syntax.hpp"
 #include "crab/cfg.hpp"
-#include "crab_utils/debug.hpp"
 
 using std::optional;
 using std::set;
@@ -20,19 +19,21 @@ using std::to_string;
 using std::vector;
 
 static optional<label_t> get_jump(Instruction ins) {
-    if (std::holds_alternative<Jmp>(ins)) {
-        return std::get<Jmp>(ins).target;
+    if (const auto pins = std::get_if<Jmp>(&ins)) {
+        return pins->target;
     }
     return {};
 }
 
-static bool has_fall(Instruction ins) {
+static bool has_fall(const Instruction& ins) {
     if (std::holds_alternative<Exit>(ins)) {
         return false;
     }
 
-    if (std::holds_alternative<Jmp>(ins) && !std::get<Jmp>(ins).cond) {
-        return false;
+    if (const auto pins = std::get_if<Jmp>(&ins)) {
+        if (!pins->cond) {
+            return false;
+        }
     }
 
     return true;
@@ -51,8 +52,8 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
     basic_block_t& caller_node = cfg.get_node(caller_label);
     std::string stack_frame_prefix = to_string(caller_label);
     for (auto& inst : caller_node) {
-        if (std::holds_alternative<CallLocal>(inst)) {
-            std::get<CallLocal>(inst).stack_frame_prefix = stack_frame_prefix;
+        if (const auto pcall = std::get_if<CallLocal>(&inst)) {
+            pcall->stack_frame_prefix = stack_frame_prefix;
         }
     }
 
@@ -72,10 +73,10 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
         const label_t label(macro_label.from, macro_label.to, stack_frame_prefix);
         auto& bb = cfg.insert(label);
         for (auto inst : cfg.get_node(macro_label)) {
-            if (std::holds_alternative<Exit>(inst)) {
-                std::get<Exit>(inst).stack_frame_prefix = label.stack_frame_prefix;
-            } else if (std::holds_alternative<Call>(inst)) {
-                std::get<Call>(inst).stack_frame_prefix = label.stack_frame_prefix;
+            if (const auto pins = std::get_if<Exit>(&inst)) {
+                pins->stack_frame_prefix = label.stack_frame_prefix;
+            } else if (const auto pins = std::get_if<Call>(&inst)) {
+                pins->stack_frame_prefix = label.stack_frame_prefix;
             }
             bb.insert(inst);
         }
@@ -121,18 +122,18 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
     for (auto& macro_label : seen_labels) {
         for (const label_t label(macro_label.from, macro_label.to, caller_label_str);
              const auto& inst : cfg.get_node(label)) {
-            if (std::holds_alternative<CallLocal>(inst)) {
+            if (const auto pins = std::get_if<CallLocal>(&inst)) {
                 if (stack_frame_depth >= MAX_CALL_STACK_FRAMES) {
                     throw std::runtime_error{"too many call stack frames"};
                 }
-                add_cfg_nodes(cfg, label, std::get<CallLocal>(inst).target);
+                add_cfg_nodes(cfg, label, pins->target);
             }
         }
     }
 }
 
 /// Convert an instruction sequence to a control-flow graph (CFG).
-static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_exit) {
+static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, const bool must_have_exit) {
     cfg_t cfg;
     std::optional<label_t> falling_from = {};
     bool first = true;
@@ -159,8 +160,7 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
         if (has_fall(inst)) {
             falling_from = label;
         }
-        auto jump_target = get_jump(inst);
-        if (jump_target) {
+        if (auto jump_target = get_jump(inst)) {
             bb >> cfg.insert(*jump_target);
         }
 
@@ -180,8 +180,8 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
     // we only add new nodes that are actually reachable, based on the
     // results of the first pass.
     for (auto& [label, inst, _] : insts) {
-        if (std::holds_alternative<CallLocal>(inst)) {
-            add_cfg_nodes(cfg, label, std::get<CallLocal>(inst).target);
+        if (const auto pins = std::get_if<CallLocal>(&inst)) {
+            add_cfg_nodes(cfg, label, pins->target);
         }
     }
 
@@ -189,7 +189,7 @@ static cfg_t instruction_seq_to_cfg(const InstructionSeq& insts, bool must_have_
 }
 
 /// Get the inverse of a given comparison operation.
-static Condition::Op reverse(Condition::Op op) {
+static Condition::Op reverse(const Condition::Op op) {
     switch (op) {
     case Condition::Op::EQ: return Condition::Op::NE;
     case Condition::Op::NE: return Condition::Op::EQ;
@@ -214,7 +214,7 @@ static Condition::Op reverse(Condition::Op op) {
 }
 
 /// Get the inverse of a given comparison condition.
-static Condition reverse(Condition cond) {
+static Condition reverse(const Condition& cond) {
     return {.op = reverse(cond.op), .left = cond.left, .right = cond.right, .is64 = cond.is64};
 }
 
@@ -274,31 +274,30 @@ static cfg_t to_nondet(const cfg_t& cfg) {
     return res;
 }
 
-/// Get the type of a given instruction.
+/// Get the type of given instruction.
 /// Most of these type names are also statistics header labels.
 static std::string instype(Instruction ins) {
-    if (std::holds_alternative<Call>(ins)) {
-        auto call = std::get<Call>(ins);
-        if (call.is_map_lookup) {
+    if (const auto pcall = std::get_if<Call>(&ins)) {
+        if (pcall->is_map_lookup) {
             return "call_1";
         }
-        if (call.pairs.empty()) {
-            if (std::all_of(call.singles.begin(), call.singles.end(),
-                            [](ArgSingle kr) { return kr.kind == ArgSingle::Kind::ANYTHING; })) {
+        if (pcall->pairs.empty()) {
+            if (std::ranges::all_of(pcall->singles,
+                                    [](const ArgSingle kr) { return kr.kind == ArgSingle::Kind::ANYTHING; })) {
                 return "call_nomem";
             }
         }
         return "call_mem";
     } else if (std::holds_alternative<Callx>(ins)) {
         return "callx";
-    } else if (std::holds_alternative<Mem>(ins)) {
-        return std::get<Mem>(ins).is_load ? "load" : "store";
+    } else if (const auto pimm = std::get_if<Mem>(&ins)) {
+        return pimm->is_load ? "load" : "store";
     } else if (std::holds_alternative<Atomic>(ins)) {
         return "load_store";
     } else if (std::holds_alternative<Packet>(ins)) {
         return "packet_access";
-    } else if (std::holds_alternative<Bin>(ins)) {
-        switch (std::get<Bin>(ins).op) {
+    } else if (const auto pins = std::get_if<Bin>(&ins)) {
+        switch (pins->op) {
         case Bin::Op::MOV:
         case Bin::Op::MOVSX8:
         case Bin::Op::MOVSX16:
@@ -334,20 +333,18 @@ std::map<std::string, int> collect_stats(const cfg_t& cfg) {
         basic_block_t const& bb = cfg.get_node(this_label);
 
         for (Instruction ins : bb) {
-            if (std::holds_alternative<LoadMapFd>(ins)) {
-                if (std::get<LoadMapFd>(ins).mapfd == -1) {
+            if (const auto pins = std::get_if<LoadMapFd>(&ins)) {
+                if (pins->mapfd == -1) {
                     res["map_in_map"] = 1;
                 }
             }
-            if (std::holds_alternative<Call>(ins)) {
-                auto call = std::get<Call>(ins);
-                if (call.reallocate_packet) {
+            if (const auto pins = std::get_if<Call>(&ins)) {
+                if (pins->reallocate_packet) {
                     res["reallocate"] = 1;
                 }
             }
-            if (std::holds_alternative<Bin>(ins)) {
-                auto const& bin = std::get<Bin>(ins);
-                res[bin.is64 ? "arith64" : "arith32"]++;
+            if (const auto pins = std::get_if<Bin>(&ins)) {
+                res[pins->is64 ? "arith64" : "arith32"]++;
             }
             res[instype(ins)]++;
         }
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 987b3423f..5e8854474 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -109,8 +109,9 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Bin const& b) {
         if (b.lddw) {
-            assert(std::holds_alternative<Imm>(b.v));
-            auto [imm, next_imm] = split(std::get<Imm>(b.v).v);
+            const auto pimm = std::get_if<Imm>(&b.v);
+            assert(pimm != nullptr);
+            auto [imm, next_imm] = split(pimm->v);
             return makeLddw(b.dst, false, imm, next_imm);
         }
 
@@ -248,9 +249,9 @@ struct MarshalVisitor {
         } else {
             res.opcode |= INST_CLS_ST;
             res.dst = access.basereg.v;
-            if (std::holds_alternative<Reg>(b.value)) {
+            if (const auto preg = std::get_if<Reg>(&b.value)) {
                 res.opcode |= 0x1;
-                res.src = std::get<Reg>(b.value).v;
+                res.src = preg->v;
             } else {
                 res.opcode |= 0x0;
                 res.imm = static_cast<int32_t>(std::get<Imm>(b.value).v);
@@ -308,9 +309,9 @@ vector<ebpf_inst> marshal(const vector<Instruction>& insts) {
     return res;
 }
 
-static int size(Instruction inst) {
-    if (std::holds_alternative<Bin>(inst)) {
-        if (std::get<Bin>(inst).lddw) {
+static int size(const Instruction& inst) {
+    if (const auto pins = std::get_if<Bin>(&inst)) {
+        if (pins->lddw) {
             return 2;
         }
     }
@@ -336,9 +337,8 @@ vector<ebpf_inst> marshal(const InstructionSeq& insts) {
     pc_t pc = 0;
     for (auto [label, ins, _] : insts) {
         (void)label; // unused
-        if (std::holds_alternative<Jmp>(ins)) {
-            Jmp& jmp = std::get<Jmp>(ins);
-            jmp.target = label_t(pc_of_label.at(jmp.target));
+        if (const auto pins = std::get_if<Jmp>(&ins)) {
+            pins->target = label_t(pc_of_label.at(pins->target));
         }
         for (auto e : marshal(ins, pc)) {
             pc++;
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 682dba033..e2e9f3169 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -120,7 +120,7 @@ std::ostream& operator<<(std::ostream& os, ValidAccess const& a) {
         os << a.offset;
     }
 
-    if (a.width == (Value)Imm{0}) {
+    if (a.width == static_cast<Value>(Imm{0})) {
         // a.width == 0, meaning we only care it's an in-bound pointer,
         // so it can be compared with another pointer to the same region.
         os << ") for comparison/subtraction";
@@ -138,12 +138,12 @@ std::ostream& operator<<(std::ostream& os, ValidAccess const& a) {
 static crab::variable_t typereg(const Reg& r) { return crab::variable_t::reg(crab::data_kind_t::types, r.v); }
 
 std::ostream& operator<<(std::ostream& os, ValidSize const& a) {
-    auto op = a.can_be_zero ? " >= " : " > ";
+    const auto op = a.can_be_zero ? " >= " : " > ";
     return os << a.reg << ".value" << op << 0;
 }
 
 std::ostream& operator<<(std::ostream& os, ValidCall const& a) {
-    EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(a.func);
+    const EbpfHelperPrototype proto = global_program_info->platform->get_helper_prototype(a.func);
     return os << "valid call(" << proto.name << ")";
 }
 
@@ -224,8 +224,7 @@ struct InstructionPrinterVisitor {
         os_ << "r0 = " << call.name << ":" << call.func << "(";
         for (uint8_t r = 1; r <= 5; r++) {
             // Look for a singleton.
-            std::vector<ArgSingle>::const_iterator single =
-                std::find_if(call.singles.begin(), call.singles.end(), [r](ArgSingle arg) { return arg.reg.v == r; });
+            auto single = std::ranges::find_if(call.singles, [r](ArgSingle arg) { return arg.reg.v == r; });
             if (single != call.singles.end()) {
                 if (r > 1) {
                     os_ << ", ";
@@ -235,8 +234,7 @@ struct InstructionPrinterVisitor {
             }
 
             // Look for the start of a pair.
-            std::vector<ArgPair>::const_iterator pair =
-                std::find_if(call.pairs.begin(), call.pairs.end(), [r](ArgPair arg) { return arg.mem.v == r; });
+            auto pair = std::ranges::find_if(call.pairs, [r](ArgPair arg) { return arg.mem.v == r; });
             if (pair != call.pairs.end()) {
                 if (r > 1) {
                     os_ << ", ";
@@ -270,8 +268,8 @@ struct InstructionPrinterVisitor {
     }
 
     void operator()(Jmp const& b, int offset) {
-        string sign = offset > 0 ? "+" : "";
-        string target = sign + std::to_string(offset) + " <" + to_string(b.target) + ">";
+        const string sign = offset > 0 ? "+" : "";
+        const string target = sign + std::to_string(offset) + " <" + to_string(b.target) + ">";
 
         if (b.cond) {
             os_ << "if ";
@@ -284,7 +282,7 @@ struct InstructionPrinterVisitor {
     void operator()(Packet const& b) {
         /* Direct packet access, R0 = *(uint *) (skb->data + imm32) */
         /* Indirect packet access, R0 = *(uint *) (skb->data + src_reg + imm32) */
-        string s = size(b.width);
+        const string s = size(b.width);
         os_ << "r0 = ";
         os_ << "*(" << s << " *)skb[";
         if (b.regoffset) {
@@ -300,7 +298,7 @@ struct InstructionPrinterVisitor {
     }
 
     void print(Deref const& access) {
-        string sign = access.offset < 0 ? " - " : " + ";
+        const string sign = access.offset < 0 ? " - " : " + ";
         int offset = std::abs(access.offset); // what about INT_MIN?
         os_ << "*(" << size(access.width) << " *)";
         os_ << "(" << access.basereg << sign << offset << ")";
@@ -379,9 +377,9 @@ string to_string(AssertionConstraint const& constraint) {
     return str.str();
 }
 
-int size(Instruction inst) {
-    if (std::holds_alternative<Bin>(inst)) {
-        if (std::get<Bin>(inst).lddw) {
+int size(const Instruction& inst) {
+    if (const auto bin = std::get_if<Bin>(&inst)) {
+        if (bin->lddw) {
             return 2;
         }
     }
@@ -401,9 +399,9 @@ auto get_labels(const InstructionSeq& insts) {
     return pc_of_label;
 }
 
-void print(const InstructionSeq& insts, std::ostream& out, std::optional<const label_t> label_to_print,
+void print(const InstructionSeq& insts, std::ostream& out, const std::optional<const label_t>& label_to_print,
            bool print_line_info) {
-    auto pc_of_label = get_labels(insts);
+    const auto pc_of_label = get_labels(insts);
     pc_t pc = 0;
     std::string previous_source;
     InstructionPrinterVisitor visitor{out};
@@ -427,13 +425,12 @@ void print(const InstructionSeq& insts, std::ostream& out, std::optional<const l
             } else {
                 out << std::setw(8) << pc << ":\t";
             }
-            if (std::holds_alternative<Jmp>(ins)) {
-                auto const& jmp = std::get<Jmp>(ins);
-                if (pc_of_label.count(jmp.target) == 0) {
-                    throw std::runtime_error(string("Cannot find label ") + to_string(jmp.target));
+            if (const auto jmp = std::get_if<Jmp>(&ins)) {
+                if (!pc_of_label.contains(jmp->target)) {
+                    throw std::runtime_error(string("Cannot find label ") + to_string(jmp->target));
                 }
-                pc_t target_pc = pc_of_label.at(jmp.target);
-                visitor(jmp, target_pc - (int)pc - 1);
+                const pc_t target_pc = pc_of_label.at(jmp->target);
+                visitor(*jmp, target_pc - static_cast<int>(pc) - 1);
             } else {
                 std::visit(visitor, ins);
             }
@@ -498,7 +495,7 @@ std::ostream& operator<<(std::ostream& o, const basic_block_t& bb) {
     if (it != et) {
         o << "  "
           << "goto ";
-        for (; it != et;) {
+        while (it != et) {
             o << *it;
             ++it;
             if (it == et) {
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index ae55a6e9c..db8f998a7 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -29,7 +29,7 @@ inline std::function<int32_t(label_t)> label_to_offset32(pc_t pc) {
 
 std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info);
 
-void print(const InstructionSeq& insts, std::ostream& out, std::optional<const label_t> label_to_print,
+void print(const InstructionSeq& insts, std::ostream& out, const std::optional<const label_t>& label_to_print,
            bool print_line_info = false);
 
 std::string to_string(label_t const& label);
@@ -43,8 +43,8 @@ std::ostream& operator<<(std::ostream& os, Condition::Op op);
 inline std::ostream& operator<<(std::ostream& os, Imm imm) { return os << (int64_t)imm.v; }
 inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << (int)a.v; }
 inline std::ostream& operator<<(std::ostream& os, Value const& a) {
-    if (std::holds_alternative<Imm>(a)) {
-        return os << std::get<Imm>(a);
+    if (auto pa = std::get_if<Imm>(&a)) {
+        return os << *pa;
     }
     return os << std::get<Reg>(a);
 }
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index dc9457d43..e319b3e3f 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -5,14 +5,13 @@
 #include <string>
 #include <vector>
 
-#include "ebpf_vm_isa.hpp"
-
 #include "asm_unmarshal.hpp"
+#include "ebpf_vm_isa.hpp"
 
 using std::string;
 using std::vector;
 
-int opcode_to_width(uint8_t opcode) {
+int opcode_to_width(const uint8_t opcode) {
     switch (opcode & INST_SIZE_MASK) {
     case INST_SIZE_B: return 1;
     case INST_SIZE_H: return 2;
@@ -23,7 +22,7 @@ int opcode_to_width(uint8_t opcode) {
     return {};
 }
 
-uint8_t width_to_opcode(int width) {
+uint8_t width_to_opcode(const int width) {
     switch (width) {
     case 1: return INST_SIZE_B;
     case 2: return INST_SIZE_H;
@@ -37,21 +36,22 @@ uint8_t width_to_opcode(int width) {
 template <typename T>
 void compare(const string& field, T actual, T expected) {
     if (actual != expected) {
-        std::cerr << field << ": (actual) " << std::hex << (int)actual << " != " << (int)expected << " (expected)\n";
+        std::cerr << field << ": (actual) " << std::hex << static_cast<int>(actual)
+                  << " != " << static_cast<int>(expected) << " (expected)\n";
     }
 }
 
-static std::string make_opcode_message(const char* msg, uint8_t opcode) {
+static std::string make_opcode_message(const char* msg, const uint8_t opcode) {
     std::ostringstream oss;
-    oss << msg << " op 0x" << std::hex << (int)opcode;
+    oss << msg << " op 0x" << std::hex << static_cast<int>(opcode);
     return oss.str();
 }
 
 struct InvalidInstruction : std::invalid_argument {
     size_t pc;
-    explicit InvalidInstruction(size_t pc, const char* what) : std::invalid_argument{what}, pc{pc} {}
-    InvalidInstruction(size_t pc, std::string what) : std::invalid_argument{what}, pc{pc} {}
-    InvalidInstruction(size_t pc, uint8_t opcode)
+    explicit InvalidInstruction(const size_t pc, const char* what) : std::invalid_argument{what}, pc{pc} {}
+    InvalidInstruction(const size_t pc, const std::string& what) : std::invalid_argument{what}, pc{pc} {}
+    InvalidInstruction(const size_t pc, const uint8_t opcode)
         : std::invalid_argument{make_opcode_message("bad instruction", opcode)}, pc{pc} {}
 };
 
@@ -59,7 +59,7 @@ struct UnsupportedMemoryMode : std::invalid_argument {
     explicit UnsupportedMemoryMode(const char* what) : std::invalid_argument{what} {}
 };
 
-static auto getMemIsLoad(uint8_t opcode) -> bool {
+static auto getMemIsLoad(const uint8_t opcode) -> bool {
     switch (opcode & INST_CLS_MASK) {
     case INST_CLS_LD:
     case INST_CLS_LDX: return true;
@@ -69,7 +69,7 @@ static auto getMemIsLoad(uint8_t opcode) -> bool {
     return {};
 }
 
-static auto getMemWidth(uint8_t opcode) -> int {
+static auto getMemWidth(const uint8_t opcode) -> int {
     switch (opcode & INST_SIZE_MASK) {
     case INST_SIZE_B: return 1;
     case INST_SIZE_H: return 2;
@@ -89,8 +89,8 @@ static auto getMemWidth(uint8_t opcode) -> int {
 //     return {};
 // }
 
-static Instruction shift32(Reg dst, Bin::Op op) {
-    return (Instruction)Bin{.op = op, .dst = dst, .v = Imm{32}, .is64 = true, .lddw = false};
+static Instruction shift32(const Reg dst, const Bin::Op op) {
+    return Bin{.op = op, .dst = dst, .v = Imm{32}, .is64 = true, .lddw = false};
 }
 
 struct Unmarshaller {
@@ -102,9 +102,9 @@ struct Unmarshaller {
         note_next_pc();
     }
 
-    auto getAluOp(size_t pc, ebpf_inst inst) -> std::variant<Bin::Op, Un::Op> {
+    auto getAluOp(const size_t pc, const ebpf_inst inst) -> std::variant<Bin::Op, Un::Op> {
         // First handle instructions that support a non-zero offset.
-        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
+        const bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
         switch (inst.opcode & INST_ALU_OP_MASK) {
         case INST_ALU_OP_DIV:
             if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::divmul64
@@ -226,9 +226,8 @@ struct Unmarshaller {
         return {};
     }
 
-    auto getAtomicOp(size_t pc, ebpf_inst inst) -> Atomic::Op {
-        Atomic::Op op = (Atomic::Op)(inst.imm & ~INST_FETCH);
-        switch (op) {
+    static auto getAtomicOp(const size_t pc, const ebpf_inst inst) -> Atomic::Op {
+        switch (const auto op = static_cast<Atomic::Op>(inst.imm & ~INST_FETCH)) {
         case Atomic::Op::XCHG:
         case Atomic::Op::CMPXCHG:
             if ((inst.imm & INST_FETCH) == 0) {
@@ -242,11 +241,11 @@ struct Unmarshaller {
         throw InvalidInstruction(pc, "unsupported immediate");
     }
 
-    uint64_t sign_extend(int32_t imm) { return (uint64_t)(int64_t)imm; }
+    static uint64_t sign_extend(const int32_t imm) { return static_cast<uint64_t>(static_cast<int64_t>(imm)); }
 
-    uint64_t zero_extend(int32_t imm) { return (uint64_t)(uint32_t)imm; }
+    static uint64_t zero_extend(const int32_t imm) { return static_cast<uint64_t>(static_cast<uint32_t>(imm)); }
 
-    auto getBinValue(pc_t pc, ebpf_inst inst) -> Value {
+    static auto getBinValue(const pc_t pc, const ebpf_inst inst) -> Value {
         if (inst.opcode & INST_SRC_REG) {
             if (inst.imm != 0) {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
@@ -261,7 +260,7 @@ struct Unmarshaller {
         }
     }
 
-    static auto getJmpOp(size_t pc, uint8_t opcode) -> Condition::Op {
+    static auto getJmpOp(const size_t pc, const uint8_t opcode) -> Condition::Op {
         using Op = Condition::Op;
         switch ((opcode >> 4) & 0xF) {
         case 0x0: return {}; // goto
@@ -284,17 +283,17 @@ struct Unmarshaller {
         return {};
     }
 
-    auto makeMemOp(pc_t pc, ebpf_inst inst) -> Instruction {
+    auto makeMemOp(const pc_t pc, const ebpf_inst inst) -> Instruction {
         if (inst.dst > R10_STACK_POINTER || inst.src > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
         }
 
-        int width = getMemWidth(inst.opcode);
+        const int width = getMemWidth(inst.opcode);
         if (!info.platform->supports_group((width == sizeof(uint64_t)) ? bpf_conformance_groups_t::base64
                                                                        : bpf_conformance_groups_t::base32)) {
             throw InvalidInstruction(pc, inst.opcode);
         }
-        bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
+        const bool isLD = (inst.opcode & INST_CLS_MASK) == INST_CLS_LD;
         switch (inst.opcode & INST_MODE_MASK) {
         case INST_MODE_IMM: throw InvalidInstruction(pc, inst.opcode);
 
@@ -332,11 +331,11 @@ struct Unmarshaller {
             if (isLD) {
                 throw InvalidInstruction(pc, inst.opcode);
             }
-            bool isLoad = getMemIsLoad(inst.opcode);
+            const bool isLoad = getMemIsLoad(inst.opcode);
             if (isLoad && inst.dst == R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "cannot modify r10");
             }
-            bool isImm = !(inst.opcode & 1);
+            const bool isImm = !(inst.opcode & 1);
             if (isImm && inst.src != 0) {
                 throw InvalidInstruction(pc, inst.opcode);
             }
@@ -345,7 +344,7 @@ struct Unmarshaller {
             }
 
             assert(!(isLoad && isImm));
-            uint8_t basereg = isLoad ? inst.src : inst.dst;
+            const uint8_t basereg = isLoad ? inst.src : inst.dst;
 
             if (basereg == R10_STACK_POINTER &&
                 (inst.offset + opcode_to_width(inst.opcode) > 0 || inst.offset < -EBPF_STACK_SIZE)) {
@@ -358,8 +357,9 @@ struct Unmarshaller {
                         .basereg = Reg{basereg},
                         .offset = inst.offset,
                     },
-                .value =
-                    isLoad ? (Value)Reg{inst.dst} : (isImm ? (Value)Imm{zero_extend(inst.imm)} : (Value)Reg{inst.src}),
+                .value = isLoad ? static_cast<Value>(Reg{inst.dst})
+                                : (isImm ? static_cast<Value>(Imm{zero_extend(inst.imm)})
+                                         : static_cast<Value>(Reg{inst.src})),
                 .is_load = isLoad,
             };
             return res;
@@ -388,11 +388,10 @@ struct Unmarshaller {
             };
         default: throw InvalidInstruction(pc, inst.opcode);
         }
-        return {};
     }
 
-    auto makeAluOp(size_t pc, ebpf_inst inst) -> Instruction {
-        bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
+    auto makeAluOp(const size_t pc, const ebpf_inst inst) -> Instruction {
+        const bool is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_ALU64;
         if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64
                                                 : bpf_conformance_groups_t::base32)) {
             throw InvalidInstruction(pc, inst.opcode);
@@ -404,8 +403,8 @@ struct Unmarshaller {
             throw InvalidInstruction(pc, "bad register");
         }
         return std::visit(
-            overloaded{[&](Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
-                       [&](Bin::Op op) -> Instruction {
+            overloaded{[&](const Un::Op op) -> Instruction { return Un{.op = op, .dst = Reg{inst.dst}, .is64 = is64}; },
+                       [&](const Bin::Op op) -> Instruction {
                            Bin res{
                                .op = op,
                                .dst = Reg{inst.dst},
@@ -414,8 +413,10 @@ struct Unmarshaller {
                            };
                            if (!thread_local_options.allow_division_by_zero &&
                                (op == Bin::Op::UDIV || op == Bin::Op::UMOD)) {
-                               if (std::holds_alternative<Imm>(res.v) && std::get<Imm>(res.v).v == 0) {
-                                   note("division by zero");
+                               if (const auto pimm = std::get_if<Imm>(&res.v)) {
+                                   if (pimm->v == 0) {
+                                       note("division by zero");
+                                   }
                                }
                            }
                            return res;
@@ -423,14 +424,15 @@ struct Unmarshaller {
             getAluOp(pc, inst));
     }
 
-    auto makeLddw(ebpf_inst inst, int32_t next_imm, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
+    auto makeLddw(const ebpf_inst inst, const int32_t next_imm, const vector<ebpf_inst>& insts, const pc_t pc) const
+        -> Instruction {
         if (!info.platform->supports_group(bpf_conformance_groups_t::base64)) {
             throw InvalidInstruction{pc, inst.opcode};
         }
         if (pc >= insts.size() - 1) {
             throw InvalidInstruction(pc, "incomplete lddw");
         }
-        ebpf_inst next = insts[pc + 1];
+        const ebpf_inst next = insts[pc + 1];
         if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0) {
             throw InvalidInstruction(pc, "invalid lddw");
         }
@@ -462,7 +464,7 @@ struct Unmarshaller {
         };
     }
 
-    static ArgSingle::Kind toArgSingleKind(ebpf_argument_type_t t) {
+    static ArgSingle::Kind toArgSingleKind(const ebpf_argument_type_t t) {
         switch (t) {
         case EBPF_ARGUMENT_TYPE_ANYTHING: return ArgSingle::Kind::ANYTHING;
         case EBPF_ARGUMENT_TYPE_PTR_TO_MAP: return ArgSingle::Kind::MAP_FD;
@@ -475,7 +477,7 @@ struct Unmarshaller {
         return {};
     }
 
-    static ArgPair::Kind toArgPairKind(ebpf_argument_type_t t) {
+    static ArgPair::Kind toArgPairKind(const ebpf_argument_type_t t) {
         switch (t) {
         case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM_OR_NULL: return ArgPair::Kind::PTR_TO_READABLE_MEM_OR_NULL;
         case EBPF_ARGUMENT_TYPE_PTR_TO_READABLE_MEM: return ArgPair::Kind::PTR_TO_READABLE_MEM;
@@ -485,8 +487,8 @@ struct Unmarshaller {
         return {};
     }
 
-    auto makeCall(int32_t imm) const {
-        EbpfHelperPrototype proto = info.platform->get_helper_prototype(imm);
+    auto makeCall(const int32_t imm) const {
+        const EbpfHelperPrototype proto = info.platform->get_helper_prototype(imm);
         if (proto.return_type == EBPF_RETURN_TYPE_UNSUPPORTED) {
             throw std::runtime_error(std::string("unsupported function: ") + proto.name);
         }
@@ -495,7 +497,7 @@ struct Unmarshaller {
         res.name = proto.name;
         res.reallocate_packet = proto.reallocate_packet;
         res.is_map_lookup = proto.return_type == EBPF_RETURN_TYPE_PTR_TO_MAP_VALUE_OR_NULL;
-        std::array<ebpf_argument_type_t, 7> args = {
+        const std::array<ebpf_argument_type_t, 7> args = {
             {EBPF_ARGUMENT_TYPE_DONTCARE, proto.argument_type[0], proto.argument_type[1], proto.argument_type[2],
              proto.argument_type[3], proto.argument_type[4], EBPF_ARGUMENT_TYPE_DONTCARE}};
         for (size_t i = 1; i < args.size() - 1; i++) {
@@ -510,7 +512,7 @@ struct Unmarshaller {
             case EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY:
             case EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE:
             case EBPF_ARGUMENT_TYPE_PTR_TO_CTX:
-                res.singles.push_back({toArgSingleKind(args[i]), Reg{(uint8_t)i}});
+                res.singles.push_back({toArgSingleKind(args[i]), Reg{static_cast<uint8_t>(i)}});
                 break;
             case EBPF_ARGUMENT_TYPE_CONST_SIZE: {
                 // Sanity check: This argument should never be seen in isolation.
@@ -542,8 +544,9 @@ struct Unmarshaller {
                                     "EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO: ") +
                         proto.name);
                 }
-                bool can_be_zero = (args[i + 1] == EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO);
-                res.pairs.push_back({toArgPairKind(args[i]), Reg{(uint8_t)i}, Reg{(uint8_t)(i + 1)}, can_be_zero});
+                const bool can_be_zero = (args[i + 1] == EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO);
+                res.pairs.push_back({toArgPairKind(args[i]), Reg{static_cast<uint8_t>(i)},
+                                     Reg{static_cast<uint8_t>(i + 1)}, can_be_zero});
                 i++;
                 break;
             }
@@ -552,17 +555,17 @@ struct Unmarshaller {
     }
 
     /// Given a program counter and an offset, get the label of the target instruction.
-    label_t getJumpTarget(int32_t offset, const vector<ebpf_inst>& insts, pc_t pc) const {
-        pc_t new_pc = pc + 1 + offset;
+    static label_t getJumpTarget(const int32_t offset, const vector<ebpf_inst>& insts, const pc_t pc) {
+        const pc_t new_pc = pc + 1 + offset;
         if (new_pc >= insts.size()) {
             throw InvalidInstruction(pc, "jump out of bounds");
         } else if (insts[new_pc].opcode == 0) {
             throw InvalidInstruction(pc, "jump to middle of lddw");
         }
-        return label_t{(int)new_pc};
+        return label_t{static_cast<int>(new_pc)};
     }
 
-    auto makeCallLocal(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) const {
+    static auto makeCallLocal(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) {
         if (inst.opcode & INST_SRC_REG) {
             throw InvalidInstruction(pc, inst.opcode);
         }
@@ -572,7 +575,7 @@ struct Unmarshaller {
         return CallLocal{.target = getJumpTarget(inst.imm, insts, pc)};
     }
 
-    auto makeCallx(ebpf_inst inst, pc_t pc) const {
+    static auto makeCallx(const ebpf_inst inst, const pc_t pc) {
         // callx puts the register number in the 'dst' field rather than the 'src' field.
         if (inst.dst > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
@@ -585,12 +588,12 @@ struct Unmarshaller {
             if (inst.imm < 0 || inst.imm > R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "bad register");
             }
-            return Callx{(uint8_t)inst.imm};
+            return Callx{static_cast<uint8_t>(inst.imm)};
         }
         return Callx{inst.dst};
     }
 
-    auto makeJmp(ebpf_inst inst, const vector<ebpf_inst>& insts, pc_t pc) -> Instruction {
+    auto makeJmp(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) const -> Instruction {
         switch ((inst.opcode >> 4) & 0xF) {
         case INST_CALL:
             if ((inst.opcode & INST_CLS_MASK) != INST_CLS_JMP) {
@@ -662,12 +665,12 @@ struct Unmarshaller {
             }
         default: {
             // First validate the opcode, src, and imm.
-            auto is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_JMP;
+            const auto is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_JMP;
             if (!info.platform->supports_group(is64 ? bpf_conformance_groups_t::base64
                                                     : bpf_conformance_groups_t::base32)) {
                 throw InvalidInstruction(pc, inst.opcode);
             }
-            auto op = getJmpOp(pc, inst.opcode);
+            const auto op = getJmpOp(pc, inst.opcode);
             if (!(inst.opcode & INST_SRC_REG) && (inst.src != 0)) {
                 throw InvalidInstruction(pc, inst.opcode);
             }
@@ -675,8 +678,8 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             }
 
-            int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
-            label_t target = getJumpTarget(offset, insts, pc);
+            const int32_t offset = (inst.opcode == INST_OP_JA32) ? inst.imm : inst.offset;
+            const label_t target = getJumpTarget(offset, insts, pc);
             if (inst.opcode != INST_OP_JA16 && inst.opcode != INST_OP_JA32) {
                 if (inst.dst > R10_STACK_POINTER) {
                     throw InvalidInstruction(pc, "bad register");
@@ -686,13 +689,13 @@ struct Unmarshaller {
                 }
             }
 
-            auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
-                            ? std::optional<Condition>{}
-                            : Condition{.op = op,
-                                        .left = Reg{inst.dst},
-                                        .right = (inst.opcode & INST_SRC_REG) ? (Value)Reg{inst.src}
-                                                                              : Imm{sign_extend(inst.imm)},
-                                        .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)};
+            const auto cond = (inst.opcode == INST_OP_JA16 || inst.opcode == INST_OP_JA32)
+                                  ? std::optional<Condition>{}
+                                  : Condition{.op = op,
+                                              .left = Reg{inst.dst},
+                                              .right = (inst.opcode & INST_SRC_REG) ? static_cast<Value>(Reg{inst.src})
+                                                                                    : Imm{sign_extend(inst.imm)},
+                                              .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)};
             return Jmp{.cond = cond, .target = target};
         }
         }
@@ -705,14 +708,14 @@ struct Unmarshaller {
             throw std::invalid_argument("Zero length programs are not allowed");
         }
         for (size_t pc = 0; pc < insts.size();) {
-            ebpf_inst inst = insts[pc];
+            const ebpf_inst inst = insts[pc];
             Instruction new_ins;
             bool skip_instruction = false;
             bool fallthrough = true;
             switch (inst.opcode & INST_CLS_MASK) {
             case INST_CLS_LD:
                 if (inst.opcode == INST_OP_LDDW_IMM) {
-                    int32_t next_imm = pc < insts.size() - 1 ? insts[pc + 1].imm : 0;
+                    const int32_t next_imm = pc < insts.size() - 1 ? insts[pc + 1].imm : 0;
                     new_ins = makeLddw(inst, next_imm, insts, static_cast<pc_t>(pc));
                     skip_instruction = true;
                     break;
@@ -731,7 +734,7 @@ struct Unmarshaller {
                 if (pc >= insts.size() - 1) {
                     break;
                 }
-                ebpf_inst next = insts[pc + 1];
+                const ebpf_inst next = insts[pc + 1];
                 auto dst = Reg{inst.dst};
 
                 if (new_ins != shift32(dst, Bin::Op::LSH)) {
@@ -755,13 +758,13 @@ struct Unmarshaller {
 
             case INST_CLS_JMP32:
             case INST_CLS_JMP: {
-                new_ins = makeJmp(inst, insts, static_cast<pc_t>(pc));
+                new_ins = makeJmp(inst, insts, pc);
                 if (std::holds_alternative<Exit>(new_ins)) {
                     fallthrough = false;
                     exit_count++;
                 }
-                if (std::holds_alternative<Jmp>(new_ins)) {
-                    if (!std::get<Jmp>(new_ins).cond) {
+                if (const auto pjmp = std::get_if<Jmp>(&new_ins)) {
+                    if (!pjmp->cond) {
                         fallthrough = false;
                     }
                 }
@@ -810,8 +813,8 @@ std::variant<InstructionSeq, std::string> unmarshal(const raw_program& raw_prog)
     return unmarshal(raw_prog, notes);
 }
 
-Call make_call(int imm, const ebpf_platform_t& platform) {
+Call make_call(const int imm, const ebpf_platform_t& platform) {
     vector<vector<string>> notes;
-    program_info info{.platform = &platform};
+    const program_info info{.platform = &platform};
     return Unmarshaller{notes, info}.makeCall(imm);
 }
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 4a53e68ca..5282ce100 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -18,9 +18,7 @@ class AssertExtractor {
     program_info info;
     std::optional<label_t> current_label; ///< Pre-simplification label this assert is part of.
 
-    static Reg reg(Value v) { return std::get<Reg>(v); }
-
-    static Imm imm(Value v) { return std::get<Imm>(v); }
+    static Imm imm(const Value& v) { return std::get<Imm>(v); }
 
     static vector<Assert> zero_offset_ctx(Reg reg) {
         vector<Assert> res;
@@ -129,13 +127,13 @@ class AssertExtractor {
     }
 
     [[nodiscard]]
-    vector<Assert> explicate(Condition cond) const {
+    vector<Assert> explicate(const Condition& cond) const {
         if (info.type.is_privileged) {
             return {};
         }
         vector<Assert> res;
-        if (std::holds_alternative<Imm>(cond.right)) {
-            if (imm(cond.right).v != 0) {
+        if (const auto pimm = std::get_if<Imm>(&cond.right)) {
+            if (pimm->v != 0) {
                 // no need to check for valid access, it must be a number
                 res.emplace_back(TypeConstraint{cond.left, TypeGroup::number});
             } else {
@@ -144,33 +142,34 @@ class AssertExtractor {
                 // Anything can be compared to 0
             }
         } else {
+            const auto reg_right = get<Reg>(cond.right);
             res.emplace_back(ValidAccess{cond.left});
-            res.emplace_back(ValidAccess{reg(cond.right)});
+            res.emplace_back(ValidAccess{reg_right});
             if (cond.op != Condition::Op::EQ && cond.op != Condition::Op::NE) {
                 res.emplace_back(TypeConstraint{cond.left, TypeGroup::ptr_or_num});
             }
-            res.emplace_back(Comparable{.r1 = cond.left, .r2 = reg(cond.right), .or_r2_is_number = false});
+            res.emplace_back(Comparable{.r1 = cond.left, .r2 = reg_right, .or_r2_is_number = false});
         }
         return res;
     }
 
-    vector<Assert> operator()(Assume ins) const { return explicate(ins.cond); }
+    vector<Assert> operator()(const Assume& ins) const { return explicate(ins.cond); }
 
-    vector<Assert> operator()(Jmp ins) const {
+    vector<Assert> operator()(const Jmp& ins) const {
         if (!ins.cond) {
             return {};
         }
         return explicate(*ins.cond);
     }
 
-    vector<Assert> operator()(Mem ins) const {
+    vector<Assert> operator()(const Mem& ins) const {
         vector<Assert> res;
-        Reg basereg = ins.access.basereg;
+        const Reg basereg = ins.access.basereg;
         Imm width{static_cast<uint32_t>(ins.access.width)};
-        int offset = ins.access.offset;
+        const int offset = ins.access.offset;
         if (basereg.v == R10_STACK_POINTER) {
             // We know we are accessing the stack.
-            if (offset < -EBPF_STACK_SIZE || offset + (int)width.v >= 0) {
+            if (offset < -EBPF_STACK_SIZE || offset + static_cast<int>(width.v) >= 0) {
                 // This assertion will fail
                 res.emplace_back(
                     ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
@@ -179,18 +178,20 @@ class AssertExtractor {
             res.emplace_back(TypeConstraint{basereg, TypeGroup::pointer});
             res.emplace_back(
                 ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
-            if (!info.type.is_privileged && !ins.is_load && std::holds_alternative<Reg>(ins.value)) {
-                if (width.v != 8) {
-                    res.emplace_back(TypeConstraint{reg(ins.value), TypeGroup::number});
-                } else {
-                    res.emplace_back(ValidStore{ins.access.basereg, reg(ins.value)});
+            if (!info.type.is_privileged && !ins.is_load) {
+                if (const auto preg = std::get_if<Reg>(&ins.value)) {
+                    if (width.v != 8) {
+                        res.emplace_back(TypeConstraint{*preg, TypeGroup::number});
+                    } else {
+                        res.emplace_back(ValidStore{ins.access.basereg, *preg});
+                    }
                 }
             }
         }
         return res;
     }
 
-    vector<Assert> operator()(Atomic ins) const {
+    vector<Assert> operator()(const Atomic& ins) const {
         vector<Assert> res;
         res.emplace_back(TypeConstraint{ins.access.basereg, TypeGroup::pointer});
         res.emplace_back(
@@ -204,58 +205,54 @@ class AssertExtractor {
         return res;
     }
 
-    vector<Assert> operator()(Un ins) { return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}}; }
+    vector<Assert> operator()(const Un ins) const { return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}}; }
 
-    vector<Assert> operator()(Bin ins) const {
+    vector<Assert> operator()(const Bin& ins) const {
         switch (ins.op) {
         case Bin::Op::MOV: return {};
         case Bin::Op::MOVSX8:
         case Bin::Op::MOVSX16:
         case Bin::Op::MOVSX32:
-            if (std::holds_alternative<Reg>(ins.v)) {
-                auto src = reg(ins.v);
-                return {Assert{TypeConstraint{src, TypeGroup::number}}};
+            if (const auto src = std::get_if<Reg>(&ins.v)) {
+                return {Assert{TypeConstraint{*src, TypeGroup::number}}};
             }
             return {};
-        case Bin::Op::ADD:
-            if (std::holds_alternative<Reg>(ins.v)) {
-                auto src = reg(ins.v);
+        case Bin::Op::ADD: {
+            if (const auto src = std::get_if<Reg>(&ins.v)) {
                 return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}},
-                        Assert{TypeConstraint{src, TypeGroup::ptr_or_num}}, Assert{Addable{src, ins.dst}},
-                        Assert{Addable{ins.dst, src}}};
-            } else {
-                return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
+                        Assert{TypeConstraint{*src, TypeGroup::ptr_or_num}}, Assert{Addable{*src, ins.dst}},
+                        Assert{Addable{ins.dst, *src}}};
             }
-        case Bin::Op::SUB:
-            if (std::holds_alternative<Reg>(ins.v)) {
+            return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
+        }
+        case Bin::Op::SUB: {
+            if (const auto reg = std::get_if<Reg>(&ins.v)) {
                 vector<Assert> res;
                 // disallow map-map since same type does not mean same offset
                 // TODO: map identities
                 res.emplace_back(TypeConstraint{ins.dst, TypeGroup::ptr_or_num});
-                res.emplace_back(Comparable{.r1 = ins.dst, .r2 = reg(ins.v), .or_r2_is_number = true});
+                res.emplace_back(Comparable{.r1 = ins.dst, .r2 = *reg, .or_r2_is_number = true});
                 return res;
-            } else {
-                return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
             }
+            return {Assert{TypeConstraint{ins.dst, TypeGroup::ptr_or_num}}};
+        }
         case Bin::Op::UDIV:
         case Bin::Op::UMOD:
         case Bin::Op::SDIV:
-        case Bin::Op::SMOD:
-            if (std::holds_alternative<Reg>(ins.v)) {
-                auto src = reg(ins.v);
-                bool is_signed = (ins.op == Bin::Op::SDIV || ins.op == Bin::Op::SMOD);
-                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}, Assert{ValidDivisor{src, is_signed}}};
-            } else {
-                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
+        case Bin::Op::SMOD: {
+            if (const auto src = std::get_if<Reg>(&ins.v)) {
+                const bool is_signed = (ins.op == Bin::Op::SDIV || ins.op == Bin::Op::SMOD);
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}, Assert{ValidDivisor{*src, is_signed}}};
             }
+            return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
+        }
         default: return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
         }
         assert(false);
-        return {};
     }
 };
 
-vector<Assert> get_assertions(Instruction ins, const program_info& info, std::optional<label_t> label) {
+vector<Assert> get_assertions(Instruction ins, const program_info& info, const std::optional<label_t>& label) {
     return std::visit(AssertExtractor{info, label}, ins);
 }
 
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index d93130855..8ff0792ff 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -616,7 +616,7 @@ std::map<std::string, int> collect_stats(const cfg_t&);
 cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit = true);
 
 void explicate_assertions(cfg_t& cfg, const program_info& info);
-std::vector<Assert> get_assertions(Instruction ins, const program_info& info, std::optional<label_t> label);
+std::vector<Assert> get_assertions(Instruction ins, const program_info& info, const std::optional<label_t>& label);
 
 void print_dot(const cfg_t& cfg, std::ostream& out);
 void print_dot(const cfg_t& cfg, const std::string& outfile);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 98b42cfc6..a4534c9e8 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1222,8 +1222,8 @@ void ebpf_domain_t::check_access_shared(NumAbsDomain& inv, const linear_expressi
 void ebpf_domain_t::operator()(const Assume& s) {
     const Condition cond = s.cond;
     const auto dst = reg_pack(cond.left);
-    if (std::holds_alternative<Reg>(cond.right)) {
-        const auto src_reg = std::get<Reg>(cond.right);
+    if (const auto psrc_reg = std::get_if<Reg>(&cond.right)) {
+        const auto src_reg = *psrc_reg;
         const auto src = reg_pack(src_reg);
         if (type_inv.same_type(m_inv, cond.left, std::get<Reg>(cond.right))) {
             m_inv = type_inv.join_over_types(m_inv, cond.left, [&](NumAbsDomain& inv, const type_encoding_t type) {
@@ -1639,7 +1639,14 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
         }
     });
 }
-
+static std::tuple<linear_expression_t, linear_expression_t> lb_ub_access_pair(const ValidAccess& s,
+                                                                              const variable_t offset_var) {
+    using namespace crab::dsl_syntax;
+    linear_expression_t lb = offset_var + s.offset;
+    linear_expression_t ub = std::holds_alternative<Imm>(s.width) ? lb + std::get<Imm>(s.width).v
+                                                                  : lb + reg_pack(std::get<Reg>(s.width)).svalue;
+    return {lb, ub};
+}
 void ebpf_domain_t::operator()(const ValidAccess& s) {
     using namespace crab::dsl_syntax;
 
@@ -1650,10 +1657,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
     m_inv = type_inv.join_over_types(m_inv, s.reg, [&](NumAbsDomain& inv, type_encoding_t type) {
         switch (type) {
         case T_PACKET: {
-            linear_expression_t lb = reg.packet_offset + s.offset;
-            linear_expression_t ub = std::holds_alternative<Imm>(s.width)
-                                         ? lb + std::get<Imm>(s.width).v
-                                         : lb + reg_pack(std::get<Reg>(s.width)).svalue;
+            auto [lb, ub] = lb_ub_access_pair(s, reg.packet_offset);
             check_access_packet(inv, lb, ub,
                                 is_comparison_check ? std::optional<variable_t>{} : variable_t::packet_size());
             // if within bounds, it can never be null
@@ -1661,10 +1665,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
             break;
         }
         case T_STACK: {
-            linear_expression_t lb = reg.stack_offset + s.offset;
-            linear_expression_t ub = std::holds_alternative<Imm>(s.width)
-                                         ? lb + std::get<Imm>(s.width).v
-                                         : lb + reg_pack(std::get<Reg>(s.width)).svalue;
+            auto [lb, ub] = lb_ub_access_pair(s, reg.stack_offset);
             check_access_stack(inv, lb, ub);
             // if within bounds, it can never be null
             if (s.access_type == AccessType::read) {
@@ -1672,9 +1673,8 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                 if (!stack.all_num(inv, lb, ub)) {
                     if (s.offset < 0) {
                         require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
-                    } else if (std::holds_alternative<Imm>(s.width)) {
-                        if (!inv.entail(static_cast<int>(std::get<Imm>(s.width).v) <=
-                                        reg.stack_numeric_size - s.offset)) {
+                    } else if (const auto pimm = std::get_if<Imm>(&s.width)) {
+                        if (!inv.entail(static_cast<int>(pimm->v) <= reg.stack_numeric_size - s.offset)) {
                             require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                         }
                     } else {
@@ -1687,15 +1687,21 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
             break;
         }
         case T_CTX: {
-            linear_expression_t lb = reg.ctx_offset + s.offset;
-            linear_expression_t ub = std::holds_alternative<Imm>(s.width)
-                                         ? lb + std::get<Imm>(s.width).v
-                                         : lb + reg_pack(std::get<Reg>(s.width)).svalue;
+            auto [lb, ub] = lb_ub_access_pair(s, reg.ctx_offset);
             check_access_context(inv, lb, ub);
             // if within bounds, it can never be null
             // The context is both readable and writable.
             break;
         }
+        case T_SHARED: {
+            auto [lb, ub] = lb_ub_access_pair(s, reg.shared_offset);
+            check_access_shared(inv, lb, ub, reg.shared_region_size);
+            if (!is_comparison_check && !s.or_null) {
+                require(inv, reg.svalue > 0, "Possible null access");
+            }
+            // Shared memory is zero-initialized when created so is safe to read and write.
+            break;
+        }
         case T_NUM:
             if (!is_comparison_check) {
                 if (s.or_null) {
@@ -1711,18 +1717,6 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                 require(inv, linear_constraint_t::false_const(), "FDs cannot be dereferenced directly");
             }
             break;
-        case T_SHARED: {
-            linear_expression_t lb = reg.shared_offset + s.offset;
-            linear_expression_t ub = std::holds_alternative<Imm>(s.width)
-                                         ? lb + std::get<Imm>(s.width).v
-                                         : lb + reg_pack(std::get<Reg>(s.width)).svalue;
-            check_access_shared(inv, lb, ub, reg.shared_region_size);
-            if (!is_comparison_check && !s.or_null) {
-                require(inv, reg.svalue > 0, "Possible null access");
-            }
-            // Shared memory is zero-initialized when created so is safe to read and write.
-            break;
-        }
         default: require(inv, linear_constraint_t::false_const(), "Invalid type"); break;
         }
     });
@@ -2016,13 +2010,12 @@ void ebpf_domain_t::operator()(const Mem& b) {
     if (m_inv.is_bottom()) {
         return;
     }
-    if (std::holds_alternative<Reg>(b.value)) {
+    if (const auto preg = std::get_if<Reg>(&b.value)) {
         if (b.is_load) {
-            do_load(b, std::get<Reg>(b.value));
+            do_load(b, *preg);
         } else {
-            const auto data = std::get<Reg>(b.value);
-            auto data_reg = reg_pack(data);
-            do_mem_store(b, data, data_reg.svalue, data_reg.uvalue, data_reg);
+            auto data_reg = reg_pack(*preg);
+            do_mem_store(b, *preg, data_reg.svalue, data_reg.uvalue, data_reg);
         }
     } else {
         do_mem_store(b, number_t{T_NUM}, number_t{static_cast<int64_t>(std::get<Imm>(b.value).v)},
@@ -2498,15 +2491,15 @@ void ebpf_domain_t::operator()(const Bin& bin) {
     auto dst = reg_pack(bin.dst);
     int finite_width = bin.is64 ? 64 : 32;
 
-    if (std::holds_alternative<Imm>(bin.v)) {
+    if (auto pimm = std::get_if<Imm>(&bin.v)) {
         // dst += K
         int64_t imm;
         if (bin.is64) {
             // Use the full signed value.
-            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+            imm = static_cast<int64_t>(pimm->v);
         } else {
             // Use only the low 32 bits of the value.
-            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+            imm = static_cast<int32_t>(pimm->v);
             bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
         }
         switch (bin.op) {
diff --git a/src/crab/fwd_analyzer.cpp b/src/crab/fwd_analyzer.cpp
index ffebe5105..e0ccc0162 100644
--- a/src/crab/fwd_analyzer.cpp
+++ b/src/crab/fwd_analyzer.cpp
@@ -19,7 +19,7 @@ class member_component_visitor final {
     bool _found;
 
   public:
-    explicit member_component_visitor(label_t node) : _node(node), _found(false) {}
+    explicit member_component_visitor(const label_t& node) : _node(node), _found(false) {}
 
     void operator()(const label_t& vertex) {
         if (!_found) {
@@ -48,7 +48,7 @@ class member_component_visitor final {
 };
 
 class interleaved_fwd_fixpoint_iterator_t final {
-    using iterator = typename invariant_table_t::iterator;
+    using iterator = invariant_table_t::iterator;
 
     cfg_t& _cfg;
     wto_t _wto;
@@ -74,7 +74,7 @@ class interleaved_fwd_fixpoint_iterator_t final {
     }
 
     [[nodiscard]]
-    static ebpf_domain_t extrapolate(ebpf_domain_t before, const ebpf_domain_t& after, unsigned int iteration) {
+    static ebpf_domain_t extrapolate(const ebpf_domain_t& before, const ebpf_domain_t& after, unsigned int iteration) {
         /// number of iterations until triggering widening
         constexpr auto _widening_delay = 2;
 
@@ -84,7 +84,7 @@ class interleaved_fwd_fixpoint_iterator_t final {
         return before.widen(after, iteration == _widening_delay);
     }
 
-    static ebpf_domain_t refine(ebpf_domain_t before, const ebpf_domain_t& after, unsigned int iteration) {
+    static ebpf_domain_t refine(const ebpf_domain_t& before, const ebpf_domain_t& after, unsigned int iteration) {
         if (iteration == 1) {
             return before & after;
         } else {
@@ -125,8 +125,8 @@ std::pair<invariant_table_t, invariant_table_t> run_forward_analyzer(cfg_t& cfg,
     if (thread_local_options.check_termination) {
         std::vector<label_t> cycle_heads;
         for (auto& component : analyzer._wto) {
-            if (std::holds_alternative<std::shared_ptr<wto_cycle_t>>(component)) {
-                cycle_heads.push_back(std::get<std::shared_ptr<wto_cycle_t>>(component)->head());
+            if (const auto pc = std::get_if<std::shared_ptr<wto_cycle_t>>(&component)) {
+                cycle_heads.push_back((*pc)->head());
             }
         }
         for (const label_t& label : cycle_heads) {
@@ -190,7 +190,8 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(const std::shared_ptr<wto_c
         set_pre(head, invariant);
         transform_to_post(head, invariant);
         for (auto& component : *cycle) {
-            if (!std::holds_alternative<label_t>(component) || (std::get<label_t>(component) != head)) {
+            const auto plabel = std::get_if<label_t>(&component);
+            if (!plabel || *plabel != head) {
                 std::visit(*this, component);
             }
         }
@@ -210,7 +211,8 @@ void interleaved_fwd_fixpoint_iterator_t::operator()(const std::shared_ptr<wto_c
         transform_to_post(head, invariant);
 
         for (auto& component : *cycle) {
-            if (!std::holds_alternative<label_t>(component) || (std::get<label_t>(component) != head)) {
+            const auto plabel = std::get_if<label_t>(&component);
+            if (!plabel || *plabel != head) {
                 std::visit(*this, component);
             }
         }
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index cc7752f3a..6a523d24e 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -338,8 +338,8 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
 
     // Convert the raw program section to a set of instructions.
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
-    if (std::holds_alternative<string>(prog_or_error)) {
-        std::cerr << "unmarshaling error at " << std::get<string>(prog_or_error) << "\n";
+    if (auto prog = std::get_if<std::string>(&prog_or_error)) {
+        std::cerr << "unmarshaling error at " << *prog << "\n";
         return {};
     }
 
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 5c43972ec..a7cd49955 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -220,8 +220,8 @@ int main(int argc, char** argv) {
 
     // Convert the raw program section to a set of instructions.
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
-    if (std::holds_alternative<string>(prog_or_error)) {
-        std::cout << "unmarshaling error at " << std::get<string>(prog_or_error) << "\n";
+    if (auto prog = std::get_if<string>(&prog_or_error)) {
+        std::cout << "unmarshaling error at " << *prog << "\n";
         return 1;
     }
 
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 2d84c76c2..ec54569d0 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -299,33 +299,33 @@ static void check_marshal_unmarshal_fail(const Instruction& ins, std::string exp
 static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_message,
                                  const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    std::vector<ebpf_inst> insns = {inst};
+    std::vector insns = {inst};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    REQUIRE(std::holds_alternative<std::string>(result));
-    std::string error_message = std::get<std::string>(result);
-    REQUIRE(error_message == expected_error_message);
+    std::string* error_message = std::get_if<std::string>(&result);
+    REQUIRE(error_message != nullptr);
+    REQUIRE(*error_message == expected_error_message);
 }
 
 static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expected_error_message,
                                       const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    std::vector<ebpf_inst> insns{inst, exit, exit};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
+    std::vector insns{inst, exit, exit};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    REQUIRE(std::holds_alternative<std::string>(result));
-    std::string error_message = std::get<std::string>(result);
-    REQUIRE(error_message == expected_error_message);
+    std::string* error_message = std::get_if<std::string>(&result);
+    REQUIRE(error_message != nullptr);
+    REQUIRE(*error_message == expected_error_message);
 }
 
 // Check that unmarshaling a 64-bit immediate instruction fails.
 static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string expected_error_message,
                                  const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    std::vector<ebpf_inst> insns = {inst1, inst2};
+    std::vector insns{inst1, inst2};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    REQUIRE(std::holds_alternative<std::string>(result));
-    std::string error_message = std::get<std::string>(result);
-    REQUIRE(error_message == expected_error_message);
+    std::string* error_message = std::get_if<std::string>(&result);
+    REQUIRE(error_message != nullptr);
+    REQUIRE(*error_message == expected_error_message);
 }
 
 static const auto ws = {1, 2, 4, 8};
diff --git a/src/test/test_print.cpp b/src/test/test_print.cpp
index e567f15a6..b7e8eaf94 100644
--- a/src/test/test_print.cpp
+++ b/src/test/test_print.cpp
@@ -26,9 +26,9 @@ void verify_printed_string(const std::string& file) {
         read_elf(std::string(TEST_OBJECT_FILE_DIRECTORY) + file + ".o", "", nullptr, &g_ebpf_platform_linux);
     const raw_program& raw_prog = raw_progs.back();
     std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);
-    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));
-    auto& program = std::get<InstructionSeq>(prog_or_error);
-    print(program, generated_output, {});
+    auto program = std::get_if<InstructionSeq>(&prog_or_error);
+    REQUIRE(program != nullptr);
+    print(*program, generated_output, {});
     print_map_descriptors(raw_prog.info.map_descriptors, generated_output);
     std::ifstream expected_stream(std::string(TEST_ASM_FILE_DIRECTORY) + file + std::string(".asm"));
     REQUIRE(expected_stream);
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index be7fa62b2..7c3160b3c 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -38,10 +38,10 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, sectionname, nullptr, platform); \
         REQUIRE(raw_progs.size() == 1);                                                                  \
         raw_program raw_prog = raw_progs.back();                                                         \
-        std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);                   \
-        REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));                                  \
-        auto& prog = std::get<InstructionSeq>(prog_or_error);                                            \
-        bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr);                \
+        auto prog_or_error = unmarshal(raw_prog);                                                        \
+        auto prog = std::get_if<InstructionSeq>(&prog_or_error);                                         \
+        REQUIRE(prog != nullptr);                                                                        \
+        bool res = ebpf_verify_program(std::cout, *prog, raw_prog.info, options, nullptr);               \
         if (pass)                                                                                        \
             REQUIRE(res);                                                                                \
         else                                                                                             \
@@ -54,10 +54,10 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         auto raw_progs = read_elf("ebpf-samples/" dirname "/" filename, section_name, nullptr, platform); \
         for (auto& raw_prog : raw_progs) {                                                                \
             if (raw_prog.function_name == program_name) {                                                 \
-                std::variant<InstructionSeq, std::string> prog_or_error = unmarshal(raw_prog);            \
-                REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error));                           \
-                auto& prog = std::get<InstructionSeq>(prog_or_error);                                     \
-                bool res = ebpf_verify_program(std::cout, prog, raw_prog.info, options, nullptr);         \
+                auto prog_or_error = unmarshal(raw_prog);                                                 \
+                auto prog = std::get_if<InstructionSeq>(&prog_or_error);                                  \
+                REQUIRE(prog != nullptr);                                                                 \
+                bool res = ebpf_verify_program(std::cout, *prog, raw_prog.info, options, nullptr);        \
                 if (pass)                                                                                 \
                     REQUIRE(res);                                                                         \
                 else                                                                                      \
@@ -598,18 +598,18 @@ TEST_CASE("multithreading", "[verify][multithreading]") {
     auto raw_progs1 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/1", nullptr, &g_ebpf_platform_linux);
     REQUIRE(raw_progs1.size() == 1);
     raw_program raw_prog1 = raw_progs1.back();
-    std::variant<InstructionSeq, std::string> prog_or_error1 = unmarshal(raw_prog1);
-    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error1));
-    auto& prog1 = std::get<InstructionSeq>(prog_or_error1);
-    cfg_t cfg1 = prepare_cfg(prog1, raw_prog1.info, true);
+    auto prog_or_error1 = unmarshal(raw_prog1);
+    auto prog1 = std::get_if<InstructionSeq>(&prog_or_error1);
+    REQUIRE(prog1 != nullptr);
+    cfg_t cfg1 = prepare_cfg(*prog1, raw_prog1.info, true);
 
     auto raw_progs2 = read_elf("ebpf-samples/bpf_cilium_test/bpf_netdev.o", "2/2", nullptr, &g_ebpf_platform_linux);
     REQUIRE(raw_progs2.size() == 1);
     raw_program raw_prog2 = raw_progs2.back();
-    std::variant<InstructionSeq, std::string> prog_or_error2 = unmarshal(raw_prog2);
-    REQUIRE(std::holds_alternative<InstructionSeq>(prog_or_error2));
-    auto& prog2 = std::get<InstructionSeq>(prog_or_error2);
-    cfg_t cfg2 = prepare_cfg(prog2, raw_prog2.info, true);
+    auto prog_or_error2 = unmarshal(raw_prog2);
+    auto prog2 = std::get_if<InstructionSeq>(&prog_or_error2);
+    REQUIRE(prog2 != nullptr);
+    cfg_t cfg2 = prepare_cfg(*prog2, raw_prog2.info, true);
 
     bool res1, res2;
     std::thread a(test_analyze_thread, &cfg1, &raw_prog1.info, &res1);

From 07b546b0b920d113895f10e0c9c3a0c34150d9be Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Sun, 29 Sep 2024 22:31:18 +0300
Subject: [PATCH 264/373] cleanup, modernize and silence compiler warnings

also some more modernization

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_marshal.cpp       | 74 ++++++++++++++++-----------------------
 src/crab/array_domain.cpp | 33 +++++++++--------
 src/crab/ebpf_domain.cpp  |  3 ++
 src/crab/split_dbm.cpp    |  2 +-
 src/crab/variable.hpp     | 18 ++++------
 5 files changed, 58 insertions(+), 72 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 5e8854474..155b3f665 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -10,7 +10,7 @@
 
 using std::vector;
 
-static uint8_t op(Condition::Op op) {
+static uint8_t op(const Condition::Op op) {
     using Op = Condition::Op;
     switch (op) {
     case Op::EQ: return 0x1;
@@ -30,7 +30,7 @@ static uint8_t op(Condition::Op op) {
     return {};
 }
 
-static uint8_t op(Bin::Op op) {
+static uint8_t op(const Bin::Op op) {
     using Op = Bin::Op;
     switch (op) {
     case Op::ADD: return 0x0;
@@ -55,7 +55,7 @@ static uint8_t op(Bin::Op op) {
     return {};
 }
 
-static int16_t offset(Bin::Op op) {
+static int16_t offset(const Bin::Op op) {
     using Op = Bin::Op;
     switch (op) {
     case Op::SDIV:
@@ -63,11 +63,11 @@ static int16_t offset(Bin::Op op) {
     case Op::MOVSX8: return 8;
     case Op::MOVSX16: return 16;
     case Op::MOVSX32: return 32;
+    default: return 0;
     }
-    return 0;
 }
 
-static uint8_t imm_endian(Un::Op op) {
+static uint8_t imm_endian(const Un::Op op) {
     using Op = Un::Op;
     switch (op) {
     case Op::NEG: assert(false); return 0;
@@ -87,7 +87,7 @@ static uint8_t imm_endian(Un::Op op) {
 
 struct MarshalVisitor {
   private:
-    static vector<ebpf_inst> makeLddw(Reg dst, bool isFd, int32_t imm, int32_t next_imm) {
+    static vector<ebpf_inst> makeLddw(const Reg dst, const bool isFd, const int32_t imm, const int32_t next_imm) {
         return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_CLS_LD | width_to_opcode(8)),
                           .dst = dst.v,
                           .src = static_cast<uint8_t>(isFd ? 1 : 0),
@@ -100,14 +100,14 @@ struct MarshalVisitor {
     std::function<auto(label_t)->int16_t> label_to_offset16;
     std::function<auto(label_t)->int32_t> label_to_offset32;
 
-    vector<ebpf_inst> operator()(Undefined const& a) {
+    vector<ebpf_inst> operator()(Undefined const& a) const {
         assert(false);
         return {};
     }
 
-    vector<ebpf_inst> operator()(LoadMapFd const& b) { return makeLddw(b.dst, true, b.mapfd, 0); }
+    vector<ebpf_inst> operator()(LoadMapFd const& b) const { return makeLddw(b.dst, true, b.mapfd, 0); }
 
-    vector<ebpf_inst> operator()(Bin const& b) {
+    vector<ebpf_inst> operator()(Bin const& b) const {
         if (b.lddw) {
             const auto pimm = std::get_if<Imm>(&b.v);
             assert(pimm != nullptr);
@@ -120,16 +120,16 @@ struct MarshalVisitor {
                       .src = 0,
                       .offset = offset(b.op),
                       .imm = 0};
-        std::visit(overloaded{[&](Reg right) {
+        std::visit(overloaded{[&](const Reg right) {
                                   res.opcode |= INST_SRC_REG;
                                   res.src = right.v;
                               },
-                              [&](Imm right) { res.imm = static_cast<int32_t>(right.v); }},
+                              [&](const Imm right) { res.imm = static_cast<int32_t>(right.v); }},
                    b.v);
         return {res};
     }
 
-    vector<ebpf_inst> operator()(Un const& b) {
+    vector<ebpf_inst> operator()(Un const& b) const {
         switch (b.op) {
         case Un::Op::NEG:
             return {ebpf_inst{
@@ -174,7 +174,7 @@ struct MarshalVisitor {
         return {};
     }
 
-    vector<ebpf_inst> operator()(Call const& b) {
+    vector<ebpf_inst> operator()(Call const& b) const {
         return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
                           .dst = 0,
                           .src = INST_CALL_STATIC_HELPER,
@@ -182,7 +182,7 @@ struct MarshalVisitor {
                           .imm = b.func}};
     }
 
-    vector<ebpf_inst> operator()(CallLocal const& b) {
+    vector<ebpf_inst> operator()(CallLocal const& b) const {
         return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
                           .dst = 0,
                           .src = INST_CALL_LOCAL,
@@ -190,7 +190,7 @@ struct MarshalVisitor {
                           .imm = label_to_offset32(b.target)}};
     }
 
-    vector<ebpf_inst> operator()(Callx const& b) {
+    vector<ebpf_inst> operator()(Callx const& b) const {
         // callx is defined to have the register in 'dst' not in 'src'.
         return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALLX),
                           .dst = b.func.v,
@@ -198,15 +198,15 @@ struct MarshalVisitor {
                           .offset = 0}};
     }
 
-    vector<ebpf_inst> operator()(Exit const& b) {
+    vector<ebpf_inst> operator()(Exit const& b) const {
         return {ebpf_inst{.opcode = INST_OP_EXIT, .dst = 0, .src = 0, .offset = 0, .imm = 0}};
     }
 
-    vector<ebpf_inst> operator()(Assume const& b) { throw std::invalid_argument("Cannot marshal assumptions"); }
+    vector<ebpf_inst> operator()(Assume const&) const { throw std::invalid_argument("Cannot marshal assumptions"); }
 
-    vector<ebpf_inst> operator()(Assert const& b) { throw std::invalid_argument("Cannot marshal assertions"); }
+    vector<ebpf_inst> operator()(Assert const&) const { throw std::invalid_argument("Cannot marshal assertions"); }
 
-    vector<ebpf_inst> operator()(Jmp const& b) {
+    vector<ebpf_inst> operator()(Jmp const& b) const {
         if (b.cond) {
             ebpf_inst res{
                 .opcode = static_cast<uint8_t>(INST_CLS_JMP | (op(b.cond->op) << 4)),
@@ -214,15 +214,15 @@ struct MarshalVisitor {
                 .src = 0,
                 .offset = label_to_offset16(b.target),
             };
-            visit(overloaded{[&](Reg right) {
+            visit(overloaded{[&](const Reg right) {
                                  res.opcode |= INST_SRC_REG;
                                  res.src = right.v;
                              },
-                             [&](Imm right) { res.imm = static_cast<int32_t>(right.v); }},
+                             [&](const Imm right) { res.imm = static_cast<int32_t>(right.v); }},
                   b.cond->right);
             return {res};
         } else {
-            int32_t imm = label_to_offset32(b.target);
+            const int32_t imm = label_to_offset32(b.target);
             if (imm != 0) {
                 return {ebpf_inst{.opcode = INST_OP_JA32, .imm = imm}};
             } else {
@@ -231,8 +231,8 @@ struct MarshalVisitor {
         }
     }
 
-    vector<ebpf_inst> operator()(Mem const& b) {
-        Deref access = b.access;
+    vector<ebpf_inst> operator()(Mem const& b) const {
+        const Deref access = b.access;
         ebpf_inst res{
             .opcode = static_cast<uint8_t>(INST_MODE_MEM | width_to_opcode(access.width)),
             .dst = 0,
@@ -245,7 +245,7 @@ struct MarshalVisitor {
             }
             res.opcode |= INST_CLS_LD | 0x1;
             res.dst = static_cast<uint8_t>(std::get<Reg>(b.value).v);
-            res.src = static_cast<uint8_t>(access.basereg.v);
+            res.src = access.basereg.v;
         } else {
             res.opcode |= INST_CLS_ST;
             res.dst = access.basereg.v;
@@ -260,7 +260,7 @@ struct MarshalVisitor {
         return {res};
     }
 
-    vector<ebpf_inst> operator()(Packet const& b) {
+    vector<ebpf_inst> operator()(Packet const& b) const {
         ebpf_inst res{
             .opcode = static_cast<uint8_t>(INST_CLS_LD | width_to_opcode(b.width)),
             .dst = 0,
@@ -277,8 +277,8 @@ struct MarshalVisitor {
         return {res};
     }
 
-    vector<ebpf_inst> operator()(Atomic const& b) {
-        int32_t imm = (int32_t)b.op;
+    vector<ebpf_inst> operator()(Atomic const& b) const {
+        int32_t imm = static_cast<int32_t>(b.op);
         if (b.fetch) {
             imm |= INST_FETCH;
         }
@@ -290,25 +290,13 @@ struct MarshalVisitor {
                       .imm = imm}};
     }
 
-    vector<ebpf_inst> operator()(IncrementLoopCounter const& ins) { return {}; }
+    vector<ebpf_inst> operator()(IncrementLoopCounter const&) const { return {}; }
 };
 
-vector<ebpf_inst> marshal(const Instruction& ins, pc_t pc) {
+vector<ebpf_inst> marshal(const Instruction& ins, const pc_t pc) {
     return std::visit(MarshalVisitor{label_to_offset16(pc), label_to_offset32(pc)}, ins);
 }
 
-vector<ebpf_inst> marshal(const vector<Instruction>& insts) {
-    vector<ebpf_inst> res;
-    pc_t pc = 0;
-    for (const auto& ins : insts) {
-        for (auto e : marshal(ins, pc)) {
-            pc++;
-            res.push_back(e);
-        }
-    }
-    return res;
-}
-
 static int size(const Instruction& inst) {
     if (const auto pins = std::get_if<Bin>(&inst)) {
         if (pins->lddw) {
@@ -333,7 +321,7 @@ static auto get_labels(const InstructionSeq& insts) {
 
 vector<ebpf_inst> marshal(const InstructionSeq& insts) {
     vector<ebpf_inst> res;
-    auto pc_of_label = get_labels(insts);
+    const auto pc_of_label = get_labels(insts);
     pc_t pc = 0;
     for (auto [label, ins, _] : insts) {
         (void)label; // unused
diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 798e626ba..de0550849 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -19,6 +19,8 @@
 
 namespace crab::domains {
 
+using index_t = uint64_t;
+
 static bool maybe_between(const NumAbsDomain& dom, const extended_number& x, const linear_expression_t& symb_lb,
                           const linear_expression_t& symb_ub) {
     using namespace dsl_syntax;
@@ -60,7 +62,7 @@ int radix_length(const offset_t& offset) {
 // Get a range of bits out of the middle of a key, starting at [begin] for a given length.
 [[maybe_unused]]
 offset_t radix_substr(const offset_t& key, const int begin, const int length) {
-    uint64_t mask;
+    index_t mask;
 
     if (length == offset_t::bitsize) {
         mask = 0;
@@ -79,11 +81,8 @@ offset_t radix_substr(const offset_t& key, const int begin, const int length) {
 // Concatenate two bit patterns.
 [[maybe_unused]]
 offset_t radix_join(const offset_t& entry1, const offset_t& entry2) {
-    const index_t value1 = (index_t)entry1;
-    const index_t value2 = (index_t)entry2;
-    const index_t value = value1 | (value2 >> entry1.prefix_length());
+    const index_t value = entry1 | (entry2 >> entry1.prefix_length());
     const int prefix_length = entry1.prefix_length() + entry2.prefix_length();
-
     return offset_t{value, prefix_length};
 }
 
@@ -491,7 +490,7 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         return;
     }
     auto size = static_cast<unsigned int>(*n_bytes);
-    offset_t o(static_cast<uint64_t>(*n));
+    offset_t o(static_cast<index_t>(*n));
 
     std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
     for (cell_t const& c : cells) {
@@ -500,7 +499,7 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         int cell_end_index = static_cast<int>(*intv.ub().number());
 
         if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) ||
-            cell_end_index + 1 < cell_start_index + sizeof(int64_t)) {
+            cell_end_index + 1UL < cell_start_index + sizeof(int64_t)) {
             // We can only split numeric cells of size 8 or less.
             continue;
         }
@@ -509,11 +508,11 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
             // We can only split cells with a singleton value.
             continue;
         }
-        if (cell_start_index < o) {
+        if (static_cast<index_t>(cell_start_index) < o) {
             // Use the bytes to the left of the specified range.
             split_cell(inv, kind, cell_start_index, static_cast<unsigned int>(o - cell_start_index));
         }
-        if (o + size - 1 < cell_end_index) {
+        if (o + size < cell_end_index + 1UL) {
             // Use the bytes to the right of the specified range.
             split_cell(inv, kind, static_cast<int>(o + size),
                        static_cast<unsigned int>(cell_end_index - (o + size - 1)));
@@ -535,7 +534,7 @@ static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDoma
         if (auto n_bytes = i_elem_size.singleton()) {
             auto size = static_cast<unsigned int>(*n_bytes);
             // -- Constant index: kill overlapping cells
-            offset_t o(static_cast<uint64_t>(*n));
+            offset_t o(static_cast<index_t>(*n));
             cells = offset_map.get_overlap_cells(o, size);
             res = std::make_pair(o, size);
         }
@@ -599,7 +598,7 @@ std::optional<uint8_t> get_value_byte(const NumAbsDomain& inv, const offset_t o,
     if (!t) {
         return {};
     }
-    uint64_t n = t->cast_to<uint64_t>();
+    index_t n = t->cast_to<index_t>();
 
     // Convert value to bytes of the appropriate endian-ness.
     switch (width) {
@@ -618,11 +617,11 @@ std::optional<uint8_t> get_value_byte(const NumAbsDomain& inv, const offset_t o,
             n = boost::endian::native_to_little<uint32_t>(n);
         }
         break;
-    case sizeof(uint64_t):
+    case sizeof(index_t):
         if (thread_local_options.big_endian) {
-            n = boost::endian::native_to_big<uint64_t>(n);
+            n = boost::endian::native_to_big<index_t>(n);
         } else {
-            n = boost::endian::native_to_little<uint64_t>(n);
+            n = boost::endian::native_to_little<index_t>(n);
         }
         break;
     default: CRAB_ERROR("Unexpected width ", width);
@@ -700,11 +699,11 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
                     return b;
                 }
                 if (size == 8) {
-                    uint64_t b = *reinterpret_cast<uint64_t*>(result_buffer);
+                    index_t b = *reinterpret_cast<index_t*>(result_buffer);
                     if (thread_local_options.big_endian) {
-                        b = boost::endian::native_to_big<uint64_t>(b);
+                        b = boost::endian::native_to_big<index_t>(b);
                     } else {
-                        b = boost::endian::native_to_little<uint64_t>(b);
+                        b = boost::endian::native_to_little<index_t>(b);
                     }
                     return kind == data_kind_t::uvalues ? number_t(b) : number_t(static_cast<int64_t>(b));
                 }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index a4534c9e8..f3c35cbf8 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2510,6 +2510,9 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             type_inv.assign_type(m_inv, bin.dst, T_NUM);
             havoc_offsets(bin.dst);
             break;
+        case Bin::Op::MOVSX8:
+        case Bin::Op::MOVSX16:
+        case Bin::Op::MOVSX32: CRAB_ERROR("Unsupported operation");
         case Bin::Op::ADD:
             if (imm == 0) {
                 return;
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 4baee4589..1672db5c3 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1168,7 +1168,7 @@ string_invariant SplitDBM::to_set() const {
 std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
 bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& out) const {
-    bool overflow = convert_NtoW_overflow(e.constant_term(), out);
+    [[maybe_unused]] bool overflow = convert_NtoW_overflow(e.constant_term(), out);
     assert(!overflow);
     for (const auto& [variable, coefficient] : e.variable_terms()) {
         Weight coef;
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index bf768e629..9267f7876 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -11,10 +11,6 @@
 #include "crab_utils/lazy_allocator.hpp"
 #include "crab_utils/num_big.hpp"
 
-using index_t = uint64_t;
-
-/* Basic type definitions */
-
 namespace crab {
 
 std::vector<std::string> default_variable_names();
@@ -22,22 +18,22 @@ std::vector<std::string> default_variable_names();
 // Wrapper for typed variables used by the crab abstract domains and linear_constraints.
 // Being a class (instead of a type alias) enables overloading in dsl_syntax
 class variable_t final {
-    index_t _id;
+    uint64_t _id;
 
-    explicit variable_t(index_t id) : _id(id) {}
+    explicit variable_t(const uint64_t id) : _id(id) {}
 
   public:
     [[nodiscard]]
     std::size_t hash() const {
-        return (size_t)_id;
+        return _id;
     }
 
-    bool operator==(variable_t o) const { return _id == o._id; }
+    bool operator==(const variable_t o) const { return _id == o._id; }
 
-    bool operator!=(variable_t o) const { return (!(operator==(o))); }
+    bool operator!=(const variable_t o) const { return (!(operator==(o))); }
 
     // for flat_map
-    bool operator<(variable_t o) const { return _id < o._id; }
+    bool operator<(const variable_t o) const { return _id < o._id; }
 
     [[nodiscard]]
     std::string name() const {
@@ -54,7 +50,7 @@ class variable_t final {
         return names->at(_id).find(".uvalue") != std::string::npos;
     }
 
-    friend std::ostream& operator<<(std::ostream& o, variable_t v) { return o << names->at(v._id); }
+    friend std::ostream& operator<<(std::ostream& o, const variable_t v) { return o << names->at(v._id); }
 
     // var_factory portion.
     // This singleton is eBPF-specific, to avoid lifetime issues and/or passing factory explicitly everywhere:

From 21818e018d489d2e02800ed893db58d730ba3bce Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 16:02:40 +0300
Subject: [PATCH 265/373] Cleanup and modernize (#706)

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_cfg.cpp           |  8 ++--
 src/asm_files.cpp         |  2 +-
 src/asm_marshal.cpp       |  4 +-
 src/asm_ostream.cpp       |  2 +-
 src/asm_ostream.hpp       | 46 +++++++++++----------
 src/asm_parse.cpp         | 65 ++++++++++++++----------------
 src/asm_parse.hpp         |  2 -
 src/asm_syntax.hpp        | 11 ++---
 src/asm_unmarshal.cpp     | 51 ++++++++++-------------
 src/assertions.cpp        | 14 +++----
 src/crab/split_dbm.cpp    |  3 +-
 src/crab_verifier.cpp     | 19 +++++----
 src/crab_verifier.hpp     |  4 +-
 src/ebpf_vm_isa.hpp       |  8 +++-
 src/ebpf_yaml.cpp         | 27 ++++++-------
 src/test/test_marshal.cpp | 85 ++++++++++++++++++++-------------------
 16 files changed, 173 insertions(+), 178 deletions(-)

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 37afdbf29..84fd81790 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -73,10 +73,10 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
         const label_t label(macro_label.from, macro_label.to, stack_frame_prefix);
         auto& bb = cfg.insert(label);
         for (auto inst : cfg.get_node(macro_label)) {
-            if (const auto pins = std::get_if<Exit>(&inst)) {
-                pins->stack_frame_prefix = label.stack_frame_prefix;
-            } else if (const auto pins = std::get_if<Call>(&inst)) {
-                pins->stack_frame_prefix = label.stack_frame_prefix;
+            if (const auto pexit = std::get_if<Exit>(&inst)) {
+                pexit->stack_frame_prefix = label.stack_frame_prefix;
+            } else if (const auto pcall = std::get_if<Call>(&inst)) {
+                pcall->stack_frame_prefix = label.stack_frame_prefix;
             }
             bb.insert(inst);
         }
diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index f6134e4c8..d39c365f3 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -250,7 +250,7 @@ static void append_subprograms(raw_program& prog, const vector<raw_program>& pro
 
         // Fill in the PC offset into the imm field of the CallLocal instruction.
         const ELFIO::Elf_Xword target_offset = subprogram_offsets[reloc.target_function_name];
-        const int64_t offset_diff = static_cast<int64_t>(target_offset - reloc.source_offset - 1);
+        const auto offset_diff = static_cast<int64_t>(target_offset - reloc.source_offset - 1);
         if (offset_diff < std::numeric_limits<int32_t>::min() || offset_diff > std::numeric_limits<int32_t>::max()) {
             throw std::runtime_error("Offset difference out of int32_t range for instruction at source offset " +
                                      std::to_string(reloc.source_offset));
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 155b3f665..9df6aead9 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -278,7 +278,7 @@ struct MarshalVisitor {
     }
 
     vector<ebpf_inst> operator()(Atomic const& b) const {
-        int32_t imm = static_cast<int32_t>(b.op);
+        auto imm = static_cast<int32_t>(b.op);
         if (b.fetch) {
             imm |= INST_FETCH;
         }
@@ -312,7 +312,7 @@ static int size(const Instruction& inst) {
 static auto get_labels(const InstructionSeq& insts) {
     pc_t pc = 0;
     std::map<label_t, pc_t> pc_of_label;
-    for (auto [label, inst, _] : insts) {
+    for (const auto& [label, inst, _] : insts) {
         pc_of_label[label] = pc;
         pc += size(inst);
     }
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index e2e9f3169..e457d6c80 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -392,7 +392,7 @@ int size(const Instruction& inst) {
 auto get_labels(const InstructionSeq& insts) {
     pc_t pc = 0;
     std::map<label_t, pc_t> pc_of_label;
-    for (auto [label, inst, _] : insts) {
+    for (const auto& [label, inst, _] : insts) {
         pc_of_label[label] = pc;
         pc += size(inst);
     }
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index db8f998a7..d357acd2c 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -13,17 +13,19 @@
 // We use a 16-bit offset whenever it fits in 16 bits.
 inline std::function<int16_t(label_t)> label_to_offset16(pc_t pc) {
     return [=](const label_t& label) {
-        int64_t offset = label.from - (int64_t)pc - 1;
-        return (offset >= INT16_MIN && offset <= INT16_MAX) ? (int16_t)offset : 0;
+        const int64_t offset = label.from - static_cast<int64_t>(pc) - 1;
+        return std::numeric_limits<int16_t>::min() <= offset && offset <= std::numeric_limits<int16_t>::max()
+                   ? static_cast<int16_t>(offset)
+                   : 0;
     };
 }
 
 // We use the JA32 opcode with the offset in 'imm' when the offset
 // of an unconditional jump doesn't fit in a int16_t.
-inline std::function<int32_t(label_t)> label_to_offset32(pc_t pc) {
+inline std::function<int32_t(label_t)> label_to_offset32(const pc_t pc) {
     return [=](const label_t& label) {
-        int64_t offset = label.from - (int64_t)pc - 1;
-        return (offset >= INT16_MIN && offset <= INT16_MAX) ? 0 : (int32_t)offset;
+        int64_t offset = label.from - static_cast<int64_t>(pc) - 1;
+        return (offset >= INT16_MIN && offset <= INT16_MAX) ? 0 : static_cast<int32_t>(offset);
     };
 }
 
@@ -40,8 +42,8 @@ std::string to_string(Instruction const& ins);
 std::ostream& operator<<(std::ostream& os, Bin::Op op);
 std::ostream& operator<<(std::ostream& os, Condition::Op op);
 
-inline std::ostream& operator<<(std::ostream& os, Imm imm) { return os << (int64_t)imm.v; }
-inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << (int)a.v; }
+inline std::ostream& operator<<(std::ostream& os, const Imm imm) { return os << static_cast<int64_t>(imm.v); }
+inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << static_cast<int>(a.v); }
 inline std::ostream& operator<<(std::ostream& os, Value const& a) {
     if (auto pa = std::get_if<Imm>(&a)) {
         return os << *pa;
@@ -49,19 +51,21 @@ inline std::ostream& operator<<(std::ostream& os, Value const& a) {
     return os << std::get<Reg>(a);
 }
 
-inline std::ostream& operator<<(std::ostream& os, Undefined const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Callx const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Atomic const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << (Instruction)a; }
-inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) { return os << (Instruction)a; }
+inline std::ostream& operator<<(std::ostream& os, Undefined const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Callx const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Atomic const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << static_cast<Instruction>(a); }
+inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) {
+    return os << static_cast<Instruction>(a);
+}
 std::ostream& operator<<(std::ostream& os, AssertionConstraint const& a);
 std::string to_string(AssertionConstraint const& constraint);
diff --git a/src/asm_parse.cpp b/src/asm_parse.cpp
index bba263b25..8488dee51 100644
--- a/src/asm_parse.cpp
+++ b/src/asm_parse.cpp
@@ -85,33 +85,35 @@ static const std::map<std::string, int> str_to_width = {
     {"64", 8},
 };
 
+static bool is64_reg(const std::string& s) { return s.at(0) == 'r'; }
+
 static Reg reg(const std::string& s) {
     assert(s.at(0) == 'r' || s.at(0) == 'w');
-    uint8_t res = (uint8_t)boost::lexical_cast<uint16_t>(s.substr(1));
+    const uint8_t res = static_cast<uint8_t>(boost::lexical_cast<uint16_t>(s.substr(1)));
     return Reg{res};
 }
 
 static Imm imm(const std::string& s, bool lddw) {
-    int base = s.find("0x") != std::string::npos ? 16 : 10;
+    const int base = s.find("0x") != std::string::npos ? 16 : 10;
 
     if (lddw) {
         if (s.at(0) == '-') {
-            return Imm{(uint64_t)std::stoll(s, nullptr, base)};
+            return Imm{static_cast<uint64_t>(std::stoll(s, nullptr, base))};
         } else {
             return Imm{std::stoull(s, nullptr, base)};
         }
     } else {
         if (s.at(0) == '-') {
-            return Imm{(uint64_t)(int64_t)std::stol(s, nullptr, base)};
+            return Imm{static_cast<uint64_t>(std::stol(s, nullptr, base))};
         } else {
-            return Imm{(uint64_t)(int64_t)(int32_t)std::stoul(s, nullptr, base)};
+            return Imm{static_cast<uint64_t>(static_cast<int64_t>(static_cast<int32_t>(std::stoul(s, nullptr, base))))};
         }
     }
 }
 
-static number_t signed_number(const std::string& s) { return static_cast<int64_t>(std::stoll(s)); }
+static number_t signed_number(const std::string& s) { return std::stoll(s); }
 
-static number_t unsigned_number(const std::string& s) { return static_cast<uint64_t>(std::stoull(s)); }
+static number_t unsigned_number(const std::string& s) { return std::stoull(s); }
 
 static Value reg_or_imm(const std::string& s) {
     if (s.at(0) == 'w' || s.at(0) == 'r') {
@@ -123,7 +125,7 @@ static Value reg_or_imm(const std::string& s) {
 
 static Deref deref(const std::string& width, const std::string& basereg, const std::string& sign,
                    const std::string& _offset) {
-    int offset = boost::lexical_cast<int>(_offset);
+    const int offset = boost::lexical_cast<int>(_offset);
     return Deref{
         .width = str_to_width.at(width),
         .basereg = reg(basereg),
@@ -134,7 +136,7 @@ static Deref deref(const std::string& width, const std::string& basereg, const s
 Instruction parse_instruction(const std::string& line, const std::map<std::string, label_t>& label_name_to_label) {
     // treat ";" as a comment
     std::string text = line.substr(0, line.find(';'));
-    size_t end = text.find_last_not_of(" ");
+    const size_t end = text.find_last_not_of(' ');
     if (end != std::string::npos) {
         text = text.substr(0, end + 1);
     }
@@ -143,7 +145,7 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         return Exit{};
     }
     if (regex_match(text, m, regex("call " FUNC))) {
-        int func = boost::lexical_cast<int>(m[1]);
+        const int func = boost::lexical_cast<int>(m[1]);
         return make_call(func, g_ebpf_platform_linux);
     }
     if (regex_match(text, m, regex("call " WRAPPED_LABEL))) {
@@ -153,22 +155,19 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         return Callx{reg(m[1])};
     }
     if (regex_match(text, m, regex(WREG OPASSIGN REG))) {
-        std::string r = m[1];
-        return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = reg(m[3]), .is64 = r.at(0) != 'w', .lddw = false};
+        const std::string r = m[1];
+        return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = reg(m[3]), .is64 = is64_reg(r), .lddw = false};
     }
     if (regex_match(text, m, regex(WREG ASSIGN UNOP WREG))) {
         if (m[1] != m[3]) {
             throw std::invalid_argument(std::string("Invalid unary operation: ") + text);
         }
-        std::string r = m[1];
-        bool is64 = r.at(0) != 'w';
-        return Un{.op = str_to_unop.at(m[2]), .dst = reg(m[1]), .is64 = is64};
+        return Un{.op = str_to_unop.at(m[2]), .dst = reg(m[1]), .is64 = is64_reg(m[1])};
     }
     if (regex_match(text, m, regex(WREG OPASSIGN IMM LONGLONG))) {
-        std::string r = m[1];
-        bool is64 = r.at(0) != 'w';
-        bool lddw = !m[4].str().empty();
-        return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = imm(m[3], lddw), .is64 = is64, .lddw = lddw};
+        const std::string r = m[1];
+        const bool lddw = !m[4].str().empty();
+        return Bin{.op = str_to_binop.at(m[2]), .dst = reg(r), .v = imm(m[3], lddw), .is64 = is64_reg(r), .lddw = lddw};
     }
     if (regex_match(text, m, regex(REG ASSIGN DEREF PAREN(REG PLUSMINUS IMM)))) {
         return Mem{
@@ -185,44 +184,40 @@ Instruction parse_instruction(const std::string& line, const std::map<std::strin
         };
     }
     if (regex_match(text, m, regex("lock " DEREF PAREN(REG PLUSMINUS IMM) " " ATOMICOP " " REG "( fetch)?"))) {
-        Atomic::Op op = str_to_atomicop.at(m[5]);
+        const Atomic::Op op = str_to_atomicop.at(m[5]);
         return Atomic{.op = op,
                       .fetch = m[7].matched || op == Atomic::Op::XCHG || op == Atomic::Op::CMPXCHG,
                       .access = deref(m[1], m[2], m[3], m[4]),
                       .valreg = reg(m[6])};
     }
     if (regex_match(text, m, regex("r0 = " DEREF "skb\\[(.*)\\]"))) {
-        auto width = str_to_width.at(m[1]);
-        std::string access = m[2].str();
+        const auto width = str_to_width.at(m[1]);
+        const std::string access = m[2].str();
         if (regex_match(access, m, regex(REG))) {
             return Packet{.width = width, .offset = 0, .regoffset = reg(m[1])};
         }
         if (regex_match(access, m, regex(IMM))) {
-            return Packet{.width = width, .offset = (int32_t)imm(m[1], false).v, .regoffset = {}};
+            return Packet{.width = width, .offset = static_cast<int32_t>(imm(m[1], false).v), .regoffset = {}};
         }
         if (regex_match(access, m, regex(REG PLUSMINUS REG))) {
             return Packet{.width = width, .offset = 0 /* ? */, .regoffset = reg(m[2])};
         }
         if (regex_match(access, m, regex(REG PLUSMINUS IMM))) {
-            return Packet{.width = width, .offset = (int32_t)imm(m[2], false).v, .regoffset = reg(m[1])};
+            return Packet{.width = width, .offset = static_cast<int32_t>(imm(m[2], false).v), .regoffset = reg(m[1])};
         }
         return Undefined{0};
     }
     if (regex_match(text, m, regex("assume " WREG CMPOP REG_OR_IMM))) {
-        Assume res{Condition{.op = str_to_cmpop.at(m[2]),
-                             .left = reg(m[1]),
-                             .right = reg_or_imm(m[3]),
-                             .is64 = (((const std::string&)m[1]).at(0) == 'r')}};
+        Assume res{Condition{
+            .op = str_to_cmpop.at(m[2]), .left = reg(m[1]), .right = reg_or_imm(m[3]), .is64 = is64_reg(m[1])}};
         return res;
     }
     if (regex_match(text, m, regex("(?:if " WREG CMPOP REG_OR_IMM " )?goto\\s+(?:" IMM ")?" WRAPPED_LABEL))) {
         // We ignore second IMM
         Jmp res{.cond = {}, .target = label_name_to_label.at(m[5])};
         if (m[1].matched) {
-            res.cond = Condition{.op = str_to_cmpop.at(m[2]),
-                                 .left = reg(m[1]),
-                                 .right = reg_or_imm(m[3]),
-                                 .is64 = (((const std::string&)m[1]).at(0) == 'r')};
+            res.cond = Condition{
+                .op = str_to_cmpop.at(m[2]), .left = reg(m[1]), .right = reg_or_imm(m[3]), .is64 = is64_reg(m[1])};
         }
         return res;
     }
@@ -234,7 +229,7 @@ static InstructionSeq parse_program(std::istream& is) {
     std::string line;
     std::vector<label_t> pc_to_label;
     InstructionSeq labeled_insts;
-    std::set<label_t> seen_labels;
+    const std::set<label_t> seen_labels;
     std::optional<label_t> next_label;
     while (std::getline(is, line)) {
         std::smatch m;
@@ -265,7 +260,7 @@ static InstructionSeq parse_program(std::istream& is) {
     return labeled_insts;
 }
 
-static uint8_t regnum(const std::string& s) { return (uint8_t)boost::lexical_cast<uint16_t>(s.substr(1)); }
+static uint8_t regnum(const std::string& s) { return static_cast<uint8_t>(boost::lexical_cast<uint16_t>(s.substr(1))); }
 
 static crab::variable_t special_var(const std::string& s) {
     if (s == "packet_size") {
@@ -413,7 +408,7 @@ std::ostream& operator<<(std::ostream& o, const string_invariant& inv) {
         } else {
             o << ", ";
         }
-        size_t pos = item.find_first_of(".=[");
+        const size_t pos = item.find_first_of(".=[");
         std::string base = item.substr(0, pos);
         if (base != lastbase) {
             o << "\n    ";
diff --git a/src/asm_parse.hpp b/src/asm_parse.hpp
index b0e66f6b7..212aca97f 100644
--- a/src/asm_parse.hpp
+++ b/src/asm_parse.hpp
@@ -3,8 +3,6 @@
 #pragma once
 
 #include <string>
-#include <tuple>
-#include <vector>
 
 #include "asm_syntax.hpp"
 
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 3cc7c0992..9e7d13ab1 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -5,6 +5,7 @@
 #include <optional>
 #include <string>
 #include <tuple>
+#include <utility>
 #include <variant>
 #include <vector>
 
@@ -19,8 +20,8 @@ struct label_t {
     int to;                         ///< Jump target or -1
     std::string stack_frame_prefix; ///< Variable prefix when calling this label.
 
-    explicit label_t(int index, int to = -1, std::string stack_frame_prefix = {}) noexcept
-        : from(index), to(to), stack_frame_prefix(stack_frame_prefix) {}
+    explicit label_t(const int index, const int to = -1, std::string stack_frame_prefix = {}) noexcept
+        : from(index), to(to), stack_frame_prefix(std::move(stack_frame_prefix)) {}
 
     static label_t make_jump(const label_t& src_label, const label_t& target_label) {
         return label_t{src_label.from, target_label.from, target_label.stack_frame_prefix};
@@ -138,7 +139,7 @@ struct Un {
         NEG,    // dst = -dst
     };
 
-    Op op;
+    Op op{};
     Reg dst;
     bool is64{};
     constexpr bool operator==(const Un&) const = default;
@@ -277,7 +278,7 @@ struct Atomic {
         CMPXCHG = 0xf0, // Only valid with fetch=true.
     };
 
-    Op op;
+    Op op{};
     bool fetch{};
     Deref access;
     Reg valreg;
@@ -389,7 +390,7 @@ using AssertionConstraint = std::variant<Comparable, Addable, ValidDivisor, Vali
 
 struct Assert {
     AssertionConstraint cst;
-    Assert(AssertionConstraint cst) : cst(cst) {}
+    Assert(AssertionConstraint cst) : cst(std::move(cst)) {}
     constexpr bool operator==(const Assert&) const = default;
 };
 
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index e319b3e3f..cae060d4d 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -17,9 +17,8 @@ int opcode_to_width(const uint8_t opcode) {
     case INST_SIZE_H: return 2;
     case INST_SIZE_W: return 4;
     case INST_SIZE_DW: return 8;
+    default: CRAB_ERROR("unexpected opcode", opcode);
     }
-    assert(false);
-    return {};
 }
 
 uint8_t width_to_opcode(const int width) {
@@ -28,9 +27,8 @@ uint8_t width_to_opcode(const int width) {
     case 2: return INST_SIZE_H;
     case 4: return INST_SIZE_W;
     case 8: return INST_SIZE_DW;
+    default: CRAB_ERROR("unexpected width", width);
     }
-    assert(false);
-    return {};
 }
 
 template <typename T>
@@ -65,8 +63,8 @@ static auto getMemIsLoad(const uint8_t opcode) -> bool {
     case INST_CLS_LDX: return true;
     case INST_CLS_ST:
     case INST_CLS_STX: return false;
+    default: CRAB_ERROR("unexpected opcode", opcode);
     }
-    return {};
 }
 
 static auto getMemWidth(const uint8_t opcode) -> int {
@@ -75,20 +73,10 @@ static auto getMemWidth(const uint8_t opcode) -> int {
     case INST_SIZE_H: return 2;
     case INST_SIZE_W: return 4;
     case INST_SIZE_DW: return 8;
+    default: CRAB_ERROR("unexpected opcode", opcode);
     }
-    return {};
 }
 
-// static auto getMemX(uint8_t opcode) -> bool {
-//     switch (opcode & INST_CLS_MASK) {
-//         case INST_CLS_LD : return false;
-//         case INST_CLS_ST : return false;
-//         case INST_CLS_LDX: return true;
-//         case INST_CLS_STX: return true;
-//     }
-//     return {};
-// }
-
 static Instruction shift32(const Reg dst, const Bin::Op op) {
     return Bin{.op = op, .dst = dst, .v = Imm{32}, .is64 = true, .lddw = false};
 }
@@ -137,6 +125,7 @@ struct Unmarshaller {
             case 32: return Bin::Op::MOVSX32;
             default: throw InvalidInstruction(pc, make_opcode_message("invalid offset for", inst.opcode));
             }
+        default: break;
         }
 
         // All the rest require a zero offset.
@@ -222,8 +211,8 @@ struct Unmarshaller {
             }
         case 0xe0: throw InvalidInstruction{pc, inst.opcode};
         case 0xf0: throw InvalidInstruction{pc, inst.opcode};
+        default: return {};
         }
-        return {};
     }
 
     static auto getAtomicOp(const size_t pc, const ebpf_inst inst) -> Atomic::Op {
@@ -251,13 +240,12 @@ struct Unmarshaller {
                 throw InvalidInstruction(pc, make_opcode_message("nonzero imm for", inst.opcode));
             }
             return Reg{inst.src};
-        } else {
-            if (inst.src != 0) {
-                throw InvalidInstruction{pc, inst.opcode};
-            }
-            // Imm is a signed 32-bit number.  Sign extend it to 64-bits for storage.
-            return Imm{sign_extend(inst.imm)};
         }
+        if (inst.src != 0) {
+            throw InvalidInstruction{pc, inst.opcode};
+        }
+        // Imm is a signed 32-bit number.  Sign extend it to 64-bits for storage.
+        return Imm{sign_extend(inst.imm)};
     }
 
     static auto getJmpOp(const size_t pc, const uint8_t opcode) -> Condition::Op {
@@ -279,8 +267,8 @@ struct Unmarshaller {
         case 0xd: return Op::SLE;
         case 0xe: throw InvalidInstruction(pc, opcode);
         case 0xf: throw InvalidInstruction(pc, opcode);
+        default: return {};
         }
-        return {};
     }
 
     auto makeMemOp(const pc_t pc, const ebpf_inst inst) -> Instruction {
@@ -424,6 +412,7 @@ struct Unmarshaller {
             getAluOp(pc, inst));
     }
 
+    [[nodiscard]]
     auto makeLddw(const ebpf_inst inst, const int32_t next_imm, const vector<ebpf_inst>& insts, const pc_t pc) const
         -> Instruction {
         if (!info.platform->supports_group(bpf_conformance_groups_t::base64)) {
@@ -487,7 +476,8 @@ struct Unmarshaller {
         return {};
     }
 
-    auto makeCall(const int32_t imm) const {
+    [[nodiscard]]
+    auto makeCall(const int32_t imm) const -> Call {
         const EbpfHelperPrototype proto = info.platform->get_helper_prototype(imm);
         if (proto.return_type == EBPF_RETURN_TYPE_UNSUPPORTED) {
             throw std::runtime_error(std::string("unsupported function: ") + proto.name);
@@ -559,13 +549,14 @@ struct Unmarshaller {
         const pc_t new_pc = pc + 1 + offset;
         if (new_pc >= insts.size()) {
             throw InvalidInstruction(pc, "jump out of bounds");
-        } else if (insts[new_pc].opcode == 0) {
+        }
+        if (insts[new_pc].opcode == 0) {
             throw InvalidInstruction(pc, "jump to middle of lddw");
         }
         return label_t{static_cast<int>(new_pc)};
     }
 
-    static auto makeCallLocal(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) {
+    static auto makeCallLocal(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) -> CallLocal {
         if (inst.opcode & INST_SRC_REG) {
             throw InvalidInstruction(pc, inst.opcode);
         }
@@ -575,7 +566,7 @@ struct Unmarshaller {
         return CallLocal{.target = getJumpTarget(inst.imm, insts, pc)};
     }
 
-    static auto makeCallx(const ebpf_inst inst, const pc_t pc) {
+    static auto makeCallx(const ebpf_inst inst, const pc_t pc) -> Callx {
         // callx puts the register number in the 'dst' field rather than the 'src' field.
         if (inst.dst > R10_STACK_POINTER) {
             throw InvalidInstruction(pc, "bad register");
@@ -593,6 +584,7 @@ struct Unmarshaller {
         return Callx{inst.dst};
     }
 
+    [[nodiscard]]
     auto makeJmp(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) const -> Instruction {
         switch ((inst.opcode >> 4) & 0xF) {
         case INST_CALL:
@@ -684,7 +676,7 @@ struct Unmarshaller {
                 if (inst.dst > R10_STACK_POINTER) {
                     throw InvalidInstruction(pc, "bad register");
                 }
-                if ((inst.opcode & INST_SRC_REG) && (inst.src > R10_STACK_POINTER)) {
+                if ((inst.opcode & INST_SRC_REG) && inst.src > R10_STACK_POINTER) {
                     throw InvalidInstruction(pc, "bad register");
                 }
             }
@@ -770,6 +762,7 @@ struct Unmarshaller {
                 }
                 break;
             }
+            default: CRAB_ERROR("invalid class: ", inst.opcode & INST_CLS_MASK);
             }
             if (pc == insts.size() - 1 && fallthrough) {
                 note("fallthrough in last instruction");
diff --git a/src/assertions.cpp b/src/assertions.cpp
index 5282ce100..34a3d2212 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -20,7 +20,7 @@ class AssertExtractor {
 
     static Imm imm(const Value& v) { return std::get<Imm>(v); }
 
-    static vector<Assert> zero_offset_ctx(Reg reg) {
+    static vector<Assert> zero_offset_ctx(const Reg reg) {
         vector<Assert> res;
         res.emplace_back(TypeConstraint{reg, TypeGroup::ctx});
         res.emplace_back(ZeroCtxOffset{reg});
@@ -31,27 +31,27 @@ class AssertExtractor {
     explicit AssertExtractor(program_info info, std::optional<label_t> label)
         : info{std::move(info)}, current_label(label) {}
 
-    vector<Assert> operator()(Undefined const& ins) const {
+    vector<Assert> operator()(Undefined const&) const {
         assert(false);
         return {};
     }
 
-    vector<Assert> operator()(Assert const& ins) const {
+    vector<Assert> operator()(Assert const&) const {
         assert(false);
         return {};
     }
 
-    vector<Assert> operator()(IncrementLoopCounter ins) const {
+    vector<Assert> operator()(IncrementLoopCounter) const {
         assert(false);
         return {};
     }
 
-    vector<Assert> operator()(LoadMapFd const& ins) const { return {}; }
+    vector<Assert> operator()(LoadMapFd const&) const { return {}; }
 
     /// Packet access implicitly uses R6, so verify that R6 still has a pointer to the context.
-    vector<Assert> operator()(Packet const& ins) const { return zero_offset_ctx({6}); }
+    vector<Assert> operator()(Packet const&) const { return zero_offset_ctx({6}); }
 
-    vector<Assert> operator()(Exit const& e) const {
+    vector<Assert> operator()(Exit const&) const {
         vector<Assert> res;
         if (current_label->stack_frame_prefix.empty()) {
             // Verify that Exit returns a number.
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 1672db5c3..9d844e82b 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1168,7 +1168,8 @@ string_invariant SplitDBM::to_set() const {
 std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
 bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& out) const {
-    [[maybe_unused]] bool overflow = convert_NtoW_overflow(e.constant_term(), out);
+    [[maybe_unused]]
+    bool overflow = convert_NtoW_overflow(e.constant_term(), out);
     assert(!overflow);
     for (const auto& [variable, coefficient] : e.variable_terms()) {
         Weight coef;
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index d7e720064..dc53011a2 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -47,18 +47,17 @@ struct checks_db final {
 
     [[nodiscard]]
     int get_max_loop_count() const {
-        auto m = this->max_loop_count.number();
+        const auto m = this->max_loop_count.number();
         if (m && m->fits<int32_t>()) {
             return m->cast_to<int32_t>();
-        } else {
-            return std::numeric_limits<int>::max();
         }
+        return std::numeric_limits<int>::max();
     }
     checks_db() = default;
 };
 
-static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invariants,
-                                 crab::invariant_table_t& post_invariants) {
+static checks_db generate_report(cfg_t& cfg, const crab::invariant_table_t& pre_invariants,
+                                 const crab::invariant_table_t& post_invariants) {
     checks_db m_db;
     for (const label_t& label : cfg.sorted_labels()) {
         basic_block_t& bb = cfg.get_node(label);
@@ -86,7 +85,7 @@ static checks_db generate_report(cfg_t& cfg, crab::invariant_table_t& pre_invari
                 }
             });
 
-        bool pre_bot = from_inv.is_bottom();
+        const bool pre_bot = from_inv.is_bottom();
 
         from_inv(bb);
 
@@ -127,14 +126,14 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
         }
     }
     os << "\n";
-    crab::number_t max_loop_count{100000};
+    const crab::number_t max_loop_count{100000};
     if (db.max_loop_count > max_loop_count) {
         os << "Could not prove termination.\n";
     }
 }
 
-static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, crab::invariant_table_t& pre_invariants,
-                                     crab::invariant_table_t& post_invariants) {
+static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::invariant_table_t& pre_invariants,
+                                     const crab::invariant_table_t& post_invariants) {
     // Analyze the control-flow graph.
     checks_db db = generate_report(cfg, pre_invariants, post_invariants);
     if (thread_local_options.print_invariants) {
@@ -239,7 +238,7 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
         stats->total_warnings = report.total_warnings;
         stats->max_loop_count = report.get_max_loop_count();
     }
-    return (report.total_warnings == 0);
+    return report.total_warnings == 0;
 }
 
 void ebpf_verifier_clear_thread_local_state() {
diff --git a/src/crab_verifier.hpp b/src/crab_verifier.hpp
index 1f425085d..14eeb89a7 100644
--- a/src/crab_verifier.hpp
+++ b/src/crab_verifier.hpp
@@ -10,10 +10,10 @@
 bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, const ebpf_verifier_options_t* options,
                        ebpf_verifier_stats_t* stats);
 
-bool ebpf_verify_program(std::ostream& s, const InstructionSeq& prog, const program_info& info,
+bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const program_info& info,
                          const ebpf_verifier_options_t* options, ebpf_verifier_stats_t* stats);
 
-using string_invariant_map = std::map<crab::label_t, string_invariant>;
+using string_invariant_map = std::map<label_t, string_invariant>;
 
 std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& os, const InstructionSeq& prog,
                                                                  const string_invariant& entry_invariant,
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index ecad957f5..66a632053 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -105,5 +105,9 @@ enum {
 int opcode_to_width(uint8_t opcode);
 uint8_t width_to_opcode(int width);
 
-inline uint64_t merge(int32_t imm, int32_t next_imm) { return (((uint64_t)next_imm) << 32) | (uint32_t)imm; }
-inline std::tuple<int32_t, int32_t> split(uint64_t v) { return {(uint32_t)v, (uint32_t)(v >> 32)}; }
+inline uint64_t merge(const int32_t imm, const int32_t next_imm) {
+    return (static_cast<uint64_t>(next_imm) << 32) | static_cast<uint32_t>(imm);
+}
+inline std::tuple<int32_t, int32_t> split(const uint64_t v) {
+    return {static_cast<uint32_t>(v), static_cast<uint32_t>(v >> 32)};
+}
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 6a523d24e..593f8e24f 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -39,9 +39,8 @@ static EbpfHelperPrototype ebpf_get_helper_prototype(int32_t n) {
 
 static bool ebpf_is_helper_usable(int32_t n) { return g_ebpf_platform_linux.is_helper_usable(n); }
 
-static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>& map_descriptors, const char* data,
-                                    size_t map_record_size, int map_count, const struct ebpf_platform_t* platform,
-                                    ebpf_verifier_options_t options) {}
+static void ebpf_parse_maps_section(vector<EbpfMapDescriptor>&, const char*, size_t, int, const ebpf_platform_t*,
+                                    ebpf_verifier_options_t) {}
 
 static EbpfMapDescriptor test_map_descriptor = {.original_fd = 0,
                                                 .type = 0,
@@ -50,7 +49,7 @@ static EbpfMapDescriptor test_map_descriptor = {.original_fd = 0,
                                                 .max_entries = 4,
                                                 .inner_map_fd = 0};
 
-static EbpfMapDescriptor& ebpf_get_map_descriptor(int map_fd) { return test_map_descriptor; }
+static EbpfMapDescriptor& ebpf_get_map_descriptor(int) { return test_map_descriptor; }
 
 ebpf_platform_t g_platform_test = {.get_program_type = ebpf_get_program_type,
                                    .get_helper_prototype = ebpf_get_helper_prototype,
@@ -63,7 +62,7 @@ ebpf_platform_t g_platform_test = {.get_program_type = ebpf_get_program_type,
                                                                    bpf_conformance_groups_t::packet |
                                                                    bpf_conformance_groups_t::callx};
 
-static EbpfProgramType make_program_type(const string& name, ebpf_context_descriptor_t* context_descriptor) {
+static EbpfProgramType make_program_type(const string& name, const ebpf_context_descriptor_t* context_descriptor) {
     return EbpfProgramType{.name = name,
                            .context_descriptor = context_descriptor,
                            .platform_specific_data = 0,
@@ -81,12 +80,12 @@ static std::set<string> vector_to_set(const vector<string>& s) {
 
 std::set<string> operator-(const std::set<string>& a, const std::set<string>& b) {
     std::set<string> res;
-    std::set_difference(a.begin(), a.end(), b.begin(), b.end(), std::inserter(res, res.begin()));
+    std::ranges::set_difference(a, b, std::inserter(res, res.begin()));
     return res;
 }
 
 static string_invariant read_invariant(const vector<string>& raw_invariant) {
-    std::set<string> res = vector_to_set(raw_invariant);
+    const std::set<string> res = vector_to_set(raw_invariant);
     if (res == std::set<string>{"_|_"}) {
         return string_invariant{};
     }
@@ -145,7 +144,7 @@ static InstructionSeq raw_cfg_to_instruction_seq(const vector<std::tuple<string,
     for (const auto& [label_name, raw_block] : raw_blocks) {
         label_name_to_label.emplace(label_name, label_index);
         // don't count large instructions as 2
-        label_index += (int)raw_block.size();
+        label_index += static_cast<int>(raw_block.size());
     }
 
     InstructionSeq res;
@@ -267,16 +266,16 @@ std::optional<Failure> run_yaml_test_case(TestCase test_case, bool debug) {
 template <typename T>
 static vector<T> vector_of(const std::vector<uint8_t>& bytes) {
     auto data = bytes.data();
-    auto size = bytes.size();
+    const auto size = bytes.size();
     if ((size % sizeof(T) != 0) || size > std::numeric_limits<uint32_t>::max() || !data) {
         throw std::runtime_error("Invalid argument to vector_of");
     }
-    return {(T*)data, (T*)(data + size)};
+    return {reinterpret_cast<const T*>(data), reinterpret_cast<const T*>(data + size)};
 }
 
 template <typename TS>
 void add_stack_variable(std::set<std::string>& more, int& offset, const std::vector<uint8_t>& memory_bytes) {
-    typedef typename std::make_unsigned<TS>::type TU;
+    using TU = std::make_unsigned_t<TS>;
     TS svalue;
     TU uvalue;
     memcpy(&svalue, memory_bytes.data() + offset + memory_bytes.size() - EBPF_STACK_SIZE, sizeof(TS));
@@ -297,7 +296,7 @@ string_invariant stack_contents_invariant(const std::vector<uint8_t>& memory_byt
                                   "s[" + std::to_string(EBPF_STACK_SIZE - memory_bytes.size()) + "..." +
                                       std::to_string(EBPF_STACK_SIZE - 1) + "].type=number"};
 
-    int offset = EBPF_STACK_SIZE - (int)memory_bytes.size();
+    int offset = EBPF_STACK_SIZE - static_cast<int>(memory_bytes.size());
     if (offset % 2 != 0) {
         add_stack_variable<int8_t>(more, offset, memory_bytes);
     }
@@ -363,7 +362,7 @@ ConformanceTestResult run_conformance_test_case(const std::vector<uint8_t>& memo
                 crab::number_t lb, ub;
                 if (invariant[10] == '[') {
                     lb = std::stoll(invariant.substr(11));
-                    ub = std::stoll(invariant.substr(invariant.find(",", 11) + 1));
+                    ub = std::stoll(invariant.substr(invariant.find(',', 11) + 1));
                 } else {
                     lb = ub = std::stoll(invariant.substr(10));
                 }
@@ -412,7 +411,7 @@ void print_failure(const Failure& failure, std::ostream& out) {
 bool all_suites(const string& path) {
     bool result = true;
     for (const TestCase& test_case : read_suite(path)) {
-        result = result && bool(run_yaml_test_case(test_case));
+        result = result && static_cast<bool>(run_yaml_test_case(test_case));
     }
     return result;
 }
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index ec54569d0..975079516 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -204,18 +204,19 @@ static const ebpf_instruction_template_t instruction_template[] = {
 
 // Verify that we can successfully unmarshal an instruction.
 static void check_unmarshal_succeed(const ebpf_inst& ins, const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
+    const program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
+    const InstructionSeq parsed =
+        std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
 
 // Verify that we can successfully unmarshal a 64-bit immediate instruction.
 static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2,
                                     const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
-    InstructionSeq parsed =
+    const program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
+    const InstructionSeq parsed =
         std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {inst1, inst2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
 }
@@ -225,7 +226,7 @@ static void check_unmarshal_succeed(ebpf_inst inst1, ebpf_inst inst2,
 static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& expected_result,
                                       const ebpf_platform_t& platform = g_ebpf_platform_linux) {
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed = std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
     auto [_, single, _2] = parsed.front();
@@ -242,7 +243,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins, const ebpf_inst& exp
 static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& ins2, const ebpf_inst& expected_result) {
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed =
         std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
@@ -261,7 +262,7 @@ static void compare_unmarshal_marshal(const ebpf_inst& ins1, const ebpf_inst& in
                                       const ebpf_inst& expected_result2) {
     program_info info{.platform = &g_ebpf_platform_linux,
                       .type = g_ebpf_platform_linux.get_program_type("unspec", "unspec")};
-    const ebpf_inst exit{.opcode = INST_OP_EXIT};
+    constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
     InstructionSeq parsed =
         std::get<InstructionSeq>(unmarshal(raw_program{"", "", 0, "", {ins1, ins2, exit, exit}, info}));
     REQUIRE(parsed.size() == 3);
@@ -291,7 +292,7 @@ static void compare_marshal_unmarshal(const Instruction& ins, bool double_cmd =
 
 static void check_marshal_unmarshal_fail(const Instruction& ins, std::string expected_error_message,
                                          const ebpf_platform_t& platform = g_ebpf_platform_linux) {
-    program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
+    const program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::string error_message = std::get<std::string>(unmarshal(raw_program{"", "", 0, "", marshal(ins, 0), info}));
     REQUIRE(error_message == expected_error_message);
 }
@@ -301,7 +302,7 @@ static void check_unmarshal_fail(ebpf_inst inst, std::string expected_error_mess
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector insns = {inst};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    std::string* error_message = std::get_if<std::string>(&result);
+    auto* error_message = std::get_if<std::string>(&result);
     REQUIRE(error_message != nullptr);
     REQUIRE(*error_message == expected_error_message);
 }
@@ -312,7 +313,7 @@ static void check_unmarshal_fail_goto(ebpf_inst inst, const std::string& expecte
     constexpr ebpf_inst exit{.opcode = INST_OP_EXIT};
     std::vector insns{inst, exit, exit};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    std::string* error_message = std::get_if<std::string>(&result);
+    auto* error_message = std::get_if<std::string>(&result);
     REQUIRE(error_message != nullptr);
     REQUIRE(*error_message == expected_error_message);
 }
@@ -323,12 +324,12 @@ static void check_unmarshal_fail(ebpf_inst inst1, ebpf_inst inst2, std::string e
     program_info info{.platform = &platform, .type = platform.get_program_type("unspec", "unspec")};
     std::vector insns{inst1, inst2};
     auto result = unmarshal(raw_program{"", "", 0, "", insns, info});
-    std::string* error_message = std::get_if<std::string>(&result);
+    auto* error_message = std::get_if<std::string>(&result);
     REQUIRE(error_message != nullptr);
     REQUIRE(*error_message == expected_error_message);
 }
 
-static const auto ws = {1, 2, 4, 8};
+static constexpr auto ws = {1, 2, 4, 8};
 
 TEST_CASE("disasm_marshal", "[disasm][marshal]") {
     SECTION("Bin") {
@@ -498,7 +499,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
         Mem m{.access = access, .value = Reg{3}, .is_load = true};
         auto ins = marshal(m, 0).at(0);
         ebpf_inst expect{
-            .opcode = (uint8_t)(INST_CLS_LD | INST_MODE_MEM | width_to_opcode(1) | 0x1),
+            .opcode = static_cast<uint8_t>(INST_CLS_LD | INST_MODE_MEM | width_to_opcode(1) | 0x1),
             .dst = 3,
             .src = 4,
             .offset = 6,
@@ -536,7 +537,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
 
 TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
     SECTION("Load") {
-        for (int w : ws) {
+        for (const int w : ws) {
             Deref access;
             access.basereg = Reg{4};
             access.offset = 6;
@@ -553,7 +554,7 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
                                      "0: cannot modify r10\n");
     }
     SECTION("Store Register") {
-        for (int w : ws) {
+        for (const int w : ws) {
             Deref access;
             access.basereg = Reg{9};
             access.offset = 8;
@@ -562,7 +563,7 @@ TEST_CASE("disasm_marshal_Mem", "[disasm][marshal]") {
         }
     }
     SECTION("Store Immediate") {
-        for (int w : ws) {
+        for (const int w : ws) {
             Deref access;
             access.basereg = Reg{10};
             access.offset = 2;
@@ -605,7 +606,7 @@ static ebpf_platform_t get_template_platform(const ebpf_instruction_template_t&
 }
 
 // Check whether an instruction matches an instruction template that may have wildcards.
-static bool matches_template_inst(ebpf_inst inst, ebpf_inst template_inst) {
+static bool matches_template_inst(const ebpf_inst inst, const ebpf_inst template_inst) {
     if (inst.opcode != template_inst.opcode) {
         return false;
     }
@@ -627,9 +628,9 @@ static bool matches_template_inst(ebpf_inst inst, ebpf_inst template_inst) {
 
 // Check that various 'dst' variations between two valid instruction templates fail.
 static void check_instruction_dst_variations(const ebpf_instruction_template_t& previous_template,
-                                             std::optional<const ebpf_instruction_template_t> next_template) {
+                                             const std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
-    ebpf_platform_t platform = get_template_platform(previous_template);
+    const ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.dst == DST) {
         inst.dst = INVALID_REGISTER;
         check_unmarshal_instruction_fail(inst, "0: bad register\n", platform);
@@ -640,9 +641,9 @@ static void check_instruction_dst_variations(const ebpf_instruction_template_t&
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.dst == 1) {
-                oss << "0: nonzero dst for register op 0x" << std::hex << (int)inst.opcode << std::endl;
+                oss << "0: nonzero dst for register op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             } else {
-                oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
+                oss << "0: bad instruction op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             }
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
@@ -651,9 +652,9 @@ static void check_instruction_dst_variations(const ebpf_instruction_template_t&
 
 // Check that various 'src' variations between two valid instruction templates fail.
 static void check_instruction_src_variations(const ebpf_instruction_template_t& previous_template,
-                                             std::optional<const ebpf_instruction_template_t> next_template) {
+                                             const std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
-    ebpf_platform_t platform = get_template_platform(previous_template);
+    const ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.src == SRC) {
         inst.src = INVALID_REGISTER;
         check_unmarshal_instruction_fail(inst, "0: bad register\n", platform);
@@ -663,7 +664,7 @@ static void check_instruction_src_variations(const ebpf_instruction_template_t&
         inst.src++;
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
-            oss << "0: bad instruction op 0x" << std::hex << (int)inst.opcode << std::endl;
+            oss << "0: bad instruction op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
     }
@@ -671,9 +672,9 @@ static void check_instruction_src_variations(const ebpf_instruction_template_t&
 
 // Check that various 'offset' variations between two valid instruction templates fail.
 static void check_instruction_offset_variations(const ebpf_instruction_template_t& previous_template,
-                                                std::optional<const ebpf_instruction_template_t> next_template) {
+                                                const std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
-    ebpf_platform_t platform = get_template_platform(previous_template);
+    const ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.offset == JMP_OFFSET) {
         inst.offset = 0; // Not a valid jump offset.
         check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n", platform);
@@ -685,9 +686,9 @@ static void check_instruction_offset_variations(const ebpf_instruction_template_
             std::ostringstream oss;
             if (inst.offset == 1 &&
                 (!next_template || next_template->inst.opcode != inst.opcode || next_template->inst.offset == 0)) {
-                oss << "0: nonzero offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
+                oss << "0: nonzero offset for op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             } else {
-                oss << "0: invalid offset for op 0x" << std::hex << (int)inst.opcode << std::endl;
+                oss << "0: invalid offset for op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             }
             check_unmarshal_instruction_fail(inst, oss.str(), platform);
         }
@@ -696,9 +697,9 @@ static void check_instruction_offset_variations(const ebpf_instruction_template_
 
 // Check that various 'imm' variations between two valid instruction templates fail.
 static void check_instruction_imm_variations(const ebpf_instruction_template_t& previous_template,
-                                             std::optional<const ebpf_instruction_template_t> next_template) {
+                                             const std::optional<const ebpf_instruction_template_t> next_template) {
     ebpf_inst inst = previous_template.inst;
-    ebpf_platform_t platform = get_template_platform(previous_template);
+    const ebpf_platform_t platform = get_template_platform(previous_template);
     if (inst.imm == JMP_OFFSET) {
         inst.imm = 0; // Not a valid jump offset.
         check_unmarshal_instruction_fail(inst, "0: jump out of bounds\n", platform);
@@ -709,7 +710,7 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
         if (!next_template || !matches_template_inst(inst, next_template->inst)) {
             std::ostringstream oss;
             if (inst.imm == 1) {
-                oss << "0: nonzero imm for op 0x" << std::hex << (int)inst.opcode << std::endl;
+                oss << "0: nonzero imm for op 0x" << std::hex << static_cast<int>(inst.opcode) << std::endl;
             } else {
                 oss << "0: unsupported immediate" << std::endl;
             }
@@ -729,8 +730,8 @@ static void check_instruction_imm_variations(const ebpf_instruction_template_t&
 }
 
 // Check that various variations between two valid instruction templates fail.
-static void check_instruction_variations(std::optional<const ebpf_instruction_template_t> previous_template,
-                                         std::optional<const ebpf_instruction_template_t> next_template) {
+static void check_instruction_variations(const std::optional<const ebpf_instruction_template_t> previous_template,
+                                         const std::optional<const ebpf_instruction_template_t> next_template) {
     if (previous_template) {
         check_instruction_dst_variations(*previous_template, next_template);
         check_instruction_src_variations(*previous_template, next_template);
@@ -739,10 +740,10 @@ static void check_instruction_variations(std::optional<const ebpf_instruction_te
     }
 
     // Check any invalid opcodes in between the previous and next templates.
-    int previous_opcode = previous_template ? previous_template->inst.opcode : -1;
-    int next_opcode = next_template ? next_template->inst.opcode : 0x100;
+    const int previous_opcode = previous_template ? previous_template->inst.opcode : -1;
+    const int next_opcode = next_template ? next_template->inst.opcode : 0x100;
     for (int opcode = previous_opcode + 1; opcode < next_opcode; opcode++) {
-        ebpf_inst inst{.opcode = (uint8_t)opcode};
+        const ebpf_inst inst{.opcode = static_cast<uint8_t>(opcode)};
         std::ostringstream oss;
         oss << "0: bad instruction op 0x" << std::hex << opcode << std::endl;
         check_unmarshal_fail(inst, oss.str());
@@ -769,7 +770,7 @@ TEST_CASE("check unmarshal conformance groups", "[disasm][marshal]") {
         ebpf_platform_t platform = g_ebpf_platform_linux;
         platform.supported_conformance_groups &= ~current.groups;
         std::ostringstream oss;
-        oss << "0: bad instruction op 0x" << std::hex << (int)current.inst.opcode << std::endl;
+        oss << "0: bad instruction op 0x" << std::hex << static_cast<int>(current.inst.opcode) << std::endl;
         check_unmarshal_fail(current.inst, oss.str(), platform);
 
         // Try unmarshaling with support.
@@ -792,16 +793,16 @@ TEST_CASE("check unmarshal conformance groups", "[disasm][marshal]") {
 TEST_CASE("check unmarshal legacy opcodes", "[disasm][marshal]") {
     // The following opcodes are deprecated and should no longer be used.
     static uint8_t supported_legacy_opcodes[] = {0x20, 0x28, 0x30, 0x40, 0x48, 0x50};
-    for (uint8_t opcode : supported_legacy_opcodes) {
+    for (const uint8_t opcode : supported_legacy_opcodes) {
         compare_unmarshal_marshal(ebpf_inst{.opcode = opcode}, ebpf_inst{.opcode = opcode});
     }
 
     // Disable legacy packet instruction support.
     ebpf_platform_t platform = g_ebpf_platform_linux;
     platform.supported_conformance_groups &= ~bpf_conformance_groups_t::packet;
-    for (uint8_t opcode : supported_legacy_opcodes) {
+    for (const uint8_t opcode : supported_legacy_opcodes) {
         std::ostringstream oss;
-        oss << "0: bad instruction op 0x" << std::hex << (int)opcode << std::endl;
+        oss << "0: bad instruction op 0x" << std::hex << static_cast<int>(opcode) << std::endl;
         check_unmarshal_fail(ebpf_inst{.opcode = opcode}, oss.str(), platform);
     }
 }

From e6752ba70dd7b5bac729302b2ef76607d87ef382 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 00:22:32 +0300
Subject: [PATCH 266/373] use the radix_tree_20 fork

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 .gitmodules         | 2 +-
 external/radix_tree | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitmodules b/.gitmodules
index f12802369..3824945c1 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -3,7 +3,7 @@
 	url = https://github.com/vbpf/ebpf-samples.git
 [submodule "external/radix_tree"]
 	path = external/radix_tree
-	url = https://github.com/ytakano/radix_tree
+	url = https://github.com/elazarg/radix_tree_20
 [submodule "external/bpf_conformance"]
 	path = external/bpf_conformance
 	url = https://github.com/Alan-Jowett/bpf_conformance.git
diff --git a/external/radix_tree b/external/radix_tree
index f8bc846ef..b1792eb0a 160000
--- a/external/radix_tree
+++ b/external/radix_tree
@@ -1 +1 @@
-Subproject commit f8bc846ef1f00ee43af2ddc04af67d2e44d50685
+Subproject commit b1792eb0a8cd195bc55b17a37795c03335644ad4

From 4147cf6f1549dea6e42ac8cf30913c18b5bd0e02 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 20:06:35 +0300
Subject: [PATCH 267/373] number_t: rename operator T to narrow<T>

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp      | 30 ++++++++++----------
 src/crab/ebpf_domain.cpp       | 20 ++++++-------
 src/crab/interval.hpp          | 10 +++++--
 src/crab/linear_constraint.hpp | 16 +++++------
 src/crab/split_dbm.cpp         | 23 ++++++++-------
 src/crab/type_domain.cpp       |  6 ++--
 src/crab/var_factory.cpp       | 19 +++++++------
 src/crab/variable.hpp          |  2 +-
 src/crab_utils/num_big.hpp     |  8 +++---
 src/crab_utils/num_safeint.hpp | 52 +++++++++++++++++-----------------
 10 files changed, 96 insertions(+), 90 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index de0550849..8ad3dcc06 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -489,14 +489,14 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
         // We can only split a singleton size.
         return;
     }
-    auto size = static_cast<unsigned int>(*n_bytes);
-    offset_t o(static_cast<index_t>(*n));
+    auto size = n_bytes->narrow<unsigned int>();
+    offset_t o(n->narrow<index_t>());
 
     std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
     for (cell_t const& c : cells) {
         interval_t intv = c.to_interval();
-        int cell_start_index = static_cast<int>(*intv.lb().number());
-        int cell_end_index = static_cast<int>(*intv.ub().number());
+        int cell_start_index = intv.lb().number()->narrow<int>();
+        int cell_end_index = intv.ub().number()->narrow<int>();
 
         if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) ||
             cell_end_index + 1UL < cell_start_index + sizeof(int64_t)) {
@@ -532,9 +532,9 @@ static std::optional<std::pair<offset_t, unsigned>> kill_and_find_var(NumAbsDoma
     if (std::optional<number_t> n = ii.singleton()) {
         interval_t i_elem_size = inv.eval_interval(elem_size);
         if (auto n_bytes = i_elem_size.singleton()) {
-            auto size = static_cast<unsigned int>(*n_bytes);
+            auto size = n_bytes->narrow<unsigned int>();
             // -- Constant index: kill overlapping cells
-            offset_t o(static_cast<index_t>(*n));
+            offset_t o(n->narrow<index_t>());
             cells = offset_map.get_overlap_cells(o, size);
             res = std::make_pair(o, size);
         }
@@ -576,7 +576,7 @@ bool array_domain_t::all_num(const NumAbsDomain& inv, const linear_expression_t&
         return true;
     }
 
-    return this->num_bytes.all_num(static_cast<int32_t>(*min_lb), static_cast<int32_t>(*max_ub));
+    return this->num_bytes.all_num(min_lb->narrow<int32_t>(), max_ub->narrow<int32_t>());
 }
 
 // Get the number of bytes, starting at offset, that are known to be numbers.
@@ -586,8 +586,8 @@ int array_domain_t::min_all_num_size(const NumAbsDomain& inv, const variable_t o
     if (!min_lb || !max_ub || !min_lb->fits<int32_t>() || !max_ub->fits<int32_t>()) {
         return 0;
     }
-    const auto lb = static_cast<int>(min_lb.value());
-    const auto ub = static_cast<int>(max_ub.value());
+    const auto lb = min_lb->narrow<int>();
+    const auto ub = max_ub->narrow<int>();
     return std::max(0, this->num_bytes.all_num_width(lb) - (ub - lb));
 }
 
@@ -635,7 +635,7 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
     interval_t ii = inv.eval_interval(i);
     if (std::optional<number_t> n = ii.singleton()) {
         offset_map_t& offset_map = lookup_array_map(kind);
-        int64_t k = static_cast<int64_t>(*n);
+        int64_t k = n->narrow<int64_t>();
         if (kind == data_kind_t::types) {
             auto [only_num, only_non_num] = num_bytes.uniformity(k, width);
             if (only_num) {
@@ -730,9 +730,9 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
         auto ub = ii.ub().number();
         if (lb.has_value() && ub.has_value()) {
             number_t fullwidth = ub.value() - lb.value() + width;
-            if (lb.value().fits<uint32_t>() && fullwidth.fits<uint32_t>()) {
+            if (lb->fits<uint32_t>() && fullwidth.fits<uint32_t>()) {
                 auto [only_num, only_non_num] =
-                    num_bytes.uniformity(static_cast<uint32_t>(lb.value()), static_cast<uint32_t>(fullwidth));
+                    num_bytes.uniformity(lb->narrow<uint32_t>(), fullwidth.narrow<uint32_t>());
                 if (only_num) {
                     return T_NUM;
                 }
@@ -766,7 +766,7 @@ std::optional<variable_t> array_domain_t::store(NumAbsDomain& inv, const data_ki
         auto [offset, size] = *maybe_cell;
         if (kind == data_kind_t::types) {
             const std::optional<number_t> t = inv.eval_interval(val).singleton();
-            if (t && static_cast<int64_t>(*t) == T_NUM) {
+            if (t == number_t{T_NUM}) {
                 num_bytes.reset(offset, size);
             } else {
                 num_bytes.havoc(offset, size);
@@ -786,7 +786,7 @@ std::optional<variable_t> array_domain_t::store_type(NumAbsDomain& inv, const li
         // perform strong update
         auto [offset, size] = *maybe_cell;
         const std::optional<number_t> t = inv.eval_interval(val).singleton();
-        if (t && static_cast<int64_t>(*t) == T_NUM) {
+        if (t == number_t{T_NUM}) {
             num_bytes.reset(offset, size);
         } else {
             num_bytes.havoc(offset, size);
@@ -837,7 +837,7 @@ void array_domain_t::store_numbers(const NumAbsDomain& inv, const variable_t _id
                   "the number of elements is larger than default limit of ", max_num_elems);
         return;
     }
-    num_bytes.reset(static_cast<int>(*idx_n), static_cast<int>(*width));
+    num_bytes.reset(idx_n->narrow<size_t>(), width->narrow<int>());
 }
 
 void array_domain_t::set_to_top() { num_bytes.set_to_top(); }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index f3c35cbf8..06648c4bc 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1449,8 +1449,8 @@ bool ebpf_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd, i
     if (!lb || !lb->fits<int32_t>() || !ub || !ub->fits<int32_t>()) {
         return false;
     }
-    *start_fd = static_cast<int32_t>(lb.value());
-    *end_fd = static_cast<int32_t>(ub.value());
+    *start_fd = lb->narrow<int32_t>();
+    *end_fd = ub->narrow<int32_t>();
 
     // Cap the maximum range we'll check.
     constexpr int max_range = 32;
@@ -1578,14 +1578,14 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             require(m_inv, linear_constraint_t::false_const(), "Map key size is not singleton");
             return;
         }
-        width = static_cast<int>(key_size.value());
+        width = key_size->narrow<int>();
     } else {
         const auto value_size = get_map_value_size(s.map_fd_reg).singleton();
         if (!value_size.has_value()) {
             require(m_inv, linear_constraint_t::false_const(), "Map value size is not singleton");
             return;
         }
-        width = static_cast<int>(value_size.value());
+        width = value_size->narrow<int>();
     }
 
     m_inv = type_inv.join_over_types(m_inv, s.access_reg, [&](NumAbsDomain& inv, type_encoding_t access_reg_type) {
@@ -1594,11 +1594,9 @@ void ebpf_domain_t::operator()(const ValidMapKeyValue& s) {
             linear_expression_t ub = lb + width;
             if (!stack.all_num(inv, lb, ub)) {
                 auto lb_is = inv[lb].lb().number();
-                std::string lb_s =
-                    lb_is && lb_is->fits<int32_t>() ? std::to_string(static_cast<int32_t>(*lb_is)) : "-oo";
+                std::string lb_s = lb_is && lb_is->fits<int32_t>() ? std::to_string(lb_is->narrow<int32_t>()) : "-oo";
                 auto ub_is = inv.eval_interval(ub).ub().number();
-                std::string ub_s =
-                    ub_is && ub_is->fits<int32_t>() ? std::to_string(static_cast<int32_t>(*ub_is)) : "oo";
+                std::string ub_s = ub_is && ub_is->fits<int32_t>() ? std::to_string(ub_is->narrow<int32_t>()) : "oo";
                 require(inv, linear_constraint_t::false_const(),
                         "Illegal map update with a non-numerical value [" + lb_s + "-" + ub_s + ")");
             } else if (thread_local_options.strict && fd_type.has_value()) {
@@ -2377,7 +2375,7 @@ void ebpf_domain_t::lshr(const Reg& dst_reg, int imm, int finite_width) {
             }
         }
         m_inv.set(dst.uvalue, interval_t{lb_n, ub_n});
-        if (static_cast<int64_t>(ub_n) >= static_cast<int64_t>(lb_n)) {
+        if (ub_n.narrow<int64_t>() >= lb_n.narrow<int64_t>()) {
             // ? m_inv.set(dst.svalue, crab::interval_t{number_t{(int64_t)lb_n}, number_t{(int64_t)ub_n}});
             m_inv.assign(dst.svalue, dst.uvalue);
         } else {
@@ -2882,8 +2880,8 @@ ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& const
         inv += cst;
     }
     for (const interval_t& range : numeric_ranges) {
-        const int start = static_cast<int>(range.lb().number().value());
-        const int width = 1 + static_cast<int>(range.finite_size().value());
+        const int start = range.lb().number()->narrow<int>();
+        const int width = 1 + range.finite_size()->narrow<int>();
         inv.stack.initialize_numbers(start, width);
     }
     // TODO: handle other stack type constraints
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 22d5124f5..131b2eda4 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -86,14 +86,20 @@ class interval_t final {
         return {_lb, _ub};
     }
 
+    template <std::integral T>
+    [[nodiscard]]
+    std::tuple<T, T> pair() const {
+        return {_lb.number()->narrow<T>(), _ub.number()->narrow<T>()};
+    }
+
     template <std::integral T>
     [[nodiscard]]
     std::tuple<T, T> bound(T lb, T ub) const {
-        interval_t b = interval_t(lb, ub) & *this;
+        const interval_t b = interval_t(lb, ub) & *this;
         if (b.is_bottom()) {
             CRAB_ERROR("Cannot convert bottom to tuple");
         }
-        return {static_cast<T>(*b._lb.number()), static_cast<T>(*b._ub.number())};
+        return {b._lb.number()->narrow<T>(), _ub.number()->narrow<T>()};
     }
 
     template <is_enum T>
diff --git a/src/crab/linear_constraint.hpp b/src/crab/linear_constraint.hpp
index ed00a6c74..e7a64c589 100644
--- a/src/crab/linear_constraint.hpp
+++ b/src/crab/linear_constraint.hpp
@@ -34,12 +34,12 @@ class linear_constraint_t final {
         if (!_expression.is_constant()) {
             return false;
         }
-        number_t constant = _expression.constant_term();
+        const number_t constant = _expression.constant_term();
         switch (_constraint_kind) {
-        case constraint_kind_t::EQUALS_ZERO: return (constant == 0);
-        case constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO: return (constant <= 0);
-        case constraint_kind_t::LESS_THAN_ZERO: return (constant < 0);
-        case constraint_kind_t::NOT_ZERO: return (constant != 0);
+        case constraint_kind_t::EQUALS_ZERO: return constant == 0;
+        case constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO: return constant <= 0;
+        case constraint_kind_t::LESS_THAN_ZERO: return constant < 0;
+        case constraint_kind_t::NOT_ZERO: return constant != 0;
         default: throw std::exception();
         }
     }
@@ -90,9 +90,9 @@ inline std::ostream& operator<<(std::ostream& o, const linear_constraint_t& cons
         const auto& expression = constraint.expression();
         expression.output_variable_terms(o);
 
-        const char* constraint_kind_label[] = {" == ", " <= ", " < ", " != "};
-        int kind = (int)constraint.kind();
-        if (kind < 0 || kind >= (int)(sizeof(constraint_kind_label) / sizeof(*constraint_kind_label))) {
+        constexpr std::array constraint_kind_label{" == ", " <= ", " < ", " != "};
+        const size_t kind = static_cast<size_t>(constraint.kind());
+        if (kind >= std::size(constraint_kind_label)) {
             throw std::exception();
         }
         o << constraint_kind_label[kind] << -expression.constant_term();
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 9d844e82b..0d98c97b1 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -2,6 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 #include <utility>
 
+#include <gsl/narrow>
+
 #include "crab/split_dbm.hpp"
 #include "crab_utils/debug.hpp"
 #include "crab_utils/stats.hpp"
@@ -11,7 +13,7 @@
 namespace crab::domains {
 
 static std::optional<SplitDBM::vert_id> try_at(const SplitDBM::vert_map_t& map, variable_t v) {
-    auto it = map.find(v);
+    const auto it = map.find(v);
     if (it == map.end()) {
         return std::nullopt;
     }
@@ -19,7 +21,7 @@ static std::optional<SplitDBM::vert_id> try_at(const SplitDBM::vert_map_t& map,
 }
 
 SplitDBM::vert_id SplitDBM::get_vert(variable_t v) {
-    if (auto y = try_at(vert_map, v)) {
+    if (const auto y = try_at(vert_map, v)) {
         return *y;
     }
 
@@ -739,7 +741,7 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
 }
 
 void SplitDBM::operator-=(variable_t v) {
-    if (auto y = try_at(vert_map, v)) {
+    if (const auto y = try_at(vert_map, v)) {
         g.forget(*y);
         rev_map[*y] = std::nullopt;
         vert_map.erase(v);
@@ -773,7 +775,7 @@ bool SplitDBM::add_constraint(const linear_constraint_t& cst) {
     case constraint_kind_t::LESS_THAN_ZERO: {
         // We try to convert a strict to non-strict.
         // e < 0 --> e <= -1
-        auto nc = linear_constraint_t(cst.expression().plus(1), constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
+        const auto nc = linear_constraint_t(cst.expression().plus(1), constraint_kind_t::LESS_THAN_OR_EQUALS_ZERO);
         if (!add_linear_leq(nc.expression())) {
             return false;
         }
@@ -956,7 +958,7 @@ void SplitDBM::set(variable_t x, const interval_t& intv) {
         return;
     }
 
-    vert_id v = get_vert(x);
+    const vert_id v = get_vert(x);
     if (intv.ub().is_finite()) {
         Weight ub;
         if (convert_NtoW_overflow(*intv.ub().number(), ub)) {
@@ -1168,8 +1170,7 @@ string_invariant SplitDBM::to_set() const {
 std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
 bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& out) const {
-    [[maybe_unused]]
-    bool overflow = convert_NtoW_overflow(e.constant_term(), out);
+    [[maybe_unused]] const bool overflow = convert_NtoW_overflow(e.constant_term(), out);
     assert(!overflow);
     for (const auto& [variable, coefficient] : e.variable_terms()) {
         Weight coef;
@@ -1193,7 +1194,7 @@ interval_t SplitDBM::compute_residual(const linear_expression_t& e, variable_t p
 }
 
 SplitDBM::Weight SplitDBM::pot_value(variable_t v) const {
-    if (auto y = try_at(vert_map, v)) {
+    if (const auto y = try_at(vert_map, v)) {
         return potential[*y];
     }
     return {0};
@@ -1225,7 +1226,7 @@ bool SplitDBM::entail(const linear_constraint_t& rhs) const {
     if (rhs.is_contradiction()) {
         return false;
     }
-    interval_t interval = eval_interval(rhs.expression());
+    const interval_t interval = eval_interval(rhs.expression());
     switch (rhs.kind()) {
     case constraint_kind_t::EQUALS_ZERO:
         if (interval.singleton() == std::optional(number_t(0))) {
@@ -1277,11 +1278,11 @@ void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
 
 static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::graph_t& r, variable_t x,
                                int finite_width) {
-    auto it = m.find(x);
+    const auto it = m.find(x);
     if (it == m.end()) {
         return interval_t::top();
     }
-    SplitDBM::vert_id v = it->second;
+    const SplitDBM::vert_id v = it->second;
     extended_number lb = extended_number::minus_infinity();
     extended_number ub = extended_number::plus_infinity();
     if (r.elem(v, 0)) {
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 09d3de00f..7d0242d58 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -209,7 +209,7 @@ type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const Reg& r) cons
     if (!res) {
         return T_UNINIT;
     }
-    return static_cast<type_encoding_t>(*res);
+    return res->narrow<type_encoding_t>();
 }
 
 type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const variable_t v) const {
@@ -217,11 +217,11 @@ type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const variable_t v
     if (!res) {
         return T_UNINIT;
     }
-    return static_cast<type_encoding_t>(*res);
+    return res->narrow<type_encoding_t>();
 }
 
 type_encoding_t TypeDomain::get_type(const NumAbsDomain& inv, const number_t& t) const {
-    return static_cast<type_encoding_t>(t);
+    return t.narrow<type_encoding_t>();
 }
 
 // Check whether a given type value is within the range of a given type variable's value.
diff --git a/src/crab/var_factory.cpp b/src/crab/var_factory.cpp
index d4fc83c56..f4c243229 100644
--- a/src/crab/var_factory.cpp
+++ b/src/crab/var_factory.cpp
@@ -11,13 +11,12 @@
 namespace crab {
 
 variable_t variable_t::make(const std::string& name) {
-    auto it = std::find(names->begin(), names->end(), name);
+    const auto it = std::find(names->begin(), names->end(), name);
     if (it == names->end()) {
         names->emplace_back(name);
         return variable_t(names->size() - 1);
-    } else {
-        return variable_t(std::distance(names->begin(), it));
     }
+    return variable_t(std::distance(names->begin(), it));
 }
 
 std::vector<std::string> default_variable_names() {
@@ -141,11 +140,13 @@ thread_local lazy_allocator<std::vector<std::string>, default_variable_names> va
 
 void variable_t::clear_thread_local_state() { names.clear(); }
 
-variable_t variable_t::reg(data_kind_t kind, int i) { return make("r" + std::to_string(i) + "." + name_of(kind)); }
+variable_t variable_t::reg(const data_kind_t kind, const int i) {
+    return make("r" + std::to_string(i) + "." + name_of(kind));
+}
 
 std::ostream& operator<<(std::ostream& o, const data_kind_t& s) { return o << name_of(s); }
 
-static std::string mk_scalar_name(data_kind_t kind, const number_t& o, const number_t& size) {
+static std::string mk_scalar_name(const data_kind_t kind, const number_t& o, const number_t& size) {
     std::stringstream os;
     os << "s"
        << "[" << o;
@@ -156,17 +157,17 @@ static std::string mk_scalar_name(data_kind_t kind, const number_t& o, const num
     return os.str();
 }
 
-variable_t variable_t::stack_frame_var(data_kind_t kind, int i, std::string prefix) {
+variable_t variable_t::stack_frame_var(const data_kind_t kind, const int i, const std::string& prefix) {
     return make(prefix + STACK_FRAME_DELIMITER + "r" + std::to_string(i) + "." + name_of(kind));
 }
 
-variable_t variable_t::cell_var(data_kind_t array, const number_t& offset, const number_t& size) {
+variable_t variable_t::cell_var(const data_kind_t array, const number_t& offset, const number_t& size) {
     return make(mk_scalar_name(array, offset.cast_to<uint64_t>(), size));
 }
 
 // Given a type variable, get the associated variable of a given kind.
-variable_t variable_t::kind_var(data_kind_t kind, variable_t type_variable) {
-    std::string name = type_variable.name();
+variable_t variable_t::kind_var(const data_kind_t kind, const variable_t type_variable) {
+    const std::string name = type_variable.name();
     return make(name.substr(0, name.rfind('.') + 1) + name_of(kind));
 }
 
diff --git a/src/crab/variable.hpp b/src/crab/variable.hpp
index 9267f7876..bb0075aea 100644
--- a/src/crab/variable.hpp
+++ b/src/crab/variable.hpp
@@ -69,7 +69,7 @@ class variable_t final {
 
     static std::vector<variable_t> get_type_variables();
     static variable_t reg(data_kind_t, int);
-    static variable_t stack_frame_var(data_kind_t kind, int i, std::string prefix);
+    static variable_t stack_frame_var(data_kind_t kind, int i, const std::string& prefix);
     static variable_t cell_var(data_kind_t array, const number_t& offset, const number_t& size);
     static variable_t kind_var(data_kind_t kind, variable_t type_variable);
     static variable_t meta_offset();
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index ae9e6220c..f7ea98a7a 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -31,7 +31,7 @@ class number_t final {
     explicit number_t(const std::string& s) { _n = cpp_int(s); }
 
     template <std::integral T>
-    explicit operator T() const {
+    T narrow() const {
         if (!fits<T>()) {
             CRAB_ERROR("number_t ", _n, " does not fit into ", typeid(T).name());
         }
@@ -39,7 +39,7 @@ class number_t final {
     }
 
     template <is_enum T>
-    explicit operator T() const {
+    T narrow() const {
         return static_cast<T>(static_cast<std::underlying_type_t<T>>(_n));
     }
 
@@ -241,7 +241,7 @@ class number_t final {
         if (!x.fits<int32_t>()) {
             CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }
-        return number_t(_n << static_cast<int32_t>(x));
+        return number_t(_n << x.narrow<int32_t>());
     }
 
     number_t operator>>(const number_t& x) const {
@@ -251,7 +251,7 @@ class number_t final {
         if (!x.fits<int32_t>()) {
             CRAB_ERROR("number_t ", x._n, " does not fit into an int32");
         }
-        return number_t(_n >> static_cast<int32_t>(x));
+        return number_t(_n >> x.narrow<int32_t>());
     }
 
     [[nodiscard]]
diff --git a/src/crab_utils/num_safeint.hpp b/src/crab_utils/num_safeint.hpp
index e8c12ed6b..1bcb8ec57 100644
--- a/src/crab_utils/num_safeint.hpp
+++ b/src/crab_utils/num_safeint.hpp
@@ -39,30 +39,30 @@ class safe_i64 {
         return std::numeric_limits<int64_t>::min();
     }
 
-    static std::optional<int64_t> checked_add(int64_t a, int64_t b) {
-        wideint_t lr = (wideint_t)a + (wideint_t)b;
+    static std::optional<int64_t> checked_add(const int64_t a, const int64_t b) {
+        const wideint_t lr = static_cast<wideint_t>(a) + static_cast<wideint_t>(b);
         if (lr > get_max() || lr < get_min()) {
             return {};
         }
         return static_cast<int64_t>(lr);
     }
 
-    static std::optional<int64_t> checked_sub(int64_t a, int64_t b) {
-        wideint_t lr = (wideint_t)a - (wideint_t)b;
+    static std::optional<int64_t> checked_sub(const int64_t a, const int64_t b) {
+        const wideint_t lr = static_cast<wideint_t>(a) - static_cast<wideint_t>(b);
         if (lr > get_max() || lr < get_min()) {
             return {};
         }
         return static_cast<int64_t>(lr);
     }
-    static std::optional<int64_t> checked_mul(int64_t a, int64_t b) {
-        wideint_t lr = (wideint_t)a * (wideint_t)b;
+    static std::optional<int64_t> checked_mul(const int64_t a, const int64_t b) {
+        const wideint_t lr = static_cast<wideint_t>(a) * static_cast<wideint_t>(b);
         if (lr > get_max() || lr < get_min()) {
             return {};
         }
         return static_cast<int64_t>(lr);
     }
-    static std::optional<int64_t> checked_div(int64_t a, int64_t b) {
-        wideint_t lr = (wideint_t)a / (wideint_t)b;
+    static std::optional<int64_t> checked_div(const int64_t a, const int64_t b) {
+        const wideint_t lr = static_cast<wideint_t>(a) / static_cast<wideint_t>(b);
         if (lr > get_max() || lr < get_min()) {
             return {};
         }
@@ -72,39 +72,39 @@ class safe_i64 {
   public:
     safe_i64() : m_num(0) {}
 
-    safe_i64(int64_t num) : m_num(num) {}
+    safe_i64(const int64_t num) : m_num(num) {}
 
-    safe_i64(const number_t& n) : m_num((int64_t)n) {}
+    safe_i64(const number_t& n) : m_num(n.narrow<int64_t>()) {}
 
     operator int64_t() const { return (int64_t)m_num; }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator+(safe_i64 x) const {
-        if (auto z = checked_add(m_num, x.m_num)) {
+    safe_i64 operator+(const safe_i64 x) const {
+        if (const auto z = checked_add(m_num, x.m_num)) {
             return safe_i64(*z);
         }
         CRAB_ERROR("Integer overflow during addition");
     }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator-(safe_i64 x) const {
-        if (auto z = checked_sub(m_num, x.m_num)) {
+    safe_i64 operator-(const safe_i64 x) const {
+        if (const auto z = checked_sub(m_num, x.m_num)) {
             return safe_i64(*z);
         }
         CRAB_ERROR("Integer overflow during subtraction");
     }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator*(safe_i64 x) const {
-        if (auto z = checked_mul(m_num, x.m_num)) {
+    safe_i64 operator*(const safe_i64 x) const {
+        if (const auto z = checked_mul(m_num, x.m_num)) {
             return safe_i64(*z);
         }
         CRAB_ERROR("Integer overflow during multiplication");
     }
 
     // TODO: output parameters whether operation overflows
-    safe_i64 operator/(safe_i64 x) const {
-        if (auto z = checked_div(m_num, x.m_num)) {
+    safe_i64 operator/(const safe_i64 x) const {
+        if (const auto z = checked_div(m_num, x.m_num)) {
             return safe_i64(*z);
         }
         CRAB_ERROR("Integer overflow during division");
@@ -114,22 +114,22 @@ class safe_i64 {
     safe_i64 operator-() const { return safe_i64(0) - *this; }
 
     // TODO: output parameters whether operation overflows
-    safe_i64& operator+=(safe_i64 x) { return *this = *this + x; }
+    safe_i64& operator+=(const safe_i64 x) { return *this = *this + x; }
 
     // TODO: output parameters whether operation overflows
-    safe_i64& operator-=(safe_i64 x) { return *this = *this - x; }
+    safe_i64& operator-=(const safe_i64 x) { return *this = *this - x; }
 
-    bool operator==(safe_i64 x) const { return m_num == x.m_num; }
+    bool operator==(const safe_i64 x) const { return m_num == x.m_num; }
 
-    bool operator!=(safe_i64 x) const { return m_num != x.m_num; }
+    bool operator!=(const safe_i64 x) const { return m_num != x.m_num; }
 
-    bool operator<(safe_i64 x) const { return m_num < x.m_num; }
+    bool operator<(const safe_i64 x) const { return m_num < x.m_num; }
 
-    bool operator<=(safe_i64 x) const { return m_num <= x.m_num; }
+    bool operator<=(const safe_i64 x) const { return m_num <= x.m_num; }
 
-    bool operator>(safe_i64 x) const { return m_num > x.m_num; }
+    bool operator>(const safe_i64 x) const { return m_num > x.m_num; }
 
-    bool operator>=(safe_i64 x) const { return m_num >= x.m_num; }
+    bool operator>=(const safe_i64 x) const { return m_num >= x.m_num; }
 
     friend std::ostream& operator<<(std::ostream& o, const safe_i64& n) { return o << n.m_num; }
 

From db564aef24941d318015fcb02225980f64546977 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 20:08:38 +0300
Subject: [PATCH 268/373] fetch and use Microsoft.GSL

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 CMakeLists.txt | 145 +++++++++++++++++++++++++++----------------------
 1 file changed, 79 insertions(+), 66 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index fd3a90f3a..b18b7801e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,70 +1,81 @@
 # Copyright (c) Prevail Verifier contributors.
 # SPDX-License-Identifier: MIT
-cmake_minimum_required(VERSION 3.10)
+cmake_minimum_required(VERSION 3.14)
 project(ebpf_verifier)
 
 include(FetchContent)
-FetchContent_Declare(
-  Catch2
-  GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-  GIT_TAG        fa43b77429ba76c462b1898d6cd2f2d7a9416b14 # v3.7.1
+
+FetchContent_Declare(GSL
+        GIT_REPOSITORY "https://github.com/microsoft/GSL"
+        GIT_TAG "v4.0.0"
+        GIT_SHALLOW ON
+)
+FetchContent_MakeAvailable(GSL)
+get_target_property(GSL_INCLUDE_DIRS Microsoft.GSL::GSL INTERFACE_INCLUDE_DIRECTORIES)
+
+FetchContent_Declare(Catch2
+        GIT_REPOSITORY "https://github.com/catchorg/Catch2.git"
+        GIT_TAG "v3.7.1"
+        GIT_SHALLOW ON
 )
 FetchContent_MakeAvailable(Catch2)
 
 if (IS_DIRECTORY "${PROJECT_SOURCE_DIR}/.git")
-  # Install Git pre-commit hook
-  file(COPY scripts/pre-commit scripts/commit-msg
-       DESTINATION "${PROJECT_SOURCE_DIR}/.git/hooks")
+    # Install Git pre-commit hook
+    file(COPY scripts/pre-commit scripts/commit-msg
+            DESTINATION "${PROJECT_SOURCE_DIR}/.git/hooks")
 endif ()
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
-    "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
-  find_package(yaml-cpp REQUIRED)
-  find_package(Boost REQUIRED)
-  set(CMAKE_CXX_STANDARD 20)
+        "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
+    find_package(yaml-cpp REQUIRED)
+    find_package(Boost REQUIRED)
+    set(CMAKE_CXX_STANDARD 20)
+    set(CMAKE_CXX_STANDARD_REQUIRED ON)
 elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
-  list(APPEND CMAKE_CONFIGURATION_TYPES FuzzerDebug)
-  list(REMOVE_DUPLICATES CMAKE_CONFIGURATION_TYPES)
-  set(CMAKE_CONFIGURATION_TYPES "${CMAKE_CONFIGURATION_TYPES}" CACHE STRING
-      "Add the configurations that we need"
-      FORCE)
-  set(CMAKE_EXE_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}")
-  set(CMAKE_SHARED_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}")
-  set(CMAKE_C_FLAGS_FUZZERDEBUG "${CMAKE_C_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
-  set(CMAKE_CXX_FLAGS_FUZZERDEBUG "${CMAKE_CXX_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
-
-  find_program(NUGET nuget)
-  if (NOT NUGET)
-    message("ERROR: You must first install nuget.exe from https://www.nuget.org/downloads")
-  else ()
-    execute_process(COMMAND ${NUGET} install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
-    set(BOOST_VERSION 1.81.0)
-  endif()
-  set(Boost_INCLUDE_DIRS ${CMAKE_BINARY_DIR}/packages/boost/lib/native/include)
-  set(Boost_LIBRARY_DIRS ${CMAKE_BINARY_DIR}/packages/boost_filesystem-vc143/lib/native)
-
-  # MSVC's "std:c++20" option is the current standard that supports all the C++17
-  # features we use. However, cmake can't deal with that here, so we set it below.
-
-  set(EXTERNAL_INSTALL_LOCATION ${CMAKE_BINARY_DIR}/packages/yaml-cpp)
-  include(ExternalProject)
-  ExternalProject_Add(yaml-cpp
-          GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
-          GIT_TAG "yaml-cpp-0.7.0"
-          GIT_SHALLOW true
-          CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${EXTERNAL_INSTALL_LOCATION}
-                     -DYAML_MSVC_SHARED_RT=ON
-                     -DYAML_CPP_BUILD_TESTS=OFF
-                     -DYAML_CPP_BUILD_TOOLS=OFF
-          )
-  set(YAML_CPP_LIBRARIES ${EXTERNAL_INSTALL_LOCATION}/lib/yaml-cpp$<$<CONFIG:DEBUG>:d>.lib)
-  set(YAML_CPP_INCLUDE_DIRS ${EXTERNAL_INSTALL_LOCATION}/include/)
+    list(APPEND CMAKE_CONFIGURATION_TYPES FuzzerDebug)
+    list(REMOVE_DUPLICATES CMAKE_CONFIGURATION_TYPES)
+    set(CMAKE_CONFIGURATION_TYPES "${CMAKE_CONFIGURATION_TYPES}" CACHE STRING
+            "Add the configurations that we need"
+            FORCE)
+    set(CMAKE_EXE_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_EXE_LINKER_FLAGS_DEBUG}")
+    set(CMAKE_SHARED_LINKER_FLAGS_FUZZERDEBUG "${CMAKE_SHARED_LINKER_FLAGS_DEBUG}")
+    set(CMAKE_C_FLAGS_FUZZERDEBUG "${CMAKE_C_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
+    set(CMAKE_CXX_FLAGS_FUZZERDEBUG "${CMAKE_CXX_FLAGS_DEBUG} /fsanitize=address /fsanitize=fuzzer /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsanitize-coverage=trace-cmp /fsanitize-coverage=trace-div /ZH:SHA_256")
+
+    find_program(NUGET nuget)
+    if (NOT NUGET)
+        message("ERROR: You must first install nuget.exe from https://www.nuget.org/downloads")
+    else ()
+        execute_process(COMMAND ${NUGET} install "Boost" -Version 1.81.0 -ExcludeVersion -OutputDirectory ${CMAKE_BINARY_DIR}/packages)
+        set(BOOST_VERSION 1.81.0)
+    endif ()
+    set(Boost_INCLUDE_DIRS ${CMAKE_BINARY_DIR}/packages/boost/lib/native/include)
+    set(Boost_LIBRARY_DIRS ${CMAKE_BINARY_DIR}/packages/boost_filesystem-vc143/lib/native)
+
+    # MSVC's "std:c++20" option is the current standard that supports all the C++17
+    # features we use. However, cmake can't deal with that here, so we set it below.
+
+    set(EXTERNAL_INSTALL_LOCATION ${CMAKE_BINARY_DIR}/packages/yaml-cpp)
+    include(ExternalProject)
+    ExternalProject_Add(yaml-cpp
+            GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
+            GIT_TAG "yaml-cpp-0.7.0"
+            GIT_SHALLOW true
+            CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${EXTERNAL_INSTALL_LOCATION}
+            -DYAML_MSVC_SHARED_RT=ON
+            -DYAML_CPP_BUILD_TESTS=OFF
+            -DYAML_CPP_BUILD_TOOLS=OFF
+    )
+    set(YAML_CPP_LIBRARIES ${EXTERNAL_INSTALL_LOCATION}/lib/yaml-cpp$<$<CONFIG:DEBUG>:d>.lib)
+    set(YAML_CPP_INCLUDE_DIRS ${EXTERNAL_INSTALL_LOCATION}/include/)
 endif ()
 
 include_directories(./external)
 include_directories(./external/bpf_conformance/external/elfio)
 include_directories(./src)
 include_directories(./external/libbtf)
+include_directories(${GSL_INCLUDE_DIRS})
 include_directories(${Boost_INCLUDE_DIRS})
 include_directories(${YAML_CPP_INCLUDE_DIRS})
 link_directories(${Boost_LIBRARY_DIRS})
@@ -73,31 +84,30 @@ file(GLOB LIB_SRC
         "./src/*.cpp"
         "./src/crab/*.cpp"
         "./src/crab_utils/*.cpp"
-        "./src/linux/gpl/*.cpp"
+        "./src/linux/gpl/spec_prototypes.cpp"
         "./src/linux/linux_platform.cpp"
-        )
+)
 
 file(GLOB ALL_TEST
-        "./src/test/test.cpp"
         "./src/test/test_conformance.cpp"
         "./src/test/test_marshal.cpp"
         "./src/test/test_print.cpp"
         "./src/test/test_verify.cpp"
         "./src/test/test_wto.cpp"
         "./src/test/test_yaml.cpp"
-        )
+)
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
-    "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
-  set(COMMON_FLAGS -Wall -Wfatal-errors -DSIZEOF_VOID_P=8 -DSIZEOF_LONG=8)
+        "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
+    set(COMMON_FLAGS -Wall -Wfatal-errors -DSIZEOF_VOID_P=8 -DSIZEOF_LONG=8)
 
-  set(RELEASE_FLAGS -O2 -flto=auto -ffat-lto-objects)
+    set(RELEASE_FLAGS -O2 -flto=auto -ffat-lto-objects)
 
-  set(DEBUG_FLAGS -O0 -g3 -fno-omit-frame-pointer)
+    set(DEBUG_FLAGS -O0 -g3 -fno-omit-frame-pointer)
 
-  set(SANITIZE_FLAGS -fsanitize=address -O1 -fno-omit-frame-pointer)
+    set(SANITIZE_FLAGS -fsanitize=address -O1 -fno-omit-frame-pointer)
 elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
-  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /std:c++20")
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /std:c++20")
 endif ()
 
 add_library(ebpfverifier ${LIB_SRC})
@@ -107,6 +117,8 @@ add_executable(tests ${ALL_TEST})
 add_executable(run_yaml src/main/run_yaml.cpp)
 add_executable(conformance_check src/test/conformance_check.cpp)
 
+target_include_directories(ebpfverifier PRIVATE ${GSL_INCLUDE_DIRS})
+
 set_target_properties(check
         PROPERTIES
         RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/..")
@@ -141,6 +153,14 @@ add_subdirectory("external/libbtf")
 set(ebpfverifier_GUID_CMAKE "7d5b4e68-c0fa-3f86-9405-f6400219b440" CACHE INTERNAL "Project GUID")
 set(yaml-cpp_GUID_CMAKE "98d56b8a-d8eb-3d98-b8ee-c83696b4d58a" CACHE INTERNAL "Project GUID")
 
+set(THREADS_PREFER_PTHREAD_FLAG ON)
+find_package(Threads REQUIRED)
+
+target_link_libraries(ebpfverifier PRIVATE ${YAML_CPP_LIBRARIES})
+target_link_libraries(ebpfverifier PRIVATE libbtf)
+target_link_libraries(ebpfverifier PRIVATE Microsoft.GSL::GSL)
+target_compile_options(ebpfverifier PRIVATE ${COMMON_FLAGS})
+
 target_compile_options(check PRIVATE ${COMMON_FLAGS})
 target_compile_options(check PUBLIC "$<$<CONFIG:DEBUG>:${DEBUG_FLAGS}>")
 target_compile_options(check PUBLIC "$<$<CONFIG:RELEASE>:${RELEASE_FLAGS}>")
@@ -155,16 +175,9 @@ target_compile_options(tests PUBLIC "$<$<CONFIG:SANITIZE>:${SANITIZE_FLAGS}>")
 target_link_libraries(tests PRIVATE ebpfverifier)
 target_link_libraries(tests PRIVATE bpf_conformance)
 target_link_libraries(tests PRIVATE ${CMAKE_DL_LIBS})
-
-set(THREADS_PREFER_PTHREAD_FLAG ON)
-find_package(Threads REQUIRED)
-
 target_link_libraries(tests PRIVATE Threads::Threads)
 target_link_libraries(tests PRIVATE Catch2::Catch2WithMain)
 
-target_link_libraries(ebpfverifier PRIVATE ${YAML_CPP_LIBRARIES})
-target_link_libraries(ebpfverifier PRIVATE libbtf)
-target_compile_options(ebpfverifier PRIVATE ${COMMON_FLAGS})
-
 target_link_libraries(run_yaml PRIVATE ebpfverifier)
+
 target_link_libraries(conformance_check PRIVATE ebpfverifier)

From 2b849fd040e07d6c0962425457d24019f681951e Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 20:43:11 +0300
Subject: [PATCH 269/373] use gsl::narrow on casts outside the main domains

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp       |  4 +--
 src/crab/cfg.hpp                | 14 ++++----
 src/crab/ebpf_domain.cpp        |  5 ++-
 src/crab/interval.hpp           | 59 ++++++++++++++++++---------------
 src/crab/linear_constraint.hpp  |  4 ++-
 src/crab/split_dbm.cpp          |  8 ++---
 src/crab_utils/num_extended.hpp | 13 ++++++++
 7 files changed, 62 insertions(+), 45 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 8ad3dcc06..22c2f0f78 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -495,8 +495,8 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
     std::vector<cell_t> cells = offset_map.get_overlap_cells(o, size);
     for (cell_t const& c : cells) {
         interval_t intv = c.to_interval();
-        int cell_start_index = intv.lb().number()->narrow<int>();
-        int cell_end_index = intv.ub().number()->narrow<int>();
+        int cell_start_index = intv.lb().narrow<int>();
+        int cell_end_index = intv.ub().narrow<int>();
 
         if (!this->num_bytes.all_num(cell_start_index, cell_end_index + 1) ||
             cell_end_index + 1UL < cell_start_index + sizeof(int64_t)) {
diff --git a/src/crab/cfg.hpp b/src/crab/cfg.hpp
index 8ff0792ff..d9527b2d2 100644
--- a/src/crab/cfg.hpp
+++ b/src/crab/cfg.hpp
@@ -20,14 +20,12 @@
 
 #include <boost/iterator/transform_iterator.hpp>
 #include <boost/lexical_cast.hpp>
-#include <boost/range/iterator_range.hpp>
-
-#include "crab/variable.hpp"
-#include "crab_utils/debug.hpp"
-#include "crab_utils/num_big.hpp"
+#include <gsl/gsl>
 
 #include "asm_ostream.hpp"
 #include "asm_syntax.hpp"
+#include "crab_utils/debug.hpp"
+#include "crab_utils/num_big.hpp"
 #include "spec_type_descriptors.hpp"
 
 namespace crab {
@@ -100,7 +98,7 @@ class basic_block_t final {
 
     [[nodiscard]]
     size_t size() const {
-        return static_cast<size_t>(std::distance(begin(), end()));
+        return gsl::narrow<size_t>(std::distance(begin(), end()));
     }
 
     [[nodiscard]]
@@ -195,7 +193,7 @@ class basic_block_rev_t final {
 
     [[nodiscard]]
     std::size_t size() const {
-        return static_cast<size_t>(std::distance(begin(), end()));
+        return gsl::narrow<size_t>(std::distance(begin(), end()));
     }
 
     [[nodiscard]]
@@ -382,7 +380,7 @@ class cfg_t final {
 
     [[nodiscard]]
     size_t size() const {
-        return static_cast<size_t>(std::distance(begin(), end()));
+        return gsl::narrow<size_t>(std::distance(begin(), end()));
     }
 
     void simplify() {
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 06648c4bc..d72b6b9cd 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2451,8 +2451,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
             int64_t lb_n = std::numeric_limits<int64_t>::min() >> imm;
             int64_t ub_n = std::numeric_limits<int64_t>::max() >> imm;
             if (left_interval.finite_size()) {
-                number_t lb = left_interval.lb().number().value();
-                number_t ub = left_interval.ub().number().value();
+                const auto [lb, ub] = left_interval.pair_number();
                 if (finite_width == 64) {
                     lb_n = lb.cast_to<int64_t>() >> imm;
                     ub_n = ub.cast_to<int64_t>() >> imm;
@@ -2880,7 +2879,7 @@ ebpf_domain_t ebpf_domain_t::from_constraints(const std::set<std::string>& const
         inv += cst;
     }
     for (const interval_t& range : numeric_ranges) {
-        const int start = range.lb().number()->narrow<int>();
+        const int start = range.lb().narrow<int>();
         const int width = 1 + range.finite_size()->narrow<int>();
         inv.stack.initialize_numbers(start, width);
     }
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 131b2eda4..657b8f694 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -24,9 +24,9 @@ class interval_t final {
     bound_t _ub;
 
   public:
-    static interval_t top() { return interval_t(bound_t::minus_infinity(), bound_t::plus_infinity()); }
+    static interval_t top() { return interval_t{bound_t::minus_infinity(), bound_t::plus_infinity()}; }
 
-    static interval_t bottom() { return interval_t(); }
+    static interval_t bottom() { return interval_t{}; }
 
     [[nodiscard]]
     std::optional<number_t> finite_size() const {
@@ -89,17 +89,22 @@ class interval_t final {
     template <std::integral T>
     [[nodiscard]]
     std::tuple<T, T> pair() const {
-        return {_lb.number()->narrow<T>(), _ub.number()->narrow<T>()};
+        return {_lb.narrow<T>(), _ub.narrow<T>()};
+    }
+
+    [[nodiscard]]
+    std::tuple<number_t, number_t> pair_number() const {
+        return {_lb.number().value(), _ub.number().value()};
     }
 
     template <std::integral T>
     [[nodiscard]]
     std::tuple<T, T> bound(T lb, T ub) const {
-        const interval_t b = interval_t(lb, ub) & *this;
+        const interval_t b = interval_t{lb, ub} & *this;
         if (b.is_bottom()) {
             CRAB_ERROR("Cannot convert bottom to tuple");
         }
-        return {b._lb.number()->narrow<T>(), _ub.number()->narrow<T>()};
+        return {b._lb.narrow<T>(), b._ub.narrow<T>()};
     }
 
     template <is_enum T>
@@ -145,7 +150,7 @@ class interval_t final {
         } else if (x.is_bottom()) {
             return *this;
         } else {
-            return interval_t(std::min(_lb, x._lb), std::max(_ub, x._ub));
+            return interval_t{std::min(_lb, x._lb), std::max(_ub, x._ub)};
         }
     }
 
@@ -153,7 +158,7 @@ class interval_t final {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
-            return interval_t(std::max(_lb, x._lb), std::min(_ub, x._ub));
+            return interval_t{std::max(_lb, x._lb), std::min(_ub, x._ub)};
         }
     }
 
@@ -164,8 +169,8 @@ class interval_t final {
         } else if (x.is_bottom()) {
             return *this;
         } else {
-            return interval_t(x._lb < _lb ? bound_t::minus_infinity() : _lb,
-                              _ub < x._ub ? bound_t::plus_infinity() : _ub);
+            return interval_t{x._lb < _lb ? bound_t::minus_infinity() : _lb,
+                              _ub < x._ub ? bound_t::plus_infinity() : _ub};
         }
     }
 
@@ -176,9 +181,9 @@ class interval_t final {
         } else if (x.is_bottom()) {
             return *this;
         } else {
-            bound_t lb = (x._lb < _lb ? ts.get_prev(x._lb) : _lb);
-            bound_t ub = (_ub < x._ub ? ts.get_next(x._ub) : _ub);
-            return interval_t(lb, ub);
+            bound_t lb = x._lb < _lb ? ts.get_prev(x._lb) : _lb;
+            bound_t ub = _ub < x._ub ? ts.get_next(x._ub) : _ub;
+            return interval_t{lb, ub};
         }
     }
 
@@ -187,8 +192,8 @@ class interval_t final {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
-            return interval_t(_lb.is_infinite() && x._lb.is_finite() ? x._lb : _lb,
-                              _ub.is_infinite() && x._ub.is_finite() ? x._ub : _ub);
+            return interval_t{_lb.is_infinite() && x._lb.is_finite() ? x._lb : _lb,
+                              _ub.is_infinite() && x._ub.is_finite() ? x._ub : _ub};
         }
     }
 
@@ -196,7 +201,7 @@ class interval_t final {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
-            return interval_t(_lb + x._lb, _ub + x._ub);
+            return interval_t{_lb + x._lb, _ub + x._ub};
         }
     }
 
@@ -206,7 +211,7 @@ class interval_t final {
         if (is_bottom()) {
             return bottom();
         } else {
-            return interval_t(-_ub, -_lb);
+            return interval_t{-_ub, -_lb};
         }
     }
 
@@ -214,7 +219,7 @@ class interval_t final {
         if (is_bottom() || x.is_bottom()) {
             return bottom();
         } else {
-            return interval_t(_lb - x._ub, _ub - x._lb);
+            return interval_t{_lb - x._ub, _ub - x._lb};
         }
     }
 
@@ -228,7 +233,7 @@ class interval_t final {
             bound_t lu = _lb * x._ub;
             bound_t ul = _ub * x._lb;
             bound_t uu = _ub * x._ub;
-            return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+            return interval_t{std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu})};
         }
     }
 
@@ -345,7 +350,7 @@ class interval_t final {
                 T lub = ub().number()->truncate_to<T>();
                 if (llb <= lub) {
                     // Interval can be accurately represented in 64 width.
-                    return interval_t(llb, lub);
+                    return interval_t{llb, lub};
                 }
             }
         }
@@ -445,21 +450,21 @@ class interval_t final {
 
 namespace interval_operators {
 
-inline interval_t operator+(const number_t& c, const interval_t& x) { return interval_t(c) + x; }
+inline interval_t operator+(const number_t& c, const interval_t& x) { return interval_t{c} + x; }
 
-inline interval_t operator+(const interval_t& x, const number_t& c) { return x + interval_t(c); }
+inline interval_t operator+(const interval_t& x, const number_t& c) { return x + interval_t{c}; }
 
-inline interval_t operator*(const number_t& c, const interval_t& x) { return interval_t(c) * x; }
+inline interval_t operator*(const number_t& c, const interval_t& x) { return interval_t{c} * x; }
 
-inline interval_t operator*(const interval_t& x, const number_t& c) { return x * interval_t(c); }
+inline interval_t operator*(const interval_t& x, const number_t& c) { return x * interval_t{c}; }
 
-inline interval_t operator/(const number_t& c, const interval_t& x) { return interval_t(c) / x; }
+inline interval_t operator/(const number_t& c, const interval_t& x) { return interval_t{c} / x; }
 
-inline interval_t operator/(const interval_t& x, const number_t& c) { return x / interval_t(c); }
+inline interval_t operator/(const interval_t& x, const number_t& c) { return x / interval_t{c}; }
 
-inline interval_t operator-(const number_t& c, const interval_t& x) { return interval_t(c) - x; }
+inline interval_t operator-(const number_t& c, const interval_t& x) { return interval_t{c} - x; }
 
-inline interval_t operator-(const interval_t& x, const number_t& c) { return x - interval_t(c); }
+inline interval_t operator-(const interval_t& x, const number_t& c) { return x - interval_t{c}; }
 
 } // namespace interval_operators
 
diff --git a/src/crab/linear_constraint.hpp b/src/crab/linear_constraint.hpp
index e7a64c589..9ed810b1f 100644
--- a/src/crab/linear_constraint.hpp
+++ b/src/crab/linear_constraint.hpp
@@ -2,6 +2,8 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
+#include <gsl/narrow>
+
 #include "linear_expression.hpp"
 
 // A linear constraint is of the form:
@@ -91,7 +93,7 @@ inline std::ostream& operator<<(std::ostream& o, const linear_constraint_t& cons
         expression.output_variable_terms(o);
 
         constexpr std::array constraint_kind_label{" == ", " <= ", " < ", " != "};
-        const size_t kind = static_cast<size_t>(constraint.kind());
+        const size_t kind = gsl::narrow<size_t>(constraint.kind());
         if (kind >= std::size(constraint_kind_label)) {
             throw std::exception();
         }
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 0d98c97b1..4272233a3 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -466,7 +466,7 @@ SplitDBM SplitDBM::operator|(const SplitDBM& o) const& {
     for (auto [v, n] : vert_map) {
         if (auto y = try_at(o.vert_map, v)) {
             // Variable exists in both
-            out_vmap.emplace(v, static_cast<vert_id>(perm_x.size()));
+            out_vmap.emplace(v, gsl::narrow<vert_id>(perm_x.size()));
             out_revmap.push_back(v);
 
             pot_rx.push_back(potential[n] - potential[0]);
@@ -629,7 +629,7 @@ SplitDBM SplitDBM::widen(const SplitDBM& o) const {
     for (auto [v, n] : vert_map) {
         if (auto y = try_at(o.vert_map, v)) {
             // Variable exists in both
-            out_vmap.emplace(v, static_cast<vert_id>(perm_x.size()));
+            out_vmap.emplace(v, gsl::narrow<vert_id>(perm_x.size()));
             out_revmap.push_back(v);
 
             widen_pot.push_back(potential[n] - potential[0]);
@@ -684,7 +684,7 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
     meet_pi.emplace_back(0);
     meet_rev.push_back(std::nullopt);
     for (auto [v, n] : vert_map) {
-        vert_id vv = static_cast<vert_id>(perm_x.size());
+        vert_id vv = gsl::narrow<vert_id>(perm_x.size());
         meet_verts.emplace(v, vv);
         meet_rev.push_back(v);
 
@@ -698,7 +698,7 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
         auto it = meet_verts.find(v);
 
         if (it == meet_verts.end()) {
-            vert_id vv = static_cast<vert_id>(perm_y.size());
+            vert_id vv = gsl::narrow<vert_id>(perm_y.size());
             meet_rev.push_back(v);
 
             perm_y.push_back(n);
diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
index f072b11e1..0aca0d8fa 100644
--- a/src/crab_utils/num_extended.hpp
+++ b/src/crab_utils/num_extended.hpp
@@ -49,6 +49,19 @@ class extended_number final {
 
     extended_number(extended_number&&) noexcept = default;
 
+    template <std::integral T>
+    T narrow() const {
+        if (_is_infinite) {
+            CRAB_ERROR("Bound: cannot narrow infinite value");
+        }
+        return _n.narrow<T>();
+    }
+
+    template <is_enum T>
+    T narrow() const {
+        return static_cast<T>(narrow<std::underlying_type_t<T>>(_n));
+    }
+
     extended_number& operator=(extended_number&&) noexcept = default;
 
     extended_number& operator=(const extended_number& o) {

From 3ef3cba7690d716d9a83b49f95aa0190e84f4489 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 21:08:37 +0300
Subject: [PATCH 270/373] fix narrowing enum on extended_number

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/num_extended.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab_utils/num_extended.hpp b/src/crab_utils/num_extended.hpp
index 0aca0d8fa..2a922eca3 100644
--- a/src/crab_utils/num_extended.hpp
+++ b/src/crab_utils/num_extended.hpp
@@ -59,7 +59,7 @@ class extended_number final {
 
     template <is_enum T>
     T narrow() const {
-        return static_cast<T>(narrow<std::underlying_type_t<T>>(_n));
+        return static_cast<T>(narrow<std::underlying_type_t<T>>());
     }
 
     extended_number& operator=(extended_number&&) noexcept = default;

From 130ef6c6ee92635618f890d02488cad9a5928fbd Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Mon, 30 Sep 2024 23:54:22 +0300
Subject: [PATCH 271/373] use gsl::narrow and gsl::narrow_cast in
 array_domain.cpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp | 30 +++++++++++++++---------------
 src/crab/split_dbm.cpp    |  3 ++-
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index 22c2f0f78..df15cd73a 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -9,8 +9,8 @@
 #include <vector>
 
 #include "boost/endian/conversion.hpp"
-
 #include "radix_tree/radix_tree.hpp"
+#include <gsl/narrow>
 
 #include "config.hpp"
 #include "crab/array_domain.hpp"
@@ -41,7 +41,7 @@ class offset_t final {
     offset_t() : _prefix_length(bitsize) {}
     explicit offset_t(const index_t index) : _index(index), _prefix_length(bitsize) {}
     offset_t(const index_t index, const int prefix_length) : _index(index), _prefix_length(prefix_length) {}
-    explicit operator int() const { return static_cast<int>(_index); }
+    explicit operator int() const { return gsl::narrow<int>(_index); }
     operator index_t() const { return _index; }
     [[nodiscard]]
     int prefix_length() const {
@@ -67,13 +67,13 @@ offset_t radix_substr(const offset_t& key, const int begin, const int length) {
     if (length == offset_t::bitsize) {
         mask = 0;
     } else {
-        mask = static_cast<index_t>(1) << length;
+        mask = index_t{1} << length;
     }
 
     mask -= 1;
     mask <<= offset_t::bitsize - length - begin;
 
-    const index_t value = (static_cast<index_t>(key) & mask) << begin;
+    const index_t value = (gsl::narrow_cast<index_t>(key) & mask) << begin;
     return offset_t{value, length};
 }
 
@@ -109,7 +109,7 @@ class cell_t final {
     cell_t(const offset_t offset, const unsigned size) : _offset(offset), _size(size) {}
 
     static interval_t to_interval(const offset_t o, const unsigned size) {
-        return {static_cast<int>(o), number_t{static_cast<int>(o)} + size - 1};
+        return {gsl::narrow<int>(o), number_t{gsl::narrow<int>(o)} + size - 1};
     }
 
   public:
@@ -130,7 +130,7 @@ class cell_t final {
 
     [[nodiscard]]
     variable_t get_scalar(const data_kind_t kind) const {
-        return variable_t::cell_var(kind, static_cast<index_t>(_offset), _size);
+        return variable_t::cell_var(kind, gsl::narrow<index_t>(_offset), _size);
     }
 
     // ignore the scalar variable
@@ -347,7 +347,7 @@ std::vector<cell_t> offset_map_t::get_overlap_cells(const offset_t o, const unsi
         }
         upto_lb.push_back(lb_it->second);
 
-        for (int i = static_cast<int>(upto_lb.size() - 1); i >= 0; --i) {
+        for (int i = gsl::narrow<int>(upto_lb.size() - 1); i >= 0; --i) {
             ///////
             // All the cells in upto_lb[i] have the same offset. They
             // just differ in the size.
@@ -433,7 +433,7 @@ void clear_global_state() { global_array_map->clear(); }
 
 void array_domain_t::initialize_numbers(const int lb, const int width) {
     num_bytes.reset(lb, width);
-    lookup_array_map(data_kind_t::svalues).mk_cell(offset_t{static_cast<index_t>(lb)}, width);
+    lookup_array_map(data_kind_t::svalues).mk_cell(offset_t{gsl::narrow_cast<index_t>(lb)}, width);
 }
 
 std::ostream& operator<<(std::ostream& o, offset_map_t& m) {
@@ -466,7 +466,7 @@ void array_domain_t::split_cell(NumAbsDomain& inv, const data_kind_t kind, const
 
     // Create a new cell for that range.
     offset_map_t& offset_map = lookup_array_map(kind);
-    const cell_t new_cell = offset_map.mk_cell(offset_t{static_cast<index_t>(cell_start_index)}, len);
+    const cell_t new_cell = offset_map.mk_cell(offset_t{gsl::narrow_cast<index_t>(cell_start_index)}, len);
     inv.assign(new_cell.get_scalar(data_kind_t::svalues), svalue);
     inv.assign(new_cell.get_scalar(data_kind_t::uvalues), uvalue);
 }
@@ -508,14 +508,14 @@ void array_domain_t::split_number_var(NumAbsDomain& inv, data_kind_t kind, const
             // We can only split cells with a singleton value.
             continue;
         }
-        if (static_cast<index_t>(cell_start_index) < o) {
+        if (gsl::narrow_cast<index_t>(cell_start_index) < o) {
             // Use the bytes to the left of the specified range.
-            split_cell(inv, kind, cell_start_index, static_cast<unsigned int>(o - cell_start_index));
+            split_cell(inv, kind, cell_start_index, gsl::narrow<unsigned int>(o - cell_start_index));
         }
         if (o + size < cell_end_index + 1UL) {
             // Use the bytes to the right of the specified range.
-            split_cell(inv, kind, static_cast<int>(o + size),
-                       static_cast<unsigned int>(cell_end_index - (o + size - 1)));
+            split_cell(inv, kind, gsl::narrow<int>(o + size),
+                       gsl::narrow<unsigned int>(cell_end_index - (o + size - 1)));
         }
     }
 }
@@ -646,7 +646,7 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
             }
         }
         offset_t o(k);
-        unsigned size = static_cast<long>(width);
+        unsigned size = gsl::narrow<unsigned>(width);
         if (auto cell = lookup_array_map(kind).get_cell(o, size)) {
             return cell->get_scalar(kind);
         }
@@ -705,7 +705,7 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
                     } else {
                         b = boost::endian::native_to_little<index_t>(b);
                     }
-                    return kind == data_kind_t::uvalues ? number_t(b) : number_t(static_cast<int64_t>(b));
+                    return kind == data_kind_t::uvalues ? number_t(b) : number_t(gsl::narrow_cast<int64_t>(b));
                 }
             }
         }
diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 4272233a3..1760f4393 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1170,7 +1170,8 @@ string_invariant SplitDBM::to_set() const {
 std::ostream& operator<<(std::ostream& o, const SplitDBM& dom) { return o << dom.to_set(); }
 
 bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& out) const {
-    [[maybe_unused]] const bool overflow = convert_NtoW_overflow(e.constant_term(), out);
+    [[maybe_unused]]
+    const bool overflow = convert_NtoW_overflow(e.constant_term(), out);
     assert(!overflow);
     for (const auto& [variable, coefficient] : e.variable_terms()) {
         Weight coef;

From 1ef02eb1c48c6abd117280e2423d60e1022db600 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 1 Oct 2024 02:20:54 +0300
Subject: [PATCH 272/373] Use gsl::narrow in ebpf_domain.cpp (#709)

Also: introduce num_safety.hpp and two helpers: to_signed() and to_unsigned()
---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/array_domain.cpp     |  8 ++--
 src/crab/ebpf_domain.cpp      | 71 +++++++++++++++++------------------
 src/crab/type_domain.cpp      | 23 ++++++++++--
 src/crab/type_encoding.hpp    |  3 ++
 src/crab_utils/num_big.hpp    |  7 +---
 src/crab_utils/num_safety.hpp | 25 ++++++++++++
 src/ebpf_vm_isa.hpp           |  2 +
 7 files changed, 91 insertions(+), 48 deletions(-)
 create mode 100644 src/crab_utils/num_safety.hpp

diff --git a/src/crab/array_domain.cpp b/src/crab/array_domain.cpp
index df15cd73a..9b4825a8f 100644
--- a/src/crab/array_domain.cpp
+++ b/src/crab/array_domain.cpp
@@ -15,6 +15,7 @@
 #include "config.hpp"
 #include "crab/array_domain.hpp"
 #include "crab/dsl_syntax.hpp"
+#include "crab_utils/num_safety.hpp"
 #include "spec_type_descriptors.hpp"
 
 namespace crab::domains {
@@ -109,7 +110,8 @@ class cell_t final {
     cell_t(const offset_t offset, const unsigned size) : _offset(offset), _size(size) {}
 
     static interval_t to_interval(const offset_t o, const unsigned size) {
-        return {gsl::narrow<int>(o), number_t{gsl::narrow<int>(o)} + size - 1};
+        const number_t lb{gsl::narrow<int>(o)};
+        return {lb, lb + size - 1};
     }
 
   public:
@@ -646,7 +648,7 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
             }
         }
         offset_t o(k);
-        unsigned size = gsl::narrow<unsigned>(width);
+        unsigned size = to_unsigned(width);
         if (auto cell = lookup_array_map(kind).get_cell(o, size)) {
             return cell->get_scalar(kind);
         }
@@ -705,7 +707,7 @@ std::optional<linear_expression_t> array_domain_t::load(const NumAbsDomain& inv,
                     } else {
                         b = boost::endian::native_to_little<index_t>(b);
                     }
-                    return kind == data_kind_t::uvalues ? number_t(b) : number_t(gsl::narrow_cast<int64_t>(b));
+                    return kind == data_kind_t::uvalues ? number_t(b) : number_t(to_signed(b));
                 }
             }
         }
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index d72b6b9cd..baf8c398b 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -10,12 +10,12 @@
 
 #include "boost/endian/conversion.hpp"
 
-#include "crab/array_domain.hpp"
-#include "crab/ebpf_domain.hpp"
-
 #include "asm_ostream.hpp"
 #include "asm_unmarshal.hpp"
 #include "config.hpp"
+#include "crab/array_domain.hpp"
+#include "crab/ebpf_domain.hpp"
+#include "crab_utils/num_safety.hpp"
 #include "dsl_syntax.hpp"
 #include "platform.hpp"
 #include "string_constraints.hpp"
@@ -72,7 +72,7 @@ static std::vector<linear_constraint_t> assume_bit_cst_interval(const NumAbsDoma
     }
     uint64_t src_int_value = src_n.value().cast_to<uint64_t>();
     if (!is64) {
-        src_int_value = static_cast<uint32_t>(src_int_value);
+        src_int_value = gsl::narrow_cast<uint32_t>(src_int_value);
     }
 
     bool result;
@@ -134,11 +134,11 @@ static std::vector<linear_constraint_t> assume_signed_32bit_eq(const NumAbsDomai
                 lb -= 0x100000000;
             }
 
-            if (static_cast<uint64_t>(lb_match) <= static_cast<uint64_t>(ub_match)) {
+            if (to_unsigned(lb_match) <= to_unsigned(ub_match)) {
                 // The interval is also valid when cast to a uvalue, meaning
                 // both bounds are positive or both are negative.
-                return {left_svalue >= lb_match, left_svalue <= ub_match,
-                        left_uvalue >= static_cast<uint64_t>(lb_match), left_uvalue <= static_cast<uint64_t>(ub_match)};
+                return {left_svalue >= lb_match, left_svalue <= ub_match, left_uvalue >= to_unsigned(lb_match),
+                        left_uvalue <= to_unsigned(ub_match)};
             } else {
                 // The interval can only be represented as an svalue.
                 return {left_svalue >= lb_match, left_svalue <= ub_match};
@@ -652,7 +652,7 @@ static std::vector<linear_constraint_t> assume_cst_imm(const NumAbsDomain& inv,
     case Op::SLE:
     case Op::SGT:
     case Op::SLT:
-        return assume_signed_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm, static_cast<uint64_t>(imm));
+        return assume_signed_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm, gsl::narrow_cast<uint64_t>(imm));
     case Op::SET:
     case Op::NSET: return assume_bit_cst_interval(inv, op, is64, dst_uvalue, interval_t{imm});
     case Op::NE:
@@ -660,7 +660,8 @@ static std::vector<linear_constraint_t> assume_cst_imm(const NumAbsDomain& inv,
     case Op::LE:
     case Op::GT:
     case Op::LT:
-        return assume_unsigned_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm, static_cast<uint64_t>(imm));
+        return assume_unsigned_cst_interval(inv, op, is64, dst_svalue, dst_uvalue, imm,
+                                            gsl::narrow_cast<uint64_t>(imm));
     }
     return {};
 }
@@ -903,7 +904,7 @@ static void havoc_register(NumAbsDomain& inv, const Reg& reg) {
 
 void ebpf_domain_t::scratch_caller_saved_registers() {
     for (int i = R1_ARG; i <= R5_ARG; i++) {
-        Reg r{static_cast<uint8_t>(i)};
+        Reg r{gsl::narrow<uint8_t>(i)};
         havoc_register(m_inv, r);
         type_inv.havoc_type(m_inv, r);
     }
@@ -913,8 +914,7 @@ void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
     // Create variables specific to the new call stack frame that store
     // copies of the states of r6 through r9.
     for (int r = R6; r <= R9; r++) {
-        for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
-             kind = static_cast<data_kind_t>(static_cast<int>(kind) + 1)) {
+        for (const data_kind_t kind : iterate_kinds()) {
             const variable_t src_var = variable_t::reg(kind, r);
             if (!m_inv[src_var].is_top()) {
                 assign(variable_t::stack_frame_var(kind, r, prefix), src_var);
@@ -925,8 +925,7 @@ void ebpf_domain_t::save_callee_saved_registers(const std::string& prefix) {
 
 void ebpf_domain_t::restore_callee_saved_registers(const std::string& prefix) {
     for (int r = R6; r <= R9; r++) {
-        for (data_kind_t kind = data_kind_t::types; kind <= data_kind_t::stack_numeric_sizes;
-             kind = static_cast<data_kind_t>(static_cast<int>(kind) + 1)) {
+        for (const data_kind_t kind : iterate_kinds()) {
             const variable_t src_var = variable_t::stack_frame_var(kind, r, prefix);
             if (!m_inv[src_var].is_top()) {
                 assign(variable_t::reg(kind, r), src_var);
@@ -1249,7 +1248,7 @@ void ebpf_domain_t::operator()(const Assume& s) {
             m_inv.set_to_top();
         }
     } else {
-        const int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
+        const int64_t imm = gsl::narrow_cast<int64_t>(std::get<Imm>(cond.right).v);
         for (const linear_constraint_t& cst : assume_cst_imm(m_inv, cond.op, cond.is64, dst.svalue, dst.uvalue, imm)) {
             assume(cst);
         }
@@ -1648,7 +1647,7 @@ static std::tuple<linear_expression_t, linear_expression_t> lb_ub_access_pair(co
 void ebpf_domain_t::operator()(const ValidAccess& s) {
     using namespace crab::dsl_syntax;
 
-    const bool is_comparison_check = s.width == static_cast<Value>(Imm{0});
+    const bool is_comparison_check = s.width == Value{Imm{0}};
 
     const auto reg = reg_pack(s.reg);
     // join_over_types instead of simple iteration is only needed for assume-assert
@@ -1672,7 +1671,7 @@ void ebpf_domain_t::operator()(const ValidAccess& s) {
                     if (s.offset < 0) {
                         require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                     } else if (const auto pimm = std::get_if<Imm>(&s.width)) {
-                        if (!inv.entail(static_cast<int>(pimm->v) <= reg.stack_numeric_size - s.offset)) {
+                        if (!inv.entail(gsl::narrow<int>(pimm->v) <= reg.stack_numeric_size - s.offset)) {
                             require(inv, linear_constraint_t::false_const(), "Stack content is not numeric");
                         }
                     } else {
@@ -2016,8 +2015,8 @@ void ebpf_domain_t::operator()(const Mem& b) {
             do_mem_store(b, *preg, data_reg.svalue, data_reg.uvalue, data_reg);
         }
     } else {
-        do_mem_store(b, number_t{T_NUM}, number_t{static_cast<int64_t>(std::get<Imm>(b.value).v)},
-                     number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}, {});
+        const uint64_t imm = std::get<Imm>(b.value).v;
+        do_mem_store(b, number_t{T_NUM}, number_t{to_signed(imm)}, number_t{imm}, {});
     }
 }
 
@@ -2180,7 +2179,7 @@ void ebpf_domain_t::operator()(const Call& call) {
             if (const auto map_type = get_map_type(*maybe_fd_reg)) {
                 if (global_program_info->platform->get_map_type(*map_type).value_type == EbpfMapValueType::MAP) {
                     if (const auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
-                        do_load_mapfd(r0_reg, static_cast<int>(*inner_map_fd), true);
+                        do_load_mapfd(r0_reg, to_signed(*inner_map_fd), true);
                         goto out;
                     }
                 } else {
@@ -2320,8 +2319,8 @@ void ebpf_domain_t::shl(const Reg& dst_reg, int imm, const int finite_width) {
             const number_t ub = interval.ub().number().value();
             uint64_t lb_n = lb.cast_to<uint64_t>();
             uint64_t ub_n = ub.cast_to<uint64_t>();
-            const uint64_t uint_max = finite_width == 64 ? std::numeric_limits<uint64_t>::max()
-                                                         : static_cast<uint64_t>(std::numeric_limits<uint32_t>::max());
+            const uint64_t uint_max = finite_width == 64 ? uint64_t{std::numeric_limits<uint64_t>::max()}
+                                                         : uint64_t{std::numeric_limits<uint32_t>::max()};
             if (lb_n >> (finite_width - imm) != ub_n >> (finite_width - imm)) {
                 // The bits that will be shifted out to the left are different,
                 // which means all combinations of remaining bits are possible.
@@ -2335,7 +2334,7 @@ void ebpf_domain_t::shl(const Reg& dst_reg, int imm, const int finite_width) {
                 ub_n = ub_n << imm & uint_max;
             }
             m_inv.set(dst.uvalue, interval_t{lb_n, ub_n});
-            if (static_cast<int64_t>(ub_n) >= static_cast<int64_t>(lb_n)) {
+            if (to_signed(ub_n) >= to_signed(lb_n)) {
                 m_inv.assign(dst.svalue, dst.uvalue);
             } else {
                 havoc(dst.svalue);
@@ -2456,8 +2455,8 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                     lb_n = lb.cast_to<int64_t>() >> imm;
                     ub_n = ub.cast_to<int64_t>() >> imm;
                 } else {
-                    number_t lb_w = lb.cast_to_sint(finite_width) >> static_cast<int>(imm);
-                    number_t ub_w = ub.cast_to_sint(finite_width) >> static_cast<int>(imm);
+                    number_t lb_w = lb.cast_to_sint(finite_width) >> gsl::narrow<int>(imm);
+                    number_t ub_w = ub.cast_to_sint(finite_width) >> gsl::narrow<int>(imm);
                     if (lb_w.cast_to<uint32_t>() <= ub_w.cast_to<uint32_t>()) {
                         lb_n = lb_w.cast_to<uint32_t>();
                         ub_n = ub_w.cast_to<uint32_t>();
@@ -2465,7 +2464,7 @@ void ebpf_domain_t::ashr(const Reg& dst_reg, const linear_expression_t& right_sv
                 }
             }
             m_inv.set(dst.svalue, interval_t{lb_n, ub_n});
-            if (static_cast<uint64_t>(ub_n) >= static_cast<uint64_t>(lb_n)) {
+            if (to_unsigned(ub_n) >= to_unsigned(lb_n)) {
                 m_inv.assign(dst.uvalue, dst.svalue);
             } else {
                 havoc(dst.uvalue);
@@ -2493,10 +2492,10 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         int64_t imm;
         if (bin.is64) {
             // Use the full signed value.
-            imm = static_cast<int64_t>(pimm->v);
+            imm = to_signed(pimm->v);
         } else {
             // Use only the low 32 bits of the value.
-            imm = static_cast<int32_t>(pimm->v);
+            imm = gsl::narrow_cast<int32_t>(pimm->v);
             bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
         }
         switch (bin.op) {
@@ -2514,13 +2513,13 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             if (imm == 0) {
                 return;
             }
-            add(bin.dst, static_cast<int>(imm), finite_width);
+            add(bin.dst, gsl::narrow<int>(imm), finite_width);
             break;
         case Bin::Op::SUB:
             if (imm == 0) {
                 return;
             }
-            add(bin.dst, static_cast<int>(-imm), finite_width);
+            add(bin.dst, gsl::narrow<int>(-imm), finite_width);
             break;
         case Bin::Op::MUL:
             mul(dst.svalue, dst.uvalue, imm, finite_width);
@@ -2549,7 +2548,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
         case Bin::Op::AND:
             // FIX: what to do with ptr&-8 as in counter/simple_loop_unrolled?
             bitwise_and(dst.svalue, dst.uvalue, imm);
-            if (static_cast<int32_t>(imm) > 0) {
+            if (gsl::narrow<int32_t>(imm) > 0) {
                 // AND with immediate is only a 32-bit operation so svalue and uvalue are the same.
                 assume(dst.svalue <= imm);
                 assume(dst.uvalue <= imm);
@@ -2558,9 +2557,9 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             }
             havoc_offsets(bin.dst);
             break;
-        case Bin::Op::LSH: shl(bin.dst, static_cast<int32_t>(imm), finite_width); break;
-        case Bin::Op::RSH: lshr(bin.dst, static_cast<int32_t>(imm), finite_width); break;
-        case Bin::Op::ARSH: ashr(bin.dst, static_cast<int32_t>(imm), finite_width); break;
+        case Bin::Op::LSH: shl(bin.dst, gsl::narrow<int32_t>(imm), finite_width); break;
+        case Bin::Op::RSH: lshr(bin.dst, gsl::narrow<int32_t>(imm), finite_width); break;
+        case Bin::Op::ARSH: ashr(bin.dst, gsl::narrow<int32_t>(imm), finite_width); break;
         case Bin::Op::XOR:
             bitwise_xor(dst.svalue, dst.uvalue, imm);
             havoc_offsets(bin.dst);
@@ -2721,7 +2720,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                             // Use only the low 32 bits of the value.
                             bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
                         }
-                        shl(bin.dst, static_cast<int32_t>(imm), finite_width);
+                        shl(bin.dst, gsl::narrow_cast<int32_t>(imm), finite_width);
                         break;
                     }
                 }
@@ -2739,7 +2738,7 @@ void ebpf_domain_t::operator()(const Bin& bin) {
                             // Use only the low 32 bits of the value.
                             bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
                         }
-                        lshr(bin.dst, static_cast<int32_t>(imm), finite_width);
+                        lshr(bin.dst, gsl::narrow_cast<int32_t>(imm), finite_width);
                         break;
                     }
                 }
diff --git a/src/crab/type_domain.cpp b/src/crab/type_domain.cpp
index 7d0242d58..125a409e6 100644
--- a/src/crab/type_domain.cpp
+++ b/src/crab/type_domain.cpp
@@ -17,14 +17,31 @@
 
 namespace crab {
 
-static void operator++(type_encoding_t& t) { t = static_cast<type_encoding_t>(1 + static_cast<int>(t)); }
+template <is_enum T>
+static void operator++(T& t) {
+    t = static_cast<T>(1 + static_cast<std::underlying_type_t<T>>(t));
+}
+
+std::vector<data_kind_t> iterate_kinds(const data_kind_t lb, const data_kind_t ub) {
+    if (lb > ub) {
+        CRAB_ERROR("lower bound ", lb, " is greater than upper bound ", ub);
+    }
+    if (lb < KIND_MIN || ub > KIND_MAX) {
+        CRAB_ERROR("bounds ", lb, " and ", ub, " are out of range");
+    }
+    std::vector<data_kind_t> res;
+    for (data_kind_t i = lb; i <= ub; ++i) {
+        res.push_back(i);
+    }
+    return res;
+}
 
 std::vector<type_encoding_t> iterate_types(const type_encoding_t lb, const type_encoding_t ub) {
     if (lb > ub) {
-        CRAB_ERROR("iterate_types: lower bound ", lb, " is greater than upper bound ", ub);
+        CRAB_ERROR("lower bound ", lb, " is greater than upper bound ", ub);
     }
     if (lb < T_MIN || ub > T_MAX) {
-        CRAB_ERROR("iterate_types: bounds ", lb, " and ", ub, " are out of range");
+        CRAB_ERROR("bounds ", lb, " and ", ub, " are out of range");
     }
     std::vector<type_encoding_t> res;
     for (type_encoding_t i = lb; i <= ub; ++i) {
diff --git a/src/crab/type_encoding.hpp b/src/crab/type_encoding.hpp
index 77f3c2be2..10c7d7001 100644
--- a/src/crab/type_encoding.hpp
+++ b/src/crab/type_encoding.hpp
@@ -20,9 +20,12 @@ enum class data_kind_t {
     shared_region_sizes,
     stack_numeric_sizes
 };
+constexpr auto KIND_MIN = data_kind_t::types;
+constexpr auto KIND_MAX = data_kind_t::stack_numeric_sizes;
 
 std::string name_of(data_kind_t kind);
 data_kind_t regkind(const std::string& s);
+std::vector<data_kind_t> iterate_kinds(data_kind_t lb = KIND_MIN, data_kind_t ub = KIND_MAX);
 std::ostream& operator<<(std::ostream& o, const data_kind_t& s);
 
 // The exact numbers are taken advantage of in ebpf_domain_t
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index f7ea98a7a..538921a2b 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -9,17 +9,12 @@
 
 #include <boost/multiprecision/cpp_int.hpp>
 
+#include "crab_utils/num_safety.hpp"
 #include "debug.hpp"
 using boost::multiprecision::cpp_int;
 
 namespace crab {
 
-template <typename T>
-concept is_enum = std::is_enum_v<T>;
-
-template <std::integral T>
-using swap_signedness = std::conditional_t<std::is_signed_v<T>, std::make_unsigned_t<T>, std::make_signed_t<T>>;
-
 class number_t final {
     cpp_int _n{};
 
diff --git a/src/crab_utils/num_safety.hpp b/src/crab_utils/num_safety.hpp
new file mode 100644
index 000000000..c6a1d0e23
--- /dev/null
+++ b/src/crab_utils/num_safety.hpp
@@ -0,0 +1,25 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+#pragma once
+
+#include <concepts>
+
+#include <gsl/narrow>
+
+namespace crab {
+
+template <typename T>
+concept is_enum = std::is_enum_v<T>;
+
+template <std::integral T>
+using swap_signedness = std::conditional_t<std::is_signed_v<T>, std::make_unsigned_t<T>, std::make_signed_t<T>>;
+
+constexpr auto to_signed(std::unsigned_integral auto x) -> std::make_signed_t<decltype(x)> {
+    return static_cast<std::make_signed_t<decltype(x)>>(x);
+}
+
+constexpr auto to_unsigned(std::signed_integral auto x) -> std::make_unsigned_t<decltype(x)> {
+    return static_cast<std::make_unsigned_t<decltype(x)>>(x);
+}
+
+} // namespace crab
diff --git a/src/ebpf_vm_isa.hpp b/src/ebpf_vm_isa.hpp
index 66a632053..09f204e5a 100644
--- a/src/ebpf_vm_isa.hpp
+++ b/src/ebpf_vm_isa.hpp
@@ -87,7 +87,9 @@ enum {
     INST_ALU_OP_ARSH = 0xc0,
     INST_ALU_OP_END = 0xd0,
     INST_ALU_OP_MASK = 0xf0,
+};
 
+enum {
     R0_RETURN_VALUE = 0,
     R1_ARG = 1,
     R2_ARG = 2,

From 6d84933a289507682dd6ac0efebe8bf456e479fc Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 1 Oct 2024 04:17:45 +0300
Subject: [PATCH 273/373] use gsl::narrow in asm files (#710)

* gsl::narrow in asm_files.cpp, asm_unmarshal.cpp, asm_ostream.hpp, ebpf_yaml.cpp and test_marshal.cpp
---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_files.cpp         | 15 ++++++------
 src/asm_files.hpp         |  7 +++---
 src/asm_ostream.hpp       | 51 ++++++++++++++++++++-------------------
 src/asm_unmarshal.cpp     | 35 +++++++++++++++------------
 src/ebpf_yaml.cpp         |  4 +--
 src/test/test_marshal.cpp |  2 +-
 6 files changed, 60 insertions(+), 54 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index d39c365f3..2f86ff7ed 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -14,6 +14,7 @@
 #include "libbtf/btf_parse.h"
 
 #include "asm_files.hpp"
+#include "crab_utils/num_safety.hpp"
 #include "platform.hpp"
 
 using std::string;
@@ -33,11 +34,11 @@ static vector<T> vector_of(const ELFIO::section& sec) {
 }
 
 int create_map_crab(const EbpfMapType& map_type, uint32_t key_size, uint32_t value_size, uint32_t max_entries,
-                    ebpf_verifier_options_t options) {
+                    ebpf_verifier_options_t) {
     const EquivalenceKey equiv{map_type.value_type, key_size, value_size, map_type.is_array ? max_entries : 0};
     if (!global_program_info->cache.contains(equiv)) {
         // +1 so 0 is the null FD
-        global_program_info->cache[equiv] = static_cast<int>(global_program_info->cache.size()) + 1;
+        global_program_info->cache[equiv] = gsl::narrow<int>(global_program_info->cache.size()) + 1;
     }
     return global_program_info->cache.at(equiv);
 }
@@ -249,13 +250,13 @@ static void append_subprograms(raw_program& prog, const vector<raw_program>& pro
         }
 
         // Fill in the PC offset into the imm field of the CallLocal instruction.
-        const ELFIO::Elf_Xword target_offset = subprogram_offsets[reloc.target_function_name];
-        const auto offset_diff = static_cast<int64_t>(target_offset - reloc.source_offset - 1);
+        const int64_t target_offset = gsl::narrow_cast<int64_t>(subprogram_offsets[reloc.target_function_name]);
+        const auto offset_diff = target_offset - gsl::narrow<int64_t>(reloc.source_offset) - 1;
         if (offset_diff < std::numeric_limits<int32_t>::min() || offset_diff > std::numeric_limits<int32_t>::max()) {
             throw std::runtime_error("Offset difference out of int32_t range for instruction at source offset " +
                                      std::to_string(reloc.source_offset));
         }
-        prog.prog[reloc.source_offset].imm = static_cast<int32_t>(offset_diff);
+        prog.prog[reloc.source_offset].imm = gsl::narrow_cast<int32_t>(offset_diff);
     }
 }
 
@@ -265,7 +266,7 @@ std::map<std::string, size_t> parse_map_section(const libbtf::btf_type_data& btf
     for (auto& map : parse_btf_map_section(btf_data)) {
         map_offsets.emplace(map.name, map_descriptors.size());
         map_descriptors.push_back({
-            .original_fd = static_cast<int>(map.type_id),
+            .original_fd = gsl::narrow_cast<int>(map.type_id),
             .type = map.map_type,
             .key_size = map.key_size,
             .value_size = map.value_size,
@@ -379,7 +380,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
             auto [program_name, program_size] = get_program_name_and_size(*section, program_offset, symbols);
             raw_program prog{path,
                              name,
-                             static_cast<uint32_t>(program_offset),
+                             gsl::narrow_cast<uint32_t>(program_offset),
                              program_name,
                              vector_of<ebpf_inst>(section_data + program_offset, program_size),
                              info};
diff --git a/src/asm_files.hpp b/src/asm_files.hpp
index 74bebb7cf..c22a5cb2d 100644
--- a/src/asm_files.hpp
+++ b/src/asm_files.hpp
@@ -10,10 +10,11 @@
 #include "platform.hpp"
 
 std::vector<raw_program> read_raw(std::string path, program_info info);
-std::vector<raw_program> read_elf(const std::string& path, const std::string& section,
-                                  const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
-std::vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& section,
+std::vector<raw_program> read_elf(const std::string& path, const std::string& desired_section,
                                   const ebpf_verifier_options_t* options, const ebpf_platform_t* platform);
+std::vector<raw_program> read_elf(std::istream& input_stream, const std::string& path,
+                                  const std::string& desired_section, const ebpf_verifier_options_t* options,
+                                  const ebpf_platform_t* platform);
 
 void write_binary_file(std::string path, const char* data, size_t size);
 
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index d357acd2c..ce0442ebd 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -9,14 +9,15 @@
 #include <boost/lexical_cast.hpp>
 
 #include "asm_syntax.hpp"
+#include "crab_utils/num_safety.hpp"
 
 // We use a 16-bit offset whenever it fits in 16 bits.
 inline std::function<int16_t(label_t)> label_to_offset16(pc_t pc) {
     return [=](const label_t& label) {
-        const int64_t offset = label.from - static_cast<int64_t>(pc) - 1;
-        return std::numeric_limits<int16_t>::min() <= offset && offset <= std::numeric_limits<int16_t>::max()
-                   ? static_cast<int16_t>(offset)
-                   : 0;
+        const int64_t offset = label.from - gsl::narrow<int64_t>(pc) - 1;
+        const bool is16 =
+            std::numeric_limits<int16_t>::min() <= offset && offset <= std::numeric_limits<int16_t>::max();
+        return is16 ? gsl::narrow<int16_t>(offset) : 0;
     };
 }
 
@@ -24,8 +25,10 @@ inline std::function<int16_t(label_t)> label_to_offset16(pc_t pc) {
 // of an unconditional jump doesn't fit in a int16_t.
 inline std::function<int32_t(label_t)> label_to_offset32(const pc_t pc) {
     return [=](const label_t& label) {
-        int64_t offset = label.from - static_cast<int64_t>(pc) - 1;
-        return (offset >= INT16_MIN && offset <= INT16_MAX) ? 0 : static_cast<int32_t>(offset);
+        const int64_t offset = label.from - gsl::narrow<int64_t>(pc) - 1;
+        const bool is16 =
+            std::numeric_limits<int16_t>::min() <= offset && offset <= std::numeric_limits<int16_t>::max();
+        return is16 ? 0 : gsl::narrow<int32_t>(offset);
     };
 }
 
@@ -42,30 +45,28 @@ std::string to_string(Instruction const& ins);
 std::ostream& operator<<(std::ostream& os, Bin::Op op);
 std::ostream& operator<<(std::ostream& os, Condition::Op op);
 
-inline std::ostream& operator<<(std::ostream& os, const Imm imm) { return os << static_cast<int64_t>(imm.v); }
-inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << static_cast<int>(a.v); }
+inline std::ostream& operator<<(std::ostream& os, const Imm imm) { return os << crab::to_signed(imm.v); }
+inline std::ostream& operator<<(std::ostream& os, Reg const& a) { return os << "r" << gsl::narrow<int>(a.v); }
 inline std::ostream& operator<<(std::ostream& os, Value const& a) {
-    if (auto pa = std::get_if<Imm>(&a)) {
+    if (const auto pa = std::get_if<Imm>(&a)) {
         return os << *pa;
     }
     return os << std::get<Reg>(a);
 }
 
-inline std::ostream& operator<<(std::ostream& os, Undefined const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Callx const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Atomic const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << static_cast<Instruction>(a); }
-inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) {
-    return os << static_cast<Instruction>(a);
-}
+inline std::ostream& operator<<(std::ostream& os, Undefined const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Callx const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Exit const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Jmp const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Packet const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Mem const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Atomic const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Assume const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, Assert const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, IncrementLoopCounter const& a) { return os << Instruction{a}; }
 std::ostream& operator<<(std::ostream& os, AssertionConstraint const& a);
 std::string to_string(AssertionConstraint const& constraint);
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index cae060d4d..24086438e 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -6,6 +6,7 @@
 #include <vector>
 
 #include "asm_unmarshal.hpp"
+#include "crab_utils/num_safety.hpp"
 #include "ebpf_vm_isa.hpp"
 
 using std::string;
@@ -84,7 +85,9 @@ static Instruction shift32(const Reg dst, const Bin::Op op) {
 struct Unmarshaller {
     vector<vector<string>>& notes;
     const program_info& info;
+    // ReSharper disable once CppMemberFunctionMayBeConst
     void note(const string& what) { notes.back().emplace_back(what); }
+    // ReSharper disable once CppMemberFunctionMayBeConst
     void note_next_pc() { notes.emplace_back(); }
     explicit Unmarshaller(vector<vector<string>>& notes, const program_info& info) : notes{notes}, info{info} {
         note_next_pc();
@@ -216,7 +219,7 @@ struct Unmarshaller {
     }
 
     static auto getAtomicOp(const size_t pc, const ebpf_inst inst) -> Atomic::Op {
-        switch (const auto op = static_cast<Atomic::Op>(inst.imm & ~INST_FETCH)) {
+        switch (const auto op = gsl::narrow<Atomic::Op>(inst.imm & ~INST_FETCH)) {
         case Atomic::Op::XCHG:
         case Atomic::Op::CMPXCHG:
             if ((inst.imm & INST_FETCH) == 0) {
@@ -230,9 +233,9 @@ struct Unmarshaller {
         throw InvalidInstruction(pc, "unsupported immediate");
     }
 
-    static uint64_t sign_extend(const int32_t imm) { return static_cast<uint64_t>(static_cast<int64_t>(imm)); }
+    static uint64_t sign_extend(const int32_t imm) { return crab::to_unsigned(int64_t{imm}); }
 
-    static uint64_t zero_extend(const int32_t imm) { return static_cast<uint64_t>(static_cast<uint32_t>(imm)); }
+    static uint64_t zero_extend(const int32_t imm) { return uint64_t{crab::to_unsigned(imm)}; }
 
     static auto getBinValue(const pc_t pc, const ebpf_inst inst) -> Value {
         if (inst.opcode & INST_SRC_REG) {
@@ -345,9 +348,9 @@ struct Unmarshaller {
                         .basereg = Reg{basereg},
                         .offset = inst.offset,
                     },
-                .value = isLoad ? static_cast<Value>(Reg{inst.dst})
-                                : (isImm ? static_cast<Value>(Imm{zero_extend(inst.imm)})
-                                         : static_cast<Value>(Reg{inst.src})),
+                .value = isLoad  ? Value{Reg{inst.dst}}
+                         : isImm ? Value{Imm{zero_extend(inst.imm)}}
+                                 : Value{Reg{inst.src}},
                 .is_load = isLoad,
             };
             return res;
@@ -502,7 +505,7 @@ struct Unmarshaller {
             case EBPF_ARGUMENT_TYPE_PTR_TO_MAP_KEY:
             case EBPF_ARGUMENT_TYPE_PTR_TO_MAP_VALUE:
             case EBPF_ARGUMENT_TYPE_PTR_TO_CTX:
-                res.singles.push_back({toArgSingleKind(args[i]), Reg{static_cast<uint8_t>(i)}});
+                res.singles.push_back({toArgSingleKind(args[i]), Reg{gsl::narrow<uint8_t>(i)}});
                 break;
             case EBPF_ARGUMENT_TYPE_CONST_SIZE: {
                 // Sanity check: This argument should never be seen in isolation.
@@ -535,8 +538,8 @@ struct Unmarshaller {
                         proto.name);
                 }
                 const bool can_be_zero = (args[i + 1] == EBPF_ARGUMENT_TYPE_CONST_SIZE_OR_ZERO);
-                res.pairs.push_back({toArgPairKind(args[i]), Reg{static_cast<uint8_t>(i)},
-                                     Reg{static_cast<uint8_t>(i + 1)}, can_be_zero});
+                res.pairs.push_back({toArgPairKind(args[i]), Reg{gsl::narrow<uint8_t>(i)},
+                                     Reg{gsl::narrow<uint8_t>(i + 1)}, can_be_zero});
                 i++;
                 break;
             }
@@ -553,7 +556,7 @@ struct Unmarshaller {
         if (insts[new_pc].opcode == 0) {
             throw InvalidInstruction(pc, "jump to middle of lddw");
         }
-        return label_t{static_cast<int>(new_pc)};
+        return label_t{gsl::narrow<int>(new_pc)};
     }
 
     static auto makeCallLocal(const ebpf_inst inst, const vector<ebpf_inst>& insts, const pc_t pc) -> CallLocal {
@@ -579,7 +582,7 @@ struct Unmarshaller {
             if (inst.imm < 0 || inst.imm > R10_STACK_POINTER) {
                 throw InvalidInstruction(pc, "bad register");
             }
-            return Callx{static_cast<uint8_t>(inst.imm)};
+            return Callx{gsl::narrow<uint8_t>(inst.imm)};
         }
         return Callx{inst.dst};
     }
@@ -685,9 +688,9 @@ struct Unmarshaller {
                                   ? std::optional<Condition>{}
                                   : Condition{.op = op,
                                               .left = Reg{inst.dst},
-                                              .right = (inst.opcode & INST_SRC_REG) ? static_cast<Value>(Reg{inst.src})
-                                                                                    : Imm{sign_extend(inst.imm)},
-                                              .is64 = ((inst.opcode & INST_CLS_MASK) == INST_CLS_JMP)};
+                                              .right = (inst.opcode & INST_SRC_REG) ? Value{Reg{inst.src}}
+                                                                                    : Value{Imm{sign_extend(inst.imm)}},
+                                              .is64 = (inst.opcode & INST_CLS_MASK) == INST_CLS_JMP};
             return Jmp{.cond = cond, .target = target};
         }
         }
@@ -708,7 +711,7 @@ struct Unmarshaller {
             case INST_CLS_LD:
                 if (inst.opcode == INST_OP_LDDW_IMM) {
                     const int32_t next_imm = pc < insts.size() - 1 ? insts[pc + 1].imm : 0;
-                    new_ins = makeLddw(inst, next_imm, insts, static_cast<pc_t>(pc));
+                    new_ins = makeLddw(inst, next_imm, insts, pc);
                     skip_instruction = true;
                     break;
                 }
@@ -774,7 +777,7 @@ struct Unmarshaller {
                 current_line_info = line_info[pc];
             }
 
-            prog.emplace_back(label_t(static_cast<int>(pc)), new_ins, current_line_info);
+            prog.emplace_back(label_t(gsl::narrow<int>(pc)), new_ins, current_line_info);
 
             pc++;
             note_next_pc();
diff --git a/src/ebpf_yaml.cpp b/src/ebpf_yaml.cpp
index 593f8e24f..9b2e57120 100644
--- a/src/ebpf_yaml.cpp
+++ b/src/ebpf_yaml.cpp
@@ -144,7 +144,7 @@ static InstructionSeq raw_cfg_to_instruction_seq(const vector<std::tuple<string,
     for (const auto& [label_name, raw_block] : raw_blocks) {
         label_name_to_label.emplace(label_name, label_index);
         // don't count large instructions as 2
-        label_index += static_cast<int>(raw_block.size());
+        label_index += gsl::narrow<int>(raw_block.size());
     }
 
     InstructionSeq res;
@@ -296,7 +296,7 @@ string_invariant stack_contents_invariant(const std::vector<uint8_t>& memory_byt
                                   "s[" + std::to_string(EBPF_STACK_SIZE - memory_bytes.size()) + "..." +
                                       std::to_string(EBPF_STACK_SIZE - 1) + "].type=number"};
 
-    int offset = EBPF_STACK_SIZE - static_cast<int>(memory_bytes.size());
+    int offset = EBPF_STACK_SIZE - gsl::narrow<int>(memory_bytes.size());
     if (offset % 2 != 0) {
         add_stack_variable<int8_t>(more, offset, memory_bytes);
     }
diff --git a/src/test/test_marshal.cpp b/src/test/test_marshal.cpp
index 975079516..883b3eecb 100644
--- a/src/test/test_marshal.cpp
+++ b/src/test/test_marshal.cpp
@@ -499,7 +499,7 @@ TEST_CASE("marshal", "[disasm][marshal]") {
         Mem m{.access = access, .value = Reg{3}, .is_load = true};
         auto ins = marshal(m, 0).at(0);
         ebpf_inst expect{
-            .opcode = static_cast<uint8_t>(INST_CLS_LD | INST_MODE_MEM | width_to_opcode(1) | 0x1),
+            .opcode = gsl::narrow<uint8_t>(INST_CLS_LD | INST_MODE_MEM | width_to_opcode(1) | 0x1),
             .dst = 3,
             .src = 4,
             .offset = 6,

From 23e83827836cfee1fc196284fee9850bd4d3218e Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 1 Oct 2024 18:37:13 +0300
Subject: [PATCH 274/373] modernize graph_ops.hpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_utils/graph_ops.hpp | 273 ++++++++++++-----------------------
 1 file changed, 95 insertions(+), 178 deletions(-)

diff --git a/src/crab_utils/graph_ops.hpp b/src/crab_utils/graph_ops.hpp
index 4fe3910fa..95447cbde 100644
--- a/src/crab_utils/graph_ops.hpp
+++ b/src/crab_utils/graph_ops.hpp
@@ -2,43 +2,37 @@
 // SPDX-License-Identifier: Apache-2.0
 #pragma once
 
+// A set of utility algorithms for manipulating graphs.
+
 #include <algorithm>
 #include <optional>
 
 #include "crab_utils/heap.hpp"
 #include "crab_utils/lazy_allocator.hpp"
-
-//============================
-// A set of utility algorithms for manipulating graphs.
-
-#ifdef __GNUC__
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wsign-compare"
-#endif
+#include "crab_utils/num_safety.hpp"
 
 namespace crab {
 // Graph views - for when we want to traverse some mutation
 // of the graph without actually constructing it.
 // ============
 
-// Processing a graph under a (possibly incomplete)
-// permutation of vertices.
-// We assume perm[x] is unique; otherwise, we'd have
-// to introduce a edges for induced equivalence classes.
+// Processing a graph under a (possibly incomplete) permutation of vertices.
+// We assume perm[x] is unique; otherwise, we'd have to introduce edges for induced equivalence classes.
 template <class G>
 class GraphPerm {
   public:
     using vert_id = typename G::vert_id;
+    constexpr static vert_id invalid_vert = std::numeric_limits<vert_id>::max();
     using Weight = typename G::Weight;
     using g_neighbour_const_range = typename G::neighbour_const_range;
     using mut_val_ref_t = typename G::mut_val_ref_t;
 
-    GraphPerm(const std::vector<vert_id>& _perm, G& _g) : g(_g), perm(_perm), inv(_g.size(), -1) {
+    GraphPerm(const std::vector<vert_id>& _perm, G& _g) : g{_g}, perm{_perm}, inv(_g.size(), invalid_vert) {
         for (unsigned int vi = 0; vi < perm.size(); vi++) {
-            if (perm[vi] == -1) {
+            if (perm[vi] == invalid_vert) {
                 continue;
             }
-            assert(inv[perm[vi]] == -1);
+            assert(inv[perm[vi]] == invalid_vert);
             inv[perm[vi]] = vi;
         }
     }
@@ -87,14 +81,14 @@ class GraphPerm {
       public:
         class iterator final {
           public:
-            explicit iterator(const vert_id& _v) : v(_v) {}
-            const vert_id& operator*() const { return v; }
+            explicit iterator(const vert_id _v) : v{_v} {}
+            vert_id operator*() const { return v; }
             iterator& operator++() {
-                v++;
+                ++v;
                 return *this;
             }
             iterator& operator--() {
-                v--;
+                --v;
                 return *this;
             }
             bool operator!=(const iterator& o) const { return v < o.v; }
@@ -102,17 +96,17 @@ class GraphPerm {
           private:
             vert_id v;
         };
-        explicit vert_const_range(const vert_id& _after) : after(_after) {}
+        explicit vert_const_range(const vert_id _after) : after{_after} {}
 
-        iterator begin() const { return iterator((vert_id)0); }
-        iterator end() const { return iterator(after); }
+        iterator begin() const { return iterator{0}; }
+        iterator end() const { return iterator{after}; }
 
       private:
         vert_id after;
     };
     using vert_const_iterator = typename vert_const_range::iterator;
 
-    vert_const_range verts() const { return vert_const_range(static_cast<vert_id>(perm.size())); }
+    vert_const_range verts() const { return vert_const_range(gsl::narrow<vert_id>(perm.size())); }
 
     // GKG: Should probably modify this to handle cases where
     // the vertex iterator isn't just a vert_id*.
@@ -129,7 +123,7 @@ class GraphPerm {
         }
 
         bool operator!=(const adj_const_iterator& other) {
-            while (v != other.v && inv[*v] == (-1)) {
+            while (v != other.v && inv[*v] == (invalid_vert)) {
                 ++v;
             }
             return v != other.v;
@@ -155,7 +149,7 @@ class GraphPerm {
         }
 
         bool operator!=(const e_adj_const_iterator& other) {
-            while (v != other.v && inv[(*v).vert] == (-1)) {
+            while (v != other.v && inv[(*v).vert] == (invalid_vert)) {
                 ++v;
             }
             return v != other.v;
@@ -181,21 +175,19 @@ class GraphPerm {
         iterator begin() const {
             if (adj) {
                 return iterator(inv, (*adj).begin());
-            } else {
-                return iterator(inv, ItG::empty_iterator());
             }
+            return iterator(inv, ItG::empty_iterator());
         }
         iterator end() const {
             if (adj) {
                 return iterator(inv, (*adj).end());
-            } else {
-                return iterator(inv, ItG::empty_iterator());
             }
+            return iterator(inv, ItG::empty_iterator());
         }
 
         [[nodiscard]]
         bool mem(unsigned int v) const {
-            if (!adj || perm[v] == (-1)) {
+            if (!adj || perm[v] == (invalid_vert)) {
                 return false;
             }
             return (*adj).mem(perm[v]);
@@ -223,21 +215,19 @@ class GraphPerm {
         iterator begin() const {
             if (adj) {
                 return iterator(inv, (*adj).begin());
-            } else {
-                return iterator(inv, ItG::empty_iterator());
             }
+            return iterator(inv, ItG::empty_iterator());
         }
         iterator end() const {
             if (adj) {
                 return iterator(inv, (*adj).end());
-            } else {
-                return iterator(inv, ItG::empty_iterator());
             }
+            return iterator(inv, ItG::empty_iterator());
         }
 
         [[nodiscard]]
         bool mem(unsigned int v) const {
-            if (!adj || perm[v] == (-1)) {
+            if (!adj || perm[v] == (invalid_vert)) {
                 return false;
             }
             return (*adj).mem(perm[v]);
@@ -249,43 +239,35 @@ class GraphPerm {
         std::optional<RG> adj;
     };
 
-    //    using neighbour_range = adj_list<typename G::neighbour_range, adj_iterator<typename
-    //    G::neighbour_range::iterator>>; using e_neighbour_range = adj_list<typename G::e_neighbour_range,
-    //    e_adj_iterator<typename G::e_neighbour_range::iterator>>;
-
     using neighbour_const_range = const_adj_list<typename G::neighbour_const_range,
                                                  adj_const_iterator<typename G::neighbour_const_range::iterator>>;
     using e_neighbour_const_range = const_adj_list<typename G::e_neighbour_const_range,
                                                    e_adj_const_iterator<typename G::e_neighbour_const_range::iterator>>;
 
     neighbour_const_range succs(vert_id v) const {
-        if (perm[v] == (-1)) {
+        if (perm[v] == (invalid_vert)) {
             return neighbour_const_range(perm, inv);
-        } else {
-            return neighbour_const_range(perm, inv, g.succs(perm[v]));
         }
+        return neighbour_const_range(perm, inv, g.succs(perm[v]));
     }
     neighbour_const_range preds(vert_id v) const {
-        if (perm[v] == (-1)) {
+        if (perm[v] == (invalid_vert)) {
             return neighbour_const_range(perm, inv);
-        } else {
-            return neighbour_const_range(perm, inv, g.preds(perm[v]));
         }
+        return neighbour_const_range(perm, inv, g.preds(perm[v]));
     }
 
     e_neighbour_const_range e_succs(vert_id v) const {
-        if (perm[v] == (-1)) {
+        if (perm[v] == (invalid_vert)) {
             return e_neighbour_const_range(perm, inv);
-        } else {
-            return e_neighbour_const_range(perm, inv, g.e_succs(perm[v]));
         }
+        return e_neighbour_const_range(perm, inv, g.e_succs(perm[v]));
     }
     e_neighbour_const_range e_preds(vert_id v) const {
-        if (perm[v] == (-1)) {
+        if (perm[v] == (invalid_vert)) {
             return e_neighbour_const_range(perm, inv);
-        } else {
-            return e_neighbour_const_range(perm, inv, g.e_preds(perm[v]));
         }
+        return e_neighbour_const_range(perm, inv, g.e_preds(perm[v]));
     }
 
     const G& g;
@@ -307,9 +289,9 @@ class SubGraph {
 
     SubGraph(G& _g, vert_id _v_ex) : g(_g), v_ex(_v_ex) {}
 
-    bool elem(vert_id x, vert_id y) const { return (x != v_ex && y != v_ex && g.elem(x, y)); }
+    bool elem(vert_id x, vert_id y) const { return x != v_ex && y != v_ex && g.elem(x, y); }
 
-    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) { return (x != v_ex && y != v_ex && g.lookup(x, y, w)); }
+    bool lookup(vert_id x, vert_id y, mut_val_ref_t* w) { return x != v_ex && y != v_ex && g.lookup(x, y, w); }
 
     std::optional<Weight> lookup(vert_id x, vert_id y) const {
         return (x != v_ex && y != v_ex) ? g.lookup(x, y) : std::optional<Weight>{};
@@ -322,8 +304,6 @@ class SubGraph {
 
     void clear_edges() { g.clear_edges(); }
 
-    void clear() { assert(0 && "SubGraph::clear not implemented."); }
-
     // Number of allocated vertices
     [[nodiscard]]
     size_t size() const {
@@ -550,11 +530,9 @@ class GraphOps {
     static thread_local size_t scratch_sz;
 
     // For locality, should combine dists & dist_ts.
-    // Weight must have an empty constructor, but does _not_
-    // need a top or infty element.
-    // dist_ts tells us which distances are current,
-    // and ts_idx prevents wraparound problems, in the unlikely
-    // circumstance that we have more than 2^sizeof(uint) iterations.
+    // Weight must have an empty constructor, but does _not_ need a top or infty element.
+    // dist_ts tells us which distances are current, and ts_idx prevents wraparound problems,
+    // in the unlikely circumstance that we have more than 2^sizeof(uint) iterations.
     static thread_local lazy_allocator<std::vector<Weight>> dists;
     static thread_local lazy_allocator<std::vector<Weight>> dists_alt;
     static thread_local lazy_allocator<std::vector<unsigned int>> dist_ts;
@@ -573,7 +551,7 @@ class GraphOps {
         ts_idx = 0;
     }
 
-    static void grow_scratch(size_t sz) {
+    static void grow_scratch(const size_t sz) {
         if (sz <= scratch_sz) {
             return;
         }
@@ -583,7 +561,7 @@ class GraphOps {
             new_sz = 10; // TODO: Introduce enums for init_sz and growth_factor
         }
         while (new_sz < sz) {
-            new_sz = static_cast<size_t>(new_sz * 1.5);
+            new_sz *= 2;
         }
 
         edge_marks->resize(new_sz * new_sz);
@@ -601,8 +579,7 @@ class GraphOps {
     }
 
     // Syntactic join.
-    template <class G1, class G2>
-    static graph_t join(G1& l, G2& r) {
+    static graph_t join(auto& l, auto& r) {
         // For the join, potentials are preserved
         assert(l.size() == r.size());
         size_t sz = l.size();
@@ -615,7 +592,7 @@ class GraphOps {
             for (auto e : l.e_succs(s)) {
                 vert_id d = e.vert;
                 if (r.lookup(s, d, &wr)) {
-                    g.add_edge(s, std::max(e.val, (Weight)wr), d);
+                    g.add_edge(s, std::max(e.val, static_cast<Weight>(wr)), d);
                 }
             }
         }
@@ -623,23 +600,9 @@ class GraphOps {
     }
 
     // Syntactic meet
-    template <class G1, class G2>
-    static graph_t meet(const G1& l, const G2& r, bool& is_closed) {
+    static graph_t meet(const auto& l, const auto& r, bool& is_closed) {
         assert(l.size() == r.size());
-
-        /*
-              for(vert_id s : l.verts())
-                for(vert_id d : l.succs(s))
-                  if(!r.elem(s, d) || l.edge_val(s, d) < r.edge_val(s, d))
-                    goto r_not_dom;
-              // r dominates
-              is_closed = true;
-              return graph_t::copy(r);
-
-        r_not_dom:
-        */
         graph_t g(graph_t::copy(l));
-        //      bool l_dom = true;
 
         mut_val_ref_t wg;
         for (vert_id s : r.verts()) {
@@ -657,8 +620,7 @@ class GraphOps {
         return g;
     }
 
-    template <class G1, class G2>
-    static graph_t widen(const G1& l, const G2& r, std::unordered_set<vert_id>& unstable) {
+    static graph_t widen(const auto& l, const auto& r, std::unordered_set<vert_id>& unstable) {
         assert(l.size() == r.size());
         size_t sz = l.size();
         graph_t g;
@@ -685,11 +647,10 @@ class GraphOps {
         return g;
     }
 
-    // Compute the strongly connected components
-    // Duped pretty much verbatim from Wikipedia
+    // Compute the strongly connected components.
+    // Duped pretty much verbatim from Wikipedia.
     // Abuses 'dual_queue' to store indices.
-    template <class G>
-    static void strong_connect(const G& x, std::vector<vert_id>& stack, int& index, vert_id v,
+    static void strong_connect(const auto& x, std::vector<vert_id>& stack, int& index, vert_id v,
                                std::vector<std::vector<vert_id>>& sccs) {
         vert_marks->at(v) = (index << 1) | 1;
         // assert(vert_marks->at(v)&1);
@@ -705,50 +666,38 @@ class GraphOps {
                 dual_queue->at(v) = std::min(dual_queue->at(v), dual_queue->at(w));
             } else if (vert_marks->at(w) & 1) {
                 // W is on the stack
-                dual_queue->at(v) = std::min(dual_queue->at(v), (vert_id)(vert_marks->at(w) >> 1));
+                dual_queue->at(v) = std::min(dual_queue->at(v), gsl::narrow<vert_id>(vert_marks->at(w) >> 1));
             }
         }
 
         // If v is a root node, pop the stack and generate an SCC
-        if (dual_queue->at(v) == (vert_marks->at(v) >> 1)) {
+        if (dual_queue->at(v) == gsl::narrow<vert_id>(vert_marks->at(v) >> 1)) {
             sccs.emplace_back();
             std::vector<vert_id>& scc(sccs.back());
-            int w;
+            vert_id w;
             do {
                 w = stack.back();
                 stack.pop_back();
-                vert_marks->at(w) &= (~1);
+                vert_marks->at(w) &= ~1;
                 scc.push_back(w);
             } while (v != w);
         }
     }
 
-    template <class G>
-    static void compute_sccs(const G& x, std::vector<std::vector<vert_id>>& out_scc) {
-        size_t sz = x.size();
+    static void compute_sccs(const auto& x, std::vector<std::vector<vert_id>>& out_scc) {
+        const size_t sz = x.size();
         grow_scratch(sz);
 
         for (vert_id v : x.verts()) {
             vert_marks->at(v) = 0;
         }
-        int index = 1;
-        std::vector<vert_id> stack;
         for (vert_id v : x.verts()) {
             if (!vert_marks->at(v)) {
+                std::vector<vert_id> stack;
+                int index = 1;
                 strong_connect(x, stack, index, v, out_scc);
             }
         }
-        /*
-        printf("[");
-        for(int ii = 0; ii < out_scc.size(); ii++)
-        {
-          printf("[");
-          for(int jj = 0; jj < out_scc[ii].size(); jj++)
-            printf(" %d", out_scc[ii][jj]);
-          printf("]");
-        }
-        printf("]\n");
-        */
 
         for (vert_id v : x.verts()) {
             vert_marks->at(v) = 0;
@@ -757,8 +706,7 @@ class GraphOps {
 
     // Run Bellman-Ford to compute a valid model of a set of difference constraints.
     // Returns false if there is some negative cycle.
-    template <class G, class P>
-    static bool select_potentials(const G& g, P& potentials) {
+    static bool select_potentials(const auto& g, auto& potentials) {
         size_t sz = g.size();
         assert(potentials.size() >= sz);
         grow_scratch(sz);
@@ -766,23 +714,20 @@ class GraphOps {
         std::vector<std::vector<vert_id>> sccs;
         compute_sccs(g, sccs);
 
-        // Currently trusting the call-site to select reasonable
-        // initial values.
-#if 0
-      // Zero existing potentials.
-      // Not strictly necessary, but means we're less
-      // likely to run into over/underflow.
-      //
-      // Though this hurts our chances of early cutoff.
-      for(vert_id v : g.verts())
-        potentials[v] = 0;
-#endif
+        // Currently trusting the call-site to select reasonable initial values.
+        if constexpr (false) {
+            // Zero existing potentials.
+            // Not strictly necessary, but means we're less likely to run into over/underflow.
+            // Though this hurts our chances of early cutoff.
+            for (vert_id v : g.verts()) {
+                potentials[v] = 0;
+            }
+        }
 
         // Run Bellman-ford on each SCC.
         // for(std::vector<vert_id>& scc : sccs)
         // Current implementation returns sccs in reverse topological order.
-        for (auto it = sccs.rbegin(); it != sccs.rend(); ++it) {
-            std::vector<vert_id>& scc(*it);
+        for (std::vector<vert_id>& scc : sccs) {
 
             auto qhead = dual_queue->begin();
             auto qtail = qhead;
@@ -793,12 +738,12 @@ class GraphOps {
             for (vert_id v : scc) {
                 *qtail = v;
                 vert_marks->at(v) = BF_SCC | BF_QUEUED;
-                qtail++;
+                ++qtail;
             }
 
-            for (size_t iter = 0; iter < scc.size(); iter++) {
-                for (; qtail != qhead;) {
-                    vert_id s = *(--qtail);
+            for (vert_id v : scc) {
+                while (qtail != qhead) {
+                    vert_id s = *--qtail;
                     // If it _was_ on the queue, it must be in the SCC
                     vert_marks->at(s) = BF_SCC;
 
@@ -812,7 +757,7 @@ class GraphOps {
                             if (vert_marks->at(d) == BF_SCC) {
                                 *next_tail = d;
                                 vert_marks->at(d) = (BF_SCC | BF_QUEUED);
-                                next_tail++;
+                                ++next_tail;
                             }
                         }
                     }
@@ -826,8 +771,8 @@ class GraphOps {
                 }
             }
             // Check if the SCC is feasible.
-            for (; qtail != qhead;) {
-                vert_id s = *(--qtail);
+            while (qtail != qhead) {
+                vert_id s = *--qtail;
                 Weight s_pot = potentials[s];
                 for (auto e : g.e_succs(s)) {
                     vert_id d = e.vert;
@@ -846,8 +791,7 @@ class GraphOps {
 
     template <class G, class G1, class G2, class P>
     static edge_vector close_after_meet(const G& g, const P& pots, const G1& l, const G2& r) {
-        // We assume the syntactic meet has already been computed,
-        // and potentials have been initialized.
+        // We assume the syntactic meet has already been computed, and potentials have been initialized.
         // We just want to restore closure.
         assert(l.size() == r.size());
         size_t sz = l.size();
@@ -857,8 +801,6 @@ class GraphOps {
 
         // Partition edges into r-only/rb/b-only.
         for (vert_id s : g.verts()) {
-            //        unsigned int g_count = 0;
-            //        unsigned int r_count = 0;
             for (auto e : g.e_succs(s)) {
                 unsigned char mark = 0;
                 vert_id d = e.vert;
@@ -884,10 +826,8 @@ class GraphOps {
             }
         }
 
-        // We can run the chromatic Dijkstra variant
-        // on each source.
+        // We can run the chromatic Dijkstra variant on each source.
         std::vector<std::tuple<vert_id, Weight>> adjs;
-        //      for(vert_id v = 0; v < sz; v++)
         edge_vector delta;
         for (vert_id v : g.verts()) {
             adjs.clear();
@@ -976,13 +916,12 @@ class GraphOps {
         }
     }
 
-    // Run Dijkstra's algorithm, but similar to the chromatic algorithm, avoid expanding
-    // anything that _was_ stable.
+    // Run Dijkstra's algorithm, but similar to the chromatic algorithm, avoid expanding anything that _was_ stable.
     // GKG: Factor out common elements of this & the previous algorithm.
     template <class G, class P, class S>
     static void dijkstra_recover(const G& g, const P& p, const S& is_stable, vert_id src,
                                  std::vector<std::tuple<vert_id, Weight>>& out) {
-        size_t sz = g.size();
+        const size_t sz = g.size();
         if (sz == 0) {
             return;
         }
@@ -1051,7 +990,7 @@ class GraphOps {
     template <class G, class P>
     static bool repair_potential(const G& g, P& p, vert_id ii, vert_id jj) {
         // Ensure there's enough scratch space.
-        size_t sz = g.size();
+        const size_t sz = g.size();
         // assert(src < (int) sz && dest < (int) sz);
         grow_scratch(sz);
 
@@ -1103,7 +1042,7 @@ class GraphOps {
 
     template <class G, class P, class V>
     static edge_vector close_after_widen(const G& g, const P& p, const V& is_stable) {
-        size_t sz = g.size();
+        const size_t sz = g.size();
         grow_scratch(sz);
         //      assert(orig.size() == sz);
 
@@ -1127,41 +1066,23 @@ class GraphOps {
     }
 
     // Used for sorting successors of some vertex by increasing slack.
-    // operator() may only be called on vertices for which
-    // dists is initialized.
+    // operator() may only be called on vertices for which dists is initialized.
     template <class P>
-    class AdjCmp {
-      public:
-        explicit AdjCmp(const P& _p) : p(_p) {}
-
-        bool operator()(vert_id d1, vert_id d2) const { return (dists->at(d1) - p[d1]) < (dists->at(d2) - p[d2]); }
-
-      protected:
+    struct AdjCmp {
+        bool operator()(vert_id d1, vert_id d2) const { return dists->at(d1) - p[d1] < dists->at(d2) - p[d2]; }
         const P& p;
     };
 
     template <class P>
-    static AdjCmp<P> make_adjcmp(const P& p) {
-        return AdjCmp<P>(p);
-    }
-
-    template <class P>
-    class NegP {
-      public:
-        explicit NegP(const P& _p) : p(_p) {}
+    struct NegP {
         Weight operator[](vert_id v) const { return -(p[v]); }
-
         const P& p;
     };
-    template <class P>
-    static NegP<P> make_negp(const P& p) {
-        return NegP<P>(p);
-    }
 
     // Compute the transitive closure of edges reachable from v, assuming
-    // (1) the subgraph G \ {v} is closed, and (2) P is a valid model of G.
-    template <class G, class P>
-    static void close_after_assign_fwd(const G& g, const P& p, vert_id v,
+    // (1) the subgraph G \ {v} is closed, and
+    // (2) P is a valid model of G.
+    static void close_after_assign_fwd(const auto& g, const auto& p, vert_id v,
                                        std::vector<std::tuple<vert_id, Weight>>& aux) {
         // Initialize the queue and distances.
         for (vert_id u : g.verts()) {
@@ -1178,14 +1099,14 @@ class GraphOps {
             dists->at(d) = e.val;
             //        assert(p[v] + dists->at(d) - p[d] >= Weight(0));
             *adj_tail = d;
-            adj_tail++;
+            ++adj_tail;
         }
 
         // Sort the immediate edges by increasing slack.
-        std::sort(adj_head, adj_tail, make_adjcmp(p));
+        std::sort(adj_head, adj_tail, AdjCmp{p});
 
         auto reach_tail = adj_tail;
-        for (; adj_head < adj_tail; adj_head++) {
+        for (; adj_head < adj_tail; ++adj_head) {
             vert_id d = *adj_head;
 
             Weight d_wt = dists->at(d);
@@ -1196,7 +1117,7 @@ class GraphOps {
                     dists->at(e) = e_wt;
                     vert_marks->at(e) = BF_QUEUED;
                     *reach_tail = e;
-                    reach_tail++;
+                    ++reach_tail;
                 } else {
                     dists->at(e) = std::min(e_wt, dists->at(e));
                 }
@@ -1205,7 +1126,7 @@ class GraphOps {
 
         // Now collect the adjacencies, and clear vertex flags
         // FIXME: This collects _all_ edges from x, not just new ones.
-        for (adj_head = dual_queue->begin(); adj_head < reach_tail; adj_head++) {
+        for (adj_head = dual_queue->begin(); adj_head < reach_tail; ++adj_head) {
             aux.emplace_back(*adj_head, dists->at(*adj_head));
             vert_marks->at(*adj_head) = 0;
         }
@@ -1274,9 +1195,8 @@ class GraphOps {
         // Closure is now updated.
     }
 
-    template <class G, class P>
-    static edge_vector close_after_assign(const G& g, const P& p, vert_id v) {
-        size_t sz = g.size();
+    static edge_vector close_after_assign(const auto& g, const auto& p, vert_id v) {
+        const size_t sz = g.size();
         grow_scratch(sz);
         edge_vector delta;
         {
@@ -1288,8 +1208,8 @@ class GraphOps {
         }
         {
             std::vector<std::tuple<vert_id, Weight>> aux;
-            GraphRev<const G> g_rev(g);
-            close_after_assign_fwd(g_rev, make_negp(p), v, aux);
+            GraphRev g_rev{g};
+            close_after_assign_fwd(g_rev, NegP{p}, v, aux);
             for (auto [vid, wt] : aux) {
                 delta.emplace_back(vid, v, wt);
             }
@@ -1324,6 +1244,3 @@ template <class G>
 thread_local unsigned int GraphOps<G>::ts_idx = 0;
 
 } // namespace crab
-#ifdef __GNUC__
-#pragma GCC diagnostic pop
-#endif

From 00683a5b9c6820a7057d27ad9c55cb4dfbecfc63 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Wed, 2 Oct 2024 13:23:19 +0300
Subject: [PATCH 275/373] use gsl::narrow in asm_marshal.cpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_marshal.cpp            | 45 +++++++++++++++++-----------------
 src/asm_ostream.cpp            |  2 +-
 src/crab_utils/graph_ops.hpp   |  2 +-
 src/crab_utils/num_safeint.hpp |  9 +++----
 src/crab_utils/stats.cpp       |  3 ++-
 5 files changed, 31 insertions(+), 30 deletions(-)

diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 9df6aead9..0db4ca6b8 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -7,6 +7,7 @@
 
 #include "asm_marshal.hpp"
 #include "asm_ostream.hpp"
+#include "crab_utils/num_safety.hpp"
 
 using std::vector;
 
@@ -88,9 +89,9 @@ static uint8_t imm_endian(const Un::Op op) {
 struct MarshalVisitor {
   private:
     static vector<ebpf_inst> makeLddw(const Reg dst, const bool isFd, const int32_t imm, const int32_t next_imm) {
-        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_CLS_LD | width_to_opcode(8)),
+        return {ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_CLS_LD | width_to_opcode(8)),
                           .dst = dst.v,
-                          .src = static_cast<uint8_t>(isFd ? 1 : 0),
+                          .src = gsl::narrow<uint8_t>(isFd ? 1 : 0),
                           .offset = 0,
                           .imm = imm},
                 ebpf_inst{.opcode = 0, .dst = 0, .src = 0, .offset = 0, .imm = next_imm}};
@@ -115,7 +116,7 @@ struct MarshalVisitor {
             return makeLddw(b.dst, false, imm, next_imm);
         }
 
-        ebpf_inst res{.opcode = static_cast<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | (op(b.op) << 4)),
+        ebpf_inst res{.opcode = gsl::narrow<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | (op(b.op) << 4)),
                       .dst = b.dst.v,
                       .src = 0,
                       .offset = offset(b.op),
@@ -124,7 +125,7 @@ struct MarshalVisitor {
                                   res.opcode |= INST_SRC_REG;
                                   res.src = right.v;
                               },
-                              [&](const Imm right) { res.imm = static_cast<int32_t>(right.v); }},
+                              [&](const Imm right) { res.imm = gsl::narrow<int32_t>(right.v); }},
                    b.v);
         return {res};
     }
@@ -133,7 +134,7 @@ struct MarshalVisitor {
         switch (b.op) {
         case Un::Op::NEG:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | INST_ALU_OP_NEG),
+                .opcode = gsl::narrow<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | INST_ALU_OP_NEG),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -143,7 +144,7 @@ struct MarshalVisitor {
         case Un::Op::LE32:
         case Un::Op::LE64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_END_LE | INST_ALU_OP_END),
+                .opcode = gsl::narrow<uint8_t>(INST_CLS_ALU | INST_END_LE | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -153,7 +154,7 @@ struct MarshalVisitor {
         case Un::Op::BE32:
         case Un::Op::BE64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU | INST_END_BE | INST_ALU_OP_END),
+                .opcode = gsl::narrow<uint8_t>(INST_CLS_ALU | INST_END_BE | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -163,7 +164,7 @@ struct MarshalVisitor {
         case Un::Op::SWAP32:
         case Un::Op::SWAP64:
             return {ebpf_inst{
-                .opcode = static_cast<uint8_t>(INST_CLS_ALU64 | INST_ALU_OP_END),
+                .opcode = gsl::narrow<uint8_t>(INST_CLS_ALU64 | INST_ALU_OP_END),
                 .dst = b.dst.v,
                 .src = 0,
                 .offset = 0,
@@ -175,7 +176,7 @@ struct MarshalVisitor {
     }
 
     vector<ebpf_inst> operator()(Call const& b) const {
-        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
+        return {ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_OP_CALL),
                           .dst = 0,
                           .src = INST_CALL_STATIC_HELPER,
                           .offset = 0,
@@ -183,7 +184,7 @@ struct MarshalVisitor {
     }
 
     vector<ebpf_inst> operator()(CallLocal const& b) const {
-        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALL),
+        return {ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_OP_CALL),
                           .dst = 0,
                           .src = INST_CALL_LOCAL,
                           .offset = 0,
@@ -192,7 +193,7 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Callx const& b) const {
         // callx is defined to have the register in 'dst' not in 'src'.
-        return {ebpf_inst{.opcode = static_cast<uint8_t>(INST_OP_CALLX),
+        return {ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_OP_CALLX),
                           .dst = b.func.v,
                           .src = INST_CALL_STATIC_HELPER,
                           .offset = 0}};
@@ -209,7 +210,7 @@ struct MarshalVisitor {
     vector<ebpf_inst> operator()(Jmp const& b) const {
         if (b.cond) {
             ebpf_inst res{
-                .opcode = static_cast<uint8_t>(INST_CLS_JMP | (op(b.cond->op) << 4)),
+                .opcode = gsl::narrow<uint8_t>(INST_CLS_JMP | (op(b.cond->op) << 4)),
                 .dst = b.cond->left.v,
                 .src = 0,
                 .offset = label_to_offset16(b.target),
@@ -218,7 +219,7 @@ struct MarshalVisitor {
                                  res.opcode |= INST_SRC_REG;
                                  res.src = right.v;
                              },
-                             [&](const Imm right) { res.imm = static_cast<int32_t>(right.v); }},
+                             [&](const Imm right) { res.imm = gsl::narrow<int32_t>(right.v); }},
                   b.cond->right);
             return {res};
         } else {
@@ -234,17 +235,17 @@ struct MarshalVisitor {
     vector<ebpf_inst> operator()(Mem const& b) const {
         const Deref access = b.access;
         ebpf_inst res{
-            .opcode = static_cast<uint8_t>(INST_MODE_MEM | width_to_opcode(access.width)),
+            .opcode = gsl::narrow<uint8_t>(INST_MODE_MEM | width_to_opcode(access.width)),
             .dst = 0,
             .src = 0,
-            .offset = static_cast<int16_t>(access.offset),
+            .offset = gsl::narrow<int16_t>(access.offset),
         };
         if (b.is_load) {
             if (!std::holds_alternative<Reg>(b.value)) {
                 throw std::runtime_error(std::string("LD IMM: ") + to_string(b));
             }
             res.opcode |= INST_CLS_LD | 0x1;
-            res.dst = static_cast<uint8_t>(std::get<Reg>(b.value).v);
+            res.dst = gsl::narrow<uint8_t>(std::get<Reg>(b.value).v);
             res.src = access.basereg.v;
         } else {
             res.opcode |= INST_CLS_ST;
@@ -254,7 +255,7 @@ struct MarshalVisitor {
                 res.src = preg->v;
             } else {
                 res.opcode |= 0x0;
-                res.imm = static_cast<int32_t>(std::get<Imm>(b.value).v);
+                res.imm = gsl::narrow<int32_t>(std::get<Imm>(b.value).v);
             }
         }
         return {res};
@@ -262,11 +263,11 @@ struct MarshalVisitor {
 
     vector<ebpf_inst> operator()(Packet const& b) const {
         ebpf_inst res{
-            .opcode = static_cast<uint8_t>(INST_CLS_LD | width_to_opcode(b.width)),
+            .opcode = gsl::narrow<uint8_t>(INST_CLS_LD | width_to_opcode(b.width)),
             .dst = 0,
             .src = 0,
             .offset = 0,
-            .imm = static_cast<int32_t>(b.offset),
+            .imm = gsl::narrow<int32_t>(b.offset),
         };
         if (b.regoffset) {
             res.opcode |= INST_MODE_IND;
@@ -278,15 +279,15 @@ struct MarshalVisitor {
     }
 
     vector<ebpf_inst> operator()(Atomic const& b) const {
-        auto imm = static_cast<int32_t>(b.op);
+        auto imm = gsl::narrow<int32_t>(b.op);
         if (b.fetch) {
             imm |= INST_FETCH;
         }
         return {
-            ebpf_inst{.opcode = static_cast<uint8_t>(INST_CLS_STX | INST_MODE_ATOMIC | width_to_opcode(b.access.width)),
+            ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_CLS_STX | INST_MODE_ATOMIC | width_to_opcode(b.access.width)),
                       .dst = b.access.basereg.v,
                       .src = b.valreg.v,
-                      .offset = static_cast<int16_t>(b.access.offset),
+                      .offset = gsl::narrow<int16_t>(b.access.offset),
                       .imm = imm}};
     }
 
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index e457d6c80..961d3b009 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -120,7 +120,7 @@ std::ostream& operator<<(std::ostream& os, ValidAccess const& a) {
         os << a.offset;
     }
 
-    if (a.width == static_cast<Value>(Imm{0})) {
+    if (a.width == Value{Imm{0}}) {
         // a.width == 0, meaning we only care it's an in-bound pointer,
         // so it can be compared with another pointer to the same region.
         os << ") for comparison/subtraction";
diff --git a/src/crab_utils/graph_ops.hpp b/src/crab_utils/graph_ops.hpp
index 95447cbde..df8bce555 100644
--- a/src/crab_utils/graph_ops.hpp
+++ b/src/crab_utils/graph_ops.hpp
@@ -741,7 +741,7 @@ class GraphOps {
                 ++qtail;
             }
 
-            for (vert_id v : scc) {
+            for (vert_id _ : scc) {
                 while (qtail != qhead) {
                     vert_id s = *--qtail;
                     // If it _was_ on the queue, it must be in the SCC
diff --git a/src/crab_utils/num_safeint.hpp b/src/crab_utils/num_safeint.hpp
index 1bcb8ec57..39671d5d2 100644
--- a/src/crab_utils/num_safeint.hpp
+++ b/src/crab_utils/num_safeint.hpp
@@ -17,7 +17,6 @@
 namespace crab {
 
 class safe_i64 {
-
     // Current implementation is based on
     // https://blog.regehr.org/archives/1139 using wider integers.
 
@@ -70,13 +69,13 @@ class safe_i64 {
     }
 
   public:
-    safe_i64() : m_num(0) {}
+    safe_i64() : m_num{0} {}
 
-    safe_i64(const int64_t num) : m_num(num) {}
+    safe_i64(const int64_t num) : m_num{num} {}
 
-    safe_i64(const number_t& n) : m_num(n.narrow<int64_t>()) {}
+    safe_i64(const number_t& n) : m_num{n.narrow<int64_t>()} {}
 
-    operator int64_t() const { return (int64_t)m_num; }
+    operator int64_t() const { return m_num; }
 
     // TODO: output parameters whether operation overflows
     safe_i64 operator+(const safe_i64 x) const {
diff --git a/src/crab_utils/stats.cpp b/src/crab_utils/stats.cpp
index 62c823f04..3e066a998 100644
--- a/src/crab_utils/stats.cpp
+++ b/src/crab_utils/stats.cpp
@@ -30,7 +30,8 @@ long Stopwatch::systemTime() const {
     }
 
     // Convert from 100ns intervals to microseconds.
-    uint64_t total_us = (((uint64_t)user_time.dwHighDateTime << 32) | (uint64_t)user_time.dwLowDateTime) / 10;
+    uint64_t total_us =
+        ((static_cast<uint64_t>(user_time.dwHighDateTime) << 32) | static_cast<uint64_t>(user_time.dwLowDateTime)) / 10;
 
     return (long)total_us;
 #else

From e50f545fb36afadc5b334bb6bea47dcaed9be2f1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 5 Oct 2024 16:45:07 +0000
Subject: [PATCH 276/373] Bump external/libbtf from `18569b3` to `eac5f80`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `18569b3` to `eac5f80`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/18569b38b5b809b4c513e24ed012f55f4309f0ff...eac5f801cb23f18db20251cd20506667a9c333c8)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 18569b38b..eac5f801c 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 18569b38b5b809b4c513e24ed012f55f4309f0ff
+Subproject commit eac5f801cb23f18db20251cd20506667a9c333c8

From 898813a77875da916a9ce20eb631df81e2bea5d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 5 Oct 2024 16:45:05 +0000
Subject: [PATCH 277/373] Bump external/bpf_conformance from `8bd493f` to
 `0b55764`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `8bd493f` to `0b55764`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/8bd493feff99805383ced4858abddbe44e9067c9...0b557642b66b95bcf62a2e92529be75a1ae63bb1)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 8bd493fef..0b557642b 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 8bd493feff99805383ced4858abddbe44e9067c9
+Subproject commit 0b557642b66b95bcf62a2e92529be75a1ae63bb1

From 86eee70a7f9092aa0e549c105dead01d77247f69 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 5 Oct 2024 16:45:03 +0000
Subject: [PATCH 278/373] Bump external/radix_tree from `b1792eb` to `9eedb58`

Bumps [external/radix_tree](https://github.com/elazarg/radix_tree_20) from `b1792eb` to `9eedb58`.
- [Commits](https://github.com/elazarg/radix_tree_20/compare/b1792eb0a8cd195bc55b17a37795c03335644ad4...9eedb58f9e5eb740d6cfe2da6d4646c10a412520)

---
updated-dependencies:
- dependency-name: external/radix_tree
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/radix_tree | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/radix_tree b/external/radix_tree
index b1792eb0a..9eedb58f9 160000
--- a/external/radix_tree
+++ b/external/radix_tree
@@ -1 +1 @@
-Subproject commit b1792eb0a8cd195bc55b17a37795c03335644ad4
+Subproject commit 9eedb58f9e5eb740d6cfe2da6d4646c10a412520

From a2b84ac08a1f853f9cd20674a669ea0fd5d1af2c Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Sat, 5 Oct 2024 11:59:55 -0700
Subject: [PATCH 279/373] Log line info when dumping invariants (#716)

* Log line info when dumping invariants
* clang format and tidy crab_verifier.cpp
---------
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab_verifier.cpp | 44 +++++++++++++++++++++++++++++++------------
 1 file changed, 32 insertions(+), 12 deletions(-)

diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index dc53011a2..f1ceccd18 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -95,7 +95,7 @@ static checks_db generate_report(cfg_t& cfg, const crab::invariant_table_t& pre_
     }
 
     if (thread_local_options.check_termination) {
-        auto last_inv = post_invariants.at(cfg.exit_label());
+        const auto last_inv = post_invariants.at(cfg.exit_label());
         m_db.max_loop_count = last_inv.get_loop_count_upper_bound();
     }
     return m_db;
@@ -111,7 +111,8 @@ static auto get_line_info(const InstructionSeq& insts) {
     return label_to_line_info;
 }
 
-static void print_report(std::ostream& os, const checks_db& db, const InstructionSeq& prog, bool print_line_info) {
+static void print_report(std::ostream& os, const checks_db& db, const InstructionSeq& prog,
+                         const bool print_line_info) {
     auto label_to_line_info = get_line_info(prog);
     os << "\n";
     for (auto [label, messages] : db.m_db) {
@@ -133,11 +134,25 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
 }
 
 static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::invariant_table_t& pre_invariants,
-                                     const crab::invariant_table_t& post_invariants) {
+                                     const crab::invariant_table_t& post_invariants,
+                                     const std::optional<InstructionSeq>& prog = std::nullopt) {
     // Analyze the control-flow graph.
     checks_db db = generate_report(cfg, pre_invariants, post_invariants);
     if (thread_local_options.print_invariants) {
+        std::optional<std::map<int, btf_line_info_t>> line_info_map = std::nullopt;
+        if (prog.has_value()) {
+            line_info_map = get_line_info(*prog);
+        }
+        std::string previous_source_line = "";
         for (const label_t& label : cfg.sorted_labels()) {
+            if (line_info_map.has_value()) {
+                auto line_info = line_info_map->find(label.from);
+                // Print line info only once.
+                if (line_info != line_info_map->end() && line_info->second.source_line != previous_source_line) {
+                    s << "\n" << line_info->second << "\n";
+                    previous_source_line = line_info->second.source_line;
+                }
+            }
             s << "\nPre-invariant : " << pre_invariants.at(label) << "\n";
             s << cfg.get_node(label);
             s << "\nPost-invariant: " << post_invariants.at(label) << "\n";
@@ -146,8 +161,8 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::in
     return db;
 }
 
-static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
-                                 const ebpf_verifier_options_t* options) {
+static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info, const ebpf_verifier_options_t* options,
+                                 const std::optional<InstructionSeq>& prog = std::nullopt) {
     global_program_info = std::move(info);
     crab::domains::clear_global_state();
     crab::variable_t::clear_thread_local_state();
@@ -156,8 +171,8 @@ static checks_db get_ebpf_report(std::ostream& s, cfg_t& cfg, program_info info,
     try {
         // Get dictionaries of pre-invariants and post-invariants for each basic block.
         ebpf_domain_t entry_dom = ebpf_domain_t::setup_entry(true);
-        auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_dom));
-        return get_analysis_report(s, cfg, pre_invariants, post_invariants);
+        auto [pre_invariants, post_invariants] = run_forward_analyzer(cfg, std::move(entry_dom));
+        return get_analysis_report(s, cfg, pre_invariants, post_invariants, prog);
     } catch (std::runtime_error& e) {
         // Convert verifier runtime_error exceptions to failure.
         checks_db db;
@@ -172,13 +187,13 @@ bool run_ebpf_analysis(std::ostream& s, cfg_t& cfg, const program_info& info, co
     if (options == nullptr) {
         options = &ebpf_verifier_default_options;
     }
-    checks_db report = get_ebpf_report(s, cfg, info, options);
+    const checks_db report = get_ebpf_report(s, cfg, info, options);
     if (stats) {
         stats->total_unreachable = report.total_unreachable;
         stats->total_warnings = report.total_warnings;
         stats->max_loop_count = report.get_max_loop_count();
     }
-    return (report.total_warnings == 0);
+    return report.total_warnings == 0;
 }
 
 static string_invariant_map to_string_invariant_map(crab::invariant_table_t& inv_table) {
@@ -205,8 +220,8 @@ std::tuple<string_invariant, bool> ebpf_analyze_program_for_test(std::ostream& o
     }
     try {
         cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
-        auto [pre_invariants, post_invariants] = crab::run_forward_analyzer(cfg, std::move(entry_inv));
-        checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
+        auto [pre_invariants, post_invariants] = run_forward_analyzer(cfg, std::move(entry_inv));
+        const checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
         print_report(os, report, prog, false);
 
         auto pre_invariant_map = to_string_invariant_map(pre_invariants);
@@ -229,7 +244,12 @@ bool ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, const pro
     // in a "passive", non-deterministic form.
     cfg_t cfg = prepare_cfg(prog, info, options->simplify);
 
-    checks_db report = get_ebpf_report(os, cfg, info, options);
+    std::optional<InstructionSeq> prog_opt = std::nullopt;
+    if (options->print_failures) {
+        prog_opt = prog;
+    }
+
+    const checks_db report = get_ebpf_report(os, cfg, info, options, prog_opt);
     if (options->print_failures) {
         print_report(os, report, prog, options->print_line_info);
     }

From 257897c60be7d7ac35ed993794d95b6a9f4c7573 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Sat, 5 Oct 2024 12:58:01 -0700
Subject: [PATCH 280/373] Fix bpf2bpf bug when multiple branches in a
 subprogram go to exit (#715)

* Fix bpf2bpf bug when multiple branches in a subprogram go to exit

The bug was that the successor label could be processed multiple
times if there were multiple predecessors, resulting in multiple
exit instructions appearing in the block, which in turn would
result in restore_callee_saved_registers() being called multiple
times, giving incorrect results.

* Added a YAML test case for this.
* clang format and tidy asm_cfg.cpp

---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
Co-authored-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/asm_cfg.cpp          | 16 +++++++++-------
 test-data/calllocal.yaml | 24 ++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/src/asm_cfg.cpp b/src/asm_cfg.cpp
index 84fd81790..5d6439bff 100644
--- a/src/asm_cfg.cpp
+++ b/src/asm_cfg.cpp
@@ -5,7 +5,6 @@
 #include <algorithm>
 #include <map>
 #include <optional>
-#include <queue>
 #include <string>
 #include <vector>
 
@@ -59,11 +58,11 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
 
     // Walk the transitive closure of CFG nodes starting at entry_label and ending at
     // any exit instruction.
-    std::queue<label_t> macro_labels{{entry_label}};
+    std::set macro_labels{entry_label};
     std::set seen_labels{entry_label};
     while (!macro_labels.empty()) {
-        label_t macro_label = macro_labels.front();
-        macro_labels.pop();
+        label_t macro_label = *macro_labels.begin();
+        macro_labels.erase(macro_label);
 
         if (stack_frame_prefix == macro_label.stack_frame_prefix) {
             throw std::runtime_error{stack_frame_prefix + ": illegal recursion"};
@@ -105,7 +104,9 @@ static void add_cfg_nodes(cfg_t& cfg, const label_t& caller_label, const label_t
                 bb >> exit_to_node;
             } else if (!seen_labels.contains(next_macro_label)) {
                 // Push any other unprocessed successor label onto the list to be processed.
-                macro_labels.push(next_macro_label);
+                if (!macro_labels.contains(next_macro_label)) {
+                    macro_labels.insert(next_macro_label);
+                }
                 seen_labels.insert(macro_label);
             }
         }
@@ -249,7 +250,7 @@ static cfg_t to_nondet(const cfg_t& cfg) {
         auto nextlist = bb.next_blocks_set();
         if (nextlist.size() == 2) {
             label_t mid_label = this_label;
-            Jmp jmp = std::get<Jmp>(*bb.rbegin());
+            auto jmp = std::get<Jmp>(*bb.rbegin());
 
             nextlist.erase(jmp.target);
             label_t fallthrough = *nextlist.begin();
@@ -358,7 +359,8 @@ std::map<std::string, int> collect_stats(const cfg_t& cfg) {
     return res;
 }
 
-cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, bool simplify, bool must_have_exit) {
+cfg_t prepare_cfg(const InstructionSeq& prog, const program_info& info, const bool simplify,
+                  const bool must_have_exit) {
     // Convert the instruction sequence to a deterministic control-flow graph.
     cfg_t det_cfg = instruction_seq_to_cfg(prog, must_have_exit);
 
diff --git a/test-data/calllocal.yaml b/test-data/calllocal.yaml
index 4bb735ad0..fa2c811c1 100644
--- a/test-data/calllocal.yaml
+++ b/test-data/calllocal.yaml
@@ -203,6 +203,30 @@ code:
     r6 = 1
     exit
 
+post:
+  - r0.type=number
+  - r0.svalue=0
+  - r0.uvalue=0
+  - r6.type=number
+  - r6.svalue=0
+  - r6.uvalue=0
+---
+test-case: call local with multiple branches
+
+pre: ["r0.type=number"]
+
+code:
+  <start>: |
+    r6 = 0
+    call <sub>
+    r0 = 0
+    exit
+  <sub>: |
+    if r0 == 0 goto <done>
+    r6 = 1
+  <done>: |
+    exit
+
 post:
   - r0.type=number
   - r0.svalue=0

From 77821c69f9ba83407deec03caf20422c17dfd0f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 12 Oct 2024 16:28:15 +0000
Subject: [PATCH 281/373] Bump external/libbtf from `eac5f80` to `6781bf2`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `eac5f80` to `6781bf2`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/eac5f801cb23f18db20251cd20506667a9c333c8...6781bf2301a37abba8859d93c8e8e31c2c90fae0)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index eac5f801c..6781bf230 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit eac5f801cb23f18db20251cd20506667a9c333c8
+Subproject commit 6781bf2301a37abba8859d93c8e8e31c2c90fae0

From 37e34dba694960ba7aa118e9d659586dff8c6885 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 12 Oct 2024 16:28:10 +0000
Subject: [PATCH 282/373] Bump external/bpf_conformance from `0b55764` to
 `e149d36`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `0b55764` to `e149d36`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/0b557642b66b95bcf62a2e92529be75a1ae63bb1...e149d36431a7ea6f982e4d409d41748d82a3b56e)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index 0b557642b..e149d3643 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit 0b557642b66b95bcf62a2e92529be75a1ae63bb1
+Subproject commit e149d36431a7ea6f982e4d409d41748d82a3b56e

From a476ecd291e1da59a6d4c3a8262059d2eaff11bc Mon Sep 17 00:00:00 2001
From: Arie Gurfinkel <arie.gurfinkel@uwaterloo.ca>
Date: Sat, 12 Oct 2024 10:22:36 -0400
Subject: [PATCH 283/373] fix: include for yaml-cpp

There is a typo in YAML_CPP_INCLUDE_DIR variable.
The one defined by find_package() is singular.

Fixed to use the same name in all branches.

Signed-off-by: Arie Gurfinkel <arie.gurfinkel@uwaterloo.ca>
---
 CMakeLists.txt | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index b18b7801e..244656c03 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -68,7 +68,7 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
             -DYAML_CPP_BUILD_TOOLS=OFF
     )
     set(YAML_CPP_LIBRARIES ${EXTERNAL_INSTALL_LOCATION}/lib/yaml-cpp$<$<CONFIG:DEBUG>:d>.lib)
-    set(YAML_CPP_INCLUDE_DIRS ${EXTERNAL_INSTALL_LOCATION}/include/)
+    set(YAML_CPP_INCLUDE_DIR ${EXTERNAL_INSTALL_LOCATION}/include/)
 endif ()
 
 include_directories(./external)
@@ -77,9 +77,12 @@ include_directories(./src)
 include_directories(./external/libbtf)
 include_directories(${GSL_INCLUDE_DIRS})
 include_directories(${Boost_INCLUDE_DIRS})
-include_directories(${YAML_CPP_INCLUDE_DIRS})
+include_directories(${YAML_CPP_INCLUDE_DIR})
+
+link_directories(${YAML_CPP_LIBRARY_DIR})
 link_directories(${Boost_LIBRARY_DIRS})
 
+
 file(GLOB LIB_SRC
         "./src/*.cpp"
         "./src/crab/*.cpp"

From 3427faabed7b69473d50aef2000c05b881cf64a2 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Mon, 14 Oct 2024 11:05:50 -0700
Subject: [PATCH 284/373] Option to build tests (#727)

* Move building tests under option

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 .github/workflows/build.yml | 17 +++++++++++++++--
 CMakeLists.txt              | 14 ++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e063a9ee5..69579acea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,6 +18,7 @@ jobs:
     strategy:
       matrix:
         configurations: [Debug, Release]
+        target: [tests, library]
     runs-on: ubuntu-latest
     env:
       # Configuration type to build.  For documentation on how build matrices work, see
@@ -37,13 +38,19 @@ jobs:
       - name: Build
         run: |
           mkdir build
-          cmake -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIGURATION}}
+          if [ "${{matrix.target}}" = "library" ]; then
+            cmake -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIGURATION}} -DVERIFIER_ENABLE_TESTS=OFF
+          else
+            cmake -B build -DCMAKE_BUILD_TYPE=${{env.BUILD_CONFIGURATION}} -DVERIFIER_ENABLE_TESTS=ON
+          fi
           cmake --build build -j $(nproc)
 
       - name: Run unit tests
+        if: ${{matrix.target == 'tests'}}
         run: ./tests -d yes
 
       - name: Test for memory leaks
+        if: ${{matrix.target == 'tests'}}
         # Any memory leaks will cause the test to fail
         # This BPF program was chosen because it is the largest one in the repo
         run: valgrind --leak-check=full --errors-for-leak-kinds=all  --show-leak-kinds=all --error-exitcode=1 ./check ebpf-samples/cilium/bpf_xdp_snat_linux_v1.o 2/1
@@ -52,6 +59,7 @@ jobs:
     strategy:
       matrix:
         configurations: [Debug, Release]
+        target: [tests, library]
     runs-on: windows-2022
     env:
       # Configuration type to build.  For documentation on how build matrices work, see
@@ -66,8 +74,13 @@ jobs:
       - name: Build
         run: |
           mkdir build
-          cmake -B build
+          if ("${{matrix.target}}" -eq "library") {
+            cmake -B build -DVERIFIER_ENABLE_TESTS=OFF
+          } else {
+            cmake -B build -DVERIFIER_ENABLE_TESTS=ON
+          }
           cmake --build build -j $(nproc) --config ${{env.BUILD_CONFIGURATION}}
 
       - name: Run unit tests
+        if: ${{matrix.target == 'tests'}}
         run: ./${{env.BUILD_CONFIGURATION}}/tests -d yes
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 244656c03..1f3a497b6 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,6 +5,8 @@ project(ebpf_verifier)
 
 include(FetchContent)
 
+option(VERIFIER_ENABLE_TESTS "Build tests" ON)
+
 FetchContent_Declare(GSL
         GIT_REPOSITORY "https://github.com/microsoft/GSL"
         GIT_TAG "v4.0.0"
@@ -13,12 +15,14 @@ FetchContent_Declare(GSL
 FetchContent_MakeAvailable(GSL)
 get_target_property(GSL_INCLUDE_DIRS Microsoft.GSL::GSL INTERFACE_INCLUDE_DIRECTORIES)
 
+if (VERIFIER_ENABLE_TESTS)
 FetchContent_Declare(Catch2
         GIT_REPOSITORY "https://github.com/catchorg/Catch2.git"
         GIT_TAG "v3.7.1"
         GIT_SHALLOW ON
 )
 FetchContent_MakeAvailable(Catch2)
+endif()
 
 if (IS_DIRECTORY "${PROJECT_SOURCE_DIR}/.git")
     # Install Git pre-commit hook
@@ -91,6 +95,7 @@ file(GLOB LIB_SRC
         "./src/linux/linux_platform.cpp"
 )
 
+if(VERIFIER_ENABLE_TESTS)
 file(GLOB ALL_TEST
         "./src/test/test_conformance.cpp"
         "./src/test/test_marshal.cpp"
@@ -99,6 +104,7 @@ file(GLOB ALL_TEST
         "./src/test/test_wto.cpp"
         "./src/test/test_yaml.cpp"
 )
+endif()
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
         "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
@@ -115,13 +121,16 @@ endif ()
 
 add_library(ebpfverifier ${LIB_SRC})
 
+if(VERIFIER_ENABLE_TESTS)
 add_executable(check src/main/check.cpp src/main/linux_verifier.cpp)
 add_executable(tests ${ALL_TEST})
 add_executable(run_yaml src/main/run_yaml.cpp)
 add_executable(conformance_check src/test/conformance_check.cpp)
+endif()
 
 target_include_directories(ebpfverifier PRIVATE ${GSL_INCLUDE_DIRS})
 
+if(VERIFIER_ENABLE_TESTS)
 set_target_properties(check
         PROPERTIES
         RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/..")
@@ -139,6 +148,7 @@ set_target_properties(conformance_check
         RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/..")
 
 add_dependencies(tests conformance_check)
+endif()
 
 target_compile_options(ebpfverifier PRIVATE ${COMMON_FLAGS})
 target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:DEBUG>:${DEBUG_FLAGS}>")
@@ -146,7 +156,9 @@ target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:RELEASE>:${RELEASE_FLAGS}
 target_compile_options(ebpfverifier PUBLIC "$<$<CONFIG:SANITIZE>:${SANITIZE_FLAGS}>")
 
 add_subdirectory("external/bpf_conformance/external/elfio")
+if(VERIFIER_ENABLE_TESTS)
 add_subdirectory("external/bpf_conformance/src")
+endif()
 add_subdirectory("external/libbtf")
 
 # CMake derives a Visual Studio project GUID from the file path but can be overridden via a property
@@ -164,6 +176,7 @@ target_link_libraries(ebpfverifier PRIVATE libbtf)
 target_link_libraries(ebpfverifier PRIVATE Microsoft.GSL::GSL)
 target_compile_options(ebpfverifier PRIVATE ${COMMON_FLAGS})
 
+if(VERIFIER_ENABLE_TESTS)
 target_compile_options(check PRIVATE ${COMMON_FLAGS})
 target_compile_options(check PUBLIC "$<$<CONFIG:DEBUG>:${DEBUG_FLAGS}>")
 target_compile_options(check PUBLIC "$<$<CONFIG:RELEASE>:${RELEASE_FLAGS}>")
@@ -184,3 +197,4 @@ target_link_libraries(tests PRIVATE Catch2::Catch2WithMain)
 target_link_libraries(run_yaml PRIVATE ebpfverifier)
 
 target_link_libraries(conformance_check PRIVATE ebpfverifier)
+endif()

From 0d1d5c37bb1beda6bb8b981ae79df956578884d5 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Tue, 15 Oct 2024 09:20:28 -0700
Subject: [PATCH 285/373] When doing module and division, first cast to
 unsigned 32 bit then promote to 64 bit

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/split_dbm.cpp | 25 ++++++++++++++++--
 src/test/test_yaml.cpp |  1 +
 test-data/muldiv.yaml  | 60 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 2 deletions(-)
 create mode 100644 test-data/muldiv.yaml

diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index 1760f4393..da0a6b377 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -1008,9 +1008,30 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, const number_
     case arith_binop_t::MUL: assign(x, linear_expression_t(k, y)); break;
     // For the rest of operations, we fall back on intervals.
     case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(interval_t(k))); break;
-    case arith_binop_t::UDIV: set(x, get_interval(y, finite_width).UDiv(interval_t(k))); break;
+    case arith_binop_t::UDIV: {
+        if (finite_width == 32) {
+            // As defined in the BPF ISA specification, for 32 bit unsigned division the immediate value is
+            // treated as a 32-bit unsigned integer, so we need to cast it to uint32_t.
+            set(x, get_interval(y, finite_width).UDiv(interval_t(k.cast_to<uint32_t>())));
+        } else {
+            // As defined in the BPF ISA specification, for 64 bit unsigned division the immediate value is
+            // treated as a 32-bit signed integer, so we need to cast it to int32_t.
+            set(x, get_interval(y, finite_width).UDiv(interval_t(k.cast_to<int32_t>())));
+        }
+        break;
+    }
     case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(interval_t(k))); break;
-    case arith_binop_t::UREM: set(x, get_interval(y, finite_width).URem(interval_t(k))); break;
+    case arith_binop_t::UREM:
+        if (finite_width == 32) {
+            // As defined in the BPF ISA specification, for 32 bit unsigned modulo the immediate value is
+            // treated as a 32-bit unsigned integer, so we need to cast it to uint32_t.
+            set(x, get_interval(y, finite_width).URem(interval_t(k.cast_to<uint32_t>())));
+        } else {
+            // As defined in the BPF ISA specification, for 64 bit unsigned modulo the immediate value is
+            // treated as a 32-bit signed integer, so we need to cast it to int32_t.
+            set(x, get_interval(y, finite_width).URem(interval_t(k.cast_to<int32_t>())));
+        }
+        break;
     default: CRAB_ERROR("DBM: unreachable");
     }
     normalize();
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index ded6df9e2..71975f2c6 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -32,6 +32,7 @@ YAML_CASE("test-data/full64.yaml")
 YAML_CASE("test-data/jump.yaml")
 YAML_CASE("test-data/loop.yaml")
 YAML_CASE("test-data/movsx.yaml")
+YAML_CASE("test-data/muldiv.yaml")
 YAML_CASE("test-data/packet.yaml")
 YAML_CASE("test-data/parse.yaml")
 YAML_CASE("test-data/sext.yaml")
diff --git a/test-data/muldiv.yaml b/test-data/muldiv.yaml
new file mode 100644
index 000000000..f32754b43
--- /dev/null
+++ b/test-data/muldiv.yaml
@@ -0,0 +1,60 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: 32bit division - negative divisor
+
+pre: ["r0.type=number", "r0.svalue=0", "r0.uvalue=0"]
+
+code:
+  <start>: |
+    w0 = 4194435072
+    w0 /= 4096655360
+
+post:
+  - r0.type=number
+  - r0.svalue=1
+  - r0.uvalue=1
+
+---
+test-case: 32bit modulo - negative divisor
+pre: ["r0.type=number", "r0.svalue=0", "r0.uvalue=0"]
+
+code:
+  <start>: |
+    w0 = 4194435072
+    w0 %= 4096655360
+
+post:
+  - r0.type=number
+  - r0.svalue=97779712
+  - r0.uvalue=97779712
+
+---
+test-case: 64bit division - negative divisor
+
+pre: ["r0.type=number", "r0.svalue=0", "r0.uvalue=0"]
+
+code:
+  <start>: |
+    r0 = 4194435072
+    r0 /= 4096655360
+
+post:
+  - r0.type=number
+  - r0.svalue=1
+  - r0.uvalue=1
+
+---
+test-case: 64bit modulo - negative divisor
+
+pre: ["r0.type=number", "r0.svalue=0", "r0.uvalue=0"]
+
+code:
+  <start>: |
+    r0 = 4194435072
+    r0 %= 4096655360
+
+post:
+  - r0.type=number
+  - r0.svalue=-100532224
+  - r0.uvalue=18446744073609019392

From b369e1229a75a34343ff54a313be31a41af5a70e Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Tue, 15 Oct 2024 11:11:59 -0700
Subject: [PATCH 286/373] PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/split_dbm.cpp | 55 +++++++++++++++++++++++-------------------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index da0a6b377..ba5e676b6 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -998,6 +998,32 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, variable_t z,
     normalize();
 }
 
+// As defined in the BPF ISA specification, the immediate value of an unsigned modulo and division is treated
+// differently depending on the width:
+// * for 32 bit, as a 32-bit unsigned integer
+// * for 64 bit, as a 32-bit (not 64 bit) signed integer
+number_t read_imm_for_udiv_or_umod(const number_t& imm, int width) {
+    assert(width == 32 || width == 64);
+    if (width == 32) {
+        return number_t{imm.cast_to<uint32_t>()};
+    } else {
+        return number_t{imm.cast_to<int32_t>()};
+    }
+}
+
+// As defined in the BPF ISA specification, the immediate value of a signed modulo and division is treated
+// differently depending on the width:
+// * for 32 bit, as a 32-bit signed integer
+// * for 64 bit, as a 64-bit signed integer
+number_t read_imm_for_sdiv_or_smod(const number_t& imm, int width) {
+    assert(width == 32 || width == 64);
+    if (width == 32) {
+        return number_t{imm.cast_to<int32_t>()};
+    } else {
+        return number_t{imm.cast_to<int64_t>()};
+    }
+}
+
 void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, const number_t& k, int finite_width) {
     CrabStats::count("SplitDBM.count.apply");
     ScopedCrabStats __st__("SplitDBM.apply");
@@ -1007,31 +1033,10 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, const number_
     case arith_binop_t::SUB: assign(x, linear_expression_t(y).subtract(k)); break;
     case arith_binop_t::MUL: assign(x, linear_expression_t(k, y)); break;
     // For the rest of operations, we fall back on intervals.
-    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(interval_t(k))); break;
-    case arith_binop_t::UDIV: {
-        if (finite_width == 32) {
-            // As defined in the BPF ISA specification, for 32 bit unsigned division the immediate value is
-            // treated as a 32-bit unsigned integer, so we need to cast it to uint32_t.
-            set(x, get_interval(y, finite_width).UDiv(interval_t(k.cast_to<uint32_t>())));
-        } else {
-            // As defined in the BPF ISA specification, for 64 bit unsigned division the immediate value is
-            // treated as a 32-bit signed integer, so we need to cast it to int32_t.
-            set(x, get_interval(y, finite_width).UDiv(interval_t(k.cast_to<int32_t>())));
-        }
-        break;
-    }
-    case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(interval_t(k))); break;
-    case arith_binop_t::UREM:
-        if (finite_width == 32) {
-            // As defined in the BPF ISA specification, for 32 bit unsigned modulo the immediate value is
-            // treated as a 32-bit unsigned integer, so we need to cast it to uint32_t.
-            set(x, get_interval(y, finite_width).URem(interval_t(k.cast_to<uint32_t>())));
-        } else {
-            // As defined in the BPF ISA specification, for 64 bit unsigned modulo the immediate value is
-            // treated as a 32-bit signed integer, so we need to cast it to int32_t.
-            set(x, get_interval(y, finite_width).URem(interval_t(k.cast_to<int32_t>())));
-        }
-        break;
+    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(interval_t(read_imm_for_sdiv_or_smod(k, finite_width)))); break;
+    case arith_binop_t::UDIV: set(x, get_interval(y, finite_width).UDiv(interval_t(read_imm_for_udiv_or_umod(k, finite_width)))); break;
+    case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(interval_t(read_imm_for_sdiv_or_smod(k, finite_width)))); break;
+    case arith_binop_t::UREM: set(x, get_interval(y, finite_width).URem(interval_t(read_imm_for_udiv_or_umod(k, finite_width)))); break;
     default: CRAB_ERROR("DBM: unreachable");
     }
     normalize();

From 36564373626989b8cbc6918f9811cff82cff00a0 Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Tue, 15 Oct 2024 23:38:08 +0300
Subject: [PATCH 287/373] clang-format and tidy

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/split_dbm.cpp | 62 ++++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 26 deletions(-)

diff --git a/src/crab/split_dbm.cpp b/src/crab/split_dbm.cpp
index ba5e676b6..527ffbce9 100644
--- a/src/crab/split_dbm.cpp
+++ b/src/crab/split_dbm.cpp
@@ -12,7 +12,7 @@
 
 namespace crab::domains {
 
-static std::optional<SplitDBM::vert_id> try_at(const SplitDBM::vert_map_t& map, variable_t v) {
+static std::optional<SplitDBM::vert_id> try_at(const SplitDBM::vert_map_t& map, const variable_t v) {
     const auto it = map.find(v);
     if (it == map.end()) {
         return std::nullopt;
@@ -740,7 +740,7 @@ std::optional<SplitDBM> SplitDBM::meet(const SplitDBM& o) const {
     return res;
 }
 
-void SplitDBM::operator-=(variable_t v) {
+void SplitDBM::operator-=(const variable_t v) {
     if (const auto y = try_at(vert_map, v)) {
         g.forget(*y);
         rev_map[*y] = std::nullopt;
@@ -923,7 +923,7 @@ class vert_set_wrap_t {
   public:
     explicit vert_set_wrap_t(const SplitDBM::vert_set_t& _vs) : vs(_vs) {}
 
-    bool operator[](SplitDBM::vert_id v) const { return vs.contains(v); }
+    bool operator[](const SplitDBM::vert_id v) const { return vs.contains(v); }
     const SplitDBM::vert_set_t& vs;
 };
 
@@ -947,7 +947,7 @@ void SplitDBM::normalize() {
     unstable.clear();
 }
 
-void SplitDBM::set(variable_t x, const interval_t& intv) {
+void SplitDBM::set(const variable_t x, const interval_t& intv) {
     CrabStats::count("SplitDBM.count.assign");
     ScopedCrabStats __st__("SplitDBM.assign");
     assert(!intv.is_bottom());
@@ -980,7 +980,8 @@ void SplitDBM::set(variable_t x, const interval_t& intv) {
     normalize();
 }
 
-void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, variable_t z, int finite_width) {
+void SplitDBM::apply(const arith_binop_t op, const variable_t x, const variable_t y, const variable_t z,
+                     const int finite_width) {
     CrabStats::count("SplitDBM.count.apply");
     ScopedCrabStats __st__("SplitDBM.apply");
 
@@ -1002,41 +1003,50 @@ void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, variable_t z,
 // differently depending on the width:
 // * for 32 bit, as a 32-bit unsigned integer
 // * for 64 bit, as a 32-bit (not 64 bit) signed integer
-number_t read_imm_for_udiv_or_umod(const number_t& imm, int width) {
+static number_t read_imm_for_udiv_or_umod(const number_t& imm, const int width) {
     assert(width == 32 || width == 64);
     if (width == 32) {
         return number_t{imm.cast_to<uint32_t>()};
-    } else {
-        return number_t{imm.cast_to<int32_t>()};
     }
+    return number_t{imm.cast_to<int32_t>()};
 }
 
 // As defined in the BPF ISA specification, the immediate value of a signed modulo and division is treated
 // differently depending on the width:
 // * for 32 bit, as a 32-bit signed integer
 // * for 64 bit, as a 64-bit signed integer
-number_t read_imm_for_sdiv_or_smod(const number_t& imm, int width) {
+static number_t read_imm_for_sdiv_or_smod(const number_t& imm, const int width) {
     assert(width == 32 || width == 64);
     if (width == 32) {
         return number_t{imm.cast_to<int32_t>()};
-    } else {
-        return number_t{imm.cast_to<int64_t>()};
     }
+    return number_t{imm.cast_to<int64_t>()};
 }
 
-void SplitDBM::apply(arith_binop_t op, variable_t x, variable_t y, const number_t& k, int finite_width) {
+void SplitDBM::apply(const arith_binop_t op, const variable_t x, const variable_t y, const number_t& k,
+                     const int finite_width) {
     CrabStats::count("SplitDBM.count.apply");
     ScopedCrabStats __st__("SplitDBM.apply");
 
     switch (op) {
     case arith_binop_t::ADD: assign(x, linear_expression_t(y).plus(k)); break;
     case arith_binop_t::SUB: assign(x, linear_expression_t(y).subtract(k)); break;
-    case arith_binop_t::MUL: assign(x, linear_expression_t(k, y)); break;
-    // For the rest of operations, we fall back on intervals.
-    case arith_binop_t::SDIV: set(x, get_interval(y, finite_width).SDiv(interval_t(read_imm_for_sdiv_or_smod(k, finite_width)))); break;
-    case arith_binop_t::UDIV: set(x, get_interval(y, finite_width).UDiv(interval_t(read_imm_for_udiv_or_umod(k, finite_width)))); break;
-    case arith_binop_t::SREM: set(x, get_interval(y, finite_width).SRem(interval_t(read_imm_for_sdiv_or_smod(k, finite_width)))); break;
-    case arith_binop_t::UREM: set(x, get_interval(y, finite_width).URem(interval_t(read_imm_for_udiv_or_umod(k, finite_width)))); break;
+    case arith_binop_t::MUL:
+        assign(x, linear_expression_t(k, y));
+        break;
+        // For the rest of operations, we fall back on intervals.
+    case arith_binop_t::SDIV:
+        set(x, get_interval(y, finite_width).SDiv(interval_t{read_imm_for_sdiv_or_smod(k, finite_width)}));
+        break;
+    case arith_binop_t::UDIV:
+        set(x, get_interval(y, finite_width).UDiv(interval_t{read_imm_for_udiv_or_umod(k, finite_width)}));
+        break;
+    case arith_binop_t::SREM:
+        set(x, get_interval(y, finite_width).SRem(interval_t{read_imm_for_sdiv_or_smod(k, finite_width)}));
+        break;
+    case arith_binop_t::UREM:
+        set(x, get_interval(y, finite_width).URem(interval_t{read_imm_for_udiv_or_umod(k, finite_width)}));
+        break;
     default: CRAB_ERROR("DBM: unreachable");
     }
     normalize();
@@ -1100,7 +1110,7 @@ void SplitDBM::forget(const variable_vector_t& variables) {
     normalize();
 }
 
-static std::string to_string(variable_t vd, variable_t vs, const SplitDBM::Weight& w, bool eq) {
+static std::string to_string(const variable_t vd, const variable_t vs, const SplitDBM::Weight& w, const bool eq) {
     std::stringstream elem;
     if (eq) {
         if (w.operator>(0)) {
@@ -1210,7 +1220,7 @@ bool SplitDBM::eval_expression_overflow(const linear_expression_t& e, Weight& ou
     return false;
 }
 
-interval_t SplitDBM::compute_residual(const linear_expression_t& e, variable_t pivot) const {
+interval_t SplitDBM::compute_residual(const linear_expression_t& e, const variable_t pivot) const {
     interval_t residual(-e.constant_term());
     for (const auto& [variable, coefficient] : e.variable_terms()) {
         if (variable != pivot) {
@@ -1220,7 +1230,7 @@ interval_t SplitDBM::compute_residual(const linear_expression_t& e, variable_t p
     return residual;
 }
 
-SplitDBM::Weight SplitDBM::pot_value(variable_t v) const {
+SplitDBM::Weight SplitDBM::pot_value(const variable_t v) const {
     if (const auto y = try_at(vert_map, v)) {
         return potential[*y];
     }
@@ -1296,15 +1306,15 @@ bool SplitDBM::entail(const linear_constraint_t& rhs) const {
     //       if (dom.is_top()) { ... }
 }
 
-void SplitDBM::diffcsts_of_assign(variable_t x, const linear_expression_t& exp,
+void SplitDBM::diffcsts_of_assign(const variable_t x, const linear_expression_t& exp,
                                   std::vector<std::pair<variable_t, Weight>>& lb,
                                   std::vector<std::pair<variable_t, Weight>>& ub) {
     diffcsts_of_assign(x, exp, true, ub);
     diffcsts_of_assign(x, exp, false, lb);
 }
 
-static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::graph_t& r, variable_t x,
-                               int finite_width) {
+static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::graph_t& r, const variable_t x,
+                               const int finite_width) {
     const auto it = m.find(x);
     if (it == m.end()) {
         return interval_t::top();
@@ -1323,10 +1333,10 @@ static interval_t get_interval(const SplitDBM::vert_map_t& m, const SplitDBM::gr
     return {lb, ub};
 }
 
-interval_t SplitDBM::get_interval(variable_t x, int finite_width) const {
+interval_t SplitDBM::get_interval(const variable_t x, const int finite_width) const {
     return domains::get_interval(vert_map, g, x, finite_width);
 }
 
-interval_t SplitDBM::operator[](variable_t x) const { return domains::get_interval(vert_map, g, x, 0); }
+interval_t SplitDBM::operator[](const variable_t x) const { return domains::get_interval(vert_map, g, x, 0); }
 
 } // namespace crab::domains

From 915978c4d3aa8f484badd39dd18765157086d35e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 12 Oct 2024 16:28:12 +0000
Subject: [PATCH 288/373] Bump ebpf-samples from `498d2f7` to `325cce1`

Bumps [ebpf-samples](https://github.com/vbpf/ebpf-samples) from `498d2f7` to `325cce1`.
- [Release notes](https://github.com/vbpf/ebpf-samples/releases)
- [Commits](https://github.com/vbpf/ebpf-samples/compare/498d2f7ae80d8dcd0cc47defd4104c0901d1afa8...325cce1bc528a8b70e02ea914d407b4e4f89731d)

---
updated-dependencies:
- dependency-name: ebpf-samples
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 ebpf-samples | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ebpf-samples b/ebpf-samples
index 498d2f7ae..325cce1bc 160000
--- a/ebpf-samples
+++ b/ebpf-samples
@@ -1 +1 @@
-Subproject commit 498d2f7ae80d8dcd0cc47defd4104c0901d1afa8
+Subproject commit 325cce1bc528a8b70e02ea914d407b4e4f89731d

From 80ada1c8b96263a924990a95576633223d355fbe Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Tue, 15 Oct 2024 19:21:17 -0700
Subject: [PATCH 289/373] Update test that used to fail to pass

Now that the issue is fixed

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/test/test_verify.cpp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 7c3160b3c..962091c4b 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -510,6 +510,7 @@ TEST_SECTION("build", "tail_call.o", "xdp_prog")
 TEST_SECTION("build", "map_in_map.o", ".text")
 TEST_SECTION("build", "map_in_map_anonymous.o", ".text")
 TEST_SECTION("build", "map_in_map_legacy.o", ".text")
+TEST_SECTION("build", "store_map_value_in_map.o", ".text")
 TEST_SECTION("build", "twomaps.o", ".text");
 TEST_SECTION("build", "twostackvars.o", ".text");
 TEST_SECTION("build", "twotypes.o", ".text");
@@ -537,10 +538,6 @@ TEST_SECTION_REJECT("build", "ringbuf_uninit.o", ".text");
 // If the verifier is later updated to accept them, these should
 // be changed to TEST_SECTION().
 
-// Issue: https://github.com/vbpf/ebpf-verifier/issues/620
-// Inserting value from map 1 into map 2 should be supported, but fails.
-TEST_SECTION_FAIL("build", "store_map_value_in_map.o", ".text")
-
 // Unsupported: ebpf-function
 TEST_SECTION_FAIL("prototype-kernel", "xdp_ddos01_blacklist_kern.o", ".text")
 

From 6ea08e0b15be5dc37dbd94b5303b8ba5ce6a6615 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Tue, 15 Oct 2024 12:28:11 -0700
Subject: [PATCH 290/373] Add test cases for INTMIN/-1

Fixes #677

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 external/bpf_conformance      |  2 +-
 src/test/test_conformance.cpp | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index e149d3643..e80df9982 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit e149d36431a7ea6f982e4d409d41748d82a3b56e
+Subproject commit e80df9982518c0ea41c939b561b06daa1bfce313
diff --git a/src/test/test_conformance.cpp b/src/test/test_conformance.cpp
index 9ab19da5d..bbfd09b9b 100644
--- a/src/test/test_conformance.cpp
+++ b/src/test/test_conformance.cpp
@@ -197,12 +197,20 @@ TEST_CONFORMANCE("movsx3264-reg.data")
 TEST_CONFORMANCE("movsx832-reg.data")
 TEST_CONFORMANCE("movsx864-reg.data")
 TEST_CONFORMANCE("mul32-imm.data")
+TEST_CONFORMANCE("mul32-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("mul32-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("mul32-reg-overflow.data")
 TEST_CONFORMANCE("mul32-reg.data")
 TEST_CONFORMANCE("mul64-imm.data")
+TEST_CONFORMANCE("mul64-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("mul64-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("mul64-reg.data")
 TEST_CONFORMANCE("neg.data")
+TEST_CONFORMANCE("neg32-intmin-imm.data")
+TEST_CONFORMANCE("neg32-intmin-reg.data")
 TEST_CONFORMANCE("neg64.data")
+TEST_CONFORMANCE("neg64-intmin-imm.data")
+TEST_CONFORMANCE("neg64-intmin-reg.data")
 TEST_CONFORMANCE_RANGE("prime.data", "[0, 1]")
 TEST_CONFORMANCE("rsh32-imm.data")
 TEST_CONFORMANCE("rsh32-imm-high.data")
@@ -219,11 +227,17 @@ TEST_CONFORMANCE("rsh64-reg-neg.data")
 TEST_CONFORMANCE("sdiv32-by-zero-imm.data")
 TEST_CONFORMANCE("sdiv32-by-zero-reg.data")
 TEST_CONFORMANCE("sdiv32-imm.data")
+TEST_CONFORMANCE("sdiv32-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("sdiv32-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("sdiv32-reg.data")
 TEST_CONFORMANCE("sdiv64-by-zero-imm.data")
 TEST_CONFORMANCE("sdiv64-by-zero-reg.data")
 TEST_CONFORMANCE("sdiv64-imm.data")
+TEST_CONFORMANCE("sdiv64-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("sdiv64-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("sdiv64-reg.data")
+TEST_CONFORMANCE("smod32-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("smod32-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("smod32-neg-by-neg-imm.data")
 TEST_CONFORMANCE("smod32-neg-by-neg-reg.data")
 TEST_CONFORMANCE("smod32-neg-by-pos-imm.data")
@@ -232,6 +246,8 @@ TEST_CONFORMANCE("smod32-neg-by-zero-imm.data")
 TEST_CONFORMANCE("smod32-neg-by-zero-reg.data")
 TEST_CONFORMANCE("smod32-pos-by-neg-imm.data")
 TEST_CONFORMANCE("smod32-pos-by-neg-reg.data")
+TEST_CONFORMANCE("smod64-intmin-by-negone-imm.data")
+TEST_CONFORMANCE("smod64-intmin-by-negone-reg.data")
 TEST_CONFORMANCE("smod64-neg-by-neg-imm.data")
 TEST_CONFORMANCE("smod64-neg-by-neg-reg.data")
 TEST_CONFORMANCE("smod64-neg-by-pos-imm.data")

From 3c9f6c00974fdc3cd2a0be30f1636eb6e1d0c934 Mon Sep 17 00:00:00 2001
From: Dave Thaler <dthaler1968@gmail.com>
Date: Wed, 2 Oct 2024 08:48:33 -0700
Subject: [PATCH 291/373] Put bpf2bpf caller in a named section

Libbpf logic is that if there are multiple programs then any programs in the .text section
are subprograms to be skipped when enumerating programs.

So the sample was updated to follow the convention that the non-subprogram is in a section
other than ".text", allowing testing the ability to load programs that call subprograms in
another section.  This PR updates the test accordingly and fixes a bug
hit that prevented bpf2bpf calls across sections.

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
---
 src/asm_files.cpp        | 3 +--
 src/test/test_verify.cpp | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 2f86ff7ed..0eb13c420 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -419,8 +419,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                     auto [symbol_name, symbol_section_index] = get_symbol_name_and_section_index(symbols, index);
 
                     // Queue up relocation for function symbols.
-                    if (inst.opcode == INST_OP_CALL && inst.src == INST_CALL_LOCAL &&
-                        reader.sections[symbol_section_index] == section.get()) {
+                    if (inst.opcode == INST_OP_CALL && inst.src == INST_CALL_LOCAL) {
                         function_relocation fr{.prog_index = res.size(),
                                                .source_offset = offset / sizeof(ebpf_inst),
                                                .relocation_entry_index = index,
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 962091c4b..a8405e382 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -501,7 +501,7 @@ TEST_SECTION("raw_tracepoint/filler/proc_startupdate_2")
 TEST_SECTION("raw_tracepoint/filler/sys_recvfrom_x")
 */
 TEST_PROGRAM_REJECT("build", "bpf2bpf.o", ".text", "plus1"); // Subprogram will fail verification.
-TEST_PROGRAM("build", "bpf2bpf.o", ".text", "func");         // Subprogram can be called from main program.
+TEST_PROGRAM("build", "bpf2bpf.o", "test", "func");         // Subprogram can be called from main program.
 TEST_SECTION("build", "byteswap.o", ".text")
 TEST_SECTION("build", "stackok.o", ".text")
 TEST_SECTION("build", "packet_start_ok.o", "xdp")

From c8f085e6b03b5d0aa25c14c653ac11f95c61d147 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 16 Oct 2024 12:45:21 -0700
Subject: [PATCH 292/373] Restrict udiv optimization to case where both are
 singletons

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/interval.cpp  | 17 ++++++++---------
 test-data/sdivmod.yaml | 21 +++++++++++++++++++++
 test-data/udivmod.yaml | 21 +++++++++++++++++++++
 3 files changed, 50 insertions(+), 9 deletions(-)

diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index 8db510e2a..4c8856f29 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -187,16 +187,15 @@ interval_t interval_t::URem(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
     }
-    if (const auto n = x.singleton()) {
-        // Divisor is a singleton:
-        //   the linear interval solver can perform many divisions where
-        //   the divisor is a singleton interval. We optimize for this case.
-        number_t c = *n;
-        if (c > number_t{0}) {
-            return interval_t(_lb.URem(bound_t{c}), _ub.URem(bound_t{c}));
+    if (const auto dividend = singleton()) {
+        if (const auto divisor = x.singleton()) {
+            if (*divisor == 0) {
+                return interval_t(*dividend);
+            }
+            auto dividend_val = dividend->cast_to<uint64_t>();
+            auto divisor_val = divisor->cast_to<uint64_t>();
+            return interval_t(dividend_val % divisor_val);
         }
-        // The eBPF ISA defines modulo 0 as being unchanged.
-        return *this;
     }
     if (x.contains(0)) {
         // The divisor contains 0.
diff --git a/test-data/sdivmod.yaml b/test-data/sdivmod.yaml
index 8da36fb5b..6221bd65f 100644
--- a/test-data/sdivmod.yaml
+++ b/test-data/sdivmod.yaml
@@ -569,3 +569,24 @@ post:
   - r2.type=number
   - r2.svalue=[7, 10]
   - r2.uvalue=[7, 10]
+
+---
+test-case: Inverted range after modulo
+
+pre: [r0.type=number]
+
+code:
+  <start>: |
+    if r0 s< 0x8000 goto <reset>
+    r0 %= 0x808
+    goto <exit>
+  <reset>: |
+    r0 = 0
+  <exit>: |
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=[0, 2055]
+  - r0.uvalue=[0, 2055]
+  - r0.svalue=r0.uvalue
diff --git a/test-data/udivmod.yaml b/test-data/udivmod.yaml
index 5255c026b..56d7a5caa 100644
--- a/test-data/udivmod.yaml
+++ b/test-data/udivmod.yaml
@@ -573,3 +573,24 @@ post:
   - r2.type=number
   - r2.svalue=[7, 10]
   - r2.uvalue=[7, 10]
+
+---
+test-case: Inverted range after modulo
+
+pre: [r0.type=number]
+
+code:
+  <start>: |
+    if r0 s< 0x8000 goto <reset>
+    r0 %= 0x808
+    goto <exit>
+  <reset>: |
+    r0 = 0
+  <exit>: |
+    exit
+
+post:
+  - r0.type=number
+  - r0.svalue=[0, 2055]
+  - r0.uvalue=[0, 2055]
+  - r0.svalue=r0.uvalue

From f14b927761bb000ee0ebe312d98406affa31c136 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 16 Oct 2024 12:54:30 -0700
Subject: [PATCH 293/373] PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 test-data/sdivmod.yaml | 11 +++--------
 test-data/udivmod.yaml |  9 ++-------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/test-data/sdivmod.yaml b/test-data/sdivmod.yaml
index 6221bd65f..ed7b651d5 100644
--- a/test-data/sdivmod.yaml
+++ b/test-data/sdivmod.yaml
@@ -573,17 +573,12 @@ post:
 ---
 test-case: Inverted range after modulo
 
-pre: [r0.type=number]
+pre: ["r0.type=number",
+      "r0.svalue=[32768, 9223372036854775807]"]
 
 code:
   <start>: |
-    if r0 s< 0x8000 goto <reset>
-    r0 %= 0x808
-    goto <exit>
-  <reset>: |
-    r0 = 0
-  <exit>: |
-    exit
+    r0 s%= 0x808
 
 post:
   - r0.type=number
diff --git a/test-data/udivmod.yaml b/test-data/udivmod.yaml
index 56d7a5caa..9e6d86f4a 100644
--- a/test-data/udivmod.yaml
+++ b/test-data/udivmod.yaml
@@ -577,17 +577,12 @@ post:
 ---
 test-case: Inverted range after modulo
 
-pre: [r0.type=number]
+pre: ["r0.type=number",
+      "r0.uvalue=[32768, 9223372036854775807]"]
 
 code:
   <start>: |
-    if r0 s< 0x8000 goto <reset>
     r0 %= 0x808
-    goto <exit>
-  <reset>: |
-    r0 = 0
-  <exit>: |
-    exit
 
 post:
   - r0.type=number

From dd0a8ec3f69992b1781311a5dfb075d0d69182c7 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 16 Oct 2024 13:02:54 -0700
Subject: [PATCH 294/373] PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 test-data/sdivmod.yaml | 4 ++++
 test-data/udivmod.yaml | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/test-data/sdivmod.yaml b/test-data/sdivmod.yaml
index ed7b651d5..3e59e49cd 100644
--- a/test-data/sdivmod.yaml
+++ b/test-data/sdivmod.yaml
@@ -573,6 +573,10 @@ post:
 ---
 test-case: Inverted range after modulo
 
+# Ranges are and divisor are selected so that the result of modulo has
+# inverted range compared (i.e 0x8000 % 0x808 = 0x788 and 0x7FFFFFFFFFFFFFFF % 0x808 = 0x787)
+# This previously caused an issue in the verifier as the range would be bottom (instead of a valid range).
+# Constants were picked by the libfuzzer tool.
 pre: ["r0.type=number",
       "r0.svalue=[32768, 9223372036854775807]"]
 
diff --git a/test-data/udivmod.yaml b/test-data/udivmod.yaml
index 9e6d86f4a..85c833b86 100644
--- a/test-data/udivmod.yaml
+++ b/test-data/udivmod.yaml
@@ -577,6 +577,10 @@ post:
 ---
 test-case: Inverted range after modulo
 
+# Ranges are and divisor are selected so that the result of modulo has
+# inverted range compared (i.e 0x8000 % 0x808 = 0x788 and 0x7FFFFFFFFFFFFFFF % 0x808 = 0x787)
+# This previously caused an issue in the verifier as the range would be bottom (instead of a valid range).
+# Constants were picked by the libfuzzer tool.
 pre: ["r0.type=number",
       "r0.uvalue=[32768, 9223372036854775807]"]
 

From 82f56c1830d7a9549ebe4d4c50360ad3f9b31fc2 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 16 Oct 2024 13:33:03 -0700
Subject: [PATCH 295/373] Fix failing test

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/interval.cpp | 4 ++--
 test-data/muldiv.yaml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index 4c8856f29..bdc01b87b 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -192,8 +192,8 @@ interval_t interval_t::URem(const interval_t& x) const {
             if (*divisor == 0) {
                 return interval_t(*dividend);
             }
-            auto dividend_val = dividend->cast_to<uint64_t>();
-            auto divisor_val = divisor->cast_to<uint64_t>();
+            uint64_t dividend_val = dividend->cast_to<uint64_t>();
+            uint64_t divisor_val = divisor->cast_to<uint64_t>();
             return interval_t(dividend_val % divisor_val);
         }
     }
diff --git a/test-data/muldiv.yaml b/test-data/muldiv.yaml
index f32754b43..f294d667d 100644
--- a/test-data/muldiv.yaml
+++ b/test-data/muldiv.yaml
@@ -56,5 +56,5 @@ code:
 
 post:
   - r0.type=number
-  - r0.svalue=-100532224
-  - r0.uvalue=18446744073609019392
+  - r0.svalue=97779712
+  - r0.uvalue=97779712

From 1907bd4e41757c7e0bfe8aa260789cf9b472d943 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 16 Oct 2024 13:49:16 -0700
Subject: [PATCH 296/373] PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/interval.cpp | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index bdc01b87b..db15c049c 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -189,12 +189,15 @@ interval_t interval_t::URem(const interval_t& x) const {
     }
     if (const auto dividend = singleton()) {
         if (const auto divisor = x.singleton()) {
-            if (*divisor == 0) {
-                return interval_t(*dividend);
+            if (dividend->fits_cast_to<uint64_t>() && divisor->fits_cast_to<uint64_t>()) {
+                // The BPF ISA defines modulo by 0 as resulting in the original value.
+                if (*divisor == 0) {
+                    return interval_t(*dividend);
+                }
+                uint64_t dividend_val = dividend->cast_to<uint64_t>();
+                uint64_t divisor_val = divisor->cast_to<uint64_t>();
+                return interval_t(dividend_val % divisor_val);
             }
-            uint64_t dividend_val = dividend->cast_to<uint64_t>();
-            uint64_t divisor_val = divisor->cast_to<uint64_t>();
-            return interval_t(dividend_val % divisor_val);
         }
     }
     if (x.contains(0)) {

From 9f25cee94f74108c19fa1cc88bc32c01d7ad758a Mon Sep 17 00:00:00 2001
From: Elazar Gershuni <elazarg@gmail.com>
Date: Fri, 18 Oct 2024 02:43:22 +0300
Subject: [PATCH 297/373] clang-format and tidy interval.cpp

* move abs to number_t
* remove interval_t::min and interval_t::max
* move interval::operator* to interval.cpp

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
---
 src/crab/interval.cpp      | 230 +++++++++++++++++++------------------
 src/crab/interval.hpp      |  26 +----
 src/crab_utils/num_big.hpp |   2 +
 3 files changed, 124 insertions(+), 134 deletions(-)

diff --git a/src/crab/interval.cpp b/src/crab/interval.cpp
index db15c049c..f37af40e7 100644
--- a/src/crab/interval.cpp
+++ b/src/crab/interval.cpp
@@ -4,6 +4,29 @@
 
 namespace crab {
 
+static interval_t make_dividend_when_both_nonzero(const interval_t& dividend, const interval_t& divisor) {
+    if (dividend.ub() >= 0) {
+        return dividend;
+    }
+    if (divisor.ub() < 0) {
+        return dividend + divisor + interval_t{1};
+    }
+    return dividend + interval_t{1} - divisor;
+}
+
+interval_t interval_t::operator*(const interval_t& x) const {
+    if (is_bottom() || x.is_bottom()) {
+        return bottom();
+    }
+    const auto [clb, cub] = std::minmax({
+        _lb * x._lb,
+        _lb * x._ub,
+        _ub * x._lb,
+        _ub * x._ub,
+    });
+    return interval_t{clb, cub};
+}
+
 // Signed division. eBPF has no instruction for this.
 interval_t interval_t::operator/(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
@@ -14,38 +37,37 @@ interval_t interval_t::operator/(const interval_t& x) const {
         //   the linear interval solver can perform many divisions where
         //   the divisor is a singleton interval. We optimize for this case.
         number_t c = *n;
-        if (c == number_t{1}) {
+        if (c == 1) {
             return *this;
-        } else if (c > number_t{0}) {
-            return interval_t(_lb / bound_t{c}, _ub / bound_t{c});
-        } else if (c < number_t{0}) {
-            return interval_t(_ub / bound_t{c}, _lb / bound_t{c});
+        } else if (c > 0) {
+            return interval_t{_lb / c, _ub / c};
+        } else if (c < 0) {
+            return interval_t{_ub / c, _lb / c};
         } else {
             // The eBPF ISA defines division by 0 as resulting in 0.
-            return interval_t(number_t(0));
+            return interval_t{0};
         }
     }
     if (x.contains(0)) {
         // The divisor contains 0.
-        interval_t l(x._lb, bound_t(-1));
-        interval_t u(bound_t(1), x._ub);
-        return (operator/(l) | operator/(u) | interval_t(number_t(0)));
+        interval_t l{x._lb, -1};
+        interval_t u{1, x._ub};
+        return operator/(l) | operator/(u) | interval_t{0};
     } else if (contains(0)) {
         // The dividend contains 0.
-        interval_t l(_lb, bound_t(-1));
-        interval_t u(bound_t(1), _ub);
-        return ((l / x) | (u / x) | interval_t(number_t(0)));
+        interval_t l{_lb, -1};
+        interval_t u{1, _ub};
+        return (l / x) | (u / x) | interval_t{0};
     } else {
         // Neither the dividend nor the divisor contains 0
-        interval_t a =
-            (_ub < number_t{0})
-                ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
-                : *this;
-        bound_t ll = a._lb / x._lb;
-        bound_t lu = a._lb / x._ub;
-        bound_t ul = a._ub / x._lb;
-        bound_t uu = a._ub / x._ub;
-        return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+        interval_t a = make_dividend_when_both_nonzero(*this, x);
+        const auto [clb, cub] = std::minmax({
+            a._lb / x._lb,
+            a._lb / x._ub,
+            a._ub / x._lb,
+            a._ub / x._ub,
+        });
+        return interval_t{clb, cub};
     }
 }
 
@@ -63,34 +85,33 @@ interval_t interval_t::SDiv(const interval_t& x) const {
             if (c == 1) {
                 return *this;
             } else if (c != 0) {
-                return interval_t(_lb / bound_t{c}, _ub / bound_t{c});
+                return interval_t{_lb / c, _ub / c};
             } else {
                 // The eBPF ISA defines division by 0 as resulting in 0.
-                return interval_t(number_t(0));
+                return interval_t{0};
             }
         }
     }
     if (x.contains(0)) {
         // The divisor contains 0.
-        interval_t l(x._lb, bound_t(-1));
-        interval_t u(bound_t(1), x._ub);
-        return (SDiv(l) | SDiv(u) | interval_t(number_t(0)));
+        interval_t l{x._lb, -1};
+        interval_t u{1, x._ub};
+        return SDiv(l) | SDiv(u) | interval_t{0};
     } else if (contains(0)) {
         // The dividend contains 0.
-        interval_t l(_lb, bound_t(-1));
-        interval_t u(bound_t(1), _ub);
-        return (l.SDiv(x) | u.SDiv(x) | interval_t(number_t(0)));
+        interval_t l{_lb, -1};
+        interval_t u{1, _ub};
+        return l.SDiv(x) | u.SDiv(x) | interval_t{0};
     } else {
         // Neither the dividend nor the divisor contains 0
-        interval_t a =
-            (_ub < number_t{0})
-                ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
-                : *this;
-        bound_t ll = a._lb / x._lb;
-        bound_t lu = a._lb / x._ub;
-        bound_t ul = a._ub / x._lb;
-        bound_t uu = a._ub / x._ub;
-        return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+        interval_t a = make_dividend_when_both_nonzero(*this, x);
+        const auto [clb, cub] = std::minmax({
+            a._lb / x._lb,
+            a._lb / x._ub,
+            a._ub / x._lb,
+            a._ub / x._ub,
+        });
+        return interval_t{clb, cub};
     }
 }
 
@@ -107,36 +128,35 @@ interval_t interval_t::UDiv(const interval_t& x) const {
             number_t c{n->cast_to<uint64_t>()};
             if (c == 1) {
                 return *this;
-            } else if (c > number_t{0}) {
-                return interval_t(_lb.UDiv(bound_t{c}), _ub.UDiv(bound_t{c}));
+            } else if (c > 0) {
+                return interval_t{_lb.UDiv(c), _ub.UDiv(c)};
             } else {
                 // The eBPF ISA defines division by 0 as resulting in 0.
-                return interval_t(number_t(0));
+                return interval_t{0};
             }
         }
     }
     if (x.contains(0)) {
         // The divisor contains 0.
-        interval_t l(x._lb, bound_t(-1));
-        interval_t u(bound_t(1), x._ub);
-        return UDiv(l) | UDiv(u) | interval_t(number_t(0));
+        interval_t l{x._lb, -1};
+        interval_t u{1, x._ub};
+        return UDiv(l) | UDiv(u) | interval_t{0};
     }
     if (contains(0)) {
         // The dividend contains 0.
-        interval_t l(_lb, bound_t(-1));
-        interval_t u(bound_t(1), _ub);
-        return l.UDiv(x) | u.UDiv(x) | interval_t(number_t(0));
+        interval_t l{_lb, -1};
+        interval_t u{1, _ub};
+        return l.UDiv(x) | u.UDiv(x) | interval_t{0};
     }
     // Neither the dividend nor the divisor contains 0
-    interval_t a =
-        (_ub < number_t{0})
-            ? (*this + ((x._ub < number_t{0}) ? (x + interval_t(number_t(1))) : (interval_t(number_t(1)) - x)))
-            : *this;
-    bound_t ll = a._lb.UDiv(x._lb);
-    bound_t lu = a._lb.UDiv(x._ub);
-    bound_t ul = a._ub.UDiv(x._lb);
-    bound_t uu = a._ub.UDiv(x._ub);
-    return interval_t(std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu}));
+    interval_t a = make_dividend_when_both_nonzero(*this, x);
+    const auto [clb, cub] = std::minmax({
+        a._lb.UDiv(x._lb),
+        a._lb.UDiv(x._ub),
+        a._ub.UDiv(x._lb),
+        a._ub.UDiv(x._ub),
+    });
+    return interval_t{clb, cub};
 }
 
 // Signed remainder (modulo).
@@ -149,37 +169,37 @@ interval_t interval_t::SRem(const interval_t& x) const {
     if (const auto dividend = singleton()) {
         if (const auto divisor = x.singleton()) {
             if (*divisor == 0) {
-                return interval_t(*dividend);
+                return interval_t{*dividend};
             }
-            return interval_t(*dividend % *divisor);
+            return interval_t{*dividend % *divisor};
         }
     }
     if (x.contains(0)) {
         // The divisor contains 0.
-        interval_t l(x._lb, bound_t(-1));
-        interval_t u(bound_t(1), x._ub);
+        interval_t l{x._lb, -1};
+        interval_t u{1, x._ub};
         return SRem(l) | SRem(u) | *this;
     }
     if (x.ub().is_finite() && x.lb().is_finite()) {
-        number_t min_divisor = min(abs(*x.lb().number()), abs(*x.ub().number()));
-        number_t max_divisor = max(abs(*x.lb().number()), abs(*x.ub().number()));
+        auto [xlb, xub] = x.pair_number();
+        const auto [min_divisor, max_divisor] = std::minmax({xlb.abs(), xub.abs()});
 
         if (ub() < min_divisor && -lb() < min_divisor) {
             // The modulo operation won't change the destination register.
             return *this;
         }
 
-        if (lb() < number_t{0}) {
-            if (ub() > number_t{0}) {
-                return interval_t(-(max_divisor - 1), max_divisor - 1);
+        if (lb() < 0) {
+            if (ub() > 0) {
+                return interval_t{-(max_divisor - 1), max_divisor - 1};
             } else {
-                return interval_t(-(max_divisor - 1), number_t{0});
+                return interval_t{-(max_divisor - 1), 0};
             }
         }
-        return interval_t(number_t{0}, max_divisor - 1);
+        return interval_t{0, max_divisor - 1};
     }
     // Divisor has infinite range, so result can be anything between the dividend and zero.
-    return *this | interval_t(number_t(0));
+    return *this | interval_t{0};
 }
 
 // Unsigned remainder (modulo).
@@ -192,23 +212,23 @@ interval_t interval_t::URem(const interval_t& x) const {
             if (dividend->fits_cast_to<uint64_t>() && divisor->fits_cast_to<uint64_t>()) {
                 // The BPF ISA defines modulo by 0 as resulting in the original value.
                 if (*divisor == 0) {
-                    return interval_t(*dividend);
+                    return interval_t{*dividend};
                 }
                 uint64_t dividend_val = dividend->cast_to<uint64_t>();
                 uint64_t divisor_val = divisor->cast_to<uint64_t>();
-                return interval_t(dividend_val % divisor_val);
+                return interval_t{dividend_val % divisor_val};
             }
         }
     }
     if (x.contains(0)) {
         // The divisor contains 0.
-        interval_t l(x._lb, bound_t(-1));
-        interval_t u(bound_t(1), x._ub);
+        interval_t l{x._lb, -1};
+        interval_t u{1, x._ub};
         return URem(l) | URem(u) | *this;
     } else if (contains(0)) {
         // The dividend contains 0.
-        interval_t l(_lb, bound_t(-1));
-        interval_t u(bound_t(1), _ub);
+        interval_t l{_lb, -1};
+        interval_t u{1, _ub};
         return l.URem(x) | u.URem(x) | *this;
     } else {
         // Neither the dividend nor the divisor contains 0
@@ -216,13 +236,13 @@ interval_t interval_t::URem(const interval_t& x) const {
             // Divisor is infinite. A "negative" dividend could result in anything except
             // a value between the upper bound and 0, so set to top.  A "positive" dividend
             // could result in anything between 0 and the dividend - 1.
-            return (_ub < number_t{0}) ? top() : ((*this - interval_t(number_t{1})) | interval_t(number_t(0)));
-        } else if (_ub.is_finite() && (_ub.number()->cast_to<uint64_t>() < x._lb.number()->cast_to<uint64_t>())) {
+            return _ub < 0 ? top() : (*this - interval_t{1}) | interval_t{0};
+        } else if (_ub.is_finite() && _ub.number()->cast_to<uint64_t>() < x._lb.number()->cast_to<uint64_t>()) {
             // Dividend lower than divisor, so the dividend is the remainder.
             return *this;
         } else {
             number_t max_divisor{x._ub.number()->cast_to<uint64_t>()};
-            return interval_t(number_t{0}, max_divisor - 1);
+            return interval_t{0, max_divisor - 1};
         }
     }
 }
@@ -232,12 +252,12 @@ interval_t interval_t::And(const interval_t& x) const {
     if (is_bottom() || x.is_bottom()) {
         return bottom();
     }
-    assert(is_top() || (lb() >= number_t{0}));
-    assert(x.is_top() || (x.lb() >= number_t{0}));
+    assert(is_top() || (lb() >= 0));
+    assert(x.is_top() || (x.lb() >= 0));
 
     if (const auto left = singleton()) {
         if (const auto right = x.singleton()) {
-            return interval_t(*left & *right);
+            return interval_t{*left & *right};
         }
     }
     if (x == interval_t{std::numeric_limits<uint32_t>::max()}) {
@@ -254,11 +274,11 @@ interval_t interval_t::And(const interval_t& x) const {
     if (x.contains(std::numeric_limits<uint64_t>::max())) {
         return truncate_to<uint64_t>();
     } else if (!is_top() && !x.is_top()) {
-        return interval_t(number_t{0}, std::min(ub(), x.ub()));
+        return interval_t{0, std::min(ub(), x.ub())};
     } else if (!x.is_top()) {
-        return interval_t(number_t{0}, x.ub());
+        return interval_t{0, x.ub()};
     } else if (!is_top()) {
-        return interval_t(number_t{0}, ub());
+        return interval_t{0, ub()};
     } else {
         return top();
     }
@@ -270,17 +290,16 @@ interval_t interval_t::Or(const interval_t& x) const {
     }
     if (const auto left_op = singleton()) {
         if (const auto right_op = x.singleton()) {
-            return interval_t(*left_op | *right_op);
+            return interval_t{*left_op | *right_op};
         }
     }
-    if (lb() >= number_t{0} && x.lb() >= number_t{0}) {
+    if (lb() >= 0 && x.lb() >= 0) {
         if (const auto left_ub = ub().number()) {
             if (const auto right_ub = x.ub().number()) {
-                const number_t m = *left_ub > *right_ub ? *left_ub : *right_ub;
-                return interval_t(number_t{0}, m.fill_ones());
+                return interval_t{0, std::max(*left_ub, *right_ub).fill_ones()};
             }
         }
-        return interval_t(number_t{0}, bound_t::plus_infinity());
+        return interval_t{0, bound_t::plus_infinity()};
     }
     return top();
 }
@@ -291,7 +310,7 @@ interval_t interval_t::Xor(const interval_t& x) const {
     }
     if (const auto left_op = singleton()) {
         if (const auto right_op = x.singleton()) {
-            return interval_t(*left_op ^ *right_op);
+            return interval_t{*left_op ^ *right_op};
         }
     }
     return Or(x);
@@ -303,13 +322,11 @@ interval_t interval_t::Shl(const interval_t& x) const {
     }
     if (const auto shift = x.singleton()) {
         const number_t k = *shift;
-        if (k < number_t{0}) {
-            // CRAB_ERROR("lshr shift operand cannot be negative");
+        if (k < 0) {
             return top();
         }
-        // Some crazy linux drivers generate shl instructions with
-        // huge shifts.  We limit the number of times the loop is run
-        // to avoid wasting too much time on it.
+        // Some crazy linux drivers generate shl instructions with huge shifts.
+        // We limit the number of times the loop is run to avoid wasting too much time on it.
         if (k <= 128) {
             number_t factor = 1;
             for (int i = 0; k > i; i++) {
@@ -327,13 +344,11 @@ interval_t interval_t::AShr(const interval_t& x) const {
     }
     if (const auto shift = x.singleton()) {
         const number_t k = *shift;
-        if (k < number_t{0}) {
-            // CRAB_ERROR("ashr shift operand cannot be negative");
+        if (k < 0) {
             return top();
         }
-        // Some crazy linux drivers generate ashr instructions with
-        // huge shifts.  We limit the number of times the loop is run
-        // to avoid wasting too much time on it.
+        // Some crazy linux drivers generate ashr instructions with huge shifts.
+        // We limit the number of times the loop is run to avoid wasting too much time on it.
         if (k <= 128) {
             number_t factor = 1;
             for (int i = 0; k > i; i++) {
@@ -350,20 +365,9 @@ interval_t interval_t::LShr(const interval_t& x) const {
         return bottom();
     }
     if (const auto shift = x.singleton()) {
-        const number_t k = *shift;
-        if (k < number_t{0}) {
-            // CRAB_ERROR("lshr shift operand cannot be negative");
-            return top();
-        }
-        // Some crazy linux drivers generate lshr instructions with
-        // huge shifts.  We limit the number of times the loop is run
-        // to avoid wasting too much time on it.
-        if (k <= 128) {
-            if (lb() >= number_t{0} && ub().is_finite() && shift) {
-                const number_t lb = *this->lb().number();
-                const number_t ub = *this->ub().number();
-                return interval_t(lb >> k, ub >> k);
-            }
+        if (*shift > 0 && lb() >= 0 && ub().is_finite()) {
+            const auto [lb, ub] = this->pair_number();
+            return interval_t{lb >> *shift, ub >> *shift};
         }
     }
     return top();
diff --git a/src/crab/interval.hpp b/src/crab/interval.hpp
index 657b8f694..c7de6dda6 100644
--- a/src/crab/interval.hpp
+++ b/src/crab/interval.hpp
@@ -36,12 +36,6 @@ class interval_t final {
   private:
     interval_t() : _lb(number_t{0}), _ub(-1) {}
 
-    static number_t abs(const number_t& x) { return x < 0 ? -x : x; }
-
-    static number_t max(const number_t& x, const number_t& y) { return x.operator<=(y) ? y : x; }
-
-    static number_t min(const number_t& x, const number_t& y) { return x.operator<(y) ? x : y; }
-
   public:
     interval_t(const bound_t& lb, const bound_t& ub)
         : _lb(lb > ub ? bound_t{number_t{0}} : lb), _ub(lb > ub ? bound_t{-1} : ub) {}
@@ -116,12 +110,12 @@ class interval_t final {
 
     [[nodiscard]]
     bool is_bottom() const {
-        return (_lb > _ub);
+        return _lb > _ub;
     }
 
     [[nodiscard]]
     bool is_top() const {
-        return (_lb.is_infinite() && _ub.is_infinite());
+        return _lb.is_infinite() && _ub.is_infinite();
     }
 
     bool operator==(const interval_t& x) const {
@@ -225,17 +219,7 @@ class interval_t final {
 
     interval_t& operator-=(const interval_t& x) { return operator=(operator-(x)); }
 
-    interval_t operator*(const interval_t& x) const {
-        if (is_bottom() || x.is_bottom()) {
-            return bottom();
-        } else {
-            bound_t ll = _lb * x._lb;
-            bound_t lu = _lb * x._ub;
-            bound_t ul = _ub * x._lb;
-            bound_t uu = _ub * x._ub;
-            return interval_t{std::min({ll, lu, ul, uu}), std::max({ll, lu, ul, uu})};
-        }
-    }
+    interval_t operator*(const interval_t& x) const;
 
     interval_t& operator*=(const interval_t& x) { return operator=(operator*(x)); }
 
@@ -268,8 +252,8 @@ class interval_t final {
         if (is_bottom()) {
             return false;
         }
-        bound_t b(n);
-        return (_lb <= b) && (b <= _ub);
+        const bound_t b{n};
+        return _lb <= b && b <= _ub;
     }
 
     friend std::ostream& operator<<(std::ostream& o, const interval_t& interval) {
diff --git a/src/crab_utils/num_big.hpp b/src/crab_utils/num_big.hpp
index 538921a2b..3a0d57168 100644
--- a/src/crab_utils/num_big.hpp
+++ b/src/crab_utils/num_big.hpp
@@ -223,6 +223,8 @@ class number_t final {
 
     bool operator>=(const number_t& x) const { return _n >= x._n; }
 
+    number_t abs() const { return _n < 0 ? -_n : _n; }
+
     number_t operator&(const number_t& x) const { return number_t(_n & x._n); }
 
     number_t operator|(const number_t& x) const { return number_t(_n | x._n); }

From 9d0df3b6a720b3d38dd8c9a4ab04e811f0dd1811 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Sat, 19 Oct 2024 09:43:34 -0700
Subject: [PATCH 298/373] Reject binary ops where the source is an
 uninitialized register (#740)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/assertions.cpp     |  27 ++-
 src/test/test_yaml.cpp |   1 +
 test-data/uninit.yaml  | 497 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 513 insertions(+), 12 deletions(-)
 create mode 100644 test-data/uninit.yaml

diff --git a/src/assertions.cpp b/src/assertions.cpp
index 34a3d2212..6904c2a0f 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -192,17 +192,13 @@ class AssertExtractor {
     }
 
     vector<Assert> operator()(const Atomic& ins) const {
-        vector<Assert> res;
-        res.emplace_back(TypeConstraint{ins.access.basereg, TypeGroup::pointer});
-        res.emplace_back(
-            ValidAccess{ins.access.basereg, ins.access.offset, Imm{static_cast<uint32_t>(ins.access.width)}, false});
-        if (ins.op == Atomic::Op::CMPXCHG) {
-            // The memory contents pointed to by ins.access will be compared
-            // against the value of the ins.valreg register.  Only numbers are
-            // supported.
-            res.emplace_back(TypeConstraint{ins.valreg, TypeGroup::number});
-        }
-        return res;
+
+        return {
+            Assert{TypeConstraint{ins.valreg, TypeGroup::number}},
+            Assert{TypeConstraint{ins.access.basereg, TypeGroup::pointer}},
+            Assert{ValidAccess{ins.access.basereg, ins.access.offset, Imm{static_cast<uint32_t>(ins.access.width)},
+                               false}},
+        };
     }
 
     vector<Assert> operator()(const Un ins) const { return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}}; }
@@ -246,7 +242,14 @@ class AssertExtractor {
             }
             return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
         }
-        default: return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
+        // For all other binary operations, the destination register must be a number and the source must either be an immediate or a number.
+        default:
+            if (const auto src = std::get_if<Reg>(&ins.v)) {
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}},
+                        Assert{TypeConstraint{*src, TypeGroup::number}}};
+            } else {
+                return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
+            }
         }
         assert(false);
     }
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index 71975f2c6..ac8a0b9f5 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -39,5 +39,6 @@ YAML_CASE("test-data/sext.yaml")
 YAML_CASE("test-data/shift.yaml")
 YAML_CASE("test-data/stack.yaml")
 YAML_CASE("test-data/subtract.yaml")
+YAML_CASE("test-data/uninit.yaml")
 YAML_CASE("test-data/unop.yaml")
 YAML_CASE("test-data/unsigned.yaml")
diff --git a/test-data/uninit.yaml b/test-data/uninit.yaml
new file mode 100644
index 000000000..397883f5d
--- /dev/null
+++ b/test-data/uninit.yaml
@@ -0,0 +1,497 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: addition of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 += r3
+
+post: []
+
+messages:
+  - "0: Invalid type (r3.type in {number, ctx, stack, packet, shared})"
+  - "CRAB ERROR: Cannot convert bottom to tuple"
+
+---
+test-case: subtraction of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 -= r3
+
+post: []
+
+messages:
+  - "0: Cannot subtract pointers to different regions (r3.type == number or r0.type == r3.type in {ctx, stack, packet})"
+
+---
+test-case: multiplication of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 *= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: division of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 /= r3
+
+post:
+  - "r0.svalue=[0, 1]"
+  - "r0.svalue=r0.uvalue"
+  - "r0.type=number"
+  - "r0.uvalue=[0, 1]"
+
+messages:
+  - "0: Only numbers can be used as divisors (r3 != 0)"
+
+---
+test-case: signed division of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s/= r3
+
+post:
+  - "r0.svalue=[-1, 1]"
+  - "r0.type=number"
+
+messages:
+  - "0: Only numbers can be used as divisors (r3 != 0)"
+
+---
+test-case: modulo of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 %= r3
+
+post:
+  - "r0.svalue=[0, 1]"
+  - "r0.svalue=r0.uvalue"
+  - "r0.type=number"
+  - "r0.uvalue=[0, 1]"
+
+messages:
+  - "0: Only numbers can be used as divisors (r3 != 0)"
+
+---
+test-case: signed modulo of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s%= r3
+
+post:
+  - "r0.svalue=[0, 1]"
+  - "r0.svalue=r0.uvalue"
+  - "r0.type=number"
+  - "r0.uvalue=[0, 1]"
+
+messages:
+  - "0: Only numbers can be used as divisors (r3 != 0)"
+
+---
+test-case: AND of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 &= r3
+
+post:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: OR of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 |= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: XOR of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 ^= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: LSH of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 <<= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: RSH of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 >>= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: ARSH of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s>>= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: MOVSX8 of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s8= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: MOVSX16 of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s16= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: MOVSX32 of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 s32= r3
+
+post:
+  - "r0.type=number"
+
+messages:
+  - "0: Invalid type (r3.type == number)"
+
+---
+test-case: MOV of a number and an uninitialized register
+
+pre:
+  - "r0.type=number"
+  - "r0.uvalue=1"
+  - "r0.svalue=1"
+
+code:
+  <start>: |
+    r0 = r3
+
+post:
+  - "r0.svalue=r3.svalue"
+  - "r0.type=r3.type"
+  - "r0.uvalue=r3.uvalue"
+
+---
+test-case: Store uninitialized register to context - 8 bytes
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    *(u64 *)(r1 + 0) = r0
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Only numbers can be stored to externally-visible regions (r1.type != stack -> r0.type == number)"
+
+---
+test-case: Store uninitialized register to context - 4 bytes
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    *(u32 *)(r1 + 0) = r0
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r0.type == number)"
+
+---
+test-case: Store uninitialized register to context - 2 bytes
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    *(u16 *)(r1 + 0) = r0
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r0.type == number)"
+
+---
+test-case: Store uninitialized register to context - 1 bytes
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    *(u8 *)(r1 + 0) = r0
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r0.type == number)"
+
+---
+test-case: Atomic add uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) += r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"
+
+---
+test-case: Atomic AND uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) &= r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"
+
+---
+test-case: Atomic OR uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) |= r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"
+
+---
+test-case: Atomic XOR uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) |= r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"
+
+---
+test-case: Atomic XHNG uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) x= r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"
+
+---
+test-case: Atomic CMPXCHG uninitialized register to context
+
+pre:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    lock *(u64 *)(r1 + 0) x= r5
+
+post:
+  - "r1.type=ctx"
+  - "r1.ctx_offset=0"
+
+messages:
+  - "0: Invalid type (r5.type == number)"

From 82c440ccb1b3e93fddf90878cd4648c1cf90bef6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Oct 2024 16:51:47 +0000
Subject: [PATCH 299/373] Bump external/libbtf from `6781bf2` to `69e0268`

Bumps [external/libbtf](https://github.com/Alan-Jowett/libbtf) from `6781bf2` to `69e0268`.
- [Release notes](https://github.com/Alan-Jowett/libbtf/releases)
- [Commits](https://github.com/Alan-Jowett/libbtf/compare/6781bf2301a37abba8859d93c8e8e31c2c90fae0...69e02688e89352d49c72707c2819448515d856df)

---
updated-dependencies:
- dependency-name: external/libbtf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/libbtf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/libbtf b/external/libbtf
index 6781bf230..69e02688e 160000
--- a/external/libbtf
+++ b/external/libbtf
@@ -1 +1 @@
-Subproject commit 6781bf2301a37abba8859d93c8e8e31c2c90fae0
+Subproject commit 69e02688e89352d49c72707c2819448515d856df

From a8207c94d3ce535507adc673420760adb2a39e80 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Oct 2024 16:51:48 +0000
Subject: [PATCH 300/373] Bump external/bpf_conformance from `e80df99` to
 `b1b1c21`

Bumps [external/bpf_conformance](https://github.com/Alan-Jowett/bpf_conformance) from `e80df99` to `b1b1c21`.
- [Release notes](https://github.com/Alan-Jowett/bpf_conformance/releases)
- [Commits](https://github.com/Alan-Jowett/bpf_conformance/compare/e80df9982518c0ea41c939b561b06daa1bfce313...b1b1c21f783ce1aa01874a8edbd761e9c48f95aa)

---
updated-dependencies:
- dependency-name: external/bpf_conformance
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 external/bpf_conformance | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/external/bpf_conformance b/external/bpf_conformance
index e80df9982..b1b1c21f7 160000
--- a/external/bpf_conformance
+++ b/external/bpf_conformance
@@ -1 +1 @@
-Subproject commit e80df9982518c0ea41c939b561b06daa1bfce313
+Subproject commit b1b1c21f783ce1aa01874a8edbd761e9c48f95aa

From 17bc9e1a3761c0ab055297a7c9e22f6015595fda Mon Sep 17 00:00:00 2001
From: Joseph Tafese <jetafese@uwaterloo.ca>
Date: Fri, 18 Oct 2024 15:53:11 -0400
Subject: [PATCH 301/373] chore: fix readme instructions for generating dot
 file

Signed-off-by: Joseph Tafese <jetafese@uwaterloo.ca>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index fd832a9da..33a69bbfd 100644
--- a/README.md
+++ b/README.md
@@ -126,7 +126,7 @@ A standard alternative to the --asm flag is `llvm-objdump -S FILE`.
 The cfg can be viewed using `dot` and the standard PDF viewer:
 ```
 sudo apt install graphviz
-./check ebpf-samples/cilium/bpf_lxc.o 2/1 --dot cfg.dot
+./check ebpf-samples/cilium/bpf_lxc.o 2/1 --dot cfg.dot --domain=stats
 dot -Tpdf cfg.dot > cfg.pdf
 ```
 

From 4832643099bc3f5ae56b23d5ef55814c8e6edbbf Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Sun, 20 Oct 2024 14:12:20 -0700
Subject: [PATCH 302/373] Move all yaml related code into test (#750)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 .github/workflows/build.yml  |  7 +++++-
 CMakeLists.txt               | 41 +++++++++++++++++++++---------------
 src/{ => test}/ebpf_yaml.cpp |  0
 src/{ => test}/ebpf_yaml.hpp |  0
 4 files changed, 30 insertions(+), 18 deletions(-)
 rename src/{ => test}/ebpf_yaml.cpp (100%)
 rename src/{ => test}/ebpf_yaml.hpp (100%)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 69579acea..298de21f9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -29,7 +29,12 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get update
-          sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev libyaml-cpp-dev valgrind
+          sudo apt install libboost-dev libboost-filesystem-dev libboost-program-options-dev
+
+      - name: Install test dependencies
+        if: ${{matrix.target == 'tests'}}
+        run: |
+          sudo apt install libyaml-cpp-dev valgrind
 
       - uses: actions/checkout@v4
         with:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1f3a497b6..77e288740 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -32,7 +32,9 @@ endif ()
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
         "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")
-    find_package(yaml-cpp REQUIRED)
+    if (VERIFIER_ENABLE_TESTS)
+        find_package(yaml-cpp REQUIRED)
+    endif()
     find_package(Boost REQUIRED)
     set(CMAKE_CXX_STANDARD 20)
     set(CMAKE_CXX_STANDARD_REQUIRED ON)
@@ -57,22 +59,24 @@ elseif ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC")
     set(Boost_INCLUDE_DIRS ${CMAKE_BINARY_DIR}/packages/boost/lib/native/include)
     set(Boost_LIBRARY_DIRS ${CMAKE_BINARY_DIR}/packages/boost_filesystem-vc143/lib/native)
 
-    # MSVC's "std:c++20" option is the current standard that supports all the C++17
-    # features we use. However, cmake can't deal with that here, so we set it below.
-
-    set(EXTERNAL_INSTALL_LOCATION ${CMAKE_BINARY_DIR}/packages/yaml-cpp)
-    include(ExternalProject)
-    ExternalProject_Add(yaml-cpp
-            GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
-            GIT_TAG "yaml-cpp-0.7.0"
-            GIT_SHALLOW true
-            CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${EXTERNAL_INSTALL_LOCATION}
-            -DYAML_MSVC_SHARED_RT=ON
-            -DYAML_CPP_BUILD_TESTS=OFF
-            -DYAML_CPP_BUILD_TOOLS=OFF
-    )
-    set(YAML_CPP_LIBRARIES ${EXTERNAL_INSTALL_LOCATION}/lib/yaml-cpp$<$<CONFIG:DEBUG>:d>.lib)
-    set(YAML_CPP_INCLUDE_DIR ${EXTERNAL_INSTALL_LOCATION}/include/)
+    if (VERIFIER_ENABLE_TESTS)
+        # MSVC's "std:c++20" option is the current standard that supports all the C++17
+        # features we use. However, cmake can't deal with that here, so we set it below.
+
+        set(EXTERNAL_INSTALL_LOCATION ${CMAKE_BINARY_DIR}/packages/yaml-cpp)
+        include(ExternalProject)
+        ExternalProject_Add(yaml-cpp
+                GIT_REPOSITORY https://github.com/jbeder/yaml-cpp.git
+                GIT_TAG "yaml-cpp-0.7.0"
+                GIT_SHALLOW true
+                CMAKE_ARGS -DCMAKE_INSTALL_PREFIX=${EXTERNAL_INSTALL_LOCATION}
+                -DYAML_MSVC_SHARED_RT=ON
+                -DYAML_CPP_BUILD_TESTS=OFF
+                -DYAML_CPP_BUILD_TOOLS=OFF
+        )
+        set(YAML_CPP_LIBRARIES ${EXTERNAL_INSTALL_LOCATION}/lib/yaml-cpp$<$<CONFIG:DEBUG>:d>.lib)
+        set(YAML_CPP_INCLUDE_DIR ${EXTERNAL_INSTALL_LOCATION}/include/)
+    endif()
 endif ()
 
 include_directories(./external)
@@ -104,6 +108,7 @@ file(GLOB ALL_TEST
         "./src/test/test_wto.cpp"
         "./src/test/test_yaml.cpp"
 )
+set(LIB_SRC ${LIB_SRC} "./src/test/ebpf_yaml.cpp")
 endif()
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
@@ -131,6 +136,8 @@ endif()
 target_include_directories(ebpfverifier PRIVATE ${GSL_INCLUDE_DIRS})
 
 if(VERIFIER_ENABLE_TESTS)
+target_include_directories(run_yaml PRIVATE src/test)
+
 set_target_properties(check
         PROPERTIES
         RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/..")
diff --git a/src/ebpf_yaml.cpp b/src/test/ebpf_yaml.cpp
similarity index 100%
rename from src/ebpf_yaml.cpp
rename to src/test/ebpf_yaml.cpp
diff --git a/src/ebpf_yaml.hpp b/src/test/ebpf_yaml.hpp
similarity index 100%
rename from src/ebpf_yaml.hpp
rename to src/test/ebpf_yaml.hpp

From e6ceb8f5e6588e5267f9272066e2e0b8cd4ee7ca Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Mon, 21 Oct 2024 09:29:03 -0700
Subject: [PATCH 303/373] When including ebpf-verifier as a submodule, default
 to tests off

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 CMakeLists.txt | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 77e288740..b7da01f57 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,7 +5,16 @@ project(ebpf_verifier)
 
 include(FetchContent)
 
-option(VERIFIER_ENABLE_TESTS "Build tests" ON)
+if (IS_DIRECTORY "${PROJECT_SOURCE_DIR}/.git")
+    # Install Git pre-commit hook
+    file(COPY scripts/pre-commit scripts/commit-msg
+            DESTINATION "${PROJECT_SOURCE_DIR}/.git/hooks")
+    option(VERIFIER_ENABLE_TESTS "Build tests" ON)
+else()
+    option(VERIFIER_ENABLE_TESTS "Build tests" OFF)
+endif ()
+
+message("Building tests: ${VERIFIER_ENABLE_TESTS}")
 
 FetchContent_Declare(GSL
         GIT_REPOSITORY "https://github.com/microsoft/GSL"
@@ -24,11 +33,6 @@ FetchContent_Declare(Catch2
 FetchContent_MakeAvailable(Catch2)
 endif()
 
-if (IS_DIRECTORY "${PROJECT_SOURCE_DIR}/.git")
-    # Install Git pre-commit hook
-    file(COPY scripts/pre-commit scripts/commit-msg
-            DESTINATION "${PROJECT_SOURCE_DIR}/.git/hooks")
-endif ()
 
 if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU" OR
         "${CMAKE_CXX_COMPILER_ID}" MATCHES "Clang")

From 8be58285624cf9ed191174494431518049ad9af1 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Tue, 22 Oct 2024 16:46:54 -0700
Subject: [PATCH 304/373] Reserve the space for the _succs and _preds in
 AdaptGraph::growTo

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab_utils/adapt_sgraph.hpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/crab_utils/adapt_sgraph.hpp b/src/crab_utils/adapt_sgraph.hpp
index e131044f0..dfd5cf018 100644
--- a/src/crab_utils/adapt_sgraph.hpp
+++ b/src/crab_utils/adapt_sgraph.hpp
@@ -338,6 +338,8 @@ class AdaptGraph final {
     }
 
     void growTo(size_t v) {
+        _succs.reserve(v);
+        _preds.reserve(v);
         while (size() < v) {
             new_vertex();
         }

From 6f944ffd5c3656ea5c30c861d1911013a6677135 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Wed, 23 Oct 2024 10:19:32 -0700
Subject: [PATCH 305/373] Fix off-by-one error in stack access check

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/assertions.cpp    |  3 +-
 test-data/uninit.yaml | 82 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+), 2 deletions(-)

diff --git a/src/assertions.cpp b/src/assertions.cpp
index 6904c2a0f..fcc922184 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -168,8 +168,7 @@ class AssertExtractor {
         Imm width{static_cast<uint32_t>(ins.access.width)};
         const int offset = ins.access.offset;
         if (basereg.v == R10_STACK_POINTER) {
-            // We know we are accessing the stack.
-            if (offset < -EBPF_STACK_SIZE || offset + static_cast<int>(width.v) >= 0) {
+            if (offset < -EBPF_STACK_SIZE || offset + static_cast<int>(width.v) > 0) {
                 // This assertion will fail
                 res.emplace_back(
                     ValidAccess{basereg, offset, width, false, ins.is_load ? AccessType::read : AccessType::write});
diff --git a/test-data/uninit.yaml b/test-data/uninit.yaml
index 397883f5d..9dcb18a44 100644
--- a/test-data/uninit.yaml
+++ b/test-data/uninit.yaml
@@ -495,3 +495,85 @@ post:
 
 messages:
   - "0: Invalid type (r5.type == number)"
+
+# Issue: https://github.com/vbpf/ebpf-verifier/issues/754
+# Should these tests fail?
+---
+test-case: Read uninitialized stack range - aligned
+
+pre:
+  - r10.type=stack
+  - r10.stack_offset=512
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 16)
+
+post:
+  - "r0.ctx_offset=s[496...503].ctx_offset"
+  - "r0.map_fd=s[496...503].map_fd"
+  - "r0.packet_offset=s[496...503].packet_offset"
+  - "r0.shared_offset=s[496...503].shared_offset"
+  - "r0.shared_region_size=s[496...503].shared_region_size"
+  - "r0.stack_numeric_size=s[496...503].stack_numeric_size"
+  - "r0.stack_offset=s[496...503].stack_offset"
+  - "r0.svalue=s[496...503].svalue"
+  - "r0.type=s[496...503].type"
+  - "r0.uvalue=s[496...503].uvalue"
+  - "r10.stack_offset=512"
+  - "r10.type=stack"
+
+messages: []
+
+---
+test-case: Read uninitialized stack range - aligned
+
+pre:
+  - r10.type=stack
+  - r10.stack_offset=512
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 8)
+
+post:
+  - "r0.ctx_offset=s[504...511].ctx_offset"
+  - "r0.map_fd=s[504...511].map_fd"
+  - "r0.packet_offset=s[504...511].packet_offset"
+  - "r0.shared_offset=s[504...511].shared_offset"
+  - "r0.shared_region_size=s[504...511].shared_region_size"
+  - "r0.stack_numeric_size=s[504...511].stack_numeric_size"
+  - "r0.stack_offset=s[504...511].stack_offset"
+  - "r0.svalue=s[504...511].svalue"
+  - "r0.type=s[504...511].type"
+  - "r0.uvalue=s[504...511].uvalue"
+  - "r10.stack_offset=512"
+  - "r10.type=stack"
+
+messages: []
+---
+test-case: Read uninitialized stack range - unaligned
+
+pre:
+  - r10.type=stack
+  - r10.stack_offset=512
+
+code:
+  <start>: |
+    r0 = *(u64 *)(r10 - 10)
+
+post:
+  - "r0.ctx_offset=s[502...509].ctx_offset"
+  - "r0.map_fd=s[502...509].map_fd"
+  - "r0.packet_offset=s[502...509].packet_offset"
+  - "r0.shared_offset=s[502...509].shared_offset"
+  - "r0.shared_region_size=s[502...509].shared_region_size"
+  - "r0.stack_numeric_size=s[502...509].stack_numeric_size"
+  - "r0.stack_offset=s[502...509].stack_offset"
+  - "r0.svalue=s[502...509].svalue"
+  - "r0.type=s[502...509].type"
+  - "r0.uvalue=s[502...509].uvalue"
+  - "r10.stack_offset=512"
+  - "r10.type=stack"
+
+messages: []

From 330861892019ddfc5635fe37d11d219973c805d0 Mon Sep 17 00:00:00 2001
From: Alan Jowett <alanjo@microsoft.com>
Date: Thu, 24 Oct 2024 14:54:47 -0700
Subject: [PATCH 306/373] Restrict comparisons with pointers to legal
 operations (#758)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/assertions.cpp     |  28 ++-
 src/test/ebpf_yaml.cpp |   5 +
 test-data/jump.yaml    | 534 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 566 insertions(+), 1 deletion(-)

diff --git a/src/assertions.cpp b/src/assertions.cpp
index fcc922184..b2258691a 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -137,6 +137,31 @@ class AssertExtractor {
                 // no need to check for valid access, it must be a number
                 res.emplace_back(TypeConstraint{cond.left, TypeGroup::number});
             } else {
+                bool allow_pointers = false;
+
+                switch (cond.op) {
+                case Condition::Op::EQ: allow_pointers = true; break;
+                case Condition::Op::NE: allow_pointers = true; break;
+                case Condition::Op::SET: allow_pointers = true; break;
+                case Condition::Op::NSET: allow_pointers = true; break;
+                case Condition::Op::LT: allow_pointers = true; break;
+                case Condition::Op::LE: allow_pointers = true; break;
+                case Condition::Op::GT: allow_pointers = true; break;
+                case Condition::Op::GE: allow_pointers = true; break;
+                case Condition::Op::SLT: allow_pointers = false; break;
+                case Condition::Op::SLE: allow_pointers = false; break;
+                case Condition::Op::SGT: allow_pointers = false; break;
+                case Condition::Op::SGE: allow_pointers = false; break;
+                default: assert(!"unexpected condition");
+                }
+
+                // Only permit pointer comparisons if the operation is 64-bit.
+                allow_pointers &= cond.is64;
+
+                if (!allow_pointers) {
+                    res.emplace_back(TypeConstraint{cond.left, TypeGroup::number});
+                }
+
                 res.emplace_back(ValidAccess{cond.left});
                 // OK - map_fd is just another pointer
                 // Anything can be compared to 0
@@ -241,7 +266,8 @@ class AssertExtractor {
             }
             return {Assert{TypeConstraint{ins.dst, TypeGroup::number}}};
         }
-        // For all other binary operations, the destination register must be a number and the source must either be an immediate or a number.
+        // For all other binary operations, the destination register must be a number and the source must either be an
+        // immediate or a number.
         default:
             if (const auto src = std::get_if<Reg>(&ins.v)) {
                 return {Assert{TypeConstraint{ins.dst, TypeGroup::number}},
diff --git a/src/test/ebpf_yaml.cpp b/src/test/ebpf_yaml.cpp
index 9b2e57120..1abb19c9f 100644
--- a/src/test/ebpf_yaml.cpp
+++ b/src/test/ebpf_yaml.cpp
@@ -179,6 +179,9 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
     // Default to the machine's native endianness.
     options.big_endian = (std::endian::native == std::endian::big);
 
+    // Default to not assuming assertions.
+    options.assume_assertions = false;
+
     for (const string& name : raw_options) {
         if (name == "!allow_division_by_zero") {
             options.allow_division_by_zero = false;
@@ -192,6 +195,8 @@ static ebpf_verifier_options_t raw_options_to_options(const std::set<string>& ra
             options.big_endian = true;
         } else if (name == "!big_endian") {
             options.big_endian = false;
+        } else if (name == "assume_assertions") {
+            options.assume_assertions = true;
         } else {
             throw std::runtime_error("Unknown option: " + name);
         }
diff --git a/test-data/jump.yaml b/test-data/jump.yaml
index edc063911..e9c08805a 100644
--- a/test-data/jump.yaml
+++ b/test-data/jump.yaml
@@ -715,3 +715,537 @@ post:
 
 messages:
   - "0: Invalid type (r1.type in {number, ctx, stack, packet, shared})"
+
+# # Test cases for special case of comparison of not a number against a number when immediate is 0
+---
+test-case: JEQ with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 == 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post:
+  - r0.svalue=1
+  - r0.type=number
+  - r0.uvalue=1
+  - r1.ctx_offset=0
+  - r1.svalue=[1, 2147418112]
+  - r1.type=ctx
+
+messages:
+  - "0:2: Code is unreachable after 0:2"
+---
+test-case: JNE with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 != 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0:1: Code is unreachable after 0:1"
+  - "2: Code is unreachable after 2"
+  - "2: Invalid type (r0.type == number)"
+
+---
+test-case: JSET with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 &== 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "2: Code is unreachable after 2"
+  - "2: Invalid type (r0.type == number)"
+
+---
+test-case: JNSET with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 &!= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "2: Code is unreachable after 2"
+  - "2: Invalid type (r0.type == number)"
+
+---
+test-case: JLT with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 < 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post:
+  - r0.svalue=1
+  - r0.type=number
+  - r0.uvalue=1
+  - r1.ctx_offset=0
+  - r1.svalue=[1, 2147418112]
+  - r1.type=ctx
+  - r1.uvalue=[0, +oo]
+
+messages:
+  - "0:2: Code is unreachable after 0:2"
+
+---
+test-case: JLE with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post:
+  - r0.svalue=1
+  - r0.type=number
+  - r0.uvalue=1
+  - r1.ctx_offset=0
+  - r1.svalue=[1, 2147418112]
+  - r1.type=ctx
+  - r1.uvalue=[1, +oo]
+
+messages:
+  - "0:2: Code is unreachable after 0:2"
+
+---
+test-case: JGT with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post:
+  - r0.svalue=1
+  - r0.type=number
+  - r0.uvalue=1
+  - r1.ctx_offset=0
+  - r1.svalue=[1, 2147418112]
+  - r1.type=ctx
+  - r1.uvalue=[1, +oo]
+
+messages:
+  - "0:2: Code is unreachable after 0:2"
+
+---
+test-case: JGE with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post:
+  - r0.svalue=1
+  - r0.type=number
+  - r0.uvalue=1
+  - r1.ctx_offset=0
+  - r1.svalue=[1, 2147418112]
+  - r1.type=ctx
+  - r1.uvalue=[1, +oo]
+
+messages:
+  - "0:2: Code is unreachable after 0:2"
+
+---
+test-case: JSLT with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 s< 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSLE with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSGT with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSGE with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if r1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JEQ32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 == 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JNE32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 != 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSET32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 &== 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JNSET32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 &!= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JLT32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 < 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JLE32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JGT32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JGE32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 <= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSLT32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 s< 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSLE32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSGT32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"
+
+---
+test-case: JSGE32 with imm 0 and pointer
+options: ["assume_assertions"]
+pre:
+  - "r1.type=ctx"
+  - "r1.svalue=[1, 2147418112]"
+  - "r1.ctx_offset=0"
+
+code:
+  <start>: |
+    if w1 s<= 0 goto <exit>
+    r0 = 1
+  <exit>: |
+    exit
+
+post: []
+
+messages:
+  - "0: Code is unreachable after 0"
+  - "0: Invalid type (r1.type == number)"

From 16e06cf98c36848c0da804d71310041e4243642b Mon Sep 17 00:00:00 2001
From: Alan Jowett <alan.jowett@microsoft.com>
Date: Thu, 17 Oct 2024 16:38:11 -0700
Subject: [PATCH 307/373] Havoc register if truncating non-number

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
---
 src/crab/ebpf_domain.cpp |   6 +
 src/test/test_yaml.cpp   |   1 +
 test-data/pointer.yaml   | 357 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 364 insertions(+)
 create mode 100644 test-data/pointer.yaml

diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index baf8c398b..7d34ba9df 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2497,6 +2497,12 @@ void ebpf_domain_t::operator()(const Bin& bin) {
             // Use only the low 32 bits of the value.
             imm = gsl::narrow_cast<int32_t>(pimm->v);
             bitwise_and(dst.svalue, dst.uvalue, std::numeric_limits<uint32_t>::max());
+            // If this is a 32-bit operation and the destination is not a number, forget everything about the register.
+            if (!type_inv.has_type(m_inv, bin.dst, T_NUM)) {
+                havoc_register(m_inv, bin.dst);
+                havoc_offsets(bin.dst);
+                havoc(dst.type);
+            }
         }
         switch (bin.op) {
         case Bin::Op::MOV:
diff --git a/src/test/test_yaml.cpp b/src/test/test_yaml.cpp
index ac8a0b9f5..b7fb6b4d6 100644
--- a/src/test/test_yaml.cpp
+++ b/src/test/test_yaml.cpp
@@ -35,6 +35,7 @@ YAML_CASE("test-data/movsx.yaml")
 YAML_CASE("test-data/muldiv.yaml")
 YAML_CASE("test-data/packet.yaml")
 YAML_CASE("test-data/parse.yaml")
+YAML_CASE("test-data/pointer.yaml")
 YAML_CASE("test-data/sext.yaml")
 YAML_CASE("test-data/shift.yaml")
 YAML_CASE("test-data/stack.yaml")
diff --git a/test-data/pointer.yaml b/test-data/pointer.yaml
new file mode 100644
index 000000000..7d3dc969c
--- /dev/null
+++ b/test-data/pointer.yaml
@@ -0,0 +1,357 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: 32-bit pointer truncation - addition
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 += 0
+    r2 = *(u32 *)(r1 + 0)
+
+post: []
+
+messages:
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - subtraction
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 -= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post: []
+
+messages:
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - multiplication
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 *= 1
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - division
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 /= 1
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - modulo
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 %= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - signed division
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 s/= 1
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - signed modulo
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 s%= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - AND
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 &= -1
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - OR
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 |= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - XOR
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 ^= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - LSH
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 <<= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - RSH
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 >>= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - ARSH
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 s>>= 0
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.uvalue=[0, 4294967295]"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type in {ctx, stack, packet, shared})"
+  - "1: Invalid type (valid_access(r1.offset, width=4) for read)"
+
+---
+test-case: 32-bit pointer truncation - NOT
+
+pre:
+  - "r1.ctx_offset=0"
+  - "r1.svalue=[0, 4294967295]"
+  - "r1.svalue=r1.uvalue"
+  - "r1.type=ctx"
+  - "r1.uvalue=[0, 4294967295]"
+
+# Trigger 32-bit ALU operation without changing the value
+code:
+  <start>: |
+    w1 = - w1
+    w1 = - w1
+    r2 = *(u32 *)(r1 + 0)
+
+post:
+  - "r1.type=ctx"
+
+messages:
+  - "0: Invalid type (r1.type == number)"
+  - "1: Invalid type (r1.type == number)"
+  - "2: Lower bound must be at least 0 (valid_access(r1.offset, width=4) for read)"
+  - "2: Upper bound must be at most 64 (valid_access(r1.offset, width=4) for read)"

From 553dbe7754f71a813fd1ea24513e40c19d3292fa Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 4 Nov 2024 03:30:56 -0500
Subject: [PATCH 308/373] Changing "type domain" to "type inference domain"

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/config.hpp               |   2 +-
 src/crab/abstract_domain.cpp |   2 +-
 src/crab/type_inference.cpp  | 146 +++++++++++++++++------------------
 src/crab/type_inference.hpp  |  42 +++++-----
 src/crab_verifier.cpp        |  20 ++---
 src/ebpf_proof.hpp           |   2 +-
 src/main/check.cpp           |   8 +-
 src/main/run_yaml.cpp        |   2 +-
 src/test/test_verify.cpp     |  30 +++----
 9 files changed, 127 insertions(+), 127 deletions(-)

diff --git a/src/config.hpp b/src/config.hpp
index b2955d55d..297aec9f2 100644
--- a/src/config.hpp
+++ b/src/config.hpp
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 
-enum class abstract_domain_kind { EBPF_DOMAIN, TYPE_DOMAIN };
+enum class abstract_domain_kind { EBPF_DOMAIN, INFERENCE_DOMAIN };
 
 struct ebpf_verifier_options_t {
     bool check_termination;
diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index a047fe0e0..0d8fc6c63 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -300,7 +300,7 @@ std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
 
 // REQUIRED: instantiation for supported domains
 template abstract_domain_t::abstract_domain_t(crab::ebpf_domain_t);
-template abstract_domain_t::abstract_domain_t(crab::type_domain_t);
+template abstract_domain_t::abstract_domain_t(crab::inference_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::region_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::offset_domain_t);
 template abstract_domain_t::abstract_domain_t(crab::interval_domain_t);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index e5d83595f..63085523e 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -6,53 +6,53 @@
 
 namespace crab {
 
-bool type_domain_t::is_bottom() const {
+bool inference_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
     return (m_region.is_bottom() || m_offset.is_bottom() || m_interval.is_bottom());
 }
 
-bool type_domain_t::is_top() const {
+bool inference_domain_t::is_top() const {
     if (m_is_bottom) return false;
     return (m_region.is_top() && m_offset.is_top() && m_interval.is_top());
 }
 
-type_domain_t type_domain_t::bottom() {
-    type_domain_t typ;
+inference_domain_t inference_domain_t::bottom() {
+    inference_domain_t typ;
     typ.set_to_bottom();
     return typ;
 }
 
-void type_domain_t::set_to_bottom() {
+void inference_domain_t::set_to_bottom() {
     m_is_bottom = true;
     m_region.set_to_bottom();
     m_offset.set_to_bottom();
     m_interval.set_to_bottom();
 }
 
-void type_domain_t::set_to_top() {
+void inference_domain_t::set_to_top() {
     m_is_bottom = false;
     m_region.set_to_top();
     m_offset.set_to_top();
     m_interval.set_to_top();
 }
 
-bool type_domain_t::operator<=(const type_domain_t& abs) const {
+bool inference_domain_t::operator<=(const inference_domain_t& abs) const {
     /* WARNING: The operation is not implemented yet.*/
     return true;
 }
 
-type_domain_t type_domain_t::widen(const type_domain_t& other, bool to_constants) {
+inference_domain_t inference_domain_t::widen(const inference_domain_t& other, bool to_constants) {
     /* WARNING: The operation is not implemented yet.*/
-    type_domain_t res{};
+    inference_domain_t res{};
     return res;
 }
 
-void type_domain_t::operator|=(const type_domain_t& abs) {
-    type_domain_t tmp{abs};
+void inference_domain_t::operator|=(const inference_domain_t& abs) {
+    inference_domain_t tmp{abs};
     operator|=(std::move(tmp));
 }
 
-void type_domain_t::operator|=(type_domain_t&& abs) {
+void inference_domain_t::operator|=(inference_domain_t&& abs) {
     if (is_bottom()) {
         *this = abs;
         return;
@@ -60,49 +60,49 @@ void type_domain_t::operator|=(type_domain_t&& abs) {
     *this = *this | std::move(abs);
 }
 
-type_domain_t type_domain_t::operator|(const type_domain_t& other) const {
+inference_domain_t inference_domain_t::operator|(const inference_domain_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     }
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | other.m_region, m_offset | other.m_offset,
+    return inference_domain_t(m_region | other.m_region, m_offset | other.m_offset,
             m_interval | other.m_interval);
 }
 
-type_domain_t type_domain_t::operator|(type_domain_t&& other) const {
+inference_domain_t inference_domain_t::operator|(inference_domain_t&& other) const {
     if (is_bottom() || other.is_top()) {
         return std::move(other);
     }
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return type_domain_t(m_region | std::move(other.m_region),
+    return inference_domain_t(m_region | std::move(other.m_region),
             m_offset | std::move(other.m_offset),
             m_interval | std::move(other.m_interval));
 }
 
-type_domain_t type_domain_t::operator&(const type_domain_t& abs) const {
+inference_domain_t inference_domain_t::operator&(const inference_domain_t& abs) const {
     /* WARNING: The operation is not implemented yet.*/
     return abs;
 }
 
-type_domain_t type_domain_t::narrow(const type_domain_t& other) const {
+inference_domain_t inference_domain_t::narrow(const inference_domain_t& other) const {
     /* WARNING: The operation is not implemented yet.*/
     return other;
 }
 
-void type_domain_t::initialize_loop_counter(label_t label) {
+void inference_domain_t::initialize_loop_counter(label_t label) {
     // WARNING: Not implemented yet
 }
 
-crab::bound_t type_domain_t::get_loop_count_upper_bound() const {
+crab::bound_t inference_domain_t::get_loop_count_upper_bound() const {
     // WARNING: Not implemented yet
     return crab::bound_t{crab::number_t{0}};
 }
 
-string_invariant type_domain_t::to_set() const {
+string_invariant inference_domain_t::to_set() const {
     if (is_top()) return string_invariant::top();
     std::set<std::string> result;
     for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
@@ -173,11 +173,11 @@ string_invariant type_domain_t::to_set() const {
     return string_invariant{result};
 }
 
-void type_domain_t::operator()(const Undefined& u, location_t loc) {
+void inference_domain_t::operator()(const Undefined& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Un& u, location_t loc) {
+void inference_domain_t::operator()(const Un& u, location_t loc) {
     m_region(u, loc);
     m_interval(u, loc);
     // TODO: check if we need to get signed values in any case
@@ -187,7 +187,7 @@ void type_domain_t::operator()(const Un& u, location_t loc) {
     m_offset.do_un(u, interval, loc);
 }
 
-void type_domain_t::operator()(const LoadMapFd& u, location_t loc) {
+void inference_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_region(u, loc);
     m_offset(u, loc);
     m_interval(u, loc);
@@ -209,7 +209,7 @@ static Bin atomic_to_bin(const Atomic& a) {
     return bin;
 }
 
-void type_domain_t::operator()(const Atomic &u, location_t loc) {
+void inference_domain_t::operator()(const Atomic &u, location_t loc) {
     // WARNING: Not implemented yet
     if (is_bottom()) return;
     std::optional<ptr_or_mapfd_t> base_reg_opt
@@ -263,11 +263,11 @@ void type_domain_t::operator()(const Atomic &u, location_t loc) {
     m_interval -= register_t{11};
 }
 
-void type_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
+void inference_domain_t::operator()(const IncrementLoopCounter &u, location_t loc) {
     // WARNING: Not implemented yet
 }
 
-void type_domain_t::operator()(const Call& u, location_t loc) {
+void inference_domain_t::operator()(const Call& u, location_t loc) {
 
     stack_cells_t stack_values;
     for (ArgPair param : u.pairs) {
@@ -298,27 +298,27 @@ void type_domain_t::operator()(const Call& u, location_t loc) {
     m_interval.do_call(u, stack_values, loc);
 }
 
-void type_domain_t::operator()(const Callx &u, location_t loc) {
+void inference_domain_t::operator()(const Callx &u, location_t loc) {
     // WARNING: Not implemented yet
     // This operation is not needed for current benchmarks,
     // TODO: implement this if needed
 }
 
-void type_domain_t::operator()(const Exit& u, location_t loc) {
+void inference_domain_t::operator()(const Exit& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Jmp& u, location_t loc) {
+void inference_domain_t::operator()(const Jmp& u, location_t loc) {
     // nothing to do here
 }
 
-void type_domain_t::operator()(const Packet& u, location_t loc) {
+void inference_domain_t::operator()(const Packet& u, location_t loc) {
     m_region(u, loc);
     m_offset(u, loc);
     m_interval(u, loc);
 }
 
-void type_domain_t::operator()(const Assume& s, location_t loc) {
+void inference_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
     const auto& maybe_left_interval = m_interval.find_interval_value(cond.left.v);
@@ -369,13 +369,13 @@ void type_domain_t::operator()(const Assume& s, location_t loc) {
     }
 }
 
-void type_domain_t::operator()(const FuncConstraint& s, location_t loc) {
+void inference_domain_t::operator()(const FuncConstraint& s, location_t loc) {
     // WARNING: Not implemented yet
     // This operation is not needed for current benchmarks,
     // TODO: implement this if needed
 }
 
-void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
+void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type_reg = m_interval.find_unsigned_interval_value(u.reg.v);
     assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
@@ -391,7 +391,7 @@ void type_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     }
 }
 
-void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
+void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     if (reg_type) {
         std::optional<mock_interval_t> width_mock_interval;
@@ -434,18 +434,18 @@ void type_domain_t::operator()(const ValidAccess& s, location_t loc) {
     }
 }
 
-void type_domain_t::operator()(const TypeConstraint& s, location_t loc) {
+void inference_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
     assert(!reg_type.has_value() || !mock_interval_type.has_value());
     m_region.check_type(s, mock_interval_type);
 }
 
-void type_domain_t::operator()(const Assert& u, location_t loc) {
+void inference_domain_t::operator()(const Assert& u, location_t loc) {
     std::visit([this, loc](const auto& v) { std::apply(*this, std::make_tuple(v, loc)); }, u.cst);
 }
 
-void type_domain_t::operator()(const Comparable& u, location_t loc) {
+void inference_domain_t::operator()(const Comparable& u, location_t loc) {
 
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
@@ -468,7 +468,7 @@ void type_domain_t::operator()(const Comparable& u, location_t loc) {
     m_errors.push_back("Non-comparable types");
 }
 
-void type_domain_t::operator()(const Addable& u, location_t loc) {
+void inference_domain_t::operator()(const Addable& u, location_t loc) {
     auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
     auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
     auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
@@ -485,7 +485,7 @@ void type_domain_t::operator()(const Addable& u, location_t loc) {
     m_errors.push_back("Addable assertion fail");
 }
 
-void type_domain_t::operator()(const ValidStore& u, location_t loc) {
+void inference_domain_t::operator()(const ValidStore& u, location_t loc) {
     auto maybe_ptr_or_mapfd_mem = m_region.find_ptr_or_mapfd_type(u.mem.v);
     auto maybe_ptr_or_mapfd_val = m_region.find_ptr_or_mapfd_type(u.val.v);
     auto maybe_num_type_mem = m_interval.find_interval_value(u.mem.v);
@@ -502,7 +502,7 @@ void type_domain_t::operator()(const ValidStore& u, location_t loc) {
     m_errors.push_back("Valid store assertion fail");
 }
 
-void type_domain_t::operator()(const ValidSize& u, location_t loc) {
+void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(u.reg.v);
     auto maybe_num_type = m_interval.find_interval_value(u.reg.v);
     assert(!maybe_ptr_or_mapfd || !maybe_num_type);
@@ -517,7 +517,7 @@ void type_domain_t::operator()(const ValidSize& u, location_t loc) {
     m_errors.push_back("Valid Size assertion fail");
 }
 
-void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
+void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
 
     // TODO: move map-related function to common
     //auto fd_type = m_region.get_map_type(u.map_fd_reg);
@@ -567,19 +567,19 @@ void type_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
     m_errors.push_back("map update with a non-numerical value");
 }
 
-void type_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
+void inference_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     m_region(u, loc);
 }
 
-type_domain_t type_domain_t::setup_entry(bool init_r1) {
+inference_domain_t inference_domain_t::setup_entry(bool init_r1) {
     auto&& reg = crab::region_domain_t::setup_entry(init_r1);
     auto&& off = offset_domain_t::setup_entry();
     auto&& interval = interval_domain_t::setup_entry();
-    type_domain_t typ(std::move(reg), std::move(off), std::move(interval));
+    inference_domain_t typ(std::move(reg), std::move(off), std::move(interval));
     return typ;
 }
 
-void type_domain_t::operator()(const Bin& bin, location_t loc) {
+void inference_domain_t::operator()(const Bin& bin, location_t loc) {
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
     std::optional<interval_t> src_signed_interval, src_unsigned_interval;
 
@@ -649,7 +649,7 @@ void type_domain_t::operator()(const Bin& bin, location_t loc) {
             dst_signed_interval, dst_ptr_or_mapfd, std::move(interval_result), loc);
 }
 
-void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
+void inference_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
     m_region.do_load(b, register_t{target_reg.v}, unknown_ptr, loc);
     // TODO: replace with a bool value returned from region do_load
@@ -661,13 +661,13 @@ void type_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_pt
     m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, std::move(interval), loc);
 }
 
-void type_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
+void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
     m_region.do_mem_store(b);
     m_interval.do_mem_store(b, basereg_opt);
     m_offset.do_mem_store(b, basereg_opt);
 }
 
-void type_domain_t::operator()(const Mem& b, location_t loc) {
+void inference_domain_t::operator()(const Mem& b, location_t loc) {
     auto basereg = b.access.basereg;
     auto base_ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
     bool unknown_ptr = !base_ptr_or_mapfd_opt.has_value();
@@ -686,7 +686,7 @@ void type_domain_t::operator()(const Mem& b, location_t loc) {
     }
 }
 
-void type_domain_t::print_ctx() const {
+void inference_domain_t::print_ctx() const {
     std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
     std::cout << "\tctx: {\n";
     for (auto const& k : ctx_keys) {
@@ -701,7 +701,7 @@ void type_domain_t::print_ctx() const {
     std::cout << "\t}\n";
 }
 
-void type_domain_t::print_stack() const {
+void inference_domain_t::print_stack() const {
     std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
     std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
     std::cout << "\tstack: {\n";
@@ -744,13 +744,13 @@ void type_domain_t::print_stack() const {
     std::cout << "\t}\n";
 }
 
-void type_domain_t::adjust_bb_for_types(location_t loc) {
+void inference_domain_t::adjust_bb_for_types(location_t loc) {
     m_region.adjust_bb_for_types(loc);
     m_offset.adjust_bb_for_types(loc);
     m_interval.adjust_bb_for_types(loc);
 }
 
-void type_domain_t::operator()(const basic_block_t& bb, int print) {
+void inference_domain_t::operator()(const basic_block_t& bb, int print) {
 
     if (print != 0) {
         print_annotated(std::cout, *this, bb, print);
@@ -780,22 +780,22 @@ void type_domain_t::operator()(const basic_block_t& bb, int print) {
 }
 
 std::optional<crab::ptr_or_mapfd_t>
-type_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_region.find_ptr_or_mapfd_at_loc(loc);
 }
 
 std::optional<crab::refinement_t>
-type_domain_t::find_refinement_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_refinement_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_offset.find_refinement_at_loc(loc);
 }
 
 std::optional<crab::mock_interval_t>
-type_domain_t::find_signed_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_signed_interval_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_interval.find_signed_interval_at_loc(loc);
 }
 
 std::optional<crab::mock_interval_t>
-type_domain_t::find_unsigned_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_unsigned_interval_at_loc(const crab::reg_with_loc_t& loc) const {
     return m_interval.find_unsigned_interval_at_loc(loc);
 }
 
@@ -812,54 +812,54 @@ static inline region_t string_to_region(const std::string& s) {
     throw std::runtime_error(std::string("Unsupported region name: ") + s);
 }
 
-void type_domain_t::insert_in_registers_in_interval_domain(register_t r, location_t loc,
+void inference_domain_t::insert_in_registers_in_interval_domain(register_t r, location_t loc,
         interval_t interval) {
     m_interval.insert_in_registers(r, loc, interval);
 }
 
-void type_domain_t::insert_in_registers_in_signed_interval_domain(register_t r, location_t loc,
+void inference_domain_t::insert_in_registers_in_signed_interval_domain(register_t r, location_t loc,
         interval_t interval) {
     m_interval.insert_in_registers_signed(r, loc, interval);
 }
 
-void type_domain_t::insert_in_registers_in_unsigned_interval_domain(register_t r, location_t loc,
+void inference_domain_t::insert_in_registers_in_unsigned_interval_domain(register_t r, location_t loc,
         interval_t interval) {
     m_interval.insert_in_registers_unsigned(r, loc, interval);
 }
 
-void type_domain_t::store_in_stack_in_interval_domain(uint64_t key, mock_interval_t p, int width) {
+void inference_domain_t::store_in_stack_in_interval_domain(uint64_t key, mock_interval_t p, int width) {
     m_interval.store_in_stack(key, p, width);
 }
 
-void type_domain_t::store_in_stack_in_signed_interval_domain(uint64_t key, mock_interval_t p,
+void inference_domain_t::store_in_stack_in_signed_interval_domain(uint64_t key, mock_interval_t p,
         int width) {
     m_interval.store_in_stack_signed(key, p, width);
 }
 
-void type_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, mock_interval_t p,
+void inference_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, mock_interval_t p,
         int width) {
     m_interval.store_in_stack_unsigned(key, p, width);
 }
 
-void type_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc,
+void inference_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc,
         refinement_t d) {
     m_offset.insert_in_registers(r, loc, d);
 }
 
-void type_domain_t::store_in_stack_in_offset_domain(uint64_t key, refinement_t d, int width) {
+void inference_domain_t::store_in_stack_in_offset_domain(uint64_t key, refinement_t d, int width) {
     m_offset.store_in_stack(key, d, width);
 }
 
-void type_domain_t::insert_in_registers_in_region_domain(register_t r, location_t loc,
+void inference_domain_t::insert_in_registers_in_region_domain(register_t r, location_t loc,
         const ptr_or_mapfd_t& p) {
     m_region.insert_in_registers(r, loc, p);
 }
 
-void type_domain_t::store_in_stack_in_region_domain(uint64_t key, ptr_or_mapfd_t p, int width) {
+void inference_domain_t::store_in_stack_in_region_domain(uint64_t key, ptr_or_mapfd_t p, int width) {
     m_region.store_in_stack(key, p, width);
 }
 
-type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>& types,
+inference_domain_t inference_domain_t::from_predefined_types(const std::set<std::string>& types,
         bool setup_constraints) {
     // TODO: redo the method according to the new offset domain
     // also, need to store the intervals in the offset domain
@@ -943,9 +943,9 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
     };
     */
 
-    type_domain_t typ;
+    inference_domain_t typ;
     if (setup_constraints) {
-        typ = type_domain_t::setup_entry(false);
+        typ = inference_domain_t::setup_entry(false);
     }
     else {
         typ.set_to_top();
@@ -1040,18 +1040,18 @@ type_domain_t type_domain_t::from_predefined_types(const std::set<std::string>&
     return typ;
 }
 
-void type_domain_t::write(std::ostream& os) const {
+void inference_domain_t::write(std::ostream& os) const {
     os << to_set();
 }
 
-std::ostream& operator<<(std::ostream& o, const type_domain_t& typ) {
+std::ostream& operator<<(std::ostream& o, const inference_domain_t& typ) {
     typ.write(o);
     return o;
 }
 
 } // namespace crab
 
-void print_annotated(std::ostream& o, const crab::type_domain_t& typ,
+void print_annotated(std::ostream& o, const crab::inference_domain_t& typ,
         const basic_block_t& bb, int print) {
     if (typ.is_bottom()) {
         o << bb << "\n";
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index d386db492..ed3c4758f 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -11,7 +11,7 @@
 
 namespace crab {
 
-class type_domain_t final {
+class inference_domain_t final {
     region_domain_t m_region;
     offset_domain_t m_offset;
     interval_domain_t m_interval;
@@ -20,35 +20,35 @@ class type_domain_t final {
 
   public:
 
-    type_domain_t() = default;
-    type_domain_t(type_domain_t&& o) = default;
-    type_domain_t(const type_domain_t& o) = default;
-    explicit type_domain_t(region_domain_t&& reg, offset_domain_t&& off,
+    inference_domain_t() = default;
+    inference_domain_t(inference_domain_t&& o) = default;
+    inference_domain_t(const inference_domain_t& o) = default;
+    explicit inference_domain_t(region_domain_t&& reg, offset_domain_t&& off,
             interval_domain_t&& interval, bool is_bottom = false) :
         m_region(reg), m_offset(off), m_interval(interval), m_is_bottom(is_bottom) {}
-    type_domain_t& operator=(type_domain_t&& o) = default;
-    type_domain_t& operator=(const type_domain_t& o) = default;
+    inference_domain_t& operator=(inference_domain_t&& o) = default;
+    inference_domain_t& operator=(const inference_domain_t& o) = default;
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static type_domain_t setup_entry(bool);
+    static inference_domain_t setup_entry(bool);
     // bottom/top
-    static type_domain_t bottom();
+    static inference_domain_t bottom();
     void set_to_top();
     void set_to_bottom();
     bool is_bottom() const;
     bool is_top() const;
     // inclusion
-    bool operator<=(const type_domain_t& other) const;
+    bool operator<=(const inference_domain_t& other) const;
     // join
-    void operator|=(const type_domain_t& abs);
-    void operator|=(type_domain_t&& abs);
-    type_domain_t operator|(const type_domain_t& other) const;
-    type_domain_t operator|(type_domain_t&& abs) const;
+    void operator|=(const inference_domain_t& abs);
+    void operator|=(inference_domain_t&& abs);
+    inference_domain_t operator|(const inference_domain_t& other) const;
+    inference_domain_t operator|(inference_domain_t&& abs) const;
     // meet
-    type_domain_t operator&(const type_domain_t& other) const;
+    inference_domain_t operator&(const inference_domain_t& other) const;
     // widening
-    type_domain_t widen(const type_domain_t& other, bool);
+    inference_domain_t widen(const inference_domain_t& other, bool);
     // narrowing
-    type_domain_t narrow(const type_domain_t& other) const;
+    inference_domain_t narrow(const inference_domain_t& other) const;
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = boost::none);
@@ -79,7 +79,7 @@ class type_domain_t final {
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
     void operator()(const basic_block_t& bb, int print = 0);
     void write(std::ostream& os) const;
-    friend std::ostream& operator<<(std::ostream& o, const type_domain_t& dom);
+    friend std::ostream& operator<<(std::ostream& o, const inference_domain_t& dom);
     void initialize_loop_counter(label_t label);
     crab::bound_t get_loop_count_upper_bound() const;
     string_invariant to_set() const;
@@ -91,7 +91,7 @@ class type_domain_t final {
     std::optional<crab::refinement_t> find_refinement_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::reg_with_loc_t&) const;
-    static type_domain_t from_predefined_types(const std::set<std::string>&, bool);
+    static inference_domain_t from_predefined_types(const std::set<std::string>&, bool);
     void insert_in_registers_in_region_domain(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack_in_region_domain(uint64_t, ptr_or_mapfd_t, int);
     void insert_in_registers_in_interval_domain(register_t, location_t, interval_t);
@@ -114,8 +114,8 @@ class type_domain_t final {
     void operator+=(std::vector<std::string>& errs) {
         m_errors.insert(m_errors.end(), errs.begin(), errs.end());
     }
-}; // end type_domain_t
+}; // end inference_domain_t
 
 } // namespace crab
 
-void print_annotated(std::ostream&, const crab::type_domain_t&, const basic_block_t&, int);
+void print_annotated(std::ostream&, const crab::inference_domain_t&, const basic_block_t&, int);
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 24dd9c960..fcd53a2b0 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -23,7 +23,7 @@
 #include "string_constraints.hpp"
 
 using crab::ebpf_domain_t;
-using crab::type_domain_t;
+using crab::inference_domain_t;
 using crab::linear_constraint_t;
 
 thread_local crab::lazy_allocator<program_info> global_program_info;
@@ -75,7 +75,7 @@ static checks_db generate_report(cfg_t& cfg, const crab::invariant_table_t& pre_
     return m_db;
 }
 
-static checks_db generate_report_type_domain(cfg_t& cfg,
+static checks_db generate_report_inference_domain(cfg_t& cfg,
                                  const crab::invariant_table_t& post_invariants) {
     checks_db m_db;
     for (const label_t& label : cfg.sorted_labels()) {
@@ -127,8 +127,8 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::in
     // Analyze the control-flow graph.
     //checks_db db = generate_report(cfg, pre_invariants, post_invariants);
     checks_db db;
-    if (thread_local_options.abstract_domain == abstract_domain_kind::TYPE_DOMAIN) {
-        db = generate_report_type_domain(cfg, post_invariants);
+    if (thread_local_options.abstract_domain == abstract_domain_kind::INFERENCE_DOMAIN) {
+        db = generate_report_inference_domain(cfg, post_invariants);
         if (thread_local_options.print_invariants) {
             auto exit_state = post_invariants.at(label_t::exit);
             // only to print ctx and stack, fix later
@@ -172,8 +172,8 @@ static abstract_domain_t make_initial(const ebpf_verifier_options_t* options) {
         ebpf_domain_t entry_inv = ebpf_domain_t::setup_entry(true);
         return abstract_domain_t(entry_inv);
     }
-    case abstract_domain_kind::TYPE_DOMAIN: {
-        type_domain_t entry_inv = type_domain_t::setup_entry(true);
+    case abstract_domain_kind::INFERENCE_DOMAIN: {
+        inference_domain_t entry_inv = inference_domain_t::setup_entry(true);
         return abstract_domain_t(entry_inv);
     }
     default:
@@ -193,10 +193,10 @@ static abstract_domain_t make_initial(abstract_domain_kind abstract_domain, cons
                                       : ebpf_domain_t::from_constraints(entry_invariant.value(), setup_constraints);
         return abstract_domain_t(entry_inv);
     }
-    case abstract_domain_kind::TYPE_DOMAIN: {
-        type_domain_t entry_inv = entry_invariant.is_bottom()
-                                      ? type_domain_t::from_predefined_types({"false"}, setup_constraints)
-                                      : type_domain_t::from_predefined_types(entry_invariant.value(), setup_constraints);
+    case abstract_domain_kind::INFERENCE_DOMAIN: {
+        inference_domain_t entry_inv = entry_invariant.is_bottom()
+                                      ? inference_domain_t::from_predefined_types({"false"}, setup_constraints)
+                                      : inference_domain_t::from_predefined_types(entry_invariant.value(), setup_constraints);
         return abstract_domain_t(entry_inv);
     }
     default:
diff --git a/src/ebpf_proof.hpp b/src/ebpf_proof.hpp
index 8137e019b..be11ea6bf 100644
--- a/src/ebpf_proof.hpp
+++ b/src/ebpf_proof.hpp
@@ -5,7 +5,7 @@
 #include "config.hpp"
 #include "crab/cfg.hpp"
 #include "crab_verifier.hpp"
-#include "crab/type_domain.hpp"
+#include "crab/type_inference.hpp"
 
 // - prog is a prevail representation of the eBPF program
 // - results contains the Crab CFG together with the inferred invariants
diff --git a/src/main/check.cpp b/src/main/check.cpp
index cf8b91d46..81ab5d71a 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -96,7 +96,7 @@ int main(int argc, char** argv) {
     app.add_option("--domain", domain, "Abstract domain")
         ->type_name("DOMAIN")
         ->capture_default_str()
-        ->check(CLI::IsMember({"stats", "linux", "zoneCrab", "cfg", "type"}));
+        ->check(CLI::IsMember({"stats", "linux", "zoneCrab", "cfg", "inference"}));
 
     app.add_flag("--termination,!--no-verify-termination", ebpf_verifier_options.check_termination,
                  "Verify termination. Default: ignore")
@@ -233,10 +233,10 @@ int main(int argc, char** argv) {
         print_map_descriptors(global_program_info->map_descriptors, out);
     }
 
-    if (domain == "zoneCrab" || domain == "type") {
+    if (domain == "zoneCrab" || domain == "inference") {
         ebpf_verifier_stats_t verifier_stats;
-        if (domain == "type") {
-          ebpf_verifier_options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;
+        if (domain == "inference") {
+          ebpf_verifier_options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;
         }
         auto [res, seconds] = timed_execution([&] {
             return ebpf_verify_program(std::cout, prog, raw_prog.info, &ebpf_verifier_options, &verifier_stats);
diff --git a/src/main/run_yaml.cpp b/src/main/run_yaml.cpp
index e4e9ea98d..b06ae9f1c 100644
--- a/src/main/run_yaml.cpp
+++ b/src/main/run_yaml.cpp
@@ -26,7 +26,7 @@ int main(int argc, char** argv) {
     CLI11_PARSE(app, argc, argv);
     bool res = true;
     bool tests_for_type_d = filename.find("types") != filename.npos;
-    auto domain = tests_for_type_d ? abstract_domain_kind::TYPE_DOMAIN :
+    auto domain = tests_for_type_d ? abstract_domain_kind::INFERENCE_DOMAIN :
         abstract_domain_kind::EBPF_DOMAIN;
     foreach_suite(filename, [&](const TestCase& test_case) {
         if (!pattern.empty() && test_case.name.find(pattern) == test_case.name.npos) {
diff --git a/src/test/test_verify.cpp b/src/test/test_verify.cpp
index 090dc3de9..1b4af381e 100644
--- a/src/test/test_verify.cpp
+++ b/src/test/test_verify.cpp
@@ -70,9 +70,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE(project "/" filename " " section " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") {  \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true);                      \
     }                                                                                                           \
-    TEST_CASE(project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") {      \
+    TEST_CASE(project "/" filename " " section " --domain=inference", "[verify][samples][" project "][inference]") {      \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                        \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                            \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                            \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);                     \
     }
 
@@ -80,9 +80,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE(project "/" filename " " program_name " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") { \
         VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, true);       \
     }                                                                                                               \
-    TEST_CASE(project "/" filename " " program_name " --domain=type", "[verify][samples][" project "][type]") {     \
+    TEST_CASE(project "/" filename " " program_name " --domain=inference", "[verify][samples][" project "][inference]") {     \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                            \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                                \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                                \
         VERIFY_PROGRAM(project, filename, section_name, program_name, &options, &g_ebpf_platform_linux, true);      \
     }
 
@@ -90,9 +90,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE(project "/" filename " " program_name " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") { \
         VERIFY_PROGRAM(project, filename, section_name, program_name, nullptr, &g_ebpf_platform_linux, false);      \
     }                                                                                                               \
-    TEST_CASE(project "/" filename " " program_name " --domain=type", "[verify][samples][" project "][type]") {     \
+    TEST_CASE(project "/" filename " " program_name " --domain=inference", "[verify][samples][" project "][inference]") {     \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                            \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                                \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                                \
         VERIFY_PROGRAM(project, filename, section_name, program_name, &options, &g_ebpf_platform_linux, false);     \
     }
 
@@ -100,9 +100,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE(project "/" filename " " section " --domain=zoneCrab", "[verify][samples][" project "][ebpf]") {  \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                     \
     }                                                                                                           \
-    TEST_CASE(project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") {      \
+    TEST_CASE(project "/" filename " " section " --domain=inference", "[verify][samples][" project "][inference]") {      \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                        \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                            \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                            \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                    \
     }
 
@@ -113,9 +113,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
         options.strict = true;                                                                                  \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                    \
     }                                                                                                           \
-    TEST_CASE(project "/" filename " " section " --domain=type", "[verify][samples][" project "][type]") {      \
+    TEST_CASE(project "/" filename " " section " --domain=inference", "[verify][samples][" project "][inference]") {      \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                        \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                            \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                            \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);                     \
         options.strict = true;                                                                                  \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                    \
@@ -125,9 +125,9 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE("expect failure " project "/" filename " " section " --domain=zoneCrab", "[!shouldfail][verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, true);                                                    \
     }                                                                                                                                         \
-    TEST_CASE("expect failure " project "/" filename " " section " --domain=type", "[!shouldfail][verify][samples][" project "][type]") {     \
+    TEST_CASE("expect failure " project "/" filename " " section " --domain=inference", "[!shouldfail][verify][samples][" project "][inference]") {     \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                                                      \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                                                          \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                                                          \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, true);                                                   \
     }
 
@@ -135,13 +135,13 @@ FAIL_UNMARSHAL("invalid", "invalid-lddw.o", ".text")
     TEST_CASE("expect failure " project "/" filename " " section " --domain=zoneCrab", "[!shouldfail][verify][samples][" project "][ebpf]") { \
         VERIFY_SECTION(project, filename, section, nullptr, &g_ebpf_platform_linux, false);                                                   \
     }                                                                                                                                         \
-    TEST_CASE("expect failure " project "/" filename " " section " --domain=type", "[!shouldfail][verify][samples][" project "][type]") {     \
+    TEST_CASE("expect failure " project "/" filename " " section " --domain=inference", "[!shouldfail][verify][samples][" project "][inference]") {     \
         ebpf_verifier_options_t options = ebpf_verifier_default_options;                                                                      \
-        options.abstract_domain = abstract_domain_kind::TYPE_DOMAIN;                                                                          \
+        options.abstract_domain = abstract_domain_kind::INFERENCE_DOMAIN;                                                                          \
         VERIFY_SECTION(project, filename, section, &options, &g_ebpf_platform_linux, false);                                                  \
     }
 
-// need these defined for type domain as well
+// need these defined for inference domain as well
 #define TEST_SECTION_LEGACY(dirname, filename, sectionname)                                               \
     TEST_SECTION(dirname, filename, sectionname)                                                          \
     TEST_CASE("Fail unmarshalling: " dirname "/" filename " " sectionname, "[unmarshal]") {               \

From f50e55e62644c10ffb0c3094ae2dc0c04cb2e399 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 4 Nov 2024 03:41:38 -0500
Subject: [PATCH 309/373] Removed redundant ebpf_proof files

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/ebpf_proof.cpp | 27 ---------------------------
 src/ebpf_proof.hpp | 20 --------------------
 src/main/check.cpp |  1 -
 3 files changed, 48 deletions(-)
 delete mode 100644 src/ebpf_proof.cpp
 delete mode 100644 src/ebpf_proof.hpp

diff --git a/src/ebpf_proof.cpp b/src/ebpf_proof.cpp
deleted file mode 100644
index 58203f08e..000000000
--- a/src/ebpf_proof.cpp
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-
-#include "ebpf_proof.hpp"
-
-bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
-                         const ebpf_verifier_options_t* options, const crab_results& results) {
-
-    if (!results.pass_verify()) {
-        // If the program is not correct then we cannot generate a proof
-        std::cout << "Proof generation not implemented\n";
-        return false;
-    }
-
-    /*
-      The goal is to translate results.pre_invariants and
-      results.post_invariants into types from our type system. For that,
-      we will need first to define all the C++ types/classes needed for
-      defining our type system (for pointer, checked_pointer, etc), and
-      then the conversion.
-
-      A type checker is not part of the proof but we should also
-      implement it so that we can be sure that our types are correct.
-     */
-
-    return false;
-}
diff --git a/src/ebpf_proof.hpp b/src/ebpf_proof.hpp
deleted file mode 100644
index be11ea6bf..000000000
--- a/src/ebpf_proof.hpp
+++ /dev/null
@@ -1,20 +0,0 @@
-// Copyright (c) Prevail Verifier contributors.
-// SPDX-License-Identifier: MIT
-#pragma once
-
-#include "config.hpp"
-#include "crab/cfg.hpp"
-#include "crab_verifier.hpp"
-#include "crab/type_inference.hpp"
-
-// - prog is a prevail representation of the eBPF program
-// - results contains the Crab CFG together with the inferred invariants
-//
-// Return true if proof is generated.
-//
-// TODO: we need to return also a proof object. We could take prog is
-// a non-const reference and add the types (i.e., our proof) as debug
-// symbols or metadata. However, note that InstructionSeq is a prevail
-// thing. Ultimately, we want to annotate eBPF bytecode with types.
-bool ebpf_generate_proof(std::ostream& s, const InstructionSeq& prog, const program_info& info,
-                         const ebpf_verifier_options_t* options, const crab_results& results);
diff --git a/src/main/check.cpp b/src/main/check.cpp
index 81ab5d71a..0f1303ff5 100644
--- a/src/main/check.cpp
+++ b/src/main/check.cpp
@@ -6,7 +6,6 @@
 #include <boost/functional/hash.hpp>
 
 #include "ebpf_verifier.hpp"
-#include "ebpf_proof.hpp"
 #ifdef _WIN32
 #include "memsize_windows.hpp"
 #else

From 0454a19fba00986f07349de411e6898a2575b09e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 12 Nov 2024 12:25:13 -0500
Subject: [PATCH 310/373] Fixes in Unary Op

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/common.hpp                   |   2 +-
 src/crab/interval_domain.cpp          | 216 +++++++++++++++-----------
 src/crab/signed_interval_domain.cpp   |  67 +++++---
 src/crab/type_inference.cpp           |  11 +-
 src/crab/unsigned_interval_domain.cpp |  67 +++++---
 5 files changed, 219 insertions(+), 144 deletions(-)

diff --git a/src/crab/common.hpp b/src/crab/common.hpp
index 30f0ca43e..b9ea3629d 100644
--- a/src/crab/common.hpp
+++ b/src/crab/common.hpp
@@ -69,7 +69,7 @@ class mock_interval_t {
         mock_interval_t& operator=(const mock_interval_t& o) = default;
         bool operator==(const mock_interval_t& o) const;
         mock_interval_t(const interval_t& i) : _lb(i.lb()), _ub(i.ub()) {}
-        interval_t to_interval() const { return std::move(interval_t(_lb, _ub)); }
+        interval_t to_interval() const { return interval_t(_lb, _ub); }
 };
 
 class ptr_with_off_t {
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index bf029cdd7..a7f88cee8 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -116,19 +116,19 @@ void interval_domain_t::insert_in_registers(register_t reg, location_t loc, inte
 void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
         interval_t interval) {
     m_signed.insert_in_registers(reg, loc, interval);
-    auto v = m_unsigned.find_interval_at_loc(reg_with_loc_t{reg, loc});
-    if (!v) {
-        m_unsigned.insert_in_registers(reg, loc, interval_t::top());
-    }
+    //auto v = m_unsigned.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    //if (!v) {
+    //    m_unsigned.insert_in_registers(reg, loc, interval_t::top());
+    //}
 }
 
 void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
         interval_t interval) {
     m_unsigned.insert_in_registers(reg, loc, interval);
-    auto v = m_signed.find_interval_at_loc(reg_with_loc_t{reg, loc});
-    if (!v) {
-        m_signed.insert_in_registers(reg, loc, interval_t::top());
-    }
+    //auto v = m_signed.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    //if (!v) {
+    //    m_signed.insert_in_registers(reg, loc, interval_t::top());
+    //}
 }
 
 void interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
@@ -218,7 +218,111 @@ interval_domain_t interval_domain_t::setup_entry() {
     return interval;
 }
 
+static void overflow_bounds(interval_t& interval, number_t span, int finite_width,
+        bool issigned) {
+    if (interval.ub() - interval.lb() >= span) {
+        // Interval covers the full space.
+        interval = interval_t::top();
+        return;
+    }
+    if (interval.is_bottom()) {
+        interval = interval_t::top();
+        return;
+    }
+    number_t lb_value = interval.lb().number().value();
+    number_t ub_value = interval.ub().number().value();
+
+    // Compute the interval, taking overflow into account.
+    // For a signed result, we need to ensure the signed and unsigned results match
+    // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
+    // a sign extended negative one.
+    number_t lb = lb_value.truncate_to_uint(finite_width);
+    number_t ub = ub_value.truncate_to_uint(finite_width);
+    if (issigned) {
+        lb = lb.truncate_to<int64_t>();
+        ub = ub.truncate_to<int64_t>();
+    }
+    if (lb > ub) {
+        // Range wraps in the middle, so we cannot represent as an unsigned interval.
+        interval = interval_t::top();
+        return;
+    }
+    interval = crab::interval_t{lb, ub};
+}
+
+static void overflow_unsigned(interval_t& interval, int finite_width) {
+    auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
+        : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
+                                   : throw std::exception()};
+    overflow_bounds(interval, span, finite_width, false);
+}
+
+static void overflow_signed(interval_t& interval, int finite_width) {
+    auto span{finite_width == 64   ? number_t{std::numeric_limits<int64_t>::max()}
+        : finite_width == 32 ? number_t{std::numeric_limits<int32_t>::max()}
+                                   : throw std::exception()};
+    overflow_bounds(interval, span, finite_width, true);
+}
+
+enum class arithm_binop_t { ADD, SUB, MUL, SDIV, UDIV, SREM, UREM };
+//enum class bitwise_binop_t { AND, OR, XOR, SHL, LSHR, ASHR };
+//using binop_t = std::variant<arith_binop_t, bitwise_binop_t>;
+
+static void apply_signed(interval_t& dst_signed, interval_t& dst_unsigned, const interval_t& lhs, const interval_t& rhs, int finite_width, arithm_binop_t op) {
+    switch (op) {
+        case arithm_binop_t::ADD: {
+            dst_signed = lhs + rhs;
+            break;
+        }
+        case arithm_binop_t::SUB: {
+            dst_signed = lhs - rhs;
+            break;
+        }
+        case arithm_binop_t::MUL: {
+            dst_signed = lhs * rhs;
+            break;
+        }
+        default: {
+            break;
+        }
+    }
+    if (finite_width) {
+        dst_unsigned = dst_signed;
+        overflow_signed(dst_signed, finite_width);
+        overflow_unsigned(dst_unsigned, finite_width);
+    }
+}
+
 void interval_domain_t::operator()(const Un& u, location_t loc) {
+    if (u.op == Un::Op::NEG) {
+        auto dst = register_t{u.dst.v};
+        auto signed_mock_interval = find_signed_interval_value(dst);
+        auto unsigned_mock_interval = find_unsigned_interval_value(dst);
+        if (!signed_mock_interval && !unsigned_mock_interval) {
+            m_signed -= dst;
+            m_unsigned -= dst;
+            return;
+        }
+        interval_t minus_one = interval_t{number_t{-1}};
+        interval_t signed_interval = signed_mock_interval ? signed_mock_interval->to_interval() : interval_t::top();
+        interval_t unsigned_interval = unsigned_mock_interval ? unsigned_mock_interval->to_interval() : interval_t::top();
+        // TODO: this is a temporary fix, need to handle this better
+        // scenario: when either signed or unsigned is not present, but the other is
+        if (!signed_mock_interval) {
+            signed_interval = unsigned_interval;
+        }
+        else if (!unsigned_mock_interval) {
+            unsigned_interval = signed_interval;
+        }
+        apply_signed(signed_interval, unsigned_interval, signed_interval, minus_one, u.is64 ? 64 : 32, arithm_binop_t::MUL);
+        if (signed_mock_interval) {
+            insert_in_registers_signed(dst, loc, signed_interval);
+        }
+        if (unsigned_mock_interval) {
+            insert_in_registers_unsigned(dst, loc, unsigned_interval);
+        }
+        return;
+    }
     m_signed(u, loc);
     m_unsigned(u, loc);
 }
@@ -998,52 +1102,6 @@ void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& in
     m_signed.check_valid_access(s, std::move(interval), width, check_stack_all_numeric);
 }
 
-static void overflow_bounds(interval_t& interval, number_t span, int finite_width,
-        bool issigned) {
-    if (interval.ub() - interval.lb() >= span) {
-        // Interval covers the full space.
-        interval = interval_t::top();
-        return;
-    }
-    if (interval.is_bottom()) {
-        interval = interval_t::top();
-        return;
-    }
-    number_t lb_value = interval.lb().number().value();
-    number_t ub_value = interval.ub().number().value();
-
-    // Compute the interval, taking overflow into account.
-    // For a signed result, we need to ensure the signed and unsigned results match
-    // so for a 32-bit operation, 0x80000000 should be a positive 64-bit number not
-    // a sign extended negative one.
-    number_t lb = lb_value.truncate_to_uint(finite_width);
-    number_t ub = ub_value.truncate_to_uint(finite_width);
-    if (issigned) {
-        lb = lb.truncate_to_sint(64);
-        ub = ub.truncate_to_sint(64);
-    }
-    if (lb > ub) {
-        // Range wraps in the middle, so we cannot represent as an unsigned interval.
-        interval = interval_t::top();
-        return;
-    }
-    interval = crab::interval_t{lb, ub};
-}
-
-static void overflow_unsigned(interval_t& interval, int finite_width) {
-    auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
-        : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(interval, span, finite_width, false);
-}
-
-static void overflow_signed(interval_t& interval, int finite_width) {
-    auto span{finite_width == 64   ? number_t{std::numeric_limits<int64_t>::max()}
-        : finite_width == 32 ? number_t{std::numeric_limits<int32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(interval, span, finite_width, true);
-}
-
 static void apply_unsigned(interval_t& dst_signed, interval_t& dst_unsigned,
         const interval_t& src, int finite_width, const interval_t& updated_interval, Bin::Op op) {
     switch (op) {
@@ -1101,32 +1159,6 @@ static void apply_unsigned(interval_t& dst_signed, interval_t& dst_unsigned,
     }
 }
 
-static void apply_signed(interval_t& dst_signed, interval_t& dst_unsigned, const interval_t& src,
-        int finite_width, const interval_t& updated_interval, Bin::Op op) {
-    switch (op) {
-        case Bin::Op::ADD: {
-            dst_signed = updated_interval + src;
-            break;
-        }
-        case Bin::Op::SUB: {
-            dst_signed = updated_interval - src;
-            break;
-        }
-        case Bin::Op::MUL: {
-            dst_signed = updated_interval * src;
-            break;
-        }
-        default: {
-            break;
-        }
-    }
-    if (finite_width) {
-        dst_unsigned = dst_signed;
-        overflow_signed(dst_signed, finite_width);
-        overflow_unsigned(dst_unsigned, finite_width);
-    }
-}
-
 static void shl(register_t reg, int imm, int finite_width,
         interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
     // The BPF ISA requires masking the imm.
@@ -1294,8 +1326,8 @@ void interval_domain_t::do_bin(const Bin& bin,
                 }
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
                     auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, imm_int_interval, finite_width,
-                            interval, Op::ADD);
+                    apply_signed(dst_signed, dst_unsigned, interval, imm_int_interval, finite_width,
+                             arithm_binop_t::ADD);
                 }
                 else {
                     operator-=(dst_register);
@@ -1309,8 +1341,8 @@ void interval_domain_t::do_bin(const Bin& bin,
                 }
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
                     auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, imm_int_interval, finite_width,
-                            interval, Op::SUB);
+                    apply_signed(dst_signed, dst_unsigned, interval, imm_int_interval, finite_width,
+                            arithm_binop_t::SUB);
                 }
                 else {
                     operator-=(dst_register);
@@ -1320,8 +1352,8 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::MUL: {
                 // ra *= imm
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_signed(dst_signed, dst_unsigned, imm_interval, finite_width, dst_signed,
-                            Op::MUL);
+                    apply_signed(dst_signed, dst_unsigned, dst_signed, imm_interval, finite_width,
+                            arithm_binop_t::MUL);
                 }
                 else {
                     operator-=(dst_register);
@@ -1445,8 +1477,8 @@ void interval_domain_t::do_bin(const Bin& bin,
                 // ra += rb
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
                     auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, interval,
-                            Op::ADD);
+                    apply_signed(dst_signed, dst_unsigned, interval, src_signed, finite_width,
+                            arithm_binop_t::ADD);
                 }
                 else {
                     operator-=(dst_register);
@@ -1457,8 +1489,8 @@ void interval_domain_t::do_bin(const Bin& bin,
                 // ra -= rb
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
                     auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, interval,
-                            Op::SUB);
+                    apply_signed(dst_signed, dst_unsigned, interval, src_signed, finite_width,
+                            arithm_binop_t::SUB);
                 }
                 else {
                     operator-=(dst_register);
@@ -1468,8 +1500,8 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::MUL: {
                 // ra *= rb
                 if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_signed(dst_signed, dst_unsigned, src_signed, finite_width, dst_signed,
-                            Op::MUL);
+                    apply_signed(dst_signed, dst_unsigned, dst_signed, src_signed, finite_width,
+                            arithm_binop_t::MUL);
                 }
                 else {
                     operator-=(dst_register);
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index bc80a780f..304922e25 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -3,6 +3,7 @@
 
 #include "crab/signed_interval_domain.hpp"
 #include "boost/endian/conversion.hpp"
+#include "config.hpp"
 
 namespace crab {
 
@@ -426,16 +427,17 @@ signed_interval_domain_t signed_interval_domain_t::setup_entry() {
     return interval;
 }
 
+// Simple truncation function usable with swap_endianness().
+template <class T>
+constexpr T truncate(T x) noexcept {
+    return x;
+}
+
 void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
-    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
-        if (std::optional<number_t> n = v.singleton()) {
+    auto swap_endianness = [&](interval_t& v, auto be_or_le) {
+        if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                // TODO: Fix later
-                /*
-                input = (decltype(input))n.value().cast_to_sint(64);
-                decltype(input) output = be_or_le(input);
-                m_registers_values.insert(u.dst.v, loc, interval_t{number_t{output}});
-                */
+                m_registers_values.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
                 return;
             }
         }
@@ -451,32 +453,51 @@ void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
     // so we use unsigned which still fits in a signed int64.
     switch (u.op) {
     case Un::Op::BE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_big<uint16_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(interval, truncate<uint16_t>);
+        }
         break;
     case Un::Op::BE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_big<uint32_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(interval, truncate<uint32_t>);
+        }
         break;
     case Un::Op::BE64:
-        swap_endianness(std::move(interval), int64_t(0),
-                boost::endian::native_to_big<int64_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
+        }
         break;
     case Un::Op::LE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_little<uint16_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(interval, truncate<uint16_t>);
+        }
         break;
     case Un::Op::LE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_little<uint32_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(interval, truncate<uint32_t>);
+        }
         break;
     case Un::Op::LE64:
-        swap_endianness(std::move(interval), int64_t(0),
-                boost::endian::native_to_little<int64_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
+        }
+        break;
+    case Un::Op::SWAP16:
+        swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        break;
+    case Un::Op::SWAP32:
+        swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
         break;
-    case Un::Op::NEG:
-        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
-        m_registers_values.insert(u.dst.v, loc, -interval);
+    case Un::Op::SWAP64:
+        swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
         break;
     }
 }
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 63085523e..467e115f5 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -181,10 +181,12 @@ void inference_domain_t::operator()(const Un& u, location_t loc) {
     m_region(u, loc);
     m_interval(u, loc);
     // TODO: check if we need to get signed values in any case
-    auto mock_interval_opt = m_interval.find_unsigned_interval_value(u.dst.v);
-    auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
-        : interval_t::bottom();
-    m_offset.do_un(u, interval, loc);
+    // TODO: activate this when we deal with offset domain
+    //auto mock_interval_opt = m_interval.find_unsigned_interval_value(u.dst.v);
+    //auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
+    //    : interval_t::bottom();
+    // m_offset.do_un(u, interval, loc);
+    m_offset.do_un(u, interval_t::bottom(), loc);
 }
 
 void inference_domain_t::operator()(const LoadMapFd& u, location_t loc) {
@@ -446,7 +448,6 @@ void inference_domain_t::operator()(const Assert& u, location_t loc) {
 }
 
 void inference_domain_t::operator()(const Comparable& u, location_t loc) {
-
     auto maybe_ptr_or_mapfd1 = m_region.find_ptr_or_mapfd_type(u.r1.v);
     auto maybe_ptr_or_mapfd2 = m_region.find_ptr_or_mapfd_type(u.r2.v);
     auto maybe_num_type1 = m_interval.find_interval_value(u.r1.v);
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index d9fa6ec2d..2be0ed989 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -3,6 +3,7 @@
 
 #include "crab/unsigned_interval_domain.hpp"
 #include "boost/endian/conversion.hpp"
+#include "config.hpp"
 
 namespace crab {
 
@@ -382,16 +383,17 @@ unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry() {
     return interval;
 }
 
+// Simple truncation function usable with swap_endianness().
+template <class T>
+constexpr T truncate(T x) noexcept {
+    return x;
+}
+
 void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
-    auto swap_endianness = [&](interval_t&& v, auto input, const auto& be_or_le) {
-        if (std::optional<number_t> n = v.singleton()) {
+    auto swap_endianness = [&](interval_t& v, auto be_or_le) {
+        if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                // TODO: fix this
-                /*
-                input = (decltype(input))n.value().cast_to_sint64();
-                decltype(input) output = be_or_le(input);
-                m_registers_values.insert(u.dst.v, loc, interval_t{number_t{output}});
-                */
+                m_registers_values.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
                 return;
             }
         }
@@ -407,32 +409,51 @@ void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
     // so we use unsigned which still fits in a signed int64.
     switch (u.op) {
     case Un::Op::BE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_big<uint16_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(interval, truncate<uint16_t>);
+        }
         break;
     case Un::Op::BE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_big<uint32_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(interval, truncate<uint32_t>);
+        }
         break;
     case Un::Op::BE64:
-        swap_endianness(std::move(interval), uint64_t(0),
-                boost::endian::native_to_big<uint64_t>);
+        if (!thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
+        }
         break;
     case Un::Op::LE16:
-        swap_endianness(std::move(interval), uint16_t(0),
-                boost::endian::native_to_little<uint16_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        } else {
+            swap_endianness(interval, truncate<uint16_t>);
+        }
         break;
     case Un::Op::LE32:
-        swap_endianness(std::move(interval), uint32_t(0),
-                boost::endian::native_to_little<uint32_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
+        } else {
+            swap_endianness(interval, truncate<uint32_t>);
+        }
         break;
     case Un::Op::LE64:
-        swap_endianness(std::move(interval), uint64_t(0),
-                boost::endian::native_to_little<uint64_t>);
+        if (thread_local_options.big_endian) {
+            swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
+        }
+        break;
+    case Un::Op::SWAP16:
+        swap_endianness(interval, boost::endian::endian_reverse<uint16_t>);
+        break;
+    case Un::Op::SWAP32:
+        swap_endianness(interval, boost::endian::endian_reverse<uint32_t>);
         break;
-    case Un::Op::NEG:
-        auto reg_with_loc = reg_with_loc_t(u.dst.v, loc);
-        m_registers_values.insert(u.dst.v, loc, -interval);
+    case Un::Op::SWAP64:
+        swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
         break;
     }
 }

From 653053e0617658651f7b007f240ee32b56c5c49e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 12 Nov 2024 12:26:51 -0500
Subject: [PATCH 311/373] Added the yaml test data for Unary op for types

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 test-data/unop_types.yaml | 331 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 331 insertions(+)
 create mode 100644 test-data/unop_types.yaml

diff --git a/test-data/unop_types.yaml b/test-data/unop_types.yaml
new file mode 100644
index 000000000..8d8ca0a65
--- /dev/null
+++ b/test-data/unop_types.yaml
@@ -0,0 +1,331 @@
+# Copyright (c) Prevail Verifier contributors.
+# SPDX-License-Identifier: MIT
+---
+test-case: negation of unknown number
+
+pre: ["r1 : snumber", "r1 : unumber"]
+
+code:
+  <start>: |
+    r1 = -r1
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: negation of 32-bit singleton number
+
+pre: ["r1 : snumber<5>", "r1 : unumber<5>"]
+
+code:
+  <start>: |
+    w1 = -w1
+
+post: ["r1 : snumber<4294967291>", "r1 : unumber<4294967291>"]
+---
+test-case: negation of 64-bit singleton number
+
+pre: ["r1 : snumber<5>", "r1 : unumber<5>"]
+
+code:
+  <start>: |
+    r1 = -r1
+
+post: ["r1 : snumber<-5>", "r1 : unumber<18446744073709551611>"]
+---
+test-case: negation of finite interval number
+
+pre: ["r1 : snumber<[-5, 5]>"]
+
+code:
+  <start>: |
+    r1 = -r1
+
+post: ["r1 : snumber<[-5, 5]>"]
+---
+test-case: be16 singleton on little-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1 : snumber<8515>", "r1 : unumber<8515>"]
+---
+test-case: be16 singleton on big-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; 0x654321 -> 0x4321
+
+post: ["r1 : snumber<17185>", "r1 : unumber<17185>"]
+---
+test-case: be32 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = be32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1 : snumber<558065031>", "r1 : unumber<558065031>"]
+---
+test-case: be32 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be32 r1 ; 0x0987654321 -> 0x87654321
+
+post: ["r1 : snumber<2271560481>", "r1 : unumber<2271560481>"]
+---
+test-case: be64 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = be64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1 : snumber<2396871057337221120>", "r1 : unumber<2396871057337221120>"]
+---
+test-case: be64 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be64 r1 ; nop
+
+post: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+---
+test-case: be16 range on little-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: be16 range on big-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = be16 r1 ; nop. this could preserve the range but we don't support that yet
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: le16 singleton on little-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; 0x654321 -> 0x4321
+
+post: ["r1 : snumber<17185>", "r1 : unumber<17185>"]
+---
+test-case: le16 singleton on big-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1 : snumber<8515>", "r1 : unumber<8515>"]
+---
+test-case: le32 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le32 r1 ; 0x0987654321 -> 0x87654321
+
+post: ["r1 : snumber<2271560481>", "r1 : unumber<2271560481>"]
+---
+test-case: le32 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = le32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1 : snumber<558065031>", "r1 : unumber<558065031>"]
+---
+test-case: le64 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le64 r1 ; nop
+
+post: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+---
+test-case: le64 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = le64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1 : snumber<2396871057337221120>", "r1 : unumber<2396871057337221120>"]
+---
+test-case: le16 range on little-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1 ; nop. this could preserve the range but we don't support that yet
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: le16 range on big-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = le16 r1
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: swap16 singleton on little-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1 : snumber<8515>", "r1 : unumber<8515>"]
+---
+test-case: swap16 singleton on big-endian
+
+pre: ["r1 : snumber<6636321>", "r1 : unumber<6636321>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; 0x654321 -> 0x2143
+
+post: ["r1 : snumber<8515>", "r1 : unumber<8515>"]
+---
+test-case: swap32 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1 : snumber<558065031>", "r1 : unumber<558065031>"]
+---
+test-case: swap32 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap32 r1 ; 0x0987654321 -> 0x21436587
+
+post: ["r1 : snumber<558065031>", "r1 : unumber<558065031>"]
+---
+test-case: swap64 singleton on little-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1 : snumber<2396871057337221120>", "r1 : unumber<2396871057337221120>"]
+---
+test-case: swap64 singleton on big-endian
+
+pre: ["r1 : snumber<40926266145>", "r1 : unumber<40926266145>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap64 r1 ; 0x0987654321 -> 0x2143658709000000
+
+post: ["r1 : snumber<2396871057337221120>", "r1 : unumber<2396871057337221120>"]
+---
+test-case: swap16 range on little-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["!big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1 : snumber", "r1 : unumber"]
+---
+test-case: swap16 range on big-endian
+
+pre: ["r1 : snumber<[0, 2]>", "r1 : unumber<[0, 2]>"]
+
+options: ["big_endian"]
+
+code:
+  <start>: |
+    r1 = swap16 r1 ; [0x0000, 0x0002] -> [0x0000, 0x2000] but currently we just lose the range
+
+post: ["r1 : snumber", "r1 : unumber"]
+

From 6c6563c58bae27c83aa025b0d03e5148508204b9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 12 Nov 2024 12:53:08 -0500
Subject: [PATCH 312/373] Updated add_types.yml with correct types

All checks dealing with numerics pass, but packet-related checks do not
as we haven't added parsing of packet pointers when reading YAML data

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 test-data/add_types.yaml | 54 +++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 34 deletions(-)

diff --git a/test-data/add_types.yaml b/test-data/add_types.yaml
index fcc9c4de8..87377ee83 100644
--- a/test-data/add_types.yaml
+++ b/test-data/add_types.yaml
@@ -3,118 +3,104 @@
 ---
 test-case: add immediate to large singleton number
 
-pre: ["r0 : number<2147483647>"]
+pre: ["r0 : snumber<2147483647>", "r0 : unumber<2147483647>"]
 
 code:
   <start>: |
     r0 += 2 ; make sure value does not become a negative 64 bit number
 
-post: ["r0 : number<2147483649>"]
-
+post: ["r0 : snumber<2147483649>", "r0 : unumber<2147483649>"]
 ---
-
 test-case: add immediate to large number range
 
-pre: ["r0 : number<[2147483645, 2147483647]>"]
+pre: ["r0 : snumber<[2147483645, 2147483647]>", "r0 : unumber<[2147483645, 2147483647]>"]
 
 code:
   <start>: |
     r0 += 4 ; make sure value does not become a negative 64 bit number
 
-post: ["r0 : number<[2147483649, 2147483651]>"]
-
+post: ["r0 : snumber<[2147483649, 2147483651]>", "r0 : unumber<[2147483649, 2147483651]>"]
 ---
-
 test-case: add immediate to unknown number
 
-pre: ["r1 : number"]
+pre: ["r1 : snumber", "r1 : unumber"]
 
 code:
   <start>: |
     r1 += 0
 
-post: ["r1 : number"]
-
+post: ["r1 : snumber", "r1 : unumber"]
 ---
-
 test-case: add number register to unknown number
 
-pre: ["r1 : number", "r2 : number"]
+pre: ["r1 : snumber", "r1 : unumber", "r2 : snumber", "r2 : unumber"]
 
 code:
   <start>: |
     r1 += r2
 
-post: ["r1 : number", "r2 : number"]
-
+post: ["r1 : snumber", "r1 : unumber", "r2 : snumber", "r2 : unumber"]
 ---
-
 test-case: add immediate to singleton number
 
-pre: ["r1 : number<5>"]
+pre: ["r1 : snumber<5>", "r1 : unumber<5>"]
 
 code:
   <start>: |
     r1 += 3
 
-post: ["r1 : number<8>"]
-
+post: ["r1 : snumber<8>", "r1 : unumber<8>"]
 ---
-
 test-case: add constant register to singleton number
 
-pre: ["r1 : number<5>", "r2 : number<7>"]
+pre: ["r1 : snumber<5>", "r1 : unumber<5>", "r2 : snumber<7>", "r2 : unumber<7>"]
 
 code:
   <start>: |
     r1 += r2
 
-post: ["r1 : number<12>", "r2 : number<7>"]
+post: ["r1 : snumber<12>", "r1 : unumber<12>", "r2 : snumber<7>", "r2 : unumber<7>"]
 
 ---
-
 test-case: add immediate to finite interval number
 
-pre: ["r1 : number<[5, 10]>"]
+pre: ["r1 : snumber<[5, 10]>", "r1 : unumber<[5, 10]>"]
 
 code:
   <start>: |
     r1 += 5
 
-post: ["r1 : number<[10, 15]>"]
+post: ["r1 : snumber<[10, 15]>", "r1 : unumber<[10, 15]>"]
 
 ---
-
 test-case: add constant register number to finite interval number
 
-pre: ["r1 : number<[5, 10]>", "r2 : number<5>"]
+pre: ["r1 : snumber<[5, 10]>", "r1 : unumber<[5, 10]>", "r2 : snumber<5>", "r2 : unumber<5>"]
 
 code:
   <start>: |
     r1 += r2
 
-post: ["r1 : number<[10, 15]>", "r2 : number<5>"]
+post: ["r1 : snumber<[10, 15]>", "r1 : unumber<[10, 15]>", "r2 : snumber<5>", "r2 : unumber<5>"]
 
 ---
-
 test-case: add interval number register to constant register pointer
 
-pre: ["r2 : packet_p<begin+0>", "r7 : number<[3, 5]>"]
+pre: ["r2 : packet_p<begin>", "r7 : snumber<[3, 5]>", "r7 : unumber<[3, 5]>"]
 
 code:
   <start>: |
     r2 += r7
 
-post: ["r2 : packet_p<begin+[3, 5]>", "r7 : number<[3, 5]>"]
+post: ["r2 : packet_p<begin+[3, 5]>", "r7 : snumber<[3, 5]>", "r7 : unumber<[3, 5]>"]
 
 ---
-
 test-case: add constant register pointer to interval number
 
-pre: ["r2 : packet_p<begin+0>", "r7 : number<[3, 5]>"]
+pre: ["r2 : packet_p<begin>", "r7 : snumber<[3, 5]>", "r7 : unumber<[3, 5]>"]
 
 code:
   <start>: |
     r7 += r2
 
-post: ["r2 : packet_p<begin+0>", "r7 : packet_p<begin+[3, 5]>"]
+post: ["r2 : packet_p<begin>", "r7 : packet_p<begin+[3, 5]>"]

From d0069862b9b8a68f0da244fc0d5a81a7d70e8917 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 13 Nov 2024 18:39:53 -0500
Subject: [PATCH 313/373] Making ebpf_domain_t parametric to abstract_domain_t

write() function in ebpf_domain_t was required to make it parametric to
abstract_domain_t, which was initially removed and caused printing
issues

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp | 13 ++++++-------
 src/crab/abstract_domain.hpp |  6 +++---
 src/crab/ebpf_domain.cpp     | 10 +++++++---
 src/crab/ebpf_domain.hpp     |  3 +++
 4 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 0d8fc6c63..224c41c23 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -172,10 +172,10 @@ void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Assert&
     m_abs_val.operator()(s, loc);
 }
 
-//template <typename Domain>
-//void abstract_domain_t::abstract_domain_model<Domain>::write(std::ostream& os) const {
-//    m_abs_val.write(os);
-//}
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::write(std::ostream& os) const {
+    m_abs_val.write(os);
+}
 
 template <typename Domain>
 crab::bound_t abstract_domain_t::abstract_domain_model<Domain>::get_loop_count_upper_bound() const {
@@ -280,7 +280,7 @@ void abstract_domain_t::operator()(const Assume& s, location_t loc) { m_concept-
 
 void abstract_domain_t::operator()(const Assert& s, location_t loc) { m_concept->operator()(s, loc); }
 
-//void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
+void abstract_domain_t::write(std::ostream& os) const { m_concept->write(os); }
 
 crab::bound_t abstract_domain_t::get_loop_count_upper_bound() const { return m_concept->get_loop_count_upper_bound(); }
 
@@ -293,8 +293,7 @@ void abstract_domain_t::set_require_check(check_require_func_t f) { m_concept->s
 std::vector<std::string> abstract_domain_t::get_errors() { return m_concept->get_errors(); }
 
 std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
-    o << dom.m_concept;
-    //dom.write(o);
+    dom.write(o);
     return o;
 }
 
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index 0f083dc0d..e1e267457 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -43,7 +43,7 @@ class abstract_domain_t {
         virtual void operator()(const Packet&, location_t) = 0;
         virtual void operator()(const Assume&, location_t) = 0;
         virtual void operator()(const Assert&, location_t) = 0;
-        //virtual void write(std::ostream& os) const = 0;
+        virtual void write(std::ostream& os) const = 0;
 
         /* These operations are not very conventional for an abstract
            domain but it's convenient to have them */
@@ -86,7 +86,7 @@ class abstract_domain_t {
         void operator()(const Packet& s, location_t loc = boost::none) override;
         void operator()(const Assume& s, location_t loc = boost::none) override;
         void operator()(const Assert& s, location_t loc = boost::none) override;
-        //void write(std::ostream& os) const override;
+        void write(std::ostream& os) const override;
         void initialize_loop_counter(const label_t) override;
         crab::bound_t get_loop_count_upper_bound() const override;
         string_invariant to_set() override;
@@ -129,7 +129,7 @@ class abstract_domain_t {
     void operator()(const Packet& s, location_t loc = boost::none);
     void operator()(const Assume& s, location_t loc = boost::none);
     void operator()(const Assert& s, location_t loc = boost::none);
-    //void write(std::ostream& os) const;
+    void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t);
     string_invariant to_set();
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index 932b48454..f80ff7a6f 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2849,12 +2849,16 @@ void ebpf_domain_t::operator()(const Bin& bin, location_t loc) {
 
 string_invariant ebpf_domain_t::to_set() const { return this->m_inv.to_set() + this->stack.to_set(); }
 
-std::ostream& operator<<(std::ostream& o, const ebpf_domain_t& dom) {
-    if (dom.is_bottom()) {
+void ebpf_domain_t::write(std::ostream& o) const {
+    if (is_bottom()) {
         o << "_|_";
     } else {
-        o << dom.m_inv << "\nStack: " << dom.stack;
+        o << m_inv << "\nStack: " << stack;
     }
+}
+
+std::ostream& operator<<(std::ostream& o, ebpf_domain_t dom) {
+    dom.write(o);
     return o;
 }
 
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index e13a27272..d490c33fa 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -81,6 +81,9 @@ class ebpf_domain_t final {
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
 
+    // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
+    void write(std::ostream& o) const;
+
     void initialize_loop_counter(const label_t& label);
     static ebpf_domain_t calculate_constant_limits();
 

From e6ea9803a58aab1912a0ebf687072e05811b3d6b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 19 Nov 2024 10:03:46 -0500
Subject: [PATCH 314/373] Updated all benchmarks script

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 scripts/runcheck.sh | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/scripts/runcheck.sh b/scripts/runcheck.sh
index 520d0e4cf..ce00c629b 100755
--- a/scripts/runcheck.sh
+++ b/scripts/runcheck.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 
 ### Update this path to the root of your prevail repository.
-PREVAIL_ROOT=/Users/jorge/Repos/prevail-type-proofs
+PREVAIL_ROOT=$(pwd)
 
 
 EBPF_BENCHMARKS=${PREVAIL_ROOT}/ebpf-samples
 PREVAIL_CHECK=${PREVAIL_ROOT}/check
-DOMAINS="zoneCrab"
+DOMAINS="inference"
 PREFIX=prevail_$(date +"%m%d%y%H%M")
 
 for dom in $DOMAINS
@@ -16,15 +16,17 @@ do
     echo "File,Result,Cpu,Mem"  1>> ${PREFIX}_${dom}.csv
     for f in ${EBPF_BENCHMARKS}/*/*.o
     do
-	sections=($(${PREVAIL_CHECK} $f -l 2> /dev/null))
-	for s in "${sections[@]}"
-	do
-	    echo "${PREVAIL_CHECK} ${f} ${s} --domain=${dom}" >> log_${dom}.txt
-	    echo -n $f:$s 1>> ${PREFIX}_${dom}.csv
-	    o=$(${PREVAIL_CHECK} ${f} ${s} --domain=${dom} 2>>log_${dom}.txt)
-	    echo -n ",$o" 1>> ${PREFIX}_${dom}.csv
-	    echo 1>> ${PREFIX}_${dom}.csv
-	done
+      ${PREVAIL_CHECK} $f -l 2> /dev/null | while read -r s; do
+      if [ -n "$s" ]; then
+        values=$(echo "$s" | awk -F' |=' '{print $2, $4}')
+        read section function <<< "$values"
+        echo "${PREVAIL_CHECK} ${f} ${section} ${function} --domain=${dom}" >> log_${dom}.txt
+        echo -n $f:$section:$function 1>> ${PREFIX}_${dom}.csv
+        o=$(${PREVAIL_CHECK} ${f} ${section} ${function} --domain=${dom} 2>>log_${dom}.txt)
+        echo -n ",$o" 1>> ${PREFIX}_${dom}.csv
+        echo 1>> ${PREFIX}_${dom}.csv
+      fi
+		done
     done
     echo "DONE"
 done

From e65d7ccfbe993204c10985757e22492d7af39f2a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 19 Nov 2024 10:05:11 -0500
Subject: [PATCH 315/373] Added the script to run benchmarks with -v

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 scripts/runcheck2.sh | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100755 scripts/runcheck2.sh

diff --git a/scripts/runcheck2.sh b/scripts/runcheck2.sh
new file mode 100755
index 000000000..3bef039ad
--- /dev/null
+++ b/scripts/runcheck2.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+### Update this path to the root of your prevail repository.
+PREVAIL_ROOT=$(pwd)
+
+
+EBPF_BENCHMARKS=${PREVAIL_ROOT}/ebpf-samples
+PREVAIL_CHECK=${PREVAIL_ROOT}/check
+DOMAINS=$1
+PREFIX=prevail_$(date +"%m%d%y%H%M")
+
+for dom in $DOMAINS
+do
+    rm -f ${PREFIX}_${dom}.txt
+    echo -n "Running Prevail with $dom ... "
+    for f in ${EBPF_BENCHMARKS}/*/*.o
+    do
+		${PREVAIL_CHECK} $f -l 2> /dev/null | while read -r s; do
+    	  if [ -n "$s" ]; then
+    	  values=$(echo "$s" | awk -F' |=' '{print $2, $4}')
+    	  read section function <<< "$values"
+    	  echo "${PREVAIL_CHECK} ${f} ${section} ${function} --domain=${dom} -v" >> ${PREFIX}_${dom}.txt
+		  # echo -n $f:$section:$function 1>> ${PREFIX}_${dom}.txt
+	      echo -n ""
+		  o=$(${PREVAIL_CHECK} ${f}  ${section} ${function} --domain=${dom} -v >>${PREFIX}_${dom}.txt 2>&1)
+		  echo 1>> ${PREFIX}_${dom}.txt
+		  fi
+		done
+	done
+    echo "DONE"
+done

From c049997499332ff88fc735fcd8e903600160bd49 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 19 Nov 2024 10:17:41 -0500
Subject: [PATCH 316/373] Fixes needed after merge, mainly with Bin op

Fixes the currently known issues with Binary operations, however, the
test-cases are currently not working, as there is some discrepency with
storing numeric values in Offset domain (possibly initialization of
data-structures when initializing tests); Benchmarks run fine

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 965 ++++++++++++++++++++---------------
 src/crab/interval_domain.hpp |  57 +++
 src/crab/region_domain.cpp   |   3 -
 3 files changed, 617 insertions(+), 408 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index a7f88cee8..a0a209419 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -218,15 +218,27 @@ interval_domain_t interval_domain_t::setup_entry() {
     return interval;
 }
 
-static void overflow_bounds(interval_t& interval, number_t span, int finite_width,
-        bool issigned) {
+void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, const int finite_width, location_t loc, bool is_signed) {
+    auto mock_interval = is_signed ? m_signed.find_interval_value(lhs) : m_unsigned.find_interval_value(lhs);
+    if (!mock_interval) return;
+    interval_t interval = mock_interval->to_interval();
     if (interval.ub() - interval.lb() >= span) {
         // Interval covers the full space.
-        interval = interval_t::top();
+        // We do not forget the interval, as it will remove the information that it is a number.
+        // We only set the interval to top.
+        if (is_signed) {
+            m_signed.insert_in_registers(lhs, loc, interval_t::top());
+        } else {
+            m_unsigned.insert_in_registers(lhs, loc, interval_t::top());
+        }
         return;
     }
     if (interval.is_bottom()) {
-        interval = interval_t::top();
+        if (is_signed) {
+            m_signed.insert_in_registers(lhs, loc, interval_t::top());
+        } else {
+            m_unsigned.insert_in_registers(lhs, loc, interval_t::top());
+        }
         return;
     }
     number_t lb_value = interval.lb().number().value();
@@ -238,89 +250,416 @@ static void overflow_bounds(interval_t& interval, number_t span, int finite_widt
     // a sign extended negative one.
     number_t lb = lb_value.truncate_to_uint(finite_width);
     number_t ub = ub_value.truncate_to_uint(finite_width);
-    if (issigned) {
+    if (is_signed) {
         lb = lb.truncate_to<int64_t>();
         ub = ub.truncate_to<int64_t>();
     }
+    auto new_interval = interval_t{lb, ub};
     if (lb > ub) {
         // Range wraps in the middle, so we cannot represent as an unsigned interval.
-        interval = interval_t::top();
-        return;
+        new_interval = interval_t::top();
+    }
+    if (is_signed) {
+        m_signed.insert_in_registers(lhs, loc, new_interval);
+    } else {
+        m_unsigned.insert_in_registers(lhs, loc, new_interval);
     }
-    interval = crab::interval_t{lb, ub};
 }
 
-static void overflow_unsigned(interval_t& interval, int finite_width) {
-    auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
-        : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(interval, span, finite_width, false);
+void interval_domain_t::overflow(const register_t& lhs, const int finite_width, location_t loc, bool is_signed) {
+    const auto span{finite_width == 64   ? number_t{std::numeric_limits<uint64_t>::max()}
+                    : finite_width == 32 ? number_t{std::numeric_limits<uint32_t>::max()}
+                                         : throw std::exception()};
+    overflow_bounds(lhs, span, finite_width, loc, is_signed);
 }
 
-static void overflow_signed(interval_t& interval, int finite_width) {
-    auto span{finite_width == 64   ? number_t{std::numeric_limits<int64_t>::max()}
-        : finite_width == 32 ? number_t{std::numeric_limits<int32_t>::max()}
-                                   : throw std::exception()};
-    overflow_bounds(interval, span, finite_width, true);
+// As defined in the BPF ISA specification, the immediate value of an unsigned modulo and division is treated
+// differently depending on the width:
+// * for 32 bit, as a 32-bit unsigned integer
+// * for 64 bit, as a 32-bit (not 64 bit) signed integer
+static number_t read_imm_for_udiv_or_umod(const number_t& imm, const int width) {
+    assert(width == 32 || width == 64);
+    if (width == 32) {
+        return number_t{imm.cast_to<uint32_t>()};
+    }
+    return number_t{imm.cast_to<int32_t>()};
+}
+
+// As defined in the BPF ISA specification, the immediate value of a signed modulo and division is treated
+// differently depending on the width:
+// * for 32 bit, as a 32-bit signed integer
+// * for 64 bit, as a 64-bit signed integer
+static number_t read_imm_for_sdiv_or_smod(const number_t& imm, const int width) {
+    assert(width == 32 || width == 64);
+    if (width == 32) {
+        return number_t{imm.cast_to<int32_t>()};
+    }
+    return number_t{imm.cast_to<int64_t>()};
 }
 
-enum class arithm_binop_t { ADD, SUB, MUL, SDIV, UDIV, SREM, UREM };
-//enum class bitwise_binop_t { AND, OR, XOR, SHL, LSHR, ASHR };
-//using binop_t = std::variant<arith_binop_t, bitwise_binop_t>;
 
-static void apply_signed(interval_t& dst_signed, interval_t& dst_unsigned, const interval_t& lhs, const interval_t& rhs, int finite_width, arithm_binop_t op) {
+void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, const register_t& y, const register_t& z, const int finite_width, location_t loc, bool is_signed) {
+    // performing arithmatic operation
+    interval_t xi = interval_t::bottom();
+    interval_t yi = interval_t::bottom();
+    interval_t zi = interval_t::bottom();
+    if (is_signed) {
+        auto yi_opt = m_signed.find_interval_value(y);
+        auto zi_opt = m_signed.find_interval_value(z);
+        if (!yi_opt || !zi_opt) {
+            std::cerr << "Error: registers not found in the interval environment\n";
+            return;
+        }
+        yi = yi_opt->to_interval();
+        zi = zi_opt->to_interval();
+    } else {
+        auto yi_opt = m_unsigned.find_interval_value(y);
+        auto zi_opt = m_unsigned.find_interval_value(z);
+        if (!yi_opt || !zi_opt) {
+            std::cerr << "Error: registers not found in the interval environment\n";
+            return;
+        }
+        yi = yi_opt->to_interval();
+        zi = zi_opt->to_interval();
+    }
+
     switch (op) {
-        case arithm_binop_t::ADD: {
-            dst_signed = lhs + rhs;
+        case arith_binaryop_t::ADD: xi = yi + zi; break;
+        case arith_binaryop_t::SUB: xi = yi - zi; break;
+        case arith_binaryop_t::MUL: xi = yi * zi; break;
+        case arith_binaryop_t::SDIV: xi = yi.SDiv(zi); break;
+        case arith_binaryop_t::UDIV: {
+            // this hack is required because UDiv call returns [+oo, +oo], at least in case when 
+            // updated_interval is top,
+            // which causes the error: CRAB ERROR: Bound: undefined operation -oo + +oo
+            // SplitDBM (possibly) uses a normalize() to avoid this issue,
+            // but we don't have that here
+            // TODO: fix this
+            if (yi.is_top()) {
+                if (is_signed) {
+                    m_signed -= x;
+                } else {
+                    m_unsigned -= x;
+                }
+                return;
+            }
+            xi = yi.UDiv(zi);
             break;
         }
-        case arithm_binop_t::SUB: {
-            dst_signed = lhs - rhs;
-            break;
+        case arith_binaryop_t::SREM: xi = yi.SRem(zi); break;
+        case arith_binaryop_t::UREM: xi = yi.URem(zi); break;
+        default: break;
+    }
+    if (is_signed) {
+        m_signed.insert_in_registers(x, loc, xi);
+    } else {
+        m_unsigned.insert_in_registers(x, loc, xi);
+    }
+}
+
+
+void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, const register_t& y, const number_t& k, const int finite_width, location_t loc, bool is_signed) {
+    // performing arithmatic operation
+    interval_t xi = interval_t::bottom();
+    interval_t yi = interval_t::bottom();
+    if (is_signed) {
+        auto yi_opt = m_signed.find_interval_value(y);
+        if (!yi_opt) {
+            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            return;
         }
-        case arithm_binop_t::MUL: {
-            dst_signed = lhs * rhs;
-            break;
+        yi = yi_opt->to_interval();
+    } else {
+        auto yi_opt = m_unsigned.find_interval_value(y);
+        if (!yi_opt) {
+            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            return;
         }
-        default: {
-            break;
+        yi = yi_opt->to_interval();
+    }
+
+    switch (op) {
+        case arith_binaryop_t::ADD: xi = yi + interval_t{k}; break;
+        case arith_binaryop_t::SUB: xi = yi - interval_t{k}; break;
+        case arith_binaryop_t::MUL: xi = yi * interval_t{k}; break;
+        case arith_binaryop_t::SDIV: xi = yi.SDiv(interval_t{read_imm_for_sdiv_or_smod(k, finite_width)}); break;
+        case arith_binaryop_t::UDIV: xi = yi.UDiv(interval_t{read_imm_for_udiv_or_umod(k, finite_width)}); break;
+        case arith_binaryop_t::SREM: xi = yi.SRem(interval_t{read_imm_for_sdiv_or_smod(k, finite_width)}); break;
+        case arith_binaryop_t::UREM: xi = yi.URem(interval_t{read_imm_for_udiv_or_umod(k, finite_width)}); break;
+        default: break;
+    }
+    if (is_signed) {
+        m_signed.insert_in_registers(x, loc, xi);
+    } else {
+        m_unsigned.insert_in_registers(x, loc, xi);
+    }
+}
+
+
+void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x, const register_t& y, const number_t& k, const int finite_width, location_t loc, bool is_signed) {
+    // performing bitwise operation 
+    interval_t xi = interval_t::bottom();
+    interval_t yi = interval_t::bottom();
+    if (is_signed) {
+        auto yi_opt = m_signed.find_interval_value(y);
+        if (!yi_opt) {
+            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            return;
         }
+        yi = yi_opt->to_interval();
+    } else {
+        auto yi_opt = m_unsigned.find_interval_value(y);
+        if (!yi_opt) {
+            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            return;
+        }
+        yi = yi_opt->to_interval();
     }
-    if (finite_width) {
-        dst_unsigned = dst_signed;
-        overflow_signed(dst_signed, finite_width);
-        overflow_unsigned(dst_unsigned, finite_width);
+    interval_t zi{number_t{k.cast_to<uint64_t>()}};
+
+    switch (op) {
+        case bitwise_binaryop_t::AND: xi = yi.And(zi); break;
+        case bitwise_binaryop_t::OR: xi = yi.Or(zi); break;
+        case bitwise_binaryop_t::XOR: xi = yi.Xor(zi); break;
+        case bitwise_binaryop_t::SHL: xi = yi.Shl(zi); break;
+        case bitwise_binaryop_t::LSHR: xi = yi.LShr(zi); break;
+        case bitwise_binaryop_t::ASHR: xi = yi.AShr(zi); break;
+        default: break;
+    }
+    if (is_signed) {
+        m_signed.insert_in_registers(x, loc, xi);
+    } else {
+        m_unsigned.insert_in_registers(x, loc, xi);
     }
 }
 
-void interval_domain_t::operator()(const Un& u, location_t loc) {
-    if (u.op == Un::Op::NEG) {
-        auto dst = register_t{u.dst.v};
-        auto signed_mock_interval = find_signed_interval_value(dst);
-        auto unsigned_mock_interval = find_unsigned_interval_value(dst);
-        if (!signed_mock_interval && !unsigned_mock_interval) {
-            m_signed -= dst;
-            m_unsigned -= dst;
+
+void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x, const register_t& y, const register_t& z, const int finite_width, location_t loc, bool is_signed) {
+    // performing bitwise operation
+    interval_t xi = interval_t::bottom();
+    interval_t yi = interval_t::bottom();
+    interval_t zi = interval_t::bottom();
+    if (is_signed) {
+        auto yi_opt = m_signed.find_interval_value(y);
+        auto zi_opt = m_signed.find_interval_value(z);
+        if (!yi_opt || !zi_opt) {
+            std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        interval_t minus_one = interval_t{number_t{-1}};
-        interval_t signed_interval = signed_mock_interval ? signed_mock_interval->to_interval() : interval_t::top();
-        interval_t unsigned_interval = unsigned_mock_interval ? unsigned_mock_interval->to_interval() : interval_t::top();
-        // TODO: this is a temporary fix, need to handle this better
-        // scenario: when either signed or unsigned is not present, but the other is
-        if (!signed_mock_interval) {
-            signed_interval = unsigned_interval;
+        yi = yi_opt->to_interval();
+        zi = zi_opt->to_interval();
+    } else {
+        auto yi_opt = m_unsigned.find_interval_value(y);
+        auto zi_opt = m_unsigned.find_interval_value(z);
+        if (!yi_opt || !zi_opt) {
+            std::cerr << "Error: registers not found in the interval environment\n";
+            return;
         }
-        else if (!unsigned_mock_interval) {
-            unsigned_interval = signed_interval;
+        yi = yi_opt->to_interval();
+        zi = zi_opt->to_interval();
+    }
+
+    switch (op) {
+        case bitwise_binaryop_t::AND: xi = yi.And(zi); break;
+        case bitwise_binaryop_t::OR: xi = yi.Or(zi); break;
+        case bitwise_binaryop_t::XOR: xi = yi.Xor(zi); break;
+        case bitwise_binaryop_t::SHL: xi = yi.Shl(zi); break;
+        case bitwise_binaryop_t::LSHR: xi = yi.LShr(zi); break;
+        case bitwise_binaryop_t::ASHR: xi = yi.AShr(zi); break;
+        default: break;
+    }
+    if (is_signed) {
+        m_signed.insert_in_registers(x, loc, xi);
+    } else {
+        m_unsigned.insert_in_registers(x, loc, xi);
+    }
+}
+
+
+void interval_domain_t::apply_signed(const binaryop_t& op, const register_t& result, const register_t& lhs, const number_t& k_rhs, const int finite_width, location_t loc) {
+    apply(op, result, lhs, k_rhs, finite_width, loc, true);
+    if (finite_width) {
+        auto signed_result = m_signed.find_interval_value(result);
+        if (signed_result) {
+            auto signed_interval = signed_result->to_interval();
+            m_unsigned.insert_in_registers(result, loc, signed_interval);
+        }
+        overflow(result, finite_width, loc, true);
+        overflow(result, finite_width, loc, false);
+    }
+}
+
+void interval_domain_t::apply_signed(const binaryop_t& op, const register_t& result, const register_t& lhs, const register_t& rhs, const int finite_width, location_t loc) {
+    apply(op, result, lhs, rhs, finite_width, loc, true);
+    if (finite_width) {
+        auto signed_result = m_signed.find_interval_value(result);
+        if (signed_result) {
+            auto signed_interval = signed_result->to_interval();
+            m_unsigned.insert_in_registers(result, loc, signed_interval);
         }
-        apply_signed(signed_interval, unsigned_interval, signed_interval, minus_one, u.is64 ? 64 : 32, arithm_binop_t::MUL);
-        if (signed_mock_interval) {
-            insert_in_registers_signed(dst, loc, signed_interval);
+        overflow(result, finite_width, loc, true);
+        overflow(result, finite_width, loc, false);
+    }
+}
+
+void interval_domain_t::apply_unsigned(const binaryop_t& op, const register_t& result, const register_t& lhs, const number_t& k_rhs, const int finite_width, location_t loc) {
+    apply(op, result, lhs, k_rhs, finite_width, loc, false);
+    if (finite_width) {
+        auto unsigned_result = m_unsigned.find_interval_value(result);
+        if (unsigned_result) {
+            auto unsigned_interval = unsigned_result->to_interval();
+            m_signed.insert_in_registers(result, loc, unsigned_interval);
         }
-        if (unsigned_mock_interval) {
-            insert_in_registers_unsigned(dst, loc, unsigned_interval);
+        overflow(result, finite_width, loc, true);
+        overflow(result, finite_width, loc, false);
+    }
+}
+
+void interval_domain_t::apply_unsigned(const binaryop_t& op, const register_t& result, const register_t& lhs, const register_t& rhs, const int finite_width, location_t loc) {
+    apply(op, result, lhs, rhs, finite_width, loc, false);
+    if (finite_width) {
+        auto unsigned_result = m_unsigned.find_interval_value(result);
+        if (unsigned_result) {
+            auto unsigned_interval = unsigned_result->to_interval();
+            m_signed.insert_in_registers(result, loc, unsigned_interval);
         }
+        overflow(result, finite_width, loc, true);
+        overflow(result, finite_width, loc, false);
+    }
+}
+
+void interval_domain_t::add(const register_t& lhs, const register_t& op2, location_t loc) {
+    apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, 0, loc);
+}
+
+void interval_domain_t::add(const register_t& lhs, const number_t& op2, location_t loc) {
+    apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, 0, loc);
+}
+
+void interval_domain_t::sub(const register_t& lhs, const register_t& op2, location_t loc) {
+    apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, 0, loc);
+}
+
+void interval_domain_t::sub(const register_t& lhs, const number_t& op2, location_t loc) {
+    apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, 0, loc);
+}
+
+// Add/subtract with overflow are both signed and unsigned. We can use either one of the two to compute the
+// result before adjusting for overflow, though if one is top we want to use the other to retain precision.
+void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+        apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
+    } else {
+        apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
+    }
+}
+
+void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+        apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
+    } else {
+        apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
+    }
+}
+
+void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+        apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
+    } else {
+        apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
+    }
+}
+
+void interval_domain_t::sub_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+        apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
+    } else {
+        apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
+    }
+}
+
+void interval_domain_t::neg(const register_t& lhs, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::MUL, lhs, lhs, number_t{-1}, finite_width, loc);
+}
+
+void interval_domain_t::mul(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::MUL, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::mul(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::MUL, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::udiv(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(arith_binaryop_t::UDIV, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::udiv(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(arith_binaryop_t::UDIV, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::sdiv(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::SDIV, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::sdiv(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::SDIV, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::srem(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::SREM, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::srem(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    apply_signed(arith_binaryop_t::SREM, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::urem(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(arith_binaryop_t::UREM, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::urem(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(arith_binaryop_t::UREM, lhs, lhs, op2, finite_width, loc);
+}
+
+
+void interval_domain_t::bitwise_and(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::AND, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::bitwise_and(const register_t& lhs, const number_t& op2, location_t loc) {
+    // Use finite width 64 to make the svalue be set as well as the uvalue.
+    apply_unsigned(bitwise_binaryop_t::AND, lhs, lhs, op2, 64, loc);
+}
+
+void interval_domain_t::bitwise_or(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::OR, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::bitwise_or(const register_t& lhs, const number_t& op2, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::OR, lhs, lhs, op2, 64, loc);
+}
+
+void interval_domain_t::bitwise_xor(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::XOR, lhs, lhs, op2, finite_width, loc);
+}
+
+void interval_domain_t::bitwise_xor(const register_t& lhs, const number_t& op2, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::XOR, lhs, lhs, op2, 64, loc);
+}
+
+void interval_domain_t::shl_overflow(const register_t& lhs, const register_t& op2, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::SHL, lhs, lhs, op2, 64, loc);
+}
+
+void interval_domain_t::shl_overflow(const register_t& lhs, const number_t& op2, location_t loc) {
+    apply_unsigned(bitwise_binaryop_t::SHL, lhs, lhs, op2, 64, loc);
+}
+
+void interval_domain_t::operator()(const Un& u, location_t loc) {
+    if (u.op == Un::Op::NEG) {
+        auto dst = register_t{u.dst.v};
+        neg(dst, u.is64 ? 64 : 32, loc);
         return;
     }
     m_signed(u, loc);
@@ -1102,166 +1441,79 @@ void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& in
     m_signed.check_valid_access(s, std::move(interval), width, check_stack_all_numeric);
 }
 
-static void apply_unsigned(interval_t& dst_signed, interval_t& dst_unsigned,
-        const interval_t& src, int finite_width, const interval_t& updated_interval, Bin::Op op) {
-    switch (op) {
-        case Bin::Op::UDIV: {
-            // this hack is required because UDiv call returns [+oo, +oo], at least in case when 
-            // updated_interval is top,
-            // which causes the error: CRAB ERROR: Bound: undefined operation -oo + +oo
-            // SplitDBM (possibly) uses a normalize() to avoid this issue,
-            // but we don't have that here
-            // TODO: fix this
-            if (updated_interval.is_top()) {
-                dst_unsigned = interval_t::top();
-                dst_signed = interval_t::top();
-                return;
-            }
-            dst_unsigned = updated_interval.UDiv(src);
-            break;
-        }
-        case Bin::Op::UMOD: {
-            dst_unsigned = updated_interval.URem(src);
-            break;
-        }
-        case Bin::Op::AND: {
-            dst_unsigned = updated_interval.And(src);
-            break;
-        }
-        case Bin::Op::OR: {
-            dst_unsigned = updated_interval.Or(src);
-            break;
-        }
-        case Bin::Op::XOR: {
-            dst_unsigned = updated_interval.Xor(src);
-            break;
-        }
-        case Bin::Op::LSH: {
-            dst_unsigned = updated_interval.Shl(src);
-            break;
-        }
-        case Bin::Op::RSH: {
-            dst_unsigned = updated_interval.LShr(src);
-            break;
-        }
-        case Bin::Op::ARSH: {
-            dst_unsigned = updated_interval.AShr(src);
-            break;
-        }
-        default: {
-            break;
-        }
-    }
-    if (finite_width) {
-        dst_signed = dst_unsigned;
-        overflow_unsigned(dst_unsigned, finite_width);
-        overflow_signed(dst_signed, finite_width);
-    }
-}
 
-static void shl(register_t reg, int imm, int finite_width,
-        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
+void interval_domain_t::shl(const register_t& reg, int imm, const int finite_width, location_t loc) {
     // The BPF ISA requires masking the imm.
     imm &= finite_width - 1;
 
-    if (dst_unsigned.finite_size()) {
-        number_t lb = dst_unsigned.lb().number().value();
-        number_t ub = dst_unsigned.ub().number().value();
-        uint64_t lb_n = lb.cast_to_uint(64).cast_to<uint>();
-        uint64_t ub_n = ub.cast_to_uint(64).cast_to<uint>();
-        uint64_t uint_max = (finite_width == 64) ? UINT64_MAX : UINT32_MAX;
-        if ((lb_n >> (finite_width - imm)) != (ub_n >> (finite_width - imm))) {
-            // The bits that will be shifted out to the left are different,
-            // which means all combinations of remaining bits are possible.
-            lb_n = 0;
-            ub_n = (uint_max << imm) & uint_max;
-        } else {
-            // The bits that will be shifted out to the left are identical
-            // for all values in the interval, so we can safely shift left
-            // to get a new interval.
-            lb_n = (lb_n << imm) & uint_max;
-            ub_n = (ub_n << imm) & uint_max;
-        }
-        dst_unsigned = interval_t{number_t{lb_n}, number_t{ub_n}};
-        dst_signed = interval_t::top();
-        if ((int64_t)ub_n >= (int64_t)lb_n) {
-            dst_signed = dst_unsigned;
+    if (auto interval_opt = find_unsigned_interval_value(reg)) {
+        interval_t interval = interval_opt->to_interval();
+        if (interval.finite_size()) {
+            const number_t lb = interval.lb().number().value();
+            const number_t ub = interval.ub().number().value();
+            uint64_t lb_n = lb.cast_to<uint64_t>();
+            uint64_t ub_n = ub.cast_to<uint64_t>();
+            uint64_t uint_max = (finite_width == 64) ? uint64_t{std::numeric_limits<uint64_t>::max()} :
+                    uint64_t{std::numeric_limits<uint32_t>::max()};
+            if (lb_n >> (finite_width - imm) != ub_n >> (finite_width - imm)) {
+                // The bits that will be shifted out to the left are different,
+                // which means all combinations of remaining bits are possible.
+                lb_n = 0;
+                ub_n = uint_max << imm & uint_max;
+            } else {
+                // The bits that will be shifted out to the left are identical
+                // for all values in the interval, so we can safely shift left
+                // to get a new interval.
+                lb_n = lb_n << imm & uint_max;
+                ub_n = ub_n << imm & uint_max;
+            }
+            insert_in_registers_unsigned(reg, loc, interval_t{lb_n, ub_n});
+            if (to_signed(ub_n) >= to_signed(lb_n)) {
+                insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
+            } else {
+                insert_in_registers_signed(reg, loc, interval_t::top());
+            }
+            return;
         }
-        return;
     }
-    apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{imm}}, 64,
-            dst_unsigned, Bin::Op::LSH);
+    shl_overflow(reg, number_t{imm}, loc);
 }
 
-static void lshr(register_t reg, int imm, int finite_width,
-        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
+void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_width, location_t loc) {
     // The BPF ISA requires masking the imm.
     imm &= finite_width - 1;
 
-    number_t lb_n{0};
-    number_t ub_n{UINT64_MAX >> imm};
-    if (dst_unsigned.finite_size()) {
-        number_t lb = dst_unsigned.lb().number().value();
-        number_t ub = dst_unsigned.ub().number().value();
-        if (finite_width == 64) {
-            lb_n = lb.cast_to_uint(64) >> imm;
-            ub_n = ub.cast_to_uint(64) >> imm;
-        } else {
-            number_t lb_w = lb.cast_to_sint(finite_width);
-            number_t ub_w = ub.cast_to_sint(finite_width);
-            lb_n = lb_w.cast_to_uint(32) >> imm;
-            ub_n = ub_w.cast_to_uint(32) >> imm;
-
-            // The interval must be valid since a signed range crossing 0
-            // was earlier converted to a full unsigned range.
-            assert(lb_n <= ub_n);
-        }
-    }
-    dst_unsigned = interval_t{lb_n, ub_n};
-    if (ub_n.cast_to<int64_t>() >= lb_n.cast_to<int64_t>()) {
-        dst_signed = dst_unsigned;
-    } else {
-        dst_signed = interval_t::top();
-    }
-    return;
-}
-
-static void ashr(register_t reg, interval_t src, int finite_width,
-        interval_t& dst_signed, interval_t& dst_unsigned, location_t loc) {
-    interval_t left_interval = interval_t::bottom();
-    interval_t right_interval = interval_t::bottom();
-    get_signed_intervals(finite_width == 64, dst_signed, dst_unsigned,
-            src, left_interval, right_interval);
-    if (auto sn = right_interval.singleton()) {
-        // The BPF ISA requires masking the imm.
-        int64_t imm = sn->cast_to_sint(64).cast_to<int64_t>() & (finite_width - 1);
-
-        int64_t lb_n = INT64_MIN >> imm;
-        int64_t ub_n = INT64_MAX >> imm;
-        if (left_interval.finite_size()) {
-            number_t lb = left_interval.lb().number().value();
-            number_t ub = left_interval.ub().number().value();
+    if (auto interval_opt = find_unsigned_interval_value(reg)) {
+        interval_t interval = interval_opt->to_interval();
+        number_t lb_n{0};
+        number_t ub_n{std::numeric_limits<uint64_t>::max() >> imm};
+        if (interval.finite_size()) {
+            number_t lb = interval.lb().number().value();
+            number_t ub = interval.ub().number().value();
             if (finite_width == 64) {
-                lb_n = lb.cast_to_sint(64).cast_to<int>() >> imm;
-                ub_n = ub.cast_to_sint(64).cast_to<int>() >> imm;
+                lb_n = lb.cast_to<uint64_t>() >> imm;
+                ub_n = ub.cast_to<uint64_t>() >> imm;
             } else {
-                number_t lb_w = lb.cast_to_sint(finite_width) >> (int)imm;
-                number_t ub_w = ub.cast_to_sint(finite_width) >> (int)imm;
-                if (lb_w.cast_to_uint(32) <= ub_w.cast_to_uint(32)) {
-                    lb_n = lb_w.cast_to_uint(32).cast_to<int>();
-                    ub_n = ub_w.cast_to_uint(32).cast_to<int>();
-                }
+                number_t lb_w = lb.cast_to_sint(finite_width);
+                number_t ub_w = ub.cast_to_sint(finite_width);
+                lb_n = lb_w.cast_to<uint32_t>() >> imm;
+                ub_n = ub_w.cast_to<uint32_t>() >> imm;
+
+                // The interval must be valid since a signed range crossing 0
+                // was earlier converted to a full unsigned range.
+                assert(lb_n <= ub_n);
             }
         }
-        dst_signed = interval_t{number_t{lb_n}, number_t{ub_n}};
-        dst_unsigned = interval_t::top();
-        if ((uint64_t)ub_n >= (uint64_t)lb_n) {
-            dst_unsigned = dst_signed;
+        insert_in_registers_unsigned(reg, loc, interval_t{lb_n, ub_n});
+        if (ub_n.narrow<int64_t>() >= lb_n.narrow<int64_t>()) {
+            insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
+        } else {
+            insert_in_registers_signed(reg, loc, interval_t::top());
         }
         return;
     }
-    dst_signed = interval_t::top();
-    dst_unsigned = interval_t::top();
+    insert_in_registers_unsigned(reg, loc, interval_t::top());
+    insert_in_registers_signed(reg, loc, interval_t::top());
 }
 
 void interval_domain_t::do_bin(const Bin& bin,
@@ -1278,9 +1530,9 @@ void interval_domain_t::do_bin(const Bin& bin,
     auto dst_register = register_t{bin.dst.v};
     auto finite_width = (bin.is64 ? 64 : 32);
 
-    interval_t dst_signed = subtracted;
-    interval_t dst_unsigned = subtracted;
     if (subtracted != interval_t::bottom()) {
+        interval_t dst_signed = subtracted;
+        interval_t dst_unsigned = subtracted;
         if (!(dst_signed <= interval_t::signed_int(64))) {
             dst_signed = dst_signed.truncate_to_sint(64);
         }
@@ -1291,47 +1543,40 @@ void interval_domain_t::do_bin(const Bin& bin,
         insert_in_registers_unsigned(dst_register, loc, dst_unsigned);
         return;
     }
-    if (dst_signed_interval_opt) dst_signed = std::move(*dst_signed_interval_opt);
-    if (dst_unsigned_interval_opt) dst_unsigned = std::move(*dst_unsigned_interval_opt);
 
-    if (std::holds_alternative<Imm>(bin.v)) {
+    if ((!dst_signed_interval_opt && !dst_unsigned_interval_opt) && bin.op != Op::MOV) {
+        operator-=(dst_register);
+        return;
+    }
+
+    if (auto pimm = std::get_if<Imm>(&bin.v)) {
         int64_t imm;
         if (bin.is64) {
             // Use the full signed value.
-            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+            imm = to_signed(pimm->v);
         } else {
             // Use only the low 32 bits of the value.
-            imm = static_cast<int>(std::get<Imm>(bin.v).v);
-            if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{UINT32_MAX}},
-                        64, dst_unsigned, Op::AND);
-            }
+            imm = gsl::narrow_cast<int32_t>(pimm->v);
+            bitwise_and(dst_register, number_t{std::numeric_limits<uint32_t>::max()}, loc);
         }
-        auto imm_number = number_t{imm};
-        auto imm_interval = interval_t{imm_number};
-        auto imm_unsigned_interval = interval_t{number_t{imm_number.cast_to_uint(64)}};
-        auto imm_int_interval = interval_t{number_t{(int)imm}};
+        auto imm_interval = interval_t{number_t{imm}};
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm
-                dst_signed = imm_interval;
-                overflow_unsigned(imm_interval, (bin.is64 ? 64 : 32));
-                dst_unsigned = imm_interval;
+                m_signed.insert_in_registers(dst_register, loc, imm_interval);
+                m_unsigned.insert_in_registers(dst_register, loc, imm_interval);
+                overflow(dst_register, finite_width, loc, false);
                 break;
             }
+            case Op::MOVSX8:
+            case Op::MOVSX16:
+            case Op::MOVSX32: m_errors.push_back("MOVSX not implemented"); break;
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) {
                     return;
                 }
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, interval, imm_int_interval, finite_width,
-                             arithm_binop_t::ADD);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                add_overflow(dst_register, number_t{gsl::narrow<int>(imm)}, finite_width, loc);
                 break;
             }
             case Op::SUB: {
@@ -1339,119 +1584,74 @@ void interval_domain_t::do_bin(const Bin& bin,
                 if (imm == 0) {
                     return;
                 }
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, interval, imm_int_interval, finite_width,
-                            arithm_binop_t::SUB);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                add_overflow(dst_register, number_t{gsl::narrow<int>(-imm)}, finite_width, loc);
                 break;
             }
             case Op::MUL: {
                 // ra *= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_signed(dst_signed, dst_unsigned, dst_signed, imm_interval, finite_width,
-                            arithm_binop_t::MUL);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                mul(dst_register, number_t{imm}, finite_width, loc);
                 break;
             }
             case Op::UDIV: {
                 // ra /= imm
-                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, imm_interval, finite_width,
-                            dst_unsigned, Op::UDIV);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                udiv(dst_register, number_t{imm}, finite_width, loc);
+                break;
+            }
+            case Op::SDIV: {
+                // ra s/= imm
+                sdiv(dst_register, number_t{imm}, finite_width, loc);
                 break;
             }
             case Op::UMOD: {
                 // ra %= imm
-                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, imm_interval, finite_width,
-                            dst_unsigned, Op::UMOD);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                urem(dst_register, number_t{imm}, finite_width, loc);
+                break;
+            }
+            case Op::SMOD: {
+                // ra s%= imm
+                srem(dst_register, number_t{imm}, finite_width, loc);
                 break;
             }
             case Op::AND: {
                 // ra &= imm
-                // might or might not be needed, but some case occurred where left was negative
-                dst_unsigned = dst_unsigned.truncate_to_uint(finite_width);
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
-                            dst_unsigned, Op::AND);
-                    if ((int32_t)imm > 0) {
-                        // AND with immediate is only a 32-bit operation so svalue and uvalue
-                        // are the same.
-                        dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
-                        dst_unsigned = dst_unsigned & interval_t{number_t{0}, number_t{imm}};
-                    }
-                }
-                else {
-                    operator-=(dst_register);
+                bitwise_and(dst_register, number_t{imm}, loc);
+                if (gsl::narrow<int32_t>(imm) > 0) {
+                    // AND with immediate is only a 32-bit operation so svalue and uvalue
+                    // are the same.
+                    auto dst_signed = m_signed.find_interval_value(dst_register)->to_interval();
+                    auto lb = dst_signed.lb().number().value();
+                    auto ub = dst_signed.ub().number().value();
+                    dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
+                    m_signed.insert_in_registers(dst_register, loc, dst_signed);
+                    m_unsigned.insert_in_registers(dst_register, loc, dst_signed);
                 }
                 break;
             }
             case Op::OR: {
                 // ra |= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
-                            dst_unsigned, Op::OR);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                bitwise_or(dst_register, number_t{imm}, loc);
                 break;
             }
             case Op::XOR: {
                 // ra ^= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, imm_unsigned_interval, finite_width,
-                            dst_unsigned, Op::XOR);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                bitwise_xor(dst_register, number_t{imm}, loc);
                 break;
             }
             case Op::LSH: {
                 // ra <<= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    shl(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                shl(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
                 break;
             }
             case Op::RSH: {
                 // ra >>= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    lshr(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                lshr(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
                 break;
             }
             case Op::ARSH: {
                 // ra >>>= imm
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    ashr(dst_register, interval_t{number_t{(int32_t)imm}}, finite_width,
-                            dst_signed, dst_unsigned, loc);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                //ashr(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
+                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
+                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
                 break;
             }
             default: {
@@ -1460,166 +1660,129 @@ void interval_domain_t::do_bin(const Bin& bin,
         }
     }
     else {
-        if (!src_signed_interval_opt || !src_unsigned_interval_opt) {
+        if (!src_signed_interval_opt && !src_unsigned_interval_opt) {
             operator-=(dst_register);
             return;
         }
-        interval_t src_signed = *src_signed_interval_opt;
-        interval_t src_unsigned = *src_unsigned_interval_opt;
+        register_t src_register = register_t{std::get<Reg>(bin.v).v};
         switch (bin.op) {
+            case Op::MOVSX8:
+            case Op::MOVSX16:
+            case Op::MOVSX32:
+                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
+                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
+                break;
             case Op::MOV: {
                 // ra = rb
-                dst_signed = src_signed;
-                dst_unsigned = src_unsigned;
+                auto src_signed = m_signed.find_interval_value(src_register)->to_interval();
+                auto src_unsigned = m_unsigned.find_interval_value(src_register)->to_interval();
+                m_signed.insert_in_registers(dst_register, loc, src_signed);
+                m_unsigned.insert_in_registers(dst_register, loc, src_unsigned);
                 break;
             }
             case Op::ADD: {
                 // ra += rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, interval, src_signed, finite_width,
-                            arithm_binop_t::ADD);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                add_overflow(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::SUB: {
                 // ra -= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    auto interval = dst_signed.is_top() ? dst_unsigned : dst_signed;
-                    apply_signed(dst_signed, dst_unsigned, interval, src_signed, finite_width,
-                            arithm_binop_t::SUB);
-                }
-                else {
-                    operator-=(dst_register);
+                if (src_register == dst_register) {
+                    // an extra check only to pass a test
+                    m_signed.insert_in_registers(dst_register, loc, interval_t{number_t{0}});
+                    m_unsigned.insert_in_registers(dst_register, loc, interval_t{number_t{0}});
+                    break;
                 }
+                apply_signed(arith_binaryop_t::SUB, dst_register, dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::MUL: {
                 // ra *= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_signed(dst_signed, dst_unsigned, dst_signed, src_signed, finite_width,
-                            arithm_binop_t::MUL);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                mul(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::UDIV: {
                 // ra /= rb
-                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
-                            dst_unsigned, Op::UDIV);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                udiv(dst_register, src_register, finite_width, loc);
+                break;
+            }
+            case Op::SDIV: {
+                // ra s/= rb
+                sdiv(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::UMOD: {
                 // ra %= rb
-                if (dst_unsigned_interval_opt && dst_signed_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
-                            dst_unsigned, Op::UMOD);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                urem(dst_register, src_register, finite_width, loc);
+                break;
+            }
+            case Op::SMOD: {
+                // ra s%= rb
+                srem(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::AND: {
                 // ra &= rb
-                // might or might not be needed
-                dst_unsigned = dst_unsigned.truncate_to_uint(finite_width);
-                src_unsigned = src_unsigned.truncate_to_uint(finite_width);
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
-                            dst_unsigned, Op::AND);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                bitwise_and(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::OR: {
                 // ra |= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
-                            dst_unsigned, Op::OR);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                bitwise_or(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::XOR: {
                 // ra ^= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, finite_width,
-                            dst_unsigned, Op::XOR);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                bitwise_xor(dst_register, src_register, finite_width, loc);
                 break;
             }
             case Op::LSH: {
                 // ra <<= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
+                    auto src_unsigned = src_unsigned_interval_opt->to_interval();
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
-                        uint64_t imm = sn->cast_to_uint(64).cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
-                        if (imm <= INT32_MAX) {
+                        uint64_t imm = sn->cast_to<int32_t>() & (bin.is64 ? 63 : 31);
+                        if (imm <= std::numeric_limits<int32_t>::max()) {
                             if (!bin.is64) {
                                 // Use only the low 32 bits of the value.
-                                dst_signed = dst_signed & interval_t{number_t{UINT32_MAX}};
-                                dst_unsigned = dst_unsigned & interval_t{number_t{UINT32_MAX}};
+                                bitwise_and(dst_register, std::numeric_limits<uint32_t>::max(), loc);
                             }
-                            shl(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                            shl(dst_register, gsl::narrow_cast<int32_t>(imm), finite_width, loc);
                             break;
                         }
                     }
-                    apply_unsigned(dst_signed, dst_unsigned, src_unsigned, 64,
-                            dst_unsigned, Op::LSH);
-                }
-                else {
-                    operator-=(dst_register);
                 }
+                shl_overflow(dst_register, register_t{src_register}, loc);
                 break;
             }
             case Op::RSH: {
                 // ra >>= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
+                if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
+                    auto src_unsigned = src_unsigned_interval_opt->to_interval();
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
-                        uint64_t imm = sn->cast_to_uint(64).cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
-                        if (imm <= INT32_MAX) {
+                        uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
+                        if (imm <= std::numeric_limits<int32_t>::max()) {
                             if (!bin.is64) {
                                 // Use only the low 32 bits of the value.
-                                dst_signed = dst_signed & interval_t{number_t{UINT32_MAX}};
-                                dst_unsigned = dst_unsigned & interval_t{number_t{UINT32_MAX}};
+                                bitwise_and(dst_register, std::numeric_limits<uint32_t>::max(), loc);
                             }
-                            lshr(dst_register, (int32_t)imm, finite_width, dst_signed, dst_unsigned, loc);
+                            lshr(dst_register, gsl::narrow_cast<int32_t>(imm), finite_width, loc);
                             break;
                         }
                     }
-                    dst_signed = interval_t::top();
-                    dst_unsigned = interval_t::top();
-                }
-                else {
-                    operator-=(dst_register);
                 }
+                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
+                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
                 break;
             }
             case Op::ARSH: {
                 // ra >>>= rb
-                if (dst_signed_interval_opt && dst_unsigned_interval_opt) {
-                    ashr(dst_register, src_signed, finite_width, dst_signed, dst_unsigned, loc);
-                }
-                else {
-                    operator-=(dst_register);
-                }
+                //if (auto src_signed_interval_opt = find_signed_interval_value(src_register)) {
+                //    ashr(dst_register, src_register, finite_width, loc);
+                //    break;
+                //}
+                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
+                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
                 break;
             }
             default: {
@@ -1627,16 +1790,8 @@ void interval_domain_t::do_bin(const Bin& bin,
             }
         }
     }
-    if (!dst_signed.is_bottom() && !dst_unsigned.is_bottom()) {
-        if (!bin.is64) {
-            apply_unsigned(dst_signed, dst_unsigned, interval_t{number_t{UINT32_MAX}},
-                    finite_width, dst_unsigned, Op::AND);
-        }
-        insert_in_registers_signed(dst_register, loc, dst_signed);
-        insert_in_registers_unsigned(dst_register, loc, dst_unsigned);
-    }
-    else {
-        operator-=(dst_register);
+    if (!bin.is64) {
+        bitwise_and(dst_register, std::numeric_limits<uint32_t>::max(), loc);
     }
 }
 
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 208b8a8bb..634caab74 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -9,6 +9,10 @@
 
 namespace crab {
 
+enum class arith_binaryop_t { ADD, SUB, MUL, SDIV, UDIV, SREM, UREM };
+enum class bitwise_binaryop_t { AND, OR, XOR, SHL, LSHR, ASHR };
+using binaryop_t = std::variant<arith_binaryop_t, bitwise_binaryop_t>;
+
 class interval_domain_t final {
     signed_interval_domain_t m_signed;
     unsigned_interval_domain_t m_unsigned;
@@ -51,6 +55,59 @@ class interval_domain_t final {
     interval_domain_t narrow(const interval_domain_t& other) const;
     void operator-=(register_t reg);
 
+
+    void apply_signed(const binaryop_t&, const register_t&, const register_t&, const number_t&, const int, location_t);
+    void apply_unsigned(const binaryop_t&, const register_t&, const register_t&, const number_t&, const int, location_t);
+    void apply_signed(const binaryop_t&, const register_t&, const register_t&, const register_t&, const int, location_t);
+    void apply_unsigned(const binaryop_t&, const register_t&, const register_t&, const register_t&, const int, location_t);
+
+    void overflow(const register_t&, const int, location_t, bool);
+    void overflow_bounds(const register_t&, number_t, const int, location_t, bool);
+
+    void apply(const bitwise_binaryop_t&, const register_t&, const register_t&, const number_t&, const int, location_t, bool);
+    void apply(const bitwise_binaryop_t&, const register_t&, const register_t&, const register_t&, const int, location_t, bool);
+    void apply(const arith_binaryop_t&, const register_t&, const register_t&, const number_t&, const int, location_t, bool);
+    void apply(const arith_binaryop_t&, const register_t&, const register_t&, const register_t&, const int, location_t, bool);
+
+    void apply(const binaryop_t& op, const register_t& result, const register_t& lhs, const register_t& rhs, const int finite_width, location_t loc, bool is_signed) {
+        std::visit([&](auto top) { apply(top, result, lhs, rhs, finite_width, loc, is_signed); }, op);
+    }
+    void apply(const binaryop_t& op, const register_t& result, const register_t& lhs, const number_t& rhs, const int finite_width, location_t loc, bool is_signed) {
+        std::visit([&](auto top) { apply(top, result, lhs, rhs, finite_width, loc, is_signed); }, op);
+    }
+
+
+    void neg(const register_t&, const int, location_t);
+    void add(const register_t&, const register_t&, location_t);
+    void add(const register_t&, const number_t&, location_t);
+    void sub(const register_t&, const register_t&, location_t);
+    void sub(const register_t&, const number_t&, location_t);
+    void add_overflow(const register_t&, const register_t&, const int, location_t);
+    void add_overflow(const register_t&, const number_t&, const int, location_t);
+    void sub_overflow(const register_t&, const register_t&, const int, location_t);
+    void sub_overflow(const register_t&, const number_t&, const int, location_t);
+    void mul(const register_t&, const register_t&, const int, location_t);
+    void mul(const register_t&, const number_t&, const int, location_t);
+    void udiv(const register_t&, const register_t&, const int, location_t);
+    void udiv(const register_t&, const number_t&, const int, location_t);
+    void sdiv(const register_t&, const register_t&, const int, location_t);
+    void sdiv(const register_t&, const number_t&, const int, location_t);
+    void srem(const register_t&, const register_t&, const int, location_t);
+    void srem(const register_t&, const number_t&, const int, location_t);
+    void urem(const register_t&, const register_t&, const int, location_t);
+    void urem(const register_t&, const number_t&, const int, location_t);
+    void bitwise_and(const register_t&, const register_t&, const int, location_t);
+    void bitwise_and(const register_t&, const number_t&, location_t);
+    void bitwise_or(const register_t&, const register_t&, const int, location_t);
+    void bitwise_or(const register_t&, const number_t&, location_t);
+    void bitwise_xor(const register_t&, const register_t&, const int, location_t);
+    void bitwise_xor(const register_t&, const number_t&, location_t);
+    void shl_overflow(const register_t&, const register_t&, location_t);
+    void shl_overflow(const register_t&, const number_t&, location_t);
+
+    void shl(const register_t&, int, const int, location_t);
+    void lshr(const register_t&, int, const int, location_t);
+
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = boost::none);
     void operator()(const Bin&, location_t loc = boost::none);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 0ac5c72d2..1e1040070 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -837,8 +837,6 @@ void region_domain_t::check_type(const TypeConstraint& s,
         }
         else {
             if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
-            // TODO: This needs to be fixed
-            // if (s.types == TypeGroup::non_map_fd) return;
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)) {
                 ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_type);
                 if (ptr_with_off.get_region() == crab::region_t::T_CTX) {
@@ -866,7 +864,6 @@ void region_domain_t::check_type(const TypeConstraint& s,
     }
     else if (interval_opt) {
         if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
-                // TODO: fix - || s.types == TypeGroup::non_map_fd 
                 || s.types == TypeGroup::mem_or_num)
             return;
     }

From 262bda09dd41e27e0f49ee401c4c97d011649756 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 19 Nov 2024 13:30:27 -0500
Subject: [PATCH 317/373] Better printing and clean up the printing interface

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp          | 32 +++++++--
 src/crab/abstract_domain.hpp          | 15 +++-
 src/crab/ebpf_domain.cpp              |  2 +-
 src/crab/ebpf_domain.hpp              |  7 +-
 src/crab/interval_domain.cpp          |  2 +-
 src/crab/interval_domain.hpp          |  5 +-
 src/crab/offset_domain.cpp            |  2 +-
 src/crab/offset_domain.hpp            |  5 +-
 src/crab/region_domain.cpp            |  2 +-
 src/crab/region_domain.hpp            |  5 +-
 src/crab/signed_interval_domain.cpp   |  2 +-
 src/crab/signed_interval_domain.hpp   |  5 +-
 src/crab/type_inference.cpp           | 99 ++++++++++++---------------
 src/crab/type_inference.hpp           |  8 +--
 src/crab/type_ostream.cpp             |  8 +++
 src/crab/type_ostream.hpp             |  2 +
 src/crab/unsigned_interval_domain.cpp |  2 +-
 src/crab/unsigned_interval_domain.hpp |  5 +-
 src/crab_verifier.cpp                 |  8 +--
 19 files changed, 130 insertions(+), 86 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index 224c41c23..b6596aa95 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -113,8 +113,24 @@ abstract_domain_t::abstract_domain_model<Domain>::narrow(const abstract_domain_t
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_block_t& bb, int print) {
-    m_abs_val.operator()(bb, print);
+void abstract_domain_t::abstract_domain_model<Domain>::print_ctx(std::ostream& o) const {
+    m_abs_val.print_ctx(o);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::print_stack(std::ostream& o) const {
+    m_abs_val.print_stack(o);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::print_annotated_bb(std::ostream& o,
+                                                                const basic_block_t& bb) const {
+    m_abs_val.print_annotated_bb(o, bb);
+}
+
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const basic_block_t& bb) {
+    m_abs_val.operator()(bb);
 }
 
 template <typename Domain>
@@ -254,8 +270,8 @@ abstract_domain_t abstract_domain_t::narrow(const abstract_domain_t& abs) const
     return abstract_domain_t(std::move(m_concept->narrow(*(abs.m_concept))));
 }
 
-void abstract_domain_t::operator()(const basic_block_t& bb, int print) {
-    m_concept->operator()(bb, print);
+void abstract_domain_t::operator()(const basic_block_t& bb) {
+    m_concept->operator()(bb);
 }
 
 void abstract_domain_t::operator()(const Undefined& s, location_t loc) { m_concept->operator()(s, loc); }
@@ -290,6 +306,14 @@ string_invariant abstract_domain_t::to_set() { return m_concept->to_set(); }
 
 void abstract_domain_t::set_require_check(check_require_func_t f) { m_concept->set_require_check(f); }
 
+void abstract_domain_t::print_ctx(std::ostream& o) const { m_concept->print_ctx(o); }
+
+void abstract_domain_t::print_stack(std::ostream& o) const { m_concept->print_stack(o); }
+
+void abstract_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {
+    m_concept->print_annotated_bb(o, bb);
+}
+
 std::vector<std::string> abstract_domain_t::get_errors() { return m_concept->get_errors(); }
 
 std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom) {
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index e1e267457..de6db04d0 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -31,7 +31,7 @@ class abstract_domain_t {
         virtual std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const = 0;
         virtual std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) = 0;
         virtual std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const = 0;
-        virtual void operator()(const basic_block_t&, int print = 0) = 0;
+        virtual void operator()(const basic_block_t&) = 0;
         virtual void operator()(const Undefined&, location_t) = 0;
         virtual void operator()(const Bin&, location_t) = 0;
         virtual void operator()(const Un&, location_t) = 0;
@@ -53,6 +53,9 @@ class abstract_domain_t {
         virtual string_invariant to_set() = 0;
         virtual void set_require_check(check_require_func_t f) = 0;
         virtual std::vector<std::string> get_errors() = 0;
+        virtual void print_ctx(std::ostream&) const = 0;
+        virtual void print_stack(std::ostream&) const = 0;
+        virtual void print_annotated_bb(std::ostream&, const basic_block_t& bb) const = 0;
     }; // end class abstract_domain_concept
 
     template <typename Domain>
@@ -74,7 +77,7 @@ class abstract_domain_t {
         std::unique_ptr<abstract_domain_concept> operator&(const abstract_domain_concept& abs) const override;
         std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
         std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
-        void operator()(const basic_block_t& bb, int print = 0) override;
+        void operator()(const basic_block_t& bb) override;
         void operator()(const Undefined& s, location_t loc = boost::none) override;
         void operator()(const Bin& s, location_t loc = boost::none) override;
         void operator()(const Un& s, location_t loc = boost::none) override;
@@ -92,6 +95,9 @@ class abstract_domain_t {
         string_invariant to_set() override;
         void set_require_check(check_require_func_t f) override;
         std::vector<std::string> get_errors() override;
+        void print_ctx(std::ostream&) const override;
+        void print_stack(std::ostream&) const override;
+        void print_annotated_bb(std::ostream&, const basic_block_t& bb) const override;
     }; // end class abstract_domain_model
 
     std::unique_ptr<abstract_domain_concept> m_concept;
@@ -117,7 +123,7 @@ class abstract_domain_t {
     abstract_domain_t operator&(const abstract_domain_t& abs) const;
     abstract_domain_t widen(const abstract_domain_t& abs, bool);
     abstract_domain_t narrow(const abstract_domain_t& abs) const;
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void operator()(const Undefined& s, location_t loc = boost::none);
     void operator()(const Bin& s, location_t loc = boost::none);
     void operator()(const Un& s, location_t loc = boost::none);
@@ -135,6 +141,9 @@ class abstract_domain_t {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
     std::vector<std::string> get_errors();
+    void print_ctx(std::ostream&) const;
+    void print_stack(std::ostream&) const;
+    void print_annotated_bb(std::ostream&, const basic_block_t& bb) const;
 
     friend std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom);
 };
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index f80ff7a6f..a31163725 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -1178,7 +1178,7 @@ static linear_constraint_t type_is_not_stack(const reg_pack_t& r) {
     return r.type != T_STACK;
 }
 
-void ebpf_domain_t::operator()(const basic_block_t& bb, int print) {
+void ebpf_domain_t::operator()(const basic_block_t& bb) {
     for (const Instruction& statement : bb) {
         std::visit(*this, statement);
     }
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index d490c33fa..ad6e70930 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -52,7 +52,7 @@ class ebpf_domain_t final {
     string_invariant to_set() const;
 
     // abstract transformers
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
 
     void operator()(const Addable&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
@@ -81,8 +81,11 @@ class ebpf_domain_t final {
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
 
-    // write operation is important to keep in ebpf_domain_t because of the parametric abstract domain
+    // following operations are important to keep in ebpf_domain_t because of the parametric abstract domain
     void write(std::ostream& o) const;
+    void print_ctx(const std::ostream& o) const {}
+    void print_stack(const std::ostream& o) const {}
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
 
     void initialize_loop_counter(const label_t& label);
     static ebpf_domain_t calculate_constant_limits();
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index a0a209419..40e97c424 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1823,7 +1823,7 @@ void interval_domain_t::operator()(const Assert&, location_t loc) {
     // nothing to do here
 }
 
-void interval_domain_t::operator()(const basic_block_t& bb, int print) {
+void interval_domain_t::operator()(const basic_block_t& bb) {
     // nothing to do here
 }
 void interval_domain_t::set_require_check(check_require_func_t f) {}
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 634caab74..8f273f3c2 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -120,7 +120,7 @@ class interval_domain_t final {
     void operator()(const Packet&, location_t loc = boost::none);
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t&);
@@ -173,6 +173,9 @@ class interval_domain_t final {
     std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
+    void print_stack(std::ostream& o) const {};
+    void print_ctx(std::ostream& o) const {};
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() {
         operator+=(m_signed.get_errors());
         operator+=(m_unsigned.get_errors());
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 4254d00e0..6f52d3719 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -664,7 +664,7 @@ void offset_domain_t::operator()(const Assert &u, location_t loc) {
     // nothing to do here
 }
 
-void offset_domain_t::operator()(const basic_block_t& bb, int print) {
+void offset_domain_t::operator()(const basic_block_t& bb) {
     // nothing to do here
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 80d41880b..e250f3425 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -149,7 +149,7 @@ class offset_domain_t final {
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {};
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     std::string domain_name() const;
     crab::bound_t get_loop_count_upper_bound() const;
@@ -177,6 +177,9 @@ class offset_domain_t final {
     void insert_in_registers(register_t, location_t, refinement_t);
     void store_in_stack(uint64_t, refinement_t, int);
     void adjust_bb_for_types(location_t);
+    void print_ctx(std::ostream& o) const {}
+    void print_stack(std::ostream& o) const {}
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
 }; // end offset_domain_t
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 1e1040070..c28e6194f 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -540,7 +540,7 @@ void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     m_errors.push_back("Zero Ctx Offset assertion fail");
 }
 
-void region_domain_t::operator()(const basic_block_t& bb, int print) {
+void region_domain_t::operator()(const basic_block_t& bb) {
     // nothing to do here
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 50cbf15c5..5696d46d2 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -148,7 +148,7 @@ class region_domain_t final {
     void operator()(const TypeConstraint&, location_t loc = boost::none);
     void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& o) const {}
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t&);
@@ -187,6 +187,9 @@ class region_domain_t final {
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     void set_registers_to_top();
     void adjust_bb_for_types(location_t);
+    void print_ctx(std::ostream& o) const {}
+    void print_stack(std::ostream& o) const {}
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
 }; // end region_domain_t
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 304922e25..9ce5e9c2a 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -602,7 +602,7 @@ void signed_interval_domain_t::operator()(const Assert&, location_t loc) {
     // nothing to do here
 }
 
-void signed_interval_domain_t::operator()(const basic_block_t& bb, int print) {
+void signed_interval_domain_t::operator()(const basic_block_t& bb) {
     // nothing to do here
 }
 
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index cdb0abd7c..0c48eb2a2 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -125,7 +125,7 @@ class signed_interval_domain_t final {
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {}
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t&);
@@ -148,6 +148,9 @@ class signed_interval_domain_t final {
     void reset_errors() { m_errors.clear(); }
     bool load_from_stack(register_t, uint64_t, location_t);
     void store_in_stack(const Mem&, uint64_t, int);
+    void print_ctx(std::ostream& o) const {}
+    void print_stack(std::ostream& o) const {};
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end signed_interval_domain_t
 
 } // namespace crab
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 467e115f5..85eb06341 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -687,25 +687,25 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
     }
 }
 
-void inference_domain_t::print_ctx() const {
+void inference_domain_t::print_ctx(std::ostream& o) const {
     std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
-    std::cout << "\tctx: {\n";
+    o << "\tctx: {";
     for (auto const& k : ctx_keys) {
         auto ptr = m_region.find_in_ctx(k);
         auto dist = m_offset.find_in_ctx(k);
         if (ptr) {
-            std::cout << "\t\t";
-            print_non_numeric_memory_cell(std::cout, k, k+3, *ptr, dist);
-            std::cout << ",\n";
+            o << "\t\t";
+            print_non_numeric_memory_cell(o, k, k+3, *ptr, dist);
+            o << ",\n";
         }
     }
-    std::cout << "\t}\n";
+    o << "\t}\n";
 }
 
-void inference_domain_t::print_stack() const {
+void inference_domain_t::print_stack(std::ostream& o) const {
     std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
     std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
-    std::cout << "\tstack: {\n";
+    o << "\tstack: {\n";
     for (auto const& k : stack_keys_region) {
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
         auto dist = m_offset.find_in_stack(k);
@@ -713,36 +713,36 @@ void inference_domain_t::print_stack() const {
             auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
-            std::cout << "\t\t";
+            o << "\t\t";
             if (dist) {
-                print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd,
+                print_non_numeric_memory_cell(o, k, k+width-1, ptr_or_mapfd,
                         std::optional<refinement_t>(dist->first));
             }
             else {
-                print_non_numeric_memory_cell(std::cout, k, k+width-1, ptr_or_mapfd);
+                print_non_numeric_memory_cell(o, k, k+width-1, ptr_or_mapfd);
             }
-            std::cout << ",\n";
+            o << ",\n";
         }
     }
     for (auto const& k : stack_keys_interval) {
         auto maybe_signed_interval_cells = m_interval.find_in_stack_signed(k);
         if (maybe_signed_interval_cells) {
             auto interval_cells = maybe_signed_interval_cells.value();
-            std::cout << "\t\t";
-            print_numeric_memory_cell(std::cout, k, k+interval_cells.second-1,
+            o << "\t\t";
+            print_numeric_memory_cell(o, k, k+interval_cells.second-1,
                     interval_cells.first.to_interval(), true);
-            std::cout << ",\n";
+            o << ",\n";
         }
         auto maybe_unsigned_interval_cells = m_interval.find_in_stack_unsigned(k);
         if (maybe_unsigned_interval_cells) {
             auto interval_cells = maybe_unsigned_interval_cells.value();
-            std::cout << "\t\t";
-            print_numeric_memory_cell(std::cout, k, k+interval_cells.second-1,
+            o << "\t\t";
+            print_numeric_memory_cell(o, k, k+interval_cells.second-1,
                     interval_cells.first.to_interval(), false);
-            std::cout << ",\n";
+            o << ",\n";
         }
     }
-    std::cout << "\t}\n";
+    o << "\t}\n";
 }
 
 void inference_domain_t::adjust_bb_for_types(location_t loc) {
@@ -751,12 +751,7 @@ void inference_domain_t::adjust_bb_for_types(location_t loc) {
     m_interval.adjust_bb_for_types(loc);
 }
 
-void inference_domain_t::operator()(const basic_block_t& bb, int print) {
-
-    if (print != 0) {
-        print_annotated(std::cout, *this, bb, print);
-        return;
-    }
+void inference_domain_t::operator()(const basic_block_t& bb) {
 
     // A temporary fix to avoid printing errors for multiple basic blocks
     m_errors.clear();
@@ -767,8 +762,7 @@ void inference_domain_t::operator()(const basic_block_t& bb, int print) {
     auto label = bb.label();
     uint32_t curr_pos = 0;
     location_t loc = location_t(std::make_pair(label, curr_pos));
-    if (print == 0)
-        adjust_bb_for_types(loc);
+    adjust_bb_for_types(loc);
 
     for (const Instruction& statement : bb) {
         loc = location_t(std::make_pair(label, ++curr_pos));
@@ -1050,19 +1044,9 @@ std::ostream& operator<<(std::ostream& o, const inference_domain_t& typ) {
     return o;
 }
 
-} // namespace crab
-
-void print_annotated(std::ostream& o, const crab::inference_domain_t& typ,
-        const basic_block_t& bb, int print) {
-    if (typ.is_bottom()) {
-        o << bb << "\n";
-        return;
-    }
-    if (print < 0) {
-        o << "state of stack and ctx in program:\n";
-        typ.print_ctx();
-        typ.print_stack();
-        o << "\n";
+void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {
+    if (is_bottom()) {
+        print_bb(o, bb);
         return;
     }
 
@@ -1076,21 +1060,21 @@ void print_annotated(std::ostream& o, const crab::inference_domain_t& typ,
         // TODO: print unsigned intervals in a proper way
         if (std::holds_alternative<Call>(statement)) {
             auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
-            auto region = typ.find_ptr_or_mapfd_at_loc(r0_reg);
-            auto rf = typ.find_refinement_at_loc(r0_reg);
-            auto signed_interval = typ.find_signed_interval_at_loc(r0_reg);
+            auto region = find_ptr_or_mapfd_at_loc(r0_reg);
+            auto rf = find_refinement_at_loc(r0_reg);
+            auto signed_interval = find_signed_interval_at_loc(r0_reg);
             print_annotated(o, std::get<Call>(statement), region, rf, signed_interval, true);
-            auto unsigned_interval = typ.find_unsigned_interval_at_loc(r0_reg);
+            auto unsigned_interval = find_unsigned_interval_at_loc(r0_reg);
             //print_annotated(o, std::get<Call>(statement), region, unsigned_interval, false);
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
             auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
-            auto region = typ.find_ptr_or_mapfd_at_loc(reg_with_loc);
-            auto rf = typ.find_refinement_at_loc(reg_with_loc);
-            auto signed_interval = typ.find_signed_interval_at_loc(reg_with_loc);
+            auto region = find_ptr_or_mapfd_at_loc(reg_with_loc);
+            auto rf = find_refinement_at_loc(reg_with_loc);
+            auto signed_interval = find_signed_interval_at_loc(reg_with_loc);
             print_annotated(o, b, region, rf, signed_interval, true);
-            auto unsigned_interval = typ.find_unsigned_interval_at_loc(reg_with_loc);
+            auto unsigned_interval = find_unsigned_interval_at_loc(reg_with_loc);
             //print_annotated(o, b, region, rf, unsigned_interval, false);
         }
         else if (std::holds_alternative<Mem>(statement)) {
@@ -1098,30 +1082,30 @@ void print_annotated(std::ostream& o, const crab::inference_domain_t& typ,
             if (u.is_load) {
                 auto target_reg = std::get<Reg>(u.value);
                 auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
-                auto region = typ.find_ptr_or_mapfd_at_loc(target_reg_loc);
-                auto rf = typ.find_refinement_at_loc(target_reg_loc);
-                auto signed_interval = typ.find_signed_interval_at_loc(target_reg_loc);
+                auto region = find_ptr_or_mapfd_at_loc(target_reg_loc);
+                auto rf = find_refinement_at_loc(target_reg_loc);
+                auto signed_interval = find_signed_interval_at_loc(target_reg_loc);
                 print_annotated(o, u, region, rf, signed_interval, true);
-                auto unsigned_interval = typ.find_unsigned_interval_at_loc(target_reg_loc);
+                auto unsigned_interval = find_unsigned_interval_at_loc(target_reg_loc);
                 //print_annotated(o, u, region, rf, unsigned_interval, false);
             }
-            else o << "  " << u << "\n";
+            else print_instr(o, u);
         }
         else if (std::holds_alternative<LoadMapFd>(statement)) {
             auto u = std::get<LoadMapFd>(statement);
             auto reg = crab::reg_with_loc_t(u.dst.v, loc);
-            auto region = typ.find_ptr_or_mapfd_at_loc(reg);
+            auto region = find_ptr_or_mapfd_at_loc(reg);
             print_annotated(o, u, region);
         }
         else if (std::holds_alternative<Un>(statement)) {
             auto u = std::get<Un>(statement);
             auto reg = crab::reg_with_loc_t(u.dst.v, loc);
-            auto signed_interval = typ.find_signed_interval_at_loc(reg);
+            auto signed_interval = find_signed_interval_at_loc(reg);
             print_annotated(o, u, signed_interval, true);
-            auto unsigned_interval = typ.find_unsigned_interval_at_loc(reg);
+            auto unsigned_interval = find_unsigned_interval_at_loc(reg);
             print_annotated(o, u, unsigned_interval, false);
         }
-        else o << "  " << statement << "\n";
+        else print_instr(o, statement);
     }
 
     auto [it, et] = bb.next_blocks();
@@ -1140,3 +1124,4 @@ void print_annotated(std::ostream& o, const crab::inference_domain_t& typ,
     o << "\n\n";
 }
 
+} // namespace crab
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index ed3c4758f..0f1bb7e41 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -77,7 +77,7 @@ class inference_domain_t final {
     void operator()(const ValidDivisor&, location_t loc = boost::none);
     void operator()(const FuncConstraint& s, location_t loc = boost::none);
     void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     friend std::ostream& operator<<(std::ostream& o, const inference_domain_t& dom);
     void initialize_loop_counter(label_t label);
@@ -85,8 +85,9 @@ class inference_domain_t final {
     string_invariant to_set() const;
     void set_require_check(check_require_func_t f) {}
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
-    void print_ctx() const;
-    void print_stack() const;
+    void print_ctx(std::ostream&) const;
+    void print_stack(std::ostream&) const;
+    void print_annotated_bb(std::ostream&, const basic_block_t&) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::refinement_t> find_refinement_at_loc(const crab::reg_with_loc_t&) const;
     std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::reg_with_loc_t&) const;
@@ -118,4 +119,3 @@ class inference_domain_t final {
 
 } // namespace crab
 
-void print_annotated(std::ostream&, const crab::inference_domain_t&, const basic_block_t&, int);
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index d0aa03dc8..9cd709e53 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -188,3 +188,11 @@ void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_inte
     print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed);
     o << " = " << op(b.op) << " " << b.dst << "\n";
 }
+
+void print_bb(std::ostream& o, const basic_block_t& bb) {
+    o << bb << "\n";
+}
+
+void print_instr(std::ostream& o, const Instruction& i) {
+    std::visit([&](auto&& i) { o << "  " << i << "\n"; }, i);
+}
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index b2bb1dd52..545bfce65 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -26,3 +26,5 @@ void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or
 void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
         std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
 void print_annotated(std::ostream&, const Un&, std::optional<crab::mock_interval_t>&, bool);
+void print_bb(std::ostream&, const basic_block_t&);
+void print_instr(std::ostream&, const Instruction&);
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 2be0ed989..962ab8505 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -521,7 +521,7 @@ void unsigned_interval_domain_t::operator()(const Assert&, location_t loc) {
     // nothing to do here
 }
 
-void unsigned_interval_domain_t::operator()(const basic_block_t& bb, int print) {
+void unsigned_interval_domain_t::operator()(const basic_block_t& bb) {
     // nothing to do here
 }
 
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index afc56a677..8666658a2 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -119,7 +119,7 @@ class unsigned_interval_domain_t final {
     void operator()(const Packet&, location_t loc = boost::none);
     void operator()(const Assume&, location_t loc = boost::none);
     void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const basic_block_t& bb, int print = 0);
+    void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t&);
@@ -138,6 +138,9 @@ class unsigned_interval_domain_t final {
     void reset_errors() { m_errors.clear(); }
     bool load_from_stack(register_t, uint64_t, location_t);
     void store_in_stack(const Mem&, uint64_t, int);
+    void print_ctx(std::ostream& o) const {};
+    void print_stack(std::ostream& o) const {};
+    void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end unsigned_interval_domain_t
 
 } // namespace crab
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index fcd53a2b0..2fb740a35 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -130,12 +130,10 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::in
     if (thread_local_options.abstract_domain == abstract_domain_kind::INFERENCE_DOMAIN) {
         db = generate_report_inference_domain(cfg, post_invariants);
         if (thread_local_options.print_invariants) {
-            auto exit_state = post_invariants.at(label_t::exit);
-            // only to print ctx and stack, fix later
-            exit_state(cfg.get_node(label_t::exit), -1);
+            auto final_state = pre_invariants.at(label_t::exit);
+            final_state.print_ctx(std::cout); final_state.print_stack(std::cout);
             for (const label_t& label : cfg.sorted_labels()) {
-                auto post_state = post_invariants.at(label);
-                post_state(cfg.get_node(label), 1);
+                post_invariants.at(label).print_annotated_bb(std::cout, cfg.get_node(label));
             }
         }
     }

From 21dfa951b57c266e94ced6cd3d4b0c4c76af8ef0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 19 Nov 2024 22:14:27 -0500
Subject: [PATCH 318/373] Printing simplification in refinement types

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.hpp     |  4 ----
 src/crab/refinement.cpp     | 16 +++++++++-------
 src/crab/symbol.hpp         |  7 +++----
 src/crab/symbol_factory.cpp |  4 +---
 4 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index f47503f7e..a5b2b031d 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -81,10 +81,6 @@ class expression_t {
         return expression_t({std::make_pair(symbol_t::nu(), 1)});
     }
 
-    static expression_t pkt_symbol() {
-        return expression_t({std::make_pair(symbol_t::pkt_symbol(), 1)});
-    }
-
     static expression_t make_slack() {
         return expression_t({std::make_pair(symbol_t::make(), 1)});
     }
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 42998df47..7e383875d 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -71,21 +71,21 @@ bool refinement_t::has_value(refinement_t&& other) const {
 
 void refinement_t::write(std::ostream& o) const {
     symbol_t nu = symbol_t::nu();
-    symbol_t i = symbol_t::pkt_symbol();
     o << "{" << nu << " : ";
     if (_type == data_type_t::NUM) {
-        o << "num | " << nu << " = ";
+        o << "num<" << _value << ">";
     }
     else if (_type == data_type_t::PACKET) {
-        o << "pkt<" << i << "> | " << i << " = ";
+        o << "pkt<" << _value << ">";
     }
     else {
         o << "_";
     }
-    o << _value;
+    if (_constraints.size() > 0 || _value.get_slack_intervals().size() > 0) {
+        o << " | ";
+    }
     std::vector<std::pair<symbol_t, interval_t>> slack_intervals = get_value().get_slack_intervals();
     if (_constraints.size() > 0) {
-        o << " & ";
         for (size_t i = 0; i < _constraints.size(); i++) {
             auto c = _constraints[i];
             auto c_slack_intervals = c.get_slack_intervals();
@@ -99,12 +99,14 @@ void refinement_t::write(std::ostream& o) const {
     }
     std::set<symbol_t> seen;
     if (slack_intervals.size() > 0) {
-        o << " & ";
+        if (_constraints.size() > 0) {
+            o << " & ";
+        }
         for (auto [s, i] : slack_intervals) {
             if (seen.find(s) != seen.end()) {
                 continue;
             }
-            o << s << " = " << i;
+            o << s << " in " << i;
             seen.insert(s);
             if (s != slack_intervals.back().first) {
                 o << " & ";
diff --git a/src/crab/symbol.hpp b/src/crab/symbol.hpp
index efd645102..1c29ee41d 100644
--- a/src/crab/symbol.hpp
+++ b/src/crab/symbol.hpp
@@ -20,6 +20,7 @@ class symbol_t final {
     bool operator!=(symbol_t o) const { return (!(operator==(o))); }
     bool operator<(symbol_t o) const { return _id < o._id; }
     bool operator>(symbol_t o) const { return _id > o._id; }
+    operator int64_t() const { return _id; }
 
   private:
     static int64_t count;
@@ -29,14 +30,12 @@ class symbol_t final {
     static symbol_t end()       { return symbol_t(1); }
     static symbol_t meta()      { return symbol_t(2); }
     static symbol_t nu()        { return symbol_t(3); }
-    static symbol_t pkt_symbol()     { return symbol_t(4); }
-    static symbol_t make()      { count++;  return symbol_t(count); }
+    static symbol_t make()      { return symbol_t(count++); }
     bool is_nu() const { return *this == symbol_t::nu(); }
-    bool is_pkt_symbol() const { return *this == symbol_t::pkt_symbol(); }
     bool is_meta() const { return *this == symbol_t::meta(); }
     bool is_end() const { return *this == symbol_t::end(); }
     bool is_begin() const { return *this == symbol_t::begin(); }
-    bool is_slack() const { return _id >= 5; }
+    bool is_slack() const { return _id >= 4; }
     void write(std::ostream& o) const;
 
     struct Hasher {
diff --git a/src/crab/symbol_factory.cpp b/src/crab/symbol_factory.cpp
index b931dcd7a..2d7a4da9c 100644
--- a/src/crab/symbol_factory.cpp
+++ b/src/crab/symbol_factory.cpp
@@ -19,10 +19,8 @@ void symbol_t::write(std::ostream& o) const {
         o << "meta";
     } else if (is_nu()) {
         o << "v";
-    } else if (is_pkt_symbol()) {
-        o << "i";
     } else {
-        o << "a_" << ((int)_id-4);
+        o << "a_" << ((int64_t)_id-4);
     }
 }
 

From b3c870c243f9a3fc9131a84d40114e5e6ef6a36b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 20 Nov 2024 09:26:14 -0500
Subject: [PATCH 319/373] Some fixes and refactoring in expression_t class

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.cpp | 65 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 57 insertions(+), 8 deletions(-)

diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 8f5eb9950..b96a21cc1 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -8,6 +8,7 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
     return o;
 }
 
+// get values for all slack variables in the expression
 std::vector<std::pair<symbol_t, interval_t>> expression_t::get_slack_intervals() const {
     std::vector<std::pair<symbol_t, interval_t>> slack_intervals;
     for (const auto &term : _symbol_terms) {
@@ -18,12 +19,13 @@ std::vector<std::pair<symbol_t, interval_t>> expression_t::get_slack_intervals()
     return slack_intervals;
 }
 
+// get an equivalent expression with all slack variables replaced by their values
 expression_t expression_t::get_equivalent_expression() const {
     interval_t value = _constant_term;
     symbol_terms_t symbol_terms;
     for (const auto &term : _symbol_terms) {
         if (term.first.is_slack()) {
-            value = value + ((*_slacks)[term.first]).to_interval() * interval_t{(int)term.second};
+            value = value + ((*_slacks)[term.first]).to_interval() * interval_t{static_cast<int>(term.second)};
         } else {
             symbol_terms[term.first] = term.second;
         }
@@ -31,38 +33,47 @@ expression_t expression_t::get_equivalent_expression() const {
     return expression_t(symbol_terms, value, _slacks);
 }
 
+// check if two expressions are equal, by getting equivalent expressions and comparing them
 bool expression_t::is_equal(const expression_t &other) const {
     return get_equivalent_expression() == other.get_equivalent_expression();
 }
 
+// check less than
 bool expression_t::is_less_than(const expression_t &other) const {
     return get_equivalent_expression() < other.get_equivalent_expression();
 }
 
+// check less than or equal
 bool expression_t::is_less_or_equal(const expression_t &other) const {
     return get_equivalent_expression() <= other.get_equivalent_expression();
 }
 
+// check greater than
 bool expression_t::is_greater_than(const expression_t &other) const {
     return get_equivalent_expression() > other.get_equivalent_expression();
 }
 
+// syntactic equality
 bool expression_t::operator==(const expression_t &other) const {
     return _symbol_terms == other._symbol_terms && _constant_term == other._constant_term;
 }
 
+// syntactic less than
 bool expression_t::operator<(const expression_t &other) const {
     return _symbol_terms == other._symbol_terms && _constant_term.ub() < other._constant_term.lb();
 }
 
+// syntactic less than or equal
 bool expression_t::operator<=(const expression_t &other) const {
     return _symbol_terms == other._symbol_terms && _constant_term.ub() <= other._constant_term.lb();
 }
 
+// syntactic greater than
 bool expression_t::operator>(const expression_t &other) const {
     return _symbol_terms == other._symbol_terms && _constant_term.lb() > other._constant_term.ub();
 }
 
+// check if an expression contains a single symbol, which can be slack or not
 bool expression_t::is_singleton() const {
     return _symbol_terms.size() == 1 && _constant_term == interval_t{0};
 }
@@ -78,9 +89,12 @@ symbol_t expression_t::get_singleton() const {
     return _symbol_terms.begin()->first;
 }
 
+// insert a symbol term into a list of symbol terms
 static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv) {
+    // add coefficient to term if it already exists
     if (terms.find(kv.first) != terms.end()) {
         terms[kv.first] += kv.second;
+        // remove term if coefficient is zero
         if (terms[kv.first] == 0) {
             terms.erase(kv.first);
         }
@@ -89,6 +103,7 @@ static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv)
     }
 }
 
+// substitute a symbol in an expression with another expression
 expression_t expression_t::substitute(const symbol_t &from, const expression_t &to) const {
     expression_t result = *this;
     auto it = result._symbol_terms.find(from);
@@ -99,6 +114,7 @@ expression_t expression_t::substitute(const symbol_t &from, const expression_t &
     return result;
 }
 
+// negate an expression, and return it
 expression_t expression_t::negate() const {
     symbol_terms_t new_terms;
     for (const auto &term : _symbol_terms) {
@@ -107,6 +123,7 @@ expression_t expression_t::negate() const {
     return expression_t(new_terms, -_constant_term, _slacks);
 }
 
+// add two expressions, and return the result
 expression_t expression_t::operator+(const expression_t &other) const {
     auto new_terms = _symbol_terms;
     for (const auto &term : other._symbol_terms) {
@@ -116,36 +133,63 @@ expression_t expression_t::operator+(const expression_t &other) const {
     return expression_t(new_terms, _constant_term + other._constant_term, slacks);
 }
 
+// add a constant to an expression, and return the result
 expression_t expression_t::operator+(interval_t constant) const {
     return expression_t(_symbol_terms, _constant_term + constant, _slacks);
 }
 
+// add an integer to an expression, and return the result
 expression_t expression_t::operator+(int n) const {
     return operator+(interval_t{n});
 }
 
 expression_t expression_t::operator|(const expression_t &other) const {
+    // TODO: support case where there are one slack variable in each expression,
+    // then we can construct a new slack that is the interval of two.
+    // we need to have intervals of slack variables to do this
     auto slacks = _slacks == nullptr ? other._slacks : _slacks;
     if (*this == other) {
+        // both expressions are equal
         return expression_t(_symbol_terms, _constant_term, slacks);
     }
+    else if (_symbol_terms == other._symbol_terms) {
+        // both expressions have the same symbol terms, but different constant terms
+        return expression_t(_symbol_terms, _constant_term | other._constant_term, slacks);
+    }
     interval_t constant_term = _constant_term;
     interval_t other_constant_term = other._constant_term;
     symbol_terms_t new_terms;
     for (const auto &term : _symbol_terms) {
-        if (other._symbol_terms.find(term.first) != other._symbol_terms.end()) {
+        if (other._symbol_terms.find(term.first) != other._symbol_terms.end()
+            && term.second == other._symbol_terms.at(term.first)) {
+            // for any symbol, if it exists in both expressions, and the coefficients are the same
+            // then the term can be added to the new expression
             new_terms[term.first] = term.second;
-        } else {
+        } else if (term.first.is_slack()) {
+            // either the symbol was not found in the other expression, or the coefficients are different
             constant_term = constant_term +
-                interval_t{(int)term.second} * (*slacks)[term.first].to_interval();
+                interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
+        }
+        else {
+            // in case where we have symbols other than slack variables, and either the symbol is not
+            // found in the other expression, or the coefficients are different, we return top
+            return expression_t();
         }
     }
     for (const auto &term : other._symbol_terms) {
-        if (_symbol_terms.find(term.first) == _symbol_terms.end()) {
+        if (term.first.is_slack()) {
+            // if the symbol is a slack variable, it must not be in the first expression else it
+            // would have been handled in the previous loop, hence we resolve its value
             other_constant_term = other_constant_term +
-                interval_t{(int)term.second} * (*slacks)[term.first].to_interval();
+                interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
+        }
+        else if (_symbol_terms.find(term.first) == _symbol_terms.end()
+          || term.second != _symbol_terms.at(term.first)) {
+            return expression_t();
         }
     }
+    // in case there are different slack variables in the two expressions, we can't merge them,
+    // so we construct a new slack variable and assign its value to the join of added intervals
     symbol_t new_slack = symbol_t::make();
     new_terms[new_slack] = 1;
     (*slacks)[new_slack] = constant_term | other_constant_term;
@@ -154,9 +198,10 @@ expression_t expression_t::operator|(const expression_t &other) const {
 
 void expression_t::write(std::ostream &o) const {
     size_t i = 0;
+    // print all symbol terms
     for (const auto &term : _symbol_terms) {
         if (term.second != 1) {
-            o << (int)term.second << " * ";
+            o << static_cast<int>(term.second) << " * ";
         }
         o << term.first;
         if (i < _symbol_terms.size() - 1) {
@@ -164,13 +209,17 @@ void expression_t::write(std::ostream &o) const {
         }
         i++;
     }
+    // print constant term
     if (auto s = _constant_term.singleton()) {
+        // print constant (singleton) term either if it is not zero,
+        // of if it is zero but there are no other terms
         if ((cpp_int)*s != 0 || _symbol_terms.empty()) {
             if (!_symbol_terms.empty()) o << " + ";
             o <<  *s;
         }
     } else {
-        o << " + " << _constant_term;
+        if (!_symbol_terms.empty()) o << " + ";
+        o << _constant_term;
     }
 }
 

From acbf9cad4df33542df9110e19d4bffdf99bb6ec2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 20 Nov 2024 09:29:18 -0500
Subject: [PATCH 320/373] Some refactoring in constraint_t class

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp | 2 ++
 src/crab/constraint.hpp | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 44471edd8..0d7688c9c 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -8,6 +8,7 @@ std::ostream &operator<<(std::ostream &o, const constraint_t &c) {
     return o;
 }
 
+// if a certain symbol is present in the constraint
 bool constraint_t::contains(const symbol_t &s) const {
     return _lhs.contains(s) || _rhs.contains(s);
 }
@@ -18,6 +19,7 @@ void constraint_t::normalize() {
     _rhs = expression_t(0);
 }
 
+// get slack intervals for all symbols in the constraint
 std::vector<std::pair<symbol_t, interval_t>> constraint_t::get_slack_intervals() const {
     std::vector<std::pair<symbol_t, interval_t>> result = _lhs.get_slack_intervals();
     auto rhs_intervals = _rhs.get_slack_intervals();
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 3009986c7..3559ffc6b 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -16,8 +16,8 @@ class constraint_t {
     constraint_t(expression_t lhs, expression_t rhs)
         : _lhs(lhs), _rhs(rhs) {}
 
-    expression_t get_lhs() const { return _lhs; }
-    expression_t get_rhs() const { return _rhs; }
+    [[nodiscard]] expression_t get_lhs() const { return _lhs; }
+    [[nodiscard]] expression_t get_rhs() const { return _rhs; }
 
     constraint_t operator+(const constraint_t&) const;    
     constraint_t operator+(int) const;

From a340be00cf59494950a406cbfca94630713e53e2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 20 Nov 2024 11:16:33 -0500
Subject: [PATCH 321/373] Refactoring and minor changes

Code simplification and minor changes to Offset Domain, refinement, and
expression classes

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.hpp    | 20 +++++---------
 src/crab/offset_domain.cpp | 53 +++++++++++++++-----------------------
 src/crab/offset_domain.hpp |  4 +--
 src/crab/refinement.cpp    | 23 ++++++++---------
 src/crab/refinement.hpp    | 20 ++++++--------
 5 files changed, 48 insertions(+), 72 deletions(-)

diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index a5b2b031d..4837f86dc 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -23,16 +23,16 @@ class expression_t {
 
   public:
     expression_t() : _constant_term(interval_t::top()) {};
-    expression_t(symbol_terms_t symbol_terms, interval_t interval = interval_t{0})
+    expression_t(symbol_terms_t symbol_terms, interval_t interval)
         : _symbol_terms(symbol_terms), _constant_term(interval) {}
-    expression_t(symbol_t symbol, std::shared_ptr<slacks_t> slacks)
+    expression_t(symbol_t symbol, std::shared_ptr<slacks_t> slacks = nullptr)
         : _constant_term(interval_t{0}), _slacks(slacks) {
         _symbol_terms[symbol] = 1;
     }
     expression_t(symbol_terms_t symbol_terms, interval_t interval,
             std::shared_ptr<slacks_t> slacks)
         : _symbol_terms(symbol_terms), _constant_term(interval), _slacks(slacks) {}
-    expression_t(symbol_terms_t symbol_terms, std::shared_ptr<slacks_t> slacks)
+    expression_t(symbol_terms_t symbol_terms, std::shared_ptr<slacks_t> slacks = nullptr)
         : _symbol_terms(symbol_terms), _constant_term{interval_t{0}}, _slacks(slacks) {}
     expression_t(interval_t interval)
         : _constant_term(interval) {}
@@ -66,23 +66,15 @@ class expression_t {
     std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
 
     static expression_t begin() {
-        return expression_t({std::make_pair(symbol_t::begin(), 1)});
+        return expression_t(symbol_t::begin());
     }
 
     static expression_t end() {
-        return expression_t({std::make_pair(symbol_t::end(), 1)});
+        return expression_t(symbol_t::end());
     }
 
     static expression_t meta() {
-        return expression_t({std::make_pair(symbol_t::meta(), 1)});
-    }
-
-    static expression_t nu() {
-        return expression_t({std::make_pair(symbol_t::nu(), 1)});
-    }
-
-    static expression_t make_slack() {
-        return expression_t({std::make_pair(symbol_t::make(), 1)});
+        return expression_t(symbol_t::meta());
     }
 };
 
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 6f52d3719..6140cb38f 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -7,7 +7,6 @@ namespace crab {
 
 void registers_state_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
     reg_with_loc_t reg_with_loc{reg, loc};
-    rf.get_value().set_slacks(m_slacks);
     (*m_offset_env)[reg_with_loc] = std::move(rf);
     m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
 }
@@ -126,7 +125,7 @@ void registers_state_t::scratch_caller_saved_registers() {
 void registers_state_t::forget_packet_pointers(location_t loc) {
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-1; r++) {
         if (auto it = find(register_t{r})) {
-            if (it->get_type() == data_type_t::PACKET) {
+            if (it->get_type() == refinement_type_t::PACKET) {
                 operator-=(register_t{r});
             }
         }
@@ -209,21 +208,15 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
     return stack_state_t(std::move(out_stack_rfs));
 }
 
-ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
+ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
     if (desc->data >= 0) {
-        refinement_t rf = refinement_t(data_type_t::PACKET,
-                expression_t(symbol_t::begin(), slacks));
-        m_rfs[desc->data] = std::move(rf);
+        m_rfs[desc->data] = refinement_t::begin();
     }
     if (desc->end >= 0) {
-        refinement_t rf = refinement_t(data_type_t::PACKET,
-                expression_t(symbol_t::end(), slacks));
-        m_rfs[desc->end] = std::move(rf);
+        m_rfs[desc->end] = refinement_t::end();
     }
     if (desc->meta >= 0) {
-        refinement_t rf = refinement_t(data_type_t::PACKET,
-                expression_t(symbol_t::meta(), slacks));
-        m_rfs[desc->meta] = std::move(rf);
+        m_rfs[desc->meta] = refinement_t::meta();
     }
     if (desc->size >= 0) {
         m_size = desc->size;
@@ -241,13 +234,12 @@ std::optional<refinement_t> ctx_offsets_t::find(int key) const {
 }
 
 offset_domain_t&& offset_domain_t::setup_entry() {
-    auto slacks = std::make_shared<slacks_t>();
-    std::shared_ptr<ctx_offsets_t> ctx
-        = std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor, slacks);
     registers_state_t regs(std::make_shared<global_offset_env_t>(),
-            slacks, global_program_info->type.context_descriptor);
+                      std::make_shared<slacks_t>(),
+                      global_program_info->type.context_descriptor);
 
-    static offset_domain_t off_d(std::move(regs), stack_state_t::top(), ctx);
+    static offset_domain_t off_d(std::move(regs), stack_state_t::top(),
+                      std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor));
     return std::move(off_d);
 }
 
@@ -432,9 +424,9 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
 static void create_numeric_refinement(registers_state_t& reg_state, mock_interval_t&& interval,
         location_t loc, register_t reg) {
     symbol_t s = symbol_t::make();
-    refinement_t rf = refinement_t(data_type_t::NUM, expression_t(s, reg_state.get_slacks()));
-    reg_state.insert(reg, loc, std::move(rf));
     reg_state.insert_slack_value(s, std::move(interval));
+    refinement_t rf = refinement_t(refinement_type_t::NUM, expression_t(s, reg_state.get_slacks()));
+    reg_state.insert(reg, loc, std::move(rf));
 }
 
 void offset_domain_t::do_bin(const Bin& bin,
@@ -457,10 +449,11 @@ void offset_domain_t::do_bin(const Bin& bin,
             // Use only the low 32 bits of the value.
             imm = static_cast<int>(std::get<Imm>(bin.v).v);
         }
-        auto imm_interval = interval_t{number_t{imm}};
+        auto imm_interval = interval_t{imm};
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm
+                // we just get the value of the immediate as an interval from interval domain
                 create_numeric_refinement(m_reg_state, std::move(interval_result),
                         loc, dst_register);
                 break;
@@ -469,7 +462,7 @@ void offset_domain_t::do_bin(const Bin& bin,
                 // ra += imm
                 if (imm == 0) break;
                 if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
-                    auto rf = *dst_rf_opt + imm;
+                    auto rf = *dst_rf_opt + imm_interval;
                     m_reg_state.insert(dst_register, loc, std::move(rf));
                 }
                 else {
@@ -481,7 +474,7 @@ void offset_domain_t::do_bin(const Bin& bin,
                 // ra -= imm
                 if (imm == 0) break;
                 if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
-                    auto rf = *dst_rf_opt + (-imm);
+                    auto rf = *dst_rf_opt + (-imm_interval);
                     m_reg_state.insert(dst_register, loc, std::move(rf));
                 }
                 else {
@@ -491,11 +484,8 @@ void offset_domain_t::do_bin(const Bin& bin,
             }
             default: {
                 if (dst_signed_interval_opt) {
-                    symbol_t s = symbol_t::make();
-                    refinement_t rf = refinement_t(data_type_t::NUM,
-                            expression_t(s, m_reg_state.get_slacks()));
-                    m_reg_state.insert(dst_register, loc, std::move(rf));
-                    m_reg_state.insert_slack_value(s, interval_result);
+                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                            loc, dst_register);
                 }
                 else {
                     // no other operations supported for packet pointers in the offset domain
@@ -511,8 +501,7 @@ void offset_domain_t::do_bin(const Bin& bin,
             case Op::MOV: {
                 // ra = rb
                 if (auto src_rf_opt = m_reg_state.find(src.v)) {
-                    auto rf = *src_rf_opt;
-                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                    m_reg_state.insert(dst_register, loc, std::move(*src_rf_opt));
                 }
                 else {
                     m_reg_state -= dst_register;
@@ -679,9 +668,9 @@ void offset_domain_t::do_mem_store(const Mem& b,
     }
     else {
         symbol_t s = symbol_t::make();
-        rf_info = refinement_t(data_type_t::NUM, expression_t(s, m_reg_state.get_slacks()));
-        auto mock_interval = mock_interval_t{bound_t{(uint64_t)std::get<Imm>(b.value).v}};
-        m_reg_state.insert_slack_value(s, std::move(mock_interval));
+        rf_info = refinement_t(refinement_type_t::NUM, expression_t(s, m_reg_state.get_slacks()));
+        interval_t interval = interval_t{number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}};
+        m_reg_state.insert_slack_value(s, std::move(interval));
     }
     if (!rf_info) return;
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index e250f3425..4ec57f66c 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -29,7 +29,7 @@ class registers_state_t {
                 bool is_bottom = false)
             : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {
 
-            auto loc = std::make_pair(label_t::entry, (unsigned int)0);
+            auto loc = std::make_pair(label_t::entry, static_cast<unsigned int>(0));
             if (desc->data >= 0) {
                 insert(register_t{12}, loc, refinement_t::begin());
             }
@@ -89,7 +89,7 @@ class ctx_offsets_t {
     int m_size;
 
     public:
-        ctx_offsets_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t>);
+        ctx_offsets_t(const ebpf_context_descriptor_t* desc);
         std::optional<refinement_t> find(int) const;
         int get_size() const;
 };
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 7e383875d..54a5a5ba3 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -70,21 +70,20 @@ bool refinement_t::has_value(refinement_t&& other) const {
 }
 
 void refinement_t::write(std::ostream& o) const {
-    symbol_t nu = symbol_t::nu();
-    o << "{" << nu << " : ";
-    if (_type == data_type_t::NUM) {
+    o << "{" << symbol_t::nu() << " : ";
+    if (_type == refinement_type_t::NUM) {
         o << "num<" << _value << ">";
     }
-    else if (_type == data_type_t::PACKET) {
+    else if (_type == refinement_type_t::PACKET) {
         o << "pkt<" << _value << ">";
     }
     else {
         o << "_";
     }
-    if (_constraints.size() > 0 || _value.get_slack_intervals().size() > 0) {
+    std::vector<std::pair<symbol_t, interval_t>> slack_intervals = _value.get_slack_intervals();
+    if (_constraints.size() > 0 || slack_intervals.size() > 0) {
         o << " | ";
     }
-    std::vector<std::pair<symbol_t, interval_t>> slack_intervals = get_value().get_slack_intervals();
     if (_constraints.size() > 0) {
         for (size_t i = 0; i < _constraints.size(); i++) {
             auto c = _constraints[i];
@@ -131,9 +130,9 @@ refinement_t refinement_t::operator+(const refinement_t &other) const {
     new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
     new_constraints.insert(new_constraints.end(),
             other._constraints.begin(), other._constraints.end());
-    data_type_t new_type = (_type == other._type) ? _type
-        : (_type == data_type_t::PACKET || other._type == data_type_t::PACKET) ? data_type_t::PACKET
-        : data_type_t::ANY;
+    refinement_type_t new_type = (_type == other._type) ? _type
+        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET) ? refinement_type_t::PACKET
+        : refinement_type_t::ANY;
     return refinement_t(new_type, new_value, new_constraints);
 }
 
@@ -201,9 +200,9 @@ refinement_t refinement_t::operator-(const refinement_t &other) const {
     new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
     new_constraints.insert(new_constraints.end(),
             other._constraints.begin(), other._constraints.end());
-    data_type_t new_type = (_type == other._type) ? data_type_t::NUM
-        : (_type == data_type_t::PACKET || other._type == data_type_t::PACKET) ? data_type_t::PACKET
-        : data_type_t::ANY;
+    refinement_type_t new_type = (_type == other._type) ? refinement_type_t::NUM
+        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET) ? refinement_type_t::PACKET
+        : refinement_type_t::ANY;
     return refinement_t(new_type, new_value, new_constraints);
 }
 
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 7563138ca..4c89fd58f 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -6,29 +6,29 @@
 
 namespace crab {
 
-enum class data_type_t {
+enum class refinement_type_t {
     NUM,
     PACKET,
     ANY
 };
 
 class refinement_t {
-    data_type_t _type;
+    refinement_type_t _type;
     expression_t _value;
     std::vector<crab::constraint_t> _constraints;
 
   public:
-    explicit refinement_t(data_type_t type, expression_t value,
+    explicit refinement_t(refinement_type_t type, expression_t value,
             std::vector<crab::constraint_t> constraints = {})
         : _type(type), _value(value) {
         for (auto &&c : constraints) {
             add_constraint(std::move(c));
         }
     }
-    refinement_t() : _type(data_type_t::ANY) {}
+    refinement_t() : _type(refinement_type_t::ANY) {}
  
     bool is_bottom();
-    [[nodiscard]] data_type_t get_type() const { return _type; }
+    [[nodiscard]] refinement_type_t get_type() const { return _type; }
     [[nodiscard]] std::vector<crab::constraint_t> get_constraints() const { return _constraints; }
     [[nodiscard]] expression_t get_value() const { return _value; }
     refinement_t operator+(int n) const;
@@ -47,19 +47,15 @@ class refinement_t {
             const std::vector<constraint_t>&) const;
 
     static refinement_t begin() {
-        return refinement_t(data_type_t::PACKET, expression_t::begin());
+        return refinement_t(refinement_type_t::PACKET, expression_t::begin());
     }
 
     static refinement_t end() {
-        return refinement_t(data_type_t::PACKET, expression_t::end());
+        return refinement_t(refinement_type_t::PACKET, expression_t::end());
     }
 
     static refinement_t meta() {
-        return refinement_t(data_type_t::PACKET, expression_t::meta());
-    }
-
-    static refinement_t make_slack() {
-        return refinement_t(data_type_t::NUM, expression_t::make_slack());
+        return refinement_t(refinement_type_t::PACKET, expression_t::meta());
     }
 };
 

From db94589b9859e917f872223b0df5c1d732aeb77b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 20 Nov 2024 12:36:53 -0500
Subject: [PATCH 322/373] Refactoring in refinement_t class

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 54a5a5ba3..3fe3c7f0a 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -81,10 +81,10 @@ void refinement_t::write(std::ostream& o) const {
         o << "_";
     }
     std::vector<std::pair<symbol_t, interval_t>> slack_intervals = _value.get_slack_intervals();
-    if (_constraints.size() > 0 || slack_intervals.size() > 0) {
+    if (!_constraints.empty() || !slack_intervals.empty()) {
         o << " | ";
     }
-    if (_constraints.size() > 0) {
+    if (!_constraints.empty()) {
         for (size_t i = 0; i < _constraints.size(); i++) {
             auto c = _constraints[i];
             auto c_slack_intervals = c.get_slack_intervals();
@@ -97,8 +97,8 @@ void refinement_t::write(std::ostream& o) const {
         }
     }
     std::set<symbol_t> seen;
-    if (slack_intervals.size() > 0) {
-        if (_constraints.size() > 0) {
+    if (!slack_intervals.empty()) {
+        if (!_constraints.empty()) {
             o << " & ";
         }
         for (auto [s, i] : slack_intervals) {
@@ -131,11 +131,12 @@ refinement_t refinement_t::operator+(const refinement_t &other) const {
     new_constraints.insert(new_constraints.end(),
             other._constraints.begin(), other._constraints.end());
     refinement_type_t new_type = (_type == other._type) ? _type
-        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET) ? refinement_type_t::PACKET
-        : refinement_type_t::ANY;
+        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
+          ? refinement_type_t::PACKET : refinement_type_t::ANY;
     return refinement_t(new_type, new_value, new_constraints);
 }
 
+// use the constraints to compute a value for the subtraction, if possible
 interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src,
         const std::vector<constraint_t>& constraints) const {
     bound_t max_packet_size = bound_t{number_t{MAX_PACKET_SIZE}};
@@ -201,8 +202,8 @@ refinement_t refinement_t::operator-(const refinement_t &other) const {
     new_constraints.insert(new_constraints.end(),
             other._constraints.begin(), other._constraints.end());
     refinement_type_t new_type = (_type == other._type) ? refinement_type_t::NUM
-        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET) ? refinement_type_t::PACKET
-        : refinement_type_t::ANY;
+        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
+          ? refinement_type_t::PACKET : refinement_type_t::ANY;
     return refinement_t(new_type, new_value, new_constraints);
 }
 

From 49f63a6e114e17795c3639354df0c66e872b837f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 27 Nov 2024 23:34:08 -0500
Subject: [PATCH 323/373] Refactoring in basic classes

Changed the structure for register_t and location_t to be classes, and
replaced reg_with_loc_t with register_location_t;
Moved these classes to a separate utils file for better readability;
Moved the types-related content to types files;
Added a structure to keep track in type_inference for all registers, to make
sure that at any point, a register only keeps one type (to be added in
future);
Some dependency cleanup and refactoring;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.hpp          |  54 ++++++-------
 src/crab/ebpf_domain.cpp              |   1 +
 src/crab/ebpf_domain.hpp              |  53 +++++++------
 src/crab/expression.hpp               |   3 +-
 src/crab/interval_domain.cpp          |   8 +-
 src/crab/interval_domain.hpp          |  32 ++++----
 src/crab/offset_domain.cpp            |  20 ++---
 src/crab/offset_domain.hpp            |  41 +++++-----
 src/crab/region_domain.cpp            |  36 ++++-----
 src/crab/region_domain.hpp            |  45 +++++------
 src/crab/register_utils.cpp           |  55 +++++++++++++
 src/crab/register_utils.hpp           |  68 +++++++++++++++++
 src/crab/signed_interval_domain.cpp   |  18 ++---
 src/crab/signed_interval_domain.hpp   |  38 ++++-----
 src/crab/type_inference.cpp           |  51 ++++++-------
 src/crab/type_inference.hpp           |  61 ++++++++-------
 src/crab/type_ostream.hpp             |   1 -
 src/crab/{common.cpp => types.cpp}    |  64 +++-------------
 src/crab/{common.hpp => types.hpp}    | 106 ++++++++++----------------
 src/crab/unsigned_interval_domain.cpp |  18 ++---
 src/crab/unsigned_interval_domain.hpp |  34 +++++----
 21 files changed, 431 insertions(+), 376 deletions(-)
 create mode 100644 src/crab/register_utils.cpp
 create mode 100644 src/crab/register_utils.hpp
 rename src/crab/{common.cpp => types.cpp} (66%)
 rename src/crab/{common.hpp => types.hpp} (72%)

diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index de6db04d0..305d2c466 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -1,13 +1,15 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
 #pragma once
 
-#include <boost/optional/optional.hpp>
 #include "cfg.hpp"
-#include "linear_constraint.hpp"
-#include "string_constraints.hpp"
+#include "register_utils.hpp"
 
 #include "array_domain.hpp"
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using location_t = boost::optional<std::pair<label_t, uint32_t>>;
+using crab::location_t;
+
 class abstract_domain_t {
   private:
     class abstract_domain_concept {
@@ -78,17 +80,17 @@ class abstract_domain_t {
         std::unique_ptr<abstract_domain_concept> widen(const abstract_domain_concept& abs, bool) override;
         std::unique_ptr<abstract_domain_concept> narrow(const abstract_domain_concept& abs) const override;
         void operator()(const basic_block_t& bb) override;
-        void operator()(const Undefined& s, location_t loc = boost::none) override;
-        void operator()(const Bin& s, location_t loc = boost::none) override;
-        void operator()(const Un& s, location_t loc = boost::none) override;
-        void operator()(const LoadMapFd& s, location_t loc = boost::none) override;
-        void operator()(const Call& s, location_t loc = boost::none) override;
-        void operator()(const Exit& s, location_t loc = boost::none) override;
-        void operator()(const Jmp& s, location_t loc = boost::none) override;
-        void operator()(const Mem& s, location_t loc = boost::none) override;
-        void operator()(const Packet& s, location_t loc = boost::none) override;
-        void operator()(const Assume& s, location_t loc = boost::none) override;
-        void operator()(const Assert& s, location_t loc = boost::none) override;
+        void operator()(const Undefined& s, location_t loc = location_t::top()) override;
+        void operator()(const Bin& s, location_t loc = location_t::top()) override;
+        void operator()(const Un& s, location_t loc = location_t::top()) override;
+        void operator()(const LoadMapFd& s, location_t loc = location_t::top()) override;
+        void operator()(const Call& s, location_t loc = location_t::top()) override;
+        void operator()(const Exit& s, location_t loc = location_t::top()) override;
+        void operator()(const Jmp& s, location_t loc = location_t::top()) override;
+        void operator()(const Mem& s, location_t loc = location_t::top()) override;
+        void operator()(const Packet& s, location_t loc = location_t::top()) override;
+        void operator()(const Assume& s, location_t loc = location_t::top()) override;
+        void operator()(const Assert& s, location_t loc = location_t::top()) override;
         void write(std::ostream& os) const override;
         void initialize_loop_counter(const label_t) override;
         crab::bound_t get_loop_count_upper_bound() const override;
@@ -124,17 +126,17 @@ class abstract_domain_t {
     abstract_domain_t widen(const abstract_domain_t& abs, bool);
     abstract_domain_t narrow(const abstract_domain_t& abs) const;
     void operator()(const basic_block_t& bb);
-    void operator()(const Undefined& s, location_t loc = boost::none);
-    void operator()(const Bin& s, location_t loc = boost::none);
-    void operator()(const Un& s, location_t loc = boost::none);
-    void operator()(const LoadMapFd& s, location_t loc = boost::none);
-    void operator()(const Call& s, location_t loc = boost::none);
-    void operator()(const Exit& s, location_t loc = boost::none);
-    void operator()(const Jmp& s, location_t loc = boost::none);
-    void operator()(const Mem& s, location_t loc = boost::none);
-    void operator()(const Packet& s, location_t loc = boost::none);
-    void operator()(const Assume& s, location_t loc = boost::none);
-    void operator()(const Assert& s, location_t loc = boost::none);
+    void operator()(const Undefined& s, location_t loc = location_t::top());
+    void operator()(const Bin& s, location_t loc = location_t::top());
+    void operator()(const Un& s, location_t loc = location_t::top());
+    void operator()(const LoadMapFd& s, location_t loc = location_t::top());
+    void operator()(const Call& s, location_t loc = location_t::top());
+    void operator()(const Exit& s, location_t loc = location_t::top());
+    void operator()(const Jmp& s, location_t loc = location_t::top());
+    void operator()(const Mem& s, location_t loc = location_t::top());
+    void operator()(const Packet& s, location_t loc = location_t::top());
+    void operator()(const Assume& s, location_t loc = location_t::top());
+    void operator()(const Assert& s, location_t loc = location_t::top());
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound() const;
     void initialize_loop_counter(const label_t);
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index a31163725..e9bba9689 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -19,6 +19,7 @@
 #include "dsl_syntax.hpp"
 #include "platform.hpp"
 #include "string_constraints.hpp"
+#include "register_utils.hpp"
 
 using crab::domains::NumAbsDomain;
 namespace crab {
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index ad6e70930..5f2700aba 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -17,7 +17,6 @@
 namespace crab {
 
 class ebpf_domain_t final {
-  using location_t = boost::optional<std::pair<label_t, uint32_t>>;
   public:
     ebpf_domain_t();
     ebpf_domain_t(NumAbsDomain inv, domains::array_domain_t stack);
@@ -54,32 +53,32 @@ class ebpf_domain_t final {
     // abstract transformers
     void operator()(const basic_block_t& bb);
 
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const CallLocal&, location_t loc = boost::none);
-    void operator()(const Callx&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const FuncConstraint&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const ValidCall&, location_t loc = boost::none);
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
+    void operator()(const Addable&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const CallLocal&, location_t loc = location_t::top());
+    void operator()(const Callx&, location_t loc = location_t::top());
+    void operator()(const Comparable&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const FuncConstraint&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Atomic&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const ValidDivisor&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const TypeConstraint&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const ValidAccess&, location_t loc = location_t::top());
+    void operator()(const ValidCall&, location_t loc = location_t::top());
+    void operator()(const ValidMapKeyValue&, location_t loc = location_t::top());
+    void operator()(const ValidSize&, location_t loc = location_t::top());
+    void operator()(const ValidStore&, location_t loc = location_t::top());
+    void operator()(const ZeroCtxOffset&, location_t loc = location_t::top());
+    void operator()(const IncrementLoopCounter&, location_t loc = location_t::top());
 
     // following operations are important to keep in ebpf_domain_t because of the parametric abstract domain
     void write(std::ostream& o) const;
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 4837f86dc..a51540898 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -5,8 +5,7 @@
 #include <map>
 #include <cassert>
 #include "symbol.hpp"
-#include "interval.hpp"
-#include "common.hpp"
+#include "types.hpp"
 
 namespace crab {
 // An expression is of form: Ax + By + Cz + ... + I.
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 40e97c424..9bddb43c5 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -99,12 +99,12 @@ std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_value(r
 }
 
 std::optional<mock_interval_t> interval_domain_t::find_signed_interval_at_loc(
-        const reg_with_loc_t reg) const {
+        const register_location_t reg) const {
     return m_signed.find_interval_at_loc(reg);
 }
 
 std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_at_loc(
-        const reg_with_loc_t reg) const {
+        const register_location_t reg) const {
     return m_unsigned.find_interval_at_loc(reg);
 }
 
@@ -116,7 +116,7 @@ void interval_domain_t::insert_in_registers(register_t reg, location_t loc, inte
 void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
         interval_t interval) {
     m_signed.insert_in_registers(reg, loc, interval);
-    //auto v = m_unsigned.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    //auto v = m_unsigned.find_interval_at_loc(register_location_t{reg, loc});
     //if (!v) {
     //    m_unsigned.insert_in_registers(reg, loc, interval_t::top());
     //}
@@ -125,7 +125,7 @@ void interval_domain_t::insert_in_registers_signed(register_t reg, location_t lo
 void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
         interval_t interval) {
     m_unsigned.insert_in_registers(reg, loc, interval);
-    //auto v = m_signed.find_interval_at_loc(reg_with_loc_t{reg, loc});
+    //auto v = m_signed.find_interval_at_loc(register_location_t{reg, loc});
     //if (!v) {
     //    m_signed.insert_in_registers(reg, loc, interval_t::top());
     //}
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 8f273f3c2..cd56e0278 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -3,12 +3,12 @@
 
 #pragma once
 
-#include "crab/common.hpp"
-#include "crab/signed_interval_domain.hpp"
-#include "crab/unsigned_interval_domain.hpp"
+#include "signed_interval_domain.hpp"
+#include "unsigned_interval_domain.hpp"
 
 namespace crab {
 
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 enum class arith_binaryop_t { ADD, SUB, MUL, SDIV, UDIV, SREM, UREM };
 enum class bitwise_binaryop_t { AND, OR, XOR, SHL, LSHR, ASHR };
 using binaryop_t = std::variant<arith_binaryop_t, bitwise_binaryop_t>;
@@ -109,17 +109,17 @@ class interval_domain_t final {
     void lshr(const register_t&, int, const int, location_t);
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
     void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound() const;
@@ -157,8 +157,8 @@ class interval_domain_t final {
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_signed_interval_value(register_t) const;
     std::optional<mock_interval_t> find_unsigned_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_signed_interval_at_loc(const reg_with_loc_t reg) const;
-    std::optional<mock_interval_t> find_unsigned_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<mock_interval_t> find_signed_interval_at_loc(const register_location_t reg) const;
+    std::optional<mock_interval_t> find_unsigned_interval_at_loc(const register_location_t reg) const;
     std::optional<interval_cells_t> find_in_stack_signed(uint64_t) const;
     std::optional<interval_cells_t> find_in_stack_unsigned(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 6140cb38f..0966225b4 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -1,21 +1,21 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "crab/offset_domain.hpp"
+#include "offset_domain.hpp"
 
 namespace crab {
 
 void registers_state_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
-    reg_with_loc_t reg_with_loc{reg, loc};
-    (*m_offset_env)[reg_with_loc] = std::move(rf);
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+    register_location_t register_location{reg, loc};
+    (*m_offset_env)[register_location] = std::move(rf);
+    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
 void registers_state_t::insert_slack_value(symbol_t sym, mock_interval_t in) {
     (*m_slacks)[sym] = std::move(in);
 }
 
-std::optional<refinement_t> registers_state_t::find(reg_with_loc_t reg) const {
+std::optional<refinement_t> registers_state_t::find(register_location_t reg) const {
     auto it = m_offset_env->find(reg);
     if (it == m_offset_env->end()) return {};
     return it->second;
@@ -92,9 +92,9 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
     }
 
     registers_state_t joined_state(m_offset_env, m_slacks);
-    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
+    location_t loc = location_t::top();
 
-    for (uint8_t i = 0; i < NUM_REGISTERS+1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -109,7 +109,7 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
 }
 
 void registers_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS+1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, std::move(*it));
         }
@@ -123,7 +123,7 @@ void registers_state_t::scratch_caller_saved_registers() {
 }
 
 void registers_state_t::forget_packet_pointers(location_t loc) {
-    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-1; r++) {
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (auto it = find(register_t{r})) {
             if (it->get_type() == refinement_type_t::PACKET) {
                 operator-=(register_t{r});
@@ -739,7 +739,7 @@ void offset_domain_t::operator()(const Mem& b, location_t loc) {
     // nothing to do here
 }
 
-std::optional<refinement_t> offset_domain_t::find_refinement_at_loc(const reg_with_loc_t reg) const {
+std::optional<refinement_t> offset_domain_t::find_refinement_at_loc(const register_location_t reg) const {
     return m_reg_state.find(reg);
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 4ec57f66c..fe5b07f79 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -3,13 +3,14 @@
 
 #pragma once
 
-#include "crab/refinement.hpp"
+#include "array_domain.hpp"
+#include "refinement.hpp"
 
 namespace crab {
 
-// +1 for v_begin
-using live_refinements_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS+1>;
-using global_offset_env_t = std::unordered_map<reg_with_loc_t, refinement_t>;
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
+using live_refinements_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
+using global_offset_env_t = std::unordered_map<register_location_t, refinement_t>;
 
 class registers_state_t {
 
@@ -29,7 +30,7 @@ class registers_state_t {
                 bool is_bottom = false)
             : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {
 
-            auto loc = std::make_pair(label_t::entry, static_cast<unsigned int>(0));
+            location_t loc{label_t::entry, 0};
             if (desc->data >= 0) {
                 insert(register_t{12}, loc, refinement_t::begin());
             }
@@ -51,7 +52,7 @@ class registers_state_t {
         void insert_slack_value(symbol_t, mock_interval_t);
         std::shared_ptr<slacks_t> get_slacks() const { return m_slacks; }
         std::optional<mock_interval_t> find_slack_value(symbol_t) const;
-        std::optional<refinement_t> find(reg_with_loc_t reg) const;
+        std::optional<refinement_t> find(register_location_t reg) const;
         std::optional<refinement_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
         void adjust_bb_for_registers(location_t);
@@ -136,19 +137,19 @@ class offset_domain_t final {
     void operator-=(register_t reg) { m_reg_state -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none) {}
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {};
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Atomic&, location_t loc = location_t::top()) {}
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
+    void operator()(const IncrementLoopCounter&, location_t loc = location_t::top()) {};
     void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     std::string domain_name() const;
@@ -172,7 +173,7 @@ class offset_domain_t final {
 
     std::optional<refinement_t> find_in_ctx(int) const;
     std::optional<refinement_cells_t> find_in_stack(int) const;
-    std::optional<refinement_t> find_refinement_at_loc(const reg_with_loc_t) const;
+    std::optional<refinement_t> find_refinement_at_loc(const register_location_t) const;
     std::optional<refinement_t> find_refinement_info(register_t reg) const;
     void insert_in_registers(register_t, location_t, refinement_t);
     void store_in_stack(uint64_t, refinement_t, int);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index c28e6194f..466d6666f 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -87,7 +87,7 @@ void register_types_t::scratch_caller_saved_registers() {
 }
 
 void register_types_t::forget_packet_ptrs() {
-    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-1; r++) {
+    for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (is_packet_ptr(find(register_t{r}))) {
             operator-=(register_t{r});
         }
@@ -106,9 +106,9 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     // in join, we do not know the label of the bb, hence we store the information
     // at a bb that is not used anywhere else in the program, and later when we know
     // the bb label, we can fix
-    location_t loc = location_t{std::make_pair(label_t(-2, -2), 0)};
+    location_t loc = location_t::top();
 
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(register_t{i});
         auto maybe_ptr2 = other.find(register_t{i});
@@ -167,12 +167,12 @@ bool register_types_t::is_top() const {
 }
 
 void register_types_t::insert(register_t reg, const location_t& loc, const ptr_or_mapfd_t& type) {
-    reg_with_loc_t reg_with_loc = reg_with_loc_t{reg, loc};
-    (*m_region_env)[reg_with_loc] = type;
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+    register_location_t register_location = register_location_t{reg, loc};
+    (*m_region_env)[register_location] = type;
+    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<ptr_or_mapfd_t> register_types_t::find(reg_with_loc_t reg) const {
+std::optional<ptr_or_mapfd_t> register_types_t::find(register_location_t reg) const {
     auto it = m_region_env->find(reg);
     if (it == m_region_env->end()) return {};
     return it->second;
@@ -184,7 +184,7 @@ std::optional<ptr_or_mapfd_t> register_types_t::find(register_t key) const {
 }
 
 void register_types_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, *it);
         }
@@ -353,7 +353,7 @@ void region_domain_t::set_to_top() {
     m_registers.set_to_top();
 }
 
-std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_at_loc(const reg_with_loc_t& reg) const {
+std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_at_loc(const register_location_t& reg) const {
     return m_registers.find(reg);
 }
 
@@ -700,7 +700,7 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                         goto out;
                     }
                 } else {
-                    auto type = ptr_with_off_t(region_t::T_SHARED, -1,
+                    auto type = ptr_with_off_t(region_t::R_SHARED, -1,
                             interval_t{number_t{0}}, nullness_t::MAYBE_NULL,
                             get_map_value_size(*maybe_fd_reg));
                     set_aliases((int)r0, type);
@@ -709,7 +709,7 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
             }
         }
         else {
-            auto type = ptr_with_off_t(region_t::T_SHARED, -1, interval_t{number_t{0}},
+            auto type = ptr_with_off_t(region_t::R_SHARED, -1, interval_t{number_t{0}},
                     nullness_t::MAYBE_NULL);
             set_aliases((int)r0, type);
             m_registers.insert(r0, loc, type);
@@ -754,12 +754,12 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
             auto offset_to_check = offset.to_interval()+interval_t{s.offset};
             auto offset_lb = offset_to_check.lb();
             auto offset_plus_width_ub = offset_to_check.ub()+bound_t{width};
-            if (ptr_with_off_type.get_region() == region_t::T_STACK) {
+            if (ptr_with_off_type.get_region() == region_t::R_STACK) {
                 if (bound_t{STACK_BEGIN} <= offset_lb
                         && offset_plus_width_ub <= bound_t{EBPF_STACK_SIZE})
                     return;
             }
-            else if (ptr_with_off_type.get_region() == region_t::T_CTX) {
+            else if (ptr_with_off_type.get_region() == region_t::R_CTX) {
                 if (bound_t{CTX_BEGIN} <= offset_lb
                         && offset_plus_width_ub <= bound_t{ctx_size()})
                     return;
@@ -805,12 +805,12 @@ region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
 
     register_types_t typ(std::make_shared<global_region_env_t>());
 
-    auto loc = std::make_pair(label_t::entry, (unsigned int)0);
+    location_t loc{label_t::entry, 0};
     if (init_r1) {
-        auto ctx_ptr_r1 = ptr_with_off_t(region_t::T_CTX, -1, mock_interval_t{number_t{0}});
+        auto ctx_ptr_r1 = ptr_with_off_t(region_t::R_CTX, -1, mock_interval_t{number_t{0}});
         typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
     }
-    auto stack_ptr_r10 = ptr_with_off_t(region_t::T_STACK, -1,  mock_interval_t{number_t{512}});
+    auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
     static region_domain_t inv(std::move(typ), stack_t::top(), ctx);
@@ -839,13 +839,13 @@ void region_domain_t::check_type(const TypeConstraint& s,
             if (s.types == TypeGroup::pointer || s.types == TypeGroup::ptr_or_num) return;
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd_type)) {
                 ptr_with_off_t ptr_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd_type);
-                if (ptr_with_off.get_region() == crab::region_t::T_CTX) {
+                if (ptr_with_off.get_region() == crab::region_t::R_CTX) {
                     if (s.types == TypeGroup::singleton_ptr) return;
                     if (s.types == TypeGroup::ctx) return;
                 }
                 else {
                     if (s.types == TypeGroup::mem || s.types == TypeGroup::mem_or_num) return;
-                    if (ptr_with_off.get_region() == crab::region_t::T_SHARED) {
+                    if (ptr_with_off.get_region() == crab::region_t::R_SHARED) {
                         if (s.types == TypeGroup::shared) return;
                     }
                     else {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 5696d46d2..f37e27320 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -3,12 +3,13 @@
 
 #pragma once
 
-#include "crab/common.hpp"
-
+#include "array_domain.hpp"
+#include "types.hpp"
 #include "platform.hpp"
 
 namespace crab {
 
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 using shared_ptr_aliases_t = std::vector<std::set<int>>;
 
 class ctx_t {
@@ -53,8 +54,8 @@ class stack_t {
     size_t size() const;
 };
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
-using global_region_env_t = std::unordered_map<reg_with_loc_t, ptr_or_mapfd_t>;
+using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
+using global_region_env_t = std::unordered_map<register_location_t, ptr_or_mapfd_t>;
 
 class register_types_t {
 
@@ -79,7 +80,7 @@ class register_types_t {
     bool is_bottom() const;
     bool is_top() const;
     void insert(register_t, const location_t&, const ptr_or_mapfd_t&);
-    std::optional<ptr_or_mapfd_t> find(reg_with_loc_t reg) const;
+    std::optional<ptr_or_mapfd_t> find(register_location_t reg) const;
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
     [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
     void forget_packet_ptrs();
@@ -132,22 +133,22 @@ class region_domain_t final {
     void operator-=(register_t var) { m_registers -= var; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Atomic&, location_t loc = location_t::top());
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
+    void operator()(const ValidAccess&, location_t loc = location_t::top());
+    void operator()(const TypeConstraint&, location_t loc = location_t::top());
+    void operator()(const ZeroCtxOffset&, location_t loc = location_t::top());
+    void operator()(const IncrementLoopCounter&, location_t loc = location_t::top());
     void operator()(const basic_block_t& bb);
     void write(std::ostream& o) const {}
     crab::bound_t get_loop_count_upper_bound() const;
@@ -180,7 +181,7 @@ class region_domain_t final {
     std::optional<crab::packet_ptr_t> find_in_ctx(uint64_t key) const;
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
-    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     void insert_in_registers(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack(uint64_t, ptr_or_mapfd_t, int);
     void set_aliases(int, ptr_with_off_t&);
diff --git a/src/crab/register_utils.cpp b/src/crab/register_utils.cpp
new file mode 100644
index 000000000..385380a4b
--- /dev/null
+++ b/src/crab/register_utils.cpp
@@ -0,0 +1,55 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#include "register_utils.hpp"
+
+namespace crab {
+
+std::size_t register_t::hash() const {
+    return std::hash<uint8_t>{}(m_val);
+}
+
+std::ostream& operator<<(std::ostream& o, const register_t& p) {
+    o << "r" << (int)p;
+    return o;
+}
+
+bool location_t::operator==(const location_t& other) const {
+    return m_bb_label == other.m_bb_label && m_line_num == other.m_line_num;
+}
+
+void location_t::write(std::ostream& o) const {
+    o << m_line_num << " in " << m_bb_label << " ";
+}
+
+std::ostream& operator<<(std::ostream& o, const location_t& loc) {
+    loc.write(o);
+    return o;
+}
+
+std::size_t register_location_t::hash() const {
+    // Similar to boost::hash_combine
+    using std::hash;
+
+    std::size_t seed = m_reg.hash();
+    seed ^= hash<uint32_t>()(m_loc.m_line_num) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc.m_bb_label.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+    seed ^= hash<int>()(m_loc.m_bb_label.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
+
+    return seed;
+}
+
+bool register_location_t::operator==(const register_location_t& other) const {
+    return m_reg == other.m_reg && m_loc == other.m_loc;
+}
+
+void register_location_t::write(std::ostream& o) const {
+    o << m_reg << "@" << m_loc;
+}
+
+std::ostream& operator<<(std::ostream& o, const register_location_t& reg) {
+    reg.write(o);
+    return o;
+}
+
+} // namespace crab
diff --git a/src/crab/register_utils.hpp b/src/crab/register_utils.hpp
new file mode 100644
index 000000000..335e38669
--- /dev/null
+++ b/src/crab/register_utils.hpp
@@ -0,0 +1,68 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include "asm_syntax.hpp"
+
+namespace crab {
+
+// 11 registers for the eBPF ISA, 1 register used in offset domain to represent r_begin,
+// and 1 pseudo-register for the atomic operations
+constexpr uint8_t NUM_REGISTERS = 13;
+
+// Represents a register, e.g., r0, r1, ..., r_begin, etc.
+class register_t {
+    uint8_t m_val;
+
+  public:
+    register_t(uint8_t val) : m_val(val) {}
+    register_t() : m_val(NUM_REGISTERS+1) {}
+    std::size_t hash() const;
+    uint8_t operator()() const { return m_val; }
+    operator int() const { return static_cast<int>(m_val); }
+    friend std::ostream& operator<<(std::ostream& o, const register_t& p);
+};
+
+
+// Represents a location in the eBPF program, i.e., a basic block label and a line number
+// it is shown as 'line_num in bb_label'
+class location_t {
+  public:
+    label_t m_bb_label;
+    uint32_t m_line_num; // uint32_t is used to represent the line number in the eBPF program
+                       // which should be sufficient for ebpf
+    location_t(label_t _label, uint32_t _offset) : m_bb_label(_label), m_line_num(_offset) {}
+    location_t() : m_bb_label(-2, -2), m_line_num(0) {} // not a valid location
+    static location_t top() { return location_t(); }
+    bool operator==(const location_t& other) const;
+    friend std::ostream& operator<<(std::ostream& o, const location_t& loc);
+    void write(std::ostream& o) const;
+};
+
+// Represents a register and a location in the eBPF program
+// it is shown as 'r0@line_num in bb_label'
+class register_location_t {
+    register_t m_reg;
+    location_t m_loc;
+
+  public:
+    register_location_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
+    std::size_t hash() const;
+    bool operator==(const register_location_t& other) const;
+    friend std::ostream& operator<<(std::ostream& o, const register_location_t& reg);
+    void write(std::ostream& o) const;
+};
+
+
+} // namespace crab
+
+
+namespace std {
+    template <>
+    struct hash<crab::register_location_t> {
+        std::size_t operator()(const crab::register_location_t& reg) const {
+            return reg.hash();
+        }
+    };
+} // namespace std
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 9ce5e9c2a..dbc44ca68 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -31,12 +31,12 @@ void registers_signed_state_t::set_to_bottom() {
 }
 
 void registers_signed_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
-    auto reg_with_loc = reg_with_loc_t{reg, loc};
-    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+    auto register_location = register_location_t{reg, loc};
+    (*m_interval_env)[register_location] = mock_interval_t{interval};
+    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> registers_signed_state_t::find(reg_with_loc_t reg) const {
+std::optional<mock_interval_t> registers_signed_state_t::find(register_location_t reg) const {
     auto it = m_interval_env->find(reg);
     if (it == m_interval_env->end()) return {};
     return it->second;
@@ -44,7 +44,7 @@ std::optional<mock_interval_t> registers_signed_state_t::find(reg_with_loc_t reg
 
 std::optional<mock_interval_t> registers_signed_state_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    const register_location_t& reg = *(m_cur_def[key]);
     return find(reg);
 }
 
@@ -55,8 +55,8 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
         return *this;
     }
     registers_signed_state_t intervals_joined(m_interval_env);
-    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    location_t loc = location_t::top();
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -70,7 +70,7 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
 }
 
 void registers_signed_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
         }
@@ -339,7 +339,7 @@ std::optional<mock_interval_t> signed_interval_domain_t::find_interval_value(reg
 }
 
 std::optional<mock_interval_t> signed_interval_domain_t::find_interval_at_loc(
-        const reg_with_loc_t reg) const {
+        const register_location_t reg) const {
     return m_registers_values.find(reg);
 }
 
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 0c48eb2a2..464e5e024 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -3,12 +3,14 @@
 
 #pragma once
 
-#include "crab/common.hpp"
+#include "array_domain.hpp"
+#include "types.hpp"
 
 namespace crab {
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
-using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
+using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
+using global_interval_env_t = std::unordered_map<register_location_t, mock_interval_t>;
 
 class registers_signed_state_t {
 
@@ -22,7 +24,7 @@ class registers_signed_state_t {
         void set_to_bottom();
         void set_to_top();
         void set_registers_to_bottom();
-        std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
+        std::optional<mock_interval_t> find(register_location_t reg) const;
         std::optional<mock_interval_t> find(register_t key) const;
         void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
@@ -112,19 +114,19 @@ class signed_interval_domain_t final {
     void operator-=(register_t reg) { m_registers_values -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none) {}
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none) {}
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Atomic&, location_t loc = location_t::top()) {}
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
+    void operator()(const IncrementLoopCounter&, location_t loc = location_t::top()) {}
     void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const {}
     crab::bound_t get_loop_count_upper_bound() const;
@@ -134,7 +136,7 @@ class signed_interval_domain_t final {
 
     void check_valid_access(const ValidAccess&, interval_t&&, int, bool);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
     void store_in_stack(uint64_t, mock_interval_t, int);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 85eb06341..b2eb0b259 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -105,7 +105,7 @@ crab::bound_t inference_domain_t::get_loop_count_upper_bound() const {
 string_invariant inference_domain_t::to_set() const {
     if (is_top()) return string_invariant::top();
     std::set<std::string> result;
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
         auto maybe_rf = m_offset.find_refinement_info(register_t{i});
         if (maybe_ptr_or_mapfd.has_value()) {
@@ -330,6 +330,7 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
         const auto& maybe_right_interval = m_interval.find_interval_value(right_reg.v);
         assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
+        // TODO: it does not handle for mapfd yet
         if (same_type(maybe_left_type, maybe_right_type,
                     maybe_left_interval, maybe_right_interval)) {
             if (maybe_left_interval) {
@@ -456,8 +457,7 @@ void inference_domain_t::operator()(const Comparable& u, location_t loc) {
     assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
     if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
         if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
-        if (!is_shared_ptr(maybe_ptr_or_mapfd1)
-                && same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
+        if (same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
     }
     else if (!maybe_ptr_or_mapfd2) {
         // TODO: interval check here
@@ -628,8 +628,7 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
                     subtracted = m_offset.compute_packet_subtraction(dst_reg, src_reg);
                 }
                 else {
-                    // Assertions should make sure we only perform this on
-                    // non-shared pointers, hence this should not happen
+                    // This should not happen as same_region only allows non-shared pointers
                     m_errors.push_back("subtraction between pointers of different region");
                 }
             }
@@ -761,11 +760,11 @@ void inference_domain_t::operator()(const basic_block_t& bb) {
 
     auto label = bb.label();
     uint32_t curr_pos = 0;
-    location_t loc = location_t(std::make_pair(label, curr_pos));
+    location_t loc{label, curr_pos};
     adjust_bb_for_types(loc);
 
     for (const Instruction& statement : bb) {
-        loc = location_t(std::make_pair(label, ++curr_pos));
+        loc = location_t(label, ++curr_pos);
         std::visit([this, loc](const auto& v) { std::apply(*this, std::make_tuple(v, loc)); }, statement);
     }
 
@@ -775,31 +774,31 @@ void inference_domain_t::operator()(const basic_block_t& bb) {
 }
 
 std::optional<crab::ptr_or_mapfd_t>
-inference_domain_t::find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_ptr_or_mapfd_at_loc(const crab::register_location_t& loc) const {
     return m_region.find_ptr_or_mapfd_at_loc(loc);
 }
 
 std::optional<crab::refinement_t>
-inference_domain_t::find_refinement_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_refinement_at_loc(const crab::register_location_t& loc) const {
     return m_offset.find_refinement_at_loc(loc);
 }
 
 std::optional<crab::mock_interval_t>
-inference_domain_t::find_signed_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_signed_interval_at_loc(const crab::register_location_t& loc) const {
     return m_interval.find_signed_interval_at_loc(loc);
 }
 
 std::optional<crab::mock_interval_t>
-inference_domain_t::find_unsigned_interval_at_loc(const crab::reg_with_loc_t& loc) const {
+inference_domain_t::find_unsigned_interval_at_loc(const crab::register_location_t& loc) const {
     return m_interval.find_unsigned_interval_at_loc(loc);
 }
 
 static inline region_t string_to_region(const std::string& s) {
     static std::map<std::string, region_t> string_to_region{
-        {std::string("ctx"), region_t::T_CTX},
-        {std::string("stack"), region_t::T_STACK},
-        {std::string("packet"), region_t::T_PACKET},
-        {std::string("shared"), region_t::T_SHARED},
+        {std::string("ctx"), region_t::R_CTX},
+        {std::string("stack"), region_t::R_STACK},
+        {std::string("packet"), region_t::R_PACKET},
+        {std::string("shared"), region_t::R_SHARED},
     };
     if (string_to_region.count(s)) {
         return string_to_region[s];
@@ -945,7 +944,7 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
     else {
         typ.set_to_top();
     }
-    auto loc = location_t{std::make_pair(label_t::entry, 0)};
+    location_t loc{label_t::entry, 0};
     for (const auto& t : types) {
         std::smatch m;
         if (regex_match(t, m, regex(REG ":" CTX_OR_STACK_PTR))) {
@@ -1055,11 +1054,11 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
     // TODO: add support for printing unsigned intervals as well
     for (const Instruction& statement : bb) {
         ++curr_pos;
-        crab::location_t loc = crab::location_t(std::make_pair(bb.label(), curr_pos));
+        crab::location_t loc{bb.label(), curr_pos};
         o << "   " << curr_pos << ".";
         // TODO: print unsigned intervals in a proper way
         if (std::holds_alternative<Call>(statement)) {
-            auto r0_reg = crab::reg_with_loc_t(register_t{R0_RETURN_VALUE}, loc);
+            auto r0_reg = crab::register_location_t(register_t{R0_RETURN_VALUE}, loc);
             auto region = find_ptr_or_mapfd_at_loc(r0_reg);
             auto rf = find_refinement_at_loc(r0_reg);
             auto signed_interval = find_signed_interval_at_loc(r0_reg);
@@ -1069,19 +1068,19 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
-            auto reg_with_loc = crab::reg_with_loc_t(b.dst.v, loc);
-            auto region = find_ptr_or_mapfd_at_loc(reg_with_loc);
-            auto rf = find_refinement_at_loc(reg_with_loc);
-            auto signed_interval = find_signed_interval_at_loc(reg_with_loc);
+            auto register_location = crab::register_location_t(b.dst.v, loc);
+            auto region = find_ptr_or_mapfd_at_loc(register_location);
+            auto rf = find_refinement_at_loc(register_location);
+            auto signed_interval = find_signed_interval_at_loc(register_location);
             print_annotated(o, b, region, rf, signed_interval, true);
-            auto unsigned_interval = find_unsigned_interval_at_loc(reg_with_loc);
+            auto unsigned_interval = find_unsigned_interval_at_loc(register_location);
             //print_annotated(o, b, region, rf, unsigned_interval, false);
         }
         else if (std::holds_alternative<Mem>(statement)) {
             auto u = std::get<Mem>(statement);
             if (u.is_load) {
                 auto target_reg = std::get<Reg>(u.value);
-                auto target_reg_loc = crab::reg_with_loc_t(target_reg.v, loc);
+                auto target_reg_loc = crab::register_location_t(target_reg.v, loc);
                 auto region = find_ptr_or_mapfd_at_loc(target_reg_loc);
                 auto rf = find_refinement_at_loc(target_reg_loc);
                 auto signed_interval = find_signed_interval_at_loc(target_reg_loc);
@@ -1093,13 +1092,13 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
         }
         else if (std::holds_alternative<LoadMapFd>(statement)) {
             auto u = std::get<LoadMapFd>(statement);
-            auto reg = crab::reg_with_loc_t(u.dst.v, loc);
+            auto reg = crab::register_location_t(u.dst.v, loc);
             auto region = find_ptr_or_mapfd_at_loc(reg);
             print_annotated(o, u, region);
         }
         else if (std::holds_alternative<Un>(statement)) {
             auto u = std::get<Un>(statement);
-            auto reg = crab::reg_with_loc_t(u.dst.v, loc);
+            auto reg = crab::register_location_t(u.dst.v, loc);
             auto signed_interval = find_signed_interval_at_loc(reg);
             print_annotated(o, u, signed_interval, true);
             auto unsigned_interval = find_unsigned_interval_at_loc(reg);
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 0f1bb7e41..5a70281f5 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -6,7 +6,6 @@
 #include "crab/region_domain.hpp"
 #include "crab/interval_domain.hpp"
 #include "crab/offset_domain.hpp"
-#include "crab/common.hpp"
 #include "crab/type_ostream.hpp"
 
 namespace crab {
@@ -51,32 +50,32 @@ class inference_domain_t final {
     inference_domain_t narrow(const inference_domain_t& other) const;
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Atomic&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const CallLocal&, location_t loc = boost::none) {}
-    void operator()(const Callx&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
-    void operator()(const ValidAccess&, location_t loc = boost::none);
-    void operator()(const Comparable&, location_t loc = boost::none);
-    void operator()(const Addable&, location_t loc = boost::none);
-    void operator()(const ValidStore&, location_t loc = boost::none);
-    void operator()(const TypeConstraint&, location_t loc = boost::none);
-    void operator()(const ValidSize&, location_t loc = boost::none);
-    void operator()(const ValidCall&, location_t loc = boost::none) {}
-    void operator()(const ValidMapKeyValue&, location_t loc = boost::none);
-    void operator()(const ZeroCtxOffset&, location_t loc = boost::none);
-    void operator()(const ValidDivisor&, location_t loc = boost::none);
-    void operator()(const FuncConstraint& s, location_t loc = boost::none);
-    void operator()(const IncrementLoopCounter&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Atomic&, location_t loc = location_t::top());
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const CallLocal&, location_t loc = location_t::top()) {}
+    void operator()(const Callx&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
+    void operator()(const ValidAccess&, location_t loc = location_t::top());
+    void operator()(const Comparable&, location_t loc = location_t::top());
+    void operator()(const Addable&, location_t loc = location_t::top());
+    void operator()(const ValidStore&, location_t loc = location_t::top());
+    void operator()(const TypeConstraint&, location_t loc = location_t::top());
+    void operator()(const ValidSize&, location_t loc = location_t::top());
+    void operator()(const ValidCall&, location_t loc = location_t::top()) {}
+    void operator()(const ValidMapKeyValue&, location_t loc = location_t::top());
+    void operator()(const ZeroCtxOffset&, location_t loc = location_t::top());
+    void operator()(const ValidDivisor&, location_t loc = location_t::top());
+    void operator()(const FuncConstraint& s, location_t loc = location_t::top());
+    void operator()(const IncrementLoopCounter&, location_t loc = location_t::top());
     void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     friend std::ostream& operator<<(std::ostream& o, const inference_domain_t& dom);
@@ -88,10 +87,10 @@ class inference_domain_t final {
     void print_ctx(std::ostream&) const;
     void print_stack(std::ostream&) const;
     void print_annotated_bb(std::ostream&, const basic_block_t&) const;
-    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::reg_with_loc_t&) const;
-    std::optional<crab::refinement_t> find_refinement_at_loc(const crab::reg_with_loc_t&) const;
-    std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::reg_with_loc_t&) const;
-    std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::reg_with_loc_t&) const;
+    std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
+    std::optional<crab::refinement_t> find_refinement_at_loc(const crab::register_location_t&) const;
+    std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::register_location_t&) const;
+    std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::register_location_t&) const;
     static inference_domain_t from_predefined_types(const std::set<std::string>&, bool);
     void insert_in_registers_in_region_domain(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack_in_region_domain(uint64_t, ptr_or_mapfd_t, int);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 545bfce65..77e77e3ce 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -3,7 +3,6 @@
 
 #pragma once
 
-#include "crab/common.hpp"
 #include "crab/offset_domain.hpp"
 
 void print_numeric_register(std::ostream&, Reg, crab::interval_t, bool);
diff --git a/src/crab/common.cpp b/src/crab/types.cpp
similarity index 66%
rename from src/crab/common.cpp
rename to src/crab/types.cpp
index 443690a59..ca053d44b 100644
--- a/src/crab/common.cpp
+++ b/src/crab/types.cpp
@@ -1,36 +1,23 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "crab/common.hpp"
-
-/*
-namespace std {
-    crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t) {
-    return std::visit( overloaded
-               {
-                   []( const crab::ptr_with_off_t& x ){ return crab::ptr_t{x};},
-                   []( const crab::packet_ptr_t& x ){ return crab::ptr_t{x};},
-                   []( auto& ) { return crab::ptr_t{};}
-                }, t
-            );
-    }
-} // namespace std
-*/
+#include "types.hpp"
 
 namespace crab {
 
-inline std::string get_reg_ptr(const region_t& r) noexcept {
+inline std::string region_to_string(const region_t& r) noexcept {
     switch (r) {
-        case region_t::T_CTX:
+        case region_t::R_CTX:
             return "ctx_p";
-        case region_t::T_STACK:
+        case region_t::R_STACK:
             return "stack_p";
-        case region_t::T_SHARED:
+        case region_t::R_SHARED:
             return "shared_p";
-        default:
+        case region_t::R_PACKET:
             return "packet_p";
+        default:
+            __builtin_unreachable();
     }
-    __builtin_unreachable();
 }
 
 bool mock_interval_t::operator==(const mock_interval_t& other) const {
@@ -46,14 +33,6 @@ bool ptr_with_off_t::operator!=(const ptr_with_off_t& other) const {
     return !(*this == other);
 }
 
-bool packet_ptr_t::operator==(const packet_ptr_t& other) const {
-    return (m_r == other.m_r);
-}
-
-bool packet_ptr_t::operator!=(const packet_ptr_t& other) const {
-    return !(*this == other);
-}
-
 bool mapfd_t::operator==(const mapfd_t& other) const {
     return (m_mapfd == other.m_mapfd);
 }
@@ -107,33 +86,8 @@ void mapfd_t::write(std::ostream& o) const {
     }
 }
 
-void reg_with_loc_t::write(std::ostream& o) const {
-    o << "r" << static_cast<unsigned int>(m_reg) << "@" << m_loc->second << " in " << m_loc->first << " ";
-}
-
-std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg) {
-    reg.write(o);
-    return o;
-}
-
-bool reg_with_loc_t::operator==(const reg_with_loc_t& other) const {
-    return (m_reg == other.m_reg && m_loc == other.m_loc);
-}
-
-std::size_t reg_with_loc_t::hash() const {
-    // Similar to boost::hash_combine
-    using std::hash;
-
-    std::size_t seed = hash<register_t>()(m_reg);
-    seed ^= hash<int>()(m_loc->first.from) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->first.to) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    seed ^= hash<int>()(m_loc->second) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-
-    return seed;
-}
-
 void ptr_with_off_t::write(std::ostream& o) const {
-    o << get_reg_ptr(m_r);
+    o << region_to_string(m_r);
     auto offset = m_offset.to_interval();
     auto region_size = m_region_size.to_interval();
     if (!offset.is_top()) {
diff --git a/src/crab/common.hpp b/src/crab/types.hpp
similarity index 72%
rename from src/crab/common.hpp
rename to src/crab/types.hpp
index b9ea3629d..9086c4d90 100644
--- a/src/crab/common.hpp
+++ b/src/crab/types.hpp
@@ -3,53 +3,55 @@
 
 #pragma once
 
-#include <boost/optional/optional_io.hpp>
-#include <functional>
 #include <optional>
 #include <vector>
-#include <unordered_map>
 
-#include "string_constraints.hpp"
-#include "asm_syntax.hpp"
-#include "array_domain.hpp"
+#include "register_utils.hpp"
+#include "interval.hpp"
 
 namespace crab {
 
-using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-
-// 11 registers for the eBPF ISA, and 1 pseudo-register for the atomic operations
-constexpr uint8_t NUM_REGISTERS = 12;
-
 constexpr int STACK_BEGIN = 0;
 constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
 constexpr int SHARED_BEGIN = 0;
 constexpr int MAX_PACKET_SIZE = 0xffff;
 
+
+enum class types_t {
+    T_UNSPEC,
+    T_NUM,
+    T_STACK,
+    T_CTX,
+    T_PACKET,
+    T_SHARED,
+    T_MAP,
+    T_MAP_PROGRAMS
+};
+
+
 enum class region_t {
-	T_CTX,
-	T_STACK,
-	T_PACKET,
-	T_SHARED
+	R_CTX,
+	R_STACK,
+	R_PACKET,
+	R_SHARED
 };
 
-inline std::string get_reg_ptr(const region_t& r) noexcept;
+inline std::string region_to_string(const region_t& r) noexcept;
 
 enum class nullness_t { MAYBE_NULL, NOT_NULL, _NULL };
 
+// TODO: make it part of the ptr_with_off_t class as generic pointers
 class packet_ptr_t {
-    region_t m_r = region_t::T_PACKET;
+    region_t m_r = region_t::R_PACKET;
 
   public:
     packet_ptr_t() = default;
-    packet_ptr_t(const packet_ptr_t &) = default;
-    packet_ptr_t(packet_ptr_t &&) = default;
-    packet_ptr_t &operator=(const packet_ptr_t &) = default;
-    packet_ptr_t &operator=(packet_ptr_t &&) = default;
-
     friend std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p);
-    bool operator==(const packet_ptr_t&) const;
-    bool operator!=(const packet_ptr_t&) const;
+    // because we only represent one packet pointer, we can always return true/false
+    bool operator==(const packet_ptr_t&) const { return true; }
+    bool operator!=(const packet_ptr_t&) const { return false; }
+    [[nodiscard]] region_t get_region() const { return m_r; }
 };
 
 class mock_interval_t {
@@ -81,10 +83,6 @@ class ptr_with_off_t {
 
   public:
     ptr_with_off_t() = default;
-    ptr_with_off_t(const ptr_with_off_t &) = default;
-    ptr_with_off_t(ptr_with_off_t &&) = default;
-    ptr_with_off_t &operator=(const ptr_with_off_t &) = default;
-    ptr_with_off_t &operator=(ptr_with_off_t &&) = default;
     ptr_with_off_t(region_t _r, int _id, mock_interval_t _off,
             nullness_t _nullness = nullness_t::MAYBE_NULL,
             mock_interval_t _region_sz = mock_interval_t::top())
@@ -111,10 +109,7 @@ class mapfd_t {
     EbpfMapValueType m_value_type;
 
   public:
-    mapfd_t(const mapfd_t&) = default;
-    mapfd_t(mapfd_t&&) = default;
-    mapfd_t &operator=(const mapfd_t&) = default;
-    mapfd_t &operator=(mapfd_t&&) = default;
+    mapfd_t() = default;
     mapfd_t operator|(const mapfd_t&) const;
     mapfd_t(mock_interval_t mapfd, EbpfMapValueType val_type)
         : m_mapfd(mapfd), m_value_type(val_type) {}
@@ -129,26 +124,11 @@ class mapfd_t {
 };
 
 using ptr_t = std::variant<packet_ptr_t, ptr_with_off_t>;
-using register_t = uint8_t;
-using location_t = boost::optional<std::pair<label_t, uint32_t>>;
-
-class reg_with_loc_t {
-    register_t m_reg;
-    location_t m_loc;
-
-  public:
-    reg_with_loc_t(register_t _r, location_t _loc) : m_reg(_r), m_loc(_loc) {}
-    bool operator==(const reg_with_loc_t& other) const;
-    std::size_t hash() const;
-    friend std::ostream& operator<<(std::ostream& o, const reg_with_loc_t& reg);
-    void write(std::ostream& ) const;
-};
 
 using ptr_or_mapfd_t = std::variant<ptr_with_off_t, packet_ptr_t, mapfd_t>;
 
 inline bool is_ptr_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
-    return (ptr_or_mapfd && (std::holds_alternative<ptr_with_off_t>(*ptr_or_mapfd)
-                || std::holds_alternative<packet_ptr_t>(*ptr_or_mapfd)));
+    return (ptr_or_mapfd && !std::holds_alternative<mapfd_t>(*ptr_or_mapfd));
 }
 
 inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
@@ -158,20 +138,24 @@ inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
 inline bool same_region(const ptr_or_mapfd_t& ptr1, const ptr_or_mapfd_t& ptr2) {
     if (std::holds_alternative<packet_ptr_t>(ptr1) && std::holds_alternative<packet_ptr_t>(ptr2))
         return true;
-    return (std::holds_alternative<ptr_with_off_t>(ptr1)
-            && std::holds_alternative<ptr_with_off_t>(ptr2)
-            && std::get<ptr_with_off_t>(ptr1).get_region()
-                == std::get<ptr_with_off_t>(ptr2).get_region());
+    if (std::holds_alternative<ptr_with_off_t>(ptr1) && std::holds_alternative<ptr_with_off_t>(ptr2)) {
+        auto p1 = std::get<ptr_with_off_t>(ptr1);
+        auto p2 = std::get<ptr_with_off_t>(ptr2);
+        auto r1 = p1.get_region();
+        auto r2 = p2.get_region();
+        if (r1 == r2 && r1 != region_t::R_SHARED) return true;
+    }
+    return false;
 }
 
 inline bool is_stack_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
-            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_STACK);
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_STACK);
 }
 
 inline bool is_ctx_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
-            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_CTX);
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_CTX);
 }
 
 inline bool is_packet_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
@@ -180,36 +164,26 @@ inline bool is_packet_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
 
 inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
-            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::T_SHARED);
+            && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_SHARED);
 }
 
 inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
         const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd2,
         const std::optional<mock_interval_t>& interval1,
         const std::optional<mock_interval_t>& interval2) {
-    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return true;
+    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return false;
     if (ptr_or_mapfd1 && ptr_or_mapfd2 && same_region(*ptr_or_mapfd1, *ptr_or_mapfd2))
         return true;
     if (interval1 && interval2) return true;
     return false;
 }
 
-inline std::ostream& operator<<(std::ostream& o, const region_t& t) {
-    o << static_cast<std::underlying_type<region_t>::type>(t);
-    return o;
-}
-
 using stack_cells_t = std::vector<std::pair<uint64_t, int>>;
 
 } // namespace crab
 
 
 namespace std {
-    template <>
-    struct hash<crab::reg_with_loc_t> {
-        size_t operator()(const crab::reg_with_loc_t& reg) const { return reg.hash(); }
-    };
-
     template <>
     struct equal_to<crab::ptr_t> {
         constexpr bool operator()(const crab::ptr_t& lhs, const crab::ptr_t& rhs) const {
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 962ab8505..d86845205 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -31,12 +31,12 @@ void registers_unsigned_state_t::set_to_bottom() {
 }
 
 void registers_unsigned_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
-    auto reg_with_loc = reg_with_loc_t{reg, loc};
-    (*m_interval_env)[reg_with_loc] = mock_interval_t{interval};
-    m_cur_def[reg] = std::make_shared<reg_with_loc_t>(reg_with_loc);
+    auto register_location = register_location_t{reg, loc};
+    (*m_interval_env)[register_location] = mock_interval_t{interval};
+    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> registers_unsigned_state_t::find(reg_with_loc_t reg) const {
+std::optional<mock_interval_t> registers_unsigned_state_t::find(register_location_t reg) const {
     auto it = m_interval_env->find(reg);
     if (it == m_interval_env->end()) return {};
     return it->second;
@@ -44,7 +44,7 @@ std::optional<mock_interval_t> registers_unsigned_state_t::find(reg_with_loc_t r
 
 std::optional<mock_interval_t> registers_unsigned_state_t::find(register_t key) const {
     if (m_cur_def[key] == nullptr) return {};
-    const reg_with_loc_t& reg = *(m_cur_def[key]);
+    const register_location_t& reg = *(m_cur_def[key]);
     return find(reg);
 }
 
@@ -55,8 +55,8 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
         return *this;
     }
     registers_unsigned_state_t intervals_joined(m_interval_env);
-    location_t loc = location_t(std::make_pair(label_t(-2, -2), 0));
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    location_t loc = location_t::top();
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_def[i]));
         auto it2 = other.find(*(other.m_cur_def[i]));
@@ -70,7 +70,7 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
 }
 
 void registers_unsigned_state_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
         }
@@ -293,7 +293,7 @@ std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_value(r
 }
 
 std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_at_loc(
-        const reg_with_loc_t reg) const {
+        const register_location_t reg) const {
     return m_registers_values.find(reg);
 }
 
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 8666658a2..38449d9ee 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -3,12 +3,14 @@
 
 #pragma once
 
-#include "crab/common.hpp"
+#include "array_domain.hpp"
+#include "types.hpp"
 
 namespace crab {
 
-using live_registers_t = std::array<std::shared_ptr<reg_with_loc_t>, NUM_REGISTERS>;
-using global_interval_env_t = std::unordered_map<reg_with_loc_t, mock_interval_t>;
+using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
+using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
+using global_interval_env_t = std::unordered_map<register_location_t, mock_interval_t>;
 
 class registers_unsigned_state_t {
 
@@ -21,7 +23,7 @@ class registers_unsigned_state_t {
         bool is_top() const;
         void set_to_bottom();
         void set_to_top();
-        std::optional<mock_interval_t> find(reg_with_loc_t reg) const;
+        std::optional<mock_interval_t> find(register_location_t reg) const;
         std::optional<mock_interval_t> find(register_t key) const;
         void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
@@ -108,17 +110,17 @@ class unsigned_interval_domain_t final {
     void operator-=(register_t reg) { m_registers_values -= reg; }
 
     //// abstract transformers
-    void operator()(const Undefined&, location_t loc = boost::none);
-    void operator()(const Bin&, location_t loc = boost::none);
-    void operator()(const Un&, location_t loc = boost::none);
-    void operator()(const LoadMapFd&, location_t loc = boost::none);
-    void operator()(const Call&, location_t loc = boost::none);
-    void operator()(const Exit&, location_t loc = boost::none);
-    void operator()(const Jmp&, location_t loc = boost::none);
-    void operator()(const Mem&, location_t loc = boost::none);
-    void operator()(const Packet&, location_t loc = boost::none);
-    void operator()(const Assume&, location_t loc = boost::none);
-    void operator()(const Assert&, location_t loc = boost::none);
+    void operator()(const Undefined&, location_t loc = location_t::top());
+    void operator()(const Bin&, location_t loc = location_t::top());
+    void operator()(const Un&, location_t loc = location_t::top());
+    void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const Call&, location_t loc = location_t::top());
+    void operator()(const Exit&, location_t loc = location_t::top());
+    void operator()(const Jmp&, location_t loc = location_t::top());
+    void operator()(const Mem&, location_t loc = location_t::top());
+    void operator()(const Packet&, location_t loc = location_t::top());
+    void operator()(const Assume&, location_t loc = location_t::top());
+    void operator()(const Assert&, location_t loc = location_t::top());
     void operator()(const basic_block_t& bb);
     void write(std::ostream& os) const;
     crab::bound_t get_loop_count_upper_bound() const;
@@ -127,7 +129,7 @@ class unsigned_interval_domain_t final {
     void set_require_check(check_require_func_t f);
 
     std::optional<mock_interval_t> find_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_interval_at_loc(const reg_with_loc_t reg) const;
+    std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<interval_cells_t> find_in_stack(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
     void store_in_stack(uint64_t, mock_interval_t, int);

From 467451cdde07e4cc40a22f2f8d32e984e3d5951b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 29 Nov 2024 12:00:20 -0500
Subject: [PATCH 324/373] Removed redundant ctx representation in region domain

Region domain only stored the information about where the packet
pointers are, in the context, plus the size of the ctx, all of which is
already available in Offset domain, hence can be removed for most part;
Only keeping ctx size info in Region domain, as it is used when checking
accesses to the ctx;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp  | 100 +++++++++++++++++++----
 src/crab/offset_domain.hpp  |   7 +-
 src/crab/region_domain.cpp  | 154 +++++++++---------------------------
 src/crab/region_domain.hpp  |  23 ++----
 src/crab/type_inference.cpp |  16 ++--
 src/crab/type_ostream.cpp   |   7 +-
 src/crab/type_ostream.hpp   |   2 +-
 7 files changed, 146 insertions(+), 163 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 0966225b4..427f66f4f 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -167,6 +167,16 @@ void stack_state_t::store(uint64_t key, refinement_t d, int width) {
     m_slot_rfs[key] = std::make_pair(d, width);
 }
 
+std::vector<uint64_t> stack_state_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(m_slot_rfs.size());
+
+    for (auto const& kv : m_slot_rfs) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
 void stack_state_t::operator-=(uint64_t to_erase) {
     if (is_bottom()) {
         return;
@@ -227,7 +237,17 @@ int ctx_offsets_t::get_size() const {
     return m_size;
 }
 
-std::optional<refinement_t> ctx_offsets_t::find(int key) const {
+std::vector<uint64_t> ctx_offsets_t::get_keys() const {
+    std::vector<uint64_t> keys;
+    keys.reserve(m_rfs.size());
+
+    for (auto const& kv : m_rfs) {
+        keys.push_back(kv.first);
+    }
+    return keys;
+}
+
+std::optional<refinement_t> ctx_offsets_t::find(uint64_t key) const {
     auto it = m_rfs.find(key);
     if (it == m_rfs.end()) return {};
     return it->second;
@@ -706,32 +726,74 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
         return;
     }
 
+    int width = b.access.width;
     int offset = b.access.offset;
     auto type_with_off = std::get<ptr_with_off_t>(*basereg_type);
     auto p_offset = type_with_off.get_offset();
     auto offset_singleton = p_offset.to_interval().singleton();
-    if (!offset_singleton) {
-        m_reg_state -= target_register;
-        return;
-    }
-    auto ptr_offset = *offset_singleton;
-    auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
-
     if (is_stack_p) {
-        auto it = m_stack_state.find(load_at);
-        if (!it) {
+        if (!offset_singleton) {
+            for (auto const& k : m_stack_state.get_keys()) {
+                auto start = p_offset.lb();
+                auto end = p_offset.ub()+number_t{offset+width-1};
+                interval_t range{start, end};
+                // TODO: fix this
+                /*
+                if (range[number_t{(int)k}]) {
+                    //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
+                    m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
+                    break;
+                }
+                */
+            }
             m_reg_state -= target_register;
-            return;
         }
-        m_reg_state.insert(target_register, loc, std::move(it->first));
+        else {
+            if (width != 1 && width != 2 && width != 4 && width != 8) {
+                m_reg_state -= target_register;
+                return;
+            }
+            auto ptr_offset = offset_singleton.value();
+            auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
+
+            auto loaded = m_stack_state.find(load_at);
+            if (!loaded) {
+                // no field at loaded offset in stack
+                m_reg_state -= target_register;
+                return;
+            }
+            m_reg_state.insert(target_register, loc, std::move(loaded->first));
+        }
     }
-    else if (is_ctx_p) {
-        auto it = m_ctx_rfs->find(load_at);
-        if (!it) {
+    else {
+        if (!offset_singleton) {
+            for (auto const& k : m_ctx_rfs->get_keys()) {
+                auto start = p_offset.lb();
+                auto end = p_offset.ub()+crab::bound_t{offset+width-1};
+                interval_t range{start, end};
+                // TODO: fix this
+                /*
+                if (range[number_t{(int)k}]) {
+                    //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
+                    m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
+                    break;
+                }
+                */
+            }
             m_reg_state -= target_register;
-            return;
         }
-        m_reg_state.insert(target_register, loc, std::move(*it));
+        else {
+            auto ptr_offset = offset_singleton.value();
+            auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
+
+            auto loaded = m_ctx_rfs->find(load_at);
+            if (!loaded) {
+                // no field at loaded offset in ctx
+                m_reg_state -= target_register;
+                return;
+            }
+            m_reg_state.insert(target_register, loc, std::move(*loaded));
+        }
     }
 }
 
@@ -739,6 +801,10 @@ void offset_domain_t::operator()(const Mem& b, location_t loc) {
     // nothing to do here
 }
 
+std::vector<uint64_t> offset_domain_t::get_ctx_keys() const {
+    return m_ctx_rfs->get_keys();
+}
+
 std::optional<refinement_t> offset_domain_t::find_refinement_at_loc(const register_location_t reg) const {
     return m_reg_state.find(reg);
 }
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index fe5b07f79..1b221b472 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -82,17 +82,19 @@ class stack_state_t {
         explicit stack_state_t(stack_slot_refinements_t&& stack_rfs, bool is_bottom = false)
             : m_slot_rfs(std::move(stack_rfs)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
+        std::vector<uint64_t> get_keys() const;
 };
 
 class ctx_offsets_t {
-    using ctx_refinements_t = std::unordered_map<int, refinement_t>;    // represents `cp[n] = rf;`
+    using ctx_refinements_t = std::unordered_map<uint64_t, refinement_t>;    // represents `cp[n] = rf;`
     ctx_refinements_t m_rfs;
     int m_size;
 
     public:
         ctx_offsets_t(const ebpf_context_descriptor_t* desc);
-        std::optional<refinement_t> find(int) const;
+        std::optional<refinement_t> find(uint64_t) const;
         int get_size() const;
+        std::vector<uint64_t> get_keys() const;
 };
 
 class offset_domain_t final {
@@ -171,6 +173,7 @@ class offset_domain_t final {
     void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
     interval_t compute_packet_subtraction(register_t, register_t) const;
 
+    std::vector<uint64_t> get_ctx_keys() const;
     std::optional<refinement_t> find_in_ctx(int) const;
     std::optional<refinement_cells_t> find_in_stack(int) const;
     std::optional<refinement_t> find_refinement_at_loc(const register_location_t) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 466d6666f..3568e97d1 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -48,38 +48,6 @@ static inline std::vector<std::set<int>> join_shared_ptr_aliases(
     return result;
 }
 
-ctx_t::ctx_t(const ebpf_context_descriptor_t* desc)
-{
-    if (desc->data >= 0) {
-        m_packet_ptrs[desc->data] = std::move(crab::packet_ptr_t{});
-    }
-    if (desc->end >= 0) {
-        m_packet_ptrs[desc->end] = std::move(crab::packet_ptr_t{});
-    }
-    if (desc->meta >= 0) {
-        m_packet_ptrs[desc->meta] = std::move(crab::packet_ptr_t{});
-    }
-    if (desc->size >= 0) {
-        size = desc->size;
-    }
-}
-
-std::vector<uint64_t> ctx_t::get_keys() const {
-    std::vector<uint64_t> keys;
-    keys.reserve(size);
-
-    for (auto const&kv : m_packet_ptrs) {
-        keys.push_back(kv.first);
-    }
-    return keys;
-}
-
-std::optional<packet_ptr_t> ctx_t::find(uint64_t key) const {
-    auto it = m_packet_ptrs.find(key);
-    if (it == m_packet_ptrs.end()) return {};
-    return it->second;
-}
-
 void register_types_t::scratch_caller_saved_registers() {
     for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
         operator-=(register_t{r});
@@ -312,6 +280,14 @@ std::vector<uint64_t> stack_t::find_overlapping_cells(uint64_t start, int width)
     return overlapping_cells;
 }
 
+void region_domain_t::compute_ctx_size(const ebpf_context_descriptor_t* desc) {
+    ctx_size = std::max(0, desc->size);
+}
+
+size_t region_domain_t::get_ctx_size() const {
+    return ctx_size;
+}
+
 std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_type(register_t reg) const {
     return m_registers.find(reg);
 }
@@ -361,22 +337,10 @@ void region_domain_t::set_registers_to_top() {
     m_registers.set_to_top();
 }
 
-size_t region_domain_t::ctx_size() const {
-    return m_ctx->get_size();
-}
-
-std::vector<uint64_t> region_domain_t::get_ctx_keys() const {
-    return m_ctx->get_keys();
-}
-
 std::vector<uint64_t> region_domain_t::get_stack_keys() const {
     return m_stack.get_keys();
 }
 
-std::optional<packet_ptr_t> region_domain_t::find_in_ctx(uint64_t key) const {
-    return m_ctx->find(key);
-}
-
 std::optional<ptr_or_mapfd_cells_t> region_domain_t::find_in_stack(uint64_t key) const {
     return m_stack.find(key);
 }
@@ -407,7 +371,7 @@ region_domain_t region_domain_t::operator|(const region_domain_t& other) const {
         return *this;
     }
     auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
-    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, other.m_ctx,
+    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack,
             std::move(aliases));
 }
 
@@ -420,7 +384,7 @@ region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
     }
     auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
     return region_domain_t(m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack), other.m_ctx, std::move(aliases));
+            m_stack | std::move(other.m_stack), std::move(aliases));
 }
 
 region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
@@ -761,7 +725,7 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
             }
             else if (ptr_with_off_type.get_region() == region_t::R_CTX) {
                 if (bound_t{CTX_BEGIN} <= offset_lb
-                        && offset_plus_width_ub <= bound_t{ctx_size()})
+                        && offset_plus_width_ub <= bound_t{get_ctx_size()})
                     return;
             }
             else { // shared
@@ -799,10 +763,6 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
 }
 
 region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
-
-    std::shared_ptr<ctx_t> ctx
-        = std::make_shared<ctx_t>(global_program_info.get().type.context_descriptor);
-
     register_types_t typ(std::make_shared<global_region_env_t>());
 
     location_t loc{label_t::entry, 0};
@@ -813,7 +773,8 @@ region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
     auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    static region_domain_t inv(std::move(typ), stack_t::top(), ctx);
+    static region_domain_t inv(std::move(typ), stack_t::top());
+    inv.compute_ctx_size(global_program_info.get().type.context_descriptor);
     return std::move(inv);
 }
 
@@ -1057,78 +1018,39 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
     auto p_offset = type_with_off.get_offset();
     auto offset_singleton = p_offset.to_interval().singleton();
 
+    if (!offset_singleton) {
+        m_registers -= target_register;
+        return;
+    }
     if (is_stack_p) {
-        if (!offset_singleton) {
-            for (auto const& k : m_stack.get_keys()) {
-                auto start = p_offset.lb();
-                auto end = p_offset.ub()+number_t{offset+width-1};
-                interval_t range{start, end};
-                // TODO: fix this
-                /*
-                if (range[number_t{(int)k}]) {
-                    //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
-                    m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
-                    break;
-                }
-                */
-            }
+        if (width != 1 && width != 2 && width != 4 && width != 8) {
             m_registers -= target_register;
+            return;
         }
-        else {
-            if (width != 1 && width != 2 && width != 4 && width != 8) {
-                m_registers -= target_register;
-                return;
-            }
-            auto ptr_offset = offset_singleton.value();
-            auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
-
-            auto loaded = m_stack.find(load_at);
-            if (!loaded) {
-                // no field at loaded offset in stack
-                m_registers -= target_register;
-                return;
-            }
-            auto ptr_or_mapfd = loaded->first;
-            if (is_shared_ptr(ptr_or_mapfd)) {
-                auto shared_ptr = std::get<ptr_with_off_t>(ptr_or_mapfd);
-                set_aliases((int)target_register, shared_ptr);
-                m_registers.insert(target_register, loc, shared_ptr);
-            }
-            else {
-                m_registers.insert(target_register, loc, ptr_or_mapfd);
-            }
-        }
-    }
-    else {
-        if (!offset_singleton) {
-            for (auto const& k : m_ctx->get_keys()) {
-                auto start = p_offset.lb();
-                auto end = p_offset.ub()+crab::bound_t{offset+width-1};
-                interval_t range{start, end};
-                // TODO: fix this
-                /*
-                if (range[number_t{(int)k}]) {
-                    //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
-                    m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
-                    break;
-                }
-                */
-            }
+        auto ptr_offset = offset_singleton.value();
+        auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
+
+        auto loaded = m_stack.find(load_at);
+        if (!loaded) {
+            // no field at loaded offset in stack
             m_registers -= target_register;
+            return;
+        }
+        auto ptr_or_mapfd = loaded->first;
+        if (is_shared_ptr(ptr_or_mapfd)) {
+            auto shared_ptr = std::get<ptr_with_off_t>(ptr_or_mapfd);
+            set_aliases((int)target_register, shared_ptr);
+            m_registers.insert(target_register, loc, shared_ptr);
         }
         else {
-            auto ptr_offset = offset_singleton.value();
-            auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
-
-            auto loaded = m_ctx->find(load_at);
-            if (!loaded) {
-                // no field at loaded offset in ctx
-                m_registers -= target_register;
-                return;
-            }
-            m_registers.insert(target_register, loc, *loaded);
+            m_registers.insert(target_register, loc, ptr_or_mapfd);
         }
     }
+    else {
+        // TODO: better reasoning needed here: in case there was an unsuccessful load in offset
+        // domain, we should not be loading from ctx
+        m_registers.insert(target_register, loc, packet_ptr_t{});
+    }
 }
 
 void region_domain_t::operator()(const Mem& m, location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index f37e27320..b9650d39c 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -12,19 +12,6 @@ namespace crab {
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 using shared_ptr_aliases_t = std::vector<std::set<int>>;
 
-class ctx_t {
-    using ptr_types_t = std::unordered_map<uint64_t, packet_ptr_t>;
-
-    ptr_types_t m_packet_ptrs;
-    size_t size = 0;
-
-  public:
-    ctx_t(const ebpf_context_descriptor_t* desc);
-    constexpr size_t get_size() const { return size; }
-    std::vector<uint64_t> get_keys() const;
-    std::optional<packet_ptr_t> find(uint64_t key) const;
-};
-
 using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
 using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
 
@@ -93,7 +80,8 @@ class region_domain_t final {
     bool m_is_bottom = false;
     crab::stack_t m_stack;
     crab::register_types_t m_registers;
-    std::shared_ptr<crab::ctx_t> m_ctx;
+    // for ctx, we only keep the size of the context
+    size_t ctx_size = 0;
     shared_ptr_aliases_t m_shared_ptr_aliases;
     std::vector<std::string> m_errors;
 
@@ -105,8 +93,8 @@ class region_domain_t final {
     region_domain_t& operator=(region_domain_t&& o) = default;
     region_domain_t& operator=(const region_domain_t& o) = default;
     region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st,
-            std::shared_ptr<crab::ctx_t> _ctx, shared_ptr_aliases_t&& _shared_ptr_aliases = {})
-            : m_stack(std::move(_st)), m_registers(std::move(_types)), m_ctx(_ctx),
+            shared_ptr_aliases_t&& _shared_ptr_aliases = {})
+            : m_stack(std::move(_st)), m_registers(std::move(_types)),
             m_shared_ptr_aliases(std::move(_shared_ptr_aliases)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static region_domain_t&& setup_entry(bool);
@@ -177,7 +165,8 @@ class region_domain_t final {
             const crab::location_t&, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
-    [[nodiscard]] size_t ctx_size() const;
+    void compute_ctx_size(const ebpf_context_descriptor_t*);
+    [[nodiscard]] size_t get_ctx_size() const;
     std::optional<crab::packet_ptr_t> find_in_ctx(uint64_t key) const;
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index b2eb0b259..60bca3047 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -139,11 +139,11 @@ string_invariant inference_domain_t::to_set() const {
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             elem << "stack";
             if (rf) {
-                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd,
+                print_non_numeric_memory_cell(elem, k, k+width-1, std::move(ptr_or_mapfd),
                         std::optional<refinement_t>(rf->first));
             }
             else {
-                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd);
+                print_non_numeric_memory_cell(elem, k, k+width-1, std::move(ptr_or_mapfd));
             }
         }
         result.insert(elem.str());
@@ -663,6 +663,7 @@ void inference_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unkno
 
 void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
     m_region.do_mem_store(b);
+    // TODO: Before storing into interval domain, check if there is no overlap with packet pointers
     m_interval.do_mem_store(b, basereg_opt);
     m_offset.do_mem_store(b, basereg_opt);
 }
@@ -687,14 +688,13 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
 }
 
 void inference_domain_t::print_ctx(std::ostream& o) const {
-    std::vector<uint64_t> ctx_keys = m_region.get_ctx_keys();
+    std::vector<uint64_t> ctx_keys = m_offset.get_ctx_keys();
     o << "\tctx: {";
     for (auto const& k : ctx_keys) {
-        auto ptr = m_region.find_in_ctx(k);
         auto dist = m_offset.find_in_ctx(k);
-        if (ptr) {
+        if (dist) {
             o << "\t\t";
-            print_non_numeric_memory_cell(o, k, k+3, *ptr, dist);
+            print_non_numeric_memory_cell(o, k, k+3, packet_ptr_t{}, dist);
             o << ",\n";
         }
     }
@@ -714,11 +714,11 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             o << "\t\t";
             if (dist) {
-                print_non_numeric_memory_cell(o, k, k+width-1, ptr_or_mapfd,
+                print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd),
                         std::optional<refinement_t>(dist->first));
             }
             else {
-                print_non_numeric_memory_cell(o, k, k+width-1, ptr_or_mapfd);
+                print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd));
             }
             o << ",\n";
         }
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 9cd709e53..ca02ef1e3 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -4,7 +4,7 @@
 #include "crab/type_ostream.hpp"
 
 void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
-        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d) {
+        crab::ptr_or_mapfd_t&& ptr, std::optional<crab::refinement_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
     }
@@ -61,7 +61,10 @@ void print_memory_cell(std::ostream& o, int start, int end,
     if (unsigned_interval) {
         print_numeric_memory_cell(o, start, end, unsigned_interval->to_interval(), false);
     }
-    else if (p) print_non_numeric_memory_cell(o, start, end, *p, d);
+    else if (p) {
+        crab::ptr_or_mapfd_t ptr = *p;
+        print_non_numeric_memory_cell(o, start, end, std::move(ptr), d);
+    }
 }
 
 void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd_t& ptr,
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 77e77e3ce..8531120ac 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -9,7 +9,7 @@ void print_numeric_register(std::ostream&, Reg, crab::interval_t, bool);
 void print_numeric_memory_cell(std::ostream&, int, int, crab::interval_t, bool);
 void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t> = std::nullopt);
-void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
+void print_non_numeric_memory_cell(std::ostream&, int, int, crab::ptr_or_mapfd_t&& ptr,
         std::optional<crab::refinement_t> = std::nullopt);
 void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
         std::optional<crab::refinement_t>, std::optional<crab::mock_interval_t>, bool);

From 87dede51b94dbc24ce3af88e5750050d25d552ee Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 29 Nov 2024 18:03:58 -0500
Subject: [PATCH 325/373] Standardize names in domains for readability

Better and standard names for more readability;
Some minor refactoring and changes;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp          |   4 +-
 src/crab/interval_domain.hpp          |   4 +-
 src/crab/offset_domain.cpp            | 330 +++++++++++++-------------
 src/crab/offset_domain.hpp            |  77 +++---
 src/crab/region_domain.cpp            | 130 +++++-----
 src/crab/region_domain.hpp            |  58 +++--
 src/crab/register_utils.hpp           |   2 +
 src/crab/signed_interval_domain.cpp   | 150 ++++++------
 src/crab/signed_interval_domain.hpp   |  49 ++--
 src/crab/type_inference.hpp           |   6 +-
 src/crab/unsigned_interval_domain.cpp | 168 ++++++-------
 src/crab/unsigned_interval_domain.hpp |  58 ++---
 12 files changed, 514 insertions(+), 522 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 9bddb43c5..4c6e7ae7b 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -44,11 +44,11 @@ void interval_domain_t::set_registers_to_top() {
     m_unsigned.set_registers_to_top();
 }
 
-std::optional<interval_cells_t> interval_domain_t::find_in_stack_signed(uint64_t key) const {
+std::optional<signed_interval_stack_cell_t> interval_domain_t::find_in_stack_signed(uint64_t key) const {
     return m_signed.find_in_stack(key);
 }
 
-std::optional<interval_cells_t> interval_domain_t::find_in_stack_unsigned(uint64_t key) const {
+std::optional<unsigned_interval_stack_cell_t> interval_domain_t::find_in_stack_unsigned(uint64_t key) const {
     return m_unsigned.find_in_stack(key);
 }
 
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index cd56e0278..bb72f4dbc 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -159,8 +159,8 @@ class interval_domain_t final {
     std::optional<mock_interval_t> find_unsigned_interval_value(register_t) const;
     std::optional<mock_interval_t> find_signed_interval_at_loc(const register_location_t reg) const;
     std::optional<mock_interval_t> find_unsigned_interval_at_loc(const register_location_t reg) const;
-    std::optional<interval_cells_t> find_in_stack_signed(uint64_t) const;
-    std::optional<interval_cells_t> find_in_stack_unsigned(uint64_t) const;
+    std::optional<signed_interval_stack_cell_t> find_in_stack_signed(uint64_t) const;
+    std::optional<unsigned_interval_stack_cell_t> find_in_stack_unsigned(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
     void insert_in_registers_signed(register_t, location_t, interval_t);
     void insert_in_registers_unsigned(register_t, location_t, interval_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 427f66f4f..92e563a2a 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -5,47 +5,47 @@
 
 namespace crab {
 
-void registers_state_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
+void offset_registers_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
     register_location_t register_location{reg, loc};
-    (*m_offset_env)[register_location] = std::move(rf);
-    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
+    (*m_registers_env)[register_location] = std::move(rf);
+    m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-void registers_state_t::insert_slack_value(symbol_t sym, mock_interval_t in) {
+void offset_registers_t::insert_slack_value(symbol_t sym, mock_interval_t in) {
     (*m_slacks)[sym] = std::move(in);
 }
 
-std::optional<refinement_t> registers_state_t::find(register_location_t reg) const {
-    auto it = m_offset_env->find(reg);
-    if (it == m_offset_env->end()) return {};
+std::optional<refinement_t> offset_registers_t::find(register_location_t reg) const {
+    auto it = m_registers_env->find(reg);
+    if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> registers_state_t::find_slack_value(symbol_t sym) const {
+std::optional<mock_interval_t> offset_registers_t::find_slack_value(symbol_t sym) const {
     auto it = m_slacks->find(sym);
     if (it == m_slacks->end()) return {};
     return it->second;
 }
 
-std::optional<refinement_t> registers_state_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    return find(*(m_cur_def[key]));
+std::optional<refinement_t> offset_registers_t::find(register_t key) const {
+    if (m_cur_register_def[key] == nullptr) return {};
+    return find(*(m_cur_register_def[key]));
 }
 
-std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int width) const {
+std::vector<uint64_t> offset_stack_t::find_overlapping_cells(uint64_t start, int width) const {
     std::vector<uint64_t> overlapping_cells;
-    auto it = m_slot_rfs.begin();
-    while (it != m_slot_rfs.end() && it->first < start) {
+    auto it = m_stack_cells.begin();
+    while (it != m_stack_cells.end() && it->first < start) {
         it++;
     }
-    if (it != m_slot_rfs.begin()) {
+    if (it != m_stack_cells.begin()) {
         it--;
         auto key = it->first;
         auto width_key = it->second.second;
         if (key < start && key+width_key > start) overlapping_cells.push_back(key);
     }
 
-    for (; it != m_slot_rfs.end(); it++) {
+    for (; it != m_stack_cells.end(); it++) {
         auto key = it->first;
         if (key >= start && key < start+width) overlapping_cells.push_back(key);
         if (key >= start+width) break;
@@ -53,51 +53,51 @@ std::vector<uint64_t> stack_state_t::find_overlapping_cells(uint64_t start, int
     return overlapping_cells;
 }
 
-void registers_state_t::set_to_top() {
-    m_offset_env = std::make_shared<global_offset_env_t>();
-    m_cur_def = live_refinements_t{nullptr};
+void offset_registers_t::set_to_top() {
+    m_registers_env = std::make_shared<global_env_offset_registers_t>();
+    m_cur_register_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
 
-void registers_state_t::set_to_bottom() {
-    m_cur_def = live_refinements_t{nullptr};
+void offset_registers_t::set_to_bottom() {
+    m_cur_register_def = live_registers_t{nullptr};
     m_is_bottom = true;
 }
 
-bool registers_state_t::is_top() const {
+bool offset_registers_t::is_top() const {
     if (m_is_bottom) return false;
-    if (m_offset_env == nullptr) return true;
-    for (auto &it : m_cur_def) {
+    if (m_registers_env == nullptr) return true;
+    for (auto &it : m_cur_register_def) {
         if (it != nullptr) return false;
     }
     return true;
 }
 
-bool registers_state_t::is_bottom() const {
+bool offset_registers_t::is_bottom() const {
     return m_is_bottom;
 }
 
-void registers_state_t::operator-=(register_t to_forget) {
+void offset_registers_t::operator-=(register_t to_forget) {
     if (is_bottom()) {
         return;
     }
-    m_cur_def[to_forget] = nullptr;
+    m_cur_register_def[to_forget] = nullptr;
 }
 
-registers_state_t registers_state_t::operator|(const registers_state_t& other) const {
+offset_registers_t offset_registers_t::operator|(const offset_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
 
-    registers_state_t joined_state(m_offset_env, m_slacks);
+    offset_registers_t joined_state(m_registers_env, m_slacks);
     location_t loc = location_t::top();
 
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             if (rf1.same_type(rf2)) {
@@ -108,7 +108,7 @@ registers_state_t registers_state_t::operator|(const registers_state_t& other) c
     return joined_state;
 }
 
-void registers_state_t::adjust_bb_for_registers(location_t loc) {
+void offset_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, std::move(*it));
@@ -116,13 +116,13 @@ void registers_state_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
-void registers_state_t::scratch_caller_saved_registers() {
+void offset_registers_t::scratch_caller_saved_registers() {
     for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
         operator-=(register_t{r});
     }
 }
 
-void registers_state_t::forget_packet_pointers(location_t loc) {
+void offset_registers_t::forget_packet_pointers(location_t loc) {
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (auto it = find(register_t{r})) {
             if (it->get_type() == refinement_type_t::PACKET) {
@@ -134,72 +134,72 @@ void registers_state_t::forget_packet_pointers(location_t loc) {
     // TODO: verify if this is all needed
 }
 
-void stack_state_t::set_to_top() {
-    m_slot_rfs.clear();
+void offset_stack_t::set_to_top() {
+    m_stack_cells.clear();
     m_is_bottom = false;
 }
 
-void stack_state_t::set_to_bottom() {
-    m_slot_rfs.clear();
+void offset_stack_t::set_to_bottom() {
+    m_stack_cells.clear();
     m_is_bottom = true;
 }
 
-bool stack_state_t::is_top() const {
+bool offset_stack_t::is_top() const {
     if (m_is_bottom) return false;
-    return m_slot_rfs.empty();
+    return m_stack_cells.empty();
 }
 
-bool stack_state_t::is_bottom() const {
+bool offset_stack_t::is_bottom() const {
     return m_is_bottom;
 }
 
-stack_state_t stack_state_t::top() {
-    return stack_state_t(false);
+offset_stack_t offset_stack_t::top() {
+    return offset_stack_t(false);
 }
 
-std::optional<refinement_cells_t> stack_state_t::find(uint64_t key) const {
-    auto it = m_slot_rfs.find(key);
-    if (it == m_slot_rfs.end()) return {};
+std::optional<refinement_stack_cell_t> offset_stack_t::find(uint64_t key) const {
+    auto it = m_stack_cells.find(key);
+    if (it == m_stack_cells.end()) return {};
     return it->second;
 }
 
-void stack_state_t::store(uint64_t key, refinement_t d, int width) {
-    m_slot_rfs[key] = std::make_pair(d, width);
+void offset_stack_t::store(uint64_t key, refinement_t d, int width) {
+    m_stack_cells[key] = std::make_pair(d, width);
 }
 
-std::vector<uint64_t> stack_state_t::get_keys() const {
+std::vector<uint64_t> offset_stack_t::get_keys() const {
     std::vector<uint64_t> keys;
-    keys.reserve(m_slot_rfs.size());
+    keys.reserve(m_stack_cells.size());
 
-    for (auto const& kv : m_slot_rfs) {
+    for (auto const& kv : m_stack_cells) {
         keys.push_back(kv.first);
     }
     return keys;
 }
 
-void stack_state_t::operator-=(uint64_t to_erase) {
+void offset_stack_t::operator-=(uint64_t to_erase) {
     if (is_bottom()) {
         return;
     }
-    m_slot_rfs.erase(to_erase);
+    m_stack_cells.erase(to_erase);
 }
 
-void stack_state_t::operator-=(const std::vector<uint64_t>& keys) {
+void offset_stack_t::operator-=(const std::vector<uint64_t>& keys) {
     for (auto &key : keys) {
        *this -= key;
     }
 }
 
-stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
+offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
 
-    stack_slot_refinements_t out_stack_rfs;
+    refinement_stack_cells_t out_stack_rfs;
     // We do not join rf cells because different rf values different types of offsets
-    for (auto const&kv: m_slot_rfs) {
+    for (auto const&kv: m_stack_cells) {
         auto maybe_rf_cells = other.find(kv.first);
         if (maybe_rf_cells) {
             auto rf_cells1 = kv.second;
@@ -215,51 +215,45 @@ stack_state_t stack_state_t::operator|(const stack_state_t& other) const {
             }
         }
     }
-    return stack_state_t(std::move(out_stack_rfs));
+    return offset_stack_t(std::move(out_stack_rfs));
 }
 
-ctx_offsets_t::ctx_offsets_t(const ebpf_context_descriptor_t* desc) {
+offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc) {
     if (desc->data >= 0) {
-        m_rfs[desc->data] = refinement_t::begin();
+        m_ctx_cells[desc->data] = refinement_t::begin();
     }
     if (desc->end >= 0) {
-        m_rfs[desc->end] = refinement_t::end();
+        m_ctx_cells[desc->end] = refinement_t::end();
     }
     if (desc->meta >= 0) {
-        m_rfs[desc->meta] = refinement_t::meta();
+        m_ctx_cells[desc->meta] = refinement_t::meta();
     }
-    if (desc->size >= 0) {
-        m_size = desc->size;
-    }
-}
-
-int ctx_offsets_t::get_size() const {
-    return m_size;
+    m_size = std::max(0, desc->size);
 }
 
-std::vector<uint64_t> ctx_offsets_t::get_keys() const {
+std::vector<uint64_t> offset_ctx_t::get_keys() const {
     std::vector<uint64_t> keys;
-    keys.reserve(m_rfs.size());
+    keys.reserve(m_ctx_cells.size());
 
-    for (auto const& kv : m_rfs) {
+    for (auto const& kv : m_ctx_cells) {
         keys.push_back(kv.first);
     }
     return keys;
 }
 
-std::optional<refinement_t> ctx_offsets_t::find(uint64_t key) const {
-    auto it = m_rfs.find(key);
-    if (it == m_rfs.end()) return {};
+std::optional<refinement_t> offset_ctx_t::find(uint64_t key) const {
+    auto it = m_ctx_cells.find(key);
+    if (it == m_ctx_cells.end()) return {};
     return it->second;
 }
 
 offset_domain_t&& offset_domain_t::setup_entry() {
-    registers_state_t regs(std::make_shared<global_offset_env_t>(),
+    offset_registers_t regs(std::make_shared<global_env_offset_registers_t>(),
                       std::make_shared<slacks_t>(),
                       global_program_info->type.context_descriptor);
 
-    static offset_domain_t off_d(std::move(regs), stack_state_t::top(),
-                      std::make_shared<ctx_offsets_t>(global_program_info->type.context_descriptor));
+    static offset_domain_t off_d(std::move(regs), offset_stack_t::top(),
+                      std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor));
     return std::move(off_d);
 }
 
@@ -270,25 +264,25 @@ offset_domain_t offset_domain_t::bottom() {
 }
 
 void offset_domain_t::set_to_top() {
-    m_reg_state.set_to_top();
-    m_stack_state.set_to_top();
+    m_registers.set_to_top();
+    m_stack.set_to_top();
     m_is_bottom = false;
 }
 
 void offset_domain_t::set_to_bottom() {
     m_is_bottom = true;
-    m_reg_state.set_to_bottom();
-    m_stack_state.set_to_bottom();
+    m_registers.set_to_bottom();
+    m_stack.set_to_bottom();
 }
 
 bool offset_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
-    return (m_reg_state.is_bottom() || m_stack_state.is_bottom());
+    return (m_registers.is_bottom() || m_stack.is_bottom());
 }
 
 bool offset_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_reg_state.is_top() && m_stack_state.is_top());
+    return (m_registers.is_top() && m_stack.is_top());
 }
 
 // inclusion
@@ -316,9 +310,9 @@ offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
         return *this;
     }
     return offset_domain_t(
-            m_reg_state | other.m_reg_state,
-            m_stack_state | other.m_stack_state,
-            m_ctx_rfs
+            m_registers | other.m_registers,
+            m_stack | other.m_stack,
+            m_ctx
     );
 }
 
@@ -330,9 +324,9 @@ offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
         return *this;
     }
     return offset_domain_t(
-            m_reg_state | std::move(other.m_reg_state),
-            m_stack_state | std::move(other.m_stack_state),
-            m_ctx_rfs
+            m_registers | std::move(other.m_registers),
+            m_stack | std::move(other.m_stack),
+            m_ctx
     );
 }
 
@@ -375,8 +369,8 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
     Condition cond = b.cond;
     if (std::holds_alternative<Reg>(cond.right)) {
         auto right_reg = std::get<Reg>(cond.right).v;
-        auto rf_left = m_reg_state.find(cond.left.v);
-        auto rf_right = m_reg_state.find(right_reg);
+        auto rf_left = m_registers.find(cond.left.v);
+        auto rf_right = m_registers.find(right_reg);
         if (!rf_left || !rf_right) {
             // this should not happen, comparison between a packet pointer and either
             // other region's pointers or numbers; possibly raise type error
@@ -384,7 +378,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             return;
         }
         if (cond.op == Condition::Op::LE) {
-            auto b = m_reg_state.find(register_t{12});
+            auto b = m_registers.find(register_t{12});
             auto le_rf = *rf_left <= *rf_right;
             if (b) {
                 b->add_constraint(std::move(le_rf));
@@ -395,12 +389,12 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                     set_to_bottom();
                 }
                 else {
-                    m_reg_state.insert(register_t{12}, loc, std::move(*b));
+                    m_registers.insert(register_t{12}, loc, std::move(*b));
                 }
             }
         }
         else if (cond.op == Condition::Op::GT) {
-            auto b = m_reg_state.find(register_t{12});
+            auto b = m_registers.find(register_t{12});
             auto gt_rf = *rf_left > *rf_right;
             if (b) {
                 b->add_constraint(std::move(gt_rf));
@@ -409,7 +403,7 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
                     set_to_bottom();
                 }
                 else {
-                    m_reg_state.insert(register_t{12}, loc, std::move(*b));
+                    m_registers.insert(register_t{12}, loc, std::move(*b));
                 }
             }
 
@@ -419,8 +413,8 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
 }
 
 interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_t src) const {
-    auto dst_rf = m_reg_state.find(dst);
-    auto src_rf = m_reg_state.find(src);
+    auto dst_rf = m_registers.find(dst);
+    auto src_rf = m_registers.find(src);
     if (!dst_rf || !src_rf) return interval_t::bottom();
     expression_t dst_expr = dst_rf->get_value();
     expression_t src_expr = src_rf->get_value();
@@ -434,14 +428,14 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     if (!dst_expr.is_singleton() || !src_expr.is_singleton()) return interval_t::top();
     auto dst_symbol = dst_expr.get_singleton();
     auto src_symbol = src_expr.get_singleton();
-    std::optional<refinement_t> begin_rf = m_reg_state.find(register_t{12});
+    std::optional<refinement_t> begin_rf = m_registers.find(register_t{12});
     if (!begin_rf) return interval_t::top();
     interval_t result_interval = result_rf.simplify_for_subtraction(dst_symbol, src_symbol,
             begin_rf->get_constraints());
     return result_interval;
 }
 
-static void create_numeric_refinement(registers_state_t& reg_state, mock_interval_t&& interval,
+static void create_numeric_refinement(offset_registers_t& reg_state, mock_interval_t&& interval,
         location_t loc, register_t reg) {
     symbol_t s = symbol_t::make();
     reg_state.insert_slack_value(s, std::move(interval));
@@ -474,42 +468,42 @@ void offset_domain_t::do_bin(const Bin& bin,
             case Op::MOV: {
                 // ra = imm
                 // we just get the value of the immediate as an interval from interval domain
-                create_numeric_refinement(m_reg_state, std::move(interval_result),
+                create_numeric_refinement(m_registers, std::move(interval_result),
                         loc, dst_register);
                 break;
             }
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
-                if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                if (auto dst_rf_opt = m_registers.find(dst_register)) {
                     auto rf = *dst_rf_opt + imm_interval;
-                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                    m_registers.insert(dst_register, loc, std::move(rf));
                 }
                 else {
-                    m_reg_state -= dst_register;
+                    m_registers -= dst_register;
                 }
                 break;
             }
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) break;
-                if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                if (auto dst_rf_opt = m_registers.find(dst_register)) {
                     auto rf = *dst_rf_opt + (-imm_interval);
-                    m_reg_state.insert(dst_register, loc, std::move(rf));
+                    m_registers.insert(dst_register, loc, std::move(rf));
                 }
                 else {
-                    m_reg_state -= dst_register;
+                    m_registers -= dst_register;
                 }
                 break;
             }
             default: {
                 if (dst_signed_interval_opt) {
-                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                    create_numeric_refinement(m_registers, std::move(interval_result),
                             loc, dst_register);
                 }
                 else {
                     // no other operations supported for packet pointers in the offset domain
-                    m_reg_state -= dst_register;
+                    m_registers -= dst_register;
                 }
                 break;
             }
@@ -520,11 +514,11 @@ void offset_domain_t::do_bin(const Bin& bin,
         switch (bin.op) {
             case Op::MOV: {
                 // ra = rb
-                if (auto src_rf_opt = m_reg_state.find(src.v)) {
-                    m_reg_state.insert(dst_register, loc, std::move(*src_rf_opt));
+                if (auto src_rf_opt = m_registers.find(src.v)) {
+                    m_registers.insert(dst_register, loc, std::move(*src_rf_opt));
                 }
                 else {
-                    m_reg_state -= dst_register;
+                    m_registers -= dst_register;
                 }
                 break;
             }
@@ -535,17 +529,17 @@ void offset_domain_t::do_bin(const Bin& bin,
                     set_to_bottom();
                 }
                 else {
-                    if (auto src_rf_opt = m_reg_state.find(src.v)) {
-                        if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                    if (auto src_rf_opt = m_registers.find(src.v)) {
+                        if (auto dst_rf_opt = m_registers.find(dst_register)) {
                             auto rf = *dst_rf_opt + *src_rf_opt;
-                            m_reg_state.insert(dst_register, loc, std::move(rf));
+                            m_registers.insert(dst_register, loc, std::move(rf));
                         }
                         else {
-                            m_reg_state -= dst_register;
+                            m_registers -= dst_register;
                         }
                     }
                     else {
-                        m_reg_state -= dst_register;
+                        m_registers -= dst_register;
                     }
                 }
                 break;
@@ -553,22 +547,22 @@ void offset_domain_t::do_bin(const Bin& bin,
             case Op::SUB: {
                 // ra -= rb
                 if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
-                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                    create_numeric_refinement(m_registers, std::move(interval_result),
                             loc, dst_register);
                     return;
                 }
                 else {
-                    if (auto src_rf_opt = m_reg_state.find(src.v)) {
-                        if (auto dst_rf_opt = m_reg_state.find(dst_register)) {
+                    if (auto src_rf_opt = m_registers.find(src.v)) {
+                        if (auto dst_rf_opt = m_registers.find(dst_register)) {
                             auto rf = *dst_rf_opt - *src_rf_opt;
-                            m_reg_state.insert(dst_register, loc, std::move(rf));
+                            m_registers.insert(dst_register, loc, std::move(rf));
                         }
                         else {
-                            m_reg_state -= dst_register;
+                            m_registers -= dst_register;
                         }
                     }
                     else {
-                        m_reg_state -= dst_register;
+                        m_registers -= dst_register;
                     }
                 }
                 break;
@@ -576,10 +570,10 @@ void offset_domain_t::do_bin(const Bin& bin,
             default: {
                 if (dst_ptr_or_mapfd_opt || src_ptr_or_mapfd_opt) {
                     // no other operations supported for packet pointers in the offset domain
-                    m_reg_state -= dst_register;
+                    m_registers -= dst_register;
                 }
                 else {
-                    create_numeric_refinement(m_reg_state, std::move(interval_result),
+                    create_numeric_refinement(m_registers, std::move(interval_result),
                             loc, dst_register);
                 }
                 break;
@@ -602,36 +596,36 @@ void offset_domain_t::operator()(const Un& u, location_t loc) {
 
 void offset_domain_t::do_un(const Un& u, interval_t interval, location_t loc) {
     if (interval == interval_t::bottom()) {
-        m_reg_state -= u.dst.v;
+        m_registers -= u.dst.v;
     }
     else {
-        create_numeric_refinement(m_reg_state, std::move(interval), loc, register_t{u.dst.v});
+        create_numeric_refinement(m_registers, std::move(interval), loc, register_t{u.dst.v});
     }
 }
 
 void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
-    m_reg_state -= u.dst.v;
+    m_registers -= u.dst.v;
 }
 
 void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
     for (const auto& kv : cells) {
         auto rf = kv.first;
         auto width = kv.second;
-        auto overlapping_cells = m_stack_state.find_overlapping_cells(rf, width);
-        m_stack_state -= overlapping_cells;
+        auto overlapping_cells = m_stack.find_overlapping_cells(rf, width);
+        m_stack -= overlapping_cells;
     }
-    m_reg_state.scratch_caller_saved_registers();
+    m_registers.scratch_caller_saved_registers();
     register_t r0{R0_RETURN_VALUE};
     if (u.reallocate_packet) {
-        m_reg_state -= r0;
-        m_reg_state.forget_packet_pointers(loc);
+        m_registers -= r0;
+        m_registers.forget_packet_pointers(loc);
     }
     else if (u.is_map_lookup) {
-        m_reg_state -= r0;
+        m_registers -= r0;
     }
     else {
         // slack needs to be fixed, as it can have any value
-        create_numeric_refinement(m_reg_state, mock_interval_t::top(), loc, r0);
+        create_numeric_refinement(m_registers, mock_interval_t::top(), loc, r0);
     }
 }
 
@@ -645,16 +639,16 @@ void offset_domain_t::operator()(const Jmp& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const Packet& u, location_t loc) {
-    create_numeric_refinement(m_reg_state, mock_interval_t::top(), loc,
+    create_numeric_refinement(m_registers, mock_interval_t::top(), loc,
             register_t{R0_RETURN_VALUE});
-    m_reg_state.scratch_caller_saved_registers();
+    m_registers.scratch_caller_saved_registers();
 }
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
-    auto begin = m_reg_state.find(register_t{12});
+    auto begin = m_registers.find(register_t{12});
     if (!begin) return false;
-    auto reg = m_reg_state.find(r.v);
+    auto reg = m_registers.find(r.v);
     if (!reg) return false;
     auto toCheck = *reg + (offset+width);
     return toCheck.is_safe_with(*begin, is_comparison_check);
@@ -684,13 +678,13 @@ void offset_domain_t::do_mem_store(const Mem& b,
 
     if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
-        rf_info = m_reg_state.find(target_reg.v);
+        rf_info = m_registers.find(target_reg.v);
     }
     else {
         symbol_t s = symbol_t::make();
-        rf_info = refinement_t(refinement_type_t::NUM, expression_t(s, m_reg_state.get_slacks()));
+        rf_info = refinement_t(refinement_type_t::NUM, expression_t(s, m_registers.get_slacks()));
         interval_t interval = interval_t{number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}};
-        m_reg_state.insert_slack_value(s, std::move(interval));
+        m_registers.insert_slack_value(s, std::move(interval));
     }
     if (!rf_info) return;
 
@@ -700,9 +694,9 @@ void offset_domain_t::do_mem_store(const Mem& b,
     auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
     if (!basereg_off_singleton) return;
     auto store_at = (*basereg_off_singleton + offset).cast_to<uint64_t>();
-    auto overlapping_cells = m_stack_state.find_overlapping_cells(store_at, width);
-    m_stack_state -= overlapping_cells;
-    m_stack_state.store(store_at, *rf_info, width);
+    auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
+    m_stack -= overlapping_cells;
+    m_stack.store(store_at, *rf_info, width);
 }
 
 void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
@@ -715,14 +709,14 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
 
     if (interval_result != interval_t::bottom()) {
         if (is_ctx_p || is_shared_p || is_packet_p) {
-            create_numeric_refinement(m_reg_state, std::move(interval_result), loc,
+            create_numeric_refinement(m_registers, std::move(interval_result), loc,
                     target_register);
             return;
         }
     }
 
     if (!is_stack_p && !is_ctx_p) {
-        m_reg_state -= target_register;
+        m_registers -= target_register;
         return;
     }
 
@@ -733,7 +727,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
     auto offset_singleton = p_offset.to_interval().singleton();
     if (is_stack_p) {
         if (!offset_singleton) {
-            for (auto const& k : m_stack_state.get_keys()) {
+            for (auto const& k : m_stack.get_keys()) {
                 auto start = p_offset.lb();
                 auto end = p_offset.ub()+number_t{offset+width-1};
                 interval_t range{start, end};
@@ -746,28 +740,28 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
                 }
                 */
             }
-            m_reg_state -= target_register;
+            m_registers -= target_register;
         }
         else {
             if (width != 1 && width != 2 && width != 4 && width != 8) {
-                m_reg_state -= target_register;
+                m_registers -= target_register;
                 return;
             }
             auto ptr_offset = offset_singleton.value();
             auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
 
-            auto loaded = m_stack_state.find(load_at);
+            auto loaded = m_stack.find(load_at);
             if (!loaded) {
                 // no field at loaded offset in stack
-                m_reg_state -= target_register;
+                m_registers -= target_register;
                 return;
             }
-            m_reg_state.insert(target_register, loc, std::move(loaded->first));
+            m_registers.insert(target_register, loc, std::move(loaded->first));
         }
     }
     else {
         if (!offset_singleton) {
-            for (auto const& k : m_ctx_rfs->get_keys()) {
+            for (auto const& k : m_ctx->get_keys()) {
                 auto start = p_offset.lb();
                 auto end = p_offset.ub()+crab::bound_t{offset+width-1};
                 interval_t range{start, end};
@@ -780,19 +774,19 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
                 }
                 */
             }
-            m_reg_state -= target_register;
+            m_registers -= target_register;
         }
         else {
             auto ptr_offset = offset_singleton.value();
             auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
 
-            auto loaded = m_ctx_rfs->find(load_at);
+            auto loaded = m_ctx->find(load_at);
             if (!loaded) {
                 // no field at loaded offset in ctx
-                m_reg_state -= target_register;
+                m_registers -= target_register;
                 return;
             }
-            m_reg_state.insert(target_register, loc, std::move(*loaded));
+            m_registers.insert(target_register, loc, std::move(*loaded));
         }
     }
 }
@@ -802,35 +796,35 @@ void offset_domain_t::operator()(const Mem& b, location_t loc) {
 }
 
 std::vector<uint64_t> offset_domain_t::get_ctx_keys() const {
-    return m_ctx_rfs->get_keys();
+    return m_ctx->get_keys();
 }
 
 std::optional<refinement_t> offset_domain_t::find_refinement_at_loc(const register_location_t reg) const {
-    return m_reg_state.find(reg);
+    return m_registers.find(reg);
 }
 
 std::optional<refinement_t> offset_domain_t::find_in_ctx(int key) const {
-    return m_ctx_rfs->find(key);
+    return m_ctx->find(key);
 }
 
-std::optional<refinement_cells_t> offset_domain_t::find_in_stack(int key) const {
-    return m_stack_state.find(key);
+std::optional<refinement_stack_cell_t> offset_domain_t::find_in_stack(int key) const {
+    return m_stack.find(key);
 }
 
 std::optional<refinement_t> offset_domain_t::find_refinement_info(register_t reg) const {
-    return m_reg_state.find(reg);
+    return m_registers.find(reg);
 }
 
 void offset_domain_t::insert_in_registers(register_t reg, location_t loc, refinement_t rf) {
-    m_reg_state.insert(reg, loc, std::move(rf));
+    m_registers.insert(reg, loc, std::move(rf));
 }
 
 void offset_domain_t::store_in_stack(uint64_t key, refinement_t d, int width) {
-    m_stack_state.store(key, d, width);
+    m_stack.store(key, d, width);
 }
 
 void offset_domain_t::adjust_bb_for_types(location_t loc) {
-    m_reg_state.adjust_bb_for_registers(loc);
+    m_registers.adjust_bb_for_registers(loc);
 }
 
 } // namespace crab
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 1b221b472..8899bb029 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -9,26 +9,25 @@
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using live_refinements_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
-using global_offset_env_t = std::unordered_map<register_location_t, refinement_t>;
+using global_env_offset_registers_t = std::unordered_map<register_location_t, refinement_t>;
 
-class registers_state_t {
+class offset_registers_t {
 
-    live_refinements_t m_cur_def;
-    std::shared_ptr<global_offset_env_t> m_offset_env;
+    live_registers_t m_cur_register_def;
+    std::shared_ptr<global_env_offset_registers_t> m_registers_env;
     std::shared_ptr<slacks_t> m_slacks;
     bool m_is_bottom = false;
 
     public:
-        registers_state_t(bool is_bottom = false) : m_offset_env(nullptr), m_slacks(nullptr),
+        offset_registers_t(bool is_bottom = false) : m_registers_env(nullptr), m_slacks(nullptr),
         m_is_bottom(is_bottom) {}
-        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env,
+        offset_registers_t(std::shared_ptr<global_env_offset_registers_t> registers_env,
                 std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
-            : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {}
-        registers_state_t(std::shared_ptr<global_offset_env_t> offset_env,
+            : m_registers_env(registers_env), m_slacks(slacks), m_is_bottom(is_bottom) {}
+        offset_registers_t(std::shared_ptr<global_env_offset_registers_t> registers_env,
                 std::shared_ptr<slacks_t> slacks, const ebpf_context_descriptor_t* desc,
                 bool is_bottom = false)
-            : m_offset_env(offset_env), m_slacks(slacks), m_is_bottom(is_bottom) {
+            : m_registers_env(registers_env), m_slacks(slacks), m_is_bottom(is_bottom) {
 
             location_t loc{label_t::entry, 0};
             if (desc->data >= 0) {
@@ -36,13 +35,13 @@ class registers_state_t {
             }
         }
 
-        explicit registers_state_t(live_refinements_t&& vars,
-                std::shared_ptr<global_offset_env_t> offset_env,
+        explicit offset_registers_t(live_registers_t&& vars,
+                std::shared_ptr<global_env_offset_registers_t> registers_env,
                 std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
-            : m_cur_def(std::move(vars)), m_offset_env(offset_env), m_slacks(slacks),
+            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_slacks(slacks),
             m_is_bottom(is_bottom) {}
 
-        registers_state_t operator|(const registers_state_t&) const;
+        offset_registers_t operator|(const offset_registers_t&) const;
         void operator-=(register_t);
         void set_to_top();
         void set_to_bottom();
@@ -54,22 +53,22 @@ class registers_state_t {
         std::optional<mock_interval_t> find_slack_value(symbol_t) const;
         std::optional<refinement_t> find(register_location_t reg) const;
         std::optional<refinement_t> find(register_t key) const;
-        friend std::ostream& operator<<(std::ostream& o, const registers_state_t& p);
+        friend std::ostream& operator<<(std::ostream& o, const offset_registers_t& p);
         void adjust_bb_for_registers(location_t);
         void scratch_caller_saved_registers();
         void forget_packet_pointers(location_t);
 };
 
-using refinement_cells_t = std::pair<refinement_t, int>;
-using stack_slot_refinements_t = std::map<uint64_t, refinement_cells_t>;
-class stack_state_t {
+using refinement_stack_cell_t = std::pair<refinement_t, int>;
+using refinement_stack_cells_t = std::map<uint64_t, refinement_stack_cell_t>;
 
-    stack_slot_refinements_t m_slot_rfs;
+class offset_stack_t {
+    refinement_stack_cells_t m_stack_cells;
     bool m_is_bottom = false;
 
     public:
-        stack_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        std::optional<refinement_cells_t> find(uint64_t) const;
+        offset_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        std::optional<refinement_stack_cell_t> find(uint64_t) const;
         void store(uint64_t, refinement_t, int);
         void operator-=(uint64_t);
         void operator-=(const std::vector<uint64_t>&);
@@ -77,32 +76,32 @@ class stack_state_t {
         void set_to_bottom();
         bool is_bottom() const;
         bool is_top() const;
-        static stack_state_t top();
-        stack_state_t operator|(const stack_state_t&) const;
-        explicit stack_state_t(stack_slot_refinements_t&& stack_rfs, bool is_bottom = false)
-            : m_slot_rfs(std::move(stack_rfs)), m_is_bottom(is_bottom) {}
+        static offset_stack_t top();
+        offset_stack_t operator|(const offset_stack_t&) const;
+        explicit offset_stack_t(refinement_stack_cells_t&& cells, bool is_bottom = false)
+            : m_stack_cells(std::move(cells)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
         std::vector<uint64_t> get_keys() const;
 };
 
-class ctx_offsets_t {
-    using ctx_refinements_t = std::unordered_map<uint64_t, refinement_t>;    // represents `cp[n] = rf;`
-    ctx_refinements_t m_rfs;
-    int m_size;
+class offset_ctx_t {
+    using refinement_ctx_cells_t = std::unordered_map<uint64_t, refinement_t>;    // represents `cp[n] = rf;`
+    refinement_ctx_cells_t m_ctx_cells;
+    size_t m_size;
 
     public:
-        ctx_offsets_t(const ebpf_context_descriptor_t* desc);
+        offset_ctx_t(const ebpf_context_descriptor_t* desc);
         std::optional<refinement_t> find(uint64_t) const;
-        int get_size() const;
+        size_t get_size() const { return m_size; }
         std::vector<uint64_t> get_keys() const;
 };
 
 class offset_domain_t final {
 
     bool m_is_bottom = false;
-    registers_state_t m_reg_state;
-    stack_state_t m_stack_state;
-    std::shared_ptr<ctx_offsets_t> m_ctx_rfs;
+    offset_registers_t m_registers;
+    offset_stack_t m_stack;
+    std::shared_ptr<offset_ctx_t> m_ctx;
     std::vector<std::string> m_errors;
 
   public:
@@ -111,9 +110,9 @@ class offset_domain_t final {
     offset_domain_t(const offset_domain_t& o) = default;
     offset_domain_t& operator=(offset_domain_t&& o) = default;
     offset_domain_t& operator=(const offset_domain_t& o) = default;
-    explicit offset_domain_t(registers_state_t&& reg, stack_state_t&& stack,
-            std::shared_ptr<ctx_offsets_t> ctx)
-        : m_reg_state(std::move(reg)), m_stack_state(std::move(stack)), m_ctx_rfs(ctx) {}
+    explicit offset_domain_t(offset_registers_t&& reg, offset_stack_t&& stack,
+            std::shared_ptr<offset_ctx_t> ctx)
+        : m_registers(std::move(reg)), m_stack(std::move(stack)), m_ctx(ctx) {}
 
     static offset_domain_t&& setup_entry();
     // bottom/top
@@ -136,7 +135,7 @@ class offset_domain_t final {
     // narrowing
     offset_domain_t narrow(const offset_domain_t& other) const;
     //forget
-    void operator-=(register_t reg) { m_reg_state -= reg; }
+    void operator-=(register_t reg) { m_registers -= reg; }
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = location_t::top());
@@ -175,7 +174,7 @@ class offset_domain_t final {
 
     std::vector<uint64_t> get_ctx_keys() const;
     std::optional<refinement_t> find_in_ctx(int) const;
-    std::optional<refinement_cells_t> find_in_stack(int) const;
+    std::optional<refinement_stack_cell_t> find_in_stack(int) const;
     std::optional<refinement_t> find_refinement_at_loc(const register_location_t) const;
     std::optional<refinement_t> find_refinement_info(register_t reg) const;
     void insert_in_registers(register_t, location_t, refinement_t);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 3568e97d1..8abc2a426 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -48,13 +48,13 @@ static inline std::vector<std::set<int>> join_shared_ptr_aliases(
     return result;
 }
 
-void register_types_t::scratch_caller_saved_registers() {
+void region_registers_t::scratch_caller_saved_registers() {
     for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
         operator-=(register_t{r});
     }
 }
 
-void register_types_t::forget_packet_ptrs() {
+void region_registers_t::forget_packet_ptrs() {
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (is_packet_ptr(find(register_t{r}))) {
             operator-=(register_t{r});
@@ -62,13 +62,13 @@ void register_types_t::forget_packet_ptrs() {
     }
 }
 
-register_types_t register_types_t::operator|(const register_types_t& other) const {
+region_registers_t region_registers_t::operator|(const region_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    register_types_t joined_reg_types(m_region_env);
+    region_registers_t joined_reg_types(m_registers_env);
 
     // a hack to store region information at the start of a joined basic block
     // in join, we do not know the label of the bb, hence we store the information
@@ -77,7 +77,7 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     location_t loc = location_t::top();
 
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
+        if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(register_t{i});
         auto maybe_ptr2 = other.find(register_t{i});
         if (maybe_ptr1 && maybe_ptr2) {
@@ -106,52 +106,52 @@ register_types_t register_types_t::operator|(const register_types_t& other) cons
     return joined_reg_types;
 }
 
-void register_types_t::operator-=(register_t var) {
+void region_registers_t::operator-=(register_t var) {
     if (is_bottom()) {
         return;
     }
-    m_cur_def[var] = nullptr;
+    m_cur_register_def[var] = nullptr;
 }
 
-void register_types_t::set_to_bottom() {
+void region_registers_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void register_types_t::set_to_top() {
-    m_region_env = std::make_shared<global_region_env_t>();
-    m_cur_def = live_registers_t{nullptr};
+void region_registers_t::set_to_top() {
+    m_registers_env = std::make_shared<global_env_region_registers_t>();
+    m_cur_register_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
 
-bool register_types_t::is_bottom() const { return m_is_bottom; }
+bool region_registers_t::is_bottom() const { return m_is_bottom; }
 
-bool register_types_t::is_top() const {
+bool region_registers_t::is_top() const {
     if (m_is_bottom) { return false; }
-    if (m_region_env == nullptr) return true;
-    for (auto &it : m_cur_def) {
+    if (m_registers_env == nullptr) return true;
+    for (auto &it : m_cur_register_def) {
         if (it != nullptr) return false;
     }
     return true;
 }
 
-void register_types_t::insert(register_t reg, const location_t& loc, const ptr_or_mapfd_t& type) {
+void region_registers_t::insert(register_t reg, const location_t& loc, const ptr_or_mapfd_t& type) {
     register_location_t register_location = register_location_t{reg, loc};
-    (*m_region_env)[register_location] = type;
-    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
+    (*m_registers_env)[register_location] = type;
+    m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<ptr_or_mapfd_t> register_types_t::find(register_location_t reg) const {
-    auto it = m_region_env->find(reg);
-    if (it == m_region_env->end()) return {};
+std::optional<ptr_or_mapfd_t> region_registers_t::find(register_location_t reg) const {
+    auto it = m_registers_env->find(reg);
+    if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<ptr_or_mapfd_t> register_types_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    return find(*(m_cur_def[key]));
+std::optional<ptr_or_mapfd_t> region_registers_t::find(register_t key) const {
+    if (m_cur_register_def[key] == nullptr) return {};
+    return find(*(m_cur_register_def[key]));
 }
 
-void register_types_t::adjust_bb_for_registers(location_t loc) {
+void region_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, *it);
@@ -159,22 +159,22 @@ void register_types_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
-stack_t stack_t::operator|(const stack_t& other) const {
+region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    stack_t joined_stack;
-    for (auto const&kv: m_ptrs) {
-        auto maybe_ptr_or_mapfd_cells = other.find(kv.first);
-        if (maybe_ptr_or_mapfd_cells) {
-            auto ptr_or_mapfd_cells1 = kv.second;
-            auto ptr_or_mapfd_cells2 = *maybe_ptr_or_mapfd_cells;
-            auto ptr_or_mapfd1 = ptr_or_mapfd_cells1.first;
-            auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
-            int width1 = ptr_or_mapfd_cells1.second;
-            int width2 = ptr_or_mapfd_cells2.second;
+    region_stack_t joined_stack;
+    for (auto const&kv: m_cells) {
+        auto maybe_ptr_or_mapfd_stack_cell = other.find(kv.first);
+        if (maybe_ptr_or_mapfd_stack_cell) {
+            auto ptr_or_mapfd_stack_cell1 = kv.second;
+            auto ptr_or_mapfd_stack_cell2 = *maybe_ptr_or_mapfd_stack_cell;
+            auto ptr_or_mapfd1 = ptr_or_mapfd_stack_cell1.first;
+            auto ptr_or_mapfd2 = ptr_or_mapfd_stack_cell2.first;
+            int width1 = ptr_or_mapfd_stack_cell1.second;
+            int width2 = ptr_or_mapfd_stack_cell2.second;
             int width_joined = std::min(width1, width2);
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
@@ -200,79 +200,79 @@ stack_t stack_t::operator|(const stack_t& other) const {
     return joined_stack;
 }
 
-void stack_t::operator-=(uint64_t key) {
+void region_stack_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
-        m_ptrs.erase(key);
+        m_cells.erase(key);
 }
 
-void stack_t::operator-=(const std::vector<uint64_t>& keys) {
+void region_stack_t::operator-=(const std::vector<uint64_t>& keys) {
     for (auto &key : keys) {
        *this -= key;
     }
 }
 
-void stack_t::set_to_bottom() {
-    m_ptrs.clear();
+void region_stack_t::set_to_bottom() {
+    m_cells.clear();
     m_is_bottom = true;
 }
 
-void stack_t::set_to_top() {
-    m_ptrs.clear();
+void region_stack_t::set_to_top() {
+    m_cells.clear();
     m_is_bottom = false;
 }
 
-stack_t stack_t::bottom() { return stack_t(true); }
+region_stack_t region_stack_t::bottom() { return region_stack_t(true); }
 
-stack_t stack_t::top() { return stack_t(false); }
+region_stack_t region_stack_t::top() { return region_stack_t(false); }
 
-bool stack_t::is_bottom() const { return m_is_bottom; }
+bool region_stack_t::is_bottom() const { return m_is_bottom; }
 
-bool stack_t::is_top() const {
+bool region_stack_t::is_top() const {
     if (m_is_bottom)
         return false;
-    return m_ptrs.empty();
+    return m_cells.empty();
 }
 
-void stack_t::store(uint64_t key, ptr_or_mapfd_t value, int width) {
-    m_ptrs[key] = std::make_pair(value, width);
+void region_stack_t::store(uint64_t key, ptr_or_mapfd_t value, int width) {
+    m_cells[key] = std::make_pair(value, width);
 }
 
-size_t stack_t::size() const {
-    return m_ptrs.size();
+size_t region_stack_t::size() const {
+    return m_cells.size();
 }
 
-std::vector<uint64_t> stack_t::get_keys() const {
+std::vector<uint64_t> region_stack_t::get_keys() const {
     std::vector<uint64_t> keys;
     keys.reserve(size());
 
-    for (auto const&kv : m_ptrs) {
+    for (auto const&kv : m_cells) {
         keys.push_back(kv.first);
     }
     return keys;
 }
 
 
-std::optional<ptr_or_mapfd_cells_t> stack_t::find(uint64_t key) const {
-    auto it = m_ptrs.find(key);
-    if (it == m_ptrs.end()) return {};
+std::optional<ptr_or_mapfd_stack_cell_t> region_stack_t::find(uint64_t key) const {
+    auto it = m_cells.find(key);
+    if (it == m_cells.end()) return {};
     return it->second;
 }
 
-std::vector<uint64_t> stack_t::find_overlapping_cells(uint64_t start, int width) const {
+std::vector<uint64_t> region_stack_t::find_overlapping_cells(uint64_t start, int width) const {
     std::vector<uint64_t> overlapping_cells;
-    auto it = m_ptrs.begin();
-    while (it != m_ptrs.end() && it->first < start) {
+    auto it = m_cells.begin();
+    while (it != m_cells.end() && it->first < start) {
         it++;
     }
-    if (it != m_ptrs.begin()) {
+    if (it != m_cells.begin()) {
         it--;
         auto key = it->first;
         auto width_key = it->second.second;
         if (key < start && key+width_key > start) overlapping_cells.push_back(key);
     }
 
-    for (; it != m_ptrs.end(); it++) {
+    for (; it != m_cells.end(); it++) {
         auto key = it->first;
         if (key >= start && key < start+width) overlapping_cells.push_back(key);
         if (key >= start+width) break;
@@ -341,7 +341,7 @@ std::vector<uint64_t> region_domain_t::get_stack_keys() const {
     return m_stack.get_keys();
 }
 
-std::optional<ptr_or_mapfd_cells_t> region_domain_t::find_in_stack(uint64_t key) const {
+std::optional<ptr_or_mapfd_stack_cell_t> region_domain_t::find_in_stack(uint64_t key) const {
     return m_stack.find(key);
 }
 
@@ -763,7 +763,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
 }
 
 region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
-    register_types_t typ(std::make_shared<global_region_env_t>());
+    region_registers_t typ(std::make_shared<global_env_region_registers_t>());
 
     location_t loc{label_t::entry, 0};
     if (init_r1) {
@@ -773,7 +773,7 @@ region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
     auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    static region_domain_t inv(std::move(typ), stack_t::top());
+    static region_domain_t inv(std::move(typ), region_stack_t::top());
     inv.compute_ctx_size(global_program_info.get().type.context_descriptor);
     return std::move(inv);
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index b9650d39c..ecd351faa 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -11,56 +11,54 @@ namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 using shared_ptr_aliases_t = std::vector<std::set<int>>;
+using ptr_or_mapfd_stack_cell_t = std::pair<ptr_or_mapfd_t, int>;
 
-using ptr_or_mapfd_cells_t = std::pair<ptr_or_mapfd_t, int>;
-using ptr_or_mapfd_types_t = std::map<uint64_t, ptr_or_mapfd_cells_t>;
-
-class stack_t {
-    ptr_or_mapfd_types_t m_ptrs;
+class region_stack_t {
+    using ptr_or_mapfd_stack_cells_t = std::map<uint64_t, ptr_or_mapfd_stack_cell_t>;
+    ptr_or_mapfd_stack_cells_t m_cells;
     bool m_is_bottom;
 
   public:
-    stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-    stack_t(ptr_or_mapfd_types_t && ptrs, bool is_bottom)
-    : m_ptrs(std::move(ptrs)) , m_is_bottom(is_bottom) {}
+    region_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+    region_stack_t(ptr_or_mapfd_stack_cells_t&& cells, bool is_bottom)
+    : m_cells(std::move(cells)) , m_is_bottom(is_bottom) {}
     
-    stack_t operator|(const stack_t& other) const;
+    region_stack_t operator|(const region_stack_t& other) const;
     void operator-=(uint64_t);
     void operator-=(const std::vector<uint64_t>&);
     void set_to_bottom();
     void set_to_top();
-    static stack_t bottom();
-    static stack_t top();
+    static region_stack_t bottom();
+    static region_stack_t top();
     bool is_bottom() const;
     bool is_top() const;
-    const ptr_or_mapfd_types_t &get_ptrs() { return m_ptrs; }
+    const ptr_or_mapfd_stack_cells_t &get_cells() { return m_cells; }
     void store(uint64_t, ptr_or_mapfd_t, int);
-    std::optional<ptr_or_mapfd_cells_t> find(uint64_t) const;
+    std::optional<ptr_or_mapfd_stack_cell_t> find(uint64_t) const;
     std::vector<uint64_t> get_keys() const;
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     size_t size() const;
 };
 
-using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
-using global_region_env_t = std::unordered_map<register_location_t, ptr_or_mapfd_t>;
+using global_env_region_registers_t = std::unordered_map<register_location_t, ptr_or_mapfd_t>;
 
-class register_types_t {
+class region_registers_t {
 
-    live_registers_t m_cur_def;
-    std::shared_ptr<global_region_env_t> m_region_env;
+    live_registers_t m_cur_register_def;
+    std::shared_ptr<global_env_region_registers_t> m_registers_env;
     bool m_is_bottom = false;
 
   public:
-    register_types_t(bool is_bottom = false) : m_region_env(nullptr), m_is_bottom(is_bottom) {}
-    explicit register_types_t(live_registers_t&& vars,
-            std::shared_ptr<global_region_env_t> reg_type_env, bool is_bottom = false)
-        : m_cur_def(std::move(vars)), m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
+    region_registers_t(bool is_bottom = false) : m_registers_env(nullptr), m_is_bottom(is_bottom) {}
+    explicit region_registers_t(live_registers_t&& vars,
+            std::shared_ptr<global_env_region_registers_t> registers_env, bool is_bottom = false)
+        : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
 
-    explicit register_types_t(std::shared_ptr<global_region_env_t> reg_type_env,
+    explicit region_registers_t(std::shared_ptr<global_env_region_registers_t> registers_env,
             bool is_bottom = false)
-        : m_region_env(reg_type_env), m_is_bottom(is_bottom) {}
+        : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
 
-    register_types_t operator|(const register_types_t& other) const;
+    region_registers_t operator|(const region_registers_t& other) const;
     void operator-=(register_t var);
     void set_to_bottom();
     void set_to_top();
@@ -69,7 +67,7 @@ class register_types_t {
     void insert(register_t, const location_t&, const ptr_or_mapfd_t&);
     std::optional<ptr_or_mapfd_t> find(register_location_t reg) const;
     std::optional<ptr_or_mapfd_t> find(register_t key) const;
-    [[nodiscard]] live_registers_t &get_vars() { return m_cur_def; }
+    [[nodiscard]] live_registers_t &get_vars() { return m_cur_register_def; }
     void forget_packet_ptrs();
     void scratch_caller_saved_registers();
     void adjust_bb_for_registers(location_t loc);
@@ -78,8 +76,8 @@ class register_types_t {
 class region_domain_t final {
 
     bool m_is_bottom = false;
-    crab::stack_t m_stack;
-    crab::register_types_t m_registers;
+    crab::region_stack_t m_stack;
+    crab::region_registers_t m_registers;
     // for ctx, we only keep the size of the context
     size_t ctx_size = 0;
     shared_ptr_aliases_t m_shared_ptr_aliases;
@@ -92,7 +90,7 @@ class region_domain_t final {
     region_domain_t(const region_domain_t& o) = default;
     region_domain_t& operator=(region_domain_t&& o) = default;
     region_domain_t& operator=(const region_domain_t& o) = default;
-    region_domain_t(crab::register_types_t&& _types, crab::stack_t&& _st,
+    explicit region_domain_t(crab::region_registers_t&& _types, crab::region_stack_t&& _st,
             shared_ptr_aliases_t&& _shared_ptr_aliases = {})
             : m_stack(std::move(_st)), m_registers(std::move(_types)),
             m_shared_ptr_aliases(std::move(_shared_ptr_aliases)) {}
@@ -169,7 +167,7 @@ class region_domain_t final {
     [[nodiscard]] size_t get_ctx_size() const;
     std::optional<crab::packet_ptr_t> find_in_ctx(uint64_t key) const;
     [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
-    std::optional<crab::ptr_or_mapfd_cells_t> find_in_stack(uint64_t key) const;
+    std::optional<crab::ptr_or_mapfd_stack_cell_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     void insert_in_registers(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack(uint64_t, ptr_or_mapfd_t, int);
diff --git a/src/crab/register_utils.hpp b/src/crab/register_utils.hpp
index 335e38669..1265a06d0 100644
--- a/src/crab/register_utils.hpp
+++ b/src/crab/register_utils.hpp
@@ -54,6 +54,8 @@ class register_location_t {
     void write(std::ostream& o) const;
 };
 
+// TODO: get rid of shared_ptr for register_location_t
+using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
 
 } // namespace crab
 
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index dbc44ca68..4793197f5 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -1,65 +1,65 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "crab/signed_interval_domain.hpp"
+#include "signed_interval_domain.hpp"
 #include "boost/endian/conversion.hpp"
 #include "config.hpp"
 
 namespace crab {
 
-bool registers_signed_state_t::is_bottom() const {
+bool signed_interval_registers_t::is_bottom() const {
     return m_is_bottom;
 }
 
-bool registers_signed_state_t::is_top() const {
+bool signed_interval_registers_t::is_top() const {
     if (m_is_bottom) return false;
-    if (m_interval_env == nullptr) return true;
-    for (auto it : m_cur_def) {
+    if (m_registers_env == nullptr) return true;
+    for (auto it : m_cur_register_def) {
         if (it != nullptr) return false;
     }
     return true;
 }
 
-void registers_signed_state_t::set_to_top() {
-    m_interval_env = std::make_shared<global_interval_env_t>();
-    m_cur_def = live_registers_t{nullptr};
+void signed_interval_registers_t::set_to_top() {
+    m_registers_env = std::make_shared<global_env_signed_registers_t>();
+    m_cur_register_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
 
-void registers_signed_state_t::set_to_bottom() {
+void signed_interval_registers_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void registers_signed_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+void signed_interval_registers_t::insert(register_t reg, const location_t& loc, interval_t interval) {
     auto register_location = register_location_t{reg, loc};
-    (*m_interval_env)[register_location] = mock_interval_t{interval};
-    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
+    (*m_registers_env)[register_location] = mock_interval_t{interval};
+    m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> registers_signed_state_t::find(register_location_t reg) const {
-    auto it = m_interval_env->find(reg);
-    if (it == m_interval_env->end()) return {};
+std::optional<mock_interval_t> signed_interval_registers_t::find(register_location_t reg) const {
+    auto it = m_registers_env->find(reg);
+    if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> registers_signed_state_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    const register_location_t& reg = *(m_cur_def[key]);
+std::optional<mock_interval_t> signed_interval_registers_t::find(register_t key) const {
+    if (m_cur_register_def[key] == nullptr) return {};
+    const register_location_t& reg = *(m_cur_register_def[key]);
     return find(reg);
 }
 
-registers_signed_state_t registers_signed_state_t::operator|(const registers_signed_state_t& other) const {
+signed_interval_registers_t signed_interval_registers_t::operator|(const signed_interval_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    registers_signed_state_t intervals_joined(m_interval_env);
+    signed_interval_registers_t intervals_joined(m_registers_env);
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
             intervals_joined.insert(register_t{i}, loc,
@@ -69,7 +69,7 @@ registers_signed_state_t registers_signed_state_t::operator|(const registers_sig
     return intervals_joined;
 }
 
-void registers_signed_state_t::adjust_bb_for_registers(location_t loc) {
+void signed_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
@@ -77,9 +77,9 @@ void registers_signed_state_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
-void registers_signed_state_t::operator-=(register_t var) {
+void signed_interval_registers_t::operator-=(register_t var) {
     if (is_bottom()) return;
-    m_cur_def[var] = nullptr;
+    m_cur_register_def[var] = nullptr;
 }
 
 bool stack_slots_signed_state_t::is_bottom() const {
@@ -88,11 +88,11 @@ bool stack_slots_signed_state_t::is_bottom() const {
 
 bool stack_slots_signed_state_t::is_top() const {
     if (m_is_bottom) return false;
-    return m_interval_values.empty();
+    return m_cells.empty();
 }
 
 void stack_slots_signed_state_t::set_to_top() {
-    m_interval_values.clear();
+    m_cells.clear();
     m_is_bottom = false;
 }
 
@@ -104,20 +104,20 @@ stack_slots_signed_state_t stack_slots_signed_state_t::top() {
     return stack_slots_signed_state_t(false);
 }
 
-std::optional<interval_cells_t> stack_slots_signed_state_t::find(uint64_t key) const {
-    auto it = m_interval_values.find(key);
-    if (it == m_interval_values.end()) return {};
+std::optional<signed_interval_stack_cell_t> stack_slots_signed_state_t::find(uint64_t key) const {
+    auto it = m_cells.find(key);
+    if (it == m_cells.end()) return {};
     return it->second;
 }
 
 void stack_slots_signed_state_t::store(uint64_t key, mock_interval_t val, int width) {
-    m_interval_values[key] = std::make_pair(val, width);
+    m_cells[key] = std::make_pair(val, width);
 }
 
 void stack_slots_signed_state_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
-        m_interval_values.erase(key);
+        m_cells.erase(key);
 }
 
 bool stack_slots_signed_state_t::all_numeric(uint64_t start_loc, int width) const {
@@ -177,18 +177,18 @@ void stack_slots_signed_state_t::remove_overlap(const std::vector<uint64_t>& key
 
 std::vector<uint64_t> stack_slots_signed_state_t::find_overlapping_cells(uint64_t start, int width) const {
     std::vector<uint64_t> overlapping_cells;
-    auto it = m_interval_values.begin();
-    while (it != m_interval_values.end() && it->first < start) {
+    auto it = m_cells.begin();
+    while (it != m_cells.end() && it->first < start) {
         it++;
     }
-    if (it != m_interval_values.begin()) {
+    if (it != m_cells.begin()) {
         it--;
         auto key = it->first;
         auto width_key = it->second.second;
         if (key < start && key+width_key > start) overlapping_cells.push_back(key);
     }
 
-    for (; it != m_interval_values.end(); it++) {
+    for (; it != m_cells.end(); it++) {
         auto key = it->first;
         if (key >= start && key < start+width) overlapping_cells.push_back(key);
         if (key >= start+width) break;
@@ -198,7 +198,7 @@ std::vector<uint64_t> stack_slots_signed_state_t::find_overlapping_cells(uint64_
 
 static inline void join_stack(const stack_slots_signed_state_t& stack1, uint64_t key1, int& loc1,
         const stack_slots_signed_state_t& stack2, uint64_t key2, int& loc2,
-        interval_values_stack_t& interval_values_joined) {
+        signed_interval_stack_cells_t& interval_values_joined) {
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
@@ -242,7 +242,7 @@ stack_slots_signed_state_t stack_slots_signed_state_t::operator|(const stack_slo
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    interval_values_stack_t interval_values_joined;
+    signed_interval_stack_cells_t interval_values_joined;
     auto stack1_keys = get_keys();
     auto stack2_keys = other.get_keys();
     int i = 0, j = 0;
@@ -254,14 +254,14 @@ stack_slots_signed_state_t stack_slots_signed_state_t::operator|(const stack_slo
 }
 
 size_t stack_slots_signed_state_t::size() const {
-    return m_interval_values.size();
+    return m_cells.size();
 }
 
 std::vector<uint64_t> stack_slots_signed_state_t::get_keys() const {
     std::vector<uint64_t> keys;
     keys.reserve(size());
 
-    for (auto const&kv : m_interval_values) {
+    for (auto const&kv : m_cells) {
         keys.push_back(kv.first);
     }
     return keys;
@@ -269,12 +269,12 @@ std::vector<uint64_t> stack_slots_signed_state_t::get_keys() const {
 
 bool signed_interval_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
-    return (m_registers_values.is_bottom() || m_stack_slots_values.is_bottom());
+    return (m_registers.is_bottom() || m_stack.is_bottom());
 }
 
 bool signed_interval_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_registers_values.is_top() && m_stack_slots_values.is_top());
+    return (m_registers.is_top() && m_stack.is_top());
 }
 
 signed_interval_domain_t signed_interval_domain_t::bottom() {
@@ -285,71 +285,71 @@ signed_interval_domain_t signed_interval_domain_t::bottom() {
 
 void signed_interval_domain_t::set_to_bottom() {
     m_is_bottom = true;
-    m_registers_values.set_to_bottom();
-    m_stack_slots_values.set_to_bottom();
+    m_registers.set_to_bottom();
+    m_stack.set_to_bottom();
 }
 
 void signed_interval_domain_t::set_registers_to_bottom() {
-    m_registers_values.set_to_bottom();
+    m_registers.set_to_bottom();
 }
 
 void signed_interval_domain_t::set_registers_to_top() {
-    m_registers_values.set_to_top();
+    m_registers.set_to_top();
 }
 
 void signed_interval_domain_t::set_to_top() {
     m_is_bottom = false;
-    m_registers_values.set_to_top();
-    m_stack_slots_values.set_to_top();
+    m_registers.set_to_top();
+    m_stack.set_to_top();
 }
 
-std::optional<interval_cells_t> signed_interval_domain_t::find_in_stack(uint64_t key) const {
-    return m_stack_slots_values.find(key);
+std::optional<signed_interval_stack_cell_t> signed_interval_domain_t::find_in_stack(uint64_t key) const {
+    return m_stack.find(key);
 }
 
 void signed_interval_domain_t::adjust_bb_for_types(location_t loc) {
-    m_registers_values.adjust_bb_for_registers(loc);
+    m_registers.adjust_bb_for_registers(loc);
 }
 
 std::vector<uint64_t> signed_interval_domain_t::get_stack_keys() const {
-    return m_stack_slots_values.get_keys();
+    return m_stack.get_keys();
 }
 
 bool signed_interval_domain_t::all_numeric_in_stack(uint64_t start_loc, int width) const {
-    return m_stack_slots_values.all_numeric(start_loc, width);
+    return m_stack.all_numeric(start_loc, width);
 }
 
 std::vector<uint64_t> signed_interval_domain_t::find_overlapping_cells_in_stack(uint64_t start_loc,
         int width) const {
-    return m_stack_slots_values.find_overlapping_cells(start_loc, width);
+    return m_stack.find_overlapping_cells(start_loc, width);
 }
 
 void signed_interval_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
         uint64_t start_loc, int width) {
-    m_stack_slots_values.remove_overlap(overlap, start_loc, width);
+    m_stack.remove_overlap(overlap, start_loc, width);
 }
 
 void signed_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overlap,
         uint64_t start_loc, int width) {
-    m_stack_slots_values.fill_values(overlap, start_loc, width);
+    m_stack.fill_values(overlap, start_loc, width);
 }
 
 std::optional<mock_interval_t> signed_interval_domain_t::find_interval_value(register_t reg) const {
-    return m_registers_values.find(reg);
+    return m_registers.find(reg);
 }
 
 std::optional<mock_interval_t> signed_interval_domain_t::find_interval_at_loc(
         const register_location_t reg) const {
-    return m_registers_values.find(reg);
+    return m_registers.find(reg);
 }
 
 void signed_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
         interval_t interval) {
-    m_registers_values.insert(reg, loc, interval);
+    m_registers.insert(reg, loc, interval);
 }
 
 void signed_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
-    m_stack_slots_values.store(key, interval, width);
+    m_stack.store(key, interval, width);
 }
 
 bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
@@ -377,8 +377,8 @@ signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interv
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return signed_interval_domain_t(m_registers_values | other.m_registers_values,
-            m_stack_slots_values | other.m_stack_slots_values);
+    return signed_interval_domain_t(m_registers | other.m_registers,
+            m_stack | other.m_stack);
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_domain_t&& other) const {
@@ -389,8 +389,8 @@ signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_dom
         return *this;
     }
     return signed_interval_domain_t(
-            m_registers_values | std::move(other.m_registers_values),
-            m_stack_slots_values | std::move(other.m_stack_slots_values));
+            m_registers | std::move(other.m_registers),
+            m_stack | std::move(other.m_stack));
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator&(const signed_interval_domain_t& abs) const {
@@ -422,7 +422,7 @@ string_invariant signed_interval_domain_t::to_set() {
 }
 
 signed_interval_domain_t signed_interval_domain_t::setup_entry() {
-    registers_signed_state_t registers(std::make_shared<global_interval_env_t>());
+    signed_interval_registers_t registers(std::make_shared<global_env_signed_registers_t>());
     signed_interval_domain_t interval(std::move(registers), stack_slots_signed_state_t::top());
     return interval;
 }
@@ -437,14 +437,14 @@ void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                m_registers_values.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
+                m_registers.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
                 return;
             }
         }
-        m_registers_values.insert(u.dst.v, loc, interval_t::top());
+        m_registers.insert(u.dst.v, loc, interval_t::top());
     };
 
-    auto mock_interval = m_registers_values.find(u.dst.v);
+    auto mock_interval = m_registers.find(u.dst.v);
     if (!mock_interval) return;
     interval_t interval = mock_interval->to_interval();
 
@@ -515,8 +515,8 @@ void signed_interval_domain_t::operator()(const Assume& s, location_t loc) {
 }
 
 bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
-    if (auto loaded = m_stack_slots_values.find(offset)) {
-        m_registers_values.insert(reg, loc, (*loaded).first.to_interval());
+    if (auto loaded = m_stack.find(offset)) {
+        m_registers.insert(reg, loc, (*loaded).first.to_interval());
         return true;
     }
     return false;
@@ -525,15 +525,15 @@ bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset,
 void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
-        if (auto targetreg_mock_interval = m_registers_values.find(target_reg.v)) {
+        if (auto targetreg_mock_interval = m_registers.find(target_reg.v)) {
             auto targetreg_type = targetreg_mock_interval->to_interval();
-            m_stack_slots_values.store(offset, targetreg_type, width);
+            m_stack.store(offset, targetreg_type, width);
         }
     }
     else {
         auto imm = (int64_t)std::get<Imm>(b.value).v;
         auto targetreg_type = interval_t{number_t{imm}};
-        m_stack_slots_values.store(offset, targetreg_type, width);
+        m_stack.store(offset, targetreg_type, width);
     }
 }
 
@@ -546,7 +546,7 @@ void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval
             if (auto start_interval_lb = start_interval.lb().number()) {
                 auto start_offset = (*start_interval_lb).cast_to<uint64_t>();
                 int width_from_start = finite_size->cast_to<int>() + width;
-                if (!m_stack_slots_values.all_numeric(start_offset, width_from_start)) {
+                if (!m_stack.all_numeric(start_offset, width_from_start)) {
                     m_errors.push_back("Stack access not numeric");
                 }
             }
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 464e5e024..0119529bf 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -9,13 +9,12 @@
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
-using global_interval_env_t = std::unordered_map<register_location_t, mock_interval_t>;
+using global_env_signed_registers_t = std::unordered_map<register_location_t, mock_interval_t>;
 
-class registers_signed_state_t {
+class signed_interval_registers_t {
 
-    live_registers_t m_cur_def;
-    std::shared_ptr<global_interval_env_t> m_interval_env;
+    live_registers_t m_cur_register_def;
+    std::shared_ptr<global_env_signed_registers_t> m_registers_env;
     bool m_is_bottom = false;
 
     public:
@@ -28,24 +27,24 @@ class registers_signed_state_t {
         std::optional<mock_interval_t> find(register_t key) const;
         void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
-        registers_signed_state_t operator|(const registers_signed_state_t& other) const;
-        registers_signed_state_t(bool is_bottom = false) : m_interval_env(nullptr),
+        signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
+        signed_interval_registers_t(bool is_bottom = false) : m_registers_env(nullptr),
             m_is_bottom(is_bottom) {}
-        explicit registers_signed_state_t(live_registers_t&& vars,
-                std::shared_ptr<global_interval_env_t> interval_env, bool is_bottom = false)
-            : m_cur_def(std::move(vars)), m_interval_env(interval_env), m_is_bottom(is_bottom) {}
-        explicit registers_signed_state_t(std::shared_ptr<global_interval_env_t> interval_env,
+        explicit signed_interval_registers_t(live_registers_t&& vars,
+                std::shared_ptr<global_env_signed_registers_t> registers_env, bool is_bottom = false)
+            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
+        explicit signed_interval_registers_t(std::shared_ptr<global_env_signed_registers_t> registers_env,
                 bool is_bottom = false)
-            : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+            : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
         void adjust_bb_for_registers(location_t);
 };
 
-using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
-using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
+using signed_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
+using signed_interval_stack_cells_t = std::map<uint64_t, signed_interval_stack_cell_t>;
 
 class stack_slots_signed_state_t {
 
-    interval_values_stack_t m_interval_values;
+    signed_interval_stack_cells_t m_cells;
     bool m_is_bottom = false;
 
     public:
@@ -54,15 +53,15 @@ class stack_slots_signed_state_t {
         void set_to_bottom();
         void set_to_top();
         static stack_slots_signed_state_t top();
-        std::optional<interval_cells_t> find(uint64_t) const;
+        std::optional<signed_interval_stack_cell_t> find(uint64_t) const;
         void store(uint64_t, mock_interval_t, int);
         void operator-=(uint64_t);
         bool all_numeric(uint64_t, int) const;
         stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
         stack_slots_signed_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        explicit stack_slots_signed_state_t(interval_values_stack_t&& interval_values,
+        explicit stack_slots_signed_state_t(signed_interval_stack_cells_t&& interval_values,
                 bool is_bottom = false)
-            : m_interval_values(std::move(interval_values)), m_is_bottom(is_bottom) {}
+            : m_cells(std::move(interval_values)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> get_keys() const;
         size_t size() const;
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
@@ -71,8 +70,8 @@ class stack_slots_signed_state_t {
 };
 
 class signed_interval_domain_t final {
-    registers_signed_state_t m_registers_values;
-    stack_slots_signed_state_t m_stack_slots_values;
+    signed_interval_registers_t m_registers;
+    stack_slots_signed_state_t m_stack;
     std::vector<std::string> m_errors;
     bool m_is_bottom = false;
 
@@ -81,9 +80,9 @@ class signed_interval_domain_t final {
     signed_interval_domain_t() = default;
     signed_interval_domain_t(signed_interval_domain_t&& o) = default;
     signed_interval_domain_t(const signed_interval_domain_t& o) = default;
-    explicit signed_interval_domain_t(registers_signed_state_t&& consts_regs,
-            stack_slots_signed_state_t&& interval_stack_slots, bool is_bottom = false) :
-        m_registers_values(std::move(consts_regs)), m_stack_slots_values(std::move(interval_stack_slots)),
+    explicit signed_interval_domain_t(signed_interval_registers_t&& register_values,
+            stack_slots_signed_state_t&& stack, bool is_bottom = false) :
+        m_registers(std::move(register_values)), m_stack(std::move(stack)),
         m_is_bottom(is_bottom) {}
     signed_interval_domain_t& operator=(signed_interval_domain_t&& o) = default;
     signed_interval_domain_t& operator=(const signed_interval_domain_t& o) = default;
@@ -111,7 +110,7 @@ class signed_interval_domain_t final {
     // narrowing
     signed_interval_domain_t narrow(const signed_interval_domain_t& other) const;
     //forget
-    void operator-=(register_t reg) { m_registers_values -= reg; }
+    void operator-=(register_t reg) { m_registers -= reg; }
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = location_t::top());
@@ -137,7 +136,7 @@ class signed_interval_domain_t final {
     void check_valid_access(const ValidAccess&, interval_t&&, int, bool);
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
-    std::optional<interval_cells_t> find_in_stack(uint64_t) const;
+    std::optional<signed_interval_stack_cell_t> find_in_stack(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
     void store_in_stack(uint64_t, mock_interval_t, int);
     void adjust_bb_for_types(location_t);
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 5a70281f5..275e17f34 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -22,11 +22,11 @@ class inference_domain_t final {
     inference_domain_t() = default;
     inference_domain_t(inference_domain_t&& o) = default;
     inference_domain_t(const inference_domain_t& o) = default;
-    explicit inference_domain_t(region_domain_t&& reg, offset_domain_t&& off,
-            interval_domain_t&& interval, bool is_bottom = false) :
-        m_region(reg), m_offset(off), m_interval(interval), m_is_bottom(is_bottom) {}
     inference_domain_t& operator=(inference_domain_t&& o) = default;
     inference_domain_t& operator=(const inference_domain_t& o) = default;
+    explicit inference_domain_t(region_domain_t region, offset_domain_t offset,
+            interval_domain_t interval) :
+        m_region(std::move(region)), m_offset(std::move(offset)), m_interval(std::move(interval)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static inference_domain_t setup_entry(bool);
     // bottom/top
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index d86845205..249438bba 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -1,65 +1,65 @@
 // Copyright (c) Prevail Verifier contributors.
 // SPDX-License-Identifier: MIT
 
-#include "crab/unsigned_interval_domain.hpp"
+#include "unsigned_interval_domain.hpp"
 #include "boost/endian/conversion.hpp"
 #include "config.hpp"
 
 namespace crab {
 
-bool registers_unsigned_state_t::is_bottom() const {
+bool unsigned_interval_registers_t::is_bottom() const {
     return m_is_bottom;
 }
 
-bool registers_unsigned_state_t::is_top() const {
+bool unsigned_interval_registers_t::is_top() const {
     if (m_is_bottom) return false;
-    if (m_interval_env == nullptr) return true;
-    for (auto it : m_cur_def) {
+    if (m_registers_env == nullptr) return true;
+    for (auto it : m_cur_register_def) {
         if (it != nullptr) return false;
     }
     return true;
 }
 
-void registers_unsigned_state_t::set_to_top() {
-    m_interval_env = std::make_shared<global_interval_env_t>();
-    m_cur_def = live_registers_t{nullptr};
+void unsigned_interval_registers_t::set_to_top() {
+    m_registers_env = std::make_shared<global_env_unsigned_registers_t>();
+    m_cur_register_def = live_registers_t{nullptr};
     m_is_bottom = false;
 }
 
-void registers_unsigned_state_t::set_to_bottom() {
+void unsigned_interval_registers_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void registers_unsigned_state_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+void unsigned_interval_registers_t::insert(register_t reg, const location_t& loc, interval_t interval) {
     auto register_location = register_location_t{reg, loc};
-    (*m_interval_env)[register_location] = mock_interval_t{interval};
-    m_cur_def[reg] = std::make_shared<register_location_t>(register_location);
+    (*m_registers_env)[register_location] = mock_interval_t{interval};
+    m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> registers_unsigned_state_t::find(register_location_t reg) const {
-    auto it = m_interval_env->find(reg);
-    if (it == m_interval_env->end()) return {};
+std::optional<mock_interval_t> unsigned_interval_registers_t::find(register_location_t reg) const {
+    auto it = m_registers_env->find(reg);
+    if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> registers_unsigned_state_t::find(register_t key) const {
-    if (m_cur_def[key] == nullptr) return {};
-    const register_location_t& reg = *(m_cur_def[key]);
+std::optional<mock_interval_t> unsigned_interval_registers_t::find(register_t key) const {
+    if (m_cur_register_def[key] == nullptr) return {};
+    const register_location_t& reg = *(m_cur_register_def[key]);
     return find(reg);
 }
 
-registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers_unsigned_state_t& other) const {
+unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const unsigned_interval_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    registers_unsigned_state_t intervals_joined(m_interval_env);
+    unsigned_interval_registers_t intervals_joined(m_registers_env);
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
-        if (m_cur_def[i] == nullptr || other.m_cur_def[i] == nullptr) continue;
-        auto it1 = find(*(m_cur_def[i]));
-        auto it2 = other.find(*(other.m_cur_def[i]));
+        if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
             intervals_joined.insert(register_t{i}, loc,
@@ -69,7 +69,7 @@ registers_unsigned_state_t registers_unsigned_state_t::operator|(const registers
     return intervals_joined;
 }
 
-void registers_unsigned_state_t::adjust_bb_for_registers(location_t loc) {
+void unsigned_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, it->to_interval());
@@ -77,50 +77,50 @@ void registers_unsigned_state_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
-void registers_unsigned_state_t::operator-=(register_t var) {
+void unsigned_interval_registers_t::operator-=(register_t var) {
     if (is_bottom()) return;
-    m_cur_def[var] = nullptr;
+    m_cur_register_def[var] = nullptr;
 }
 
-bool stack_slots_unsigned_state_t::is_bottom() const {
+bool unsigned_interval_stack_t::is_bottom() const {
     return m_is_bottom;
 }
 
-bool stack_slots_unsigned_state_t::is_top() const {
+bool unsigned_interval_stack_t::is_top() const {
     if (m_is_bottom) return false;
-    return m_interval_values.empty();
+    return m_cells.empty();
 }
 
-void stack_slots_unsigned_state_t::set_to_top() {
-    m_interval_values.clear();
+void unsigned_interval_stack_t::set_to_top() {
+    m_cells.clear();
     m_is_bottom = false;
 }
 
-void stack_slots_unsigned_state_t::set_to_bottom() {
+void unsigned_interval_stack_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-stack_slots_unsigned_state_t stack_slots_unsigned_state_t::top() {
-    return stack_slots_unsigned_state_t(false);
+unsigned_interval_stack_t unsigned_interval_stack_t::top() {
+    return unsigned_interval_stack_t(false);
 }
 
-std::optional<interval_cells_t> stack_slots_unsigned_state_t::find(uint64_t key) const {
-    auto it = m_interval_values.find(key);
-    if (it == m_interval_values.end()) return {};
+std::optional<unsigned_interval_stack_cell_t> unsigned_interval_stack_t::find(uint64_t key) const {
+    auto it = m_cells.find(key);
+    if (it == m_cells.end()) return {};
     return it->second;
 }
 
-void stack_slots_unsigned_state_t::store(uint64_t key, mock_interval_t val, int width) {
-    m_interval_values[key] = std::make_pair(val, width);
+void unsigned_interval_stack_t::store(uint64_t key, mock_interval_t val, int width) {
+    m_cells[key] = std::make_pair(val, width);
 }
 
-void stack_slots_unsigned_state_t::operator-=(uint64_t key) {
+void unsigned_interval_stack_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
-        m_interval_values.erase(key);
+        m_cells.erase(key);
 }
 
-void stack_slots_unsigned_state_t::fill_values(const std::vector<uint64_t>& keys,
+void unsigned_interval_stack_t::fill_values(const std::vector<uint64_t>& keys,
         uint64_t start, int width) {
     if (keys[0] < start) {
         auto type = find(keys[0]);
@@ -148,7 +148,7 @@ void stack_slots_unsigned_state_t::fill_values(const std::vector<uint64_t>& keys
     }
 }
 
-void stack_slots_unsigned_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
+void unsigned_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
     for (auto& key : keys) {
         auto type = find(key);
         auto width_key = type.value().second;
@@ -164,9 +164,9 @@ void stack_slots_unsigned_state_t::remove_overlap(const std::vector<uint64_t>& k
     }
 }
 
-static inline void join_stack(const stack_slots_unsigned_state_t& stack1, uint64_t key1, int& loc1,
-        const stack_slots_unsigned_state_t& stack2, uint64_t key2, int& loc2,
-        interval_values_stack_t& interval_values_joined) {
+static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t key1, int& loc1,
+        const unsigned_interval_stack_t& stack2, uint64_t key2, int& loc2,
+        unsigned_interval_stack_cells_t& interval_values_joined) {
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
@@ -204,13 +204,13 @@ static inline void join_stack(const stack_slots_unsigned_state_t& stack1, uint64
     }
 }
 
-stack_slots_unsigned_state_t stack_slots_unsigned_state_t::operator|(const stack_slots_unsigned_state_t& other) const {
+unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_interval_stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    interval_values_stack_t interval_values_joined;
+    unsigned_interval_stack_cells_t interval_values_joined;
     auto stack1_keys = get_keys();
     auto stack2_keys = other.get_keys();
     int i = 0, j = 0;
@@ -218,18 +218,18 @@ stack_slots_unsigned_state_t stack_slots_unsigned_state_t::operator|(const stack
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
         join_stack(*this, key1, i, other, key2, j, interval_values_joined);
     }
-    return stack_slots_unsigned_state_t(std::move(interval_values_joined));
+    return unsigned_interval_stack_t(std::move(interval_values_joined));
 }
 
-size_t stack_slots_unsigned_state_t::size() const {
-    return m_interval_values.size();
+size_t unsigned_interval_stack_t::size() const {
+    return m_cells.size();
 }
 
-std::vector<uint64_t> stack_slots_unsigned_state_t::get_keys() const {
+std::vector<uint64_t> unsigned_interval_stack_t::get_keys() const {
     std::vector<uint64_t> keys;
     keys.reserve(size());
 
-    for (auto const&kv : m_interval_values) {
+    for (auto const&kv : m_cells) {
         keys.push_back(kv.first);
     }
     return keys;
@@ -237,12 +237,12 @@ std::vector<uint64_t> stack_slots_unsigned_state_t::get_keys() const {
 
 bool unsigned_interval_domain_t::is_bottom() const {
     if (m_is_bottom) return true;
-    return (m_registers_values.is_bottom() || m_stack_slots_values.is_bottom());
+    return (m_registers.is_bottom() || m_stack.is_bottom());
 }
 
 bool unsigned_interval_domain_t::is_top() const {
     if (m_is_bottom) return false;
-    return (m_registers_values.is_top() && m_stack_slots_values.is_top());
+    return (m_registers.is_top() && m_stack.is_top());
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::bottom() {
@@ -253,57 +253,57 @@ unsigned_interval_domain_t unsigned_interval_domain_t::bottom() {
 
 void unsigned_interval_domain_t::set_to_bottom() {
     m_is_bottom = true;
-    m_registers_values.set_to_bottom();
-    m_stack_slots_values.set_to_bottom();
+    m_registers.set_to_bottom();
+    m_stack.set_to_bottom();
 }
 
 void unsigned_interval_domain_t::set_registers_to_bottom() {
-    m_registers_values.set_to_bottom();
+    m_registers.set_to_bottom();
 }
 
 void unsigned_interval_domain_t::set_registers_to_top() {
-    m_registers_values.set_to_top();
+    m_registers.set_to_top();
 }
 
 void unsigned_interval_domain_t::set_to_top() {
-    m_registers_values.set_to_top();
-    m_stack_slots_values.set_to_top();
+    m_registers.set_to_top();
+    m_stack.set_to_top();
 }
 
-std::optional<interval_cells_t> unsigned_interval_domain_t::find_in_stack(uint64_t key) const {
-    return m_stack_slots_values.find(key);
+std::optional<unsigned_interval_stack_cell_t> unsigned_interval_domain_t::find_in_stack(uint64_t key) const {
+    return m_stack.find(key);
 }
 
 void unsigned_interval_domain_t::adjust_bb_for_types(location_t loc) {
-    m_registers_values.adjust_bb_for_registers(loc);
+    m_registers.adjust_bb_for_registers(loc);
 }
 
 void unsigned_interval_domain_t::remove_overlap_in_stack(const std::vector<uint64_t>& overlap,
         uint64_t start_loc, int width) {
-    m_stack_slots_values.remove_overlap(overlap, start_loc, width);
+    m_stack.remove_overlap(overlap, start_loc, width);
 }
 
 void unsigned_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overlap,
         uint64_t start_loc, int width) {
-    m_stack_slots_values.fill_values(overlap, start_loc, width);
+    m_stack.fill_values(overlap, start_loc, width);
 }
 
 std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_value(register_t reg) const {
-    return m_registers_values.find(reg);
+    return m_registers.find(reg);
 }
 
 std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_at_loc(
         const register_location_t reg) const {
-    return m_registers_values.find(reg);
+    return m_registers.find(reg);
 }
 
 void unsigned_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
         interval_t interval) {
-    m_registers_values.insert(reg, loc, interval);
+    m_registers.insert(reg, loc, interval);
 }
 
 void unsigned_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
-    m_stack_slots_values.store(key, interval, width);
+    m_stack.store(key, interval, width);
 }
 
 bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
@@ -331,8 +331,8 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return unsigned_interval_domain_t(m_registers_values | other.m_registers_values,
-            m_stack_slots_values | other.m_stack_slots_values);
+    return unsigned_interval_domain_t(m_registers | other.m_registers,
+            m_stack | other.m_stack);
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interval_domain_t&& other) const {
@@ -343,8 +343,8 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interv
         return *this;
     }
     return unsigned_interval_domain_t(
-            m_registers_values | std::move(other.m_registers_values),
-            m_stack_slots_values | std::move(other.m_stack_slots_values));
+            m_registers | std::move(other.m_registers),
+            m_stack | std::move(other.m_stack));
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator&(const unsigned_interval_domain_t& abs) const {
@@ -378,8 +378,8 @@ string_invariant unsigned_interval_domain_t::to_set() {
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry() {
-    registers_unsigned_state_t registers(std::make_shared<global_interval_env_t>());
-    unsigned_interval_domain_t interval(std::move(registers), stack_slots_unsigned_state_t::top());
+    unsigned_interval_registers_t registers(std::make_shared<global_env_unsigned_registers_t>());
+    unsigned_interval_domain_t interval(std::move(registers), unsigned_interval_stack_t::top());
     return interval;
 }
 
@@ -393,14 +393,14 @@ void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                m_registers_values.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
+                m_registers.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
                 return;
             }
         }
-        m_registers_values.insert(u.dst.v, loc, interval_t::top());
+        m_registers.insert(u.dst.v, loc, interval_t::top());
     };
 
-    auto mock_interval = m_registers_values.find(u.dst.v);
+    auto mock_interval = m_registers.find(u.dst.v);
     if (!mock_interval) return;
     interval_t interval = mock_interval->to_interval();
 
@@ -471,8 +471,8 @@ void unsigned_interval_domain_t::operator()(const Assume& s, location_t loc) {
 }
 
 bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
-    if (auto loaded = m_stack_slots_values.find(offset)) {
-        m_registers_values.insert(reg, loc, (*loaded).first.to_interval());
+    if (auto loaded = m_stack.find(offset)) {
+        m_registers.insert(reg, loc, (*loaded).first.to_interval());
         return true;
     }
     return false;
@@ -481,15 +481,15 @@ bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset
 void unsigned_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
-        if (auto targetreg_mock_interval = m_registers_values.find(target_reg.v)) {
+        if (auto targetreg_mock_interval = m_registers.find(target_reg.v)) {
             auto targetreg_type = targetreg_mock_interval->to_interval();
-            m_stack_slots_values.store(offset, targetreg_type, width);
+            m_stack.store(offset, targetreg_type, width);
         }
     }
     else {
         auto imm = (uint64_t)std::get<Imm>(b.value).v;
         auto targetreg_type = interval_t{number_t{imm}};
-        m_stack_slots_values.store(offset, targetreg_type, width);
+        m_stack.store(offset, targetreg_type, width);
     }
 }
 
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 38449d9ee..5e06ade40 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -9,13 +9,12 @@
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
-using global_interval_env_t = std::unordered_map<register_location_t, mock_interval_t>;
+using global_env_unsigned_registers_t = std::unordered_map<register_location_t, mock_interval_t>;
 
-class registers_unsigned_state_t {
+class unsigned_interval_registers_t {
 
-    live_registers_t m_cur_def;
-    std::shared_ptr<global_interval_env_t> m_interval_env;
+    live_registers_t m_cur_register_def;
+    std::shared_ptr<global_env_unsigned_registers_t> m_registers_env;
     bool m_is_bottom = false;
 
     public:
@@ -27,24 +26,24 @@ class registers_unsigned_state_t {
         std::optional<mock_interval_t> find(register_t key) const;
         void insert(register_t, const location_t&, interval_t);
         void operator-=(register_t);
-        registers_unsigned_state_t operator|(const registers_unsigned_state_t& other) const;
-        registers_unsigned_state_t(bool is_bottom = false) : m_interval_env(nullptr),
+        unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
+        unsigned_interval_registers_t(bool is_bottom = false) : m_registers_env(nullptr),
             m_is_bottom(is_bottom) {}
-        explicit registers_unsigned_state_t(live_registers_t&& vars,
-                std::shared_ptr<global_interval_env_t> interval_env, bool is_bottom = false)
-            : m_cur_def(std::move(vars)), m_interval_env(interval_env), m_is_bottom(is_bottom) {}
-        explicit registers_unsigned_state_t(std::shared_ptr<global_interval_env_t> interval_env,
+        explicit unsigned_interval_registers_t(live_registers_t&& vars,
+                std::shared_ptr<global_env_unsigned_registers_t> registers_env, bool is_bottom = false)
+            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
+        explicit unsigned_interval_registers_t(std::shared_ptr<global_env_unsigned_registers_t> registers_env,
                 bool is_bottom = false)
-            : m_interval_env(interval_env), m_is_bottom(is_bottom) {}
+            : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
         void adjust_bb_for_registers(location_t);
 };
 
-using interval_cells_t = std::pair<mock_interval_t, int>;    // intervals with width
-using interval_values_stack_t = std::map<uint64_t, interval_cells_t>;
+using unsigned_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
+using unsigned_interval_stack_cells_t = std::map<uint64_t, unsigned_interval_stack_cell_t>;
 
-class stack_slots_unsigned_state_t {
+class unsigned_interval_stack_t {
 
-    interval_values_stack_t m_interval_values;
+    unsigned_interval_stack_cells_t m_cells;
     bool m_is_bottom = false;
 
     public:
@@ -52,14 +51,15 @@ class stack_slots_unsigned_state_t {
         bool is_top() const;
         void set_to_bottom();
         void set_to_top();
-        static stack_slots_unsigned_state_t top();
-        std::optional<interval_cells_t> find(uint64_t) const;
+        static unsigned_interval_stack_t top();
+        std::optional<unsigned_interval_stack_cell_t> find(uint64_t) const;
         void store(uint64_t, mock_interval_t, int);
         void operator-=(uint64_t);
-        stack_slots_unsigned_state_t operator|(const stack_slots_unsigned_state_t& other) const;
-        stack_slots_unsigned_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        explicit stack_slots_unsigned_state_t(interval_values_stack_t&& interval_values, bool is_bottom = false)
-            : m_interval_values(std::move(interval_values)), m_is_bottom(is_bottom) {}
+        unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
+        unsigned_interval_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        explicit unsigned_interval_stack_t(unsigned_interval_stack_cells_t&& cells,
+                                           bool is_bottom = false)
+            : m_cells(std::move(cells)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> get_keys() const;
         size_t size() const;
         void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
@@ -67,8 +67,8 @@ class stack_slots_unsigned_state_t {
 };
 
 class unsigned_interval_domain_t final {
-    registers_unsigned_state_t m_registers_values;
-    stack_slots_unsigned_state_t m_stack_slots_values;
+    unsigned_interval_registers_t m_registers;
+    unsigned_interval_stack_t m_stack;
     std::vector<std::string> m_errors;
     bool m_is_bottom = false;
 
@@ -77,9 +77,9 @@ class unsigned_interval_domain_t final {
     unsigned_interval_domain_t() = default;
     unsigned_interval_domain_t(unsigned_interval_domain_t&& o) = default;
     unsigned_interval_domain_t(const unsigned_interval_domain_t& o) = default;
-    explicit unsigned_interval_domain_t(registers_unsigned_state_t&& consts_regs,
-            stack_slots_unsigned_state_t&& interval_stack_slots, bool is_bottom = false) :
-        m_registers_values(std::move(consts_regs)), m_stack_slots_values(std::move(interval_stack_slots)),
+    explicit unsigned_interval_domain_t(unsigned_interval_registers_t&& registers,
+            unsigned_interval_stack_t&& stack, bool is_bottom = false) :
+        m_registers(std::move(registers)), m_stack(std::move(stack)),
         m_is_bottom(is_bottom) {}
     unsigned_interval_domain_t& operator=(unsigned_interval_domain_t&& o) = default;
     unsigned_interval_domain_t& operator=(const unsigned_interval_domain_t& o) = default;
@@ -107,7 +107,7 @@ class unsigned_interval_domain_t final {
     // narrowing
     unsigned_interval_domain_t narrow(const unsigned_interval_domain_t& other) const;
     //forget
-    void operator-=(register_t reg) { m_registers_values -= reg; }
+    void operator-=(register_t reg) { m_registers -= reg; }
 
     //// abstract transformers
     void operator()(const Undefined&, location_t loc = location_t::top());
@@ -130,7 +130,7 @@ class unsigned_interval_domain_t final {
 
     std::optional<mock_interval_t> find_interval_value(register_t) const;
     std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
-    std::optional<interval_cells_t> find_in_stack(uint64_t) const;
+    std::optional<unsigned_interval_stack_cell_t> find_in_stack(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
     void store_in_stack(uint64_t, mock_interval_t, int);
     void adjust_bb_for_types(location_t);

From 04fdb6517f86f559e3ced4f26632a10f268c119c Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 30 Nov 2024 00:57:43 -0500
Subject: [PATCH 326/373] Cleanup in all domains

Did cleanup mainly to major methods, like constructors and joins, in
order to flush out any implicit issues with the domains;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp          | 28 ++-------
 src/crab/interval_domain.hpp          | 12 +---
 src/crab/offset_domain.cpp            | 33 +++++------
 src/crab/offset_domain.hpp            | 39 ++++---------
 src/crab/region_domain.cpp            | 14 +++--
 src/crab/region_domain.hpp            | 29 +++------
 src/crab/signed_interval_domain.cpp   |  2 +-
 src/crab/signed_interval_domain.hpp   | 84 ++++++++++++---------------
 src/crab/type_inference.cpp           | 33 +++--------
 src/crab/type_inference.hpp           | 15 ++---
 src/crab/unsigned_interval_domain.cpp |  2 +-
 src/crab/unsigned_interval_domain.hpp | 78 +++++++++++--------------
 12 files changed, 136 insertions(+), 233 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 4c6e7ae7b..055916cd0 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -7,12 +7,10 @@
 namespace crab {
 
 bool interval_domain_t::is_bottom() const {
-    if (m_is_bottom) return true;
     return (m_signed.is_bottom() || m_unsigned.is_bottom());
 }
 
 bool interval_domain_t::is_top() const {
-    if (m_is_bottom) return false;
     return (m_signed.is_top() && m_unsigned.is_top());
 }
 
@@ -23,13 +21,11 @@ interval_domain_t interval_domain_t::bottom() {
 }
 
 void interval_domain_t::set_to_bottom() {
-    m_is_bottom = true;
     m_signed.set_to_bottom();
     m_unsigned.set_to_bottom();
 }
 
 void interval_domain_t::set_to_top() {
-    m_is_bottom = false;
     m_signed.set_to_top();
     m_unsigned.set_to_top();
 }
@@ -163,24 +159,12 @@ void interval_domain_t::operator|=(interval_domain_t&& abs) {
 }
 
 interval_domain_t interval_domain_t::operator|(const interval_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
     return interval_domain_t(m_signed | other.m_signed, m_unsigned | other.m_unsigned);
 }
 
 interval_domain_t interval_domain_t::operator|(interval_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
-        return std::move(other);
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
-    return interval_domain_t(
-            m_signed | std::move(other.m_signed), m_unsigned | std::move(other.m_unsigned));
+    return interval_domain_t(m_signed | std::move(other.m_signed),
+                             m_unsigned | std::move(other.m_unsigned));
 }
 
 interval_domain_t interval_domain_t::operator&(const interval_domain_t& abs) const {
@@ -212,10 +196,10 @@ string_invariant interval_domain_t::to_set() {
 }
 
 interval_domain_t interval_domain_t::setup_entry() {
-    auto&& _signed = signed_interval_domain_t::setup_entry();
-    auto&& _unsigned = unsigned_interval_domain_t::setup_entry();
-    interval_domain_t interval(std::move(_signed), std::move(_unsigned));
-    return interval;
+    return interval_domain_t{
+        std::move(signed_interval_domain_t::setup_entry()),
+        std::move(unsigned_interval_domain_t::setup_entry())
+    };
 }
 
 void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, const int finite_width, location_t loc, bool is_signed) {
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index bb72f4dbc..fdef8d12f 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -17,19 +17,13 @@ class interval_domain_t final {
     signed_interval_domain_t m_signed;
     unsigned_interval_domain_t m_unsigned;
     std::vector<std::string> m_errors;
-    bool m_is_bottom = false;
 
   public:
 
     interval_domain_t() = default;
-    interval_domain_t(interval_domain_t&& o) = default;
-    interval_domain_t(const interval_domain_t& o) = default;
-    explicit interval_domain_t(signed_interval_domain_t&& signed_domain,
-            unsigned_interval_domain_t&& unsigned_domain, bool is_bottom = false) :
-        m_signed(std::move(signed_domain)), m_unsigned(std::move(unsigned_domain)),
-        m_is_bottom(is_bottom) {}
-    interval_domain_t& operator=(interval_domain_t&& o) = default;
-    interval_domain_t& operator=(const interval_domain_t& o) = default;
+    interval_domain_t(signed_interval_domain_t signed_domain,
+            unsigned_interval_domain_t unsigned_domain) :
+        m_signed(std::move(signed_domain)), m_unsigned(std::move(unsigned_domain)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static interval_domain_t setup_entry();
     // bottom/top
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 92e563a2a..1474992d0 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -154,7 +154,7 @@ bool offset_stack_t::is_bottom() const {
 }
 
 offset_stack_t offset_stack_t::top() {
-    return offset_stack_t(false);
+    return offset_stack_t();
 }
 
 std::optional<refinement_stack_cell_t> offset_stack_t::find(uint64_t key) const {
@@ -247,14 +247,13 @@ std::optional<refinement_t> offset_ctx_t::find(uint64_t key) const {
     return it->second;
 }
 
-offset_domain_t&& offset_domain_t::setup_entry() {
+offset_domain_t offset_domain_t::setup_entry() {
     offset_registers_t regs(std::make_shared<global_env_offset_registers_t>(),
-                      std::make_shared<slacks_t>(),
-                      global_program_info->type.context_descriptor);
+                            std::make_shared<slacks_t>(),
+                            global_program_info->type.context_descriptor->data);
 
-    static offset_domain_t off_d(std::move(regs), offset_stack_t::top(),
-                      std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor));
-    return std::move(off_d);
+    return offset_domain_t{std::move(regs), offset_stack_t::top(),
+                    std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor)};
 }
 
 offset_domain_t offset_domain_t::bottom() {
@@ -264,9 +263,9 @@ offset_domain_t offset_domain_t::bottom() {
 }
 
 void offset_domain_t::set_to_top() {
+    m_is_bottom = false;
     m_registers.set_to_top();
     m_stack.set_to_top();
-    m_is_bottom = false;
 }
 
 void offset_domain_t::set_to_bottom() {
@@ -305,28 +304,22 @@ void offset_domain_t::operator|=(offset_domain_t&& abs) {
 offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
-    }
-    else if (other.is_bottom() || is_top()) {
+    } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(
-            m_registers | other.m_registers,
-            m_stack | other.m_stack,
-            m_ctx
-    );
+    return offset_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, m_ctx);
 }
 
 offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
     if (is_bottom() || other.is_top()) {
         return std::move(other);
-    }
-    else if (other.is_bottom() || is_top()) {
+    } else if (other.is_bottom() || is_top()) {
         return *this;
     }
     return offset_domain_t(
-            m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack),
-            m_ctx
+        m_registers | std::move(other.m_registers),
+        m_stack | std::move(other.m_stack),
+        std::move(m_ctx)
     );
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 8899bb029..46ca3552c 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -19,28 +19,15 @@ class offset_registers_t {
     bool m_is_bottom = false;
 
     public:
-        offset_registers_t(bool is_bottom = false) : m_registers_env(nullptr), m_slacks(nullptr),
-        m_is_bottom(is_bottom) {}
+        offset_registers_t() = default;
         offset_registers_t(std::shared_ptr<global_env_offset_registers_t> registers_env,
-                std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
-            : m_registers_env(registers_env), m_slacks(slacks), m_is_bottom(is_bottom) {}
-        offset_registers_t(std::shared_ptr<global_env_offset_registers_t> registers_env,
-                std::shared_ptr<slacks_t> slacks, const ebpf_context_descriptor_t* desc,
-                bool is_bottom = false)
-            : m_registers_env(registers_env), m_slacks(slacks), m_is_bottom(is_bottom) {
+                std::shared_ptr<slacks_t> slacks, int data_pos = -1)
+            : m_registers_env(registers_env), m_slacks(slacks) {
 
-            location_t loc{label_t::entry, 0};
-            if (desc->data >= 0) {
-                insert(register_t{12}, loc, refinement_t::begin());
+            if (data_pos >= 0) {
+                insert(register_t{12}, location_t{label_t::entry, 0}, refinement_t::begin());
             }
         }
-
-        explicit offset_registers_t(live_registers_t&& vars,
-                std::shared_ptr<global_env_offset_registers_t> registers_env,
-                std::shared_ptr<slacks_t> slacks, bool is_bottom = false)
-            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_slacks(slacks),
-            m_is_bottom(is_bottom) {}
-
         offset_registers_t operator|(const offset_registers_t&) const;
         void operator-=(register_t);
         void set_to_top();
@@ -67,7 +54,9 @@ class offset_stack_t {
     bool m_is_bottom = false;
 
     public:
-        offset_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
+        offset_stack_t() = default;
+        explicit offset_stack_t(refinement_stack_cells_t cells)
+            : m_stack_cells(std::move(cells)) {}
         std::optional<refinement_stack_cell_t> find(uint64_t) const;
         void store(uint64_t, refinement_t, int);
         void operator-=(uint64_t);
@@ -78,8 +67,6 @@ class offset_stack_t {
         bool is_top() const;
         static offset_stack_t top();
         offset_stack_t operator|(const offset_stack_t&) const;
-        explicit offset_stack_t(refinement_stack_cells_t&& cells, bool is_bottom = false)
-            : m_stack_cells(std::move(cells)), m_is_bottom(is_bottom) {}
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
         std::vector<uint64_t> get_keys() const;
 };
@@ -106,15 +93,11 @@ class offset_domain_t final {
 
   public:
     offset_domain_t() = default;
-    offset_domain_t(offset_domain_t&& o) = default;
-    offset_domain_t(const offset_domain_t& o) = default;
-    offset_domain_t& operator=(offset_domain_t&& o) = default;
-    offset_domain_t& operator=(const offset_domain_t& o) = default;
-    explicit offset_domain_t(offset_registers_t&& reg, offset_stack_t&& stack,
+    offset_domain_t(offset_registers_t reg, offset_stack_t stack,
             std::shared_ptr<offset_ctx_t> ctx)
-        : m_registers(std::move(reg)), m_stack(std::move(stack)), m_ctx(ctx) {}
+        : m_registers(std::move(reg)), m_stack(std::move(stack)), m_ctx(std::move(ctx)) {}
 
-    static offset_domain_t&& setup_entry();
+    static offset_domain_t setup_entry();
     // bottom/top
     static offset_domain_t bottom();
     void set_to_top();
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 8abc2a426..bd1e54ee6 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -222,9 +222,13 @@ void region_stack_t::set_to_top() {
     m_is_bottom = false;
 }
 
-region_stack_t region_stack_t::bottom() { return region_stack_t(true); }
+region_stack_t region_stack_t::bottom() {
+    region_stack_t stk;
+    stk.set_to_bottom();
+    return stk;
+};
 
-region_stack_t region_stack_t::top() { return region_stack_t(false); }
+region_stack_t region_stack_t::top() { return region_stack_t(); }
 
 bool region_stack_t::is_bottom() const { return m_is_bottom; }
 
@@ -762,7 +766,7 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
     // nothing to do here
 }
 
-region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
+region_domain_t region_domain_t::setup_entry(bool init_r1) {
     region_registers_t typ(std::make_shared<global_env_region_registers_t>());
 
     location_t loc{label_t::entry, 0};
@@ -773,9 +777,9 @@ region_domain_t&& region_domain_t::setup_entry(bool init_r1) {
     auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    static region_domain_t inv(std::move(typ), region_stack_t::top());
+    region_domain_t inv(std::move(typ), region_stack_t::top());
     inv.compute_ctx_size(global_program_info.get().type.context_descriptor);
-    return std::move(inv);
+    return inv;
 }
 
 void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index ecd351faa..aed982552 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -16,13 +16,10 @@ using ptr_or_mapfd_stack_cell_t = std::pair<ptr_or_mapfd_t, int>;
 class region_stack_t {
     using ptr_or_mapfd_stack_cells_t = std::map<uint64_t, ptr_or_mapfd_stack_cell_t>;
     ptr_or_mapfd_stack_cells_t m_cells;
-    bool m_is_bottom;
+    bool m_is_bottom = false;
 
   public:
-    region_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-    region_stack_t(ptr_or_mapfd_stack_cells_t&& cells, bool is_bottom)
-    : m_cells(std::move(cells)) , m_is_bottom(is_bottom) {}
-    
+    region_stack_t() = default;
     region_stack_t operator|(const region_stack_t& other) const;
     void operator-=(uint64_t);
     void operator-=(const std::vector<uint64_t>&);
@@ -49,14 +46,10 @@ class region_registers_t {
     bool m_is_bottom = false;
 
   public:
-    region_registers_t(bool is_bottom = false) : m_registers_env(nullptr), m_is_bottom(is_bottom) {}
-    explicit region_registers_t(live_registers_t&& vars,
-            std::shared_ptr<global_env_region_registers_t> registers_env, bool is_bottom = false)
-        : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
-
+    region_registers_t() = default;
     explicit region_registers_t(std::shared_ptr<global_env_region_registers_t> registers_env,
             bool is_bottom = false)
-        : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
+        : m_registers_env(std::move(registers_env)), m_is_bottom(is_bottom) {}
 
     region_registers_t operator|(const region_registers_t& other) const;
     void operator-=(register_t var);
@@ -86,16 +79,12 @@ class region_domain_t final {
   public:
 
     region_domain_t() = default;
-    region_domain_t(region_domain_t&& o) = default;
-    region_domain_t(const region_domain_t& o) = default;
-    region_domain_t& operator=(region_domain_t&& o) = default;
-    region_domain_t& operator=(const region_domain_t& o) = default;
-    explicit region_domain_t(crab::region_registers_t&& _types, crab::region_stack_t&& _st,
-            shared_ptr_aliases_t&& _shared_ptr_aliases = {})
-            : m_stack(std::move(_st)), m_registers(std::move(_types)),
-            m_shared_ptr_aliases(std::move(_shared_ptr_aliases)) {}
+    region_domain_t(region_registers_t registers, region_stack_t stack,
+            shared_ptr_aliases_t shared_ptr_aliases = {})
+            : m_stack(std::move(stack)), m_registers(std::move(registers)),
+            m_shared_ptr_aliases(std::move(shared_ptr_aliases)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static region_domain_t&& setup_entry(bool);
+    static region_domain_t setup_entry(bool);
     // bottom/top
     static region_domain_t bottom();
     void set_to_top();
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 4793197f5..f0a71b83c 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -101,7 +101,7 @@ void stack_slots_signed_state_t::set_to_bottom() {
 }
 
 stack_slots_signed_state_t stack_slots_signed_state_t::top() {
-    return stack_slots_signed_state_t(false);
+    return stack_slots_signed_state_t();
 }
 
 std::optional<signed_interval_stack_cell_t> stack_slots_signed_state_t::find(uint64_t key) const {
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 0119529bf..72394451b 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -17,26 +17,21 @@ class signed_interval_registers_t {
     std::shared_ptr<global_env_signed_registers_t> m_registers_env;
     bool m_is_bottom = false;
 
-    public:
-        bool is_bottom() const;
-        bool is_top() const;
-        void set_to_bottom();
-        void set_to_top();
-        void set_registers_to_bottom();
-        std::optional<mock_interval_t> find(register_location_t reg) const;
-        std::optional<mock_interval_t> find(register_t key) const;
-        void insert(register_t, const location_t&, interval_t);
-        void operator-=(register_t);
-        signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
-        signed_interval_registers_t(bool is_bottom = false) : m_registers_env(nullptr),
-            m_is_bottom(is_bottom) {}
-        explicit signed_interval_registers_t(live_registers_t&& vars,
-                std::shared_ptr<global_env_signed_registers_t> registers_env, bool is_bottom = false)
-            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
-        explicit signed_interval_registers_t(std::shared_ptr<global_env_signed_registers_t> registers_env,
-                bool is_bottom = false)
-            : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
-        void adjust_bb_for_registers(location_t);
+  public:
+    signed_interval_registers_t() = default;
+    signed_interval_registers_t(std::shared_ptr<global_env_signed_registers_t> registers_env)
+        : m_registers_env(std::move(registers_env)) {}
+    bool is_bottom() const;
+    bool is_top() const;
+    void set_to_bottom();
+    void set_to_top();
+    void set_registers_to_bottom();
+    std::optional<mock_interval_t> find(register_location_t reg) const;
+    std::optional<mock_interval_t> find(register_t key) const;
+    void insert(register_t, const location_t&, interval_t);
+    void operator-=(register_t);
+    signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
+    void adjust_bb_for_registers(location_t);
 };
 
 using signed_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
@@ -47,26 +42,24 @@ class stack_slots_signed_state_t {
     signed_interval_stack_cells_t m_cells;
     bool m_is_bottom = false;
 
-    public:
-        bool is_bottom() const;
-        bool is_top() const;
-        void set_to_bottom();
-        void set_to_top();
-        static stack_slots_signed_state_t top();
-        std::optional<signed_interval_stack_cell_t> find(uint64_t) const;
-        void store(uint64_t, mock_interval_t, int);
-        void operator-=(uint64_t);
-        bool all_numeric(uint64_t, int) const;
-        stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
-        stack_slots_signed_state_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        explicit stack_slots_signed_state_t(signed_interval_stack_cells_t&& interval_values,
-                bool is_bottom = false)
-            : m_cells(std::move(interval_values)), m_is_bottom(is_bottom) {}
-        std::vector<uint64_t> get_keys() const;
-        size_t size() const;
-        std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
-        void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
-        void fill_values(const std::vector<uint64_t>&, uint64_t, int);
+  public:
+    stack_slots_signed_state_t() = default;
+    stack_slots_signed_state_t(signed_interval_stack_cells_t cells) : m_cells(std::move(cells)) {}
+    bool is_bottom() const;
+    bool is_top() const;
+    void set_to_bottom();
+    void set_to_top();
+    static stack_slots_signed_state_t top();
+    std::optional<signed_interval_stack_cell_t> find(uint64_t) const;
+    void store(uint64_t, mock_interval_t, int);
+    void operator-=(uint64_t);
+    bool all_numeric(uint64_t, int) const;
+    stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
+    std::vector<uint64_t> get_keys() const;
+    size_t size() const;
+    std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
+    void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
+    void fill_values(const std::vector<uint64_t>&, uint64_t, int);
 };
 
 class signed_interval_domain_t final {
@@ -78,14 +71,9 @@ class signed_interval_domain_t final {
   public:
 
     signed_interval_domain_t() = default;
-    signed_interval_domain_t(signed_interval_domain_t&& o) = default;
-    signed_interval_domain_t(const signed_interval_domain_t& o) = default;
-    explicit signed_interval_domain_t(signed_interval_registers_t&& register_values,
-            stack_slots_signed_state_t&& stack, bool is_bottom = false) :
-        m_registers(std::move(register_values)), m_stack(std::move(stack)),
-        m_is_bottom(is_bottom) {}
-    signed_interval_domain_t& operator=(signed_interval_domain_t&& o) = default;
-    signed_interval_domain_t& operator=(const signed_interval_domain_t& o) = default;
+    signed_interval_domain_t(signed_interval_registers_t registers,
+            stack_slots_signed_state_t stack) :
+        m_registers(std::move(registers)), m_stack(std::move(stack)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static signed_interval_domain_t setup_entry();
     // bottom/top
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 60bca3047..4d392dcd2 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -7,12 +7,10 @@
 namespace crab {
 
 bool inference_domain_t::is_bottom() const {
-    if (m_is_bottom) return true;
     return (m_region.is_bottom() || m_offset.is_bottom() || m_interval.is_bottom());
 }
 
 bool inference_domain_t::is_top() const {
-    if (m_is_bottom) return false;
     return (m_region.is_top() && m_offset.is_top() && m_interval.is_top());
 }
 
@@ -23,14 +21,12 @@ inference_domain_t inference_domain_t::bottom() {
 }
 
 void inference_domain_t::set_to_bottom() {
-    m_is_bottom = true;
     m_region.set_to_bottom();
     m_offset.set_to_bottom();
     m_interval.set_to_bottom();
 }
 
 void inference_domain_t::set_to_top() {
-    m_is_bottom = false;
     m_region.set_to_top();
     m_offset.set_to_top();
     m_interval.set_to_top();
@@ -52,32 +48,21 @@ void inference_domain_t::operator|=(const inference_domain_t& abs) {
     operator|=(std::move(tmp));
 }
 
-void inference_domain_t::operator|=(inference_domain_t&& abs) {
+void inference_domain_t::operator|=(inference_domain_t&& other) {
     if (is_bottom()) {
-        *this = abs;
+        *this = std::move(other);
         return;
     }
-    *this = *this | std::move(abs);
+    if (other.is_bottom()) return;
+    *this = *this | std::move(other);
 }
 
 inference_domain_t inference_domain_t::operator|(const inference_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
-        return other;
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
     return inference_domain_t(m_region | other.m_region, m_offset | other.m_offset,
             m_interval | other.m_interval);
 }
 
 inference_domain_t inference_domain_t::operator|(inference_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
-        return std::move(other);
-    }
-    else if (other.is_bottom() || is_top()) {
-        return *this;
-    }
     return inference_domain_t(m_region | std::move(other.m_region),
             m_offset | std::move(other.m_offset),
             m_interval | std::move(other.m_interval));
@@ -573,11 +558,11 @@ void inference_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
 }
 
 inference_domain_t inference_domain_t::setup_entry(bool init_r1) {
-    auto&& reg = crab::region_domain_t::setup_entry(init_r1);
-    auto&& off = offset_domain_t::setup_entry();
-    auto&& interval = interval_domain_t::setup_entry();
-    inference_domain_t typ(std::move(reg), std::move(off), std::move(interval));
-    return typ;
+    return inference_domain_t{
+        region_domain_t::setup_entry(init_r1),
+        offset_domain_t::setup_entry(),
+        interval_domain_t::setup_entry()
+    };
 }
 
 void inference_domain_t::operator()(const Bin& bin, location_t loc) {
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 275e17f34..8ec392730 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -3,10 +3,10 @@
 
 #pragma once
 
-#include "crab/region_domain.hpp"
-#include "crab/interval_domain.hpp"
-#include "crab/offset_domain.hpp"
-#include "crab/type_ostream.hpp"
+#include "region_domain.hpp"
+#include "interval_domain.hpp"
+#include "offset_domain.hpp"
+#include "type_ostream.hpp"
 
 namespace crab {
 
@@ -14,17 +14,12 @@ class inference_domain_t final {
     region_domain_t m_region;
     offset_domain_t m_offset;
     interval_domain_t m_interval;
-    bool m_is_bottom = false;
     std::vector<std::string> m_errors;
 
   public:
 
     inference_domain_t() = default;
-    inference_domain_t(inference_domain_t&& o) = default;
-    inference_domain_t(const inference_domain_t& o) = default;
-    inference_domain_t& operator=(inference_domain_t&& o) = default;
-    inference_domain_t& operator=(const inference_domain_t& o) = default;
-    explicit inference_domain_t(region_domain_t region, offset_domain_t offset,
+    inference_domain_t(region_domain_t region, offset_domain_t offset,
             interval_domain_t interval) :
         m_region(std::move(region)), m_offset(std::move(offset)), m_interval(std::move(interval)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 249438bba..80ab78de7 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -101,7 +101,7 @@ void unsigned_interval_stack_t::set_to_bottom() {
 }
 
 unsigned_interval_stack_t unsigned_interval_stack_t::top() {
-    return unsigned_interval_stack_t(false);
+    return unsigned_interval_stack_t();
 }
 
 std::optional<unsigned_interval_stack_cell_t> unsigned_interval_stack_t::find(uint64_t key) const {
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 5e06ade40..8541c1c57 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -17,25 +17,20 @@ class unsigned_interval_registers_t {
     std::shared_ptr<global_env_unsigned_registers_t> m_registers_env;
     bool m_is_bottom = false;
 
-    public:
-        bool is_bottom() const;
-        bool is_top() const;
-        void set_to_bottom();
-        void set_to_top();
-        std::optional<mock_interval_t> find(register_location_t reg) const;
-        std::optional<mock_interval_t> find(register_t key) const;
-        void insert(register_t, const location_t&, interval_t);
-        void operator-=(register_t);
-        unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
-        unsigned_interval_registers_t(bool is_bottom = false) : m_registers_env(nullptr),
-            m_is_bottom(is_bottom) {}
-        explicit unsigned_interval_registers_t(live_registers_t&& vars,
-                std::shared_ptr<global_env_unsigned_registers_t> registers_env, bool is_bottom = false)
-            : m_cur_register_def(std::move(vars)), m_registers_env(registers_env), m_is_bottom(is_bottom) {}
-        explicit unsigned_interval_registers_t(std::shared_ptr<global_env_unsigned_registers_t> registers_env,
-                bool is_bottom = false)
-            : m_registers_env(registers_env), m_is_bottom(is_bottom) {}
-        void adjust_bb_for_registers(location_t);
+  public:
+    unsigned_interval_registers_t() = default;
+    unsigned_interval_registers_t(std::shared_ptr<global_env_unsigned_registers_t> registers_env)
+        : m_registers_env(std::move(registers_env)) {}
+    bool is_bottom() const;
+    bool is_top() const;
+    void set_to_bottom();
+    void set_to_top();
+    std::optional<mock_interval_t> find(register_location_t reg) const;
+    std::optional<mock_interval_t> find(register_t key) const;
+    void insert(register_t, const location_t&, interval_t);
+    void operator-=(register_t);
+    unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
+    void adjust_bb_for_registers(location_t);
 };
 
 using unsigned_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
@@ -46,24 +41,22 @@ class unsigned_interval_stack_t {
     unsigned_interval_stack_cells_t m_cells;
     bool m_is_bottom = false;
 
-    public:
-        bool is_bottom() const;
-        bool is_top() const;
-        void set_to_bottom();
-        void set_to_top();
-        static unsigned_interval_stack_t top();
-        std::optional<unsigned_interval_stack_cell_t> find(uint64_t) const;
-        void store(uint64_t, mock_interval_t, int);
-        void operator-=(uint64_t);
-        unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
-        unsigned_interval_stack_t(bool is_bottom = false) : m_is_bottom(is_bottom) {}
-        explicit unsigned_interval_stack_t(unsigned_interval_stack_cells_t&& cells,
-                                           bool is_bottom = false)
-            : m_cells(std::move(cells)), m_is_bottom(is_bottom) {}
-        std::vector<uint64_t> get_keys() const;
-        size_t size() const;
-        void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
-        void fill_values(const std::vector<uint64_t>&, uint64_t, int);
+  public:
+    unsigned_interval_stack_t() = default;
+    unsigned_interval_stack_t(unsigned_interval_stack_cells_t cells) : m_cells(std::move(cells)) {}
+    bool is_bottom() const;
+    bool is_top() const;
+    void set_to_bottom();
+    void set_to_top();
+    static unsigned_interval_stack_t top();
+    std::optional<unsigned_interval_stack_cell_t> find(uint64_t) const;
+    void store(uint64_t, mock_interval_t, int);
+    void operator-=(uint64_t);
+    unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
+    std::vector<uint64_t> get_keys() const;
+    size_t size() const;
+    void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
+    void fill_values(const std::vector<uint64_t>&, uint64_t, int);
 };
 
 class unsigned_interval_domain_t final {
@@ -75,14 +68,9 @@ class unsigned_interval_domain_t final {
   public:
 
     unsigned_interval_domain_t() = default;
-    unsigned_interval_domain_t(unsigned_interval_domain_t&& o) = default;
-    unsigned_interval_domain_t(const unsigned_interval_domain_t& o) = default;
-    explicit unsigned_interval_domain_t(unsigned_interval_registers_t&& registers,
-            unsigned_interval_stack_t&& stack, bool is_bottom = false) :
-        m_registers(std::move(registers)), m_stack(std::move(stack)),
-        m_is_bottom(is_bottom) {}
-    unsigned_interval_domain_t& operator=(unsigned_interval_domain_t&& o) = default;
-    unsigned_interval_domain_t& operator=(const unsigned_interval_domain_t& o) = default;
+    unsigned_interval_domain_t(unsigned_interval_registers_t registers,
+            unsigned_interval_stack_t stack) :
+        m_registers(std::move(registers)), m_stack(std::move(stack)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static unsigned_interval_domain_t setup_entry();
     // bottom/top

From 760b71607150941d8c720ea7e46ffd0f8e28a115 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sat, 30 Nov 2024 13:28:26 -0500
Subject: [PATCH 327/373] Refactoring in refinement, expression, constraint,
 and symbol class

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp     |  2 ++
 src/crab/constraint.hpp     | 10 +---------
 src/crab/expression.hpp     |  8 ++------
 src/crab/refinement.cpp     |  2 ++
 src/crab/refinement.hpp     |  4 ++--
 src/crab/symbol.hpp         |  2 +-
 src/crab/symbol_factory.cpp |  2 +-
 7 files changed, 11 insertions(+), 19 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 0d7688c9c..e3ccc8b1e 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -1,3 +1,5 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
 
 #include "constraint.hpp"
 
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 3559ffc6b..2b105eaad 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -19,21 +19,13 @@ class constraint_t {
     [[nodiscard]] expression_t get_lhs() const { return _lhs; }
     [[nodiscard]] expression_t get_rhs() const { return _rhs; }
 
-    constraint_t operator+(const constraint_t&) const;    
-    constraint_t operator+(int) const;
-    constraint_t operator+(interval_t) const;
-    constraint_t operator-(const constraint_t&) const;
-    constraint_t operator|(const constraint_t&) const;
-    constraint_t operator<=(const constraint_t&) const;
-    constraint_t operator>(const constraint_t&) const;
     std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
-    bool is_equality() const;
     bool contains(const symbol_t&) const;
     void normalize();
     [[nodiscard]] constraint_t negate() const;
     void write(std::ostream&) const;
+    friend std::ostream& operator<<(std::ostream &, const constraint_t&);
 };
 
-std::ostream& operator<<(std::ostream &, const constraint_t&);
 
 } // namespace crab
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index a51540898..e83613b41 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -22,17 +22,13 @@ class expression_t {
 
   public:
     expression_t() : _constant_term(interval_t::top()) {};
-    expression_t(symbol_terms_t symbol_terms, interval_t interval)
-        : _symbol_terms(symbol_terms), _constant_term(interval) {}
     expression_t(symbol_t symbol, std::shared_ptr<slacks_t> slacks = nullptr)
         : _constant_term(interval_t{0}), _slacks(slacks) {
         _symbol_terms[symbol] = 1;
     }
     expression_t(symbol_terms_t symbol_terms, interval_t interval,
-            std::shared_ptr<slacks_t> slacks)
+            std::shared_ptr<slacks_t> slacks = nullptr)
         : _symbol_terms(symbol_terms), _constant_term(interval), _slacks(slacks) {}
-    expression_t(symbol_terms_t symbol_terms, std::shared_ptr<slacks_t> slacks = nullptr)
-        : _symbol_terms(symbol_terms), _constant_term{interval_t{0}}, _slacks(slacks) {}
     expression_t(interval_t interval)
         : _constant_term(interval) {}
     expression_t(int n)
@@ -63,6 +59,7 @@ class expression_t {
     std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
     void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
     std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
+    friend std::ostream& operator<<(std::ostream &, const expression_t&);
 
     static expression_t begin() {
         return expression_t(symbol_t::begin());
@@ -77,6 +74,5 @@ class expression_t {
     }
 };
 
-std::ostream& operator<<(std::ostream &, const expression_t&);
 
 }  // namespace crab
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 3fe3c7f0a..3f73c41cc 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -1,3 +1,5 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
 
 #include "refinement.hpp"
 
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 4c89fd58f..83842f9c9 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -18,7 +18,7 @@ class refinement_t {
     std::vector<crab::constraint_t> _constraints;
 
   public:
-    explicit refinement_t(refinement_type_t type, expression_t value,
+    refinement_t(refinement_type_t type, expression_t value,
             std::vector<crab::constraint_t> constraints = {})
         : _type(type), _value(value) {
         for (auto &&c : constraints) {
@@ -45,6 +45,7 @@ class refinement_t {
     bool is_safe_with(refinement_t, bool) const;
     interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
             const std::vector<constraint_t>&) const;
+    friend std::ostream &operator<<(std::ostream &, const refinement_t&);
 
     static refinement_t begin() {
         return refinement_t(refinement_type_t::PACKET, expression_t::begin());
@@ -59,6 +60,5 @@ class refinement_t {
     }
 };
 
-std::ostream &operator<<(std::ostream &, const refinement_t&);
 
 } // namespace crab
diff --git a/src/crab/symbol.hpp b/src/crab/symbol.hpp
index 1c29ee41d..45b90e03b 100644
--- a/src/crab/symbol.hpp
+++ b/src/crab/symbol.hpp
@@ -37,12 +37,12 @@ class symbol_t final {
     bool is_begin() const { return *this == symbol_t::begin(); }
     bool is_slack() const { return _id >= 4; }
     void write(std::ostream& o) const;
+    friend std::ostream& operator<<(std::ostream& o, const symbol_t& s);
 
     struct Hasher {
         std::size_t operator()(const symbol_t& s) const { return s.hash(); }
     };
 };  // class symbol_t
 
-std::ostream& operator<<(std::ostream& o, const symbol_t& s);
 
 } // namespace crab
diff --git a/src/crab/symbol_factory.cpp b/src/crab/symbol_factory.cpp
index 2d7a4da9c..461c6202b 100644
--- a/src/crab/symbol_factory.cpp
+++ b/src/crab/symbol_factory.cpp
@@ -4,7 +4,7 @@
  * Factories for symbol names.
  */
 
-#include "crab/symbol.hpp"
+#include "symbol.hpp"
 
 namespace crab {
 

From 2d953016223954eadce05c65340a5f37b518b65d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 1 Dec 2024 16:42:42 -0500
Subject: [PATCH 328/373] Changing representation to refinement-related code

Following changes have been made:
1. Instead of keeping arbitrary constraints as a vector, restrict the
   refinements to meta-begin constraints, and begin-end constraints
   (meta-end constraint is generated as needed). This simplifies the
   analysis while only keeping the representation that is needed;
2. Allow constraints only in v_begin register, hence less constraints to
   keep track of, otherwise there can be unintentional inconsistencies;
3. Relevant changes to other files, including offset_domain, constraint,
   expression, symbol classes
4. Better printing of types

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp      |  86 +++++++--
 src/crab/constraint.hpp      |  39 +++-
 src/crab/expression.cpp      | 151 ++++++++-------
 src/crab/expression.hpp      |  10 +-
 src/crab/interval_domain.hpp |   2 +-
 src/crab/offset_domain.cpp   |  60 ++----
 src/crab/offset_domain.hpp   |   4 +-
 src/crab/refinement.cpp      | 344 +++++++++++++----------------------
 src/crab/refinement.hpp      |  51 ++++--
 src/crab/symbol.hpp          |  18 +-
 src/crab/symbol_factory.cpp  |   8 +-
 src/crab/types.hpp           |   1 +
 12 files changed, 394 insertions(+), 380 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index e3ccc8b1e..663674ff7 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -12,26 +12,88 @@ std::ostream &operator<<(std::ostream &o, const constraint_t &c) {
 
 // if a certain symbol is present in the constraint
 bool constraint_t::contains(const symbol_t &s) const {
-    return _lhs.contains(s) || _rhs.contains(s);
+    return _lhs.contains(s);
 }
 
-// move all terms to the left side
-void constraint_t::normalize() {
-    _lhs = _lhs + _rhs.negate();
-    _rhs = expression_t(0);
+// get slack intervals for all symbols in the constraint
+std::map<symbol_t, mock_interval_t> constraint_t::get_slack_intervals() const {
+    return _lhs.get_slack_intervals();
 }
 
-// get slack intervals for all symbols in the constraint
-std::vector<std::pair<symbol_t, interval_t>> constraint_t::get_slack_intervals() const {
-    std::vector<std::pair<symbol_t, interval_t>> result = _lhs.get_slack_intervals();
-    auto rhs_intervals = _rhs.get_slack_intervals();
-    result.insert(result.end(), rhs_intervals.begin(), rhs_intervals.end());
-    return result;
+interval_t constraint_t::compute_subtraction(const symbol_t &a, const symbol_t &b) const {
+    expression_t lhs = _lhs.get_equivalent_expression();
+    int coeff_a = static_cast<int>(lhs.get_coefficient(a));
+    int coeff_b = static_cast<int>(lhs.get_coefficient(b));
+    interval_t constant = lhs.get_constant_term();
+    if (coeff_a == 1 && coeff_b == -1) {
+        // a - b + [lb, ub] <= 0 -> a - b = [-oo, -lb]
+        return interval_t{bound_t::minus_infinity(), -constant.lb()};
+    } else if (coeff_a == -1 && coeff_b == 1) {
+        // b - a + [lb, ub] <= 0 -> a - b = [lb, +oo]
+        return interval_t{constant.lb(), bound_t::plus_infinity()};
+    } else {
+        return interval_t::top();
+    }
 }
 
 constraint_t constraint_t::negate() const {
     // neg(x <= y) -> x > y -> y < x -> y <= x - 1
-    return constraint_t(_rhs, _lhs + (-1));
+    return constraint_t(_rhs, _lhs - 1);
+}
+
+constraint_t constraint_t::operator|(const constraint_t &other) const {
+    if (other.implies(*this)) {
+        // other => this
+        return *this;
+    } else if (implies(other)) {
+        // this => other
+        return other;
+    } else {
+        if (is_meta_begin_constraint()) {
+            // meta <= begin
+            return constraint_t::meta_begin_init_constraint();
+        }
+        else if (is_begin_end_constraint()) {
+            // begin <= end
+            return constraint_t::begin_end_init_constraint();
+        }
+        else {
+            return constraint_t::get_true();
+        }
+    }
+}
+
+bool constraint_t::is_meta_begin_constraint() const {
+    return _lhs.contains(symbol_t::meta()) && _lhs.contains(symbol_t::begin());
+}
+
+bool constraint_t::is_begin_end_constraint() const {
+    return _lhs.contains(symbol_t::begin()) && _lhs.contains(symbol_t::end());
+}
+
+bool constraint_t::is_bottom() const {
+    // lhs > rhs is bottom
+    return _lhs > _rhs;
+}
+
+bool constraint_t::is_top() const {
+    // lhs <= rhs is top
+    return _lhs <= _rhs;
+}
+
+constraint_t constraint_t::operator+(constraint_t c2) const {
+    return constraint_t(_lhs + c2.get_lhs());
+}
+
+bool constraint_t::is_unsat(constraint_t other) const {
+    // check if the other constraint is unsat with this constraint
+    return operator+(other).is_bottom();
+}
+
+bool constraint_t::implies(const constraint_t& other) const {
+    // c1 => c2 iff c1 and not c2 is unsat
+    constraint_t negated = other.negate();
+    return is_unsat(std::move(negated));
 }
 
 void constraint_t::write(std::ostream &o) const {
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 2b105eaad..980405d3b 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -6,23 +6,44 @@
 
 namespace crab {
 
-// represents a constraint of the form lhs <= rhs
+// represents a constraint of the form lhs <= rhs, where rhs is always 0
 class constraint_t {
-  private:
     expression_t _lhs;
-    expression_t _rhs;
+    expression_t _rhs = expression_t(0);
+
+  private:
+    // true constraint is 0 <= 0, false constraint is 1 <= 0
+    constraint_t(bool is_true) : _lhs(is_true ? 0 : 1), _rhs(0) {}
 
   public:
+    constraint_t() : _lhs(1), _rhs(0) {} // false constraint
     constraint_t(expression_t lhs, expression_t rhs)
-        : _lhs(lhs), _rhs(rhs) {}
-
+        : _lhs(lhs - rhs), _rhs(expression_t(0)) {}
+    constraint_t(expression_t lhs) : _lhs(lhs), _rhs(expression_t(0)) {}
+    static constraint_t get_false() { return constraint_t(false); }
+    static constraint_t get_true() { return constraint_t(true); }
+    static constraint_t meta_begin_init_constraint() {
+        // construct meta <= begin
+        return constraint_t(expression_t::meta(), expression_t::begin());
+    }
+    static constraint_t begin_end_init_constraint() {
+        // construct begin <= end
+        return constraint_t(expression_t::begin(), expression_t::end());
+    }
+
+    bool is_meta_begin_constraint() const;
+    bool is_begin_end_constraint() const;
     [[nodiscard]] expression_t get_lhs() const { return _lhs; }
-    [[nodiscard]] expression_t get_rhs() const { return _rhs; }
-
-    std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
+    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
     bool contains(const symbol_t&) const;
-    void normalize();
+    bool implies(const constraint_t&) const;
+    constraint_t operator+(constraint_t) const;
+    bool is_unsat(constraint_t) const;
+    bool is_bottom() const;
+    bool is_top() const;
+    interval_t compute_subtraction(const symbol_t&, const symbol_t&) const;
     [[nodiscard]] constraint_t negate() const;
+    constraint_t operator|(const constraint_t&) const;
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream &, const constraint_t&);
 };
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index b96a21cc1..44c8ba09c 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -1,3 +1,5 @@
+// Copyright (c) Prevail Verifier contributors.
+// SPDX-License-Identifier: MIT
 
 #include "expression.hpp"
 
@@ -9,16 +11,25 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
 }
 
 // get values for all slack variables in the expression
-std::vector<std::pair<symbol_t, interval_t>> expression_t::get_slack_intervals() const {
-    std::vector<std::pair<symbol_t, interval_t>> slack_intervals;
+std::map<symbol_t, mock_interval_t> expression_t::get_slack_intervals() const {
+    std::map<symbol_t, mock_interval_t> slack_intervals;
     for (const auto &term : _symbol_terms) {
         if (term.first.is_slack()) {
-            slack_intervals.push_back({term.first, (*_slacks)[term.first].to_interval()});
+            // assuming that there are no conflicting values
+            slack_intervals[term.first] = (*_slacks)[term.first];
         }
     }
     return slack_intervals;
 }
 
+int8_t expression_t::get_coefficient(const symbol_t &s) const {
+    auto it = _symbol_terms.find(s);
+    if (it != _symbol_terms.end()) {
+        return it->second;
+    }
+    return 0;
+}
+
 // get an equivalent expression with all slack variables replaced by their values
 expression_t expression_t::get_equivalent_expression() const {
     interval_t value = _constant_term;
@@ -33,44 +44,72 @@ expression_t expression_t::get_equivalent_expression() const {
     return expression_t(symbol_terms, value, _slacks);
 }
 
-// check if two expressions are equal, by getting equivalent expressions and comparing them
-bool expression_t::is_equal(const expression_t &other) const {
-    return get_equivalent_expression() == other.get_equivalent_expression();
-}
-
-// check less than
-bool expression_t::is_less_than(const expression_t &other) const {
-    return get_equivalent_expression() < other.get_equivalent_expression();
+template <typename T, typename Op>
+static bool check_op(const symbol_terms_t& s1, const symbol_terms_t& s2, const T& op1, const T& op2,
+                     Op op) {
+    return s1 == s2 && op(op1, op2);
 }
 
-// check less than or equal
-bool expression_t::is_less_or_equal(const expression_t &other) const {
-    return get_equivalent_expression() <= other.get_equivalent_expression();
-}
-
-// check greater than
-bool expression_t::is_greater_than(const expression_t &other) const {
-    return get_equivalent_expression() > other.get_equivalent_expression();
-}
-
-// syntactic equality
+// equality
 bool expression_t::operator==(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _constant_term == other._constant_term;
+    auto check = [](const interval_t &a, const interval_t &b) { return a == b; };
+    if (check_op(_symbol_terms, other._symbol_terms, _constant_term, other._constant_term, check)) {
+        // syntactic equality
+        return true;
+    }
+    // check if two expressions are equal, by getting equivalent expressions and comparing them
+    expression_t e1 = get_equivalent_expression();
+    expression_t e2 = other.get_equivalent_expression();
+    if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term, e2._constant_term, check)) {
+        return true;
+    }
+    // expressions might still be equal, however, we can't prove it as it contains packet symbols
+    return false;
 }
 
-// syntactic less than
+// less than
 bool expression_t::operator<(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _constant_term.ub() < other._constant_term.lb();
+    auto check = [](const bound_t &a, const bound_t &b) { return a < b; };
+    if (check_op(_symbol_terms, other._symbol_terms, _constant_term.ub(), other._constant_term.lb(), check)) {
+        return true;
+    }
+    expression_t e1 = get_equivalent_expression();
+    expression_t e2 = other.get_equivalent_expression();
+    if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.ub(), e2._constant_term.lb(), check)) {
+        return true;
+    }
+    // we cannot prove that one expression is less than the other, as they contain packet symbols
+    return false;
 }
 
-// syntactic less than or equal
+// less than or equal
 bool expression_t::operator<=(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _constant_term.ub() <= other._constant_term.lb();
+    auto check = [](const bound_t &a, const bound_t &b) { return a <= b; };
+    if (check_op(_symbol_terms, other._symbol_terms, _constant_term.ub(), other._constant_term.lb(), check)) {
+        return true;
+    }
+    expression_t e1 = get_equivalent_expression();
+    expression_t e2 = other.get_equivalent_expression();
+    if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.ub(), e2._constant_term.lb(), check)) {
+        return true;
+    }
+    // we cannot prove that one expression is less than or equal to the other, as they contain packet symbols
+    return false;
 }
 
-// syntactic greater than
+// greater than
 bool expression_t::operator>(const expression_t &other) const {
-    return _symbol_terms == other._symbol_terms && _constant_term.lb() > other._constant_term.ub();
+    auto check = [](const bound_t &a, const bound_t &b) { return a > b; };
+    if (check_op(_symbol_terms, other._symbol_terms, _constant_term.lb(), other._constant_term.ub(), check)) {
+        return true;
+    }
+    expression_t e1 = get_equivalent_expression();
+    expression_t e2 = other.get_equivalent_expression();
+    if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.lb(), e2._constant_term.ub(), check)) {
+        return true;
+    }
+    // we cannot prove that one expression is greater than the other, as they contain packet symbols
+    return false;
 }
 
 // check if an expression contains a single symbol, which can be slack or not
@@ -103,26 +142,6 @@ static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv)
     }
 }
 
-// substitute a symbol in an expression with another expression
-expression_t expression_t::substitute(const symbol_t &from, const expression_t &to) const {
-    expression_t result = *this;
-    auto it = result._symbol_terms.find(from);
-    if (it != result._symbol_terms.end()) {
-        result._symbol_terms.erase(it);
-        result = result + to;
-    }
-    return result;
-}
-
-// negate an expression, and return it
-expression_t expression_t::negate() const {
-    symbol_terms_t new_terms;
-    for (const auto &term : _symbol_terms) {
-        new_terms[term.first] = -term.second;
-    }
-    return expression_t(new_terms, -_constant_term, _slacks);
-}
-
 // add two expressions, and return the result
 expression_t expression_t::operator+(const expression_t &other) const {
     auto new_terms = _symbol_terms;
@@ -138,23 +157,29 @@ expression_t expression_t::operator+(interval_t constant) const {
     return expression_t(_symbol_terms, _constant_term + constant, _slacks);
 }
 
+// subtract an expression from another, and return the result
+expression_t expression_t::operator-(const expression_t &other) const {
+    auto new_terms = _symbol_terms;
+    for (const auto &term : other._symbol_terms) {
+        insert(new_terms, {term.first, -term.second});
+    }
+    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
+    return expression_t(new_terms, _constant_term - other._constant_term, slacks);
+}
+
 // add an integer to an expression, and return the result
 expression_t expression_t::operator+(int n) const {
     return operator+(interval_t{n});
 }
 
 expression_t expression_t::operator|(const expression_t &other) const {
-    // TODO: support case where there are one slack variable in each expression,
-    // then we can construct a new slack that is the interval of two.
-    // we need to have intervals of slack variables to do this
     auto slacks = _slacks == nullptr ? other._slacks : _slacks;
+    if (slacks == nullptr) {
+        slacks = std::make_shared<slacks_t>();
+    }
     if (*this == other) {
         // both expressions are equal
-        return expression_t(_symbol_terms, _constant_term, slacks);
-    }
-    else if (_symbol_terms == other._symbol_terms) {
-        // both expressions have the same symbol terms, but different constant terms
-        return expression_t(_symbol_terms, _constant_term | other._constant_term, slacks);
+        return *this;
     }
     interval_t constant_term = _constant_term;
     interval_t other_constant_term = other._constant_term;
@@ -177,14 +202,18 @@ expression_t expression_t::operator|(const expression_t &other) const {
         }
     }
     for (const auto &term : other._symbol_terms) {
+        if (new_terms.find(term.first) != new_terms.end()) {
+            // if the symbol is already handled in the previous loop, then we skip it
+            continue;
+        }
         if (term.first.is_slack()) {
-            // if the symbol is a slack variable, it must not be in the first expression else it
-            // would have been handled in the previous loop, hence we resolve its value
+            // the slack variable was not handled before, hence we resolve its value
             other_constant_term = other_constant_term +
                 interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
         }
-        else if (_symbol_terms.find(term.first) == _symbol_terms.end()
-          || term.second != _symbol_terms.at(term.first)) {
+        else {
+            // in case where we have symbols other than slack variables, and either the symbol is not
+            // found in the other expression, or the coefficients are different, we return top
             return expression_t();
         }
     }
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index e83613b41..467bc2b25 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -34,31 +34,27 @@ class expression_t {
     expression_t(int n)
         : _constant_term(interval_t{n}) {}
     expression_t get_equivalent_expression() const;
-    bool is_equal(const expression_t &other) const;
-    bool is_less_than(const expression_t &other) const;
-    bool is_less_or_equal(const expression_t &other) const;
-    bool is_greater_than(const expression_t &other) const;
     bool operator==(const expression_t &other) const;
     bool operator<(const expression_t &other) const;
     bool operator<=(const expression_t &other) const;
     bool operator>(const expression_t &other) const;
     void operator-=(const symbol_t& s) { _symbol_terms.erase(s); }
     bool is_constant() const { return _symbol_terms.empty(); }
-    expression_t negate() const;
     expression_t operator+(const expression_t &other) const;
     expression_t operator+(interval_t) const;
     expression_t operator+(int n) const;
+    expression_t operator-(const expression_t &other) const;
     expression_t operator|(const expression_t &other) const;
     void write(std::ostream &o) const;
     symbol_terms_t get_symbol_terms() const { return _symbol_terms; }
+    int8_t get_coefficient(const symbol_t &s) const;
     bool is_singleton() const;
-    expression_t substitute(const symbol_t &, const expression_t &) const;
     bool contains(const symbol_t &s) const;
     symbol_t get_singleton() const;
     interval_t get_constant_term() const { return _constant_term; }
     std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
     void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
-    std::vector<std::pair<symbol_t, interval_t>> get_slack_intervals() const;
+    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
     friend std::ostream& operator<<(std::ostream &, const expression_t&);
 
     static expression_t begin() {
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index fdef8d12f..cfea99323 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -162,7 +162,7 @@ class interval_domain_t final {
     void store_in_stack_signed(uint64_t, mock_interval_t, int);
     void store_in_stack_unsigned(uint64_t, mock_interval_t, int);
     void adjust_bb_for_types(location_t);
-    std::vector<uint64_t> get_stack_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
     std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 1474992d0..c17b780ab 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -101,7 +101,7 @@ offset_registers_t offset_registers_t::operator|(const offset_registers_t& other
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             if (rf1.same_type(rf2)) {
-                joined_state.insert(register_t{i}, loc, std::move(rf1 | rf2));
+                joined_state.insert(register_t{i}, loc, rf1 | rf2);
             }
         }
     }
@@ -130,7 +130,7 @@ void offset_registers_t::forget_packet_pointers(location_t loc) {
             }
         }
     }
-    insert(register_t{12}, loc, refinement_t::begin());
+    insert(BEGIN_REG, loc, refinement_t::begin(true));
     // TODO: verify if this is all needed
 }
 
@@ -370,36 +370,14 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             m_errors.push_back("one of the pointers being compared isn't packet pointer");
             return;
         }
+        auto begin = m_registers.find(register_t{BEGIN_REG});
         if (cond.op == Condition::Op::LE) {
-            auto b = m_registers.find(register_t{12});
-            auto le_rf = *rf_left <= *rf_right;
-            if (b) {
-                b->add_constraint(std::move(le_rf));
-                b->add_constraint(refinement_t::meta() <= refinement_t::begin());
-                b->add_constraint(refinement_t::begin() <= refinement_t::end());
-                auto b_copy = *b;
-                if (b_copy.is_bottom()) {
-                    set_to_bottom();
-                }
-                else {
-                    m_registers.insert(register_t{12}, loc, std::move(*b));
-                }
-            }
+            begin->add_constraint(*rf_left <= *rf_right);
+            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GT) {
-            auto b = m_registers.find(register_t{12});
-            auto gt_rf = *rf_left > *rf_right;
-            if (b) {
-                b->add_constraint(std::move(gt_rf));
-                auto b_copy = *b;
-                if (b_copy.is_bottom()) {
-                    set_to_bottom();
-                }
-                else {
-                    m_registers.insert(register_t{12}, loc, std::move(*b));
-                }
-            }
-
+            begin->add_constraint(*rf_left > *rf_right);
+            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
         }
         // other comparisons not supported
     }
@@ -412,7 +390,7 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     expression_t dst_expr = dst_rf->get_value();
     expression_t src_expr = src_rf->get_value();
     refinement_t result_rf = *dst_rf - *src_rf;
-    expression_t result_expr = result_rf.get_value();
+    expression_t result_expr = result_rf.get_value().get_equivalent_expression();
     if (result_expr.is_constant()) {
         return result_expr.get_constant_term();
     }
@@ -421,19 +399,16 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     if (!dst_expr.is_singleton() || !src_expr.is_singleton()) return interval_t::top();
     auto dst_symbol = dst_expr.get_singleton();
     auto src_symbol = src_expr.get_singleton();
-    std::optional<refinement_t> begin_rf = m_registers.find(register_t{12});
-    if (!begin_rf) return interval_t::top();
-    interval_t result_interval = result_rf.simplify_for_subtraction(dst_symbol, src_symbol,
-            begin_rf->get_constraints());
-    return result_interval;
+    std::optional<refinement_t> begin_rf = m_registers.find(register_t{BEGIN_REG});
+    return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol);
 }
 
 static void create_numeric_refinement(offset_registers_t& reg_state, mock_interval_t&& interval,
         location_t loc, register_t reg) {
     symbol_t s = symbol_t::make();
     reg_state.insert_slack_value(s, std::move(interval));
-    refinement_t rf = refinement_t(refinement_type_t::NUM, expression_t(s, reg_state.get_slacks()));
-    reg_state.insert(reg, loc, std::move(rf));
+    expression_t value = expression_t(s, reg_state.get_slacks());
+    reg_state.insert(reg, loc, refinement_t::numeric_refinement(std::move(value)));
 }
 
 void offset_domain_t::do_bin(const Bin& bin,
@@ -639,12 +614,12 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
-    auto begin = m_registers.find(register_t{12});
-    if (!begin) return false;
+    auto begin = m_registers.find(register_t{BEGIN_REG});
     auto reg = m_registers.find(r.v);
     if (!reg) return false;
-    auto toCheck = *reg + (offset+width);
-    return toCheck.is_safe_with(*begin, is_comparison_check);
+    auto toCheck_lb = (*reg + offset).get_value();
+    auto toCheck_ub = (*reg + offset + width).get_value();
+    return begin->safe_access(toCheck_lb, toCheck_ub, is_comparison_check);
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
@@ -675,7 +650,8 @@ void offset_domain_t::do_mem_store(const Mem& b,
     }
     else {
         symbol_t s = symbol_t::make();
-        rf_info = refinement_t(refinement_type_t::NUM, expression_t(s, m_registers.get_slacks()));
+        expression_t value = expression_t(s, m_registers.get_slacks());
+        rf_info = refinement_t::numeric_refinement(std::move(value));
         interval_t interval = interval_t{number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}};
         m_registers.insert_slack_value(s, std::move(interval));
     }
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 46ca3552c..ba6585021 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -11,6 +11,8 @@ namespace crab {
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 using global_env_offset_registers_t = std::unordered_map<register_location_t, refinement_t>;
 
+constexpr uint8_t BEGIN_REG = 12;
+
 class offset_registers_t {
 
     live_registers_t m_cur_register_def;
@@ -25,7 +27,7 @@ class offset_registers_t {
             : m_registers_env(registers_env), m_slacks(slacks) {
 
             if (data_pos >= 0) {
-                insert(register_t{12}, location_t{label_t::entry, 0}, refinement_t::begin());
+                insert(BEGIN_REG, location_t{label_t::entry, 0}, refinement_t::begin(true));
             }
         }
         offset_registers_t operator|(const offset_registers_t&) const;
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 3f73c41cc..67ce20b06 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -5,121 +5,63 @@
 
 namespace crab {
 
-constexpr int PROPAGATE_INEQUALITIES = 2;
-
-static void propagate_inequalities(std::vector<constraint_t>& constraints_to_check) {
-    std::vector<constraint_t> new_constraints;
-    for (int i = 0; i < (int)constraints_to_check.size()-1; i++) {
-        for (int j = i + 1; j < (int)constraints_to_check.size(); j++) {
-            auto c1 = constraints_to_check[i];
-            auto c2 = constraints_to_check[j];
-            expression_t lhs1 = c1.get_lhs();
-            expression_t rhs1 = c1.get_rhs();
-            expression_t lhs2 = c2.get_lhs();
-            expression_t rhs2 = c2.get_rhs();
-            if (rhs1.is_singleton()) {
-                symbol_t y = rhs1.get_singleton();
-                if (lhs2.contains(y)) {
-                    expression_t new_lhs2 = lhs2.substitute(y, lhs1);
-                    new_constraints.push_back(constraint_t(new_lhs2, rhs2));
-                }
-            }
-            if (rhs2.is_singleton()) {
-                symbol_t y = rhs2.get_singleton();
-                if (lhs1.contains(y)) {
-                    expression_t new_lhs1 = lhs1.substitute(y, lhs2);
-                    new_constraints.push_back(constraint_t(new_lhs1, rhs1));
-                }
-            }
-        }
-    }
-    constraints_to_check.insert(constraints_to_check.end(),
-            new_constraints.begin(), new_constraints.end());
-}
-
 std::ostream& operator<<(std::ostream& o, const refinement_t& r) {
     r.write(o);
     return o;
 }
 
-bool refinement_t::is_bottom() {
-    std::vector<constraint_t> constraints_to_check = _constraints;
-    int i = 0;
-    while (i <= PROPAGATE_INEQUALITIES) {
-        for (constraint_t c : constraints_to_check) {
-            for (constraint_t c1 : constraints_to_check) {
-                c.normalize();  c1.normalize();
-                auto lhs = c.get_lhs();
-                auto lhs1 = c1.get_lhs();
-                auto add = lhs + lhs1;
-                // if we can derive a contradiction, then the refinement is bottom
-                // e.g., 5 <= 0
-                if (add.is_greater_than(expression_t(0))) {
-                    return true;
-                }
-            }
-        }
-        if (i < PROPAGATE_INEQUALITIES) {
-            propagate_inequalities(constraints_to_check);
-        }
-        i++;
-    }
-    return false;
+bool refinement_t::is_numeric_refinement() const {
+    return _type == refinement_type_t::NUM;
 }
 
-bool refinement_t::has_value(refinement_t&& other) const {
-    return (_type == other._type && _value == other._value);
+bool refinement_t::is_packet_refinement() const {
+    return _type == refinement_type_t::PACKET;
+}
+
+std::map<symbol_t, mock_interval_t> refinement_t::get_slack_intervals() const {
+    std::map<symbol_t, mock_interval_t> slack_intervals = _value.get_slack_intervals();
+    if (has_constraints) {
+        slack_intervals.merge(meta_begin_constraint.get_slack_intervals());
+        slack_intervals.merge(begin_end_constraint.get_slack_intervals());
+    }
+    return slack_intervals;
 }
 
 void refinement_t::write(std::ostream& o) const {
-    o << "{" << symbol_t::nu() << " : ";
-    if (_type == refinement_type_t::NUM) {
+    std::map<symbol_t, mock_interval_t> slack_intervals = get_slack_intervals();
+    bool has_extra_info = has_constraints || !slack_intervals.empty();
+    if (has_extra_info) o << "{";
+    if (is_numeric_refinement()) {
         o << "num<" << _value << ">";
     }
-    else if (_type == refinement_type_t::PACKET) {
+    else if (is_packet_refinement()) {
         o << "pkt<" << _value << ">";
     }
     else {
         o << "_";
     }
-    std::vector<std::pair<symbol_t, interval_t>> slack_intervals = _value.get_slack_intervals();
-    if (!_constraints.empty() || !slack_intervals.empty()) {
-        o << " | ";
+    if (has_extra_info) o << " | ";
+    if (has_constraints) {
+        o << meta_begin_constraint << " & " << begin_end_constraint;
     }
-    if (!_constraints.empty()) {
-        for (size_t i = 0; i < _constraints.size(); i++) {
-            auto c = _constraints[i];
-            auto c_slack_intervals = c.get_slack_intervals();
-            slack_intervals.insert(slack_intervals.end(), c_slack_intervals.begin(),
-                    c_slack_intervals.end());
-            o << _constraints[i];
-            if (i < _constraints.size() - 1) {
-                o << " & ";
-            }
-        }
+    size_t i = 0;
+    size_t n = slack_intervals.size();
+    if (n > 0 && has_constraints) {
+        o << " & ";
     }
-    std::set<symbol_t> seen;
-    if (!slack_intervals.empty()) {
-        if (!_constraints.empty()) {
+    for (auto [s, mock_interv] : slack_intervals) {
+        o << s << " in " << mock_interv.to_interval();
+        if (i < n - 1) {
             o << " & ";
         }
-        for (auto [s, i] : slack_intervals) {
-            if (seen.find(s) != seen.end()) {
-                continue;
-            }
-            o << s << " in " << i;
-            seen.insert(s);
-            if (s != slack_intervals.back().first) {
-                o << " & ";
-            }
-        }
+        i++;
     }
-    o << "}";
+    if (has_extra_info) o << "}";
 }
 
 refinement_t refinement_t::operator+(interval_t i) const {
     expression_t added_value = _value + i;
-    return refinement_t(_type, added_value, _constraints);
+    return refinement_t(_type, added_value);
 }
 
 refinement_t refinement_t::operator+(int n) const {
@@ -128,178 +70,152 @@ refinement_t refinement_t::operator+(int n) const {
 
 refinement_t refinement_t::operator+(const refinement_t &other) const {
     expression_t new_value = _value + other._value;
-    std::vector<crab::constraint_t> new_constraints;
-    new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
-    new_constraints.insert(new_constraints.end(),
-            other._constraints.begin(), other._constraints.end());
     refinement_type_t new_type = (_type == other._type) ? _type
         : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
           ? refinement_type_t::PACKET : refinement_type_t::ANY;
-    return refinement_t(new_type, new_value, new_constraints);
+    return refinement_t(new_type, new_value);
 }
 
 // use the constraints to compute a value for the subtraction, if possible
-interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src,
-        const std::vector<constraint_t>& constraints) const {
+interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src) const {
     bound_t max_packet_size = bound_t{number_t{MAX_PACKET_SIZE}};
-    bound_t max_meta_size = bound_t{number_t{4098}};
+    bound_t max_meta_size = bound_t{number_t{MAX_META_SIZE}};
     bound_t zero = bound_t{number_t{0}};
     symbol_t begin = symbol_t::begin();
     symbol_t end = symbol_t::end();
     symbol_t meta = symbol_t::meta();
 
-    if (src != begin && src != meta && src != end && dst != begin && dst != meta && dst != end) {
+    if (dst == meta && src == begin) {
+        // compute meta - begin
+        interval_t i = meta_begin_constraint.compute_subtraction(meta, begin);
+        return i & interval_t{-max_meta_size, zero};
+    }
+    else if (dst == begin && src == meta) {
+        // compute begin - meta
+        interval_t i = meta_begin_constraint.compute_subtraction(begin, meta);
+        return i & interval_t{zero, max_meta_size};
+    }
+    else if (dst == end && src == begin) {
+        // compute end - begin
+        interval_t i = begin_end_constraint.compute_subtraction(end, begin);
+        return i & interval_t{zero, max_packet_size};
+    }
+    else if (dst == begin && src == end) {
+        // compute begin - end
+        interval_t i = begin_end_constraint.compute_subtraction(begin, end);
+        return i & interval_t{-max_packet_size, zero};
+    }
+    else if (dst == end && src == meta) {
+        // compute end - meta
+        constraint_t meta_end_constraint = construct_meta_end_constraint();
+        interval_t i = meta_end_constraint.compute_subtraction(end, meta);
+        return i & interval_t{zero, max_meta_size + max_packet_size};
+    }
+    else if (dst == meta && src == end) {
+        // compute meta - end
+        constraint_t meta_end_constraint = construct_meta_end_constraint();
+        interval_t i = meta_end_constraint.compute_subtraction(meta, end);
+        return i & interval_t{-max_meta_size - max_packet_size, zero};
+    }
+    else {
         // We currently only support subtraction between begin, meta, and end
         return interval_t::top();
     }
+}
 
-    // we can do better in case both end and meta are involved, but for now we should be okay
-    if (dst == end && src == meta) {
-        return interval_t{zero, max_meta_size + max_packet_size};
+static constraint_t solve_constraints(constraint_t c1, constraint_t c2) {
+    // We are adding c2 to a system already containing c1
+    if (c1.is_unsat(c2)) {
+        // c1 and c2 are unsatisfiable
+        // e.g., c1 := begin + 14 <= end and c2 := begin + 14 > end
+        return constraint_t::get_false();
     }
-    else if (dst == meta && src == end) {
-        return interval_t{-(max_meta_size + max_packet_size), zero};
+    if (c1.implies(c2)) {
+        // c1 implies c2, so c2 is a weaker constraint. We keep c1.
+        // e.g., c1 := begin + 14 <= end and c2 := begin + 12 <= end
+        return c1;
+    }
+    if (c2.implies(c1)) {
+        // c2 implies c1, so c1 is a weaker constraint. We keep c2.
+        // e.g., c1 := begin + 14 <= end and c2 := begin + 18 <= end
+        return c2;
     }
-    // we only have cases (begin, meta), and (begin, end) left
-    bound_t max_size = (dst == meta || src == meta) ? max_meta_size : max_packet_size;
+    // c1 and c2 are not comparable, i.e., c2 is providing information not affecting c1
+    // e.g., c1 := begin + 14 <= end and c2 := begin + 18 > end
+    return c1;
+}
 
-    interval_t result = interval_t::top();
-    for (constraint_t c : constraints) {
-        c.normalize();
-        expression_t lhs = c.get_lhs();
-        if (lhs.contains(dst) && lhs.contains(src)) {
-            symbol_terms_t terms = lhs.get_symbol_terms();
-            if (terms.size() == 2) {
-                if (terms[dst] == 1 && terms[src] == -1) {
-                    // dst - src + [lb, ub] <= 0 -> dst - src <= -lb
-                    interval_t lhs_interval = lhs.get_constant_term();
-                    result = result & interval_t{-max_size, -lhs_interval.lb()};
-                }
-                else if (terms[dst] == -1 && terms[src] == 1) {
-                    // src - dst + [lb, ub] <= 0 -> dst - src >= lb
-                    interval_t lhs_interval = lhs.get_constant_term();
-                    result = result & interval_t{lhs_interval.lb(), max_size};
-                }
-            }
-        }
+void refinement_t::add_constraint(constraint_t c) {
+    if (c.is_meta_begin_constraint()) {
+        meta_begin_constraint = solve_constraints(meta_begin_constraint, std::move(c));
     }
-    // If no constraints were found, we can still infer some bounds
-    if (result == interval_t::top()) {
-        if (src == end)
-            result = interval_t{-max_packet_size, zero};
-        else if (dst == end)
-            result = interval_t{zero, max_packet_size};
-        else if (src == meta)
-            result = interval_t{zero, max_meta_size};
-        else if (dst == meta)
-            result = interval_t{-max_meta_size, zero};
+    else if (c.is_begin_end_constraint()) {
+        begin_end_constraint = solve_constraints(begin_end_constraint, std::move(c));
     }
-    return result;
 }
 
 refinement_t refinement_t::operator-(const refinement_t &other) const {
-    expression_t new_value = _value + other._value.negate();
-    std::vector<crab::constraint_t> new_constraints;
-    new_constraints.insert(new_constraints.end(), _constraints.begin(), _constraints.end());
-    new_constraints.insert(new_constraints.end(),
-            other._constraints.begin(), other._constraints.end());
+    expression_t new_value = _value - other._value;
     refinement_type_t new_type = (_type == other._type) ? refinement_type_t::NUM
         : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
           ? refinement_type_t::PACKET : refinement_type_t::ANY;
-    return refinement_t(new_type, new_value, new_constraints);
+    return refinement_t(new_type, new_value);
 }
 
 bool refinement_t::same_type(const refinement_t &other) const {
-    return _type == other._type;
+    return _type == other._type && _type != refinement_type_t::ANY;
 }
 
 refinement_t refinement_t::operator|(const refinement_t &other) const {
-    assert(same_type(other));
-    auto joined_value = _value | other._value;
-    std::vector<crab::constraint_t> new_constraints;
-    std::set<int> to_keep, to_keep1;
-    for (size_t i = 0; i < _constraints.size(); i++) {
-        for (size_t j = 0; j < other._constraints.size(); j++) {
-            auto c = _constraints[i];
-            auto c1 = other._constraints[j];
-            auto lhs = c.get_lhs();
-            auto lhs1 = c1.get_lhs();
-            if (lhs.is_equal(lhs1)) {
-                to_keep.insert(i);
-            }
-            else if (lhs.is_less_than(lhs1)) {
-                to_keep.insert(i);
-            }
-            else if (lhs1.is_less_than(lhs)) {
-                to_keep1.insert(j);
-            }
-        }
-    }
-    for (size_t i = 0; i < _constraints.size(); i++) {
-        if (to_keep.find(i) != to_keep.end()) {
-            new_constraints.push_back(_constraints[i]);
-        }
+    if (!has_constraints) {
+        return refinement_t(_type, _value | other._value);
     }
-    for (size_t i = 0; i < other._constraints.size(); i++) {
-        if (to_keep1.find(i) != to_keep1.end()) {
-            new_constraints.push_back(other._constraints[i]);
-        }
-    }
-    return refinement_t(_type, joined_value, new_constraints);
+    return refinement_t(_type, _value | other._value,
+                        meta_begin_constraint | other.meta_begin_constraint,
+                        begin_end_constraint | other.begin_end_constraint);
 }
 
 constraint_t refinement_t::operator<=(const refinement_t &other) const {
-    assert(same_type(other));
     return constraint_t(_value, other._value);
 }
 
 constraint_t refinement_t::operator>(const refinement_t &other) const {
-    assert(same_type(other));
-    return constraint_t(other._value, _value + (-1));
+    return operator<=(other).negate();
 }
 
-void refinement_t::add_constraint(constraint_t&& c, bool remove_redundant) {
-    auto c_copy = c;
-    c_copy.normalize();
-    if (remove_redundant) {
-        // remove redundant constraints
-        for (auto it = _constraints.begin(); it != _constraints.end();) {
-            auto c1 = *it;
-            c1.normalize();
-            // already contains the same constraint
-            if (c1.get_lhs().is_equal(c_copy.get_lhs())) {
-                return;
-            }
-            // found a stronger constraint
-            // e.g., begin + 14 <= end & begin + 34 <= end -> begin + 34 <= end
-            if (c1.get_lhs().is_less_than(c_copy.get_lhs())) {
-                it = _constraints.erase(it);
-            }
-            // found a weaker constraint
-            else if (c_copy.get_lhs().is_less_than(c1.get_lhs())) {
-                return;
-            }
-            else {
-                it++;
-            }
-        }
+constraint_t refinement_t::construct_meta_end_constraint() const {
+    return meta_begin_constraint + begin_end_constraint;
+}
+
+bool refinement_t::check_consistent(const constraint_t& c) const {
+    if (c.is_bottom()) {
+        return false;
+    }
+    else if (c.is_top()) {
+        return true;
+    }
+    else if (c.is_begin_end_constraint()) {
+        return begin_end_constraint.implies(c);
+    }
+    else if (c.is_meta_begin_constraint()) {
+        return meta_begin_constraint.implies(c);
+    }
+    else {
+        return construct_meta_end_constraint().implies(c);
     }
-    _constraints.push_back(std::move(c));
 }
 
-bool refinement_t::is_safe_with(refinement_t begin, bool is_comparison_check) const {
-    refinement_t check_lb = begin;
-    auto lb = constraint_t(expression_t::meta(), _value);
-    constraint_t neg_lb = lb.negate();
-    check_lb.add_constraint(std::move(neg_lb), false);
-    bool lb_satisfied = check_lb.is_bottom();
+bool refinement_t::safe_access(const expression_t& access_lb, const expression_t& access_ub,
+                               bool is_comparison_check) const {
+    // access is at least meta
+    constraint_t lb = constraint_t(expression_t::meta(), access_lb);
+    bool lb_satisfied = check_consistent(lb);
 
-    refinement_t check_ub = std::move(begin);
-    auto ub = is_comparison_check ? constraint_t(_value, expression_t(interval_t{MAX_PACKET_SIZE}))
-        : constraint_t(_value, expression_t::end());
-    constraint_t neg_ub = ub.negate();
-    check_ub.add_constraint(std::move(neg_ub), false);
-    bool ub_satisfied = check_ub.is_bottom();
+    // access is at most end or MAX_PACKET_SIZE, depending on the check
+    constraint_t ub = is_comparison_check ?
+        constraint_t(access_ub, expression_t(interval_t{MAX_PACKET_SIZE}))
+        : constraint_t(access_ub, expression_t::end());
+    bool ub_satisfied = check_consistent(ub);
 
     return lb_satisfied && ub_satisfied;
 }
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 83842f9c9..697c9b047 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -7,29 +7,29 @@
 namespace crab {
 
 enum class refinement_type_t {
-    NUM,
-    PACKET,
-    ANY
+    NUM,    // numeric refinement
+    PACKET, // packet refinement
+    ANY     // represents any refinement
 };
 
 class refinement_t {
     refinement_type_t _type;
     expression_t _value;
-    std::vector<crab::constraint_t> _constraints;
+    constraint_t meta_begin_constraint; // meta + sth <= begin
+    constraint_t begin_end_constraint; // begin + sth <= end
+    bool has_constraints = false;
 
   public:
-    refinement_t(refinement_type_t type, expression_t value,
-            std::vector<crab::constraint_t> constraints = {})
-        : _type(type), _value(value) {
-        for (auto &&c : constraints) {
-            add_constraint(std::move(c));
-        }
-    }
     refinement_t() : _type(refinement_type_t::ANY) {}
+    refinement_t(refinement_type_t type, expression_t value,
+                 constraint_t meta_begin_constraint, constraint_t begin_end_constraint) :
+        _type(type), _value(value), meta_begin_constraint(meta_begin_constraint),
+        begin_end_constraint(begin_end_constraint), has_constraints(true) {}
+    refinement_t(refinement_type_t type, expression_t value) :
+        _type(type), _value(value), meta_begin_constraint(constraint_t::get_true()),
+        begin_end_constraint(constraint_t::get_true()) {}
  
-    bool is_bottom();
     [[nodiscard]] refinement_type_t get_type() const { return _type; }
-    [[nodiscard]] std::vector<crab::constraint_t> get_constraints() const { return _constraints; }
     [[nodiscard]] expression_t get_value() const { return _value; }
     refinement_t operator+(int n) const;
     refinement_t operator+(interval_t) const;
@@ -38,16 +38,25 @@ class refinement_t {
     refinement_t operator|(const refinement_t &other) const;
     constraint_t operator<=(const refinement_t &other) const;
     constraint_t operator>(const refinement_t &other) const;
-    bool has_value(refinement_t&&) const;
     void write(std::ostream &o) const;
     bool same_type(const refinement_t &other) const;
-    void add_constraint(constraint_t&&, bool = true);
-    bool is_safe_with(refinement_t, bool) const;
-    interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
-            const std::vector<constraint_t>&) const;
+    bool safe_access(const expression_t&, const expression_t&, bool) const;
+    bool check_consistent(const constraint_t&) const;
+    constraint_t construct_meta_end_constraint() const;
+    bool is_numeric_refinement() const;
+    bool is_packet_refinement() const;
+    interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&) const;
+    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
+    void add_constraint(constraint_t);
     friend std::ostream &operator<<(std::ostream &, const refinement_t&);
 
-    static refinement_t begin() {
+    static refinement_t begin(bool has_constraints = false) {
+        if (has_constraints) {
+            constraint_t meta_begin_constraint = constraint_t::meta_begin_init_constraint();
+            constraint_t begin_end_constraint = constraint_t::begin_end_init_constraint();
+            return refinement_t(refinement_type_t::PACKET, expression_t::begin(),
+                                meta_begin_constraint, begin_end_constraint);
+        }
         return refinement_t(refinement_type_t::PACKET, expression_t::begin());
     }
 
@@ -58,6 +67,10 @@ class refinement_t {
     static refinement_t meta() {
         return refinement_t(refinement_type_t::PACKET, expression_t::meta());
     }
+
+    static refinement_t numeric_refinement(expression_t value) {
+        return refinement_t(refinement_type_t::NUM, std::move(value));
+    }
 };
 
 
diff --git a/src/crab/symbol.hpp b/src/crab/symbol.hpp
index 45b90e03b..a2b5bed0d 100644
--- a/src/crab/symbol.hpp
+++ b/src/crab/symbol.hpp
@@ -7,35 +7,33 @@
 
 namespace crab {
 
-using index_t = int64_t;
-
 class symbol_t final {
-    index_t _id;
+    uint64_t _id;
 
-    explicit symbol_t(index_t id) : _id(id) {}
+    explicit symbol_t(uint64_t id) : _id(id) {}
 
   public:
-    [[nodiscard]] std::size_t hash() const { return (size_t)_id; }
+    [[nodiscard]] std::size_t hash() const { return _id; }
     bool operator==(symbol_t o) const { return _id == o._id; }
     bool operator!=(symbol_t o) const { return (!(operator==(o))); }
     bool operator<(symbol_t o) const { return _id < o._id; }
     bool operator>(symbol_t o) const { return _id > o._id; }
-    operator int64_t() const { return _id; }
+    operator uint64_t() const { return _id; }
 
   private:
-    static int64_t count;
+    static uint64_t count;
 
   public:
     static symbol_t begin()     { return symbol_t(0); }
     static symbol_t end()       { return symbol_t(1); }
     static symbol_t meta()      { return symbol_t(2); }
-    static symbol_t nu()        { return symbol_t(3); }
+    //static symbol_t nu()        { return symbol_t(3); }
     static symbol_t make()      { return symbol_t(count++); }
-    bool is_nu() const { return *this == symbol_t::nu(); }
+    //bool is_nu() const { return *this == symbol_t::nu(); }
     bool is_meta() const { return *this == symbol_t::meta(); }
     bool is_end() const { return *this == symbol_t::end(); }
     bool is_begin() const { return *this == symbol_t::begin(); }
-    bool is_slack() const { return _id >= 4; }
+    bool is_slack() const { return _id >= 3; }
     void write(std::ostream& o) const;
     friend std::ostream& operator<<(std::ostream& o, const symbol_t& s);
 
diff --git a/src/crab/symbol_factory.cpp b/src/crab/symbol_factory.cpp
index 461c6202b..6d33594cf 100644
--- a/src/crab/symbol_factory.cpp
+++ b/src/crab/symbol_factory.cpp
@@ -8,7 +8,7 @@
 
 namespace crab {
 
-int64_t symbol_t::count = 4;
+uint64_t symbol_t::count = 3;
 
 void symbol_t::write(std::ostream& o) const {
     if (is_begin()) {
@@ -17,10 +17,10 @@ void symbol_t::write(std::ostream& o) const {
         o << "end";
     } else if (is_meta()) {
         o << "meta";
-    } else if (is_nu()) {
-        o << "v";
+    //} else if (is_nu()) {
+    //    o << "v";
     } else {
-        o << "a_" << ((int64_t)_id-4);
+        o << "a_" << ((uint64_t)_id-3);
     }
 }
 
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index 9086c4d90..7a024943d 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -16,6 +16,7 @@ constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
 constexpr int SHARED_BEGIN = 0;
 constexpr int MAX_PACKET_SIZE = 0xffff;
+constexpr int MAX_META_SIZE = 4098;
 
 
 enum class types_t {

From 54a021c6396d915a7d75b1ffd8643707da410bbd Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 1 Dec 2024 16:48:09 -0500
Subject: [PATCH 329/373] Add ctx to region domain previously removed

ctx is needed in region domain, hence its simpler version (than before)
has been added back to the domain -- mainly keeps track of where the
packet pointers are, rather than storing one;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp            | 51 +++++++++++++++++++--------
 src/crab/region_domain.hpp            | 29 ++++++++++-----
 src/crab/signed_interval_domain.hpp   |  4 +--
 src/crab/type_inference.cpp           | 10 +++---
 src/crab/unsigned_interval_domain.hpp |  2 +-
 5 files changed, 64 insertions(+), 32 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index bd1e54ee6..35b0734f7 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -48,6 +48,23 @@ static inline std::vector<std::set<int>> join_shared_ptr_aliases(
     return result;
 }
 
+region_ctx_t::region_ctx_t(const ebpf_context_descriptor_t* desc) {
+    if (desc->data >= 0) {
+        m_keys.push_back(desc->data);
+    }
+    if (desc->end >= 0) {
+        m_keys.push_back(desc->end);
+    }
+    if (desc->meta >= 0) {
+        m_keys.push_back(desc->meta);
+    }
+    m_size = std::max(0, desc->size);
+}
+
+bool region_ctx_t::packet_ptr_at(uint64_t key) const {
+    return std::find(m_keys.begin(), m_keys.end(), key) != m_keys.end();
+}
+
 void region_registers_t::scratch_caller_saved_registers() {
     for (uint8_t r = R1_ARG; r <= R5_ARG; r++) {
         operator-=(register_t{r});
@@ -284,12 +301,8 @@ std::vector<uint64_t> region_stack_t::find_overlapping_cells(uint64_t start, int
     return overlapping_cells;
 }
 
-void region_domain_t::compute_ctx_size(const ebpf_context_descriptor_t* desc) {
-    ctx_size = std::max(0, desc->size);
-}
-
 size_t region_domain_t::get_ctx_size() const {
-    return ctx_size;
+    return m_ctx->get_size();
 }
 
 std::optional<ptr_or_mapfd_t> region_domain_t::find_ptr_or_mapfd_type(register_t reg) const {
@@ -341,6 +354,10 @@ void region_domain_t::set_registers_to_top() {
     m_registers.set_to_top();
 }
 
+const std::vector<uint64_t>& region_domain_t::get_ctx_keys() const {
+    return m_ctx->get_keys();
+}
+
 std::vector<uint64_t> region_domain_t::get_stack_keys() const {
     return m_stack.get_keys();
 }
@@ -375,7 +392,7 @@ region_domain_t region_domain_t::operator|(const region_domain_t& other) const {
         return *this;
     }
     auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
-    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack,
+    return region_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, m_ctx,
             std::move(aliases));
 }
 
@@ -388,7 +405,7 @@ region_domain_t region_domain_t::operator|(region_domain_t&& other) const {
     }
     auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
     return region_domain_t(m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack), std::move(aliases));
+            m_stack | std::move(other.m_stack), std::move(m_ctx), std::move(aliases));
 }
 
 region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
@@ -767,6 +784,8 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
 }
 
 region_domain_t region_domain_t::setup_entry(bool init_r1) {
+    std::shared_ptr<region_ctx_t> ctx(std::make_shared<region_ctx_t>(
+                global_program_info.get().type.context_descriptor));
     region_registers_t typ(std::make_shared<global_env_region_registers_t>());
 
     location_t loc{label_t::entry, 0};
@@ -777,8 +796,7 @@ region_domain_t region_domain_t::setup_entry(bool init_r1) {
     auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    region_domain_t inv(std::move(typ), region_stack_t::top());
-    inv.compute_ctx_size(global_program_info.get().type.context_descriptor);
+    region_domain_t inv(std::move(typ), region_stack_t::top(), std::move(ctx));
     return inv;
 }
 
@@ -1026,14 +1044,14 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
         m_registers -= target_register;
         return;
     }
+
+    auto ptr_offset = offset_singleton.value();
+    auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
     if (is_stack_p) {
         if (width != 1 && width != 2 && width != 4 && width != 8) {
             m_registers -= target_register;
             return;
         }
-        auto ptr_offset = offset_singleton.value();
-        auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
-
         auto loaded = m_stack.find(load_at);
         if (!loaded) {
             // no field at loaded offset in stack
@@ -1051,9 +1069,12 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
         }
     }
     else {
-        // TODO: better reasoning needed here: in case there was an unsuccessful load in offset
-        // domain, we should not be loading from ctx
-        m_registers.insert(target_register, loc, packet_ptr_t{});
+        if (m_ctx->packet_ptr_at(load_at)) {
+            m_registers.insert(target_register, loc, packet_ptr_t{});
+        }
+        else {
+            m_registers -= target_register;
+        }
     }
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index aed982552..7b4addf34 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -13,6 +13,19 @@ using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, co
 using shared_ptr_aliases_t = std::vector<std::set<int>>;
 using ptr_or_mapfd_stack_cell_t = std::pair<ptr_or_mapfd_t, int>;
 
+class region_ctx_t {
+    std::vector<uint64_t> m_keys;
+    std::size_t m_size = 0;
+    bool m_is_bottom = false;
+
+  public:
+    region_ctx_t() = default;
+    region_ctx_t(const ebpf_context_descriptor_t*);
+    [[nodiscard]] const std::vector<uint64_t>& get_keys() const { return m_keys; }
+    bool packet_ptr_at(uint64_t key) const;
+    size_t get_size() const { return m_size; }
+};
+
 class region_stack_t {
     using ptr_or_mapfd_stack_cells_t = std::map<uint64_t, ptr_or_mapfd_stack_cell_t>;
     ptr_or_mapfd_stack_cells_t m_cells;
@@ -32,7 +45,7 @@ class region_stack_t {
     const ptr_or_mapfd_stack_cells_t &get_cells() { return m_cells; }
     void store(uint64_t, ptr_or_mapfd_t, int);
     std::optional<ptr_or_mapfd_stack_cell_t> find(uint64_t) const;
-    std::vector<uint64_t> get_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_keys() const;
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     size_t size() const;
 };
@@ -69,10 +82,9 @@ class region_registers_t {
 class region_domain_t final {
 
     bool m_is_bottom = false;
-    crab::region_stack_t m_stack;
-    crab::region_registers_t m_registers;
-    // for ctx, we only keep the size of the context
-    size_t ctx_size = 0;
+    region_stack_t m_stack;
+    region_registers_t m_registers;
+    std::shared_ptr<region_ctx_t> m_ctx;
     shared_ptr_aliases_t m_shared_ptr_aliases;
     std::vector<std::string> m_errors;
 
@@ -80,8 +92,8 @@ class region_domain_t final {
 
     region_domain_t() = default;
     region_domain_t(region_registers_t registers, region_stack_t stack,
-            shared_ptr_aliases_t shared_ptr_aliases = {})
-            : m_stack(std::move(stack)), m_registers(std::move(registers)),
+            std::shared_ptr<region_ctx_t> ctx, shared_ptr_aliases_t shared_ptr_aliases = {})
+            : m_stack(std::move(stack)), m_registers(std::move(registers)), m_ctx(std::move(ctx)),
             m_shared_ptr_aliases(std::move(shared_ptr_aliases)) {}
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static region_domain_t setup_entry(bool);
@@ -152,10 +164,9 @@ class region_domain_t final {
             const crab::location_t&, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
-    void compute_ctx_size(const ebpf_context_descriptor_t*);
     [[nodiscard]] size_t get_ctx_size() const;
     std::optional<crab::packet_ptr_t> find_in_ctx(uint64_t key) const;
-    [[nodiscard]] std::vector<uint64_t> get_ctx_keys() const;
+    [[nodiscard]] const std::vector<uint64_t>& get_ctx_keys() const;
     std::optional<crab::ptr_or_mapfd_stack_cell_t> find_in_stack(uint64_t key) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     void insert_in_registers(register_t, location_t, const ptr_or_mapfd_t&);
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 72394451b..d7bfd1a1f 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -55,7 +55,7 @@ class stack_slots_signed_state_t {
     void operator-=(uint64_t);
     bool all_numeric(uint64_t, int) const;
     stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
-    std::vector<uint64_t> get_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_keys() const;
     size_t size() const;
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
@@ -128,7 +128,7 @@ class signed_interval_domain_t final {
     void insert_in_registers(register_t, location_t, interval_t);
     void store_in_stack(uint64_t, mock_interval_t, int);
     void adjust_bb_for_types(location_t);
-    std::vector<uint64_t> get_stack_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
     std::vector<uint64_t> find_overlapping_cells_in_stack(uint64_t, int) const;
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 4d392dcd2..19f0030c1 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -113,7 +113,7 @@ string_invariant inference_domain_t::to_set() const {
             result.insert(elem.str());
         }
     }
-    std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
+   const std::vector<uint64_t>& stack_keys_region = m_region.get_stack_keys();
     for (auto const& k : stack_keys_region) {
         std::stringstream elem;
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
@@ -134,7 +134,7 @@ string_invariant inference_domain_t::to_set() const {
         result.insert(elem.str());
     }
 
-    std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
+    const std::vector<uint64_t>& stack_keys_interval = m_interval.get_stack_keys();
     for (auto const& k : stack_keys_interval) {
         auto maybe_interval_cells_signed = m_interval.find_in_stack_signed(k);
         if (maybe_interval_cells_signed.has_value()) {
@@ -673,7 +673,7 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
 }
 
 void inference_domain_t::print_ctx(std::ostream& o) const {
-    std::vector<uint64_t> ctx_keys = m_offset.get_ctx_keys();
+    const std::vector<uint64_t>& ctx_keys = m_region.get_ctx_keys();
     o << "\tctx: {";
     for (auto const& k : ctx_keys) {
         auto dist = m_offset.find_in_ctx(k);
@@ -687,8 +687,8 @@ void inference_domain_t::print_ctx(std::ostream& o) const {
 }
 
 void inference_domain_t::print_stack(std::ostream& o) const {
-    std::vector<uint64_t> stack_keys_region = m_region.get_stack_keys();
-    std::vector<uint64_t> stack_keys_interval = m_interval.get_stack_keys();
+    const std::vector<uint64_t>& stack_keys_region = m_region.get_stack_keys();
+    const std::vector<uint64_t>& stack_keys_interval = m_interval.get_stack_keys();
     o << "\tstack: {\n";
     for (auto const& k : stack_keys_region) {
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 8541c1c57..f647191c5 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -53,7 +53,7 @@ class unsigned_interval_stack_t {
     void store(uint64_t, mock_interval_t, int);
     void operator-=(uint64_t);
     unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
-    std::vector<uint64_t> get_keys() const;
+    [[nodiscard]] std::vector<uint64_t> get_keys() const;
     size_t size() const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values(const std::vector<uint64_t>&, uint64_t, int);

From f4a6a353996080113dbf533191a5958ae315064d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 2 Dec 2024 06:02:05 -0500
Subject: [PATCH 330/373] Fixing issues with Copy constructors and assignments

Copy constructors were not properly implemented, as shallow copies of
different shared (global) objects were being made, which affected
domains indirectly after copies;
In future, todo: remove dependency on shared (global) objects, where
possible

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp            |  9 +++----
 src/crab/offset_domain.hpp            | 34 ++++++++++++++++++++-------
 src/crab/region_domain.cpp            | 12 ++++------
 src/crab/region_domain.hpp            | 24 +++++++++++++++----
 src/crab/signed_interval_domain.cpp   |  7 +++---
 src/crab/signed_interval_domain.hpp   | 23 +++++++++++++++---
 src/crab/unsigned_interval_domain.cpp |  7 +++---
 src/crab/unsigned_interval_domain.hpp | 23 +++++++++++++++---
 8 files changed, 99 insertions(+), 40 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index c17b780ab..7e1e8df5d 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -91,7 +91,7 @@ offset_registers_t offset_registers_t::operator|(const offset_registers_t& other
         return *this;
     }
 
-    offset_registers_t joined_state(m_registers_env, m_slacks);
+    offset_registers_t joined_state(m_slacks);
     location_t loc = location_t::top();
 
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
@@ -219,6 +219,7 @@ offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
 }
 
 offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc) {
+    if (desc == nullptr) return;
     if (desc->data >= 0) {
         m_ctx_cells[desc->data] = refinement_t::begin();
     }
@@ -248,11 +249,7 @@ std::optional<refinement_t> offset_ctx_t::find(uint64_t key) const {
 }
 
 offset_domain_t offset_domain_t::setup_entry() {
-    offset_registers_t regs(std::make_shared<global_env_offset_registers_t>(),
-                            std::make_shared<slacks_t>(),
-                            global_program_info->type.context_descriptor->data);
-
-    return offset_domain_t{std::move(regs), offset_stack_t::top(),
+    return offset_domain_t{offset_registers_t{}, offset_stack_t::top(),
                     std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor)};
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index ba6585021..3c20ca946 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -21,15 +21,33 @@ class offset_registers_t {
     bool m_is_bottom = false;
 
     public:
-        offset_registers_t() = default;
-        offset_registers_t(std::shared_ptr<global_env_offset_registers_t> registers_env,
-                std::shared_ptr<slacks_t> slacks, int data_pos = -1)
-            : m_registers_env(registers_env), m_slacks(slacks) {
-
-            if (data_pos >= 0) {
-                insert(BEGIN_REG, location_t{label_t::entry, 0}, refinement_t::begin(true));
+        offset_registers_t() :
+            m_registers_env(std::make_shared<global_env_offset_registers_t>()),
+            m_slacks(std::make_shared<slacks_t>()) {
+            insert(BEGIN_REG, location_t{label_t::entry, 0}, refinement_t::begin(true));
+        }
+        offset_registers_t(std::shared_ptr<slacks_t> slacks)
+            : m_registers_env(std::make_shared<global_env_offset_registers_t>()), m_slacks(slacks) {}
+        offset_registers_t(const offset_registers_t& other)
+            : m_cur_register_def(other.m_cur_register_def), m_slacks(other.m_slacks),
+            m_is_bottom(other.m_is_bottom) {
+            if (other.m_registers_env) {
+                m_registers_env = std::make_shared<global_env_offset_registers_t>(*other.m_registers_env);
+            }
+        }
+        offset_registers_t& operator=(const offset_registers_t& other) {
+            if (this != &other) {
+                m_cur_register_def = other.m_cur_register_def;
+                m_is_bottom = other.m_is_bottom;
+                if (other.m_registers_env) {
+                    m_registers_env = std::make_shared<global_env_offset_registers_t>(*other.m_registers_env);
+                }
+                m_slacks = other.m_slacks;
             }
+            return *this;
         }
+        offset_registers_t(offset_registers_t&& other) = default;
+        offset_registers_t& operator=(offset_registers_t&& other) = default;
         offset_registers_t operator|(const offset_registers_t&) const;
         void operator-=(register_t);
         void set_to_top();
@@ -76,7 +94,7 @@ class offset_stack_t {
 class offset_ctx_t {
     using refinement_ctx_cells_t = std::unordered_map<uint64_t, refinement_t>;    // represents `cp[n] = rf;`
     refinement_ctx_cells_t m_ctx_cells;
-    size_t m_size;
+    size_t m_size = 0;
 
     public:
         offset_ctx_t(const ebpf_context_descriptor_t* desc);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 35b0734f7..782c029fb 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -49,6 +49,7 @@ static inline std::vector<std::set<int>> join_shared_ptr_aliases(
 }
 
 region_ctx_t::region_ctx_t(const ebpf_context_descriptor_t* desc) {
+    if (desc == nullptr) return;
     if (desc->data >= 0) {
         m_keys.push_back(desc->data);
     }
@@ -85,7 +86,7 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    region_registers_t joined_reg_types(m_registers_env);
+    region_registers_t joined_reg_types;
 
     // a hack to store region information at the start of a joined basic block
     // in join, we do not know the label of the bb, hence we store the information
@@ -784,11 +785,8 @@ void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
 }
 
 region_domain_t region_domain_t::setup_entry(bool init_r1) {
-    std::shared_ptr<region_ctx_t> ctx(std::make_shared<region_ctx_t>(
-                global_program_info.get().type.context_descriptor));
-    region_registers_t typ(std::make_shared<global_env_region_registers_t>());
-
     location_t loc{label_t::entry, 0};
+    region_registers_t typ;
     if (init_r1) {
         auto ctx_ptr_r1 = ptr_with_off_t(region_t::R_CTX, -1, mock_interval_t{number_t{0}});
         typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
@@ -796,8 +794,8 @@ region_domain_t region_domain_t::setup_entry(bool init_r1) {
     auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
-    region_domain_t inv(std::move(typ), region_stack_t::top(), std::move(ctx));
-    return inv;
+    return region_domain_t{std::move(typ), region_stack_t::top(),
+        std::make_shared<region_ctx_t>(global_program_info->type.context_descriptor)};
 }
 
 void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 7b4addf34..863315630 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -59,11 +59,25 @@ class region_registers_t {
     bool m_is_bottom = false;
 
   public:
-    region_registers_t() = default;
-    explicit region_registers_t(std::shared_ptr<global_env_region_registers_t> registers_env,
-            bool is_bottom = false)
-        : m_registers_env(std::move(registers_env)), m_is_bottom(is_bottom) {}
-
+    region_registers_t() : m_registers_env(std::make_shared<global_env_region_registers_t>()) {}
+    region_registers_t(const region_registers_t& other)
+        : m_cur_register_def(other.m_cur_register_def), m_is_bottom(other.m_is_bottom) {
+        if (other.m_registers_env) {
+            m_registers_env = std::make_shared<global_env_region_registers_t>(*other.m_registers_env);
+        }
+    }
+    region_registers_t(region_registers_t&& other) noexcept = default;
+    region_registers_t& operator=(const region_registers_t& other) {
+        if (this != &other) {
+            m_cur_register_def = other.m_cur_register_def;
+            if (other.m_registers_env) {
+                m_registers_env = std::make_shared<global_env_region_registers_t>(*other.m_registers_env);
+            }
+            m_is_bottom = other.m_is_bottom;
+        }
+        return *this;
+    }
+    region_registers_t& operator=(region_registers_t&& other) noexcept = default;
     region_registers_t operator|(const region_registers_t& other) const;
     void operator-=(register_t var);
     void set_to_bottom();
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index f0a71b83c..eea9a6cee 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -54,7 +54,7 @@ signed_interval_registers_t signed_interval_registers_t::operator|(const signed_
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    signed_interval_registers_t intervals_joined(m_registers_env);
+    signed_interval_registers_t intervals_joined;
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
@@ -422,9 +422,8 @@ string_invariant signed_interval_domain_t::to_set() {
 }
 
 signed_interval_domain_t signed_interval_domain_t::setup_entry() {
-    signed_interval_registers_t registers(std::make_shared<global_env_signed_registers_t>());
-    signed_interval_domain_t interval(std::move(registers), stack_slots_signed_state_t::top());
-    return interval;
+    return signed_interval_domain_t{signed_interval_registers_t{},
+        stack_slots_signed_state_t::top()};
 }
 
 // Simple truncation function usable with swap_endianness().
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index d7bfd1a1f..df5df33e6 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -18,9 +18,26 @@ class signed_interval_registers_t {
     bool m_is_bottom = false;
 
   public:
-    signed_interval_registers_t() = default;
-    signed_interval_registers_t(std::shared_ptr<global_env_signed_registers_t> registers_env)
-        : m_registers_env(std::move(registers_env)) {}
+    signed_interval_registers_t() :
+            m_registers_env(std::make_shared<global_env_signed_registers_t>()) {}
+    signed_interval_registers_t(const signed_interval_registers_t& other) :
+        m_cur_register_def(other.m_cur_register_def), m_is_bottom(other.m_is_bottom) {
+        if (other.m_registers_env) {
+            m_registers_env = std::make_shared<global_env_signed_registers_t>(*other.m_registers_env);
+        }
+    }
+    signed_interval_registers_t& operator=(const signed_interval_registers_t& other) {
+        if (this != &other) {
+            m_cur_register_def = other.m_cur_register_def;
+            m_is_bottom = other.m_is_bottom;
+            if (other.m_registers_env) {
+                m_registers_env = std::make_shared<global_env_signed_registers_t>(*other.m_registers_env);
+            }
+        }
+        return *this;
+    }
+    signed_interval_registers_t(signed_interval_registers_t&& other) = default;
+    signed_interval_registers_t& operator=(signed_interval_registers_t&& other) = default;
     bool is_bottom() const;
     bool is_top() const;
     void set_to_bottom();
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 80ab78de7..316f55340 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -54,7 +54,7 @@ unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const uns
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    unsigned_interval_registers_t intervals_joined(m_registers_env);
+    unsigned_interval_registers_t intervals_joined;
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
@@ -378,9 +378,8 @@ string_invariant unsigned_interval_domain_t::to_set() {
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry() {
-    unsigned_interval_registers_t registers(std::make_shared<global_env_unsigned_registers_t>());
-    unsigned_interval_domain_t interval(std::move(registers), unsigned_interval_stack_t::top());
-    return interval;
+    return unsigned_interval_domain_t{unsigned_interval_registers_t{},
+                                      unsigned_interval_stack_t::top()};
 }
 
 // Simple truncation function usable with swap_endianness().
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index f647191c5..e541db59b 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -18,9 +18,26 @@ class unsigned_interval_registers_t {
     bool m_is_bottom = false;
 
   public:
-    unsigned_interval_registers_t() = default;
-    unsigned_interval_registers_t(std::shared_ptr<global_env_unsigned_registers_t> registers_env)
-        : m_registers_env(std::move(registers_env)) {}
+    unsigned_interval_registers_t() :
+        m_registers_env(std::make_shared<global_env_unsigned_registers_t>()) {}
+    unsigned_interval_registers_t(const unsigned_interval_registers_t& other) :
+        m_cur_register_def(other.m_cur_register_def), m_is_bottom(other.m_is_bottom) {
+        if (other.m_registers_env) {
+            m_registers_env = std::make_shared<global_env_unsigned_registers_t>(*other.m_registers_env);
+        }
+    }
+    unsigned_interval_registers_t& operator=(const unsigned_interval_registers_t& other) {
+        if (this != &other) {
+            m_cur_register_def = other.m_cur_register_def;
+            m_is_bottom = other.m_is_bottom;
+            if (other.m_registers_env) {
+                m_registers_env = std::make_shared<global_env_unsigned_registers_t>(*other.m_registers_env);
+            }
+        }
+        return *this;
+    }
+    unsigned_interval_registers_t(unsigned_interval_registers_t&& other) = default;
+    unsigned_interval_registers_t& operator=(unsigned_interval_registers_t&& other) = default;
     bool is_bottom() const;
     bool is_top() const;
     void set_to_bottom();

From 0479f621f5988947b80f4a492c636fd383efcdf3 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 5 Dec 2024 05:25:01 -0500
Subject: [PATCH 331/373] Restructure the entire type inference domain

Keeping numeric refinements inside interval domain, and packet
refinements in offset domain, and only information needed in offset
domain is passed from interval domain;
Many relevant changes in the code;
Some printing changes for numeric refinements (TODO: fix later);
Cleanups;
TODO: The tool does not work properly yet, we need to fix many transformer
functions before it can be fixed;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.cpp               |   8 +-
 src/crab/expression.hpp               |  25 +-
 src/crab/interval_domain.cpp          | 365 +++++++++++++++-----------
 src/crab/interval_domain.hpp          |  39 +--
 src/crab/offset_domain.cpp            | 189 ++++---------
 src/crab/offset_domain.hpp            |  42 ++-
 src/crab/refinement.cpp               |   8 +
 src/crab/refinement.hpp               |  40 ++-
 src/crab/region_domain.cpp            |  79 +++---
 src/crab/region_domain.hpp            |  14 +-
 src/crab/signed_interval_domain.cpp   | 180 +++++++------
 src/crab/signed_interval_domain.hpp   |  46 ++--
 src/crab/type_inference.cpp           | 198 +++++++-------
 src/crab/type_inference.hpp           |  50 +++-
 src/crab/type_ostream.cpp             |  83 ++----
 src/crab/type_ostream.hpp             |  18 +-
 src/crab/types.hpp                    |  11 -
 src/crab/unsigned_interval_domain.cpp | 148 ++++++-----
 src/crab/unsigned_interval_domain.hpp |  31 ++-
 19 files changed, 799 insertions(+), 775 deletions(-)

diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 44c8ba09c..f21ff2093 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -112,6 +112,11 @@ bool expression_t::operator>(const expression_t &other) const {
     return false;
 }
 
+// check if an expression contains only an interval
+bool expression_t::only_has_interval() const {
+    return _symbol_terms.empty();
+}
+
 // check if an expression contains a single symbol, which can be slack or not
 bool expression_t::is_singleton() const {
     return _symbol_terms.size() == 1 && _constant_term == interval_t{0};
@@ -174,9 +179,6 @@ expression_t expression_t::operator+(int n) const {
 
 expression_t expression_t::operator|(const expression_t &other) const {
     auto slacks = _slacks == nullptr ? other._slacks : _slacks;
-    if (slacks == nullptr) {
-        slacks = std::make_shared<slacks_t>();
-    }
     if (*this == other) {
         // both expressions are equal
         return *this;
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 467bc2b25..c7f23d160 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -29,10 +29,10 @@ class expression_t {
     expression_t(symbol_terms_t symbol_terms, interval_t interval,
             std::shared_ptr<slacks_t> slacks = nullptr)
         : _symbol_terms(symbol_terms), _constant_term(interval), _slacks(slacks) {}
-    expression_t(interval_t interval)
-        : _constant_term(interval) {}
-    expression_t(int n)
-        : _constant_term(interval_t{n}) {}
+    expression_t(interval_t interval, std::shared_ptr<slacks_t> slacks = nullptr)
+        : _constant_term(interval), _slacks(slacks) {}
+    expression_t(int n, std::shared_ptr<slacks_t> slacks = nullptr)
+        : _constant_term(interval_t{n}), _slacks(slacks) {}
     expression_t get_equivalent_expression() const;
     bool operator==(const expression_t &other) const;
     bool operator<(const expression_t &other) const;
@@ -50,6 +50,7 @@ class expression_t {
     int8_t get_coefficient(const symbol_t &s) const;
     bool is_singleton() const;
     bool contains(const symbol_t &s) const;
+    bool only_has_interval() const;
     symbol_t get_singleton() const;
     interval_t get_constant_term() const { return _constant_term; }
     std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
@@ -57,16 +58,20 @@ class expression_t {
     std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
     friend std::ostream& operator<<(std::ostream &, const expression_t&);
 
-    static expression_t begin() {
-        return expression_t(symbol_t::begin());
+    static expression_t begin(std::shared_ptr<slacks_t> slacks = nullptr) {
+        return expression_t(symbol_t::begin(), slacks);
     }
 
-    static expression_t end() {
-        return expression_t(symbol_t::end());
+    static expression_t end(std::shared_ptr<slacks_t> slacks = nullptr) {
+        return expression_t(symbol_t::end(), slacks);
     }
 
-    static expression_t meta() {
-        return expression_t(symbol_t::meta());
+    static expression_t meta(std::shared_ptr<slacks_t> slacks = nullptr) {
+        return expression_t(symbol_t::meta(), slacks);
+    }
+
+    static expression_t top(std::shared_ptr<slacks_t> slacks = nullptr) {
+        return expression_t(interval_t::top(), slacks);
     }
 };
 
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 055916cd0..21f3c7859 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -81,63 +81,67 @@ void interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>& overla
     m_unsigned.fill_values_in_stack(overlap, start_loc, width);
 }
 
-std::optional<mock_interval_t> interval_domain_t::find_interval_value(register_t reg) const {
+std::optional<refinement_t> interval_domain_t::find_interval_value(register_t reg) const {
     // in this case, it does not matter which domain we look into, hence we look into the signed one
     return m_signed.find_interval_value(reg);
 }
 
-std::optional<mock_interval_t> interval_domain_t::find_signed_interval_value(register_t reg) const {
+std::optional<refinement_t> interval_domain_t::find_signed_interval_value(register_t reg) const {
     return m_signed.find_interval_value(reg);
 }
 
-std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_value(register_t reg) const {
+std::optional<refinement_t> interval_domain_t::find_unsigned_interval_value(register_t reg) const {
     return m_unsigned.find_interval_value(reg);
 }
 
-std::optional<mock_interval_t> interval_domain_t::find_signed_interval_at_loc(
+std::optional<refinement_t> interval_domain_t::find_signed_interval_at_loc(
         const register_location_t reg) const {
     return m_signed.find_interval_at_loc(reg);
 }
 
-std::optional<mock_interval_t> interval_domain_t::find_unsigned_interval_at_loc(
+std::optional<refinement_t> interval_domain_t::find_unsigned_interval_at_loc(
         const register_location_t reg) const {
     return m_unsigned.find_interval_at_loc(reg);
 }
 
-void interval_domain_t::insert_in_registers(register_t reg, location_t loc, interval_t interval) {
-    insert_in_registers_unsigned(reg, loc, interval);
-    insert_in_registers_signed(reg, loc, interval);
+void interval_domain_t::insert_in_registers(register_t reg, location_t loc, refinement_t rf) {
+    insert_in_registers_unsigned(reg, loc, rf);
+    insert_in_registers_signed(reg, loc, rf);
 }
 
 void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
         interval_t interval) {
-    m_signed.insert_in_registers(reg, loc, interval);
-    //auto v = m_unsigned.find_interval_at_loc(register_location_t{reg, loc});
-    //if (!v) {
-    //    m_unsigned.insert_in_registers(reg, loc, interval_t::top());
-    //}
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_signed.insert_in_registers(reg, loc, rf);
+}
+
+void interval_domain_t::insert_in_registers_signed(register_t reg, location_t loc,
+        refinement_t rf) {
+    m_signed.insert_in_registers(reg, loc, rf);
 }
 
 void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
         interval_t interval) {
-    m_unsigned.insert_in_registers(reg, loc, interval);
-    //auto v = m_signed.find_interval_at_loc(register_location_t{reg, loc});
-    //if (!v) {
-    //    m_signed.insert_in_registers(reg, loc, interval_t::top());
-    //}
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_unsigned.insert_in_registers(reg, loc, rf);
 }
 
-void interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
-    store_in_stack_signed(key, interval, width);
-    store_in_stack_unsigned(key, interval, width);
+void interval_domain_t::insert_in_registers_unsigned(register_t reg, location_t loc,
+        refinement_t rf) {
+    m_unsigned.insert_in_registers(reg, loc, rf);
 }
 
-void interval_domain_t::store_in_stack_signed(uint64_t key, mock_interval_t interval, int width) {
-    m_signed.store_in_stack(key, interval, width);
+void interval_domain_t::store_in_stack(uint64_t key, refinement_t rf, int width) {
+    store_in_stack_signed(key, rf, width);
+    store_in_stack_unsigned(key, rf, width);
 }
 
-void interval_domain_t::store_in_stack_unsigned(uint64_t key, mock_interval_t interval, int width) {
-    m_unsigned.store_in_stack(key, interval, width);
+void interval_domain_t::store_in_stack_signed(uint64_t key, refinement_t rf, int width) {
+    m_signed.store_in_stack(key, rf, width);
+}
+
+void interval_domain_t::store_in_stack_unsigned(uint64_t key, refinement_t rf, int width) {
+    m_unsigned.store_in_stack(key, rf, width);
 }
 
 bool interval_domain_t::operator<=(const interval_domain_t& abs) const {
@@ -159,12 +163,12 @@ void interval_domain_t::operator|=(interval_domain_t&& abs) {
 }
 
 interval_domain_t interval_domain_t::operator|(const interval_domain_t& other) const {
-    return interval_domain_t(m_signed | other.m_signed, m_unsigned | other.m_unsigned);
+    return interval_domain_t(m_signed | other.m_signed, m_unsigned | other.m_unsigned, m_slacks);
 }
 
 interval_domain_t interval_domain_t::operator|(interval_domain_t&& other) const {
     return interval_domain_t(m_signed | std::move(other.m_signed),
-                             m_unsigned | std::move(other.m_unsigned));
+                             m_unsigned | std::move(other.m_unsigned), std::move(other.m_slacks));
 }
 
 interval_domain_t interval_domain_t::operator&(const interval_domain_t& abs) const {
@@ -195,33 +199,36 @@ string_invariant interval_domain_t::to_set() {
     return string_invariant{};
 }
 
-interval_domain_t interval_domain_t::setup_entry() {
+interval_domain_t interval_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
     return interval_domain_t{
-        std::move(signed_interval_domain_t::setup_entry()),
-        std::move(unsigned_interval_domain_t::setup_entry())
+        signed_interval_domain_t::setup_entry(slacks),
+        unsigned_interval_domain_t::setup_entry(slacks),
+        slacks
     };
 }
 
 void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, const int finite_width, location_t loc, bool is_signed) {
-    auto mock_interval = is_signed ? m_signed.find_interval_value(lhs) : m_unsigned.find_interval_value(lhs);
-    if (!mock_interval) return;
-    interval_t interval = mock_interval->to_interval();
+    auto rf_opt = is_signed ? m_signed.find_interval_value(lhs) : m_unsigned.find_interval_value(lhs);
+    if (!rf_opt) return;
+    interval_t interval = rf_opt->get_interval_value();
+    // numeric_refinement_top() represents interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (interval.ub() - interval.lb() >= span) {
         // Interval covers the full space.
         // We do not forget the interval, as it will remove the information that it is a number.
         // We only set the interval to top.
         if (is_signed) {
-            m_signed.insert_in_registers(lhs, loc, interval_t::top());
+            m_signed.insert_in_registers(lhs, loc, top_rf);
         } else {
-            m_unsigned.insert_in_registers(lhs, loc, interval_t::top());
+            m_unsigned.insert_in_registers(lhs, loc, top_rf);
         }
         return;
     }
     if (interval.is_bottom()) {
         if (is_signed) {
-            m_signed.insert_in_registers(lhs, loc, interval_t::top());
+            m_signed.insert_in_registers(lhs, loc, top_rf);
         } else {
-            m_unsigned.insert_in_registers(lhs, loc, interval_t::top());
+            m_unsigned.insert_in_registers(lhs, loc, top_rf);
         }
         return;
     }
@@ -294,8 +301,8 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
-        zi = zi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
+        zi = zi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
@@ -303,8 +310,8 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
-        zi = zi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
+        zi = zi_opt->get_interval_value();
     }
 
     switch (op) {
@@ -352,14 +359,14 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
             std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
     }
 
     switch (op) {
@@ -390,14 +397,14 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
             std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
     }
     interval_t zi{number_t{k.cast_to<uint64_t>()}};
 
@@ -430,8 +437,8 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
-        zi = zi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
+        zi = zi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
@@ -439,8 +446,8 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->to_interval();
-        zi = zi_opt->to_interval();
+        yi = yi_opt->get_interval_value();
+        zi = zi_opt->get_interval_value();
     }
 
     switch (op) {
@@ -465,8 +472,7 @@ void interval_domain_t::apply_signed(const binaryop_t& op, const register_t& res
     if (finite_width) {
         auto signed_result = m_signed.find_interval_value(result);
         if (signed_result) {
-            auto signed_interval = signed_result->to_interval();
-            m_unsigned.insert_in_registers(result, loc, signed_interval);
+            m_unsigned.insert_in_registers(result, loc, *signed_result);
         }
         overflow(result, finite_width, loc, true);
         overflow(result, finite_width, loc, false);
@@ -478,8 +484,7 @@ void interval_domain_t::apply_signed(const binaryop_t& op, const register_t& res
     if (finite_width) {
         auto signed_result = m_signed.find_interval_value(result);
         if (signed_result) {
-            auto signed_interval = signed_result->to_interval();
-            m_unsigned.insert_in_registers(result, loc, signed_interval);
+            m_unsigned.insert_in_registers(result, loc, *signed_result);
         }
         overflow(result, finite_width, loc, true);
         overflow(result, finite_width, loc, false);
@@ -491,8 +496,7 @@ void interval_domain_t::apply_unsigned(const binaryop_t& op, const register_t& r
     if (finite_width) {
         auto unsigned_result = m_unsigned.find_interval_value(result);
         if (unsigned_result) {
-            auto unsigned_interval = unsigned_result->to_interval();
-            m_signed.insert_in_registers(result, loc, unsigned_interval);
+            m_signed.insert_in_registers(result, loc, *unsigned_result);
         }
         overflow(result, finite_width, loc, true);
         overflow(result, finite_width, loc, false);
@@ -504,8 +508,7 @@ void interval_domain_t::apply_unsigned(const binaryop_t& op, const register_t& r
     if (finite_width) {
         auto unsigned_result = m_unsigned.find_interval_value(result);
         if (unsigned_result) {
-            auto unsigned_interval = unsigned_result->to_interval();
-            m_signed.insert_in_registers(result, loc, unsigned_interval);
+            m_signed.insert_in_registers(result, loc, *unsigned_result);
         }
         overflow(result, finite_width, loc, true);
         overflow(result, finite_width, loc, false);
@@ -531,7 +534,8 @@ void interval_domain_t::sub(const register_t& lhs, const number_t& op2, location
 // Add/subtract with overflow are both signed and unsigned. We can use either one of the two to compute the
 // result before adjusting for overflow, though if one is top we want to use the other to retain precision.
 void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
-    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
@@ -539,7 +543,8 @@ void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op
 }
 
 void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
-    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
@@ -547,7 +552,8 @@ void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2,
 }
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
-    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
@@ -555,7 +561,8 @@ void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op
 }
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
-    if (!m_signed.find_interval_value(lhs)->to_interval().is_top()) {
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
@@ -662,13 +669,14 @@ void interval_domain_t::scratch_caller_saved_registers() {
 
 void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
         location_t loc) {
+    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     for (const auto& kv : store_in_stack) {
         auto offset = kv.first;
         auto width = kv.second;
         auto overlapping_cells = find_overlapping_cells_in_stack(offset, width);
         if (overlapping_cells.empty()) {
-            m_signed.store_in_stack(offset, interval_t::top(), width);
-            m_unsigned.store_in_stack(offset, interval_t::top(), width);
+            m_signed.store_in_stack(offset, top_rf, width);
+            m_unsigned.store_in_stack(offset, top_rf, width);
         }
         else {
             fill_values_in_stack(overlapping_cells, offset, width);
@@ -683,14 +691,14 @@ void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_sta
         operator-=(r0);
     }
     else {
-        insert_in_registers(r0, loc, interval_t::top());
+        insert_in_registers(r0, loc, top_rf);
     }
     scratch_caller_saved_registers();
 }
 
 void interval_domain_t::operator()(const Packet& u, location_t loc) {
     auto r0 = register_t{R0_RETURN_VALUE};
-    insert_in_registers(r0, loc, interval_t::top());
+    insert_in_registers(r0, loc, refinement_t::numeric_refinement_top(m_slacks));
     scratch_caller_saved_registers();
 }
 
@@ -738,6 +746,7 @@ void interval_domain_t::assume_unsigned_lt(bool is64, bool strict,
         register_t left, Value right, location_t loc) {
 
     auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
+    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (right_interval <= interval_t::nonnegative(64)) {
         // Both left_interval and right_interval fit in [0, INT_MAX],
         // and can be treated as both signed and unsigned values
@@ -757,9 +766,9 @@ void interval_domain_t::assume_unsigned_lt(bool is64, bool strict,
                 left_signed, left_unsigned, right_signed, right_unsigned,
                 left, right, loc, interval_t::top(), interval_t::top(),
                 false, true, false, false);
-        insert_in_registers_signed(left, loc, interval_t::top());
+        insert_in_registers_signed(left, loc, top_rf);
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers_signed(std::get<Reg>(right).v, loc, interval_t::top());
+            insert_in_registers_signed(std::get<Reg>(right).v, loc, top_rf);
         }
     }
     // possibly redundant case, since when left interval is negative, it is converted to
@@ -780,9 +789,9 @@ void interval_domain_t::assume_unsigned_lt(bool is64, bool strict,
         update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
                 left_signed, left_unsigned, right_signed, right_unsigned,
                 left, right, loc, interval_t::top(), std::move(positive), false, true, false, false);
-        insert_in_registers_signed(left, loc, interval_t::top());
+        insert_in_registers_signed(left, loc, top_rf);
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers_signed(std::get<Reg>(right).v, loc, interval_t::top());
+            insert_in_registers_signed(std::get<Reg>(right).v, loc, top_rf);
         }
     }
 }
@@ -793,6 +802,7 @@ void interval_domain_t::assume_unsigned_gt(bool is64, bool strict,
         const interval_t& right_signed, const interval_t& right_unsigned,
         register_t left, Value right, location_t loc) {
 
+    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
     if (left_interval <= interval_t::unsigned_int(64) &&
             right_interval <= interval_t::unsigned_int(64)) {
@@ -816,9 +826,9 @@ void interval_domain_t::assume_unsigned_gt(bool is64, bool strict,
         update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
                 left_signed, left_unsigned, right_signed, right_unsigned,
                 left, right, loc, interval_t::top(), std::move(positive), false, true, false, false);
-        insert_in_registers_signed(left, loc, interval_t::top());
+        insert_in_registers_signed(left, loc, top_rf);
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers(std::get<Reg>(right).v, loc, interval_t::top());
+            insert_in_registers(std::get<Reg>(right).v, loc, top_rf);
         }
     }
 }
@@ -954,16 +964,18 @@ void interval_domain_t::update_lt(bool is64, bool strict, interval_t&& left_inte
         if (update_signed) {
             auto to_insert_signed = interval_t{llbs, strict ? rlbs - number_t{1} : rlbs};
             to_insert_signed = to_insert_signed & restrict_signed;
-            insert_in_registers_signed(left, loc, to_insert_signed);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_signed, m_slacks);
+            insert_in_registers_signed(left, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(left, loc, to_insert_signed);
+                insert_in_registers_unsigned(left, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_unsigned = interval_t{llbu, strict ? rlbu - number_t{1} : rlbu};
             to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
-            insert_in_registers_unsigned(left, loc, to_insert_unsigned);
+            insert_in_registers_unsigned(left, loc,
+                                refinement_t::numeric_refinement(to_insert_unsigned, m_slacks));
         }
     }
     else if (left_interval <= right_interval && strict ? lub < rub : lub <= rub && holds_reg) {
@@ -971,32 +983,36 @@ void interval_domain_t::update_lt(bool is64, bool strict, interval_t&& left_inte
         if (update_signed) {
             auto to_insert_signed = interval_t{strict ? lubs + number_t{1} : lubs, rubs};
             to_insert_signed = to_insert_signed & restrict_signed;
-            insert_in_registers_signed(right_reg, loc, to_insert_signed);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_signed, m_slacks);
+            insert_in_registers_signed(right_reg, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(right_reg, loc, to_insert_signed);
+                insert_in_registers_unsigned(right_reg, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_unsigned = interval_t{strict ? lubu + number_t{1} : lubu, rubu};
             to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
-            insert_in_registers_unsigned(right_reg, loc, to_insert_unsigned);
+            insert_in_registers_unsigned(right_reg, loc,
+                            refinement_t::numeric_refinement(to_insert_unsigned, m_slacks));
         }
     }
     else if (lub >= rub && strict ? llb < rub : llb <= rub) {
         if (update_signed) {
             auto to_insert_left_signed = interval_t{llbs, strict ? rubs - number_t{1} : rubs};
             to_insert_left_signed = to_insert_left_signed & restrict_signed;
-            insert_in_registers_signed(left, loc, to_insert_left_signed);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_left_signed, m_slacks);
+            insert_in_registers_signed(left, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(left, loc, to_insert_left_signed);
+                insert_in_registers_unsigned(left, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_left_unsigned = interval_t{llbu, strict ? rubu - number_t{1} : rubu};
             to_insert_left_unsigned = to_insert_left_unsigned & restrict_unsigned;
-            insert_in_registers_unsigned(left, loc, to_insert_left_unsigned);
+            insert_in_registers_unsigned(left, loc,
+                            refinement_t::numeric_refinement(to_insert_left_unsigned, m_slacks));
         }
 
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rub)
@@ -1006,13 +1022,16 @@ void interval_domain_t::update_lt(bool is64, bool strict, interval_t&& left_inte
             auto right_reg = std::get<Reg>(right).v;
             if (update_signed) {
                 auto to_insert_right_signed = interval_t{rubs} & restrict_signed;
-                insert_in_registers_signed(right_reg, loc, to_insert_right_signed);
+                refinement_t rf = refinement_t::numeric_refinement(to_insert_right_signed, m_slacks);
+                insert_in_registers_signed(right_reg, loc, rf);
                 if (mk_equal_unsigned && !is_signed) {
-                    insert_in_registers_unsigned(right_reg, loc, to_insert_right_signed);
+                    insert_in_registers_unsigned(right_reg, loc, rf);
                 }
             }
             if (update_unsigned && !is_signed) {
-                insert_in_registers_unsigned(right_reg, loc, interval_t{rubu} & restrict_unsigned);
+                interval_t interval = interval_t{rubu} & restrict_unsigned;
+                insert_in_registers_unsigned(right_reg, loc,
+                                             refinement_t::numeric_refinement(interval, m_slacks));
             }
         }
     }
@@ -1021,9 +1040,11 @@ void interval_domain_t::update_lt(bool is64, bool strict, interval_t&& left_inte
         set_registers_to_bottom();
     }
     if (is_signed) {
-        insert_in_registers_unsigned(left, loc, left_unsigned);
+        insert_in_registers_unsigned(left, loc,
+                                     refinement_t::numeric_refinement(left_unsigned, m_slacks));
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc,
+                                     refinement_t::numeric_refinement(right_unsigned, m_slacks));
         }
     }
 }
@@ -1056,10 +1077,12 @@ void interval_domain_t::assume_signed_lt(bool is64, bool strict,
         update_lt(is64, strict, std::move(left_interval), std::move(right_interval),
                 left_signed, left_unsigned, right_signed, right_unsigned,
                 left, right, loc, interval_t::top(), interval_t::top(), true, false, false, false);
-        insert_in_registers_unsigned(left, loc, left_unsigned);
+        insert_in_registers_unsigned(left, loc,
+                                     refinement_t::numeric_refinement(left_unsigned, m_slacks));
         if (std::holds_alternative<Reg>(right)) {
             auto right_reg = std::get<Reg>(right).v;
-            insert_in_registers_unsigned(right_reg, loc, right_unsigned);
+            insert_in_registers_unsigned(right_reg, loc,
+                                     refinement_t::numeric_refinement(right_unsigned, m_slacks));
         }
     }
 }
@@ -1090,16 +1113,18 @@ void interval_domain_t::update_gt(bool is64, bool strict, interval_t&& left_inte
         if (update_signed) {
             auto to_insert_signed = interval_t{strict ? rubs + number_t{1} : rubs, lubs};
             to_insert_signed = to_insert_signed & restrict_signed;
-            insert_in_registers_signed(left, loc, to_insert_signed);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_signed, m_slacks);
+            insert_in_registers_signed(left, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(left, loc, to_insert_signed);
+                insert_in_registers_unsigned(left, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_unsigned = interval_t{strict ? rubu + number_t{1} : rubu, lubu};
             to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
-            insert_in_registers_unsigned(left, loc, to_insert_unsigned);
+            insert_in_registers_unsigned(left, loc,
+                                    refinement_t::numeric_refinement(to_insert_unsigned, m_slacks));
         }
     }
     else if (left_interval <= right_interval && strict ? llb > rlb : llb >= rlb && holds_reg) {
@@ -1107,32 +1132,36 @@ void interval_domain_t::update_gt(bool is64, bool strict, interval_t&& left_inte
         if (update_signed) {
             auto to_insert_signed = interval_t{rlbs, strict ? llbs - number_t{1} : llbs};
             to_insert_signed = to_insert_signed & restrict_signed;
-            insert_in_registers_signed(right_reg, loc, to_insert_signed);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_signed, m_slacks);
+            insert_in_registers_signed(right_reg, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(right_reg, loc, to_insert_signed);
+                insert_in_registers_unsigned(right_reg, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_unsigned = interval_t{rlbu, strict ? llbu - number_t{1} : llbu};
             to_insert_unsigned = to_insert_unsigned & restrict_unsigned;
-            insert_in_registers_unsigned(right_reg, loc, to_insert_unsigned);
+            insert_in_registers_unsigned(right_reg, loc,
+                                    refinement_t::numeric_refinement(to_insert_unsigned, m_slacks));
         }
     }
     else if (llb <= rlb && strict ? lub > rlb : lub >= rlb) {
         if (update_signed) {
             auto to_insert_signed_left = interval_t{strict ? rlbs + number_t{1} : rlbs, lubs};
             to_insert_signed_left = to_insert_signed_left & restrict_signed;
-            insert_in_registers_signed(left, loc, to_insert_signed_left);
+            refinement_t rf = refinement_t::numeric_refinement(to_insert_signed_left, m_slacks);
+            insert_in_registers_signed(left, loc, rf);
             if (mk_equal_unsigned && !is_signed) {
-                insert_in_registers_unsigned(left, loc, to_insert_signed_left);
+                insert_in_registers_unsigned(left, loc, rf);
             }
         }
 
         if (update_unsigned && !is_signed) {
             auto to_insert_unsigned_left = interval_t{strict ? rlbu + number_t{1} : rlbu, lubu};
             to_insert_unsigned_left = to_insert_unsigned_left & restrict_unsigned;
-            insert_in_registers_unsigned(left, loc, to_insert_unsigned_left);
+            insert_in_registers_unsigned(left, loc,
+                            refinement_t::numeric_refinement(to_insert_unsigned_left, m_slacks));
         }
 
         // this is only one way to resolve this scenario, i.e. set right to singleton value (rlb)
@@ -1142,13 +1171,16 @@ void interval_domain_t::update_gt(bool is64, bool strict, interval_t&& left_inte
             auto right_reg = std::get<Reg>(right).v;
             if (update_signed) {
                 auto to_insert_signed_right = interval_t{rlbs} & restrict_signed;
-                insert_in_registers_signed(right_reg, loc, to_insert_signed_right);
+                refinement_t rf = refinement_t::numeric_refinement(to_insert_signed_right, m_slacks);
+                insert_in_registers_signed(right_reg, loc, rf);
                 if (mk_equal_unsigned && !is_signed) {
-                    insert_in_registers_unsigned(right_reg, loc, to_insert_signed_right);
+                    insert_in_registers_unsigned(right_reg, loc, rf);
                 }
             }
             if (update_unsigned && !is_signed) {
-                insert_in_registers_unsigned(right_reg, loc, interval_t{rlbu} & restrict_unsigned);
+                interval_t interval = interval_t{rlbu} & restrict_unsigned;
+                insert_in_registers_unsigned(right_reg, loc,
+                                             refinement_t::numeric_refinement(interval, m_slacks));
             }
         }
     }
@@ -1157,9 +1189,11 @@ void interval_domain_t::update_gt(bool is64, bool strict, interval_t&& left_inte
         set_registers_to_bottom();
     }
     if (is_signed) {
-        insert_in_registers_unsigned(left, loc, left_unsigned);
+        insert_in_registers_unsigned(left, loc,
+                                     refinement_t::numeric_refinement(left_unsigned, m_slacks));
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc,
+                                     refinement_t::numeric_refinement(right_unsigned, m_slacks));
         }
     }
 }
@@ -1193,9 +1227,11 @@ void interval_domain_t::assume_signed_gt(bool is64, bool strict,
         update_gt(is64, strict, std::move(left_interval), std::move(right_interval),
                 left_signed, left_unsigned, right_signed, right_unsigned,
                 left, right, loc, interval_t::top(), interval_t::top(), true, false, false, true);
-        insert_in_registers_unsigned(left, loc, left_unsigned);
+        insert_in_registers_unsigned(left, loc,
+                                     refinement_t::numeric_refinement(left_unsigned, m_slacks));
         if (std::holds_alternative<Reg>(right)) {
-            insert_in_registers_unsigned(std::get<Reg>(right).v, loc, right_unsigned);
+            insert_in_registers_unsigned(std::get<Reg>(right).v, loc,
+                                     refinement_t::numeric_refinement(right_unsigned, m_slacks));
         }
     }
 }
@@ -1256,14 +1292,14 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
         Value right, location_t loc) {
     using Op = Condition::Op;
 
-    auto left_signed = find_signed_interval_value(left)->to_interval();
-    auto left_unsigned = find_unsigned_interval_value(left)->to_interval();
+    auto left_signed = find_signed_interval_value(left)->get_interval_value();
+    auto left_unsigned = find_unsigned_interval_value(left)->get_interval_value();
     auto right_signed = interval_t::bottom();
     auto right_unsigned = interval_t::bottom();
     if (std::holds_alternative<Reg>(right)) {
         auto right_reg = register_t{std::get<Reg>(right).v};
-        right_signed = find_signed_interval_value(right_reg)->to_interval();
-        right_unsigned = find_unsigned_interval_value(right_reg)->to_interval();
+        right_signed = find_signed_interval_value(right_reg)->get_interval_value();
+        right_unsigned = find_unsigned_interval_value(right_reg)->get_interval_value();
     } else if (std::holds_alternative<Imm>(right)) {
         auto right_imm = std::get<Imm>(right).v;
         right_signed = interval_t{number_t{right_imm}};
@@ -1274,12 +1310,14 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
         case Op::EQ: {
             auto interval_signed = left_signed & right_signed;
             auto interval_unsigned = left_unsigned & right_unsigned;
-            insert_in_registers_signed(left, loc, interval_signed);
-            insert_in_registers_unsigned(left, loc, interval_unsigned);
+            refinement_t rf_signed = refinement_t::numeric_refinement(interval_signed, m_slacks);
+            refinement_t rf_unsigned = refinement_t::numeric_refinement(interval_unsigned, m_slacks);
+            insert_in_registers_signed(left, loc, rf_signed);
+            insert_in_registers_unsigned(left, loc, rf_unsigned);
             if (std::holds_alternative<Reg>(right)) {
                 auto right_reg = std::get<Reg>(right).v;
-                insert_in_registers_signed(right_reg, loc, interval_signed);
-                insert_in_registers_unsigned(right_reg, loc, interval_unsigned);
+                insert_in_registers_signed(right_reg, loc, rf_signed);
+                insert_in_registers_unsigned(right_reg, loc, rf_unsigned);
             }
             break;
         }
@@ -1340,7 +1378,7 @@ bool interval_domain_t::load_from_stack(register_t reg, interval_t load_at, int
     if (overlapping_cells.size() == 1) {
         // only allow loading from a single cell
         if (all_numeric_in_stack(start_offset, width)) {
-            insert_in_registers(reg, loc, interval_t::top());
+            insert_in_registers(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
             return true;
         }
     }
@@ -1365,21 +1403,24 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
     int offset = b.access.offset;
     auto basereg_ptr_or_mapfd_type = basereg_type.value();
 
+    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (is_ctx_ptr(basereg_type)) {
-        insert_in_registers(target_register, loc, interval_t::top());
+        insert_in_registers(target_register, loc, top_rf);
         return;
     }
     if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
         if (width == 1) {
             interval_t to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
-            insert_in_registers(target_register, loc, to_insert);
+            expression_t e(to_insert, m_slacks);
+            insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
         }
         else if (width == 2) {
             interval_t to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
-            insert_in_registers(target_register, loc, to_insert);
+            expression_t e(to_insert, m_slacks);
+            insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
         }
         else {
-            insert_in_registers(target_register, loc, interval_t::top());
+            insert_in_registers(target_register, loc, refinement_t::numeric_refinement_top(m_slacks));
         }
         return;
     }
@@ -1431,7 +1472,7 @@ void interval_domain_t::shl(const register_t& reg, int imm, const int finite_wid
     imm &= finite_width - 1;
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
-        interval_t interval = interval_opt->to_interval();
+        interval_t interval = interval_opt->get_interval_value();
         if (interval.finite_size()) {
             const number_t lb = interval.lb().number().value();
             const number_t ub = interval.ub().number().value();
@@ -1455,7 +1496,7 @@ void interval_domain_t::shl(const register_t& reg, int imm, const int finite_wid
             if (to_signed(ub_n) >= to_signed(lb_n)) {
                 insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
             } else {
-                insert_in_registers_signed(reg, loc, interval_t::top());
+                insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
             }
             return;
         }
@@ -1468,7 +1509,7 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
     imm &= finite_width - 1;
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
-        interval_t interval = interval_opt->to_interval();
+        interval_t interval = interval_opt->get_interval_value();
         number_t lb_n{0};
         number_t ub_n{std::numeric_limits<uint64_t>::max() >> imm};
         if (interval.finite_size()) {
@@ -1492,31 +1533,25 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
         if (ub_n.narrow<int64_t>() >= lb_n.narrow<int64_t>()) {
             insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
         } else {
-            insert_in_registers_signed(reg, loc, interval_t::top());
+            insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
         }
         return;
     }
-    insert_in_registers_unsigned(reg, loc, interval_t::top());
-    insert_in_registers_signed(reg, loc, interval_t::top());
+    insert_in_registers_unsigned(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
+    insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
 }
 
-void interval_domain_t::do_bin(const Bin& bin,
-        const std::optional<interval_t>& src_signed_interval_opt,
-        const std::optional<interval_t>& src_unsigned_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
-        const std::optional<interval_t>& dst_signed_interval_opt,
-        const std::optional<interval_t>& dst_unsigned_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
-        const interval_t& subtracted, location_t loc) {
+void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>& subtracted_opt,
+                               location_t loc) {
     
     using Op = Bin::Op;
 
     auto dst_register = register_t{bin.dst.v};
     auto finite_width = (bin.is64 ? 64 : 32);
 
-    if (subtracted != interval_t::bottom()) {
-        interval_t dst_signed = subtracted;
-        interval_t dst_unsigned = subtracted;
+    if (subtracted_opt.has_value()) {
+        interval_t dst_signed = *subtracted_opt;
+        interval_t dst_unsigned = *subtracted_opt;
         if (!(dst_signed <= interval_t::signed_int(64))) {
             dst_signed = dst_signed.truncate_to_sint(64);
         }
@@ -1524,11 +1559,16 @@ void interval_domain_t::do_bin(const Bin& bin,
         if (!(dst_unsigned <= interval_t::unsigned_int(64))) {
             dst_unsigned = dst_unsigned.truncate_to_uint(64);
         }
-        insert_in_registers_unsigned(dst_register, loc, dst_unsigned);
+        insert_in_registers_unsigned(dst_register, loc,
+                                     refinement_t::numeric_refinement(dst_unsigned, m_slacks));
         return;
     }
 
-    if ((!dst_signed_interval_opt && !dst_unsigned_interval_opt) && bin.op != Op::MOV) {
+    bool is_numeric_dst = find_signed_interval_value(dst_register).has_value();
+    bool is_numeric_src = std::holds_alternative<Imm>(bin.v) ||
+            find_signed_interval_value(register_t{std::get<Reg>(bin.v).v}).has_value();
+
+    if (!is_numeric_dst && bin.op != Op::MOV) {
         operator-=(dst_register);
         return;
     }
@@ -1547,8 +1587,9 @@ void interval_domain_t::do_bin(const Bin& bin,
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm
-                m_signed.insert_in_registers(dst_register, loc, imm_interval);
-                m_unsigned.insert_in_registers(dst_register, loc, imm_interval);
+                refinement_t rf = refinement_t::numeric_refinement(imm_interval, m_slacks);
+                m_signed.insert_in_registers(dst_register, loc, rf);
+                m_unsigned.insert_in_registers(dst_register, loc, rf);
                 overflow(dst_register, finite_width, loc, false);
                 break;
             }
@@ -1602,12 +1643,13 @@ void interval_domain_t::do_bin(const Bin& bin,
                 if (gsl::narrow<int32_t>(imm) > 0) {
                     // AND with immediate is only a 32-bit operation so svalue and uvalue
                     // are the same.
-                    auto dst_signed = m_signed.find_interval_value(dst_register)->to_interval();
+                    auto dst_signed = m_signed.find_interval_value(dst_register)->get_interval_value();
                     auto lb = dst_signed.lb().number().value();
                     auto ub = dst_signed.ub().number().value();
                     dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
-                    m_signed.insert_in_registers(dst_register, loc, dst_signed);
-                    m_unsigned.insert_in_registers(dst_register, loc, dst_signed);
+                    refinement_t rf = refinement_t::numeric_refinement(dst_signed, m_slacks);
+                    m_signed.insert_in_registers(dst_register, loc, rf);
+                    m_unsigned.insert_in_registers(dst_register, loc, rf);
                 }
                 break;
             }
@@ -1634,8 +1676,10 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::ARSH: {
                 // ra >>>= imm
                 //ashr(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
-                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
-                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
+                m_signed.insert_in_registers(dst_register, loc,
+                                             refinement_t::numeric_refinement_top(m_slacks));
+                m_unsigned.insert_in_registers(dst_register, loc,
+                                               refinement_t::numeric_refinement_top(m_slacks));
                 break;
             }
             default: {
@@ -1644,7 +1688,7 @@ void interval_domain_t::do_bin(const Bin& bin,
         }
     }
     else {
-        if (!src_signed_interval_opt && !src_unsigned_interval_opt) {
+        if (!is_numeric_src) {
             operator-=(dst_register);
             return;
         }
@@ -1653,15 +1697,17 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::MOVSX8:
             case Op::MOVSX16:
             case Op::MOVSX32:
-                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
-                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
+                m_signed.insert_in_registers(dst_register, loc,
+                                            refinement_t::numeric_refinement_top(m_slacks));
+                m_unsigned.insert_in_registers(dst_register, loc,
+                                            refinement_t::numeric_refinement_top(m_slacks));
                 break;
             case Op::MOV: {
                 // ra = rb
-                auto src_signed = m_signed.find_interval_value(src_register)->to_interval();
-                auto src_unsigned = m_unsigned.find_interval_value(src_register)->to_interval();
-                m_signed.insert_in_registers(dst_register, loc, src_signed);
-                m_unsigned.insert_in_registers(dst_register, loc, src_unsigned);
+                auto src_signed_rf = m_signed.find_interval_value(src_register);
+                auto src_unsigned_rf = m_unsigned.find_interval_value(src_register);
+                m_signed.insert_in_registers(dst_register, loc, *src_signed_rf);
+                m_unsigned.insert_in_registers(dst_register, loc, *src_unsigned_rf);
                 break;
             }
             case Op::ADD: {
@@ -1673,8 +1719,9 @@ void interval_domain_t::do_bin(const Bin& bin,
                 // ra -= rb
                 if (src_register == dst_register) {
                     // an extra check only to pass a test
-                    m_signed.insert_in_registers(dst_register, loc, interval_t{number_t{0}});
-                    m_unsigned.insert_in_registers(dst_register, loc, interval_t{number_t{0}});
+                    interval_t zero = interval_t{number_t{0}};
+                    m_signed.insert_in_registers(dst_register, loc, zero);
+                    m_unsigned.insert_in_registers(dst_register, loc, zero);
                     break;
                 }
                 apply_signed(arith_binaryop_t::SUB, dst_register, dst_register, src_register, finite_width, loc);
@@ -1723,7 +1770,7 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::LSH: {
                 // ra <<= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
-                    auto src_unsigned = src_unsigned_interval_opt->to_interval();
+                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value();
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<int32_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
@@ -1742,7 +1789,7 @@ void interval_domain_t::do_bin(const Bin& bin,
             case Op::RSH: {
                 // ra >>= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
-                    auto src_unsigned = src_unsigned_interval_opt->to_interval();
+                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value();
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
@@ -1755,8 +1802,10 @@ void interval_domain_t::do_bin(const Bin& bin,
                         }
                     }
                 }
-                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
-                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
+                m_signed.insert_in_registers(dst_register, loc,
+                                             refinement_t::numeric_refinement_top(m_slacks));
+                m_unsigned.insert_in_registers(dst_register, loc,
+                                             refinement_t::numeric_refinement_top(m_slacks));
                 break;
             }
             case Op::ARSH: {
@@ -1765,8 +1814,10 @@ void interval_domain_t::do_bin(const Bin& bin,
                 //    ashr(dst_register, src_register, finite_width, loc);
                 //    break;
                 //}
-                m_signed.insert_in_registers(dst_register, loc, interval_t::top());
-                m_unsigned.insert_in_registers(dst_register, loc, interval_t::top());
+                m_signed.insert_in_registers(dst_register, loc,
+                                             refinement_t::numeric_refinement_top(m_slacks));
+                m_unsigned.insert_in_registers(dst_register, loc,
+                                             refinement_t::numeric_refinement_top(m_slacks));
                 break;
             }
             default: {
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index cfea99323..1a893e483 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -14,18 +14,24 @@ enum class bitwise_binaryop_t { AND, OR, XOR, SHL, LSHR, ASHR };
 using binaryop_t = std::variant<arith_binaryop_t, bitwise_binaryop_t>;
 
 class interval_domain_t final {
+    std::shared_ptr<slacks_t> m_slacks = nullptr;
     signed_interval_domain_t m_signed;
     unsigned_interval_domain_t m_unsigned;
     std::vector<std::string> m_errors;
 
   public:
 
-    interval_domain_t() = default;
+    interval_domain_t() : m_slacks(std::make_shared<slacks_t>()), m_signed(m_slacks),
+        m_unsigned(m_slacks) {}
+    interval_domain_t(std::shared_ptr<slacks_t> slacks) : m_slacks(std::move(slacks)),
+        m_signed(m_slacks), m_unsigned(m_slacks) {}
     interval_domain_t(signed_interval_domain_t signed_domain,
-            unsigned_interval_domain_t unsigned_domain) :
-        m_signed(std::move(signed_domain)), m_unsigned(std::move(unsigned_domain)) {}
+            unsigned_interval_domain_t unsigned_domain, std::shared_ptr<slacks_t> slacks) :
+        m_slacks(std::move(slacks)), m_signed(std::move(signed_domain)),
+        m_unsigned(std::move(unsigned_domain)) {}
+
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static interval_domain_t setup_entry();
+    static interval_domain_t setup_entry(std::shared_ptr<slacks_t>);
     // bottom/top
     static interval_domain_t bottom();
     void set_to_top();
@@ -124,10 +130,7 @@ class interval_domain_t final {
     void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
-    void do_bin(const Bin&, const std::optional<interval_t>&,
-            const std::optional<interval_t>&, const std::optional<ptr_or_mapfd_t>&,
-            const std::optional<interval_t>&, const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&, const interval_t&, location_t);
+    void do_bin(const Bin&, const std::optional<interval_t>&, location_t);
     void check_valid_access(const ValidAccess&, interval_t&&, int = -1, bool = false);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
     void assume_signed_cst(Condition::Op, bool, const interval_t&, const interval_t&,
@@ -148,19 +151,21 @@ class interval_domain_t final {
     void update_lt(bool, bool, interval_t&&, interval_t&&, const interval_t&, const interval_t&,
             const interval_t&, const interval_t&, register_t, Value, location_t,
             interval_t&&, interval_t&&, bool, bool, bool, bool);
-    std::optional<mock_interval_t> find_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_signed_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_unsigned_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_signed_interval_at_loc(const register_location_t reg) const;
-    std::optional<mock_interval_t> find_unsigned_interval_at_loc(const register_location_t reg) const;
+    std::optional<refinement_t> find_interval_value(register_t) const;
+    std::optional<refinement_t> find_signed_interval_value(register_t) const;
+    std::optional<refinement_t> find_unsigned_interval_value(register_t) const;
+    std::optional<refinement_t> find_signed_interval_at_loc(const register_location_t reg) const;
+    std::optional<refinement_t> find_unsigned_interval_at_loc(const register_location_t reg) const;
     std::optional<signed_interval_stack_cell_t> find_in_stack_signed(uint64_t) const;
     std::optional<unsigned_interval_stack_cell_t> find_in_stack_unsigned(uint64_t) const;
-    void insert_in_registers(register_t, location_t, interval_t);
+    void insert_in_registers(register_t, location_t, refinement_t);
+    void insert_in_registers_signed(register_t, location_t, refinement_t);
     void insert_in_registers_signed(register_t, location_t, interval_t);
+    void insert_in_registers_unsigned(register_t, location_t, refinement_t);
     void insert_in_registers_unsigned(register_t, location_t, interval_t);
-    void store_in_stack(uint64_t, mock_interval_t, int);
-    void store_in_stack_signed(uint64_t, mock_interval_t, int);
-    void store_in_stack_unsigned(uint64_t, mock_interval_t, int);
+    void store_in_stack(uint64_t, refinement_t, int);
+    void store_in_stack_signed(uint64_t, refinement_t, int);
+    void store_in_stack_unsigned(uint64_t, refinement_t, int);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 7e1e8df5d..d71db9d1c 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -5,28 +5,18 @@
 
 namespace crab {
 
-void offset_registers_t::insert(register_t reg, const location_t& loc, refinement_t&& rf) {
+void offset_registers_t::insert(register_t reg, const location_t& loc, refinement_t rf) {
     register_location_t register_location{reg, loc};
-    (*m_registers_env)[register_location] = std::move(rf);
+    (*m_registers_env)[register_location] = rf;
     m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-void offset_registers_t::insert_slack_value(symbol_t sym, mock_interval_t in) {
-    (*m_slacks)[sym] = std::move(in);
-}
-
 std::optional<refinement_t> offset_registers_t::find(register_location_t reg) const {
     auto it = m_registers_env->find(reg);
     if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> offset_registers_t::find_slack_value(symbol_t sym) const {
-    auto it = m_slacks->find(sym);
-    if (it == m_slacks->end()) return {};
-    return it->second;
-}
-
 std::optional<refinement_t> offset_registers_t::find(register_t key) const {
     if (m_cur_register_def[key] == nullptr) return {};
     return find(*(m_cur_register_def[key]));
@@ -91,7 +81,7 @@ offset_registers_t offset_registers_t::operator|(const offset_registers_t& other
         return *this;
     }
 
-    offset_registers_t joined_state(m_slacks);
+    offset_registers_t joined_state;
     location_t loc = location_t::top();
 
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
@@ -130,7 +120,7 @@ void offset_registers_t::forget_packet_pointers(location_t loc) {
             }
         }
     }
-    insert(BEGIN_REG, loc, refinement_t::begin(true));
+    insert(BEGIN_REG, loc, refinement_t::begin_with_constraints());
     // TODO: verify if this is all needed
 }
 
@@ -218,16 +208,16 @@ offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
     return offset_stack_t(std::move(out_stack_rfs));
 }
 
-offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc) {
+offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
     if (desc == nullptr) return;
     if (desc->data >= 0) {
-        m_ctx_cells[desc->data] = refinement_t::begin();
+        m_ctx_cells[desc->data] = refinement_t::begin(slacks);
     }
     if (desc->end >= 0) {
-        m_ctx_cells[desc->end] = refinement_t::end();
+        m_ctx_cells[desc->end] = refinement_t::end(slacks);
     }
     if (desc->meta >= 0) {
-        m_ctx_cells[desc->meta] = refinement_t::meta();
+        m_ctx_cells[desc->meta] = refinement_t::meta(slacks);
     }
     m_size = std::max(0, desc->size);
 }
@@ -248,9 +238,10 @@ std::optional<refinement_t> offset_ctx_t::find(uint64_t key) const {
     return it->second;
 }
 
-offset_domain_t offset_domain_t::setup_entry() {
+offset_domain_t offset_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
     return offset_domain_t{offset_registers_t{}, offset_stack_t::top(),
-                    std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor)};
+            std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor, slacks),
+            slacks};
 }
 
 offset_domain_t offset_domain_t::bottom() {
@@ -304,7 +295,7 @@ offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, m_ctx);
+    return offset_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, m_ctx, m_slacks);
 }
 
 offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
@@ -316,7 +307,8 @@ offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
     return offset_domain_t(
         m_registers | std::move(other.m_registers),
         m_stack | std::move(other.m_stack),
-        std::move(m_ctx)
+        std::move(other.m_ctx),
+        std::move(other.m_slacks)
     );
 }
 
@@ -400,20 +392,8 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol);
 }
 
-static void create_numeric_refinement(offset_registers_t& reg_state, mock_interval_t&& interval,
-        location_t loc, register_t reg) {
-    symbol_t s = symbol_t::make();
-    reg_state.insert_slack_value(s, std::move(interval));
-    expression_t value = expression_t(s, reg_state.get_slacks());
-    reg_state.insert(reg, loc, refinement_t::numeric_refinement(std::move(value)));
-}
-
-void offset_domain_t::do_bin(const Bin& bin,
-        const std::optional<interval_t>& src_signed_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
-        const std::optional<interval_t>& dst_signed_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt,
-        mock_interval_t &&interval_result, location_t loc) {
+void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>& numeric_rf_dst,
+                             const std::optional<refinement_t>& numeric_rf_src, location_t loc) {
 
     using Op = Bin::Op;
 
@@ -432,17 +412,14 @@ void offset_domain_t::do_bin(const Bin& bin,
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm
-                // we just get the value of the immediate as an interval from interval domain
-                create_numeric_refinement(m_registers, std::move(interval_result),
-                        loc, dst_register);
+                m_registers -= dst_register;
                 break;
             }
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
                 if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                    auto rf = *dst_rf_opt + imm_interval;
-                    m_registers.insert(dst_register, loc, std::move(rf));
+                    m_registers.insert(dst_register, loc, *dst_rf_opt + imm_interval);
                 }
                 else {
                     m_registers -= dst_register;
@@ -453,8 +430,7 @@ void offset_domain_t::do_bin(const Bin& bin,
                 // ra -= imm
                 if (imm == 0) break;
                 if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                    auto rf = *dst_rf_opt + (-imm_interval);
-                    m_registers.insert(dst_register, loc, std::move(rf));
+                    m_registers.insert(dst_register, loc, *dst_rf_opt + (-imm_interval));
                 }
                 else {
                     m_registers -= dst_register;
@@ -462,14 +438,8 @@ void offset_domain_t::do_bin(const Bin& bin,
                 break;
             }
             default: {
-                if (dst_signed_interval_opt) {
-                    create_numeric_refinement(m_registers, std::move(interval_result),
-                            loc, dst_register);
-                }
-                else {
-                    // no other operations supported for packet pointers in the offset domain
-                    m_registers -= dst_register;
-                }
+                // no other operations supported for packet pointers in the offset domain
+                m_registers -= dst_register;
                 break;
             }
         }
@@ -480,7 +450,7 @@ void offset_domain_t::do_bin(const Bin& bin,
             case Op::MOV: {
                 // ra = rb
                 if (auto src_rf_opt = m_registers.find(src.v)) {
-                    m_registers.insert(dst_register, loc, std::move(*src_rf_opt));
+                    m_registers.insert(dst_register, loc, *src_rf_opt);
                 }
                 else {
                     m_registers -= dst_register;
@@ -489,58 +459,42 @@ void offset_domain_t::do_bin(const Bin& bin,
             }
             case Op::ADD: {
                 // ra += rb
-                if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
+                auto dst_rf_opt = m_registers.find(dst_register);
+                auto src_rf_opt = m_registers.find(src.v);
+                if (dst_rf_opt.has_value() && src_rf_opt.has_value()) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
+                else if (dst_rf_opt.has_value() && numeric_rf_src.has_value()) {
+                    m_registers.insert(dst_register, loc, *dst_rf_opt + *numeric_rf_src);
+                }
+                else if (numeric_rf_dst.has_value() && src_rf_opt.has_value()) {
+                    m_registers.insert(dst_register, loc, *numeric_rf_dst + *src_rf_opt);
+                }
                 else {
-                    if (auto src_rf_opt = m_registers.find(src.v)) {
-                        if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                            auto rf = *dst_rf_opt + *src_rf_opt;
-                            m_registers.insert(dst_register, loc, std::move(rf));
-                        }
-                        else {
-                            m_registers -= dst_register;
-                        }
-                    }
-                    else {
-                        m_registers -= dst_register;
-                    }
+                    m_registers -= dst_register;
                 }
                 break;
             }
             case Op::SUB: {
                 // ra -= rb
-                if (is_packet_ptr(src_ptr_or_mapfd_opt) && is_packet_ptr(dst_ptr_or_mapfd_opt)) {
-                    create_numeric_refinement(m_registers, std::move(interval_result),
-                            loc, dst_register);
-                    return;
+                auto dst_rf_opt = m_registers.find(dst_register);
+                auto src_rf_opt = m_registers.find(src.v);
+                if (dst_rf_opt.has_value() && src_rf_opt.has_value()) {
+                    // possibly subtracting two pointers
+                    m_registers -= dst_register;
+                }
+                else if (dst_rf_opt.has_value() && numeric_rf_src.has_value()) {
+                    m_registers.insert(dst_register, loc, *dst_rf_opt - *numeric_rf_src);
                 }
                 else {
-                    if (auto src_rf_opt = m_registers.find(src.v)) {
-                        if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                            auto rf = *dst_rf_opt - *src_rf_opt;
-                            m_registers.insert(dst_register, loc, std::move(rf));
-                        }
-                        else {
-                            m_registers -= dst_register;
-                        }
-                    }
-                    else {
-                        m_registers -= dst_register;
-                    }
+                    m_registers -= dst_register;
                 }
                 break;
             }
             default: {
-                if (dst_ptr_or_mapfd_opt || src_ptr_or_mapfd_opt) {
-                    // no other operations supported for packet pointers in the offset domain
-                    m_registers -= dst_register;
-                }
-                else {
-                    create_numeric_refinement(m_registers, std::move(interval_result),
-                            loc, dst_register);
-                }
+                // no other operations supported for packet pointers in the offset domain
+                m_registers -= dst_register;
                 break;
             }
         }
@@ -556,16 +510,7 @@ void offset_domain_t::operator()(const Undefined& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const Un& u, location_t loc) {
-    // nothing to do here
-}
-
-void offset_domain_t::do_un(const Un& u, interval_t interval, location_t loc) {
-    if (interval == interval_t::bottom()) {
-        m_registers -= u.dst.v;
-    }
-    else {
-        create_numeric_refinement(m_registers, std::move(interval), loc, register_t{u.dst.v});
-    }
+    m_registers -= register_t{u.dst.v};
 }
 
 void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
@@ -589,8 +534,7 @@ void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
         m_registers -= r0;
     }
     else {
-        // slack needs to be fixed, as it can have any value
-        create_numeric_refinement(m_registers, mock_interval_t::top(), loc, r0);
+        m_registers -= r0;
     }
 }
 
@@ -604,8 +548,7 @@ void offset_domain_t::operator()(const Jmp& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const Packet& u, location_t loc) {
-    create_numeric_refinement(m_registers, mock_interval_t::top(), loc,
-            register_t{R0_RETURN_VALUE});
+    m_registers -= register_t{R0_RETURN_VALUE};
     m_registers.scratch_caller_saved_registers();
 }
 
@@ -641,19 +584,6 @@ void offset_domain_t::do_mem_store(const Mem& b,
     std::optional<refinement_t> rf_info = std::nullopt;
     if (!is_stack_ptr(maybe_basereg_type)) return;
 
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto target_reg = std::get<Reg>(b.value);
-        rf_info = m_registers.find(target_reg.v);
-    }
-    else {
-        symbol_t s = symbol_t::make();
-        expression_t value = expression_t(s, m_registers.get_slacks());
-        rf_info = refinement_t::numeric_refinement(std::move(value));
-        interval_t interval = interval_t{number_t{static_cast<uint64_t>(std::get<Imm>(b.value).v)}};
-        m_registers.insert_slack_value(s, std::move(interval));
-    }
-    if (!rf_info) return;
-
     int offset = b.access.offset;
     int width = b.access.width;
     auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
@@ -662,24 +592,21 @@ void offset_domain_t::do_mem_store(const Mem& b,
     auto store_at = (*basereg_off_singleton + offset).cast_to<uint64_t>();
     auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
     m_stack -= overlapping_cells;
-    m_stack.store(store_at, *rf_info, width);
+
+    // TODO: verify if both cases are correct, as it was changed during refactoring
+    if (std::holds_alternative<Reg>(b.value)) {
+        auto target_reg = std::get<Reg>(b.value);
+        rf_info = m_registers.find(target_reg.v);
+        if (rf_info) m_stack.store(store_at, *rf_info, width);
+    }
+    else {}
 }
 
 void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
-        std::optional<ptr_or_mapfd_t> basereg_type, interval_t &&interval_result, location_t loc) {
+        std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
 
     bool is_stack_p = is_stack_ptr(basereg_type);
     bool is_ctx_p = is_ctx_ptr(basereg_type);
-    bool is_packet_p = is_packet_ptr(basereg_type);
-    bool is_shared_p = is_shared_ptr(basereg_type);
-
-    if (interval_result != interval_t::bottom()) {
-        if (is_ctx_p || is_shared_p || is_packet_p) {
-            create_numeric_refinement(m_registers, std::move(interval_result), loc,
-                    target_register);
-            return;
-        }
-    }
 
     if (!is_stack_p && !is_ctx_p) {
         m_registers -= target_register;
@@ -722,7 +649,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
                 m_registers -= target_register;
                 return;
             }
-            m_registers.insert(target_register, loc, std::move(loaded->first));
+            m_registers.insert(target_register, loc, loaded->first);
         }
     }
     else {
@@ -752,7 +679,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
                 m_registers -= target_register;
                 return;
             }
-            m_registers.insert(target_register, loc, std::move(*loaded));
+            m_registers.insert(target_register, loc, *loaded);
         }
     }
 }
@@ -782,7 +709,7 @@ std::optional<refinement_t> offset_domain_t::find_refinement_info(register_t reg
 }
 
 void offset_domain_t::insert_in_registers(register_t reg, location_t loc, refinement_t rf) {
-    m_registers.insert(reg, loc, std::move(rf));
+    m_registers.insert(reg, loc, rf);
 }
 
 void offset_domain_t::store_in_stack(uint64_t key, refinement_t d, int width) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 3c20ca946..06d8ab9a1 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -17,23 +17,22 @@ class offset_registers_t {
 
     live_registers_t m_cur_register_def;
     std::shared_ptr<global_env_offset_registers_t> m_registers_env;
-    std::shared_ptr<slacks_t> m_slacks;
     bool m_is_bottom = false;
 
     public:
         offset_registers_t() :
-            m_registers_env(std::make_shared<global_env_offset_registers_t>()),
-            m_slacks(std::make_shared<slacks_t>()) {
-            insert(BEGIN_REG, location_t{label_t::entry, 0}, refinement_t::begin(true));
+            m_registers_env(std::make_shared<global_env_offset_registers_t>()) {
+            insert(BEGIN_REG, location_t{label_t::entry, 0},
+                   refinement_t::begin_with_constraints());
         }
-        offset_registers_t(std::shared_ptr<slacks_t> slacks)
-            : m_registers_env(std::make_shared<global_env_offset_registers_t>()), m_slacks(slacks) {}
+        offset_registers_t(std::shared_ptr<global_env_offset_registers_t> env)
+            : m_registers_env(env) {}
         offset_registers_t(const offset_registers_t& other)
-            : m_cur_register_def(other.m_cur_register_def), m_slacks(other.m_slacks),
-            m_is_bottom(other.m_is_bottom) {
+            : m_cur_register_def(other.m_cur_register_def), m_is_bottom(other.m_is_bottom) {
             if (other.m_registers_env) {
                 m_registers_env = std::make_shared<global_env_offset_registers_t>(*other.m_registers_env);
             }
+
         }
         offset_registers_t& operator=(const offset_registers_t& other) {
             if (this != &other) {
@@ -42,7 +41,6 @@ class offset_registers_t {
                 if (other.m_registers_env) {
                     m_registers_env = std::make_shared<global_env_offset_registers_t>(*other.m_registers_env);
                 }
-                m_slacks = other.m_slacks;
             }
             return *this;
         }
@@ -54,10 +52,7 @@ class offset_registers_t {
         void set_to_bottom();
         bool is_bottom() const;
         bool is_top() const;
-        void insert(register_t, const location_t&, refinement_t&&);
-        void insert_slack_value(symbol_t, mock_interval_t);
-        std::shared_ptr<slacks_t> get_slacks() const { return m_slacks; }
-        std::optional<mock_interval_t> find_slack_value(symbol_t) const;
+        void insert(register_t, const location_t&, refinement_t);
         std::optional<refinement_t> find(register_location_t reg) const;
         std::optional<refinement_t> find(register_t key) const;
         friend std::ostream& operator<<(std::ostream& o, const offset_registers_t& p);
@@ -97,7 +92,7 @@ class offset_ctx_t {
     size_t m_size = 0;
 
     public:
-        offset_ctx_t(const ebpf_context_descriptor_t* desc);
+        offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t>);
         std::optional<refinement_t> find(uint64_t) const;
         size_t get_size() const { return m_size; }
         std::vector<uint64_t> get_keys() const;
@@ -106,6 +101,7 @@ class offset_ctx_t {
 class offset_domain_t final {
 
     bool m_is_bottom = false;
+    std::shared_ptr<slacks_t> m_slacks;
     offset_registers_t m_registers;
     offset_stack_t m_stack;
     std::shared_ptr<offset_ctx_t> m_ctx;
@@ -114,10 +110,12 @@ class offset_domain_t final {
   public:
     offset_domain_t() = default;
     offset_domain_t(offset_registers_t reg, offset_stack_t stack,
-            std::shared_ptr<offset_ctx_t> ctx)
-        : m_registers(std::move(reg)), m_stack(std::move(stack)), m_ctx(std::move(ctx)) {}
+            std::shared_ptr<offset_ctx_t> ctx, std::shared_ptr<slacks_t> slacks) :
+        m_slacks(std::move(slacks)), m_registers(std::move(reg)), m_stack(std::move(stack)),
+        m_ctx(ctx) {}
+    offset_domain_t(std::shared_ptr<slacks_t> slacks) : m_slacks(slacks) {}
 
-    static offset_domain_t setup_entry();
+    static offset_domain_t setup_entry(std::shared_ptr<slacks_t>);
     // bottom/top
     static offset_domain_t bottom();
     void set_to_top();
@@ -162,14 +160,10 @@ class offset_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_un(const Un&, interval_t, location_t);
-    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, interval_t&&,
-            location_t);
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
-    void do_bin(const Bin&, const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&,
-            const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&, mock_interval_t&&, location_t);
+    void do_bin(const Bin&, const std::optional<refinement_t>&, const std::optional<refinement_t>&,
+                location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     bool check_packet_access(const Reg&, int, int, bool) const;
     void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 67ce20b06..e5c482519 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -18,6 +18,14 @@ bool refinement_t::is_packet_refinement() const {
     return _type == refinement_type_t::PACKET;
 }
 
+interval_t refinement_t::get_interval_value() const {
+    expression_t e = _value.get_equivalent_expression();
+    if (e.only_has_interval()) {
+        return e.get_constant_term();
+    }
+    return interval_t::bottom();
+}
+
 std::map<symbol_t, mock_interval_t> refinement_t::get_slack_intervals() const {
     std::map<symbol_t, mock_interval_t> slack_intervals = _value.get_slack_intervals();
     if (has_constraints) {
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 697c9b047..375a0fe3c 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -29,8 +29,10 @@ class refinement_t {
         _type(type), _value(value), meta_begin_constraint(constraint_t::get_true()),
         begin_end_constraint(constraint_t::get_true()) {}
  
+    [[nodiscard]] interval_t get_interval_value() const;
     [[nodiscard]] refinement_type_t get_type() const { return _type; }
     [[nodiscard]] expression_t get_value() const { return _value; }
+    [[nodiscard]] expression_t get_equivalent_expression() const;
     refinement_t operator+(int n) const;
     refinement_t operator+(interval_t) const;
     refinement_t operator+(const refinement_t &other) const;
@@ -50,26 +52,38 @@ class refinement_t {
     void add_constraint(constraint_t);
     friend std::ostream &operator<<(std::ostream &, const refinement_t&);
 
-    static refinement_t begin(bool has_constraints = false) {
-        if (has_constraints) {
-            constraint_t meta_begin_constraint = constraint_t::meta_begin_init_constraint();
-            constraint_t begin_end_constraint = constraint_t::begin_end_init_constraint();
-            return refinement_t(refinement_type_t::PACKET, expression_t::begin(),
-                                meta_begin_constraint, begin_end_constraint);
-        }
-        return refinement_t(refinement_type_t::PACKET, expression_t::begin());
+    static refinement_t begin_with_constraints() {
+        constraint_t meta_begin_constraint = constraint_t::meta_begin_init_constraint();
+        constraint_t begin_end_constraint = constraint_t::begin_end_init_constraint();
+        return refinement_t(refinement_type_t::PACKET, expression_t::begin(),
+                            meta_begin_constraint, begin_end_constraint);
     }
 
-    static refinement_t end() {
-        return refinement_t(refinement_type_t::PACKET, expression_t::end());
+    static refinement_t begin(std::shared_ptr<slacks_t> slacks = nullptr) {
+        return refinement_t(refinement_type_t::PACKET, expression_t::begin(slacks));
     }
 
-    static refinement_t meta() {
-        return refinement_t(refinement_type_t::PACKET, expression_t::meta());
+    static refinement_t end(std::shared_ptr<slacks_t> slacks) {
+        return refinement_t(refinement_type_t::PACKET, expression_t::end(slacks));
+    }
+
+    static refinement_t meta(std::shared_ptr<slacks_t> slacks) {
+        return refinement_t(refinement_type_t::PACKET, expression_t::meta(slacks));
     }
 
     static refinement_t numeric_refinement(expression_t value) {
-        return refinement_t(refinement_type_t::NUM, std::move(value));
+        return refinement_t(refinement_type_t::NUM, value);
+    }
+
+    static refinement_t numeric_refinement(interval_t i, std::shared_ptr<slacks_t> slacks) {
+        symbol_t s = symbol_t::make();
+        (*slacks)[s] = i;
+        return numeric_refinement(expression_t(s, slacks));
+    }
+
+    static refinement_t numeric_refinement_top(std::shared_ptr<slacks_t> slacks = nullptr) {
+        // expression_t::top() represents a top interval
+        return numeric_refinement(expression_t::top(slacks));
     }
 };
 
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 782c029fb..f3740b031 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -802,8 +802,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::check_type(const TypeConstraint& s,
-        std::optional<mock_interval_t> interval_opt) {
+void region_domain_t::check_type(const TypeConstraint& s, bool is_numeric) {
     auto ptr_or_mapfd_opt = m_registers.find(s.reg.v);
     if (ptr_or_mapfd_opt) {
         // it is a pointer or mapfd
@@ -843,7 +842,7 @@ void region_domain_t::check_type(const TypeConstraint& s,
             }
         }
     }
-    else if (interval_opt) {
+    else if (is_numeric) {
         if (s.types == TypeGroup::number || s.types == TypeGroup::ptr_or_num
                 || s.types == TypeGroup::mem_or_num)
             return;
@@ -852,8 +851,8 @@ void region_domain_t::check_type(const TypeConstraint& s,
     m_errors.push_back("type constraint assert fail");
 }
 
-void region_domain_t::update_ptr_or_mapfd(ptr_or_mapfd_t&& ptr_or_mapfd, interval_t&& change,
-        const location_t& loc, register_t reg) {
+void region_domain_t::update_ptr_or_mapfd(const ptr_or_mapfd_t& ptr_or_mapfd, const interval_t& change,
+        location_t loc, register_t reg) {
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
         auto offset = ptr_or_mapfd_with_off.get_offset();
@@ -875,14 +874,17 @@ void region_domain_t::operator()(const Bin& b, location_t loc) {
 }
 
 void region_domain_t::do_bin(const Bin& bin,
-        const std::optional<interval_t>& src_signed_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& src_ptr_or_mapfd_opt,
-        const std::optional<interval_t>& dst_signed_interval_opt,
-        const std::optional<ptr_or_mapfd_t>& dst_ptr_or_mapfd_opt, location_t loc) {
+                             const std::optional<interval_t>& dst_signed_interval_opt,
+                             const std::optional<interval_t>& src_signed_interval_opt,
+                             location_t loc) {
 
     auto dst_register = register_t{bin.dst.v};
+    auto dst_ptr_or_mapfd_opt = m_registers.find(dst_register);
+    bool is_numeric_dst = !(dst_ptr_or_mapfd_opt.has_value());
+    bool is_numeric_src = std::holds_alternative<Imm>(bin.v) ||
+        !(find_ptr_or_mapfd_type(register_t{std::get<Reg>(bin.v).v}).has_value());
 
-    if (!dst_ptr_or_mapfd_opt && !src_ptr_or_mapfd_opt) {
+    if (is_numeric_dst && is_numeric_src) {
         m_registers -= dst_register;
         return;
     }
@@ -908,10 +910,8 @@ void region_domain_t::do_bin(const Bin& bin,
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
-                if (dst_ptr_or_mapfd_opt) {
-                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
-                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
-                            std::move(imm_interval), loc, dst_register);
+                if (!is_numeric_dst) {
+                    update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, imm_interval, loc, dst_register);
                 }
                 else {
                     m_registers -= dst_register;
@@ -921,10 +921,8 @@ void region_domain_t::do_bin(const Bin& bin,
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) break;
-                if (dst_ptr_or_mapfd_opt) {
-                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
-                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
-                            -std::move(imm_interval), loc, dst_register);
+                if (!is_numeric_dst) {
+                    update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, -imm_interval, loc, dst_register);
                 }
                 else {
                     m_registers -= dst_register;
@@ -939,13 +937,14 @@ void region_domain_t::do_bin(const Bin& bin,
         }
     }
     else {
+        auto src_register = register_t{std::get<Reg>(bin.v).v};
+        auto src_ptr_or_mapfd_opt = m_registers.find(src_register);
         switch (bin.op) {
             case Op::MOV: {
                 // ra = rb
-                if (src_ptr_or_mapfd_opt) {
-                    auto src_ptr_or_mapfd = std::move(*src_ptr_or_mapfd_opt);
-                    if (is_shared_ptr(src_ptr_or_mapfd)) {
-                        auto shared_ptr = std::get<ptr_with_off_t>(src_ptr_or_mapfd);
+                if (!is_numeric_src) {
+                    if (is_shared_ptr(*src_ptr_or_mapfd_opt)) {
+                        auto shared_ptr = std::get<ptr_with_off_t>(*src_ptr_or_mapfd_opt);
                         set_aliases(dst_register, shared_ptr);
                         m_registers.insert(dst_register, loc, shared_ptr);
                     }
@@ -960,23 +959,15 @@ void region_domain_t::do_bin(const Bin& bin,
             }
             case Op::ADD: {
                 // ra += rb
-                if (dst_ptr_or_mapfd_opt && src_signed_interval_opt) {
-                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
-                    auto src_signed = std::move(*src_signed_interval_opt);
-                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
-                            std::move(src_signed), loc, dst_register);
+                if (!is_numeric_dst && is_numeric_src) {
+                    update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, *src_signed_interval_opt, loc,
+                                        dst_register);
                 }
-                else if (src_ptr_or_mapfd_opt && dst_signed_interval_opt) {
-                    auto src_ptr_or_mapfd = std::move(*src_ptr_or_mapfd_opt);
-                    auto dst_signed = std::move(*dst_signed_interval_opt);
-                    update_ptr_or_mapfd(std::move(src_ptr_or_mapfd),
-                            std::move(dst_signed), loc, dst_register);
+                else if (is_numeric_dst && !is_numeric_src) {
+                    update_ptr_or_mapfd(*src_ptr_or_mapfd_opt, *dst_signed_interval_opt, loc,
+                                        dst_register);
                 }
-                // else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                //     // we do not deal with numbers in region domain
-                //     m_registers -= dst_register;
-                // }
-                else if (dst_ptr_or_mapfd_opt && src_ptr_or_mapfd_opt) {
+                else if (!is_numeric_dst && !is_numeric_src) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
@@ -984,19 +975,13 @@ void region_domain_t::do_bin(const Bin& bin,
             }
             case Op::SUB: {
                 // ra -= rb
-                if (dst_ptr_or_mapfd_opt && src_signed_interval_opt) {
-                    auto dst_ptr_or_mapfd = std::move(*dst_ptr_or_mapfd_opt);
-                    auto src_signed = std::move(*src_signed_interval_opt);
-                    update_ptr_or_mapfd(std::move(dst_ptr_or_mapfd),
-                            -std::move(src_signed), loc, dst_register);
+                if (!is_numeric_dst && is_numeric_src) {
+                    update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, -(*src_signed_interval_opt),
+                                        loc, dst_register);
                 }
-                else if (src_ptr_or_mapfd_opt && dst_signed_interval_opt) {
+                else if (is_numeric_dst && !is_numeric_src) {
                     m_registers -= dst_register;
                 }
-                // else if (dst_signed_interval_opt && src_signed_interval_opt) {
-                //     // we do not deal with numbers in region domain
-                //     m_registers -= dst_register;
-                // }
                 else {
                     // ptr -= ptr
                     // this case already handled in type domain
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 863315630..b963ca0d2 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -107,8 +107,9 @@ class region_domain_t final {
     region_domain_t() = default;
     region_domain_t(region_registers_t registers, region_stack_t stack,
             std::shared_ptr<region_ctx_t> ctx, shared_ptr_aliases_t shared_ptr_aliases = {})
-            : m_stack(std::move(stack)), m_registers(std::move(registers)), m_ctx(std::move(ctx)),
+            : m_stack(std::move(stack)), m_registers(std::move(registers)), m_ctx(ctx),
             m_shared_ptr_aliases(std::move(shared_ptr_aliases)) {}
+
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static region_domain_t setup_entry(bool);
     // bottom/top
@@ -163,19 +164,16 @@ class region_domain_t final {
     interval_t get_map_key_size(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
-    void check_type(const TypeConstraint&, std::optional<mock_interval_t>);
+    void check_type(const TypeConstraint&, bool);
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&);
-    void do_bin(const Bin&, const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&,
-            const std::optional<interval_t>&,
-            const std::optional<ptr_or_mapfd_t>&, location_t);
+    void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
+                location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int);
     void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
-    void update_ptr_or_mapfd(crab::ptr_or_mapfd_t&&, interval_t&&,
-            const crab::location_t&, register_t);
+    void update_ptr_or_mapfd(const ptr_or_mapfd_t&, const interval_t&, location_t, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
     [[nodiscard]] size_t get_ctx_size() const;
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index eea9a6cee..c8905c863 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -30,19 +30,19 @@ void signed_interval_registers_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void signed_interval_registers_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+void signed_interval_registers_t::insert(register_t reg, const location_t& loc, refinement_t rf) {
     auto register_location = register_location_t{reg, loc};
-    (*m_registers_env)[register_location] = mock_interval_t{interval};
+    (*m_registers_env)[register_location] = rf;
     m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> signed_interval_registers_t::find(register_location_t reg) const {
+std::optional<refinement_t> signed_interval_registers_t::find(register_location_t reg) const {
     auto it = m_registers_env->find(reg);
     if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> signed_interval_registers_t::find(register_t key) const {
+std::optional<refinement_t> signed_interval_registers_t::find(register_t key) const {
     if (m_cur_register_def[key] == nullptr) return {};
     const register_location_t& reg = *(m_cur_register_def[key]);
     return find(reg);
@@ -54,25 +54,24 @@ signed_interval_registers_t signed_interval_registers_t::operator|(const signed_
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    signed_interval_registers_t intervals_joined;
+    signed_interval_registers_t refinements_joined;
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_register_def[i]));
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
-            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
-            intervals_joined.insert(register_t{i}, loc,
-                    std::move(interval1 | interval2));
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            refinements_joined.insert(register_t{i}, loc, rf1 | rf2);
         }
     }
-    return intervals_joined;
+    return refinements_joined;
 }
 
 void signed_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
-            insert(register_t{i}, loc, it->to_interval());
+            insert(register_t{i}, loc, it.value());
         }
     }
 }
@@ -82,45 +81,45 @@ void signed_interval_registers_t::operator-=(register_t var) {
     m_cur_register_def[var] = nullptr;
 }
 
-bool stack_slots_signed_state_t::is_bottom() const {
+bool signed_interval_stack_t::is_bottom() const {
     return m_is_bottom;
 }
 
-bool stack_slots_signed_state_t::is_top() const {
+bool signed_interval_stack_t::is_top() const {
     if (m_is_bottom) return false;
     return m_cells.empty();
 }
 
-void stack_slots_signed_state_t::set_to_top() {
+void signed_interval_stack_t::set_to_top() {
     m_cells.clear();
     m_is_bottom = false;
 }
 
-void stack_slots_signed_state_t::set_to_bottom() {
+void signed_interval_stack_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-stack_slots_signed_state_t stack_slots_signed_state_t::top() {
-    return stack_slots_signed_state_t();
+signed_interval_stack_t signed_interval_stack_t::top() {
+    return signed_interval_stack_t();
 }
 
-std::optional<signed_interval_stack_cell_t> stack_slots_signed_state_t::find(uint64_t key) const {
+std::optional<signed_interval_stack_cell_t> signed_interval_stack_t::find(uint64_t key) const {
     auto it = m_cells.find(key);
     if (it == m_cells.end()) return {};
     return it->second;
 }
 
-void stack_slots_signed_state_t::store(uint64_t key, mock_interval_t val, int width) {
+void signed_interval_stack_t::store(uint64_t key, refinement_t val, int width) {
     m_cells[key] = std::make_pair(val, width);
 }
 
-void stack_slots_signed_state_t::operator-=(uint64_t key) {
+void signed_interval_stack_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
         m_cells.erase(key);
 }
 
-bool stack_slots_signed_state_t::all_numeric(uint64_t start_loc, int width) const {
+bool signed_interval_stack_t::all_numeric(uint64_t start_loc, int width) const {
     auto overlapping_cells = find_overlapping_cells(start_loc, width);
     if (overlapping_cells.empty()) return false;
     for (std::size_t i = 0; i < overlapping_cells.size()-1; i++) {
@@ -130,52 +129,56 @@ bool stack_slots_signed_state_t::all_numeric(uint64_t start_loc, int width) cons
     return true;
 }
 
-void stack_slots_signed_state_t::fill_values(const std::vector<uint64_t>& keys,
+void signed_interval_stack_t::fill_values(const std::vector<uint64_t>& keys,
         uint64_t start, int width) {
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (keys[0] < start) {
         auto type = find(keys[0]);
         auto width_key = type.value().second;
-        store(keys[0], interval_t::top(), width_key);
+        store(keys[0], top_rf, width_key);
     }
     if (keys[0] > start) {
-        store(start, interval_t::top(), keys[0]-start);
+        store(start, top_rf, keys[0]-start);
     }
     for (size_t i = 0; i < keys.size()-1; i++) {
         auto type = find(keys[i]);
         auto width_key = type.value().second;
         if (keys[i]+width_key != keys[i+1]) {
-            store(keys[i]+width_key, interval_t::top(), keys[i+1]-(keys[i]+width_key));
+            store(keys[i]+width_key, top_rf, keys[i+1]-(keys[i]+width_key));
         }
     }
     auto type = find(keys[keys.size()-1]);
     auto width_key = type.value().second;
     if (keys[keys.size()-1]+width_key < start+width) {
-        store(keys[keys.size()-1]+width_key, interval_t::top(),
+        store(keys[keys.size()-1]+width_key, top_rf,
                 start+width-(keys[keys.size()-1]+width_key));
     }
     if (keys[keys.size()-1]+width_key > start+width) {
-        store(keys[keys.size()-1], interval_t::top(), width_key);
+        store(keys[keys.size()-1], top_rf, width_key);
     }
 }
 
-void stack_slots_signed_state_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start,
+void signed_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start,
         int width) {
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     for (auto& key : keys) {
         auto type = find(key);
         auto width_key = type.value().second;
         if (key < start) {
             int new_width = start-key;
-            store(key, interval_t::top(), new_width);
+            store(key, top_rf, new_width);
         }
         if (key+width_key > start+width) {
             int new_width = key+width_key-(start+width);
-            store(start+width, interval_t::top(), new_width);
+            store(start+width, top_rf, new_width);
         }
         if (key >= start) *this -= key;
     }
 }
 
-std::vector<uint64_t> stack_slots_signed_state_t::find_overlapping_cells(uint64_t start, int width) const {
+std::vector<uint64_t> signed_interval_stack_t::find_overlapping_cells(uint64_t start, int width) const {
     std::vector<uint64_t> overlapping_cells;
     auto it = m_cells.begin();
     while (it != m_cells.end() && it->first < start) {
@@ -196,68 +199,68 @@ std::vector<uint64_t> stack_slots_signed_state_t::find_overlapping_cells(uint64_
     return overlapping_cells;
 }
 
-static inline void join_stack(const stack_slots_signed_state_t& stack1, uint64_t key1, int& loc1,
-        const stack_slots_signed_state_t& stack2, uint64_t key2, int& loc2,
-        signed_interval_stack_cells_t& interval_values_joined) {
+static inline void join_stack(const signed_interval_stack_t& stack1, uint64_t key1, int& loc1,
+        const signed_interval_stack_t& stack2, uint64_t key2, int& loc2,
+        signed_interval_stack_cells_t& refinements_joined) {
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
-    auto interval1 = cells1.first.to_interval();
-    auto interval2 = cells2.first.to_interval();
-    auto top_interval_mock = mock_interval_t(interval_t::top());
+    refinement_t rf1 = cells1.first;
+    refinement_t rf2 = cells2.first;
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (key1 == key2) {
         if (width1 == width2) {
-            interval_values_joined[key1] = std::make_pair(
-                    mock_interval_t(interval1 | interval2), width1);
+            refinements_joined[key1] = std::make_pair(rf1 | rf2, width1);
             loc1++; loc2++;
         }
         else if (width1 < width2) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            refinements_joined[key1] = std::make_pair(top_rf, width1);
             loc1++;
         }
         else {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
+            refinements_joined[key1] = std::make_pair(top_rf, width2);
             loc2++;
         }
     }
     else if (key1 > key2) {
         if (key2+width2 > key1+width1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            refinements_joined[key1] = std::make_pair(top_rf, width1);
             loc1++;
         }
         else if (key2+width2 > key1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
+            refinements_joined[key1] = std::make_pair(top_rf, key2+width2-key1);
             loc2++;
         }
         else loc2++;
     }
     else {
-        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined);
     }
 }
 
-stack_slots_signed_state_t stack_slots_signed_state_t::operator|(const stack_slots_signed_state_t& other) const {
-    if (is_bottom() || other.is_top()) {
+signed_interval_stack_t signed_interval_stack_t::operator|(const signed_interval_stack_t& other) const {
+    if (is_bottom()) {
         return other;
-    } else if (other.is_bottom() || is_top()) {
+    } else if (other.is_bottom()) {
         return *this;
     }
-    signed_interval_stack_cells_t interval_values_joined;
+    signed_interval_stack_cells_t refinements_joined;
     auto stack1_keys = get_keys();
     auto stack2_keys = other.get_keys();
     int i = 0, j = 0;
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
-        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
+        join_stack(*this, key1, i, other, key2, j, refinements_joined);
     }
-    return stack_slots_signed_state_t(std::move(interval_values_joined));
+    return signed_interval_stack_t(std::move(refinements_joined));
 }
 
-size_t stack_slots_signed_state_t::size() const {
+size_t signed_interval_stack_t::size() const {
     return m_cells.size();
 }
 
-std::vector<uint64_t> stack_slots_signed_state_t::get_keys() const {
+std::vector<uint64_t> signed_interval_stack_t::get_keys() const {
     std::vector<uint64_t> keys;
     keys.reserve(size());
 
@@ -334,24 +337,35 @@ void signed_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t>&
     m_stack.fill_values(overlap, start_loc, width);
 }
 
-std::optional<mock_interval_t> signed_interval_domain_t::find_interval_value(register_t reg) const {
+std::optional<refinement_t> signed_interval_domain_t::find_interval_value(register_t reg) const {
     return m_registers.find(reg);
 }
 
-std::optional<mock_interval_t> signed_interval_domain_t::find_interval_at_loc(
+std::optional<refinement_t> signed_interval_domain_t::find_interval_at_loc(
         const register_location_t reg) const {
     return m_registers.find(reg);
 }
 
 void signed_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
         interval_t interval) {
-    m_registers.insert(reg, loc, interval);
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_registers.insert(reg, loc, rf);
+}
+
+void signed_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
+        refinement_t rf) {
+    m_registers.insert(reg, loc, rf);
 }
 
-void signed_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
+void signed_interval_domain_t::store_in_stack(uint64_t key, refinement_t interval, int width) {
     m_stack.store(key, interval, width);
 }
 
+void signed_interval_domain_t::store_in_stack(uint64_t key, interval_t interval, int width) {
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_stack.store(key, rf, width);
+}
+
 bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
     /* WARNING: The operation is not implemented yet.*/
     return true;
@@ -371,26 +385,29 @@ void signed_interval_domain_t::operator|=(signed_interval_domain_t&& abs) {
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interval_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
+    if (is_bottom()) {
         return other;
     }
-    else if (other.is_bottom() || is_top()) {
+    else if (other.is_bottom()) {
         return *this;
     }
-    return signed_interval_domain_t(m_registers | other.m_registers,
-            m_stack | other.m_stack);
+    return signed_interval_domain_t(
+        m_registers | other.m_registers,
+        m_stack | other.m_stack,
+        m_slacks);
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
+    if (is_bottom()) {
         return std::move(other);
     }
-    else if (other.is_bottom() || is_top()) {
+    else if (other.is_bottom()) {
         return *this;
     }
     return signed_interval_domain_t(
-            m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack));
+        m_registers | std::move(other.m_registers),
+        m_stack | std::move(other.m_stack),
+        std::move(other.m_slacks));
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator&(const signed_interval_domain_t& abs) const {
@@ -421,9 +438,9 @@ string_invariant signed_interval_domain_t::to_set() {
     return string_invariant{};
 }
 
-signed_interval_domain_t signed_interval_domain_t::setup_entry() {
+signed_interval_domain_t signed_interval_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
     return signed_interval_domain_t{signed_interval_registers_t{},
-        stack_slots_signed_state_t::top()};
+        signed_interval_stack_t::top(), slacks};
 }
 
 // Simple truncation function usable with swap_endianness().
@@ -433,19 +450,27 @@ constexpr T truncate(T x) noexcept {
 }
 
 void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
+    // numeric_refinement_top() creates interval_t::top()
+    auto top_rf = refinement_t::numeric_refinement_top(m_slacks);
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                m_registers.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
+                auto interval = interval_t{be_or_le(n->cast_to<int64_t>())};
+                refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+                m_registers.insert(u.dst.v, loc, rf);
                 return;
             }
         }
-        m_registers.insert(u.dst.v, loc, interval_t::top());
+        m_registers.insert(u.dst.v, loc, top_rf);
     };
 
-    auto mock_interval = m_registers.find(u.dst.v);
-    if (!mock_interval) return;
-    interval_t interval = mock_interval->to_interval();
+    auto rf_opt = m_registers.find(u.dst.v);
+    if (!rf_opt) return;
+    auto interval = rf_opt->get_interval_value();
+    if (interval.is_bottom()) {
+        m_registers.insert(u.dst.v, loc, top_rf);
+        return;
+    }
 
     // Swap bytes.  For 64-bit types we need the weights to fit in a
     // signed int64, but for smaller types we don't want sign extension,
@@ -498,6 +523,8 @@ void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
     case Un::Op::SWAP64:
         swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
         break;
+    default: // Un::Op::NEG
+        break;
     }
 }
 
@@ -515,7 +542,7 @@ void signed_interval_domain_t::operator()(const Assume& s, location_t loc) {
 
 bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
     if (auto loaded = m_stack.find(offset)) {
-        m_registers.insert(reg, loc, (*loaded).first.to_interval());
+        m_registers.insert(reg, loc, loaded->first);
         return true;
     }
     return false;
@@ -524,19 +551,18 @@ bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset,
 void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
-        if (auto targetreg_mock_interval = m_registers.find(target_reg.v)) {
-            auto targetreg_type = targetreg_mock_interval->to_interval();
-            m_stack.store(offset, targetreg_type, width);
+        if (auto rf_opt = m_registers.find(target_reg.v)) {
+            m_stack.store(offset, *rf_opt, width);
         }
     }
     else {
         auto imm = (int64_t)std::get<Imm>(b.value).v;
-        auto targetreg_type = interval_t{number_t{imm}};
-        m_stack.store(offset, targetreg_type, width);
+        auto rf = refinement_t::numeric_refinement(interval_t{number_t{imm}}, m_slacks);
+        m_stack.store(offset, rf, width);
     }
 }
 
-void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
+void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
         int width, bool check_stack_all_numeric) {
 
     if (check_stack_all_numeric) {
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index df5df33e6..eeb7bc0a3 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -4,12 +4,12 @@
 #pragma once
 
 #include "array_domain.hpp"
-#include "types.hpp"
+#include "refinement.hpp"
 
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using global_env_signed_registers_t = std::unordered_map<register_location_t, mock_interval_t>;
+using global_env_signed_registers_t = std::unordered_map<register_location_t, refinement_t>;
 
 class signed_interval_registers_t {
 
@@ -42,36 +42,35 @@ class signed_interval_registers_t {
     bool is_top() const;
     void set_to_bottom();
     void set_to_top();
-    void set_registers_to_bottom();
-    std::optional<mock_interval_t> find(register_location_t reg) const;
-    std::optional<mock_interval_t> find(register_t key) const;
-    void insert(register_t, const location_t&, interval_t);
+    std::optional<refinement_t> find(register_location_t reg) const;
+    std::optional<refinement_t> find(register_t key) const;
+    void insert(register_t, const location_t&, refinement_t);
     void operator-=(register_t);
     signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
     void adjust_bb_for_registers(location_t);
 };
 
-using signed_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
+using signed_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
 using signed_interval_stack_cells_t = std::map<uint64_t, signed_interval_stack_cell_t>;
 
-class stack_slots_signed_state_t {
+class signed_interval_stack_t {
 
     signed_interval_stack_cells_t m_cells;
     bool m_is_bottom = false;
 
   public:
-    stack_slots_signed_state_t() = default;
-    stack_slots_signed_state_t(signed_interval_stack_cells_t cells) : m_cells(std::move(cells)) {}
+    signed_interval_stack_t() = default;
+    signed_interval_stack_t(signed_interval_stack_cells_t cells) : m_cells(std::move(cells)) {}
     bool is_bottom() const;
     bool is_top() const;
     void set_to_bottom();
     void set_to_top();
-    static stack_slots_signed_state_t top();
+    static signed_interval_stack_t top();
     std::optional<signed_interval_stack_cell_t> find(uint64_t) const;
-    void store(uint64_t, mock_interval_t, int);
+    void store(uint64_t, refinement_t, int);
     void operator-=(uint64_t);
     bool all_numeric(uint64_t, int) const;
-    stack_slots_signed_state_t operator|(const stack_slots_signed_state_t& other) const;
+    signed_interval_stack_t operator|(const signed_interval_stack_t& other) const;
     [[nodiscard]] std::vector<uint64_t> get_keys() const;
     size_t size() const;
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
@@ -80,19 +79,22 @@ class stack_slots_signed_state_t {
 };
 
 class signed_interval_domain_t final {
+    std::shared_ptr<slacks_t> m_slacks = nullptr;
     signed_interval_registers_t m_registers;
-    stack_slots_signed_state_t m_stack;
+    signed_interval_stack_t m_stack;
     std::vector<std::string> m_errors;
     bool m_is_bottom = false;
 
   public:
 
     signed_interval_domain_t() = default;
+    signed_interval_domain_t(std::shared_ptr<slacks_t> slacks) : m_slacks(slacks) {}
     signed_interval_domain_t(signed_interval_registers_t registers,
-            stack_slots_signed_state_t stack) :
-        m_registers(std::move(registers)), m_stack(std::move(stack)) {}
+            signed_interval_stack_t stack, std::shared_ptr<slacks_t> slacks) :
+        m_slacks(std::move(slacks)), m_registers(std::move(registers)), m_stack(std::move(stack)) {}
+
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static signed_interval_domain_t setup_entry();
+    static signed_interval_domain_t setup_entry(std::shared_ptr<slacks_t>);
     // bottom/top
     static signed_interval_domain_t bottom();
     void set_to_top();
@@ -138,12 +140,14 @@ class signed_interval_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void check_valid_access(const ValidAccess&, interval_t&&, int, bool);
-    std::optional<mock_interval_t> find_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
+    void check_valid_access(const ValidAccess&, interval_t, int, bool);
+    std::optional<refinement_t> find_interval_value(register_t) const;
+    std::optional<refinement_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<signed_interval_stack_cell_t> find_in_stack(uint64_t) const;
+    void insert_in_registers(register_t, location_t, refinement_t);
     void insert_in_registers(register_t, location_t, interval_t);
-    void store_in_stack(uint64_t, mock_interval_t, int);
+    void store_in_stack(uint64_t, refinement_t, int);
+    void store_in_stack(uint64_t, interval_t, int);
     void adjust_bb_for_types(location_t);
     [[nodiscard]] std::vector<uint64_t> get_stack_keys() const;
     bool all_numeric_in_stack(uint64_t, int) const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 19f0030c1..170e5d427 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -59,13 +59,14 @@ void inference_domain_t::operator|=(inference_domain_t&& other) {
 
 inference_domain_t inference_domain_t::operator|(const inference_domain_t& other) const {
     return inference_domain_t(m_region | other.m_region, m_offset | other.m_offset,
-            m_interval | other.m_interval);
+            m_interval | other.m_interval, m_slacks);
 }
 
 inference_domain_t inference_domain_t::operator|(inference_domain_t&& other) const {
     return inference_domain_t(m_region | std::move(other.m_region),
             m_offset | std::move(other.m_offset),
-            m_interval | std::move(other.m_interval));
+            m_interval | std::move(other.m_interval),
+            std::move(other.m_slacks));
 }
 
 inference_domain_t inference_domain_t::operator&(const inference_domain_t& abs) const {
@@ -95,14 +96,13 @@ string_invariant inference_domain_t::to_set() const {
         auto maybe_rf = m_offset.find_refinement_info(register_t{i});
         if (maybe_ptr_or_mapfd.has_value()) {
             std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, std::nullopt, false);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, {}, false);
             result.insert(elem.str());
         }
         auto maybe_signed_interval = m_interval.find_signed_interval_value(register_t{i});
         if (maybe_signed_interval.has_value()) {
             std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf,
-                    maybe_signed_interval, true);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_signed_interval, true);
             result.insert(elem.str());
         }
         auto maybe_unsigned_interval = m_interval.find_unsigned_interval_value(register_t{i});
@@ -124,11 +124,10 @@ string_invariant inference_domain_t::to_set() const {
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             elem << "stack";
             if (rf) {
-                print_non_numeric_memory_cell(elem, k, k+width-1, std::move(ptr_or_mapfd),
-                        std::optional<refinement_t>(rf->first));
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, rf->first);
             }
             else {
-                print_non_numeric_memory_cell(elem, k, k+width-1, std::move(ptr_or_mapfd));
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd);
             }
         }
         result.insert(elem.str());
@@ -142,7 +141,7 @@ string_invariant inference_domain_t::to_set() const {
             auto signed_interval_cells = maybe_interval_cells_signed.value();
             elem << "stack";
             print_numeric_memory_cell(elem, k, k+signed_interval_cells.second,
-                    signed_interval_cells.first.to_interval(), true);
+                    signed_interval_cells.first, true);
             result.insert(elem.str());
         }
         auto maybe_interval_cells_unsigned = m_interval.find_in_stack_unsigned(k);
@@ -151,7 +150,7 @@ string_invariant inference_domain_t::to_set() const {
             auto unsigned_interval_cells = maybe_interval_cells_unsigned.value();
             elem << "stack";
             print_numeric_memory_cell(elem, k, k+unsigned_interval_cells.second,
-                    unsigned_interval_cells.first.to_interval(), false);
+                    unsigned_interval_cells.first, false);
             result.insert(elem.str());
         }
     }
@@ -164,14 +163,8 @@ void inference_domain_t::operator()(const Undefined& u, location_t loc) {
 
 void inference_domain_t::operator()(const Un& u, location_t loc) {
     m_region(u, loc);
+    m_offset(u, loc);
     m_interval(u, loc);
-    // TODO: check if we need to get signed values in any case
-    // TODO: activate this when we deal with offset domain
-    //auto mock_interval_opt = m_interval.find_unsigned_interval_value(u.dst.v);
-    //auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
-    //    : interval_t::bottom();
-    // m_offset.do_un(u, interval, loc);
-    m_offset.do_un(u, interval_t::bottom(), loc);
 }
 
 void inference_domain_t::operator()(const LoadMapFd& u, location_t loc) {
@@ -201,17 +194,18 @@ void inference_domain_t::operator()(const Atomic &u, location_t loc) {
     if (is_bottom()) return;
     std::optional<ptr_or_mapfd_t> base_reg_opt
         = m_region.find_ptr_or_mapfd_type(u.access.basereg.v);
-    std::optional<mock_interval_t> value_reg_opt = m_interval.find_interval_value(u.valreg.v);
+    std::optional<refinement_t> value_reg_opt = m_interval.find_interval_value(u.valreg.v);
     if (!base_reg_opt || !value_reg_opt) return;
     if (is_stack_ptr(base_reg_opt)) {
         if (u.op == Atomic::Op::CMPXCHG) {
             m_region -= register_t{R0_RETURN_VALUE};
             m_offset -= register_t{R0_RETURN_VALUE};
             insert_in_registers_in_interval_domain(register_t{R0_RETURN_VALUE},
-                    loc, interval_t::top());
+                    loc, refinement_t::numeric_refinement_top());
         }
         else if (u.fetch) {
-            insert_in_registers_in_interval_domain(u.valreg.v, loc, interval_t::top());
+            insert_in_registers_in_interval_domain(u.valreg.v, loc,
+                                    refinement_t::numeric_refinement_top());
         }
         return;
     }
@@ -233,7 +227,8 @@ void inference_domain_t::operator()(const Atomic &u, location_t loc) {
         // For now we just havoc the value of R11.
         m_region -= register_t{11};
         m_offset -= register_t{11};
-        insert_in_registers_in_interval_domain(register_t{11}, loc, interval_t::top());
+        insert_in_registers_in_interval_domain(register_t{11}, loc,
+                refinement_t::numeric_refinement_top());
     } else if (u.fetch) {
         // For other FETCH operations, store the original value in the src register.
         (*this)(Mem{.access = u.access, .value = u.valreg, .is_load = true}, loc);
@@ -260,11 +255,11 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
-            auto maybe_width_interval = m_interval.find_signed_interval_value(param.size.v);
-            if (!maybe_ptr_or_mapfd || !maybe_width_interval) continue;
+            auto maybe_width_rf = m_interval.find_signed_interval_value(param.size.v);
+            if (!maybe_ptr_or_mapfd || !maybe_width_rf) continue;
             if (is_stack_ptr(maybe_ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
-                auto width_interval = maybe_width_interval->to_interval();
+                auto width_interval = maybe_width_rf->get_interval_value();
 
                 auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
                 if (!offset_singleton) {
@@ -305,20 +300,30 @@ void inference_domain_t::operator()(const Packet& u, location_t loc) {
     m_interval(u, loc);
 }
 
+static inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
+        const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd2,
+        const std::optional<refinement_t>& interval1,
+        const std::optional<refinement_t>& interval2) {
+    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return false;
+    if (ptr_or_mapfd1 && ptr_or_mapfd2 && same_region(*ptr_or_mapfd1, *ptr_or_mapfd2))
+        return true;
+    if (interval1 && interval2) return true;
+    return false;
+}
+
 void inference_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
     const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
-    const auto& maybe_left_interval = m_interval.find_interval_value(cond.left.v);
-    assert(!maybe_left_type.has_value() || !maybe_left_interval.has_value());
+    const auto& maybe_left_rf = m_interval.find_interval_value(cond.left.v);
+    assert(!maybe_left_type.has_value() || !maybe_left_rf.has_value());
     if (std::holds_alternative<Reg>(cond.right)) {
         const auto& right_reg = std::get<Reg>(cond.right);
         const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
-        const auto& maybe_right_interval = m_interval.find_interval_value(right_reg.v);
-        assert(!maybe_right_type.has_value() || !maybe_right_interval.has_value());
+        const auto& maybe_right_rf = m_interval.find_interval_value(right_reg.v);
+        assert(!maybe_right_type.has_value() || !maybe_right_rf.has_value());
         // TODO: it does not handle for mapfd yet
-        if (same_type(maybe_left_type, maybe_right_type,
-                    maybe_left_interval, maybe_right_interval)) {
-            if (maybe_left_interval) {
+        if (same_type(maybe_left_type, maybe_right_type, maybe_left_rf, maybe_right_rf)) {
+            if (maybe_left_rf) {
                 // both numbers
                 m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v},
                         cond.right, loc);
@@ -351,7 +356,7 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
             // left is  a mapfd
             // TODO: need to work with values
         }
-        else if (maybe_left_interval) {
+        else if (maybe_left_rf) {
             m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v}, cond.right, loc);
         }
     }
@@ -372,7 +377,7 @@ void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
         m_errors.push_back("Only numbers can be used as divisors");
     }
     else if (maybe_num_type_reg.has_value() && !thread_local_options.allow_division_by_zero) {
-        auto num_type_reg = maybe_num_type_reg->to_interval();
+        auto num_type_reg = maybe_num_type_reg->get_interval_value();
         if (interval_t{number_t{0}} <= num_type_reg) {
             m_errors.push_back("Possible division by zero");
         }
@@ -382,19 +387,19 @@ void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
 void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     if (reg_type) {
-        std::optional<mock_interval_t> width_mock_interval;
+        interval_t width_interval = interval_t::bottom();
         if (std::holds_alternative<Reg>(s.width)) {
-            width_mock_interval = m_interval.find_interval_value(std::get<Reg>(s.width).v);
-            if (!width_mock_interval) {
+            auto width_rf = m_interval.find_interval_value(std::get<Reg>(s.width).v);
+            if (!width_rf) {
                 m_errors.push_back("width is unknown for valid access");
                 return;
             }
+            width_interval = width_rf->get_interval_value();
         }
         else {
             auto imm = std::get<Imm>(s.width); 
-            width_mock_interval = mock_interval_t{interval_t{number_t{imm.v}}};
+            width_interval = interval_t{number_t{imm.v}};
         }
-        auto width_interval = width_mock_interval->to_interval();
         if (auto width_number = width_interval.ub().number()) {
             int width = width_number->cast_to<int>();
             m_region.check_valid_access(s, width);
@@ -412,9 +417,9 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
         }
     }
     else {
-        auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
-        if (mock_interval_type) {
-            m_interval.check_valid_access(s, std::move(mock_interval_type->to_interval()));
+        auto rf_type = m_interval.find_interval_value(s.reg.v);
+        if (rf_type) {
+            m_interval.check_valid_access(s, rf_type->get_interval_value());
         }
         else {
             m_errors.push_back("valid access on unknown register");
@@ -424,9 +429,9 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
 
 void inference_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
-    auto mock_interval_type = m_interval.find_interval_value(s.reg.v);
-    assert(!reg_type.has_value() || !mock_interval_type.has_value());
-    m_region.check_type(s, mock_interval_type);
+    auto rf_type = m_interval.find_interval_value(s.reg.v);
+    assert(!reg_type.has_value() || !rf_type.has_value());
+    m_region.check_type(s, rf_type.has_value());
 }
 
 void inference_domain_t::operator()(const Assert& u, location_t loc) {
@@ -494,7 +499,7 @@ void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
     assert(!maybe_ptr_or_mapfd || !maybe_num_type);
 
     if (maybe_num_type) {
-        auto reg_value = maybe_num_type.value();
+        auto reg_value = maybe_num_type->get_interval_value();
         if ((u.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
                 || (!u.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
             return;
@@ -558,38 +563,36 @@ void inference_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
 }
 
 inference_domain_t inference_domain_t::setup_entry(bool init_r1) {
+    std::shared_ptr<slacks_t> slacks = std::make_shared<slacks_t>();
     return inference_domain_t{
         region_domain_t::setup_entry(init_r1),
-        offset_domain_t::setup_entry(),
-        interval_domain_t::setup_entry()
+        offset_domain_t::setup_entry(slacks),
+        interval_domain_t::setup_entry(slacks),
+        slacks
     };
 }
 
 void inference_domain_t::operator()(const Bin& bin, location_t loc) {
     std::optional<ptr_or_mapfd_t> src_ptr_or_mapfd;
-    std::optional<interval_t> src_signed_interval, src_unsigned_interval;
+    std::optional<refinement_t> src_signed_rf;
+    std::optional<interval_t> dst_signed_interval, src_signed_interval;
 
+    auto dst_register = register_t{bin.dst.v};
     if (std::holds_alternative<Reg>(bin.v)) {
         Reg r = std::get<Reg>(bin.v);
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
-        if (auto src_mock_signed_interval = m_interval.find_signed_interval_value(r.v)) {
-            src_signed_interval = src_mock_signed_interval->to_interval();
-        }
-        if (auto src_mock_unsigned_interval = m_interval.find_unsigned_interval_value(r.v)) {
-            src_unsigned_interval = src_mock_unsigned_interval->to_interval();
+        src_signed_rf = m_interval.find_signed_interval_value(r.v);
+        if (src_signed_rf) {
+            src_signed_interval = src_signed_rf->get_interval_value();
         }
     }
-    auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(bin.dst.v);
-    std::optional<interval_t> dst_signed_interval, dst_unsigned_interval;
-    if (auto dst_mock_signed_interval = m_interval.find_signed_interval_value(bin.dst.v)) {
-        dst_signed_interval = dst_mock_signed_interval->to_interval();
-    }
-    if (auto dst_mock_unsigned_interval = m_interval.find_unsigned_interval_value(bin.dst.v)) {
-        dst_unsigned_interval = dst_mock_unsigned_interval->to_interval();
+    auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(dst_register);
+    auto dst_signed_rf = m_interval.find_signed_interval_value(dst_register);
+    if (dst_signed_rf) {
+        dst_signed_interval = dst_signed_rf->get_interval_value();
     }
 
-    auto dst_register = register_t{bin.dst.v};
-    interval_t subtracted = interval_t::bottom();
+    std::optional<interval_t> subtracted;
     using Op = Bin::Op;
     // ptr -= ptr
     if (std::holds_alternative<Reg>(bin.v) && bin.op == Op::SUB) {
@@ -622,16 +625,9 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
         }
     }
 
-    m_interval.do_bin(bin, src_signed_interval, src_unsigned_interval, src_ptr_or_mapfd,
-            dst_signed_interval, dst_unsigned_interval, dst_ptr_or_mapfd, subtracted, loc);
-    m_region.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
-            dst_signed_interval, dst_ptr_or_mapfd, loc);
-
-    auto mock_interval_result = m_interval.find_signed_interval_value(dst_register);
-    auto interval_result = std::move(mock_interval_result ? *mock_interval_result
-        : mock_interval_t::top());
-    m_offset.do_bin(bin, src_signed_interval, src_ptr_or_mapfd,
-            dst_signed_interval, dst_ptr_or_mapfd, std::move(interval_result), loc);
+    m_interval.do_bin(bin, subtracted, loc);
+    m_region.do_bin(bin, dst_signed_interval, src_signed_interval, loc);
+    m_offset.do_bin(bin, dst_signed_rf, src_signed_rf, loc);
 }
 
 void inference_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
@@ -640,10 +636,7 @@ void inference_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unkno
     // TODO: replace with a bool value returned from region do_load
     auto load_in_region = m_region.find_ptr_or_mapfd_type(target_reg.v).has_value();
     m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, load_in_region, loc);
-    auto mock_interval_opt = m_interval.find_unsigned_interval_value(target_reg.v);
-    auto interval = mock_interval_opt ? mock_interval_opt->to_interval()
-        : interval_t::bottom();
-    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, std::move(interval), loc);
+    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
 }
 
 void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
@@ -714,7 +707,7 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto interval_cells = maybe_signed_interval_cells.value();
             o << "\t\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first.to_interval(), true);
+                    interval_cells.first, true);
             o << ",\n";
         }
         auto maybe_unsigned_interval_cells = m_interval.find_in_stack_unsigned(k);
@@ -722,7 +715,7 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto interval_cells = maybe_unsigned_interval_cells.value();
             o << "\t\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first.to_interval(), false);
+                    interval_cells.first, false);
             o << ",\n";
         }
     }
@@ -768,12 +761,12 @@ inference_domain_t::find_refinement_at_loc(const crab::register_location_t& loc)
     return m_offset.find_refinement_at_loc(loc);
 }
 
-std::optional<crab::mock_interval_t>
+std::optional<crab::refinement_t>
 inference_domain_t::find_signed_interval_at_loc(const crab::register_location_t& loc) const {
     return m_interval.find_signed_interval_at_loc(loc);
 }
 
-std::optional<crab::mock_interval_t>
+std::optional<crab::refinement_t>
 inference_domain_t::find_unsigned_interval_at_loc(const crab::register_location_t& loc) const {
     return m_interval.find_unsigned_interval_at_loc(loc);
 }
@@ -792,36 +785,36 @@ static inline region_t string_to_region(const std::string& s) {
 }
 
 void inference_domain_t::insert_in_registers_in_interval_domain(register_t r, location_t loc,
-        interval_t interval) {
-    m_interval.insert_in_registers(r, loc, interval);
+                                                            refinement_t rf) {
+    m_interval.insert_in_registers(r, loc, rf);
 }
 
-void inference_domain_t::insert_in_registers_in_signed_interval_domain(register_t r, location_t loc,
-        interval_t interval) {
-    m_interval.insert_in_registers_signed(r, loc, interval);
+void inference_domain_t::insert_in_registers_in_signed_interval_domain(register_t r,
+                                                            location_t loc, refinement_t rf) {
+    m_interval.insert_in_registers_signed(r, loc, rf);
 }
 
-void inference_domain_t::insert_in_registers_in_unsigned_interval_domain(register_t r, location_t loc,
-        interval_t interval) {
-    m_interval.insert_in_registers_unsigned(r, loc, interval);
+void inference_domain_t::insert_in_registers_in_unsigned_interval_domain(register_t r,
+                                                            location_t loc, refinement_t rf) {
+    m_interval.insert_in_registers_unsigned(r, loc, rf);
 }
 
-void inference_domain_t::store_in_stack_in_interval_domain(uint64_t key, mock_interval_t p, int width) {
+void inference_domain_t::store_in_stack_in_interval_domain(uint64_t key, refinement_t p, int width) {
     m_interval.store_in_stack(key, p, width);
 }
 
-void inference_domain_t::store_in_stack_in_signed_interval_domain(uint64_t key, mock_interval_t p,
-        int width) {
+void inference_domain_t::store_in_stack_in_signed_interval_domain(uint64_t key, refinement_t p,
+                                                            int width) {
     m_interval.store_in_stack_signed(key, p, width);
 }
 
-void inference_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, mock_interval_t p,
-        int width) {
+void inference_domain_t::store_in_stack_in_unsigned_interval_domain(uint64_t key, refinement_t p,
+                                                            int width) {
     m_interval.store_in_stack_unsigned(key, p, width);
 }
 
 void inference_domain_t::insert_in_registers_in_offset_domain(register_t r, location_t loc,
-        refinement_t d) {
+                                                             refinement_t d) {
     m_offset.insert_in_registers(r, loc, d);
 }
 
@@ -830,7 +823,7 @@ void inference_domain_t::store_in_stack_in_offset_domain(uint64_t key, refinemen
 }
 
 void inference_domain_t::insert_in_registers_in_region_domain(register_t r, location_t loc,
-        const ptr_or_mapfd_t& p) {
+                                                             const ptr_or_mapfd_t& p) {
     m_region.insert_in_registers(r, loc, p);
 }
 
@@ -839,7 +832,7 @@ void inference_domain_t::store_in_stack_in_region_domain(uint64_t key, ptr_or_ma
 }
 
 inference_domain_t inference_domain_t::from_predefined_types(const std::set<std::string>& types,
-        bool setup_constraints) {
+                                                             bool setup_constraints) {
     // TODO: redo the method according to the new offset domain
     // also, need to store the intervals in the offset domain
     using std::regex;
@@ -922,6 +915,7 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
     };
     */
 
+    // TODO: Incomplete implementation, needs work
     inference_domain_t typ;
     if (setup_constraints) {
         typ = inference_domain_t::setup_entry(false);
@@ -954,12 +948,12 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
         else if (regex_match(t, m, regex(REG ":" SNUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto num = create_interval(m[2], m[3]).to_interval();
-            typ.insert_in_registers_in_signed_interval_domain(reg, loc, num);
+            //typ.insert_in_registers_in_signed_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" UNUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
             auto num = create_interval(m[2], m[3]).to_interval();
-            typ.insert_in_registers_in_unsigned_interval_domain(reg, loc, num);
+            //typ.insert_in_registers_in_unsigned_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" MAPFD))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
@@ -995,15 +989,15 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
             auto stack_cell_end = std::stoi(m[2]);
             auto num = create_interval(m[3], m[4]);
-            typ.store_in_stack_in_signed_interval_domain(stack_cell_start, num,
-                    stack_cell_end-stack_cell_start);
+            //typ.store_in_stack_in_signed_interval_domain(stack_cell_start, num,
+            //        stack_cell_end-stack_cell_start);
         }
         else if (regex_match(t, m, regex(STACK_CELL ":" UNUMBER))) {
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
             auto stack_cell_end = std::stoi(m[2]);
             auto num = create_interval(m[3], m[4]);
-            typ.store_in_stack_in_unsigned_interval_domain(stack_cell_start, num,
-                    stack_cell_end-stack_cell_start);
+            //typ.store_in_stack_in_unsigned_interval_domain(stack_cell_start, num,
+            //        stack_cell_end-stack_cell_start);
         }
         else if (regex_match(t, m, regex(STACK_CELL ":" MAPFD))) {
             auto stack_cell_start = static_cast<uint64_t>(std::stoul(m[1]));
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 8ec392730..85d67ce54 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -11,6 +11,7 @@
 namespace crab {
 
 class inference_domain_t final {
+    std::shared_ptr<slacks_t> m_slacks;
     region_domain_t m_region;
     offset_domain_t m_offset;
     interval_domain_t m_interval;
@@ -18,10 +19,37 @@ class inference_domain_t final {
 
   public:
 
-    inference_domain_t() = default;
+    inference_domain_t() : m_slacks(std::make_shared<slacks_t>()),
+        m_region(), m_offset(m_slacks), m_interval(m_slacks) {}
     inference_domain_t(region_domain_t region, offset_domain_t offset,
-            interval_domain_t interval) :
-        m_region(std::move(region)), m_offset(std::move(offset)), m_interval(std::move(interval)) {}
+            interval_domain_t interval, std::shared_ptr<slacks_t> slacks) :
+        m_slacks(std::move(slacks)), m_region(std::move(region)), m_offset(std::move(offset)),
+        m_interval(std::move(interval)) {}
+    inference_domain_t(const inference_domain_t& other) :
+        m_slacks(other.m_slacks), m_region(other.m_region), m_offset(other.m_offset),
+        m_interval(other.m_interval) {}
+    inference_domain_t(inference_domain_t&& other) :
+        m_slacks(std::move(other.m_slacks)), m_region(std::move(other.m_region)),
+        m_offset(std::move(other.m_offset)), m_interval(std::move(other.m_interval)) {}
+    inference_domain_t& operator=(const inference_domain_t& other) {
+        if (this != &other) {
+            m_slacks = other.m_slacks;
+            m_region = other.m_region;
+            m_offset = other.m_offset;
+            m_interval = other.m_interval;
+        }
+        return *this;
+    }
+    inference_domain_t& operator=(inference_domain_t&& other) {
+        if (this != &other) {
+            m_slacks = std::move(other.m_slacks);
+            m_region = std::move(other.m_region);
+            m_offset = std::move(other.m_offset);
+            m_interval = std::move(other.m_interval);
+        }
+        return *this;
+    }
+
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
     static inference_domain_t setup_entry(bool);
     // bottom/top
@@ -84,17 +112,17 @@ class inference_domain_t final {
     void print_annotated_bb(std::ostream&, const basic_block_t&) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     std::optional<crab::refinement_t> find_refinement_at_loc(const crab::register_location_t&) const;
-    std::optional<crab::mock_interval_t> find_signed_interval_at_loc(const crab::register_location_t&) const;
-    std::optional<crab::mock_interval_t> find_unsigned_interval_at_loc(const crab::register_location_t&) const;
+    std::optional<crab::refinement_t> find_signed_interval_at_loc(const crab::register_location_t&) const;
+    std::optional<crab::refinement_t> find_unsigned_interval_at_loc(const crab::register_location_t&) const;
     static inference_domain_t from_predefined_types(const std::set<std::string>&, bool);
     void insert_in_registers_in_region_domain(register_t, location_t, const ptr_or_mapfd_t&);
     void store_in_stack_in_region_domain(uint64_t, ptr_or_mapfd_t, int);
-    void insert_in_registers_in_interval_domain(register_t, location_t, interval_t);
-    void insert_in_registers_in_signed_interval_domain(register_t, location_t, interval_t);
-    void insert_in_registers_in_unsigned_interval_domain(register_t, location_t, interval_t);
-    void store_in_stack_in_interval_domain(uint64_t, mock_interval_t, int);
-    void store_in_stack_in_signed_interval_domain(uint64_t, mock_interval_t, int);
-    void store_in_stack_in_unsigned_interval_domain(uint64_t, mock_interval_t, int);
+    void insert_in_registers_in_interval_domain(register_t, location_t, refinement_t);
+    void insert_in_registers_in_signed_interval_domain(register_t, location_t, refinement_t);
+    void insert_in_registers_in_unsigned_interval_domain(register_t, location_t, refinement_t);
+    void store_in_stack_in_interval_domain(uint64_t, refinement_t, int);
+    void store_in_stack_in_signed_interval_domain(uint64_t, refinement_t, int);
+    void store_in_stack_in_unsigned_interval_domain(uint64_t, refinement_t, int);
     void insert_in_registers_in_offset_domain(register_t, location_t, refinement_t);
     void store_in_stack_in_offset_domain(uint64_t, refinement_t, int);
 
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index ca02ef1e3..21c91299e 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -4,7 +4,7 @@
 #include "crab/type_ostream.hpp"
 
 void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
-        crab::ptr_or_mapfd_t&& ptr, std::optional<crab::refinement_t> d) {
+        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
     }
@@ -21,9 +21,10 @@ void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
     }
 }
 
-void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::interval_t n,
+void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::refinement_t n,
         bool is_signed) {
-    if (n.is_top()) {
+    crab::interval_t i = n.get_interval_value();
+    if (i.is_top()) {
         if (is_signed) {
             o << "[" << start << "-" << end << "] : snumber";
         }
@@ -32,38 +33,23 @@ void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::interv
         }
     }
     else {
-        if (auto n_singleton = n.singleton()) {
-            if (is_signed) {
-                o << "[" << start << "-" << end << "] : snumber<" << *n_singleton << ">";
-            }
-            else {
-                o << "[" << start << "-" << end << "] : unumber<" << *n_singleton << ">";
-            }
-        }
-        else {
-            if (is_signed) {
-                o << "[" << start << "-" << end << "] : snumber<" << n << ">";
-            }
-            else {
-                o << "[" << start << "-" << end << "] : unumber<" << n << ">";
-            }
-        }
+        // TODO: differentiate between signed and unsigned
+        o << "[" << start << "-" << end << "] : " << n;
     }
 }
 
 void print_memory_cell(std::ostream& o, int start, int end,
         const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t> d
-        , std::optional<crab::mock_interval_t> signed_interval,
-        std::optional<crab::mock_interval_t> unsigned_interval) {
-    if (signed_interval) {
-        print_numeric_memory_cell(o, start, end, signed_interval->to_interval(), true);
+        , std::optional<crab::refinement_t> signed_numeric,
+        std::optional<crab::refinement_t> unsigned_numeric) {
+    if (signed_numeric) {
+        print_numeric_memory_cell(o, start, end, *signed_numeric, true);
     }
-    if (unsigned_interval) {
-        print_numeric_memory_cell(o, start, end, unsigned_interval->to_interval(), false);
+    if (unsigned_numeric) {
+        print_numeric_memory_cell(o, start, end, *unsigned_numeric, false);
     }
     else if (p) {
-        crab::ptr_or_mapfd_t ptr = *p;
-        print_non_numeric_memory_cell(o, start, end, std::move(ptr), d);
+        print_non_numeric_memory_cell(o, start, end, *p, d);
     }
 }
 
@@ -85,8 +71,9 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
     }
 }
 
-void print_numeric_register(std::ostream& o, Reg r, crab::interval_t n, bool is_signed) {
-    if (n.is_top()) {
+void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool is_signed) {
+    crab::interval_t i = n.get_interval_value();
+    if (i.is_top()) {
         if (is_signed) {
             o << r << " : snumber";
         }
@@ -95,53 +82,32 @@ void print_numeric_register(std::ostream& o, Reg r, crab::interval_t n, bool is_
         }
     }
     else {
-        if (auto n_singleton = n.singleton()) {
-            if (is_signed) {
-                o << r << " : snumber<" << *n_singleton << ">";
-            }
-            else {
-                o << r << " : unumber<" << *n_singleton << ">";
-            }
-        }
-        else {
-            if (is_signed) {
-                o << r << " : snumber<" << n << ">";
-            }
-            else {
-                o << r << " : unumber<" << n << ">";
-            }
-        }
+        o << r << " : " << n;
     }
 }
 
 void print_register(std::ostream& o, Reg r, const std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t> d, std::optional<crab::mock_interval_t> interval,
+        const std::optional<crab::refinement_t>& d, const std::optional<crab::refinement_t>& numeric,
         bool is_signed) {
-    if (interval) print_numeric_register(o, r, interval->to_interval(), is_signed);
+    if (numeric) print_numeric_register(o, r, *numeric, is_signed);
     else if (p) print_non_numeric_register(o, r, *p, d);
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
 void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t>& d,
-        std::optional<crab::mock_interval_t>& n, bool is_signed) {
+        std::optional<crab::refinement_t>& n, bool is_signed) {
     o << "  ";
     print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, d, n, is_signed);
     o << " = " << call.name << ":" << call.func << "(...)\n";
-    if (d) {
-        o << "  " << *d << "\n";
-    }
 }
 
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t>& d, std::optional<crab::mock_interval_t>& n,
+        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n,
         bool is_signed) {
     o << "  ";
     print_register(o, b.dst, p, d, n, is_signed);
     o << " " << b.op << "= " << b.v << "\n";
-    if (d) {
-        o << "  " << *d << "\n";
-    }
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
@@ -151,7 +117,7 @@ void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::pt
 }
 
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t>& d, std::optional<crab::mock_interval_t>& n, bool is_signed) {
+        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n, bool is_signed) {
     o << "  ";
     print_register(o, std::get<Reg>(b.value), p, d, n, is_signed);
     o << " = ";
@@ -159,9 +125,6 @@ void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_m
     int offset = std::abs(b.access.offset);
     o << "*(" << size_(b.access.width) << " *)";
     o << "(" << b.access.basereg << sign << offset << ")\n";
-    if (d) {
-        o << "  " << *d << "\n";
-    }
 }
 
 std::string op(Un::Op op) {
@@ -185,7 +148,7 @@ std::string op(Un::Op op) {
     }
 }
 
-void print_annotated(std::ostream& o, const Un& b, std::optional<crab::mock_interval_t>& n,
+void print_annotated(std::ostream& o, const Un& b, std::optional<crab::refinement_t>& n,
         bool is_signed) {
     o << "  ";
     print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed);
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 8531120ac..30803b702 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -5,25 +5,25 @@
 
 #include "crab/offset_domain.hpp"
 
-void print_numeric_register(std::ostream&, Reg, crab::interval_t, bool);
-void print_numeric_memory_cell(std::ostream&, int, int, crab::interval_t, bool);
+void print_numeric_register(std::ostream&, Reg, crab::refinement_t, bool);
+void print_numeric_memory_cell(std::ostream&, int, int, crab::refinement_t, bool);
 void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t> = std::nullopt);
-void print_non_numeric_memory_cell(std::ostream&, int, int, crab::ptr_or_mapfd_t&& ptr,
+void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t> = std::nullopt);
 void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>, std::optional<crab::mock_interval_t>, bool);
+        const std::optional<crab::refinement_t>&, const std::optional<crab::refinement_t>&, bool);
 void print_memory_cell(std::ostream&, int, int, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>, std::optional<crab::mock_interval_t>);
+        std::optional<crab::refinement_t>, std::optional<crab::refinement_t>);
 
 // Print select transformers
 void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
 void print_annotated(std::ostream&, const Bin&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
 void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or_mapfd_t>&);
 void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::mock_interval_t>&, bool);
-void print_annotated(std::ostream&, const Un&, std::optional<crab::mock_interval_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
+void print_annotated(std::ostream&, const Un&, std::optional<crab::refinement_t>&, bool);
 void print_bb(std::ostream&, const basic_block_t&);
 void print_instr(std::ostream&, const Instruction&);
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index 7a024943d..cd52b1c6a 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -168,17 +168,6 @@ inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
             && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_SHARED);
 }
 
-inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
-        const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd2,
-        const std::optional<mock_interval_t>& interval1,
-        const std::optional<mock_interval_t>& interval2) {
-    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return false;
-    if (ptr_or_mapfd1 && ptr_or_mapfd2 && same_region(*ptr_or_mapfd1, *ptr_or_mapfd2))
-        return true;
-    if (interval1 && interval2) return true;
-    return false;
-}
-
 using stack_cells_t = std::vector<std::pair<uint64_t, int>>;
 
 } // namespace crab
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 316f55340..4ee59872f 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -30,19 +30,19 @@ void unsigned_interval_registers_t::set_to_bottom() {
     m_is_bottom = true;
 }
 
-void unsigned_interval_registers_t::insert(register_t reg, const location_t& loc, interval_t interval) {
+void unsigned_interval_registers_t::insert(register_t reg, const location_t& loc, refinement_t rf) {
     auto register_location = register_location_t{reg, loc};
-    (*m_registers_env)[register_location] = mock_interval_t{interval};
+    (*m_registers_env)[register_location] = rf;
     m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
-std::optional<mock_interval_t> unsigned_interval_registers_t::find(register_location_t reg) const {
+std::optional<refinement_t> unsigned_interval_registers_t::find(register_location_t reg) const {
     auto it = m_registers_env->find(reg);
     if (it == m_registers_env->end()) return {};
     return it->second;
 }
 
-std::optional<mock_interval_t> unsigned_interval_registers_t::find(register_t key) const {
+std::optional<refinement_t> unsigned_interval_registers_t::find(register_t key) const {
     if (m_cur_register_def[key] == nullptr) return {};
     const register_location_t& reg = *(m_cur_register_def[key]);
     return find(reg);
@@ -54,25 +54,24 @@ unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const uns
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    unsigned_interval_registers_t intervals_joined;
+    unsigned_interval_registers_t refinements_joined;
     location_t loc = location_t::top();
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
         auto it1 = find(*(m_cur_register_def[i]));
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
-            auto interval1 = it1->to_interval(), interval2 = it2->to_interval();
-            intervals_joined.insert(register_t{i}, loc,
-                    std::move(interval1 | interval2));
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            refinements_joined.insert(register_t{i}, loc, rf1 | rf2);
         }
     }
-    return intervals_joined;
+    return refinements_joined;
 }
 
 void unsigned_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
-            insert(register_t{i}, loc, it->to_interval());
+            insert(register_t{i}, loc, it.value());
         }
     }
 }
@@ -110,7 +109,7 @@ std::optional<unsigned_interval_stack_cell_t> unsigned_interval_stack_t::find(ui
     return it->second;
 }
 
-void unsigned_interval_stack_t::store(uint64_t key, mock_interval_t val, int width) {
+void unsigned_interval_stack_t::store(uint64_t key, refinement_t val, int width) {
     m_cells[key] = std::make_pair(val, width);
 }
 
@@ -122,43 +121,48 @@ void unsigned_interval_stack_t::operator-=(uint64_t key) {
 
 void unsigned_interval_stack_t::fill_values(const std::vector<uint64_t>& keys,
         uint64_t start, int width) {
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (keys[0] < start) {
         auto type = find(keys[0]);
         auto width_key = type.value().second;
-        store(keys[0], interval_t::top(), width_key);
+        store(keys[0], top_rf, width_key);
     }
     if (keys[0] > start) {
-        store(start, interval_t::top(), keys[0]-start);
+        store(start, top_rf, keys[0]-start);
     }
     for (size_t i = 0; i < keys.size()-1; i++) {
         auto type = find(keys[i]);
         auto width_key = type.value().second;
         if (keys[i]+width_key != keys[i+1]) {
-            store(keys[i]+width_key, interval_t::top(), keys[i+1]-(keys[i]+width_key));
+            store(keys[i]+width_key, top_rf, keys[i+1]-(keys[i]+width_key));
         }
     }
     auto type = find(keys[keys.size()-1]);
     auto width_key = type.value().second;
     if (keys[keys.size()-1]+width_key < start+width) {
-        store(keys[keys.size()-1]+width_key, interval_t::top(),
+        store(keys[keys.size()-1]+width_key, top_rf,
                 start+width-(keys[keys.size()-1]+width_key));
     }
     if (keys[keys.size()-1]+width_key > start+width) {
-        store(keys[keys.size()-1], interval_t::top(), width_key);
+        store(keys[keys.size()-1], top_rf, width_key);
     }
 }
 
-void unsigned_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start, int width) {
+void unsigned_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys, uint64_t start,
+        int width) {
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     for (auto& key : keys) {
         auto type = find(key);
         auto width_key = type.value().second;
         if (key < start) {
             int new_width = start-key;
-            store(key, interval_t::top(), new_width);
+            store(key, top_rf, new_width);
         }
         if (key+width_key > start+width) {
             int new_width = key+width_key-(start+width);
-            store(start+width, interval_t::top(), new_width);
+            store(start+width, top_rf, new_width);
         }
         if (key >= start) *this -= key;
     }
@@ -166,59 +170,59 @@ void unsigned_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys
 
 static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t key1, int& loc1,
         const unsigned_interval_stack_t& stack2, uint64_t key2, int& loc2,
-        unsigned_interval_stack_cells_t& interval_values_joined) {
+        unsigned_interval_stack_cells_t& refinements_joined) {
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
-    auto interval1 = cells1.first.to_interval();
-    auto interval2 = cells2.first.to_interval();
-    auto top_interval_mock = mock_interval_t(interval_t::top());
+    refinement_t rf1 = cells1.first;
+    refinement_t rf2 = cells2.first;
+    // numeric_refinement_top() creates interval_t::top()
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (key1 == key2) {
         if (width1 == width2) {
-            interval_values_joined[key1] = std::make_pair(
-                    mock_interval_t(interval1 | interval2), width1);
+            refinements_joined[key1] = std::make_pair(rf1 | rf2, width1);
             loc1++; loc2++;
         }
         else if (width1 < width2) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            refinements_joined[key1] = std::make_pair(top_rf, width1);
             loc1++;
         }
         else {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width2);
+            refinements_joined[key1] = std::make_pair(top_rf, width2);
             loc2++;
         }
     }
     else if (key1 > key2) {
         if (key2+width2 > key1+width1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, width1);
+            refinements_joined[key1] = std::make_pair(top_rf, width1);
             loc1++;
         }
         else if (key2+width2 > key1) {
-            interval_values_joined[key1] = std::make_pair(top_interval_mock, key2+width2-key1);
+            refinements_joined[key1] = std::make_pair(top_rf, key2+width2-key1);
             loc2++;
         }
         else loc2++;
     }
     else {
-        join_stack(stack2, key2, loc2, stack1, key1, loc1, interval_values_joined);
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined);
     }
 }
 
 unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_interval_stack_t& other) const {
-    if (is_bottom() || other.is_top()) {
+    if (is_bottom()) {
         return other;
-    } else if (other.is_bottom() || is_top()) {
+    } else if (other.is_bottom()) {
         return *this;
     }
-    unsigned_interval_stack_cells_t interval_values_joined;
+    unsigned_interval_stack_cells_t refinements_joined;
     auto stack1_keys = get_keys();
     auto stack2_keys = other.get_keys();
     int i = 0, j = 0;
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
-        join_stack(*this, key1, i, other, key2, j, interval_values_joined);
+        join_stack(*this, key1, i, other, key2, j, refinements_joined);
     }
-    return unsigned_interval_stack_t(std::move(interval_values_joined));
+    return unsigned_interval_stack_t(std::move(refinements_joined));
 }
 
 size_t unsigned_interval_stack_t::size() const {
@@ -288,22 +292,33 @@ void unsigned_interval_domain_t::fill_values_in_stack(const std::vector<uint64_t
     m_stack.fill_values(overlap, start_loc, width);
 }
 
-std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_value(register_t reg) const {
+std::optional<refinement_t> unsigned_interval_domain_t::find_interval_value(register_t reg) const {
     return m_registers.find(reg);
 }
 
-std::optional<mock_interval_t> unsigned_interval_domain_t::find_interval_at_loc(
+std::optional<refinement_t> unsigned_interval_domain_t::find_interval_at_loc(
         const register_location_t reg) const {
     return m_registers.find(reg);
 }
 
 void unsigned_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
         interval_t interval) {
-    m_registers.insert(reg, loc, interval);
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_registers.insert(reg, loc, rf);
 }
 
-void unsigned_interval_domain_t::store_in_stack(uint64_t key, mock_interval_t interval, int width) {
-    m_stack.store(key, interval, width);
+void unsigned_interval_domain_t::insert_in_registers(register_t reg, location_t loc,
+        refinement_t rf) {
+    m_registers.insert(reg, loc, rf);
+}
+
+void unsigned_interval_domain_t::store_in_stack(uint64_t key, refinement_t rf, int width) {
+    m_stack.store(key, rf, width);
+}
+
+void unsigned_interval_domain_t::store_in_stack(uint64_t key, interval_t interval, int width) {
+    refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+    m_stack.store(key, rf, width);
 }
 
 bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
@@ -325,26 +340,29 @@ void unsigned_interval_domain_t::operator|=(unsigned_interval_domain_t&& abs) {
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_interval_domain_t& other) const {
-    if (is_bottom() || other.is_top()) {
+    if (is_bottom()) {
         return other;
     }
-    else if (other.is_bottom() || is_top()) {
+    else if (other.is_bottom()) {
         return *this;
     }
-    return unsigned_interval_domain_t(m_registers | other.m_registers,
-            m_stack | other.m_stack);
+    return unsigned_interval_domain_t(
+        m_registers | other.m_registers,
+        m_stack | other.m_stack,
+        m_slacks);
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interval_domain_t&& other) const {
-    if (is_bottom() || other.is_top()) {
+    if (is_bottom()) {
         return std::move(other);
     }
-    else if (other.is_bottom() || is_top()) {
+    else if (other.is_bottom()) {
         return *this;
     }
     return unsigned_interval_domain_t(
             m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack));
+            m_stack | std::move(other.m_stack),
+            std::move(m_slacks));
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator&(const unsigned_interval_domain_t& abs) const {
@@ -377,9 +395,9 @@ string_invariant unsigned_interval_domain_t::to_set() {
     return string_invariant{};
 }
 
-unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry() {
+unsigned_interval_domain_t unsigned_interval_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
     return unsigned_interval_domain_t{unsigned_interval_registers_t{},
-                                      unsigned_interval_stack_t::top()};
+                                      unsigned_interval_stack_t::top(), slacks};
 }
 
 // Simple truncation function usable with swap_endianness().
@@ -389,19 +407,27 @@ constexpr T truncate(T x) noexcept {
 }
 
 void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
+    // numeric_refinement_top() creates interval_t::top()
+    auto top_rf = refinement_t::numeric_refinement_top(m_slacks);
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
-                m_registers.insert(u.dst.v, loc, interval_t{be_or_le(n->cast_to<int64_t>())});
+                auto interval = interval_t{be_or_le(n->cast_to<int64_t>())};
+                refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
+                m_registers.insert(u.dst.v, loc, rf);
                 return;
             }
         }
-        m_registers.insert(u.dst.v, loc, interval_t::top());
+        m_registers.insert(u.dst.v, loc, top_rf);
     };
 
-    auto mock_interval = m_registers.find(u.dst.v);
-    if (!mock_interval) return;
-    interval_t interval = mock_interval->to_interval();
+    auto rf_opt = m_registers.find(u.dst.v);
+    if (!rf_opt) return;
+    auto interval = rf_opt->get_interval_value();
+    if (interval.is_bottom()) {
+        m_registers.insert(u.dst.v, loc, top_rf);
+        return;
+    }
 
     // Swap bytes.  For 64-bit types we need the weights to fit in a
     // signed int64, but for smaller types we don't want sign extension,
@@ -454,9 +480,10 @@ void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
     case Un::Op::SWAP64:
         swap_endianness(interval, boost::endian::endian_reverse<uint64_t>);
         break;
+    default: // Un::Op::NEG
+        break;
     }
 }
-
 void unsigned_interval_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     // nothing to do here
 }
@@ -471,7 +498,7 @@ void unsigned_interval_domain_t::operator()(const Assume& s, location_t loc) {
 
 bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset, location_t loc) {
     if (auto loaded = m_stack.find(offset)) {
-        m_registers.insert(reg, loc, (*loaded).first.to_interval());
+        m_registers.insert(reg, loc, loaded->first);
         return true;
     }
     return false;
@@ -480,15 +507,14 @@ bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset
 void unsigned_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
     if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
-        if (auto targetreg_mock_interval = m_registers.find(target_reg.v)) {
-            auto targetreg_type = targetreg_mock_interval->to_interval();
-            m_stack.store(offset, targetreg_type, width);
+        if (auto rf_opt = m_registers.find(target_reg.v)) {
+            m_stack.store(offset, *rf_opt, width);
         }
     }
     else {
         auto imm = (uint64_t)std::get<Imm>(b.value).v;
-        auto targetreg_type = interval_t{number_t{imm}};
-        m_stack.store(offset, targetreg_type, width);
+        auto rf = refinement_t::numeric_refinement(interval_t{number_t{imm}}, m_slacks);
+        m_stack.store(offset, rf, width);
     }
 }
 
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index e541db59b..8012a3313 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -4,12 +4,12 @@
 #pragma once
 
 #include "array_domain.hpp"
-#include "types.hpp"
+#include "refinement.hpp"
 
 namespace crab {
 
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
-using global_env_unsigned_registers_t = std::unordered_map<register_location_t, mock_interval_t>;
+using global_env_unsigned_registers_t = std::unordered_map<register_location_t, refinement_t>;
 
 class unsigned_interval_registers_t {
 
@@ -42,15 +42,15 @@ class unsigned_interval_registers_t {
     bool is_top() const;
     void set_to_bottom();
     void set_to_top();
-    std::optional<mock_interval_t> find(register_location_t reg) const;
-    std::optional<mock_interval_t> find(register_t key) const;
-    void insert(register_t, const location_t&, interval_t);
+    std::optional<refinement_t> find(register_location_t reg) const;
+    std::optional<refinement_t> find(register_t key) const;
+    void insert(register_t, const location_t&, refinement_t);
     void operator-=(register_t);
     unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
     void adjust_bb_for_registers(location_t);
 };
 
-using unsigned_interval_stack_cell_t = std::pair<mock_interval_t, int>;    // intervals with width
+using unsigned_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
 using unsigned_interval_stack_cells_t = std::map<uint64_t, unsigned_interval_stack_cell_t>;
 
 class unsigned_interval_stack_t {
@@ -67,7 +67,7 @@ class unsigned_interval_stack_t {
     void set_to_top();
     static unsigned_interval_stack_t top();
     std::optional<unsigned_interval_stack_cell_t> find(uint64_t) const;
-    void store(uint64_t, mock_interval_t, int);
+    void store(uint64_t, refinement_t, int);
     void operator-=(uint64_t);
     unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
     [[nodiscard]] std::vector<uint64_t> get_keys() const;
@@ -77,6 +77,7 @@ class unsigned_interval_stack_t {
 };
 
 class unsigned_interval_domain_t final {
+    std::shared_ptr<slacks_t> m_slacks = nullptr;
     unsigned_interval_registers_t m_registers;
     unsigned_interval_stack_t m_stack;
     std::vector<std::string> m_errors;
@@ -85,11 +86,13 @@ class unsigned_interval_domain_t final {
   public:
 
     unsigned_interval_domain_t() = default;
+    unsigned_interval_domain_t(std::shared_ptr<slacks_t> slacks) : m_slacks(slacks) {}
     unsigned_interval_domain_t(unsigned_interval_registers_t registers,
-            unsigned_interval_stack_t stack) :
-        m_registers(std::move(registers)), m_stack(std::move(stack)) {}
+            unsigned_interval_stack_t stack, std::shared_ptr<slacks_t> slacks) :
+        m_slacks(std::move(slacks)), m_registers(std::move(registers)), m_stack(std::move(stack)) {}
+
     // eBPF initialization: R1 points to ctx, R10 to stack, etc.
-    static unsigned_interval_domain_t setup_entry();
+    static unsigned_interval_domain_t setup_entry(std::shared_ptr<slacks_t>);
     // bottom/top
     static unsigned_interval_domain_t bottom();
     void set_to_top();
@@ -133,11 +136,13 @@ class unsigned_interval_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    std::optional<mock_interval_t> find_interval_value(register_t) const;
-    std::optional<mock_interval_t> find_interval_at_loc(const register_location_t reg) const;
+    std::optional<refinement_t> find_interval_value(register_t) const;
+    std::optional<refinement_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<unsigned_interval_stack_cell_t> find_in_stack(uint64_t) const;
     void insert_in_registers(register_t, location_t, interval_t);
-    void store_in_stack(uint64_t, mock_interval_t, int);
+    void insert_in_registers(register_t, location_t, refinement_t);
+    void store_in_stack(uint64_t, refinement_t, int);
+    void store_in_stack(uint64_t, interval_t, int);
     void adjust_bb_for_types(location_t);
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);

From c9ff3877437c3cdf8f05507a7c11fa6179d2e9a0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 5 Dec 2024 06:05:10 -0500
Subject: [PATCH 332/373] Fixed error reporting caused by last comment

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.hpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 85d67ce54..3e03e7ddf 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -27,16 +27,18 @@ class inference_domain_t final {
         m_interval(std::move(interval)) {}
     inference_domain_t(const inference_domain_t& other) :
         m_slacks(other.m_slacks), m_region(other.m_region), m_offset(other.m_offset),
-        m_interval(other.m_interval) {}
+        m_interval(other.m_interval), m_errors(other.m_errors) {}
     inference_domain_t(inference_domain_t&& other) :
         m_slacks(std::move(other.m_slacks)), m_region(std::move(other.m_region)),
-        m_offset(std::move(other.m_offset)), m_interval(std::move(other.m_interval)) {}
+        m_offset(std::move(other.m_offset)), m_interval(std::move(other.m_interval)),
+        m_errors(std::move(other.m_errors)) {}
     inference_domain_t& operator=(const inference_domain_t& other) {
         if (this != &other) {
             m_slacks = other.m_slacks;
             m_region = other.m_region;
             m_offset = other.m_offset;
             m_interval = other.m_interval;
+            m_errors = other.m_errors;
         }
         return *this;
     }
@@ -46,6 +48,7 @@ class inference_domain_t final {
             m_region = std::move(other.m_region);
             m_offset = std::move(other.m_offset);
             m_interval = std::move(other.m_interval);
+            m_errors = std::move(other.m_errors);
         }
         return *this;
     }

From 657545e7b22b4c21710a59aac644907b9f09eac6 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 4 Jul 2024 20:01:02 -0400
Subject: [PATCH 333/373] initial support for inclusion/widen operations

For region and offset domains, the support is partial, hence it needs
more work;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/expression.cpp               |  22 ++++
 src/crab/expression.hpp               |   1 +
 src/crab/interval_domain.cpp          |   7 +-
 src/crab/offset_domain.cpp            | 100 +++++++++++++++-
 src/crab/offset_domain.hpp            |   4 +
 src/crab/refinement.cpp               |  11 ++
 src/crab/refinement.hpp               |   2 +
 src/crab/region_domain.cpp            | 166 +++++++++++++++++++++++++-
 src/crab/region_domain.hpp            |   4 +
 src/crab/signed_interval_domain.cpp   | 108 ++++++++++++++---
 src/crab/signed_interval_domain.hpp   |   4 +
 src/crab/type_inference.cpp           |  11 +-
 src/crab/types.cpp                    |  26 ++++
 src/crab/types.hpp                    |   4 +
 src/crab/unsigned_interval_domain.cpp | 106 +++++++++++++---
 src/crab/unsigned_interval_domain.hpp |   4 +
 16 files changed, 534 insertions(+), 46 deletions(-)

diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index f21ff2093..407757eeb 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -227,6 +227,28 @@ expression_t expression_t::operator|(const expression_t &other) const {
     return expression_t(new_terms, interval_t{0}, slacks);
 }
 
+expression_t expression_t::widen(const expression_t &other) const {
+    // TODO: this needs more work
+    if (_symbol_terms.size() != other._symbol_terms.size()) {
+        return expression_t();
+    }
+    symbol_terms_t new_terms;
+    for (auto &term : _symbol_terms) {
+        auto it = other._symbol_terms.find(term.first);
+        if (it == other._symbol_terms.end()) {
+            // we need to know what is the other slack, but it's not accesible directly
+                auto new_slack = symbol_t::make();
+                new_terms[new_slack] = 1;
+        }
+        else {
+            // TODO: some complex logic is needed here
+            new_terms[term.first] = term.second;
+        }
+    }
+    interval_t new_interval = _constant_term.widen(other._constant_term);
+    return expression_t(new_terms, new_interval);
+}
+
 void expression_t::write(std::ostream &o) const {
     size_t i = 0;
     // print all symbol terms
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index c7f23d160..a1899226b 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -45,6 +45,7 @@ class expression_t {
     expression_t operator+(int n) const;
     expression_t operator-(const expression_t &other) const;
     expression_t operator|(const expression_t &other) const;
+    expression_t widen(const expression_t &other) const;
     void write(std::ostream &o) const;
     symbol_terms_t get_symbol_terms() const { return _symbol_terms; }
     int8_t get_coefficient(const symbol_t &s) const;
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 21f3c7859..b233a2b43 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -145,8 +145,7 @@ void interval_domain_t::store_in_stack_unsigned(uint64_t key, refinement_t rf, i
 }
 
 bool interval_domain_t::operator<=(const interval_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
+    return (m_signed <= abs.m_signed && m_unsigned <= abs.m_unsigned);
 }
 
 void interval_domain_t::operator|=(const interval_domain_t& abs) {
@@ -177,8 +176,8 @@ interval_domain_t interval_domain_t::operator&(const interval_domain_t& abs) con
 }
 
 interval_domain_t interval_domain_t::widen(const interval_domain_t& abs, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
+    return interval_domain_t(m_signed.widen(abs.m_signed, to_constants),
+            m_unsigned.widen(abs.m_unsigned, to_constants), m_slacks);
 }
 
 interval_domain_t interval_domain_t::narrow(const interval_domain_t& other) const {
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index d71db9d1c..a5fc4d7de 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -74,6 +74,23 @@ void offset_registers_t::operator-=(register_t to_forget) {
     m_cur_register_def[to_forget] = nullptr;
 }
 
+bool offset_registers_t::operator<=(const offset_registers_t& other) const {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        if (m_cur_register_def[i] == nullptr) return false;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
+        if (it1 && it2) {
+            // currently being conservative and only checking if the types are the same
+            // refinement equal only checks for equality of type and value, but not constraints
+            // We need comparison of constraints as well
+            if (!(*it1 == *it2)) return false;
+        }
+    }
+    // need separate handling for the registers v_begin
+    return true;
+}
+
 offset_registers_t offset_registers_t::operator|(const offset_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -98,6 +115,30 @@ offset_registers_t offset_registers_t::operator|(const offset_registers_t& other
     return joined_state;
 }
 
+offset_registers_t offset_registers_t::widen(const offset_registers_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+
+    offset_registers_t joined_state;
+    location_t loc = location_t::top();
+
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
+        if (it1 && it2) {
+            auto rf1 = *it1, rf2 = *it2;
+            if (rf1.same_type(rf2)) {
+                joined_state.insert(register_t{i}, loc, rf1.widen(rf2));
+            }
+        }
+    }
+    return joined_state;
+}
+
 void offset_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (auto it = find(register_t{i})) {
@@ -180,6 +221,23 @@ void offset_stack_t::operator-=(const std::vector<uint64_t>& keys) {
     }
 }
 
+bool offset_stack_t::operator<=(const offset_stack_t& other) const {
+    size_t size1 = m_stack_cells.size();
+    size_t size2 = other.m_stack_cells.size();
+    if (size2 > size1) return false;
+    for (auto const &kv : other.m_stack_cells) {
+        auto it = m_stack_cells.find(kv.first);
+        if (it == m_stack_cells.end()) return false;
+        auto rf1 = it->second.first;
+        auto rf2 = kv.second.first;
+        auto width1 = it->second.second;
+        auto width2 = kv.second.second;
+        // being conservative and only checking if the types are the same
+        if (!(rf1 == rf2) || width1 != width2) return false;
+    }
+    return true;
+}
+
 offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -208,6 +266,34 @@ offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
     return offset_stack_t(std::move(out_stack_rfs));
 }
 
+offset_stack_t offset_stack_t::widen(const offset_stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+
+    refinement_stack_cells_t out_stack_rfs;
+    // We do not join rf cells because different rf values different types of offsets
+    for (auto const&kv: m_stack_cells) {
+        auto maybe_rf_cells = other.find(kv.first);
+        if (maybe_rf_cells) {
+            auto rf_cells1 = kv.second;
+            auto rf_cells2 = *maybe_rf_cells;
+            auto rf1 = rf_cells1.first;
+            auto rf2 = rf_cells2.first;
+            int width1 = rf_cells1.second;
+            int width2 = rf_cells2.second;
+            // TODO: for numerical values, the width does not have to be the same
+            // hence, handle accordingly
+            if (rf1.same_type(rf2) && width1 == width2) {
+                out_stack_rfs.insert({kv.first, std::make_pair(rf1.widen(rf2), width1)});
+            }
+        }
+    }
+    return offset_stack_t(std::move(out_stack_rfs));
+}
+
 offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
     if (desc == nullptr) return;
     if (desc->data >= 0) {
@@ -273,7 +359,9 @@ bool offset_domain_t::is_top() const {
 }
 
 // inclusion
-bool offset_domain_t::operator<=(const offset_domain_t& other) const { return true; }
+bool offset_domain_t::operator<=(const offset_domain_t& other) const {
+    return (m_registers <= other.m_registers && m_stack <= other.m_stack);
+}
 
 // join
 void offset_domain_t::operator|=(const offset_domain_t& abs) {
@@ -320,8 +408,14 @@ offset_domain_t offset_domain_t::operator&(const offset_domain_t& other) const {
 
 // widening
 offset_domain_t offset_domain_t::widen(const offset_domain_t& other, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return other;
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return offset_domain_t(m_registers.widen(other.m_registers),
+            m_stack.widen(other.m_stack), m_ctx, m_slacks);
 }
 
 // narrowing
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 06d8ab9a1..75313d161 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -47,6 +47,8 @@ class offset_registers_t {
         offset_registers_t(offset_registers_t&& other) = default;
         offset_registers_t& operator=(offset_registers_t&& other) = default;
         offset_registers_t operator|(const offset_registers_t&) const;
+        bool operator<=(const offset_registers_t&) const;
+        offset_registers_t widen(const offset_registers_t&) const;
         void operator-=(register_t);
         void set_to_top();
         void set_to_bottom();
@@ -82,6 +84,8 @@ class offset_stack_t {
         bool is_top() const;
         static offset_stack_t top();
         offset_stack_t operator|(const offset_stack_t&) const;
+        bool operator<=(const offset_stack_t&) const;
+        offset_stack_t widen(const offset_stack_t&) const;
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
         std::vector<uint64_t> get_keys() const;
 };
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index e5c482519..2abe81184 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -174,6 +174,12 @@ bool refinement_t::same_type(const refinement_t &other) const {
     return _type == other._type && _type != refinement_type_t::ANY;
 }
 
+refinement_t refinement_t::widen(const refinement_t &other) const {
+    assert(same_type(other));
+    auto widened_value = _value.widen(other._value);
+    return refinement_t(_type, widened_value);
+}
+
 refinement_t refinement_t::operator|(const refinement_t &other) const {
     if (!has_constraints) {
         return refinement_t(_type, _value | other._value);
@@ -228,4 +234,9 @@ bool refinement_t::safe_access(const expression_t& access_lb, const expression_t
     return lb_satisfied && ub_satisfied;
 }
 
+bool refinement_t::operator==(const refinement_t &other) const {
+    // TODO: we need to compare constraints as well
+    return _type == other._type && _value == other._value;
+}
+
 } // namespace crab
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 375a0fe3c..ca81b27b6 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -38,8 +38,10 @@ class refinement_t {
     refinement_t operator+(const refinement_t &other) const;
     refinement_t operator-(const refinement_t &other) const;
     refinement_t operator|(const refinement_t &other) const;
+    refinement_t widen(const refinement_t &other) const;
     constraint_t operator<=(const refinement_t &other) const;
     constraint_t operator>(const refinement_t &other) const;
+    bool operator==(const refinement_t &other) const;
     void write(std::ostream &o) const;
     bool same_type(const refinement_t &other) const;
     bool safe_access(const expression_t&, const expression_t&, bool) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index f3740b031..db32a603b 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -124,6 +124,76 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
     return joined_reg_types;
 }
 
+bool region_registers_t::operator<=(const region_registers_t& other) const {
+    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        if (m_cur_register_def[i] == nullptr) return false;
+        auto maybe_ptr1 = find(register_t{i});
+        auto maybe_ptr2 = other.find(register_t{i});
+        if (maybe_ptr1 && maybe_ptr2) {
+            ptr_or_mapfd_t ptr_or_mapfd1 = *maybe_ptr1, ptr_or_mapfd2 = *maybe_ptr2;
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (!(ptr_with_off1 <= ptr_with_off2)) return false;
+            }
+            else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                if (!(mapfd1 <= mapfd2)) return false;
+            }
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+                continue;
+            }
+            else return false;
+        }
+    }
+    return true;
+}
+
+region_registers_t region_registers_t::widen(const region_registers_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    region_registers_t joined_reg_types;
+
+    location_t loc = location_t::top();
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        auto maybe_ptr1 = find(register_t{i});
+        auto maybe_ptr2 = other.find(register_t{i});
+        if (maybe_ptr1 && maybe_ptr2) {
+            ptr_or_mapfd_t ptr_or_mapfd1 = *maybe_ptr1, ptr_or_mapfd2 = *maybe_ptr2;
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1)
+                        && std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                ptr_with_off_t ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                    auto ptr_with_off = ptr_with_off1.widen(ptr_with_off2);
+                    joined_reg_types.insert(register_t{i}, loc, std::move(ptr_with_off));
+                }
+            }
+            else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                auto map_fd = mapfd1.widen(mapfd2);
+                joined_reg_types.insert(register_t{i}, loc, std::move(map_fd));
+            }
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1)
+                    && std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+                joined_reg_types.insert(register_t{i}, loc, std::move(packet_ptr_t()));
+            }
+        }
+    }
+    return joined_reg_types;
+}
+
 void region_registers_t::operator-=(register_t var) {
     if (is_bottom()) {
         return;
@@ -177,6 +247,41 @@ void region_registers_t::adjust_bb_for_registers(location_t loc) {
     }
 }
 
+bool region_stack_t::operator<=(const region_stack_t& other) const {
+    size_t size1 = m_cells.size();
+    size_t size2 = other.m_cells.size();
+    if (size2 > size1) return false;
+    for (auto const &kv : other.m_cells) {
+        auto it = m_cells.find(kv.first);
+        if (it == m_cells.end()) return false;
+        auto ptr_or_mapfd_cells1 = it->second;
+        auto ptr_or_mapfd_cells2 = kv.second;
+        auto ptr_or_mapfd1 = ptr_or_mapfd_cells1.first;
+        auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
+        int width1 = ptr_or_mapfd_cells1.second;
+        int width2 = ptr_or_mapfd_cells2.second;
+        if (width1 != width2) return false;
+        if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
+                std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+            auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+            auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+            if (!(ptr_with_off1 <= ptr_with_off2)) return false;
+        }
+        else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
+                std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+            auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+            auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+            if (!(mapfd1 <= mapfd2)) return false;
+        }
+        else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1) &&
+                std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+            continue;
+        }
+        else return false;
+    }
+    return true;
+}
+
 region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -193,6 +298,7 @@ region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
             auto ptr_or_mapfd2 = ptr_or_mapfd_stack_cell2.first;
             int width1 = ptr_or_mapfd_stack_cell1.second;
             int width2 = ptr_or_mapfd_stack_cell2.second;
+            // this should be fixed in the future
             int width_joined = std::min(width1, width2);
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
@@ -218,6 +324,49 @@ region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
     return joined_stack;
 }
 
+region_stack_t region_stack_t::widen(const region_stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    region_stack_t joined_stack;
+    for (auto const&kv: m_cells) {
+        auto maybe_ptr_or_mapfd_cells = other.find(kv.first);
+        if (maybe_ptr_or_mapfd_cells) {
+            auto ptr_or_mapfd_cells1 = kv.second;
+            auto ptr_or_mapfd_cells2 = *maybe_ptr_or_mapfd_cells;
+            auto ptr_or_mapfd1 = ptr_or_mapfd_cells1.first;
+            auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
+            int width1 = ptr_or_mapfd_cells1.second;
+            int width2 = ptr_or_mapfd_cells2.second;
+            // this should be fixed in the future
+            int width_joined = std::min(width1, width2);
+            if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
+                auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
+                auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
+                if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
+                    auto ptr_with_off = ptr_with_off1.widen(ptr_with_off2);
+                    joined_stack.store(kv.first, std::move(ptr_with_off), width_joined);
+                }
+            }
+            else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
+                auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
+                auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
+                auto mapfd = mapfd1.widen(mapfd2);
+                joined_stack.store(kv.first, std::move(mapfd), width_joined);
+            }
+            else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1) &&
+                    std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
+                joined_stack.store(kv.first, std::move(packet_ptr_t()), width_joined);
+            }
+        }
+    }
+    return joined_stack;
+}
+
 void region_stack_t::operator-=(uint64_t key) {
     auto it = find(key);
     if (it)
@@ -368,8 +517,8 @@ std::optional<ptr_or_mapfd_stack_cell_t> region_domain_t::find_in_stack(uint64_t
 }
 
 bool region_domain_t::operator<=(const region_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
+    // TODO: check for shared_ptr_aliases
+    return (m_registers <= abs.m_registers && m_stack <= abs.m_stack);
 }
 
 void region_domain_t::operator|=(const region_domain_t& abs) {
@@ -414,9 +563,16 @@ region_domain_t region_domain_t::operator&(const region_domain_t& abs) const {
     return abs;
 }
 
-region_domain_t region_domain_t::widen(const region_domain_t& abs, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
+region_domain_t region_domain_t::widen(const region_domain_t& other, bool to_constants) {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    auto aliases = join_shared_ptr_aliases(m_shared_ptr_aliases, other.m_shared_ptr_aliases);
+    return region_domain_t(m_registers.widen(other.m_registers), m_stack.widen(other.m_stack),
+            other.m_ctx, std::move(aliases));
 }
 
 region_domain_t region_domain_t::narrow(const region_domain_t& other) const {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index b963ca0d2..6cf0895cd 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -34,6 +34,8 @@ class region_stack_t {
   public:
     region_stack_t() = default;
     region_stack_t operator|(const region_stack_t& other) const;
+    bool operator<=(const region_stack_t& other) const;
+    region_stack_t widen(const region_stack_t& other) const;
     void operator-=(uint64_t);
     void operator-=(const std::vector<uint64_t>&);
     void set_to_bottom();
@@ -79,6 +81,8 @@ class region_registers_t {
     }
     region_registers_t& operator=(region_registers_t&& other) noexcept = default;
     region_registers_t operator|(const region_registers_t& other) const;
+    region_registers_t widen(const region_registers_t& other) const;
+    bool operator<=(const region_registers_t& other) const;
     void operator-=(register_t var);
     void set_to_bottom();
     void set_to_top();
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index c8905c863..fb760cf4e 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -48,6 +48,20 @@ std::optional<refinement_t> signed_interval_registers_t::find(register_t key) co
     return find(reg);
 }
 
+bool signed_interval_registers_t::operator<=(const signed_interval_registers_t& other) const {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        if (m_cur_register_def[i] == nullptr) return false;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(m_cur_register_def[i]));
+        if (it1 && it2) {
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            if (!(rf1 <= rf2)) return false;
+        }
+    }
+    return true;
+}
+
 signed_interval_registers_t signed_interval_registers_t::operator|(const signed_interval_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -68,6 +82,26 @@ signed_interval_registers_t signed_interval_registers_t::operator|(const signed_
     return refinements_joined;
 }
 
+signed_interval_registers_t signed_interval_registers_t::widen(const signed_interval_registers_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    signed_interval_registers_t refinements_joined;
+    location_t loc = location_t::top();
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
+        if (it1 && it2) {
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2)););
+        }
+    }
+    return refinements_joined;
+}
+
 void signed_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
@@ -199,9 +233,28 @@ std::vector<uint64_t> signed_interval_stack_t::find_overlapping_cells(uint64_t s
     return overlapping_cells;
 }
 
+bool signed_interval_stack_t::operator<=(const signed_interval_stack_t& other) const {
+    size_t size1 = size(), size2 = other.size();
+    if (size2 > size1) return false;
+    for (auto const &kv : other.m_cells) {
+        auto key = kv.first;
+        auto it = m_cells.find(key);
+        if (it == m_cells.end()) return false;
+        auto& cells1 = it->second; auto& cells2 = kv.second;
+        auto rf1 = cells1.first;
+        auto rf2 = cells2.first;
+        auto width1 = cells1.second; auto width2 = cells2.second;
+        if (width1 != width2) return false;
+        if (!(rf1 <= rf2)) return false;
+    }
+    return true;
+}
+
+using RefinementJoin = std::function<refinement_t(const refinement_t&, const refinement_t&)>;
+
 static inline void join_stack(const signed_interval_stack_t& stack1, uint64_t key1, int& loc1,
         const signed_interval_stack_t& stack2, uint64_t key2, int& loc2,
-        signed_interval_stack_cells_t& refinements_joined) {
+        signed_interval_stack_cells_t& refinements_joined, RefinementJoin joinFunc) {
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
@@ -211,7 +264,7 @@ static inline void join_stack(const signed_interval_stack_t& stack1, uint64_t ke
     refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (key1 == key2) {
         if (width1 == width2) {
-            refinements_joined[key1] = std::make_pair(rf1 | rf2, width1);
+            refinements_joined[key1] = std::make_pair(joinFunc(rf1, rf2), width1);
             loc1++; loc2++;
         }
         else if (width1 < width2) {
@@ -235,14 +288,14 @@ static inline void join_stack(const signed_interval_stack_t& stack1, uint64_t ke
         else loc2++;
     }
     else {
-        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined);
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined, joinFunc);
     }
 }
 
 signed_interval_stack_t signed_interval_stack_t::operator|(const signed_interval_stack_t& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return other;
-    } else if (other.is_bottom()) {
+    } else if (other.is_bottom() || is_top()) {
         return *this;
     }
     signed_interval_stack_cells_t refinements_joined;
@@ -251,7 +304,26 @@ signed_interval_stack_t signed_interval_stack_t::operator|(const signed_interval
     int i = 0, j = 0;
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
-        join_stack(*this, key1, i, other, key2, j, refinements_joined);
+        join_stack(*this, key1, i, other, key2, j, refinements_joined,
+                [](const refinement_t& a, const refinement_t& b) { return a | b; });
+    }
+    return signed_interval_stack_t(std::move(refinements_joined));
+}
+
+signed_interval_stack_t signed_interval_stack_t::widen(const signed_interval_stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    signed_interval_stack_cells_t refinements_joined;
+    auto stack1_keys = get_keys();
+    auto stack2_keys = other.get_keys();
+    int i = 0, j = 0;
+    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
+        int key1 = stack1_keys[i], key2 = stack2_keys[j];
+        join_stack(*this, key1, i, other, key2, j, refinements_joined,
+                [](const refinement_t& a, const refinement_t& b) { return a.widen(b); });
     }
     return signed_interval_stack_t(std::move(refinements_joined));
 }
@@ -367,8 +439,8 @@ void signed_interval_domain_t::store_in_stack(uint64_t key, interval_t interval,
 }
 
 bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
+    return (m_registers <= abs.m_registers) &&
+        (m_stack <= abs.m_stack);
 }
 
 void signed_interval_domain_t::operator|=(const signed_interval_domain_t& abs) {
@@ -385,10 +457,10 @@ void signed_interval_domain_t::operator|=(signed_interval_domain_t&& abs) {
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interval_domain_t& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return other;
     }
-    else if (other.is_bottom()) {
+    else if (other.is_bottom() || is_top()) {
         return *this;
     }
     return signed_interval_domain_t(
@@ -398,10 +470,10 @@ signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interv
 }
 
 signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_domain_t&& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return std::move(other);
     }
-    else if (other.is_bottom()) {
+    else if (other.is_bottom() || is_top()) {
         return *this;
     }
     return signed_interval_domain_t(
@@ -415,9 +487,15 @@ signed_interval_domain_t signed_interval_domain_t::operator&(const signed_interv
     return abs;
 }
 
-signed_interval_domain_t signed_interval_domain_t::widen(const signed_interval_domain_t& abs, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
+signed_interval_domain_t signed_interval_domain_t::widen(const signed_interval_domain_t& other, bool to_constants) {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return signed_interval_domain_t(m_registers.widen(other.m_registers),
+            m_stack.widen(other.m_stack));
 }
 
 signed_interval_domain_t signed_interval_domain_t::narrow(const signed_interval_domain_t& other) const {
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index eeb7bc0a3..4e414e4dc 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -48,6 +48,8 @@ class signed_interval_registers_t {
     void operator-=(register_t);
     signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
     void adjust_bb_for_registers(location_t);
+    bool operator<=(const signed_interval_registers_t& other) const;
+    signed_interval_registers_t widen(const signed_interval_registers_t& other) const;
 };
 
 using signed_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
@@ -76,6 +78,8 @@ class signed_interval_stack_t {
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values(const std::vector<uint64_t>&, uint64_t, int);
+    bool operator<=(const signed_interval_stack_t& other) const;
+    signed_interval_stack_t widen(const signed_interval_stack_t& other) const;
 };
 
 class signed_interval_domain_t final {
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 170e5d427..e118d222d 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -33,14 +33,15 @@ void inference_domain_t::set_to_top() {
 }
 
 bool inference_domain_t::operator<=(const inference_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
+    if (abs.is_top() || is_bottom()) return true;
+    if (is_top() || abs.is_bottom()) return false;
+    return (m_region <= abs.m_region && m_offset <= abs.m_offset && m_interval <= abs.m_interval);
 }
 
 inference_domain_t inference_domain_t::widen(const inference_domain_t& other, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    inference_domain_t res{};
-    return res;
+    return inference_domain_t(m_region.widen(other.m_region, to_constants),
+            m_offset.widen(other.m_offset, to_constants),
+            m_interval.widen(other.m_interval, to_constants));
 }
 
 void inference_domain_t::operator|=(const inference_domain_t& abs) {
diff --git a/src/crab/types.cpp b/src/crab/types.cpp
index ca053d44b..b93a516b8 100644
--- a/src/crab/types.cpp
+++ b/src/crab/types.cpp
@@ -37,12 +37,24 @@ bool mapfd_t::operator==(const mapfd_t& other) const {
     return (m_mapfd == other.m_mapfd);
 }
 
+bool mapfd_t::operator<=(const mapfd_t& other) const {
+    bool map_type = m_value_type == other.m_value_type
+        || other.m_value_type == EbpfMapValueType::ANY;
+    return (m_mapfd.to_interval() <= other.m_mapfd.to_interval() && map_type);
+}
+
 mapfd_t mapfd_t::operator|(const mapfd_t& other) const {
     auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
     const auto& mock_i = mock_interval_t(m_mapfd.to_interval() | other.m_mapfd.to_interval());
     return mapfd_t(std::move(mock_i), value_type);
 }
 
+mapfd_t mapfd_t::widen(const mapfd_t& other) const {
+    auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
+    const auto& mock_i = mock_interval_t(m_mapfd.to_interval().widen(other.m_mapfd.to_interval()));
+    return mapfd_t(std::move(mock_i), value_type);
+}
+
 void ptr_with_off_t::set_nullness(nullness_t n) { m_nullness = n; }
 
 void ptr_with_off_t::set_id(int id) { m_id = id; }
@@ -53,6 +65,12 @@ void ptr_with_off_t::set_region_size(mock_interval_t region_sz) { m_region_size
 
 void ptr_with_off_t::set_region(region_t r) { m_r = r; }
 
+bool ptr_with_off_t::operator<=(const ptr_with_off_t& other) const {
+    bool nullness = m_nullness == other.m_nullness || other.m_nullness == nullness_t::MAYBE_NULL;
+    return (m_r == other.m_r && m_offset.to_interval() <= other.m_offset.to_interval()
+            && m_region_size.to_interval() <= other.m_region_size.to_interval() && nullness);
+}
+
 ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
     auto&& mock_o = mock_interval_t(m_offset.to_interval() | other.m_offset.to_interval());
     auto&& mock_r_s = mock_interval_t(
@@ -61,6 +79,14 @@ ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
     return ptr_with_off_t(m_r, -1, std::move(mock_o), std::move(nullness), std::move(mock_r_s));
 }
 
+ptr_with_off_t ptr_with_off_t::widen(const ptr_with_off_t& other) const {
+    auto&& mock_o = mock_interval_t(m_offset.to_interval().widen(other.m_offset.to_interval()));
+    auto&& mock_r_s = mock_interval_t(
+            m_region_size.to_interval().widen(other.m_region_size.to_interval()));
+    auto&& nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
+    return ptr_with_off_t(m_r, -1, std::move(mock_o), std::move(nullness), std::move(mock_r_s));
+}
+
 std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
     m.write(o);
     return o;
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index cd52b1c6a..7eb3f4d58 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -89,6 +89,8 @@ class ptr_with_off_t {
             mock_interval_t _region_sz = mock_interval_t::top())
         : m_r(_r), m_id(_id), m_offset(_off), m_nullness(_nullness), m_region_size(_region_sz) {}
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
+    ptr_with_off_t widen(const ptr_with_off_t&) const;
+    bool operator<=(const ptr_with_off_t&) const;
     [[nodiscard]] nullness_t get_nullness() const { return m_nullness; }
     void set_nullness(nullness_t);
     [[nodiscard]] int get_id() const { return m_id; }
@@ -112,6 +114,8 @@ class mapfd_t {
   public:
     mapfd_t() = default;
     mapfd_t operator|(const mapfd_t&) const;
+    mapfd_t widen(const mapfd_t&) const;
+    bool operator<=(const mapfd_t&) const;
     mapfd_t(mock_interval_t mapfd, EbpfMapValueType val_type)
         : m_mapfd(mapfd), m_value_type(val_type) {}
     friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 4ee59872f..06b5b774b 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -48,6 +48,19 @@ std::optional<refinement_t> unsigned_interval_registers_t::find(register_t key)
     return find(reg);
 }
 
+bool unsigned_interval_registers_t::operator<=(const unsigned_interval_registers_t& other) const {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        if (m_cur_register_def[i] == nullptr) return false;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
+        if (it1 && it2) {
+            if (!(it1->to_interval() <= it2->to_interval())) return false;
+        }
+    }
+    return true;
+}
+
 unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const unsigned_interval_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
@@ -68,6 +81,26 @@ unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const uns
     return refinements_joined;
 }
 
+unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigned_interval_registers_t& other, bool to_constants) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    unsigned_interval_registers_t refinements_joined;
+    location_t loc = location_t::top();
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+        if (other.m_cur_register_def[i] == nullptr) continue;
+        auto it1 = find(*(m_cur_register_def[i]));
+        auto it2 = other.find(*(other.m_cur_register_def[i]));
+        if (it1 && it2) {
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2)));
+        }
+    }
+    return refinements_joined;
+}
+
 void unsigned_interval_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (auto it = find(register_t{i})) {
@@ -168,9 +201,12 @@ void unsigned_interval_stack_t::remove_overlap(const std::vector<uint64_t>& keys
     }
 }
 
+using RefinementJoin = std::function<refinement_t(const refinement_t&, const refinement_t&)>;
+
 static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t key1, int& loc1,
         const unsigned_interval_stack_t& stack2, uint64_t key2, int& loc2,
-        unsigned_interval_stack_cells_t& refinements_joined) {
+        unsigned_interval_stack_cells_t& refinements_joined, const IntervalFunction& joinFunc) {
+
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
     int width1 = cells1.second; int width2 = cells2.second;
@@ -180,7 +216,7 @@ static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t
     refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (key1 == key2) {
         if (width1 == width2) {
-            refinements_joined[key1] = std::make_pair(rf1 | rf2, width1);
+            refinements_joined[key1] = std::make_pair(joinFunc(rf1, rf2), width1);
             loc1++; loc2++;
         }
         else if (width1 < width2) {
@@ -208,10 +244,27 @@ static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t
     }
 }
 
+bool unsigned_interval_stack_t::operator<=(const unsigned_interval_stack_t& other) const {
+    size_t size1 = size(), size2 = other.size();
+    if (size2 > size1) return false;
+    for (auto const &kv : other.m_cells) {
+        auto key = kv.first;
+        auto it = m_cells.find(key);
+        if (it == m_cells.end()) return false;
+        auto& cells1 = it->second; auto& cells2 = kv.second;
+        auto interval1 = cells1.first.to_interval();
+        auto interval2 = cells2.first.to_interval();
+        auto width1 = cells1.second; auto width2 = cells2.second;
+        if (width1 != width2) return false;
+        if (!(interval1 <= interval2)) return false;
+    }
+    return true;
+}
+
 unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_interval_stack_t& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return other;
-    } else if (other.is_bottom()) {
+    } else if (other.is_bottom() || is_top()) {
         return *this;
     }
     unsigned_interval_stack_cells_t refinements_joined;
@@ -220,7 +273,26 @@ unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_in
     int i = 0, j = 0;
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
-        join_stack(*this, key1, i, other, key2, j, refinements_joined);
+        join_stack(*this, key1, i, other, key2, j, refinements_joined,
+                [](const refinement_t& a, const refinement_t& b) { return a | b; });
+    }
+    return unsigned_interval_stack_t(std::move(refinements_joined));
+}
+
+unsigned_interval_stack_t unsigned_interval_stack_t::widen(const unsigned_interval_stack_t& other) const {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    } else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    unsigned_interval_stack_cells_t refinements_joined;
+    auto stack1_keys = get_keys();
+    auto stack2_keys = other.get_keys();
+    int i = 0, j = 0;
+    while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
+        int key1 = stack1_keys[i], key2 = stack2_keys[j];
+        join_stack(*this, key1, i, other, key2, j, refinements_joined,
+                [](const refinement_t& a, const refinement_t& b) { return a.widen(b); });
     }
     return unsigned_interval_stack_t(std::move(refinements_joined));
 }
@@ -322,8 +394,8 @@ void unsigned_interval_domain_t::store_in_stack(uint64_t key, interval_t interva
 }
 
 bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
-    /* WARNING: The operation is not implemented yet.*/
-    return true;
+    return (m_registers <= abs.m_registers) &&
+        (m_stack <= abs.m_stack);
 }
 
 void unsigned_interval_domain_t::operator|=(const unsigned_interval_domain_t& abs) {
@@ -340,10 +412,10 @@ void unsigned_interval_domain_t::operator|=(unsigned_interval_domain_t&& abs) {
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_interval_domain_t& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return other;
     }
-    else if (other.is_bottom()) {
+    else if (other.is_bottom() || is_top()) {
         return *this;
     }
     return unsigned_interval_domain_t(
@@ -353,10 +425,10 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interval_domain_t&& other) const {
-    if (is_bottom()) {
+    if (is_bottom() || other.is_top()) {
         return std::move(other);
     }
-    else if (other.is_bottom()) {
+    else if (other.is_bottom() || is_top()) {
         return *this;
     }
     return unsigned_interval_domain_t(
@@ -370,9 +442,15 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator&(const unsigned_
     return abs;
 }
 
-unsigned_interval_domain_t unsigned_interval_domain_t::widen(const unsigned_interval_domain_t& abs, bool to_constants) {
-    /* WARNING: The operation is not implemented yet.*/
-    return abs;
+unsigned_interval_domain_t unsigned_interval_domain_t::widen(const unsigned_interval_domain_t& other, bool to_constants) {
+    if (is_bottom() || other.is_top()) {
+        return other;
+    }
+    else if (other.is_bottom() || is_top()) {
+        return *this;
+    }
+    return unsigned_interval_domain_t(m_registers.widen(other.m_registers),
+            m_stack.widen(other.m_stack));
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::narrow(const unsigned_interval_domain_t& other) const {
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 8012a3313..4d203ded6 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -48,6 +48,8 @@ class unsigned_interval_registers_t {
     void operator-=(register_t);
     unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
     void adjust_bb_for_registers(location_t);
+    bool operator<=(const unsigned_interval_registers_t& other) const;
+    unsigned_interval_registers_t widen(const unsigned_interval_registers_t& other) const;
 };
 
 using unsigned_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
@@ -74,6 +76,8 @@ class unsigned_interval_stack_t {
     size_t size() const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values(const std::vector<uint64_t>&, uint64_t, int);
+    bool operator<=(const unsigned_interval_stack_t& other) const;
+    unsigned_interval_stack_t widen(const unsigned_interval_stack_t& other) const;
 };
 
 class unsigned_interval_domain_t final {

From c49fca6f6a279e5395bb073eb24055b3b06a8c89 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 2 Dec 2024 10:08:14 -0500
Subject: [PATCH 334/373] Adding full but imprecise support for widen

Widen and inclusion operator have been implemented for all required
classes, however, precision can indeed be improved in certain cases

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp               | 28 ++++++++-
 src/crab/constraint.hpp               |  2 +
 src/crab/expression.cpp               | 91 ++++++++++++---------------
 src/crab/expression.hpp               |  6 +-
 src/crab/offset_domain.cpp            | 15 ++---
 src/crab/refinement.cpp               | 28 +++++++--
 src/crab/refinement.hpp               |  5 +-
 src/crab/region_domain.cpp            |  2 +-
 src/crab/signed_interval_domain.cpp   |  7 +--
 src/crab/type_inference.cpp           |  2 +-
 src/crab/unsigned_interval_domain.cpp | 22 +++----
 11 files changed, 117 insertions(+), 91 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 663674ff7..74e590661 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -63,6 +63,30 @@ constraint_t constraint_t::operator|(const constraint_t &other) const {
     }
 }
 
+constraint_t constraint_t::widen(const constraint_t &other) const {
+    if (this->implies(other) && other.implies(*this)) {
+        // this == other
+        return *this;
+    } else {
+        if (is_meta_begin_constraint()) {
+            // meta <= begin
+            return constraint_t::meta_begin_init_constraint();
+        }
+        else if (is_begin_end_constraint()) {
+            // begin <= end
+            return constraint_t::begin_end_init_constraint();
+        }
+        else {
+            return constraint_t::get_true();
+        }
+    }
+}
+
+// inclusion operator
+bool constraint_t::operator<=(const constraint_t &other) const {
+    return this->implies(other);
+}
+
 bool constraint_t::is_meta_begin_constraint() const {
     return _lhs.contains(symbol_t::meta()) && _lhs.contains(symbol_t::begin());
 }
@@ -78,7 +102,9 @@ bool constraint_t::is_bottom() const {
 
 bool constraint_t::is_top() const {
     // lhs <= rhs is top
-    return _lhs <= _rhs;
+    // in expression_t, we need to support <= operator as inclusion operator,
+    // hence we use check_le instead of operator<=
+    return _lhs.check_le(_rhs);
 }
 
 constraint_t constraint_t::operator+(constraint_t c2) const {
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 980405d3b..849b3ca84 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -44,6 +44,8 @@ class constraint_t {
     interval_t compute_subtraction(const symbol_t&, const symbol_t&) const;
     [[nodiscard]] constraint_t negate() const;
     constraint_t operator|(const constraint_t&) const;
+    constraint_t widen(const constraint_t&) const;
+    bool operator<=(const constraint_t&) const;
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream &, const constraint_t&);
 };
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index 407757eeb..a5fc82799 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -67,23 +67,8 @@ bool expression_t::operator==(const expression_t &other) const {
     return false;
 }
 
-// less than
-bool expression_t::operator<(const expression_t &other) const {
-    auto check = [](const bound_t &a, const bound_t &b) { return a < b; };
-    if (check_op(_symbol_terms, other._symbol_terms, _constant_term.ub(), other._constant_term.lb(), check)) {
-        return true;
-    }
-    expression_t e1 = get_equivalent_expression();
-    expression_t e2 = other.get_equivalent_expression();
-    if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.ub(), e2._constant_term.lb(), check)) {
-        return true;
-    }
-    // we cannot prove that one expression is less than the other, as they contain packet symbols
-    return false;
-}
-
-// less than or equal
-bool expression_t::operator<=(const expression_t &other) const {
+// less than or equal, named check_le to avoid confusion with operator<= (inclusion operator)
+bool expression_t::check_le(const expression_t &other) const {
     auto check = [](const bound_t &a, const bound_t &b) { return a <= b; };
     if (check_op(_symbol_terms, other._symbol_terms, _constant_term.ub(), other._constant_term.lb(), check)) {
         return true;
@@ -177,45 +162,50 @@ expression_t expression_t::operator+(int n) const {
     return operator+(interval_t{n});
 }
 
-expression_t expression_t::operator|(const expression_t &other) const {
-    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
-    if (*this == other) {
+using IntervalJoin = std::function<interval_t(const interval_t&, const interval_t&)>;
+
+static inline expression_t join(const expression_t* e1, const expression_t &e2,
+                                IntervalJoin join) {
+    auto slacks = e1->get_slacks() == nullptr ? e2.get_slacks() : e1->get_slacks();
+    if (*e1 == e2) {
         // both expressions are equal
-        return *this;
+        return *e1;
     }
-    interval_t constant_term = _constant_term;
-    interval_t other_constant_term = other._constant_term;
+    interval_t e1_constant_term = e1->get_constant_term();
+    interval_t e2_constant_term = e2.get_constant_term();
+    const symbol_terms_t& e1_terms = e1->get_symbol_terms();
+    const symbol_terms_t& e2_terms = e2.get_symbol_terms();
     symbol_terms_t new_terms;
-    for (const auto &term : _symbol_terms) {
-        if (other._symbol_terms.find(term.first) != other._symbol_terms.end()
-            && term.second == other._symbol_terms.at(term.first)) {
+    for (const auto &term : e1_terms) {
+        if (e2_terms.find(term.first) != e2_terms.end()
+            && term.second == e2_terms.at(term.first)) {
             // for any symbol, if it exists in both expressions, and the coefficients are the same
             // then the term can be added to the new expression
             new_terms[term.first] = term.second;
         } else if (term.first.is_slack()) {
-            // either the symbol was not found in the other expression, or the coefficients are different
-            constant_term = constant_term +
+            // either the symbol was not found in the e2 expression, or the coefficients are different
+            e1_constant_term = e1_constant_term +
                 interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
         }
         else {
             // in case where we have symbols other than slack variables, and either the symbol is not
-            // found in the other expression, or the coefficients are different, we return top
+            // found in the e2 expression, or the coefficients are different, we return top
             return expression_t();
         }
     }
-    for (const auto &term : other._symbol_terms) {
+    for (const auto &term : e2_terms) {
         if (new_terms.find(term.first) != new_terms.end()) {
             // if the symbol is already handled in the previous loop, then we skip it
             continue;
         }
         if (term.first.is_slack()) {
             // the slack variable was not handled before, hence we resolve its value
-            other_constant_term = other_constant_term +
+            e2_constant_term = e2_constant_term +
                 interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
         }
         else {
             // in case where we have symbols other than slack variables, and either the symbol is not
-            // found in the other expression, or the coefficients are different, we return top
+            // found in the e2 expression, or the coefficients are different, we return top
             return expression_t();
         }
     }
@@ -223,30 +213,27 @@ expression_t expression_t::operator|(const expression_t &other) const {
     // so we construct a new slack variable and assign its value to the join of added intervals
     symbol_t new_slack = symbol_t::make();
     new_terms[new_slack] = 1;
-    (*slacks)[new_slack] = constant_term | other_constant_term;
+    // either join or widen
+    (*slacks)[new_slack] = join(e1_constant_term, e2_constant_term);
     return expression_t(new_terms, interval_t{0}, slacks);
 }
 
+expression_t expression_t::operator|(const expression_t &other) const {
+    return join(this, other, [](const interval_t& a, const interval_t& b) { return a | b; });
+}
+
 expression_t expression_t::widen(const expression_t &other) const {
-    // TODO: this needs more work
-    if (_symbol_terms.size() != other._symbol_terms.size()) {
-        return expression_t();
-    }
-    symbol_terms_t new_terms;
-    for (auto &term : _symbol_terms) {
-        auto it = other._symbol_terms.find(term.first);
-        if (it == other._symbol_terms.end()) {
-            // we need to know what is the other slack, but it's not accesible directly
-                auto new_slack = symbol_t::make();
-                new_terms[new_slack] = 1;
-        }
-        else {
-            // TODO: some complex logic is needed here
-            new_terms[term.first] = term.second;
-        }
-    }
-    interval_t new_interval = _constant_term.widen(other._constant_term);
-    return expression_t(new_terms, new_interval);
+    return join(this, other, [](const interval_t& a, const interval_t& b) { return a.widen(b); });
+}
+
+
+// inclusion operator
+bool expression_t::operator<=(const expression_t &other) const {
+    expression_t e1 = get_equivalent_expression();
+    expression_t e2 = other.get_equivalent_expression();
+    // if after removing slack variables, the expressions are equal, then the inclusion holds
+    // otherwise, we can't prove the inclusion
+    return e1._symbol_terms == e2._symbol_terms && e1._constant_term <= e2._constant_term;
 }
 
 void expression_t::write(std::ostream &o) const {
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index a1899226b..61066f0a8 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -35,8 +35,7 @@ class expression_t {
         : _constant_term(interval_t{n}), _slacks(slacks) {}
     expression_t get_equivalent_expression() const;
     bool operator==(const expression_t &other) const;
-    bool operator<(const expression_t &other) const;
-    bool operator<=(const expression_t &other) const;
+    bool check_le(const expression_t &other) const;
     bool operator>(const expression_t &other) const;
     void operator-=(const symbol_t& s) { _symbol_terms.erase(s); }
     bool is_constant() const { return _symbol_terms.empty(); }
@@ -46,6 +45,7 @@ class expression_t {
     expression_t operator-(const expression_t &other) const;
     expression_t operator|(const expression_t &other) const;
     expression_t widen(const expression_t &other) const;
+    bool operator<=(const expression_t &other) const;
     void write(std::ostream &o) const;
     symbol_terms_t get_symbol_terms() const { return _symbol_terms; }
     int8_t get_coefficient(const symbol_t &s) const;
@@ -54,7 +54,7 @@ class expression_t {
     bool only_has_interval() const;
     symbol_t get_singleton() const;
     interval_t get_constant_term() const { return _constant_term; }
-    std::shared_ptr<slacks_t> get_slacks() const { return _slacks; }
+    const std::shared_ptr<slacks_t>& get_slacks() const { return _slacks; }
     void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
     std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
     friend std::ostream& operator<<(std::ostream &, const expression_t&);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index a5fc4d7de..e1820dac1 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -75,19 +75,15 @@ void offset_registers_t::operator-=(register_t to_forget) {
 }
 
 bool offset_registers_t::operator<=(const offset_registers_t& other) const {
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
         auto it1 = find(*(m_cur_register_def[i]));
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
-            // currently being conservative and only checking if the types are the same
-            // refinement equal only checks for equality of type and value, but not constraints
-            // We need comparison of constraints as well
-            if (!(*it1 == *it2)) return false;
+            if (!(it1->operator<=(*it2))) return false;
         }
     }
-    // need separate handling for the registers v_begin
     return true;
 }
 
@@ -232,8 +228,7 @@ bool offset_stack_t::operator<=(const offset_stack_t& other) const {
         auto rf2 = kv.second.first;
         auto width1 = it->second.second;
         auto width2 = kv.second.second;
-        // being conservative and only checking if the types are the same
-        if (!(rf1 == rf2) || width1 != width2) return false;
+        if (!(rf1 <= rf2) || width1 != width2) return false;
     }
     return true;
 }
@@ -455,11 +450,11 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
         }
         auto begin = m_registers.find(register_t{BEGIN_REG});
         if (cond.op == Condition::Op::LE) {
-            begin->add_constraint(*rf_left <= *rf_right);
+            begin->add_constraint(rf_left->assume_le(*rf_right));
             m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GT) {
-            begin->add_constraint(*rf_left > *rf_right);
+            begin->add_constraint(rf_left->assume_gt(*rf_right));
             m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
         }
         // other comparisons not supported
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 2abe81184..6eca3e652 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -174,10 +174,24 @@ bool refinement_t::same_type(const refinement_t &other) const {
     return _type == other._type && _type != refinement_type_t::ANY;
 }
 
+
+// inclusion operator
+bool refinement_t::operator<=(const refinement_t &other) const {
+    if (!has_constraints) {
+        return _value <= other._value;
+    }
+    return _value <= other._value &&
+           meta_begin_constraint <= other.meta_begin_constraint &&
+           begin_end_constraint <= other.begin_end_constraint;
+}
+
 refinement_t refinement_t::widen(const refinement_t &other) const {
-    assert(same_type(other));
-    auto widened_value = _value.widen(other._value);
-    return refinement_t(_type, widened_value);
+    if (!has_constraints) {
+        return refinement_t(_type, _value.widen(other._value));
+    }
+    return refinement_t(_type, _value.widen(other._value),
+                        meta_begin_constraint.widen(other.meta_begin_constraint),
+                        begin_end_constraint.widen(other.begin_end_constraint));
 }
 
 refinement_t refinement_t::operator|(const refinement_t &other) const {
@@ -189,12 +203,14 @@ refinement_t refinement_t::operator|(const refinement_t &other) const {
                         begin_end_constraint | other.begin_end_constraint);
 }
 
-constraint_t refinement_t::operator<=(const refinement_t &other) const {
+// assume that the current refinement is less than or equal to the other refinement
+constraint_t refinement_t::assume_le(const refinement_t &other) const {
     return constraint_t(_value, other._value);
 }
 
-constraint_t refinement_t::operator>(const refinement_t &other) const {
-    return operator<=(other).negate();
+// assume that the current refinement is greater than the other refinement
+constraint_t refinement_t::assume_gt(const refinement_t &other) const {
+    return assume_le(other).negate();
 }
 
 constraint_t refinement_t::construct_meta_end_constraint() const {
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index ca81b27b6..2ec8faaeb 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -39,8 +39,9 @@ class refinement_t {
     refinement_t operator-(const refinement_t &other) const;
     refinement_t operator|(const refinement_t &other) const;
     refinement_t widen(const refinement_t &other) const;
-    constraint_t operator<=(const refinement_t &other) const;
-    constraint_t operator>(const refinement_t &other) const;
+    bool operator<=(const refinement_t &other) const;
+    constraint_t assume_le(const refinement_t &other) const;
+    constraint_t assume_gt(const refinement_t &other) const;
     bool operator==(const refinement_t &other) const;
     void write(std::ostream &o) const;
     bool same_type(const refinement_t &other) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index db32a603b..b204b9901 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -125,7 +125,7 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
 }
 
 bool region_registers_t::operator<=(const region_registers_t& other) const {
-    for (uint8_t i = 0; i < NUM_REGISTERS-1; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
         auto maybe_ptr1 = find(register_t{i});
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index fb760cf4e..156d61c9f 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -96,7 +96,7 @@ signed_interval_registers_t signed_interval_registers_t::widen(const signed_inte
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2)););
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2));
         }
     }
     return refinements_joined;
@@ -439,8 +439,7 @@ void signed_interval_domain_t::store_in_stack(uint64_t key, interval_t interval,
 }
 
 bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
-    return (m_registers <= abs.m_registers) &&
-        (m_stack <= abs.m_stack);
+    return (m_registers <= abs.m_registers && m_stack <= abs.m_stack);
 }
 
 void signed_interval_domain_t::operator|=(const signed_interval_domain_t& abs) {
@@ -495,7 +494,7 @@ signed_interval_domain_t signed_interval_domain_t::widen(const signed_interval_d
         return *this;
     }
     return signed_interval_domain_t(m_registers.widen(other.m_registers),
-            m_stack.widen(other.m_stack));
+            m_stack.widen(other.m_stack), m_slacks);
 }
 
 signed_interval_domain_t signed_interval_domain_t::narrow(const signed_interval_domain_t& other) const {
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index e118d222d..90d29fdf8 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -41,7 +41,7 @@ bool inference_domain_t::operator<=(const inference_domain_t& abs) const {
 inference_domain_t inference_domain_t::widen(const inference_domain_t& other, bool to_constants) {
     return inference_domain_t(m_region.widen(other.m_region, to_constants),
             m_offset.widen(other.m_offset, to_constants),
-            m_interval.widen(other.m_interval, to_constants));
+            m_interval.widen(other.m_interval, to_constants), m_slacks);
 }
 
 void inference_domain_t::operator|=(const inference_domain_t& abs) {
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index 06b5b774b..fef087158 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -55,7 +55,8 @@ bool unsigned_interval_registers_t::operator<=(const unsigned_interval_registers
         auto it1 = find(*(m_cur_register_def[i]));
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
-            if (!(it1->to_interval() <= it2->to_interval())) return false;
+            refinement_t rf1 = it1.value(), rf2 = it2.value();
+            if (!(rf1 <= rf2)) return false;
         }
     }
     return true;
@@ -81,7 +82,7 @@ unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const uns
     return refinements_joined;
 }
 
-unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigned_interval_registers_t& other, bool to_constants) const {
+unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigned_interval_registers_t& other) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -95,7 +96,7 @@ unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigne
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2)));
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2));
         }
     }
     return refinements_joined;
@@ -205,7 +206,7 @@ using RefinementJoin = std::function<refinement_t(const refinement_t&, const ref
 
 static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t key1, int& loc1,
         const unsigned_interval_stack_t& stack2, uint64_t key2, int& loc2,
-        unsigned_interval_stack_cells_t& refinements_joined, const IntervalFunction& joinFunc) {
+        unsigned_interval_stack_cells_t& refinements_joined, RefinementJoin joinFunc) {
 
     auto type1 = stack1.find(key1);    auto type2 = stack2.find(key2);
     auto& cells1 = type1.value();   auto& cells2 = type2.value();
@@ -240,7 +241,7 @@ static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t
         else loc2++;
     }
     else {
-        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined);
+        join_stack(stack2, key2, loc2, stack1, key1, loc1, refinements_joined, joinFunc);
     }
 }
 
@@ -252,11 +253,11 @@ bool unsigned_interval_stack_t::operator<=(const unsigned_interval_stack_t& othe
         auto it = m_cells.find(key);
         if (it == m_cells.end()) return false;
         auto& cells1 = it->second; auto& cells2 = kv.second;
-        auto interval1 = cells1.first.to_interval();
-        auto interval2 = cells2.first.to_interval();
+        auto rf1 = cells1.first;
+        auto rf2 = cells2.first;
         auto width1 = cells1.second; auto width2 = cells2.second;
         if (width1 != width2) return false;
-        if (!(interval1 <= interval2)) return false;
+        if (!(rf1 <= rf2)) return false;
     }
     return true;
 }
@@ -394,8 +395,7 @@ void unsigned_interval_domain_t::store_in_stack(uint64_t key, interval_t interva
 }
 
 bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
-    return (m_registers <= abs.m_registers) &&
-        (m_stack <= abs.m_stack);
+    return (m_registers <= abs.m_registers && m_stack <= abs.m_stack);
 }
 
 void unsigned_interval_domain_t::operator|=(const unsigned_interval_domain_t& abs) {
@@ -450,7 +450,7 @@ unsigned_interval_domain_t unsigned_interval_domain_t::widen(const unsigned_inte
         return *this;
     }
     return unsigned_interval_domain_t(m_registers.widen(other.m_registers),
-            m_stack.widen(other.m_stack));
+            m_stack.widen(other.m_stack), m_slacks);
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::narrow(const unsigned_interval_domain_t& other) const {

From 9314447cb13422d9bc9d52bbe09714e23d14df22 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 22 Nov 2024 11:59:05 -0500
Subject: [PATCH 335/373] Support 64-bit immediate instruction for relocation

Relocations to rodata/global data are supported similar to how maps are
supported. Reading a variable address results in a shared region of the
size same as the variable size to be loaded.

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/asm_files.cpp                     | 52 +++++++++++++++++++++++++++
 src/asm_marshal.cpp                   | 12 ++++---
 src/asm_ostream.cpp                   |  4 ++-
 src/asm_ostream.hpp                   |  1 +
 src/asm_syntax.hpp                    |  9 ++++-
 src/asm_unmarshal.cpp                 |  9 ++++-
 src/assertions.cpp                    |  2 ++
 src/crab/abstract_domain.cpp          |  7 ++++
 src/crab/abstract_domain.hpp          |  3 ++
 src/crab/ebpf_domain.cpp              |  4 +++
 src/crab/ebpf_domain.hpp              |  1 +
 src/crab/interval_domain.cpp          |  4 +++
 src/crab/interval_domain.hpp          |  1 +
 src/crab/offset_domain.cpp            |  4 +++
 src/crab/offset_domain.hpp            |  1 +
 src/crab/region_domain.cpp            | 24 +++++++++++++
 src/crab/region_domain.hpp            |  1 +
 src/crab/signed_interval_domain.cpp   |  4 +++
 src/crab/signed_interval_domain.hpp   |  1 +
 src/crab/type_inference.cpp           |  6 ++++
 src/crab/type_inference.hpp           |  1 +
 src/crab/unsigned_interval_domain.cpp |  4 +++
 src/crab/unsigned_interval_domain.hpp |  1 +
 src/spec_type_descriptors.hpp         |  6 ++++
 24 files changed, 154 insertions(+), 8 deletions(-)

diff --git a/src/asm_files.cpp b/src/asm_files.cpp
index 0eb13c420..fe99cb838 100644
--- a/src/asm_files.cpp
+++ b/src/asm_files.cpp
@@ -84,6 +84,18 @@ static std::tuple<ELFIO::Elf64_Addr, unsigned char> get_value(const ELFIO::const
     return {value, type};
 }
 
+static ELFIO::Elf_Xword get_size(const ELFIO::const_symbol_section_accessor& symbols, const ELFIO::Elf_Xword index) {
+    string symbol_name;
+    ELFIO::Elf64_Addr value{};
+    ELFIO::Elf_Xword size{};
+    unsigned char bind{};
+    unsigned char type{};
+    ELFIO::Elf_Half section_index{};
+    unsigned char other{};
+    symbols.get_symbol(index, symbol_name, value, size, bind, type, section_index, other);
+    return size;
+}
+
 // parse_maps_sections processes all maps sections in the provided ELF file by calling the platform-specific maps'
 // parser. The section index of each maps section is inserted into section_indices.
 static size_t parse_map_sections(const ebpf_verifier_options_t* options, const ebpf_platform_t* platform,
@@ -277,6 +289,22 @@ std::map<std::string, size_t> parse_map_section(const libbtf::btf_type_data& btf
     return map_offsets;
 }
 
+// For indirect relocations, i.e., for static data, we need to find the size of the actual data.
+ELFIO::Elf_Xword get_size_for_indirect_relocation(const ELFIO::Elf64_Addr& offset_in_section,
+                                                  const ELFIO::Elf_Word lookup_section_index,
+                                                  const ELFIO::const_symbol_section_accessor& symbols) {
+    for (ELFIO::Elf_Xword i = 0; i < symbols.get_symbols_num(); i++) {
+        auto [name, current_symbol_section_index] = get_symbol_name_and_section_index(symbols, i);
+        if (current_symbol_section_index == lookup_section_index) {
+            auto [relocation_offset, relocation_type] = get_value(symbols, i);
+            if (relocation_type == ELFIO::STT_OBJECT && relocation_offset == offset_in_section) {
+                return get_size(symbols, i);
+            }
+        }
+    }
+    return 0;
+}
+
 vector<raw_program> read_elf(std::istream& input_stream, const std::string& path, const std::string& desired_section,
                              const ebpf_verifier_options_t* options, const ebpf_platform_t* platform) {
     if (options == nullptr) {
@@ -396,6 +424,7 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                 }
                 ELFIO::const_relocation_section_accessor reloc{reader, prelocs};
 
+                int relocation_fd = 0;
                 // Fetch and store relocation count locally to permit static
                 // analysis tools to correctly reason about the code below.
                 for (ELFIO::Elf_Xword i = 0; i < reloc.get_entries_num(); i++) {
@@ -434,6 +463,29 @@ vector<raw_program> read_elf(std::istream& input_stream, const std::string& path
                         continue;
                     }
 
+                    // Checking relocations for global/rodata variables (aka platform variables).
+                    auto [relocation_offset, relocation_type] = get_value(symbols, index);
+                    // We currently handle only relocations to objects (single data items),
+                    // which includes indirect relocations for static data.
+                    if (relocation_type == ELFIO::STT_SECTION || relocation_type == ELFIO::STT_OBJECT) {
+                        ELFIO::Elf_Xword relocation_size = get_size(symbols, index);
+                        // indirect relocations for static data
+                        if (relocation_type == ELFIO::STT_SECTION) {
+                            // relocation_offset represents the offset of the section.
+                            // inst.imm represents the offset into the section for the specific relocation.
+                            relocation_size = get_size_for_indirect_relocation(
+                                                                    relocation_offset + inst.imm,
+                                                                    symbol_section_index, symbols);
+                        }
+                        prog.info.relocation_descriptors.push_back({
+                            .original_fd = relocation_fd,
+                            .value_size = relocation_size
+                        });
+                        inst.imm = relocation_fd++;
+                        inst.src = 3; // magic number for LoadVariable
+                        continue;
+                    }
+
                     string unresolved_symbol = "Unresolved external symbol " + symbol_name + " in section " + name +
                                                " at location " + std::to_string(offset / sizeof(ebpf_inst));
                     unresolved_symbols_errors.push_back(unresolved_symbol);
diff --git a/src/asm_marshal.cpp b/src/asm_marshal.cpp
index 0db4ca6b8..0e8463ccf 100644
--- a/src/asm_marshal.cpp
+++ b/src/asm_marshal.cpp
@@ -88,10 +88,10 @@ static uint8_t imm_endian(const Un::Op op) {
 
 struct MarshalVisitor {
   private:
-    static vector<ebpf_inst> makeLddw(const Reg dst, const bool isFd, const int32_t imm, const int32_t next_imm) {
+    static vector<ebpf_inst> makeLddw(const Reg dst, const bool isMapFd, bool isVarFd, const int32_t imm, const int32_t next_imm) {
         return {ebpf_inst{.opcode = gsl::narrow<uint8_t>(INST_CLS_LD | width_to_opcode(8)),
                           .dst = dst.v,
-                          .src = gsl::narrow<uint8_t>(isFd ? 1 : 0),
+                          .src = gsl::narrow<uint8_t>(isMapFd ? 1 : (isVarFd ? 3 : 0)),
                           .offset = 0,
                           .imm = imm},
                 ebpf_inst{.opcode = 0, .dst = 0, .src = 0, .offset = 0, .imm = next_imm}};
@@ -106,14 +106,16 @@ struct MarshalVisitor {
         return {};
     }
 
-    vector<ebpf_inst> operator()(LoadMapFd const& b) const { return makeLddw(b.dst, true, b.mapfd, 0); }
+    vector<ebpf_inst> operator()(LoadMapFd const& b) const { return makeLddw(b.dst, true, false, b.mapfd, 0); }
+
+    vector<ebpf_inst> operator()(LoadVariable const& b) const { return makeLddw(b.dst, false, true, b.varfd, 0); }
 
     vector<ebpf_inst> operator()(Bin const& b) const {
         if (b.lddw) {
             const auto pimm = std::get_if<Imm>(&b.v);
             assert(pimm != nullptr);
             auto [imm, next_imm] = split(pimm->v);
-            return makeLddw(b.dst, false, imm, next_imm);
+            return makeLddw(b.dst, false, false, imm, next_imm);
         }
 
         ebpf_inst res{.opcode = gsl::narrow<uint8_t>((b.is64 ? INST_CLS_ALU64 : INST_CLS_ALU) | (op(b.op) << 4)),
@@ -304,7 +306,7 @@ static int size(const Instruction& inst) {
             return 2;
         }
     }
-    if (std::holds_alternative<LoadMapFd>(inst)) {
+    if (std::holds_alternative<LoadMapFd>(inst) || std::holds_alternative<LoadVariable>(inst)) {
         return 2;
     }
     return 1;
diff --git a/src/asm_ostream.cpp b/src/asm_ostream.cpp
index 961d3b009..f80dd6552 100644
--- a/src/asm_ostream.cpp
+++ b/src/asm_ostream.cpp
@@ -192,6 +192,8 @@ struct InstructionPrinterVisitor {
 
     void operator()(LoadMapFd const& b) { os_ << b.dst << " = map_fd " << b.mapfd; }
 
+    void operator()(LoadVariable const& b) { os_ << b.dst << " = var_addr " << b.varfd; }
+
     // llvm-objdump uses "w<number>" for 32-bit operations and "r<number>" for 64-bit operations.
     // We use the same convention here for consistency.
     static std::string reg_name(Reg const& a, bool is64) { return ((is64) ? "r" : "w") + std::to_string(a.v); }
@@ -383,7 +385,7 @@ int size(const Instruction& inst) {
             return 2;
         }
     }
-    if (std::holds_alternative<LoadMapFd>(inst)) {
+    if (std::holds_alternative<LoadMapFd>(inst) || std::holds_alternative<LoadVariable>(inst)) {
         return 2;
     }
     return 1;
diff --git a/src/asm_ostream.hpp b/src/asm_ostream.hpp
index ce0442ebd..755078f0b 100644
--- a/src/asm_ostream.hpp
+++ b/src/asm_ostream.hpp
@@ -56,6 +56,7 @@ inline std::ostream& operator<<(std::ostream& os, Value const& a) {
 
 inline std::ostream& operator<<(std::ostream& os, Undefined const& a) { return os << Instruction{a}; }
 inline std::ostream& operator<<(std::ostream& os, LoadMapFd const& a) { return os << Instruction{a}; }
+inline std::ostream& operator<<(std::ostream& os, LoadVariable const& a) { return os << Instruction{a}; }
 inline std::ostream& operator<<(std::ostream& os, Bin const& a) { return os << Instruction{a}; }
 inline std::ostream& operator<<(std::ostream& os, Un const& a) { return os << Instruction{a}; }
 inline std::ostream& operator<<(std::ostream& os, Call const& a) { return os << Instruction{a}; }
diff --git a/src/asm_syntax.hpp b/src/asm_syntax.hpp
index 9e7d13ab1..ecbae4d29 100644
--- a/src/asm_syntax.hpp
+++ b/src/asm_syntax.hpp
@@ -153,6 +153,13 @@ struct LoadMapFd {
     constexpr bool operator==(const LoadMapFd&) const = default;
 };
 
+/// This instruction is encoded similarly to LDDW.
+struct LoadVariable {
+    Reg dst;
+    int32_t varfd{};
+    constexpr bool operator==(const LoadVariable&) const = default;
+};
+
 struct Condition {
     enum class Op {
         EQ,
@@ -400,7 +407,7 @@ struct IncrementLoopCounter {
 };
 
 using Instruction = std::variant<Undefined, Bin, Un, LoadMapFd, Call, CallLocal, Callx, Exit, Jmp, Mem, Packet, Atomic,
-                                 Assume, Assert, IncrementLoopCounter>;
+                                 Assume, Assert, IncrementLoopCounter, LoadVariable>;
 
 using LabeledInstruction = std::tuple<label_t, Instruction, std::optional<btf_line_info_t>>;
 using InstructionSeq = std::vector<LabeledInstruction>;
diff --git a/src/asm_unmarshal.cpp b/src/asm_unmarshal.cpp
index 24086438e..f4dcf922a 100644
--- a/src/asm_unmarshal.cpp
+++ b/src/asm_unmarshal.cpp
@@ -428,7 +428,7 @@ struct Unmarshaller {
         if (next.opcode != 0 || next.dst != 0 || next.src != 0 || next.offset != 0) {
             throw InvalidInstruction(pc, "invalid lddw");
         }
-        if (inst.src > 1) {
+        if (inst.src != 0 && inst.src != 1 && inst.src != 3) {
             throw InvalidInstruction(pc, make_opcode_message("bad instruction", inst.opcode));
         }
         if (inst.offset != 0) {
@@ -446,6 +446,13 @@ struct Unmarshaller {
             }
             return LoadMapFd{.dst = Reg{inst.dst}, .mapfd = inst.imm};
         }
+        if (inst.src == 3) {
+            // magic number, we are loading a variable
+            if (next.imm != 0) {
+                throw InvalidInstruction(pc, "lddw uses reserved fields");
+            }
+            return LoadVariable{.dst = Reg{inst.dst}, .varfd = inst.imm};
+        }
 
         return Bin{
             .op = Bin::Op::MOV,
diff --git a/src/assertions.cpp b/src/assertions.cpp
index b2258691a..bedbe2357 100644
--- a/src/assertions.cpp
+++ b/src/assertions.cpp
@@ -48,6 +48,8 @@ class AssertExtractor {
 
     vector<Assert> operator()(LoadMapFd const&) const { return {}; }
 
+    vector<Assert> operator()(LoadVariable const&) const { return {}; }
+
     /// Packet access implicitly uses R6, so verify that R6 still has a pointer to the context.
     vector<Assert> operator()(Packet const&) const { return zero_offset_ctx({6}); }
 
diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index b6596aa95..da9ba3baf 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -153,6 +153,11 @@ void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadMapF
     m_abs_val.operator()(s, loc);
 }
 
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::operator()(const LoadVariable& s, location_t loc) {
+    m_abs_val.operator()(s, loc);
+}
+
 template <typename Domain>
 void abstract_domain_t::abstract_domain_model<Domain>::operator()(const Call& s, location_t loc) {
     m_abs_val.operator()(s, loc);
@@ -282,6 +287,8 @@ void abstract_domain_t::operator()(const Un& s, location_t loc) { m_concept->ope
 
 void abstract_domain_t::operator()(const LoadMapFd& s, location_t loc) { m_concept->operator()(s, loc); }
 
+void abstract_domain_t::operator()(const LoadVariable& s, location_t loc) { m_concept->operator()(s, loc); }
+
 void abstract_domain_t::operator()(const Call& s, location_t loc) { m_concept->operator()(s, loc); }
 
 void abstract_domain_t::operator()(const Exit& s, location_t loc) { m_concept->operator()(s, loc); }
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index 305d2c466..e690deee7 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -38,6 +38,7 @@ class abstract_domain_t {
         virtual void operator()(const Bin&, location_t) = 0;
         virtual void operator()(const Un&, location_t) = 0;
         virtual void operator()(const LoadMapFd&, location_t) = 0;
+        virtual void operator()(const LoadVariable&, location_t) = 0;
         virtual void operator()(const Call&, location_t) = 0;
         virtual void operator()(const Exit&, location_t) = 0;
         virtual void operator()(const Jmp&, location_t) = 0;
@@ -84,6 +85,7 @@ class abstract_domain_t {
         void operator()(const Bin& s, location_t loc = location_t::top()) override;
         void operator()(const Un& s, location_t loc = location_t::top()) override;
         void operator()(const LoadMapFd& s, location_t loc = location_t::top()) override;
+        void operator()(const LoadVariable& s, location_t loc = location_t::top()) override;
         void operator()(const Call& s, location_t loc = location_t::top()) override;
         void operator()(const Exit& s, location_t loc = location_t::top()) override;
         void operator()(const Jmp& s, location_t loc = location_t::top()) override;
@@ -130,6 +132,7 @@ class abstract_domain_t {
     void operator()(const Bin& s, location_t loc = location_t::top());
     void operator()(const Un& s, location_t loc = location_t::top());
     void operator()(const LoadMapFd& s, location_t loc = location_t::top());
+    void operator()(const LoadVariable& s, location_t loc = location_t::top());
     void operator()(const Call& s, location_t loc = location_t::top());
     void operator()(const Exit& s, location_t loc = location_t::top());
     void operator()(const Jmp& s, location_t loc = location_t::top());
diff --git a/src/crab/ebpf_domain.cpp b/src/crab/ebpf_domain.cpp
index e9bba9689..ab4f446c7 100644
--- a/src/crab/ebpf_domain.cpp
+++ b/src/crab/ebpf_domain.cpp
@@ -2254,6 +2254,10 @@ void ebpf_domain_t::do_load_mapfd(const Reg& dst_reg, const int mapfd, const boo
 
 void ebpf_domain_t::operator()(const LoadMapFd& ins, location_t loc) { do_load_mapfd(ins.dst, ins.mapfd, false); }
 
+void ebpf_domain_t::operator()(const LoadVariable& ins, location_t loc) {
+    /* WARNING: Not implemented yet */
+}
+
 void ebpf_domain_t::assign_valid_ptr(const Reg& dst_reg, const bool maybe_null) {
     using namespace crab::dsl_syntax;
     const reg_pack_t& reg = reg_pack(dst_reg);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 5f2700aba..6d09ca025 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -65,6 +65,7 @@ class ebpf_domain_t final {
     void operator()(const FuncConstraint&, location_t loc = location_t::top());
     void operator()(const Jmp&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top());
     void operator()(const Mem&, location_t loc = location_t::top());
     void operator()(const ValidDivisor&, location_t loc = location_t::top());
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index b233a2b43..b223a79b4 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -660,6 +660,10 @@ void interval_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     operator-=(register_t{u.dst.v});
 }
 
+void interval_domain_t::operator()(const LoadVariable& u, location_t loc) {
+    operator-=(register_t{u.dst.v});
+}
+
 void interval_domain_t::scratch_caller_saved_registers() {
     for (uint8_t i = R1_ARG; i <= R5_ARG; i++) {
         operator-=(register_t{i});
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 1a893e483..a6b348046 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -113,6 +113,7 @@ class interval_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
     void operator()(const Jmp&, location_t loc = location_t::top());
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index e1820dac1..4eec28ba0 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -606,6 +606,10 @@ void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_registers -= u.dst.v;
 }
 
+void offset_domain_t::operator()(const LoadVariable& u, location_t loc) {
+    m_registers -= u.dst.v;
+}
+
 void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
     for (const auto& kv : cells) {
         auto rf = kv.first;
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 75313d161..ec8a59003 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -147,6 +147,7 @@ class offset_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top()) {}
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b204b9901..d34b201a0 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -793,6 +793,30 @@ void region_domain_t::operator()(const LoadMapFd &u, location_t loc) {
     do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
 }
 
+static EbpfRelocationDescriptor* find_relocation_descriptor(const int relocation_fd) {
+    for (EbpfRelocationDescriptor& relocation : global_program_info->relocation_descriptors) {
+        if (relocation.original_fd == relocation_fd) {
+            return &relocation;
+        }
+    }
+    return nullptr;
+}
+
+
+void region_domain_t::operator()(const LoadVariable& u, location_t loc) {
+    const EbpfRelocationDescriptor* desc = find_relocation_descriptor(u.varfd);
+    if (desc == nullptr) {
+        throw std::runtime_error(std::string("relocation_fd not found"));
+        m_registers -= u.dst.v;
+        return;
+    } else {
+        // TODO: verify if the pointer can be null
+        auto type = ptr_with_off_t(region_t::R_SHARED, -1, interval_t{number_t{0}},
+                              nullness_t::NOT_NULL, interval_t{number_t{desc->value_size}});
+        m_registers.insert(u.dst.v, loc, type);
+    }
+}
+
 void region_domain_t::set_aliases(int v, ptr_with_off_t& ptr) {
     size_t i = 0;
     for (; i < m_shared_ptr_aliases.size(); i++) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 6cf0895cd..d4916ed7d 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -143,6 +143,7 @@ class region_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top());
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 156d61c9f..74971b558 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -609,6 +609,10 @@ void signed_interval_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     // nothing to do here
 }
 
+void signed_interval_domain_t::operator()(const LoadVariable& u, location_t loc) {
+    // nothing to do here
+}
+
 void signed_interval_domain_t::operator()(const Packet& u, location_t loc) {
     // nothing to do here
 }
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 4e414e4dc..d4d53bf6d 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -128,6 +128,7 @@ class signed_interval_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top()) {}
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 90d29fdf8..3ed611214 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -174,6 +174,12 @@ void inference_domain_t::operator()(const LoadMapFd& u, location_t loc) {
     m_interval(u, loc);
 }
 
+void inference_domain_t::operator()(const LoadVariable& u, location_t loc) {
+    m_region(u, loc);
+    m_offset(u, loc);
+    m_interval(u, loc);
+}
+
 // Construct a Bin operation that does the main operation that a given Atomic operation does atomically.
 static Bin atomic_to_bin(const Atomic& a) {
     Bin bin{
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 3e03e7ddf..14183a8c2 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -80,6 +80,7 @@ class inference_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top());
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const CallLocal&, location_t loc = location_t::top()) {}
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index fef087158..cce460899 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -566,6 +566,10 @@ void unsigned_interval_domain_t::operator()(const LoadMapFd &u, location_t loc)
     // nothing to do here
 }
 
+void unsigned_interval_domain_t::operator()(const LoadVariable &u, location_t loc) {
+    // nothing to do here
+}
+
 void unsigned_interval_domain_t::operator()(const Packet& u, location_t loc) {
     // nothing to do here
 }
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 4d203ded6..7821c157d 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -126,6 +126,7 @@ class unsigned_interval_domain_t final {
     void operator()(const Bin&, location_t loc = location_t::top());
     void operator()(const Un&, location_t loc = location_t::top());
     void operator()(const LoadMapFd&, location_t loc = location_t::top());
+    void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Call&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
     void operator()(const Jmp&, location_t loc = location_t::top());
diff --git a/src/spec_type_descriptors.hpp b/src/spec_type_descriptors.hpp
index 8ed4d84da..02d15b20f 100644
--- a/src/spec_type_descriptors.hpp
+++ b/src/spec_type_descriptors.hpp
@@ -30,6 +30,11 @@ struct EbpfMapDescriptor {
     unsigned int inner_map_fd;
 };
 
+struct EbpfRelocationDescriptor {
+    int original_fd;
+    long unsigned int value_size;
+};
+
 constexpr unsigned int DEFAULT_MAP_FD = 0xffffffff;
 
 struct EbpfProgramType {
@@ -50,6 +55,7 @@ struct program_info {
     std::vector<EbpfMapDescriptor> map_descriptors{};
     EbpfProgramType type{};
     std::map<EquivalenceKey, int> cache{};
+    std::vector<EbpfRelocationDescriptor> relocation_descriptors{};
 };
 
 struct btf_line_info_t {

From 8d8c2e2c621211f71f5000e3b6defc68efc39afa Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 10 Dec 2024 05:28:59 -0500
Subject: [PATCH 336/373] Removing some extra error messages

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index b223a79b4..fe487084b 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -297,7 +297,7 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
         auto yi_opt = m_signed.find_interval_value(y);
         auto zi_opt = m_signed.find_interval_value(z);
         if (!yi_opt || !zi_opt) {
-            std::cerr << "Error: registers not found in the interval environment\n";
+            //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
@@ -306,7 +306,7 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
         if (!yi_opt || !zi_opt) {
-            std::cerr << "Error: registers not found in the interval environment\n";
+            //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
@@ -355,14 +355,14 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
     if (is_signed) {
         auto yi_opt = m_signed.find_interval_value(y);
         if (!yi_opt) {
-            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
-            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
@@ -393,14 +393,14 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
     if (is_signed) {
         auto yi_opt = m_signed.find_interval_value(y);
         if (!yi_opt) {
-            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
-            std::cerr << "Error: register " << y << " not found in the interval environment\n";
+            //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
@@ -433,7 +433,7 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
         auto yi_opt = m_signed.find_interval_value(y);
         auto zi_opt = m_signed.find_interval_value(z);
         if (!yi_opt || !zi_opt) {
-            std::cerr << "Error: registers not found in the interval environment\n";
+            //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();
@@ -442,7 +442,7 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
         if (!yi_opt || !zi_opt) {
-            std::cerr << "Error: registers not found in the interval environment\n";
+            //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
         yi = yi_opt->get_interval_value();

From 4bdfda42574f545a86e97a754c23558984f8e814 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 10 Dec 2024 05:29:56 -0500
Subject: [PATCH 337/373] Adding the GE and LT cases to Assume in Offset D

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 4eec28ba0..fbbcc9434 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -457,6 +457,14 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             begin->add_constraint(rf_left->assume_gt(*rf_right));
             m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
         }
+        else if (cond.op == Condition::Op::GE) {
+            begin->add_constraint(rf_right->assume_le(*rf_left));
+            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+        }
+        else if (cond.op == Condition::Op::LT) {
+            begin->add_constraint(rf_right->assume_gt(*rf_left));
+            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+        }
         // other comparisons not supported
     }
 }

From b7e86a718e3bdf6a975fc8af0fe1e05ab0700cc9 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 10 Dec 2024 05:44:40 -0500
Subject: [PATCH 338/373] Added a very specific heuristic

Very specific heuristic added to make one benchmark work, however it can
be a generic check with some changes and could be helpful

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 6eca3e652..fb55004e8 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -148,6 +148,33 @@ static constraint_t solve_constraints(constraint_t c1, constraint_t c2) {
         // e.g., c1 := begin + 14 <= end and c2 := begin + 18 <= end
         return c2;
     }
+    // some heuristic to resolve certain cases like the following:
+    // c1 := begin + 34 <= end and c2 := begin + a_0 + 18 <= end, a_0 in [0, 60]
+    // it will not fall in any category above
+    // We can prefer to keep c2 in this case as it might contain more information than c1
+    // as it contains a slack variable a_0
+    expression_t c2_lhs = c2.get_lhs();
+    expression_t c1_lhs = c1.get_lhs();
+    auto c2_slacks = c2_lhs.get_slack_intervals();
+    auto c1_slacks = c1_lhs.get_slack_intervals();
+    if (!c2_slacks.empty() && c1_slacks.empty()) {
+        // very specific heuristic but could be beneficial if expressed properly
+        // TODO: fix later
+        expression_t c2_eq = c2_lhs.get_equivalent_expression();
+        interval_t c2_interval = c2_eq.get_constant_term();
+        auto symbol_terms = c2_eq.get_symbol_terms();
+        if (c2_interval.singleton()) {
+            return c1;
+        }
+        auto lb = interval_t{c2_interval.lb()};
+        auto ub = interval_t{c2_interval.ub()};
+        expression_t lb_c2 = expression_t{symbol_terms, lb};
+        expression_t ub_c2 = expression_t{symbol_terms, ub};
+        if (c1.implies(constraint_t(lb_c2)) && constraint_t(ub_c2).implies(c1)) {
+            return c2;
+        }
+        return c1;
+    }
     // c1 and c2 are not comparable, i.e., c2 is providing information not affecting c1
     // e.g., c1 := begin + 14 <= end and c2 := begin + 18 > end
     return c1;

From 26cf8cf262855b5643df5a6b53d43ab83a195aad Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 20 Jun 2025 01:53:41 -0400
Subject: [PATCH 339/373] Refactoring

Removed the logic for mock_interval_t and directly store intervals into
the data structures;
Added API to ptr_with_off_t for cleaner code;
Cleaned up some comments;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp      |  2 +-
 src/crab/constraint.hpp      |  2 +-
 src/crab/expression.cpp      | 32 ++++++++++++------
 src/crab/expression.hpp      |  4 +--
 src/crab/interval_domain.cpp |  4 +--
 src/crab/offset_domain.cpp   |  4 +--
 src/crab/refinement.cpp      | 10 +++---
 src/crab/refinement.hpp      |  4 +--
 src/crab/region_domain.cpp   | 29 ++++++++---------
 src/crab/register_utils.hpp  |  3 +-
 src/crab/type_inference.cpp  | 26 +++++++--------
 src/crab/types.cpp           | 55 ++++++++++++-------------------
 src/crab/types.hpp           | 63 +++++++++++++++---------------------
 13 files changed, 112 insertions(+), 126 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 74e590661..60e5b21c4 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -16,7 +16,7 @@ bool constraint_t::contains(const symbol_t &s) const {
 }
 
 // get slack intervals for all symbols in the constraint
-std::map<symbol_t, mock_interval_t> constraint_t::get_slack_intervals() const {
+std::map<symbol_t, interval_t> constraint_t::get_slack_intervals() const {
     return _lhs.get_slack_intervals();
 }
 
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index 849b3ca84..c2724aff7 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -34,7 +34,7 @@ class constraint_t {
     bool is_meta_begin_constraint() const;
     bool is_begin_end_constraint() const;
     [[nodiscard]] expression_t get_lhs() const { return _lhs; }
-    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
+    std::map<symbol_t, interval_t> get_slack_intervals() const;
     bool contains(const symbol_t&) const;
     bool implies(const constraint_t&) const;
     constraint_t operator+(constraint_t) const;
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index a5fc82799..e0e0f8354 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -11,12 +11,16 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
 }
 
 // get values for all slack variables in the expression
-std::map<symbol_t, mock_interval_t> expression_t::get_slack_intervals() const {
-    std::map<symbol_t, mock_interval_t> slack_intervals;
+std::map<symbol_t, interval_t> expression_t::get_slack_intervals() const {
+    std::map<symbol_t, interval_t> slack_intervals;
     for (const auto &term : _symbol_terms) {
         if (term.first.is_slack()) {
             // assuming that there are no conflicting values
-            slack_intervals[term.first] = (*_slacks)[term.first];
+            // TODO: check what to do in case value is not found
+            auto it = _slacks->find(term.first);
+            if (it != _slacks->end()) {
+                slack_intervals.insert_or_assign(term.first, it->second);
+            }
         }
     }
     return slack_intervals;
@@ -36,7 +40,11 @@ expression_t expression_t::get_equivalent_expression() const {
     symbol_terms_t symbol_terms;
     for (const auto &term : _symbol_terms) {
         if (term.first.is_slack()) {
-            value = value + ((*_slacks)[term.first]).to_interval() * interval_t{static_cast<int>(term.second)};
+            auto it = _slacks->find(term.first);
+            // TODO: check what to do in case value is not found
+            if (it != _slacks->end()) {
+                value = value + (it->second * interval_t{static_cast<int>(term.second)});
+            }
         } else {
             symbol_terms[term.first] = term.second;
         }
@@ -184,8 +192,11 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
             new_terms[term.first] = term.second;
         } else if (term.first.is_slack()) {
             // either the symbol was not found in the e2 expression, or the coefficients are different
-            e1_constant_term = e1_constant_term +
-                interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
+            auto it = slacks->find(term.first);
+            if (it != slacks->end()) {
+                e1_constant_term = e1_constant_term +
+                    (interval_t{static_cast<int>(term.second)} * it->second);
+            }
         }
         else {
             // in case where we have symbols other than slack variables, and either the symbol is not
@@ -200,8 +211,11 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
         }
         if (term.first.is_slack()) {
             // the slack variable was not handled before, hence we resolve its value
-            e2_constant_term = e2_constant_term +
-                interval_t{static_cast<int>(term.second)} * (*slacks)[term.first].to_interval();
+            auto it = slacks->find(term.first);
+            if (it != slacks->end()) {
+                e2_constant_term = e2_constant_term +
+                    (interval_t{static_cast<int>(term.second)} * it->second);
+            }
         }
         else {
             // in case where we have symbols other than slack variables, and either the symbol is not
@@ -214,7 +228,7 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
     symbol_t new_slack = symbol_t::make();
     new_terms[new_slack] = 1;
     // either join or widen
-    (*slacks)[new_slack] = join(e1_constant_term, e2_constant_term);
+    slacks->insert_or_assign(new_slack, join(e1_constant_term, e2_constant_term));
     return expression_t(new_terms, interval_t{0}, slacks);
 }
 
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 61066f0a8..18e233ef8 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -12,7 +12,7 @@ namespace crab {
 // x, y, z, ... are symbols, and A, B, C, ... are coefficients.
 // I is an interval.
     
-using slacks_t = std::map<symbol_t, mock_interval_t>;
+using slacks_t = std::map<symbol_t, interval_t>;
 using symbol_terms_t = std::map<symbol_t, int8_t>;
 class expression_t {
   private:
@@ -56,7 +56,7 @@ class expression_t {
     interval_t get_constant_term() const { return _constant_term; }
     const std::shared_ptr<slacks_t>& get_slacks() const { return _slacks; }
     void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
-    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
+    std::map<symbol_t, interval_t> get_slack_intervals() const;
     friend std::ostream& operator<<(std::ostream &, const expression_t&);
 
     static expression_t begin(std::shared_ptr<slacks_t> slacks = nullptr) {
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index fe487084b..52a4af942 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1431,7 +1431,7 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
     if (is_stack_ptr(basereg_type)) {
         auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
         auto p_offset = ptr_with_off.get_offset();
-        auto load_at = p_offset.to_interval() + interval_t(number_t{offset});
+        auto load_at = p_offset + interval_t(number_t{offset});
         if (load_from_stack(target_register, load_at, width, loc)) return;
     }
     operator-=(target_register);
@@ -1452,7 +1452,7 @@ void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>
     }
 
     auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(*basereg_type);
-    auto offset_singleton = basereg_ptr_with_off_type.get_offset().to_interval().singleton();
+    auto offset_singleton = basereg_ptr_with_off_type.get_offset().singleton();
     if (!offset_singleton) {
         m_errors.push_back("doing a store with unknown offset");
         return;
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index fbbcc9434..7d2e0c82d 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -688,7 +688,7 @@ void offset_domain_t::do_mem_store(const Mem& b,
     int offset = b.access.offset;
     int width = b.access.width;
     auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
-    auto basereg_off_singleton = basereg_with_off.get_offset().to_interval().singleton();
+    auto basereg_off_singleton = basereg_with_off.get_offset().singleton();
     if (!basereg_off_singleton) return;
     auto store_at = (*basereg_off_singleton + offset).cast_to<uint64_t>();
     auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
@@ -718,7 +718,7 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
     int offset = b.access.offset;
     auto type_with_off = std::get<ptr_with_off_t>(*basereg_type);
     auto p_offset = type_with_off.get_offset();
-    auto offset_singleton = p_offset.to_interval().singleton();
+    auto offset_singleton = p_offset.singleton();
     if (is_stack_p) {
         if (!offset_singleton) {
             for (auto const& k : m_stack.get_keys()) {
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index fb55004e8..ca430023c 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -26,8 +26,8 @@ interval_t refinement_t::get_interval_value() const {
     return interval_t::bottom();
 }
 
-std::map<symbol_t, mock_interval_t> refinement_t::get_slack_intervals() const {
-    std::map<symbol_t, mock_interval_t> slack_intervals = _value.get_slack_intervals();
+std::map<symbol_t, interval_t> refinement_t::get_slack_intervals() const {
+    std::map<symbol_t, interval_t> slack_intervals = _value.get_slack_intervals();
     if (has_constraints) {
         slack_intervals.merge(meta_begin_constraint.get_slack_intervals());
         slack_intervals.merge(begin_end_constraint.get_slack_intervals());
@@ -36,7 +36,7 @@ std::map<symbol_t, mock_interval_t> refinement_t::get_slack_intervals() const {
 }
 
 void refinement_t::write(std::ostream& o) const {
-    std::map<symbol_t, mock_interval_t> slack_intervals = get_slack_intervals();
+    std::map<symbol_t, interval_t> slack_intervals = get_slack_intervals();
     bool has_extra_info = has_constraints || !slack_intervals.empty();
     if (has_extra_info) o << "{";
     if (is_numeric_refinement()) {
@@ -57,8 +57,8 @@ void refinement_t::write(std::ostream& o) const {
     if (n > 0 && has_constraints) {
         o << " & ";
     }
-    for (auto [s, mock_interv] : slack_intervals) {
-        o << s << " in " << mock_interv.to_interval();
+    for (auto [s, interv] : slack_intervals) {
+        o << s << " in " << interv;
         if (i < n - 1) {
             o << " & ";
         }
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 2ec8faaeb..3f713acf0 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -51,7 +51,7 @@ class refinement_t {
     bool is_numeric_refinement() const;
     bool is_packet_refinement() const;
     interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&) const;
-    std::map<symbol_t, mock_interval_t> get_slack_intervals() const;
+    std::map<symbol_t, interval_t> get_slack_intervals() const;
     void add_constraint(constraint_t);
     friend std::ostream &operator<<(std::ostream &, const refinement_t&);
 
@@ -80,7 +80,7 @@ class refinement_t {
 
     static refinement_t numeric_refinement(interval_t i, std::shared_ptr<slacks_t> slacks) {
         symbol_t s = symbol_t::make();
-        (*slacks)[s] = i;
+        slacks->insert_or_assign(s, i);
         return numeric_refinement(expression_t(s, slacks));
     }
 
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index d34b201a0..267467cc4 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -224,7 +224,7 @@ bool region_registers_t::is_top() const {
 
 void region_registers_t::insert(register_t reg, const location_t& loc, const ptr_or_mapfd_t& type) {
     register_location_t register_location = register_location_t{reg, loc};
-    (*m_registers_env)[register_location] = type;
+    m_registers_env->insert_or_assign(register_location, type);
     m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
@@ -406,7 +406,7 @@ bool region_stack_t::is_top() const {
 }
 
 void region_stack_t::store(uint64_t key, ptr_or_mapfd_t value, int width) {
-    m_cells[key] = std::make_pair(value, width);
+    m_cells.insert_or_assign(key, std::make_pair(value, width));
 }
 
 size_t region_stack_t::size() const {
@@ -697,7 +697,7 @@ bool region_domain_t::get_map_fd_range(const Reg& map_fd_reg, int32_t* start_fd,
     auto maybe_type = m_registers.find(map_fd_reg.v);
     if (!is_mapfd_type(maybe_type)) return false;
     auto mapfd_type = std::get<mapfd_t>(*maybe_type);
-    const auto& mapfd_interval = mapfd_type.get_mapfd().to_interval();
+    const auto& mapfd_interval = mapfd_type.get_mapfd();
     auto lb = mapfd_interval.lb().number();
     auto ub = mapfd_interval.ub().number();
     if (!lb || !lb->fits<int32_t>() || !ub || !ub->fits<int32_t>())
@@ -811,7 +811,7 @@ void region_domain_t::operator()(const LoadVariable& u, location_t loc) {
         return;
     } else {
         // TODO: verify if the pointer can be null
-        auto type = ptr_with_off_t(region_t::R_SHARED, -1, interval_t{number_t{0}},
+        auto type = ptr_with_off_t(region_t::R_SHARED, interval_t{number_t{0}}, -1,
                               nullness_t::NOT_NULL, interval_t{number_t{desc->value_size}});
         m_registers.insert(u.dst.v, loc, type);
     }
@@ -866,16 +866,16 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                         goto out;
                     }
                 } else {
-                    auto type = ptr_with_off_t(region_t::R_SHARED, -1,
-                            interval_t{number_t{0}}, nullness_t::MAYBE_NULL,
-                            get_map_value_size(*maybe_fd_reg));
+                    auto type = ptr_with_off_t::shared_region_ptr(interval_t{number_t{0}}, -1,
+                                               nullness_t::NOT_NULL,
+                                               get_map_value_size(*maybe_fd_reg));
                     set_aliases((int)r0, type);
                     m_registers.insert(r0, loc, type);
                 }
             }
         }
         else {
-            auto type = ptr_with_off_t(region_t::R_SHARED, -1, interval_t{number_t{0}},
+            auto type = ptr_with_off_t::shared_region_ptr(interval_t{number_t{0}}, -1,
                     nullness_t::MAYBE_NULL);
             set_aliases((int)r0, type);
             m_registers.insert(r0, loc, type);
@@ -917,7 +917,7 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
         if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
             auto ptr_with_off_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
             auto offset = ptr_with_off_type.get_offset();
-            auto offset_to_check = offset.to_interval()+interval_t{s.offset};
+            auto offset_to_check = offset+interval_t{s.offset};
             auto offset_lb = offset_to_check.lb();
             auto offset_plus_width_ub = offset_to_check.ub()+bound_t{width};
             if (ptr_with_off_type.get_region() == region_t::R_STACK) {
@@ -968,10 +968,10 @@ region_domain_t region_domain_t::setup_entry(bool init_r1) {
     location_t loc{label_t::entry, 0};
     region_registers_t typ;
     if (init_r1) {
-        auto ctx_ptr_r1 = ptr_with_off_t(region_t::R_CTX, -1, mock_interval_t{number_t{0}});
+        auto ctx_ptr_r1 = ptr_with_off_t::ctx_region_ptr(interval_t{number_t{0}});
         typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
     }
-    auto stack_ptr_r10 = ptr_with_off_t(region_t::R_STACK, -1,  mock_interval_t{number_t{512}});
+    auto stack_ptr_r10 = ptr_with_off_t::stack_region_ptr(interval_t{number_t{512}});
     typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
 
     return region_domain_t{std::move(typ), region_stack_t::top(),
@@ -1035,8 +1035,7 @@ void region_domain_t::update_ptr_or_mapfd(const ptr_or_mapfd_t& ptr_or_mapfd, co
         location_t loc, register_t reg) {
     if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd)) {
         auto ptr_or_mapfd_with_off = std::get<ptr_with_off_t>(ptr_or_mapfd);
-        auto offset = ptr_or_mapfd_with_off.get_offset();
-        auto updated_offset = offset.to_interval() + change;
+        auto updated_offset = ptr_or_mapfd_with_off.get_offset() + change;
         ptr_or_mapfd_with_off.set_offset(updated_offset);
         m_registers.insert(reg, loc, ptr_or_mapfd_with_off);
     }
@@ -1201,7 +1200,7 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
 
     auto type_with_off = std::get<ptr_with_off_t>(*ptr_or_mapfd_opt);
     auto p_offset = type_with_off.get_offset();
-    auto offset_singleton = p_offset.to_interval().singleton();
+    auto offset_singleton = p_offset.singleton();
 
     if (!offset_singleton) {
         m_registers -= target_register;
@@ -1281,7 +1280,7 @@ void region_domain_t::do_mem_store(const Mem& b) {
 
     // if the code reaches here, we are storing into a stack pointer
     auto basereg_type_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
-    auto offset_singleton = basereg_type_with_off.get_offset().to_interval().singleton();
+    auto offset_singleton = basereg_type_with_off.get_offset().singleton();
     if (!offset_singleton) {
         //std::cout << "type error: storing to a pointer with unknown offset\n";
         m_errors.push_back("storing to a pointer with unknown offset");
diff --git a/src/crab/register_utils.hpp b/src/crab/register_utils.hpp
index 1265a06d0..20146ce66 100644
--- a/src/crab/register_utils.hpp
+++ b/src/crab/register_utils.hpp
@@ -32,7 +32,7 @@ class location_t {
     label_t m_bb_label;
     uint32_t m_line_num; // uint32_t is used to represent the line number in the eBPF program
                        // which should be sufficient for ebpf
-    location_t(label_t _label, uint32_t _offset) : m_bb_label(_label), m_line_num(_offset) {}
+    location_t(label_t _label, uint32_t _line_num) : m_bb_label(_label), m_line_num(_line_num) {}
     location_t() : m_bb_label(-2, -2), m_line_num(0) {} // not a valid location
     static location_t top() { return location_t(); }
     bool operator==(const location_t& other) const;
@@ -54,7 +54,6 @@ class register_location_t {
     void write(std::ostream& o) const;
 };
 
-// TODO: get rid of shared_ptr for register_location_t
 using live_registers_t = std::array<std::shared_ptr<register_location_t>, NUM_REGISTERS>;
 
 } // namespace crab
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 3ed611214..051554a8a 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -268,7 +268,7 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
                 auto width_interval = maybe_width_rf->get_interval_value();
 
-                auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
+                auto offset_singleton = ptr_with_off.get_offset().singleton();
                 if (!offset_singleton) {
                     //std::cout << "type error: storing at an unknown offset in stack\n";
                     m_errors.push_back("storing at an unknown offset in stack");
@@ -415,7 +415,7 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
             }
             if (s.access_type == AccessType::read && is_stack_ptr(reg_type)) {
                 auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
-                auto offset_ptr = stack_ptr.get_offset().to_interval();
+                auto offset_ptr = stack_ptr.get_offset();
                 m_interval.check_valid_access(s, std::move(offset_ptr), width, true);
             }
         }
@@ -543,7 +543,7 @@ void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
         if (is_mapfd_type(maybe_mapfd)) {
             if (is_stack_ptr(maybe_ptr_or_mapfd_basereg)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd_basereg);
-                auto offset_singleton = ptr_with_off.get_offset().to_interval().singleton();
+                auto offset_singleton = ptr_with_off.get_offset().singleton();
                 if (!offset_singleton) {
                     //std::cout << "type error: reading the stack at an unknown offset\n";
                     m_errors.push_back("reading the stack at an unknown offset");
@@ -614,8 +614,7 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
                 if (std::holds_alternative<ptr_with_off_t>(dst_ptr)) {
                     auto dst_ptr_with_off = std::get<ptr_with_off_t>(dst_ptr);
                     auto src_ptr_with_off = std::get<ptr_with_off_t>(src_ptr);
-                    subtracted = dst_ptr_with_off.get_offset().to_interval() -
-                                src_ptr_with_off.get_offset().to_interval();
+                    subtracted = dst_ptr_with_off.get_offset() - src_ptr_with_off.get_offset();
                 }
                 else if (std::holds_alternative<packet_ptr_t>(dst_ptr)) {
                     register_t src_reg = std::get<Reg>(bin.v).v;
@@ -859,7 +858,7 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
 
     auto create_interval = [](std::string lb, std::string ub) {
         if (lb == "" && ub == "") {
-            return crab::mock_interval_t::top();
+            return crab::interval_t::top();
         }
         bound_t lb_num = bound_t::minus_infinity();
         if (lb != "-oo") {
@@ -881,16 +880,15 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
             }
         }
         else if (ub == "+oo") ub_num = bound_t::plus_infinity();
-        return crab::mock_interval_t{lb_num, ub_num};
+        return crab::interval_t{lb_num, ub_num};
     };
 
     auto create_ptr = [create_interval](std::string region, std::string off_lb,
             std::string off_ub, std::string region_sz_lb = "", std::string region_sz_ub = "") {
         auto region_type = string_to_region(region);
-        auto mock_offset = create_interval(off_lb, off_ub);
-        auto mock_region_size = create_interval(region_sz_lb, region_sz_ub);
-        return crab::ptr_with_off_t{region_type, -1, mock_offset, nullness_t::MAYBE_NULL,
-            mock_region_size};
+        auto offset = create_interval(off_lb, off_ub);
+        auto region_size = create_interval(region_sz_lb, region_sz_ub);
+        return crab::ptr_with_off_t{region_type, offset, -1, nullness_t::MAYBE_NULL, region_size};
     };
 
     auto create_mapfd = [create_interval](std::string mapfd_type, std::string lb_mapfd,
@@ -907,7 +905,7 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
     /*
     auto create_pkt_offset = [create_interval](std::string offset_type, std::string offset_lb,
             std::string offset_ub) {
-        auto offset = create_interval(offset_lb, offset_ub).to_interval();
+        auto offset = create_interval(offset_lb, offset_ub);
         if (offset_type == "begin") {
             return dist_t{offset};
         }
@@ -954,12 +952,12 @@ inference_domain_t inference_domain_t::from_predefined_types(const std::set<std:
         }
         else if (regex_match(t, m, regex(REG ":" SNUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
-            auto num = create_interval(m[2], m[3]).to_interval();
+            auto num = create_interval(m[2], m[3]);
             //typ.insert_in_registers_in_signed_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" UNUMBER))) {
             auto reg = register_t{static_cast<uint8_t>(std::stoul(m[1]))};
-            auto num = create_interval(m[2], m[3]).to_interval();
+            auto num = create_interval(m[2], m[3]);
             //typ.insert_in_registers_in_unsigned_interval_domain(reg, loc, num);
         }
         else if (regex_match(t, m, regex(REG ":" MAPFD))) {
diff --git a/src/crab/types.cpp b/src/crab/types.cpp
index b93a516b8..91344f4df 100644
--- a/src/crab/types.cpp
+++ b/src/crab/types.cpp
@@ -20,10 +20,6 @@ inline std::string region_to_string(const region_t& r) noexcept {
     }
 }
 
-bool mock_interval_t::operator==(const mock_interval_t& other) const {
-    return (to_interval() == other.to_interval());
-}
-
 bool ptr_with_off_t::operator==(const ptr_with_off_t& other) const {
     return (m_r == other.m_r && m_offset == other.m_offset
             && m_region_size == other.m_region_size);
@@ -40,51 +36,45 @@ bool mapfd_t::operator==(const mapfd_t& other) const {
 bool mapfd_t::operator<=(const mapfd_t& other) const {
     bool map_type = m_value_type == other.m_value_type
         || other.m_value_type == EbpfMapValueType::ANY;
-    return (m_mapfd.to_interval() <= other.m_mapfd.to_interval() && map_type);
+    return (m_mapfd <= other.m_mapfd && map_type);
 }
 
 mapfd_t mapfd_t::operator|(const mapfd_t& other) const {
     auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
-    const auto& mock_i = mock_interval_t(m_mapfd.to_interval() | other.m_mapfd.to_interval());
-    return mapfd_t(std::move(mock_i), value_type);
+    return mapfd_t(m_mapfd | other.m_mapfd, value_type);
 }
 
 mapfd_t mapfd_t::widen(const mapfd_t& other) const {
     auto value_type = m_value_type == other.m_value_type ? m_value_type : EbpfMapValueType::ANY;
-    const auto& mock_i = mock_interval_t(m_mapfd.to_interval().widen(other.m_mapfd.to_interval()));
-    return mapfd_t(std::move(mock_i), value_type);
+    return mapfd_t(m_mapfd.widen(other.m_mapfd), value_type);
 }
 
 void ptr_with_off_t::set_nullness(nullness_t n) { m_nullness = n; }
 
 void ptr_with_off_t::set_id(int id) { m_id = id; }
 
-void ptr_with_off_t::set_offset(mock_interval_t off) { m_offset = off; }
+void ptr_with_off_t::set_offset(interval_t off) { m_offset = off; }
 
-void ptr_with_off_t::set_region_size(mock_interval_t region_sz) { m_region_size = region_sz; }
+void ptr_with_off_t::set_region_size(interval_t region_sz) { m_region_size = region_sz; }
 
 void ptr_with_off_t::set_region(region_t r) { m_r = r; }
 
 bool ptr_with_off_t::operator<=(const ptr_with_off_t& other) const {
     bool nullness = m_nullness == other.m_nullness || other.m_nullness == nullness_t::MAYBE_NULL;
-    return (m_r == other.m_r && m_offset.to_interval() <= other.m_offset.to_interval()
-            && m_region_size.to_interval() <= other.m_region_size.to_interval() && nullness);
+    return (m_r == other.m_r && m_offset <= other.m_offset
+            && m_region_size <= other.m_region_size && nullness);
 }
 
 ptr_with_off_t ptr_with_off_t::operator|(const ptr_with_off_t& other) const {
-    auto&& mock_o = mock_interval_t(m_offset.to_interval() | other.m_offset.to_interval());
-    auto&& mock_r_s = mock_interval_t(
-            m_region_size.to_interval() | other.m_region_size.to_interval());
-    auto&& nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
-    return ptr_with_off_t(m_r, -1, std::move(mock_o), std::move(nullness), std::move(mock_r_s));
+    auto nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
+    return ptr_with_off_t(m_r, m_offset | other.m_offset, -1, nullness,
+                          m_region_size | other.m_region_size);
 }
 
 ptr_with_off_t ptr_with_off_t::widen(const ptr_with_off_t& other) const {
-    auto&& mock_o = mock_interval_t(m_offset.to_interval().widen(other.m_offset.to_interval()));
-    auto&& mock_r_s = mock_interval_t(
-            m_region_size.to_interval().widen(other.m_region_size.to_interval()));
-    auto&& nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
-    return ptr_with_off_t(m_r, -1, std::move(mock_o), std::move(nullness), std::move(mock_r_s));
+    auto nullness = m_nullness == other.m_nullness ? m_nullness : nullness_t::MAYBE_NULL;
+    return ptr_with_off_t(m_r, m_offset.widen(other.m_offset), -1, nullness,
+                          m_region_size.widen(other.m_region_size));
 }
 
 std::ostream& operator<<(std::ostream& o, const mapfd_t& m) {
@@ -103,34 +93,31 @@ void mapfd_t::write(std::ostream& o) const {
     else {
         o << "map_fd ";
     }
-    auto mapfd = m_mapfd.to_interval();
-    if (auto mapfd_singleton = mapfd.singleton()) {
+    if (auto mapfd_singleton = m_mapfd.singleton()) {
         o << *mapfd_singleton;
     }
     else {
-        o << mapfd;
+        o << m_mapfd;
     }
 }
 
 void ptr_with_off_t::write(std::ostream& o) const {
     o << region_to_string(m_r);
-    auto offset = m_offset.to_interval();
-    auto region_size = m_region_size.to_interval();
-    if (!offset.is_top()) {
+    if (!m_offset.is_top()) {
         o << "<";
-        if (auto off_singleton = offset.singleton()) {
+        if (auto off_singleton = m_offset.singleton()) {
             o << *off_singleton;
         }
         else {
-            o << offset;
+            o << m_offset;
         }
-        if (region_size.lb() >= number_t{0}) {
+        if (m_region_size.lb() >= number_t{0}) {
             o << ",";
-            if (auto rs_singleton = region_size.singleton()) {
+            if (auto rs_singleton = m_region_size.singleton()) {
                 o << *rs_singleton;
             }
             else {
-                o << region_size;
+                o << m_region_size;
             }
         }
         o << ">";
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index 7eb3f4d58..d9e8f5fb7 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -42,12 +42,10 @@ inline std::string region_to_string(const region_t& r) noexcept;
 
 enum class nullness_t { MAYBE_NULL, NOT_NULL, _NULL };
 
-// TODO: make it part of the ptr_with_off_t class as generic pointers
 class packet_ptr_t {
     region_t m_r = region_t::R_PACKET;
 
   public:
-    packet_ptr_t() = default;
     friend std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p);
     // because we only represent one packet pointer, we can always return true/false
     bool operator==(const packet_ptr_t&) const { return true; }
@@ -55,39 +53,30 @@ class packet_ptr_t {
     [[nodiscard]] region_t get_region() const { return m_r; }
 };
 
-class mock_interval_t {
-    bound_t _lb;
-    bound_t _ub;
-
-    public:
-        static mock_interval_t top() {
-            return mock_interval_t(bound_t::minus_infinity(), bound_t::plus_infinity());
-        }
-        [[nodiscard]] bound_t lb() const { return _lb; }
-        [[nodiscard]] bound_t ub() const { return _ub; }
-        mock_interval_t(bound_t lb, bound_t ub) : _lb(lb), _ub(ub) {};
-        mock_interval_t() : _lb(bound_t::minus_infinity()), _ub(bound_t::plus_infinity()) {}
-        mock_interval_t(const mock_interval_t& c) = default;
-        mock_interval_t(const bound_t& b) : _lb(b), _ub(b) {}
-        mock_interval_t& operator=(const mock_interval_t& o) = default;
-        bool operator==(const mock_interval_t& o) const;
-        mock_interval_t(const interval_t& i) : _lb(i.lb()), _ub(i.ub()) {}
-        interval_t to_interval() const { return interval_t(_lb, _ub); }
-};
-
 class ptr_with_off_t {
     region_t m_r;
-    int m_id;
-    mock_interval_t m_offset;
+    interval_t m_offset;
+    // following fields are used for shared pointers, default values used for other pointer types
+    int m_id = -1;
     nullness_t m_nullness = nullness_t::MAYBE_NULL;
-    mock_interval_t m_region_size = mock_interval_t::top();
+    interval_t m_region_size = interval_t::top();
 
   public:
-    ptr_with_off_t() = default;
-    ptr_with_off_t(region_t _r, int _id, mock_interval_t _off,
-            nullness_t _nullness = nullness_t::MAYBE_NULL,
-            mock_interval_t _region_sz = mock_interval_t::top())
-        : m_r(_r), m_id(_id), m_offset(_off), m_nullness(_nullness), m_region_size(_region_sz) {}
+    ptr_with_off_t(region_t _r, interval_t _off) : m_r(_r), m_offset(_off) {}
+    ptr_with_off_t(region_t _r, interval_t _off, int _id, nullness_t _nullness,
+                   interval_t _region_sz)
+        : m_r(_r), m_offset(_off), m_id(_id), m_nullness(_nullness), m_region_size(_region_sz) {}
+    static ptr_with_off_t shared_region_ptr(interval_t _offset, int _id = -1,
+                                            nullness_t _nullness = nullness_t::MAYBE_NULL,
+                                            interval_t _region_sz = interval_t::top()) {
+        return ptr_with_off_t(region_t::R_SHARED, _offset, _id, _nullness, _region_sz);
+    }
+    static ptr_with_off_t ctx_region_ptr(interval_t _offset) {
+        return ptr_with_off_t(region_t::R_CTX, _offset);
+    }
+    static ptr_with_off_t stack_region_ptr(interval_t _offset) {
+        return ptr_with_off_t(region_t::R_STACK, _offset);
+    }
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
     ptr_with_off_t widen(const ptr_with_off_t&) const;
     bool operator<=(const ptr_with_off_t&) const;
@@ -95,10 +84,10 @@ class ptr_with_off_t {
     void set_nullness(nullness_t);
     [[nodiscard]] int get_id() const { return m_id; }
     void set_id(int);
-    [[nodiscard]] mock_interval_t get_region_size() const { return m_region_size; }
-    void set_region_size(mock_interval_t);
-    [[nodiscard]] mock_interval_t get_offset() const { return m_offset; }
-    void set_offset(mock_interval_t);
+    [[nodiscard]] interval_t get_region_size() const { return m_region_size; }
+    void set_region_size(interval_t);
+    [[nodiscard]] interval_t get_offset() const { return m_offset; }
+    void set_offset(interval_t);
     [[nodiscard]] region_t get_region() const { return m_r; }
     void set_region(region_t);
     void write(std::ostream&) const;
@@ -108,7 +97,7 @@ class ptr_with_off_t {
 };
 
 class mapfd_t {
-    mock_interval_t m_mapfd;
+    interval_t m_mapfd;
     EbpfMapValueType m_value_type;
 
   public:
@@ -116,7 +105,7 @@ class mapfd_t {
     mapfd_t operator|(const mapfd_t&) const;
     mapfd_t widen(const mapfd_t&) const;
     bool operator<=(const mapfd_t&) const;
-    mapfd_t(mock_interval_t mapfd, EbpfMapValueType val_type)
+    mapfd_t(interval_t mapfd, EbpfMapValueType val_type)
         : m_mapfd(mapfd), m_value_type(val_type) {}
     friend std::ostream& operator<<(std::ostream&, const mapfd_t&);
     bool operator==(const mapfd_t&) const;
@@ -125,7 +114,7 @@ class mapfd_t {
 
     bool has_type_map_programs() const;
     [[nodiscard]] EbpfMapValueType get_value_type() const { return m_value_type; }
-    [[nodiscard]] mock_interval_t get_mapfd() const { return m_mapfd; }
+    [[nodiscard]] interval_t get_mapfd() const { return m_mapfd; }
 };
 
 using ptr_t = std::variant<packet_ptr_t, ptr_with_off_t>;

From 3d4ab524f8afffe7badb6f3599617e31321ab2c0 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 20 Jun 2025 23:02:48 -0400
Subject: [PATCH 340/373] Refactoring: cleanups and some comments added

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp |  4 ++--
 src/crab/region_domain.cpp | 25 ++++++++++++-------------
 src/crab/types.hpp         | 15 +++++++--------
 3 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 7d2e0c82d..edde7af6f 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -7,7 +7,7 @@ namespace crab {
 
 void offset_registers_t::insert(register_t reg, const location_t& loc, refinement_t rf) {
     register_location_t register_location{reg, loc};
-    (*m_registers_env)[register_location] = rf;
+    m_registers_env->insert_or_assign(register_location, rf);
     m_cur_register_def[reg] = std::make_shared<register_location_t>(register_location);
 }
 
@@ -138,7 +138,7 @@ offset_registers_t offset_registers_t::widen(const offset_registers_t& other) co
 void offset_registers_t::adjust_bb_for_registers(location_t loc) {
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (auto it = find(register_t{i})) {
-            insert(register_t{i}, loc, std::move(*it));
+            insert(register_t{i}, loc, *it);
         }
     }
 }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 267467cc4..ed5b39ed0 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -106,18 +106,18 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
                 ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                 if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
                     auto joined_ptr = ptr_with_off1 | ptr_with_off2;
-                    joined_reg_types.insert(register_t{i}, loc, std::move(joined_ptr));
+                    joined_reg_types.insert(register_t{i}, loc, joined_ptr);
                 }
             }
             else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
                     && std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
                 mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                 mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
-                joined_reg_types.insert(register_t{i}, loc, std::move(mapfd1 | mapfd2));
+                joined_reg_types.insert(register_t{i}, loc, mapfd1 | mapfd2);
             }
             else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1)
                     && std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
-                joined_reg_types.insert(register_t{i}, loc, std::move(packet_ptr_t()));
+                joined_reg_types.insert(register_t{i}, loc, packet_ptr_t());
             }
         }
     }
@@ -175,7 +175,7 @@ region_registers_t region_registers_t::widen(const region_registers_t& other) co
                 ptr_with_off_t ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                 if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
                     auto ptr_with_off = ptr_with_off1.widen(ptr_with_off2);
-                    joined_reg_types.insert(register_t{i}, loc, std::move(ptr_with_off));
+                    joined_reg_types.insert(register_t{i}, loc, ptr_with_off);
                 }
             }
             else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1)
@@ -183,11 +183,11 @@ region_registers_t region_registers_t::widen(const region_registers_t& other) co
                 mapfd_t mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                 mapfd_t mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
                 auto map_fd = mapfd1.widen(mapfd2);
-                joined_reg_types.insert(register_t{i}, loc, std::move(map_fd));
+                joined_reg_types.insert(register_t{i}, loc, map_fd);
             }
             else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1)
                     && std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
-                joined_reg_types.insert(register_t{i}, loc, std::move(packet_ptr_t()));
+                joined_reg_types.insert(register_t{i}, loc, packet_ptr_t());
             }
         }
     }
@@ -305,19 +305,18 @@ region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
                 auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
                 auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                 if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
-                    joined_stack.store(kv.first, std::move(ptr_with_off1 | ptr_with_off2),
-                            width_joined);
+                    joined_stack.store(kv.first, ptr_with_off1 | ptr_with_off2, width_joined);
                 }
             }
             else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<mapfd_t>(ptr_or_mapfd2)) {
                 auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                 auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
-                joined_stack.store(kv.first, std::move(mapfd1 | mapfd2), width_joined);
+                joined_stack.store(kv.first, mapfd1 | mapfd2, width_joined);
             }
             else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
-                joined_stack.store(kv.first, std::move(packet_ptr_t()), width_joined);
+                joined_stack.store(kv.first, packet_ptr_t(), width_joined);
             }
         }
     }
@@ -348,7 +347,7 @@ region_stack_t region_stack_t::widen(const region_stack_t& other) const {
                 auto ptr_with_off2 = std::get<ptr_with_off_t>(ptr_or_mapfd2);
                 if (ptr_with_off1.get_region() == ptr_with_off2.get_region()) {
                     auto ptr_with_off = ptr_with_off1.widen(ptr_with_off2);
-                    joined_stack.store(kv.first, std::move(ptr_with_off), width_joined);
+                    joined_stack.store(kv.first, ptr_with_off, width_joined);
                 }
             }
             else if (std::holds_alternative<mapfd_t>(ptr_or_mapfd1) &&
@@ -356,11 +355,11 @@ region_stack_t region_stack_t::widen(const region_stack_t& other) const {
                 auto mapfd1 = std::get<mapfd_t>(ptr_or_mapfd1);
                 auto mapfd2 = std::get<mapfd_t>(ptr_or_mapfd2);
                 auto mapfd = mapfd1.widen(mapfd2);
-                joined_stack.store(kv.first, std::move(mapfd), width_joined);
+                joined_stack.store(kv.first, mapfd, width_joined);
             }
             else if (std::holds_alternative<packet_ptr_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<packet_ptr_t>(ptr_or_mapfd2)) {
-                joined_stack.store(kv.first, std::move(packet_ptr_t()), width_joined);
+                joined_stack.store(kv.first, packet_ptr_t(), width_joined);
             }
         }
     }
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index d9e8f5fb7..840a59c80 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -48,6 +48,7 @@ class packet_ptr_t {
   public:
     friend std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p);
     // because we only represent one packet pointer, we can always return true/false
+    // TODO: clean this up in future
     bool operator==(const packet_ptr_t&) const { return true; }
     bool operator!=(const packet_ptr_t&) const { return false; }
     [[nodiscard]] region_t get_region() const { return m_r; }
@@ -121,11 +122,11 @@ using ptr_t = std::variant<packet_ptr_t, ptr_with_off_t>;
 
 using ptr_or_mapfd_t = std::variant<ptr_with_off_t, packet_ptr_t, mapfd_t>;
 
-inline bool is_ptr_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
+inline bool is_ptr_type(std::optional<ptr_or_mapfd_t> ptr_or_mapfd) {
     return (ptr_or_mapfd && !std::holds_alternative<mapfd_t>(*ptr_or_mapfd));
 }
 
-inline bool is_mapfd_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd) {
+inline bool is_mapfd_type(std::optional<ptr_or_mapfd_t> ptr_or_mapfd) {
     return (ptr_or_mapfd && std::holds_alternative<mapfd_t>(*ptr_or_mapfd));
 }
 
@@ -142,21 +143,21 @@ inline bool same_region(const ptr_or_mapfd_t& ptr1, const ptr_or_mapfd_t& ptr2)
     return false;
 }
 
-inline bool is_stack_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+inline bool is_stack_ptr(std::optional<ptr_or_mapfd_t> ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
             && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_STACK);
 }
 
-inline bool is_ctx_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+inline bool is_ctx_ptr(std::optional<ptr_or_mapfd_t> ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
             && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_CTX);
 }
 
-inline bool is_packet_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+inline bool is_packet_ptr(std::optional<ptr_or_mapfd_t> ptr) {
     return (ptr && std::holds_alternative<packet_ptr_t>(*ptr));
 }
 
-inline bool is_shared_ptr(const std::optional<ptr_or_mapfd_t>& ptr) {
+inline bool is_shared_ptr(std::optional<ptr_or_mapfd_t> ptr) {
     return (ptr && std::holds_alternative<ptr_with_off_t>(*ptr)
             && std::get<ptr_with_off_t>(*ptr).get_region() == region_t::R_SHARED);
 }
@@ -195,6 +196,4 @@ namespace std {
             );
         }
     };
-
-    //crab::ptr_t get_ptr(const crab::ptr_or_mapfd_t& t);
 }

From 7b32b22c3b32c7272c47270f0d179218cfafea00 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 15:51:55 -0400
Subject: [PATCH 341/373] Refactoring in multiple segments

Better entry setup for all domains;
Renamed BEGIN_PTR as R12_PKT_BEGIN for clearer semantics;
Added support for printing code locations with errors;
Better API for creating ptrs, especially shared, stack, ctx;
Better insertions into maps;
General cleanup of code, and adding better comments to transfer
functions;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp  | 32 ++++++++++++++++------------
 src/crab/offset_domain.hpp  |  8 +------
 src/crab/region_domain.cpp  | 42 ++++++++++++++++++++++---------------
 src/crab/register_utils.cpp |  7 +++++++
 src/crab/register_utils.hpp |  7 +++++--
 src/crab/type_inference.cpp | 10 +++++++--
 src/crab/type_inference.hpp |  4 ++--
 src/crab/types.hpp          | 16 ++++++++------
 8 files changed, 77 insertions(+), 49 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index edde7af6f..f069083ac 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -157,8 +157,8 @@ void offset_registers_t::forget_packet_pointers(location_t loc) {
             }
         }
     }
-    insert(BEGIN_REG, loc, refinement_t::begin_with_constraints());
-    // TODO: verify if this is all needed
+    // Reset the constraints on the packet
+    insert(R12_PKT_BEGIN, loc, refinement_t::begin_with_constraints());
 }
 
 void offset_stack_t::set_to_top() {
@@ -292,13 +292,13 @@ offset_stack_t offset_stack_t::widen(const offset_stack_t& other) const {
 offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
     if (desc == nullptr) return;
     if (desc->data >= 0) {
-        m_ctx_cells[desc->data] = refinement_t::begin(slacks);
+        m_ctx_cells.insert_or_assign(desc->data, refinement_t::begin(slacks));
     }
     if (desc->end >= 0) {
-        m_ctx_cells[desc->end] = refinement_t::end(slacks);
+        m_ctx_cells.insert_or_assign(desc->end, refinement_t::end(slacks));
     }
     if (desc->meta >= 0) {
-        m_ctx_cells[desc->meta] = refinement_t::meta(slacks);
+        m_ctx_cells.insert_or_assign(desc->meta, refinement_t::meta(slacks));
     }
     m_size = std::max(0, desc->size);
 }
@@ -320,7 +320,13 @@ std::optional<refinement_t> offset_ctx_t::find(uint64_t key) const {
 }
 
 offset_domain_t offset_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
-    return offset_domain_t{offset_registers_t{}, offset_stack_t::top(),
+    location_t loc{label_t::entry, 0};
+    offset_registers_t offset_regs;
+    const auto r12_pkt_begin = register_t{R12_PKT_BEGIN};
+    const auto type_begin_rf = refinement_t::begin_with_constraints();
+    offset_regs.insert(r12_pkt_begin, loc, type_begin_rf);
+
+    return offset_domain_t{std::move(offset_regs), offset_stack_t::top(),
             std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor, slacks),
             slacks};
 }
@@ -448,22 +454,22 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
             m_errors.push_back("one of the pointers being compared isn't packet pointer");
             return;
         }
-        auto begin = m_registers.find(register_t{BEGIN_REG});
+        auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
         if (cond.op == Condition::Op::LE) {
             begin->add_constraint(rf_left->assume_le(*rf_right));
-            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GT) {
             begin->add_constraint(rf_left->assume_gt(*rf_right));
-            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GE) {
             begin->add_constraint(rf_right->assume_le(*rf_left));
-            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::LT) {
             begin->add_constraint(rf_right->assume_gt(*rf_left));
-            m_registers.insert(register_t{BEGIN_REG}, loc, std::move(*begin));
+            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         // other comparisons not supported
     }
@@ -485,7 +491,7 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     if (!dst_expr.is_singleton() || !src_expr.is_singleton()) return interval_t::top();
     auto dst_symbol = dst_expr.get_singleton();
     auto src_symbol = src_expr.get_singleton();
-    std::optional<refinement_t> begin_rf = m_registers.find(register_t{BEGIN_REG});
+    std::optional<refinement_t> begin_rf = m_registers.find(register_t{R12_PKT_BEGIN});
     return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol);
 }
 
@@ -655,7 +661,7 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
         bool is_comparison_check) const {
-    auto begin = m_registers.find(register_t{BEGIN_REG});
+    auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
     auto reg = m_registers.find(r.v);
     if (!reg) return false;
     auto toCheck_lb = (*reg + offset).get_value();
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index ec8a59003..583d055d0 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -11,8 +11,6 @@ namespace crab {
 using check_require_func_t = std::function<bool(crab::domains::NumAbsDomain&, const crab::linear_constraint_t&, std::string)>;
 using global_env_offset_registers_t = std::unordered_map<register_location_t, refinement_t>;
 
-constexpr uint8_t BEGIN_REG = 12;
-
 class offset_registers_t {
 
     live_registers_t m_cur_register_def;
@@ -20,11 +18,7 @@ class offset_registers_t {
     bool m_is_bottom = false;
 
     public:
-        offset_registers_t() :
-            m_registers_env(std::make_shared<global_env_offset_registers_t>()) {
-            insert(BEGIN_REG, location_t{label_t::entry, 0},
-                   refinement_t::begin_with_constraints());
-        }
+        offset_registers_t() : m_registers_env(std::make_shared<global_env_offset_registers_t>()) {}
         offset_registers_t(std::shared_ptr<global_env_offset_registers_t> env)
             : m_registers_env(env) {}
         offset_registers_t(const offset_registers_t& other)
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index ed5b39ed0..75339b597 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -73,6 +73,7 @@ void region_registers_t::scratch_caller_saved_registers() {
 }
 
 void region_registers_t::forget_packet_ptrs() {
+    // skip the R12_PKT_BEGIN, as its region type will remain packet_ptr_t
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (is_packet_ptr(find(register_t{r}))) {
             operator-=(register_t{r});
@@ -686,7 +687,7 @@ void region_domain_t::operator()(const basic_block_t& bb) {
 }
 
 void region_domain_t::operator()(const Un& u, location_t loc) {
-    m_registers -= u.dst.v;
+    m_registers -= register_t{u.dst.v};
 }
 
 // Get the start and end of the range of possible map fd values.
@@ -755,10 +756,11 @@ interval_t region_domain_t::get_map_key_size(const Reg& map_fd_reg) const {
 
     interval_t result = interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
-            result = result | interval_t(number_t(map->key_size));
-        else
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t(map->key_size);
+        } else {
             return interval_t::top();
+        }
     }
     return result;
 }
@@ -806,12 +808,11 @@ void region_domain_t::operator()(const LoadVariable& u, location_t loc) {
     const EbpfRelocationDescriptor* desc = find_relocation_descriptor(u.varfd);
     if (desc == nullptr) {
         throw std::runtime_error(std::string("relocation_fd not found"));
-        m_registers -= u.dst.v;
+        m_registers -= register_t{u.dst.v};
         return;
     } else {
-        // TODO: verify if the pointer can be null
-        auto type = ptr_with_off_t(region_t::R_SHARED, interval_t{number_t{0}}, -1,
-                              nullness_t::NOT_NULL, interval_t{number_t{desc->value_size}});
+        auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::MAYBE_NULL,
+                              interval_t{number_t{desc->value_size}});
         m_registers.insert(u.dst.v, loc, type);
     }
 }
@@ -865,8 +866,7 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                         goto out;
                     }
                 } else {
-                    auto type = ptr_with_off_t::shared_region_ptr(interval_t{number_t{0}}, -1,
-                                               nullness_t::NOT_NULL,
+                    auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::NOT_NULL,
                                                get_map_value_size(*maybe_fd_reg));
                     set_aliases((int)r0, type);
                     m_registers.insert(r0, loc, type);
@@ -874,8 +874,8 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
             }
         }
         else {
-            auto type = ptr_with_off_t::shared_region_ptr(interval_t{number_t{0}}, -1,
-                    nullness_t::MAYBE_NULL);
+            // here, we only know that the return value is a pointer to a shared region
+            auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::MAYBE_NULL);
             set_aliases((int)r0, type);
             m_registers.insert(r0, loc, type);
         }
@@ -967,11 +967,19 @@ region_domain_t region_domain_t::setup_entry(bool init_r1) {
     location_t loc{label_t::entry, 0};
     region_registers_t typ;
     if (init_r1) {
-        auto ctx_ptr_r1 = ptr_with_off_t::ctx_region_ptr(interval_t{number_t{0}});
-        typ.insert(register_t{R1_ARG}, loc, ctx_ptr_r1);
-    }
-    auto stack_ptr_r10 = ptr_with_off_t::stack_region_ptr(interval_t{number_t{512}});
-    typ.insert(register_t{R10_STACK_POINTER}, loc, stack_ptr_r10);
+        const auto reg_r1 = register_t{R1_ARG};
+        const auto ctx_begin_ptr = ptr_with_off_t::ctx_region_ptr(CTX_BEGIN);
+        typ.insert(reg_r1, loc, ctx_begin_ptr);
+    }
+    const auto reg_r10 = register_t{R10_STACK_POINTER};
+    const auto stack_end_ptr = ptr_with_off_t::stack_region_ptr(STACK_END);
+    typ.insert(reg_r10, loc, stack_end_ptr);
+
+    // Initialize R12 to point to the pkt_begin pointer, which is mainly needed in offset domain;
+    // however, for consistency, the type is stored in the region domain.
+    const auto reg_r12 = register_t{R12_PKT_BEGIN};
+    const auto packet_begin_ptr = packet_ptr_t();
+    typ.insert(reg_r12, loc, packet_begin_ptr);
 
     return region_domain_t{std::move(typ), region_stack_t::top(),
         std::make_shared<region_ctx_t>(global_program_info->type.context_descriptor)};
diff --git a/src/crab/register_utils.cpp b/src/crab/register_utils.cpp
index 385380a4b..5447ef45d 100644
--- a/src/crab/register_utils.cpp
+++ b/src/crab/register_utils.cpp
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 #include "register_utils.hpp"
+#include <sstream>
 
 namespace crab {
 
@@ -22,6 +23,12 @@ void location_t::write(std::ostream& o) const {
     o << m_line_num << " in " << m_bb_label << " ";
 }
 
+std::string location_t::to_string() const {
+    std::ostringstream oss;
+    write(oss);
+    return oss.str();
+}
+
 std::ostream& operator<<(std::ostream& o, const location_t& loc) {
     loc.write(o);
     return o;
diff --git a/src/crab/register_utils.hpp b/src/crab/register_utils.hpp
index 20146ce66..f42068346 100644
--- a/src/crab/register_utils.hpp
+++ b/src/crab/register_utils.hpp
@@ -7,9 +7,11 @@
 
 namespace crab {
 
-// 11 registers for the eBPF ISA, 1 register used in offset domain to represent r_begin,
-// and 1 pseudo-register for the atomic operations
+// 11 registers for the eBPF ISA, 1 pseudo-register for the atomic operations,
+// and 1 register used in offset domain to represent r_begin.
+// r0, r1, ..., r10, r11, r_begin
 constexpr uint8_t NUM_REGISTERS = 13;
+constexpr uint8_t R12_PKT_BEGIN = 12;
 
 // Represents a register, e.g., r0, r1, ..., r_begin, etc.
 class register_t {
@@ -38,6 +40,7 @@ class location_t {
     bool operator==(const location_t& other) const;
     friend std::ostream& operator<<(std::ostream& o, const location_t& loc);
     void write(std::ostream& o) const;
+    std::string to_string() const;
 };
 
 // Represents a register and a location in the eBPF program
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 051554a8a..95be9c3f5 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -287,10 +287,16 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
     m_interval.do_call(u, stack_values, loc);
 }
 
+void inference_domain_t::operator()(const ValidCall& u, location_t loc) {
+    // WARNING: Not implemented yet
+}
+
 void inference_domain_t::operator()(const Callx &u, location_t loc) {
     // WARNING: Not implemented yet
-    // This operation is not needed for current benchmarks,
-    // TODO: implement this if needed
+}
+
+void inference_domain_t::operator()(const CallLocal& u, location_t loc) {
+    // WARNING: Not implemented yet
 }
 
 void inference_domain_t::operator()(const Exit& u, location_t loc) {
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 14183a8c2..b8b90761a 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -83,7 +83,7 @@ class inference_domain_t final {
     void operator()(const LoadVariable&, location_t loc = location_t::top());
     void operator()(const Atomic&, location_t loc = location_t::top());
     void operator()(const Call&, location_t loc = location_t::top());
-    void operator()(const CallLocal&, location_t loc = location_t::top()) {}
+    void operator()(const CallLocal&, location_t loc = location_t::top());
     void operator()(const Callx&, location_t loc = location_t::top());
     void operator()(const Exit&, location_t loc = location_t::top());
     void operator()(const Jmp&, location_t loc = location_t::top());
@@ -97,7 +97,7 @@ class inference_domain_t final {
     void operator()(const ValidStore&, location_t loc = location_t::top());
     void operator()(const TypeConstraint&, location_t loc = location_t::top());
     void operator()(const ValidSize&, location_t loc = location_t::top());
-    void operator()(const ValidCall&, location_t loc = location_t::top()) {}
+    void operator()(const ValidCall&, location_t loc = location_t::top());
     void operator()(const ValidMapKeyValue&, location_t loc = location_t::top());
     void operator()(const ZeroCtxOffset&, location_t loc = location_t::top());
     void operator()(const ValidDivisor&, location_t loc = location_t::top());
diff --git a/src/crab/types.hpp b/src/crab/types.hpp
index 840a59c80..2c662c9d5 100644
--- a/src/crab/types.hpp
+++ b/src/crab/types.hpp
@@ -12,6 +12,7 @@
 namespace crab {
 
 constexpr int STACK_BEGIN = 0;
+constexpr int STACK_END = 512;
 constexpr int CTX_BEGIN = 0;
 constexpr int PACKET_BEGIN = 0;
 constexpr int SHARED_BEGIN = 0;
@@ -67,16 +68,19 @@ class ptr_with_off_t {
     ptr_with_off_t(region_t _r, interval_t _off, int _id, nullness_t _nullness,
                    interval_t _region_sz)
         : m_r(_r), m_offset(_off), m_id(_id), m_nullness(_nullness), m_region_size(_region_sz) {}
-    static ptr_with_off_t shared_region_ptr(interval_t _offset, int _id = -1,
+    static ptr_with_off_t shared_region_ptr(int _offset, int _id = -1,
                                             nullness_t _nullness = nullness_t::MAYBE_NULL,
                                             interval_t _region_sz = interval_t::top()) {
-        return ptr_with_off_t(region_t::R_SHARED, _offset, _id, _nullness, _region_sz);
+        interval_t offset_interval{number_t{_offset}};
+        return ptr_with_off_t(region_t::R_SHARED, offset_interval, _id, _nullness, _region_sz);
     }
-    static ptr_with_off_t ctx_region_ptr(interval_t _offset) {
-        return ptr_with_off_t(region_t::R_CTX, _offset);
+    static ptr_with_off_t ctx_region_ptr(int _offset) {
+        interval_t offset_interval{number_t{_offset}};
+        return ptr_with_off_t(region_t::R_CTX, offset_interval);
     }
-    static ptr_with_off_t stack_region_ptr(interval_t _offset) {
-        return ptr_with_off_t(region_t::R_STACK, _offset);
+    static ptr_with_off_t stack_region_ptr(int _offset) {
+        interval_t offset_interval{number_t{_offset}};
+        return ptr_with_off_t(region_t::R_STACK, offset_interval);
     }
     ptr_with_off_t operator|(const ptr_with_off_t&) const;
     ptr_with_off_t widen(const ptr_with_off_t&) const;

From d0a31581fbf2208bbcc357f814e9c27c7ccd9a85 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:37:11 -0400
Subject: [PATCH 342/373] Refactoring in ValidAccess function

Cleanup of code, better reasoning, and better reporting of errors

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp        |  6 +-
 src/crab/interval_domain.hpp        |  2 +-
 src/crab/offset_domain.cpp          | 20 +++---
 src/crab/offset_domain.hpp          |  2 +-
 src/crab/region_domain.cpp          | 98 +++++++++++++++++------------
 src/crab/region_domain.hpp          |  2 +-
 src/crab/signed_interval_domain.cpp | 38 +++--------
 src/crab/signed_interval_domain.hpp |  2 +-
 src/crab/type_inference.cpp         | 18 +++---
 9 files changed, 93 insertions(+), 95 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 52a4af942..767291c50 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1463,10 +1463,10 @@ void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>
     store_in_stack(b, store_at, width);
 }
 
-void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t&& interval,
-        int width, bool check_stack_all_numeric) {
+void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
+        location_t loc) {
     // access can be checked only in the signed domain
-    m_signed.check_valid_access(s, std::move(interval), width, check_stack_all_numeric);
+    m_signed.check_valid_access(s, interval, loc);
 }
 
 
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index a6b348046..27d52c483 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -132,7 +132,7 @@ class interval_domain_t final {
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, location_t);
-    void check_valid_access(const ValidAccess&, interval_t&&, int = -1, bool = false);
+    void check_valid_access(const ValidAccess&, interval_t, location_t);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
     void assume_signed_cst(Condition::Op, bool, const interval_t&, const interval_t&,
             const interval_t&, const interval_t&, register_t, Value, location_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index f069083ac..d653c7eed 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -664,18 +664,22 @@ bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
     auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
     auto reg = m_registers.find(r.v);
     if (!reg) return false;
-    auto toCheck_lb = (*reg + offset).get_value();
-    auto toCheck_ub = (*reg + offset + width).get_value();
-    return begin->safe_access(toCheck_lb, toCheck_ub, is_comparison_check);
+    auto check_lb = *reg + offset;
+    auto check_ub = check_lb + width;
+    return begin->safe_access(check_lb.get_value(), check_ub.get_value(), is_comparison_check);
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
-        std::optional<ptr_or_mapfd_t>& reg_type, int w) {
-    if (w == 0 || !reg_type) return;
-
+        std::optional<ptr_or_mapfd_t>& reg_type, int w, location_t loc) {
     bool is_comparison_check = s.width == (Value)Imm{0};
-    if (check_packet_access(s.reg, w, s.offset, is_comparison_check)) return;
-    m_errors.push_back("valid access check failed");
+    if (!check_packet_access(s.reg, w, s.offset, is_comparison_check)) {
+        std::string loc_str = loc.to_string();
+        if (is_comparison_check) {
+            m_errors.push_back(loc_str + ": Lower bound must be at least meta_offset and upper bound must be at most " + std::to_string(MAX_PACKET_SIZE));
+        } else {
+            m_errors.push_back(loc_str + ": Lower bound must be at least meta_offset and upper bound must be at most packet size");
+        }
+    }
 }
 
 void offset_domain_t::operator()(const Assert &u, location_t loc) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 583d055d0..d0fb8eced 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -165,7 +165,7 @@ class offset_domain_t final {
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     bool check_packet_access(const Reg&, int, int, bool) const;
-    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int);
+    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int, location_t);
     interval_t compute_packet_subtraction(register_t, register_t) const;
 
     std::vector<uint64_t> get_ctx_keys() const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 75339b597..770c8d0c0 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -907,56 +907,72 @@ void region_domain_t::operator()(const Packet& u, location_t loc) {
     m_registers.scratch_caller_saved_registers();
 }
 
-void region_domain_t::check_valid_access(const ValidAccess &s, int width) {
+void region_domain_t::check_valid_access(const ValidAccess &s, int width, location_t loc) {
     bool is_comparison_check = s.width == (Value)Imm{0};
-
-    auto maybe_ptr_or_mapfd_type = m_registers.find(s.reg.v);
-    if (maybe_ptr_or_mapfd_type) {
-        auto reg_ptr_or_mapfd_type = *maybe_ptr_or_mapfd_type;
-        if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
-            auto ptr_with_off_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
-            auto offset = ptr_with_off_type.get_offset();
-            auto offset_to_check = offset+interval_t{s.offset};
-            auto offset_lb = offset_to_check.lb();
-            auto offset_plus_width_ub = offset_to_check.ub()+bound_t{width};
-            if (ptr_with_off_type.get_region() == region_t::R_STACK) {
-                if (bound_t{STACK_BEGIN} <= offset_lb
-                        && offset_plus_width_ub <= bound_t{EBPF_STACK_SIZE})
-                    return;
+    std::string loc_str = loc.to_string();
+    // we reach here only if the register is a pointer or mapfd
+    auto reg_ptr_or_mapfd_type = *(m_registers.find(s.reg.v));
+    if (std::holds_alternative<ptr_with_off_t>(reg_ptr_or_mapfd_type)) {
+        auto ptr_with_off_type = std::get<ptr_with_off_t>(reg_ptr_or_mapfd_type);
+        auto offset = ptr_with_off_type.get_offset();
+        auto offset_to_check = offset+interval_t{s.offset};
+        auto offset_lb = offset_to_check.lb();
+        auto offset_plus_width_ub = offset_to_check.ub()+bound_t{width};
+        if (ptr_with_off_type.get_region() == region_t::R_STACK) {
+            if (!(bound_t{STACK_BEGIN} <= offset_lb)) {
+                m_errors.push_back(loc_str + ": Lower bound must be at least " +
+                                   std::to_string(STACK_BEGIN));
+                return;
             }
-            else if (ptr_with_off_type.get_region() == region_t::R_CTX) {
-                if (bound_t{CTX_BEGIN} <= offset_lb
-                        && offset_plus_width_ub <= bound_t{get_ctx_size()})
-                    return;
+            if (!(offset_plus_width_ub <= bound_t{EBPF_STACK_SIZE})) {
+                m_errors.push_back(loc_str + ": Upper bound must be at most " +
+                                   std::to_string(EBPF_STACK_SIZE));
+                return;
             }
-            else { // shared
-                if (crab::bound_t{SHARED_BEGIN} <= offset_lb &&
-                        offset_plus_width_ub <= ptr_with_off_type.get_region_size().lb()) {
-                    if (!is_comparison_check && !s.or_null) {
-                        auto nullness = ptr_with_off_type.get_nullness();
-                        if (nullness != nullness_t::NOT_NULL) {
-                            m_errors.push_back("possible null access");
-                        }
-                        return;
-                    }
-                    return;
-                }
+        }
+        else if (ptr_with_off_type.get_region() == region_t::R_CTX) {
+            if (!(bound_t{CTX_BEGIN} <= offset_lb)) {
+                m_errors.push_back(loc_str + ": Lower bound must be at least " +
+                                   std::to_string(CTX_BEGIN));
+                return;
+            }
+            if (!(offset_plus_width_ub <= bound_t{get_ctx_size()})) {
+                m_errors.push_back(loc_str + ": Upper bound must be at most " +
+                                   std::to_string(get_ctx_size()));
+                return;
             }
         }
-        else if (std::holds_alternative<packet_ptr_t>(reg_ptr_or_mapfd_type)) {
-            // We do not handle packet ptr access in region domain
-            return;
+        else { // shared
+            if (!(bound_t{SHARED_BEGIN} <= offset_lb)) {
+                m_errors.push_back(loc_str + ": Lower bound must be at least " +
+                                   std::to_string(SHARED_BEGIN));
+                return;
+            }
+            if (!(offset_plus_width_ub <= ptr_with_off_type.get_region_size().lb())) {
+                auto number_lb = ptr_with_off_type.get_region_size().lb().number();
+                int lb_value = number_lb->cast_to<int>();
+                m_errors.push_back(loc_str + ": Upper bound must be at most " +
+                                   std::to_string(lb_value));
+                return;
+            }
+            if (!is_comparison_check && !s.or_null) {
+                auto nullness = ptr_with_off_type.get_nullness();
+                if (nullness == nullness_t::NOT_NULL) {
+                    m_errors.push_back(loc_str + ": Possible null access");
+                }
+            }
         }
-        else {
-            // mapfd
-            if (is_comparison_check) return;
-            //std::cout << "type error: FDs cannot be dereferenced directly\n";
+    }
+    else if (std::holds_alternative<packet_ptr_t>(reg_ptr_or_mapfd_type)) {
+        // We do not handle packet ptr access in region domain
+        return;
+    }
+    else {
+        // mapfd
+        if (!is_comparison_check) {
             m_errors.push_back("FDs cannot be dereferenced directly");
         }
-        //std::cout << "type error: valid access assert fail\n";
-        m_errors.push_back("valid access assert fail");
     }
-
 }
 
 void region_domain_t::operator()(const ValidAccess &s, location_t loc) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index d4916ed7d..312347a0f 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -176,7 +176,7 @@ class region_domain_t final {
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
-    void check_valid_access(const ValidAccess &, int);
+    void check_valid_access(const ValidAccess &, int, location_t);
     void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
     void update_ptr_or_mapfd(const ptr_or_mapfd_t&, const interval_t&, location_t, register_t);
 
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 74971b558..1ae806d33 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -644,38 +644,18 @@ void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int
 }
 
 void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
-        int width, bool check_stack_all_numeric) {
-
-    if (check_stack_all_numeric) {
-        auto start_interval = interval + interval_t{number_t{s.offset}};
-        if (auto finite_size = start_interval.finite_size()) {
-            if (auto start_interval_lb = start_interval.lb().number()) {
-                auto start_offset = (*start_interval_lb).cast_to<uint64_t>();
-                int width_from_start = finite_size->cast_to<int>() + width;
-                if (!m_stack.all_numeric(start_offset, width_from_start)) {
-                    m_errors.push_back("Stack access not numeric");
-                }
-            }
-            else {
-                m_errors.push_back("Offset information not available");
+        location_t loc) {
+    std::string loc_str = loc.to_string();
+    bool is_comparison_check = s.width == (Value)Imm{0};
+    if (!is_comparison_check) {
+        if (s.or_null) {
+            if (auto singleton = interval.singleton()) {
+                if (*singleton == number_t{0}) return;
             }
+            m_errors.push_back(loc_str + ": Non-null number");
         }
         else {
-            m_errors.push_back("Register interval not finite for stack access");
-        }
-    }
-    else {
-        bool is_comparison_check = s.width == (Value)Imm{0};
-        if (!is_comparison_check) {
-            if (s.or_null) {
-                if (auto singleton = interval.singleton()) {
-                    if (*singleton == number_t{0}) return;
-                }
-                m_errors.push_back("Non-null number");
-            }
-            else {
-                m_errors.push_back("Only pointers can be dereferenced");
-            }
+            m_errors.push_back(loc_str + ": Only pointers can be dereferenced");
         }
     }
 }
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index d4d53bf6d..dc2c75093 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -145,7 +145,7 @@ class signed_interval_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void check_valid_access(const ValidAccess&, interval_t, int, bool);
+    void check_valid_access(const ValidAccess&, interval_t, location_t);
     std::optional<refinement_t> find_interval_value(register_t) const;
     std::optional<refinement_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<signed_interval_stack_cell_t> find_in_stack(uint64_t) const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 95be9c3f5..f3ca67803 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -398,13 +398,14 @@ void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
 }
 
 void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
+    std::string loc_str = loc.to_string();
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     if (reg_type) {
         interval_t width_interval = interval_t::bottom();
         if (std::holds_alternative<Reg>(s.width)) {
             auto width_rf = m_interval.find_interval_value(std::get<Reg>(s.width).v);
             if (!width_rf) {
-                m_errors.push_back("width is unknown for valid access");
+                m_errors.push_back(loc_str + ": Width is unknown for valid access");
                 return;
             }
             width_interval = width_rf->get_interval_value();
@@ -415,27 +416,24 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
         }
         if (auto width_number = width_interval.ub().number()) {
             int width = width_number->cast_to<int>();
-            m_region.check_valid_access(s, width);
             if (is_packet_ptr(reg_type)) {
-                m_offset.check_valid_access(s, reg_type, width);
+                m_offset.check_valid_access(s, reg_type, width, loc);
             }
-            if (s.access_type == AccessType::read && is_stack_ptr(reg_type)) {
-                auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
-                auto offset_ptr = stack_ptr.get_offset();
-                m_interval.check_valid_access(s, std::move(offset_ptr), width, true);
+            else {
+                m_region.check_valid_access(s, width, loc);
             }
         }
         else {
-            m_errors.push_back("width is unknown for valid access");
+            m_errors.push_back(loc_str + ": Width is unknown for valid access");
         }
     }
     else {
         auto rf_type = m_interval.find_interval_value(s.reg.v);
         if (rf_type) {
-            m_interval.check_valid_access(s, rf_type->get_interval_value());
+            m_interval.check_valid_access(s, rf_type->get_interval_value(), loc);
         }
         else {
-            m_errors.push_back("valid access on unknown register");
+            m_errors.push_back(loc_str + ": Access on unknown register");
         }
     }
 }

From 899b8a8b344ae9dc6ebf7a4f9c3eebf1e7734dbd Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:42:04 -0400
Subject: [PATCH 343/373] Refactoring in multiple transfer functions

Cleaning up code, better error reporting and better comments in
following functions: TypeConstraint, FuncConstraint, Comparable,
Addable, ValidDivisor, ValidStore

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp  | 14 ++++-----
 src/crab/region_domain.hpp  |  2 +-
 src/crab/type_inference.cpp | 62 ++++++++++++++++++++-----------------
 3 files changed, 41 insertions(+), 37 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 770c8d0c0..3e9dd2cab 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -593,7 +593,9 @@ string_invariant region_domain_t::to_set() {
     return string_invariant{};
 }
 
-void region_domain_t::operator()(const Undefined &u, location_t loc) {}
+void region_domain_t::operator()(const Undefined &u, location_t loc) {
+    // nothing to do here
+}
 
 void region_domain_t::operator()(const Exit &u, location_t loc) {}
 
@@ -676,10 +678,9 @@ void region_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {
     auto maybe_ptr_or_mapfd = m_registers.find(u.reg.v);
     if (is_ctx_ptr(maybe_ptr_or_mapfd)) {
         auto ctx_ptr = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
-        if (ctx_ptr.get_offset() == interval_t{crab::number_t{0}}) return;
+        if (ctx_ptr.get_offset() == interval_t{number_t{0}}) return;
     }
-    //std::cout << "type error: Zero Offset assertion fail\n";
-    m_errors.push_back("Zero Ctx Offset assertion fail");
+    m_errors.push_back(loc.to_string() + ": Non-zero context offset");
 }
 
 void region_domain_t::operator()(const basic_block_t& bb) {
@@ -1005,7 +1006,7 @@ void region_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::check_type(const TypeConstraint& s, bool is_numeric) {
+void region_domain_t::check_type(const TypeConstraint& s, bool is_numeric, location_t loc) {
     auto ptr_or_mapfd_opt = m_registers.find(s.reg.v);
     if (ptr_or_mapfd_opt) {
         // it is a pointer or mapfd
@@ -1050,8 +1051,7 @@ void region_domain_t::check_type(const TypeConstraint& s, bool is_numeric) {
                 || s.types == TypeGroup::mem_or_num)
             return;
     }
-    //std::cout << "type error: type constraint assert fail\n";
-    m_errors.push_back("type constraint assert fail");
+    m_errors.push_back(loc.to_string() + ": Invalid type");
 }
 
 void region_domain_t::update_ptr_or_mapfd(const ptr_or_mapfd_t& ptr_or_mapfd, const interval_t& change,
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 312347a0f..f13ba8c34 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -169,10 +169,10 @@ class region_domain_t final {
     interval_t get_map_key_size(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
-    void check_type(const TypeConstraint&, bool);
     void do_load_mapfd(const register_t&, int, location_t);
     void do_load(const Mem&, const register_t&, bool, location_t);
     void do_mem_store(const Mem&);
+    void check_type(const TypeConstraint&, bool, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index f3ca67803..ad8a7cde5 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -377,22 +377,23 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
 
 void inference_domain_t::operator()(const FuncConstraint& s, location_t loc) {
     // WARNING: Not implemented yet
-    // This operation is not needed for current benchmarks,
-    // TODO: implement this if needed
 }
 
 void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     auto maybe_ptr_or_mapfd_reg = m_region.find_ptr_or_mapfd_type(u.reg.v);
-    auto maybe_num_type_reg = m_interval.find_unsigned_interval_value(u.reg.v);
-    assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_num_type_reg.has_value());
+    auto maybe_unsigned_reg = m_interval.find_unsigned_interval_value(u.reg.v);
+    auto maybe_signed_reg = m_interval.find_signed_interval_value(u.reg.v);
+    assert(!maybe_ptr_or_mapfd_reg.has_value() || !maybe_unsigned_reg.has_value());
 
+    std::string loc_str = loc.to_string();
     if (is_ptr_type(maybe_ptr_or_mapfd_reg)) {
-        m_errors.push_back("Only numbers can be used as divisors");
+        m_errors.push_back(loc_str + ": Only numbers can be used as divisors");
     }
-    else if (maybe_num_type_reg.has_value() && !thread_local_options.allow_division_by_zero) {
-        auto num_type_reg = maybe_num_type_reg->get_interval_value();
-        if (interval_t{number_t{0}} <= num_type_reg) {
-            m_errors.push_back("Possible division by zero");
+    if (!thread_local_options.allow_division_by_zero) {
+        interval_t to_check = u.is_signed ? maybe_signed_reg->get_interval_value()
+                                          : maybe_unsigned_reg->get_interval_value();
+        if (interval_t{number_t{0}} <= to_check) {
+            m_errors.push_back(loc_str + ": Possible division by zero");
         }
     }
 }
@@ -442,7 +443,7 @@ void inference_domain_t::operator()(const TypeConstraint& s, location_t loc) {
     auto reg_type = m_region.find_ptr_or_mapfd_type(s.reg.v);
     auto rf_type = m_interval.find_interval_value(s.reg.v);
     assert(!reg_type.has_value() || !rf_type.has_value());
-    m_region.check_type(s, rf_type.has_value());
+    m_region.check_type(s, rf_type.has_value(), loc);
 }
 
 void inference_domain_t::operator()(const Assert& u, location_t loc) {
@@ -456,35 +457,39 @@ void inference_domain_t::operator()(const Comparable& u, location_t loc) {
     auto maybe_num_type2 = m_interval.find_interval_value(u.r2.v);
     assert(!maybe_ptr_or_mapfd1.has_value() || !maybe_num_type1.has_value());
     assert(!maybe_ptr_or_mapfd2.has_value() || !maybe_num_type2.has_value());
-    if (maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2) {
-        if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
-        if (same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
+    bool both_are_ptrs = maybe_ptr_or_mapfd1 && maybe_ptr_or_mapfd2;
+    bool both_are_numbers = maybe_num_type1 && maybe_num_type2;
+    if (both_are_ptrs || both_are_numbers) {
+        if (both_are_ptrs) {
+            if (is_mapfd_type(maybe_ptr_or_mapfd1) && is_mapfd_type(maybe_ptr_or_mapfd2)) return;
+            if (same_region(*maybe_ptr_or_mapfd1, *maybe_ptr_or_mapfd2)) return;
+            m_errors.push_back(loc.to_string() + ": Cannot subtract pointers to non-singleton regions");
+            return;
+        }
+        this->operator()(ValidAccess{u.r1, 0, Imm{0}, false}, loc);
+        this->operator()(ValidAccess{u.r2, 0, Imm{0}, false}, loc);
     }
-    else if (!maybe_ptr_or_mapfd2) {
-        // TODO: interval check here
-        // two numbers can be compared
-        // if r1 is a pointer, r2 must be a number
+    else if (maybe_num_type2) {
+        // _Maybe_ different types, so r2 must be a number.
         return;
     }
-    //std::cout << "type error: Non-comparable types\n";
-    m_errors.push_back("Non-comparable types");
+    m_errors.push_back(loc.to_string() + ": Cannot subtract pointers to different regions");
 }
 
 void inference_domain_t::operator()(const Addable& u, location_t loc) {
-    auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
-    auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
-    auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
-    auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
+    const auto maybe_ptr_or_mapfd_ptr = m_region.find_ptr_or_mapfd_type(u.ptr.v);
+    const auto maybe_ptr_or_mapfd_num = m_region.find_ptr_or_mapfd_type(u.num.v);
+    const auto maybe_num_type_ptr = m_interval.find_interval_value(u.ptr.v);
+    const auto maybe_num_type_num = m_interval.find_interval_value(u.num.v);
     assert(!maybe_ptr_or_mapfd_ptr.has_value() || !maybe_num_type_ptr.has_value());
     assert(!maybe_ptr_or_mapfd_num.has_value() || !maybe_num_type_num.has_value());
 
     // a -> b <-> !a || b
     // is_ptr(ptr) -> is_num(num) <-> !is_ptr(ptr) || is_num(num)
-    if (!is_ptr_type(maybe_ptr_or_mapfd_ptr) ||
-      (!maybe_ptr_or_mapfd_num.has_value() || maybe_num_type_num.has_value())) {
+    if (!is_ptr_type(maybe_ptr_or_mapfd_ptr) || maybe_num_type_num.has_value()) {
         return;
     }
-    m_errors.push_back("Addable assertion fail");
+    m_errors.push_back(loc.to_string() + ": Only numbers can be added to pointers");
 }
 
 void inference_domain_t::operator()(const ValidStore& u, location_t loc) {
@@ -497,11 +502,10 @@ void inference_domain_t::operator()(const ValidStore& u, location_t loc) {
 
     // a -> b <-> !a || b
     // !is_stack_ptr(mem) -> is_num(val) <-> is_stack_ptr(mem) || is_num(val)
-    if (is_stack_ptr(maybe_ptr_or_mapfd_mem) ||
-            (!maybe_ptr_or_mapfd_val.has_value() || maybe_num_type_val.has_value())) {
+    if (is_stack_ptr(maybe_ptr_or_mapfd_mem) || maybe_num_type_val.has_value()) {
         return;
     }
-    m_errors.push_back("Valid store assertion fail");
+    m_errors.push_back(loc.to_string() + ": Only numbers can be stored to externally-visible regions");
 }
 
 void inference_domain_t::operator()(const ValidSize& u, location_t loc) {

From 4d562ef92c4bc63acfad8852f1afa3c173f4dd0b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:46:12 -0400
Subject: [PATCH 344/373] Refactoring: Better, cleaner reasoning in Call

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 13 ++++++-------
 src/crab/offset_domain.cpp   | 16 +++-------------
 src/crab/region_domain.cpp   | 10 +++-------
 src/crab/type_inference.cpp  | 26 ++++++++++++++++----------
 4 files changed, 28 insertions(+), 37 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 767291c50..c161d66a6 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -673,10 +673,9 @@ void interval_domain_t::scratch_caller_saved_registers() {
 void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
         location_t loc) {
     refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
-    for (const auto& kv : store_in_stack) {
-        auto offset = kv.first;
-        auto width = kv.second;
+    for (const auto& [offset, width] : store_in_stack) {
         auto overlapping_cells = find_overlapping_cells_in_stack(offset, width);
+        /*
         if (overlapping_cells.empty()) {
             m_signed.store_in_stack(offset, top_rf, width);
             m_unsigned.store_in_stack(offset, top_rf, width);
@@ -684,12 +683,12 @@ void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_sta
         else {
             fill_values_in_stack(overlapping_cells, offset, width);
         }
-        //remove_overlap_in_stack(overlapping_cells, offset, width);
-        //m_signed.store_in_stack(offset, interval_t::top(), width);
-        //m_unsigned.store_in_stack(offset, interval_t::top(), width);
+        */
+        remove_overlap_in_stack(overlapping_cells, offset, width);
+        m_signed.store_in_stack(offset, top_rf, width);
+        m_unsigned.store_in_stack(offset, top_rf, width);
     }
     auto r0 = register_t{R0_RETURN_VALUE};
-    // TODO: Check if packet_reallocate() function call needs handling separately
     if (u.is_map_lookup) {
         operator-=(r0);
     }
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index d653c7eed..340d72250 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -625,24 +625,14 @@ void offset_domain_t::operator()(const LoadVariable& u, location_t loc) {
 }
 
 void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
-    for (const auto& kv : cells) {
-        auto rf = kv.first;
-        auto width = kv.second;
-        auto overlapping_cells = m_stack.find_overlapping_cells(rf, width);
-        m_stack -= overlapping_cells;
+    for (const auto& [offset, width] : cells) {
+        m_stack -= m_stack.find_overlapping_cells(offset, width);
     }
+    m_registers -= register_t{R0_RETURN_VALUE};
     m_registers.scratch_caller_saved_registers();
-    register_t r0{R0_RETURN_VALUE};
     if (u.reallocate_packet) {
-        m_registers -= r0;
         m_registers.forget_packet_pointers(loc);
     }
-    else if (u.is_map_lookup) {
-        m_registers -= r0;
-    }
-    else {
-        m_registers -= r0;
-    }
 }
 
 void offset_domain_t::operator()(const Call& u, location_t loc) {
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 3e9dd2cab..6ff42bcec 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -844,12 +844,8 @@ void region_domain_t::set_aliases(int v, ptr_with_off_t& ptr) {
 }
 
 void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
-    for (const auto& kv : cells) {
-        auto offset = kv.first;
-        auto width = kv.second;
-        auto overlapping_cells
-            = m_stack.find_overlapping_cells(offset, width);
-        m_stack -= overlapping_cells;
+    for (const auto& [offset, width] : cells) {
+        m_stack -= m_stack.find_overlapping_cells(offset, width);
     }
     std::optional<Reg> maybe_fd_reg{};
     for (ArgSingle param : u.singles) {
@@ -863,7 +859,7 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                 if (global_program_info->platform->get_map_type(*map_type).value_type
                         == EbpfMapValueType::MAP) {
                     if (auto inner_map_fd = get_map_inner_map_fd(*maybe_fd_reg)) {
-                        do_load_mapfd(r0, (int)*inner_map_fd, loc);
+                        do_load_mapfd(r0, to_signed(*inner_map_fd), loc);
                         goto out;
                     }
                 } else {
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index ad8a7cde5..66f1bfb8c 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -258,26 +258,32 @@ void inference_domain_t::operator()(const IncrementLoopCounter &u, location_t lo
 
 void inference_domain_t::operator()(const Call& u, location_t loc) {
 
+    if (is_bottom()) return;
+    std::string loc_str = loc.to_string();
     stack_cells_t stack_values;
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
             auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(param.mem.v);
+            if (!maybe_ptr_or_mapfd) {
+                m_errors.push_back(loc_str + "Argument must be a pointer to writable memory");
+                return;
+            }
             auto maybe_width_rf = m_interval.find_signed_interval_value(param.size.v);
-            if (!maybe_ptr_or_mapfd || !maybe_width_rf) continue;
             if (is_stack_ptr(maybe_ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
                 auto width_interval = maybe_width_rf->get_interval_value();
 
-                auto offset_singleton = ptr_with_off.get_offset().singleton();
-                if (!offset_singleton) {
-                    //std::cout << "type error: storing at an unknown offset in stack\n";
-                    m_errors.push_back("storing at an unknown offset in stack");
-                    continue;
+                if (const auto offset_singleton = ptr_with_off.get_offset().singleton()) {
+                    uint64_t offset = offset_singleton->cast_to<uint64_t>();
+                    if (const auto single_width = width_interval.singleton()) {
+                        int width = single_width->cast_to<int>();
+                        stack_values.emplace_back(offset, width);
+                    } else {
+                        m_errors.push_back(loc_str + ": Width for stack stores cannot be an interval");
+                    }
                 }
-                auto offset = offset_singleton.value().cast_to<int>();
-                if (auto single_width = width_interval.singleton()) {
-                    int width = single_width.value().cast_to<int>();
-                    stack_values.push_back(std::make_pair(offset, width));
+                else {
+                    m_errors.push_back(loc_str + ": Storing at an unknown offset in stack");
                 }
             }
         }

From 9f8d2e171397d7d38b2c0077e1d550c524bad9f4 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:48:41 -0400
Subject: [PATCH 345/373] Refactoring: Better Mem load and store reasoning, and
 error reporting

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp          | 57 ++++++++---------
 src/crab/interval_domain.hpp          |  2 +-
 src/crab/offset_domain.cpp            | 89 +++++++++++---------------
 src/crab/offset_domain.hpp            |  2 +-
 src/crab/region_domain.cpp            | 92 +++++++++++++++++----------
 src/crab/region_domain.hpp            |  4 +-
 src/crab/signed_interval_domain.cpp   |  9 ++-
 src/crab/type_inference.cpp           | 40 ++++++------
 src/crab/type_inference.hpp           |  4 +-
 src/crab/unsigned_interval_domain.cpp |  7 +-
 10 files changed, 157 insertions(+), 149 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index c161d66a6..a20d5e2a7 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1377,27 +1377,23 @@ bool interval_domain_t::load_from_stack(register_t reg, interval_t load_at, int
         }
     }
     auto overlapping_cells = find_overlapping_cells_in_stack(start_offset, width);
-    if (overlapping_cells.size() == 1) {
+    //if (overlapping_cells.size() == 1) {
         // only allow loading from a single cell
         if (all_numeric_in_stack(start_offset, width)) {
             insert_in_registers(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
             return true;
         }
-    }
+    //}
     return false;
 }
 
 void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
-        std::optional<ptr_or_mapfd_t> basereg_type, bool load_in_region, location_t loc) {
-
-    if (!basereg_type) {
-        operator-=(target_register);
-        return;
-    }
+        std::optional<ptr_or_mapfd_t> basereg_type, bool loaded_ptr, bool ptrs_in_ctx_range,
+                                location_t loc) {
 
     // we check if we already loaded a pointer from ctx or stack in region domain,
-        // we then do not store a number
-    if (load_in_region) {
+        // we then do not load a numeric value
+    if (loaded_ptr) {
         operator-=(target_register);
         return;
     }
@@ -1407,10 +1403,10 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
 
     refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (is_ctx_ptr(basereg_type)) {
-        insert_in_registers(target_register, loc, top_rf);
-        return;
-    }
-    if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
+        if (!ptrs_in_ctx_range) {
+            insert_in_registers(target_register, loc, top_rf);
+        }
+    } else if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
         if (width == 1) {
             interval_t to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
             expression_t e(to_insert, m_slacks);
@@ -1424,13 +1420,10 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
         else {
             insert_in_registers(target_register, loc, refinement_t::numeric_refinement_top(m_slacks));
         }
-        return;
-    }
-
-    if (is_stack_ptr(basereg_type)) {
+    } else if (is_stack_ptr(basereg_type)) {
         auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
         auto p_offset = ptr_with_off.get_offset();
-        auto load_at = p_offset + interval_t(number_t{offset});
+        auto load_at = p_offset + interval_t{offset};
         if (load_from_stack(target_register, load_at, width, loc)) return;
     }
     operator-=(target_register);
@@ -1441,25 +1434,29 @@ void interval_domain_t::store_in_stack(const Mem& b, uint64_t store_at, int widt
     m_unsigned.store_in_stack(b, store_at, width);
 }
 
-void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> basereg_type) {
+void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t> maybe_basereg_type) {
     int offset = b.access.offset;
     int width = b.access.width;
 
-    if (!is_stack_ptr(basereg_type)) {
+    if (!is_stack_ptr(maybe_basereg_type)) {
         // we only store for stack pointers
         return;
     }
 
-    auto basereg_ptr_with_off_type = std::get<ptr_with_off_t>(*basereg_type);
-    auto offset_singleton = basereg_ptr_with_off_type.get_offset().singleton();
-    if (!offset_singleton) {
-        m_errors.push_back("doing a store with unknown offset");
-        return;
+    auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
+    auto offset_reg = basereg_with_off.get_offset();
+    if (auto finite = offset_reg.finite_size()) {
+        int finite_size = finite->cast_to<int>();
+        const number_t lb = offset_reg.lb().number().value();
+        uint64_t lb_n = lb.cast_to<uint64_t>();
+        uint64_t store_at = lb_n + offset;
+        auto overlapping_cells = find_overlapping_cells_in_stack(store_at, width + finite_size);
+        remove_overlap_in_stack(overlapping_cells, store_at, width + finite_size);
+
+        if (auto offset_singleton = offset_reg.singleton()) {
+            store_in_stack(b, store_at, width);
+        }
     }
-    auto store_at = (*offset_singleton + offset).cast_to<uint64_t>();
-    auto overlapping_cells = find_overlapping_cells_in_stack(store_at, width);
-    remove_overlap_in_stack(overlapping_cells, store_at, width);
-    store_in_stack(b, store_at, width);
 }
 
 void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 27d52c483..ed8d3281c 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -128,7 +128,7 @@ class interval_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, location_t);
+    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, bool, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, location_t);
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 340d72250..b746b3536 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -688,22 +688,24 @@ void offset_domain_t::do_mem_store(const Mem& b,
     int offset = b.access.offset;
     int width = b.access.width;
     auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
-    auto basereg_off_singleton = basereg_with_off.get_offset().singleton();
-    if (!basereg_off_singleton) return;
-    auto store_at = (*basereg_off_singleton + offset).cast_to<uint64_t>();
-    auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
-    m_stack -= overlapping_cells;
-
-    // TODO: verify if both cases are correct, as it was changed during refactoring
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto target_reg = std::get<Reg>(b.value);
-        rf_info = m_registers.find(target_reg.v);
-        if (rf_info) m_stack.store(store_at, *rf_info, width);
+    auto offset_reg = basereg_with_off.get_offset();
+    if (auto finite = offset_reg.finite_size()) {
+        int finite_size = finite->cast_to<int>();
+        const number_t lb = offset_reg.lb().number().value();
+        uint64_t lb_n = lb.cast_to<uint64_t>();
+        uint64_t store_at = lb_n + offset;
+        m_stack -= m_stack.find_overlapping_cells(store_at, width + finite_size);
+
+        if (auto offset_singleton = offset_reg.singleton()) {
+            if (auto target_reg = std::get_if<Reg>(&b.value)) {
+                rf_info = m_registers.find(target_reg->v);
+                if (rf_info) m_stack.store(store_at, *rf_info, width);
+            }
+        }
     }
-    else {}
 }
 
-void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
+bool offset_domain_t::do_load(const Mem& b, const register_t& target_register,
         std::optional<ptr_or_mapfd_t> basereg_type, location_t loc) {
 
     bool is_stack_p = is_stack_ptr(basereg_type);
@@ -711,9 +713,10 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
 
     if (!is_stack_p && !is_ctx_p) {
         m_registers -= target_register;
-        return;
+        return false;
     }
 
+    std::string loc_str = loc.to_string();
     int width = b.access.width;
     int offset = b.access.offset;
     auto type_with_off = std::get<ptr_with_off_t>(*basereg_type);
@@ -721,25 +724,12 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
     auto offset_singleton = p_offset.singleton();
     if (is_stack_p) {
         if (!offset_singleton) {
-            for (auto const& k : m_stack.get_keys()) {
-                auto start = p_offset.lb();
-                auto end = p_offset.ub()+number_t{offset+width-1};
-                interval_t range{start, end};
-                // TODO: fix this
-                /*
-                if (range[number_t{(int)k}]) {
-                    //std::cout << "stack load at unknown offset, and offset range contains pointers\n";
-                    m_errors.push_back("stack load at unknown offset, and offset range contains pointers");
-                    break;
-                }
-                */
-            }
             m_registers -= target_register;
         }
         else {
             if (width != 1 && width != 2 && width != 4 && width != 8) {
                 m_registers -= target_register;
-                return;
+                return false;
             }
             auto ptr_offset = offset_singleton.value();
             auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
@@ -748,41 +738,38 @@ void offset_domain_t::do_load(const Mem& b, const register_t& target_register,
             if (!loaded) {
                 // no field at loaded offset in stack
                 m_registers -= target_register;
-                return;
+                return false;
             }
             m_registers.insert(target_register, loc, loaded->first);
         }
     }
     else {
-        if (!offset_singleton) {
-            for (auto const& k : m_ctx->get_keys()) {
-                auto start = p_offset.lb();
-                auto end = p_offset.ub()+crab::bound_t{offset+width-1};
-                interval_t range{start, end};
-                // TODO: fix this
-                /*
-                if (range[number_t{(int)k}]) {
-                    //std::cout << "ctx load at unknown offset, and offset range contains pointers\n";
-                    m_errors.push_back("ctx load at unknown offset, and offset range contains pointers");
-                    break;
-                }
-                */
-            }
-            m_registers -= target_register;
-        }
-        else {
+        if (offset_singleton) {
             auto ptr_offset = offset_singleton.value();
             auto load_at = (ptr_offset + offset).cast_to<uint64_t>();
 
             auto loaded = m_ctx->find(load_at);
-            if (!loaded) {
-                // no field at loaded offset in ctx
-                m_registers -= target_register;
-                return;
+            if (loaded && width == 4) {
+                m_registers.insert(target_register, loc, *loaded);
+                return false;
+            }
+            m_registers -= target_register;
+        }
+        // These checks are important to ensure that either we read a complete ptr (loaded before),
+        // or a numeric value (when cells contains nothing).
+        for (auto const& k : m_ctx->get_keys()) {
+            // The value 4 should be dynamic, however, pkt pointers are always stored as 4-byte
+            auto start = p_offset.lb();
+            auto end = p_offset.ub() + bound_t{offset+width-1};
+            if (end < bound_t{k} || start > bound_t{k + 4 - 1}) {
+                // no overlap with stored range
+                continue;
             }
-            m_registers.insert(target_register, loc, *loaded);
+            m_errors.push_back(loc_str + ": Load range in ctx contains pointers");
+            return true;
         }
     }
+    return false;
 }
 
 void offset_domain_t::operator()(const Mem& b, location_t loc) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index d0fb8eced..862158dd2 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -159,7 +159,7 @@ class offset_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f) {}
 
-    void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t);
+    bool do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
     void do_bin(const Bin&, const std::optional<refinement_t>&, const std::optional<refinement_t>&,
                 location_t);
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 6ff42bcec..56607adbf 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1196,13 +1196,7 @@ void region_domain_t::do_bin(const Bin& bin,
     return;
 }
 
-void region_domain_t::do_load(const Mem& b, const register_t& target_register, bool unknown_ptr,
-        location_t loc) {
-
-    if (unknown_ptr) {
-        m_registers -= target_register;
-        return;
-    }
+bool region_domain_t::do_load(const Mem& b, const register_t& target_register, location_t loc) {
 
     int width = b.access.width;
     int offset = b.access.offset;
@@ -1214,16 +1208,18 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
     if (!is_ctx_p && !is_stack_p) {
         // loading from either packet or shared region or mapfd does not happen in region domain
         m_registers -= target_register;
-        return;
+        return false;
     }
 
     auto type_with_off = std::get<ptr_with_off_t>(*ptr_or_mapfd_opt);
     auto p_offset = type_with_off.get_offset();
     auto offset_singleton = p_offset.singleton();
 
+    std::string loc_str = loc.to_string();
     if (!offset_singleton) {
+        m_errors.push_back(loc_str + ": Load at an unknown offset");
         m_registers -= target_register;
-        return;
+        return false;
     }
 
     auto ptr_offset = offset_singleton.value();
@@ -1231,13 +1227,21 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
     if (is_stack_p) {
         if (width != 1 && width != 2 && width != 4 && width != 8) {
             m_registers -= target_register;
-            return;
+            m_errors.push_back(loc_str + ": Invalid width for stack load");
+            return false;
+        }
+        if (width != 8) {
+            // we do not support loading pointers from stack with width != 8
+            // can be relaxed, if needed
+            m_registers -= target_register;
+            m_errors.push_back(loc_str + ": Only 8-byte stack loads for pointers are supported");
+            return false;
         }
         auto loaded = m_stack.find(load_at);
         if (!loaded) {
-            // no field at loaded offset in stack
+            // no field at loaded offset in stack, but possibly a number is there
             m_registers -= target_register;
-            return;
+            return false;
         }
         auto ptr_or_mapfd = loaded->first;
         if (is_shared_ptr(ptr_or_mapfd)) {
@@ -1248,26 +1252,36 @@ void region_domain_t::do_load(const Mem& b, const register_t& target_register, b
         else {
             m_registers.insert(target_register, loc, ptr_or_mapfd);
         }
+        return true;
     }
     else {
         if (m_ctx->packet_ptr_at(load_at)) {
+            if (width != 4) {
+                m_registers -= target_register;
+                // Special case for packet pointers, that these are stored into ctx as 4-byte, and
+                // also loaded as 4-byte.
+                // This probably needs to be relaxed in the future.
+                m_errors.push_back(loc_str + ": Only 4-byte ctx loads for pkt pointers are supported");
+                return false;
+            }
             m_registers.insert(target_register, loc, packet_ptr_t{});
+            return true;
         }
         else {
             m_registers -= target_register;
         }
     }
+    return false;
 }
 
 void region_domain_t::operator()(const Mem& m, location_t loc) {
     // nothing to do here
 }
 
-void region_domain_t::do_mem_store(const Mem& b) {
+void region_domain_t::do_mem_store(const Mem& b, location_t loc) {
 
     std::optional<ptr_or_mapfd_t> targetreg_type = {};
-    bool target_is_reg = std::holds_alternative<Reg>(b.value);
-    if (target_is_reg) {
+    if (std::holds_alternative<Reg>(b.value)) {
         auto target_reg = std::get<Reg>(b.value);
         targetreg_type = m_registers.find(target_reg.v);
     }
@@ -1282,13 +1296,14 @@ void region_domain_t::do_mem_store(const Mem& b) {
     bool is_packet_p = is_packet_ptr(maybe_basereg_type);
     bool is_mapfd = is_mapfd_type(maybe_basereg_type);
 
+    std::string loc_str = loc.to_string();
     if (is_mapfd) {
-        m_errors.push_back("storing into a mapfd register is not defined");
+        m_errors.push_back(loc_str + ": Cannot store to a mapfd");
         return;
     }
     if (is_shared_p || is_packet_p || is_ctx_p) {
         if (targetreg_type) {
-            m_errors.push_back("storing a pointer into a shared, packet or ctx pointer");
+            m_errors.push_back(loc_str + ": Cannot store a pointer into regions other than stack");
             return;
         }
         else {
@@ -1299,26 +1314,33 @@ void region_domain_t::do_mem_store(const Mem& b) {
 
     // if the code reaches here, we are storing into a stack pointer
     auto basereg_type_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
-    auto offset_singleton = basereg_type_with_off.get_offset().singleton();
-    if (!offset_singleton) {
-        //std::cout << "type error: storing to a pointer with unknown offset\n";
-        m_errors.push_back("storing to a pointer with unknown offset");
-        return;
-    }
-    auto store_at = (uint64_t)offset+offset_singleton.value().cast_to<uint64_t>();
-    auto overlapping_cells = m_stack.find_overlapping_cells(store_at, width);
-    m_stack -= overlapping_cells;
-
-    // if targetreg_type is empty, we are storing a number
-    if (!targetreg_type) return;
-    auto type = *targetreg_type;
-    if (is_shared_ptr(type)) {
-        auto shared_ptr = std::get<ptr_with_off_t>(type);
-        set_aliases(store_at+11, shared_ptr);
-        m_stack.store(store_at, shared_ptr, width);
+    auto offset_reg = basereg_type_with_off.get_offset();
+    if (auto finite = offset_reg.finite_size()) {
+        int finite_size = finite->cast_to<int>();
+        const number_t lb = offset_reg.lb().number().value();
+        uint64_t lb_n = lb.cast_to<uint64_t>();
+        uint64_t store_at = lb_n + offset;
+        m_stack -= m_stack.find_overlapping_cells(store_at, width + finite_size);
+
+        auto offset_singleton = offset_reg.singleton();
+        if (!offset_singleton) {
+            m_errors.push_back(loc_str + ": Storing at an unknown offset into stack");
+            return;
+        }
+        // if targetreg_type is empty, we are storing a number
+        if (!targetreg_type) return;
+        auto type = *targetreg_type;
+        if (is_shared_ptr(type)) {
+            auto shared_ptr = std::get<ptr_with_off_t>(type);
+            set_aliases(store_at+11, shared_ptr);
+            m_stack.store(store_at, shared_ptr, width);
+        }
+        else {
+            m_stack.store(store_at, type, width);
+        }
     }
     else {
-        m_stack.store(store_at, type, width);
+        m_errors.push_back(loc_str + ": Storing at an unknown offset into stack");
     }
 }
 
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index f13ba8c34..14fbf7457 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -170,9 +170,9 @@ class region_domain_t final {
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void do_load_mapfd(const register_t&, int, location_t);
-    void do_load(const Mem&, const register_t&, bool, location_t);
-    void do_mem_store(const Mem&);
     void check_type(const TypeConstraint&, bool, location_t);
+    bool do_load(const Mem&, const register_t&, location_t);
+    void do_mem_store(const Mem&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 1ae806d33..82cdcbc63 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -630,15 +630,14 @@ bool signed_interval_domain_t::load_from_stack(register_t reg, uint64_t offset,
 }
 
 void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto target_reg = std::get<Reg>(b.value);
-        if (auto rf_opt = m_registers.find(target_reg.v)) {
+    if (auto target_reg = std::get_if<Reg>(&b.value)) {
+        if (auto rf_opt = m_registers.find(target_reg->v)) {
             m_stack.store(offset, *rf_opt, width);
         }
     }
     else {
-        auto imm = (int64_t)std::get<Imm>(b.value).v;
-        auto rf = refinement_t::numeric_refinement(interval_t{number_t{imm}}, m_slacks);
+        auto imm = to_signed(std::get<Imm>(b.value).v);
+        auto rf = refinement_t::numeric_refinement(interval_t{imm}, m_slacks);
         m_stack.store(offset, rf, width);
     }
 }
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 66f1bfb8c..35acaa74a 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -650,38 +650,42 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
     m_offset.do_bin(bin, dst_signed_rf, src_signed_rf, loc);
 }
 
-void inference_domain_t::do_load(const Mem& b, const Reg& target_reg, bool unknown_ptr,
+void inference_domain_t::do_load(const Mem& b, const Reg& target_reg,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
-    m_region.do_load(b, register_t{target_reg.v}, unknown_ptr, loc);
-    // TODO: replace with a bool value returned from region do_load
-    auto load_in_region = m_region.find_ptr_or_mapfd_type(target_reg.v).has_value();
-    m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, load_in_region, loc);
-    m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
+    bool loaded_in_region = m_region.do_load(b, register_t{target_reg.v}, loc);
+    bool ptrs_in_range = m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
+    m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, loaded_in_region, ptrs_in_range,
+                       loc);
 }
 
-void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt) {
-    m_region.do_mem_store(b);
-    // TODO: Before storing into interval domain, check if there is no overlap with packet pointers
+void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc) {
+    m_region.do_mem_store(b, loc);
     m_interval.do_mem_store(b, basereg_opt);
     m_offset.do_mem_store(b, basereg_opt);
 }
 
 void inference_domain_t::operator()(const Mem& b, location_t loc) {
+    if (is_bottom()) return;
     auto basereg = b.access.basereg;
     auto base_ptr_or_mapfd_opt = m_region.find_ptr_or_mapfd_type(basereg.v);
     bool unknown_ptr = !base_ptr_or_mapfd_opt.has_value();
     if (unknown_ptr) {
-        std::string s = std::to_string(static_cast<unsigned int>(basereg.v));
-        m_errors.push_back(
-                std::string("load/store using an unknown pointer, or number - r") + s);
+        m_errors.push_back(loc.to_string() + ": Memory operation at an unknown pointer");
+        if (b.is_load) {
+            const auto reg = std::get<Reg>(b.value);
+            register_t r{reg.v};
+            m_region -= r;
+            m_offset -= r;
+            m_interval -= r;
+        }
+        return;
     }
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto targetreg = std::get<Reg>(b.value);
-        if (b.is_load) do_load(b, targetreg, unknown_ptr, base_ptr_or_mapfd_opt, loc);
-        else if (!unknown_ptr) do_mem_store(b, base_ptr_or_mapfd_opt);
+    if (const auto reg = std::get_if<Reg>(&b.value)) {
+        if (b.is_load) do_load(b, *reg, base_ptr_or_mapfd_opt, loc);
+        else do_mem_store(b, base_ptr_or_mapfd_opt, loc);
     }
-    else if (!unknown_ptr && !b.is_load) {
-        do_mem_store(b, base_ptr_or_mapfd_opt);
+    else {
+        do_mem_store(b, base_ptr_or_mapfd_opt, loc);
     }
 }
 
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index b8b90761a..3c8431efc 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -132,9 +132,9 @@ class inference_domain_t final {
 
   private:
 
-    void do_load(const Mem&, const Reg&, bool, std::optional<ptr_or_mapfd_t>,
+    void do_load(const Mem&, const Reg&, std::optional<ptr_or_mapfd_t>,
             location_t);
-    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
+    void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&, location_t);
     void report_type_error(std::string, location_t);
     void print_registers() const;
     void adjust_bb_for_types(location_t);
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index cce460899..dd38d384b 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -587,15 +587,14 @@ bool unsigned_interval_domain_t::load_from_stack(register_t reg, uint64_t offset
 }
 
 void unsigned_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int width) {
-    if (std::holds_alternative<Reg>(b.value)) {
-        auto target_reg = std::get<Reg>(b.value);
-        if (auto rf_opt = m_registers.find(target_reg.v)) {
+    if (auto target_reg = std::get_if<Reg>(&b.value)) {
+        if (auto rf_opt = m_registers.find(target_reg->v)) {
             m_stack.store(offset, *rf_opt, width);
         }
     }
     else {
         auto imm = (uint64_t)std::get<Imm>(b.value).v;
-        auto rf = refinement_t::numeric_refinement(interval_t{number_t{imm}}, m_slacks);
+        auto rf = refinement_t::numeric_refinement(interval_t{imm}, m_slacks);
         m_stack.store(offset, rf, width);
     }
 }

From 53dbbc8c329001602d308b922916a7a8ac0b3f91 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:49:51 -0400
Subject: [PATCH 346/373] Refactoring: Cleaning up Atomic

Removing some code that is not currently adding any functionality to
current benchmarks, conservatively;
In future, add more sophisticated analysis;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 51 +++++++++++++++----------------------
 1 file changed, 20 insertions(+), 31 deletions(-)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 35acaa74a..652d3c719 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -197,50 +197,39 @@ static Bin atomic_to_bin(const Atomic& a) {
 }
 
 void inference_domain_t::operator()(const Atomic &u, location_t loc) {
-    // WARNING: Not implemented yet
     if (is_bottom()) return;
     std::optional<ptr_or_mapfd_t> base_reg_opt
         = m_region.find_ptr_or_mapfd_type(u.access.basereg.v);
     std::optional<refinement_t> value_reg_opt = m_interval.find_interval_value(u.valreg.v);
     if (!base_reg_opt || !value_reg_opt) return;
-    if (is_stack_ptr(base_reg_opt)) {
-        if (u.op == Atomic::Op::CMPXCHG) {
-            m_region -= register_t{R0_RETURN_VALUE};
-            m_offset -= register_t{R0_RETURN_VALUE};
-            insert_in_registers_in_interval_domain(register_t{R0_RETURN_VALUE},
-                    loc, refinement_t::numeric_refinement_top());
-        }
-        else if (u.fetch) {
-            insert_in_registers_in_interval_domain(u.valreg.v, loc,
-                                    refinement_t::numeric_refinement_top());
-        }
+
+    // For shared memory regions, this behavior is sound, as the regions are volatile
+    // For stack memory region, we simply havoc values but fine-grained analysis can be done
+    if (u.op == Atomic::Op::CMPXCHG) {
+        register_t r0 = register_t{R0_RETURN_VALUE};
+        m_region -= r0;
+        m_offset -= r0;
+        m_interval -= r0;
+    }
+    else if (u.fetch) {
+        register_t r = register_t{u.valreg.v};
+        m_region -= r;
+        m_offset -= r;
+        m_interval -= r;
+    }
+
+    // Case for shared memory regions.
+    if (!is_stack_ptr(base_reg_opt)) {
         return;
     }
+
     // Fetch the current value into the R11 pseudo-register.
-    const Reg r11{11};
+    constexpr Reg r11{11};
     (*this)(Mem{.access = u.access, .value = r11, .is_load = true}, loc);
 
     // Compute the new value in R11.
     (*this)(atomic_to_bin(u), loc);
 
-    if (u.op == Atomic::Op::CMPXCHG) {
-        // For CMPXCHG, store the original value in r0.
-        (*this)(Mem{.access = u.access, .value = Reg{R0_RETURN_VALUE}, .is_load = true}, loc);
-
-        // For the destination, there are 3 possibilities:
-        // 1) dst.value == r0.value : set R11 to valreg
-        // 2) dst.value != r0.value : don't modify R11
-        // 3) dst.value may or may not == r0.value : set R11 to the union of R11 and valreg
-        // For now we just havoc the value of R11.
-        m_region -= register_t{11};
-        m_offset -= register_t{11};
-        insert_in_registers_in_interval_domain(register_t{11}, loc,
-                refinement_t::numeric_refinement_top());
-    } else if (u.fetch) {
-        // For other FETCH operations, store the original value in the src register.
-        (*this)(Mem{.access = u.access, .value = u.valreg, .is_load = true}, loc);
-    }
-
     // Store the new value back in the original shared memory location.
     // Note that do_mem_store() currently doesn't track shared memory values,
     // but stack memory values are tracked and are legal here.

From 3ffb86ed14827260ce8df1b8dfc89a195f7130a4 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:52:23 -0400
Subject: [PATCH 347/373] Refactoring: Cleanup in LoadMapFd and LoadVariable

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 4 ++--
 src/crab/region_domain.cpp | 6 +++---
 src/crab/region_domain.hpp | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index b746b3536..f818126a7 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -617,11 +617,11 @@ void offset_domain_t::operator()(const Un& u, location_t loc) {
 }
 
 void offset_domain_t::operator()(const LoadMapFd& u, location_t loc) {
-    m_registers -= u.dst.v;
+    m_registers -= register_t{u.dst.v};
 }
 
 void offset_domain_t::operator()(const LoadVariable& u, location_t loc) {
-    m_registers -= u.dst.v;
+    m_registers -= register_t{u.dst.v};
 }
 
 void offset_domain_t::do_call(const Call& u, const stack_cells_t& cells, location_t loc) {
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 56607adbf..2e9004dda 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -782,17 +782,17 @@ interval_t region_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
     return result;
 }
 
-void region_domain_t::do_load_mapfd(const register_t& dst_reg, int mapfd, location_t loc) {
+void region_domain_t::do_load_mapfd(register_t dst_reg, int mapfd, location_t loc) {
     const auto& platform = global_program_info->platform;
     const EbpfMapDescriptor& desc = platform->get_map_descriptor(mapfd);
     const EbpfMapValueType& map_value_type = platform->get_map_type(desc.type).value_type;
     auto mapfd_interval = interval_t{number_t{mapfd}};
-    auto type = mapfd_t(mapfd_interval, map_value_type);
+    mapfd_t type{mapfd_interval, map_value_type};
     m_registers.insert(dst_reg, loc, type);
 }
 
 void region_domain_t::operator()(const LoadMapFd &u, location_t loc) {
-    do_load_mapfd((register_t)u.dst.v, u.mapfd, loc);
+    do_load_mapfd(register_t{u.dst.v}, u.mapfd, loc);
 }
 
 static EbpfRelocationDescriptor* find_relocation_descriptor(const int relocation_fd) {
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 14fbf7457..f89aa993b 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -169,8 +169,8 @@ class region_domain_t final {
     interval_t get_map_key_size(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
-    void do_load_mapfd(const register_t&, int, location_t);
     void check_type(const TypeConstraint&, bool, location_t);
+    void do_load_mapfd(register_t, int, location_t);
     bool do_load(const Mem&, const register_t&, location_t);
     void do_mem_store(const Mem&, location_t);
     void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,

From 8f38d6a3c973b38fd4c64d062a44f7588c35125e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:53:35 -0400
Subject: [PATCH 348/373] Refactoring: Cleanup in ValidMapKey

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp  | 25 ++++++++--
 src/crab/region_domain.hpp  |  1 +
 src/crab/type_inference.cpp | 97 ++++++++++++++++++++++++++++---------
 3 files changed, 98 insertions(+), 25 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 2e9004dda..ba7f41916 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -774,10 +774,29 @@ interval_t region_domain_t::get_map_value_size(const Reg& map_fd_reg) const {
 
     interval_t result = crab::interval_t::bottom();
     for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
-        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd))
-            result = result | crab::interval_t(number_t(map->value_size));
-        else
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t(map->value_size);
+        } else {
+            return interval_t::top();
+        }
+    }
+    return result;
+}
+
+// We can deal with a range of max_entries values.
+interval_t region_domain_t::get_map_max_entries(const Reg& map_fd_reg) const {
+    int start_fd, end_fd;
+    if (!get_map_fd_range(map_fd_reg, &start_fd, &end_fd))
+        return interval_t::top();
+
+    interval_t result = interval_t::bottom();
+    for (int map_fd = start_fd; map_fd <= end_fd; map_fd++) {
+        if (EbpfMapDescriptor* map = &global_program_info->platform->get_map_descriptor(map_fd)) {
+            result = result | interval_t(map->max_entries);
+        }
+        else {
             return interval_t::top();
+        }
     }
     return result;
 }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index f89aa993b..db53882e9 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -167,6 +167,7 @@ class region_domain_t final {
     interval_t get_map_value_size(const Reg&) const;
     bool get_map_fd_range(const Reg&, int32_t*, int32_t*) const;
     interval_t get_map_key_size(const Reg&) const;
+    interval_t get_map_max_entries(const Reg&) const;
     std::optional<uint32_t> get_map_type(const Reg&) const;
     std::optional<uint32_t> get_map_inner_map_fd(const Reg&) const;
     void check_type(const TypeConstraint&, bool, location_t);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 652d3c719..a3283b163 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -520,52 +520,105 @@ void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
 
 void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
 
-    // TODO: move map-related function to common
-    //auto fd_type = m_region.get_map_type(u.map_fd_reg);
+    // TODO: move map-related function from region domain to common
+    auto fd_type = m_region.get_map_type(u.map_fd_reg);
 
     int width;
+    std::string loc_str = loc.to_string();
     if (u.key) {
         auto key_size = m_region.get_map_key_size(u.map_fd_reg).singleton();
         if (!key_size.has_value()) {
-            m_errors.push_back("Map key size is not singleton");
+            m_errors.push_back(loc_str + ": Map key size is not singleton");
             return;
         }
-        width = key_size.value().cast_to<int>();
+        width = key_size->narrow<int>();
     } else {
         auto value_size = m_region.get_map_value_size(u.map_fd_reg).singleton();
         if (!value_size.has_value()) {
-            m_errors.push_back("Map value size is not singleton");
+            m_errors.push_back(loc_str + ": Map value size is not singleton");
             return;
         }
-        width = value_size.value().cast_to<int>();
+        width = value_size->narrow<int>();
     }
     auto maybe_ptr_or_mapfd_basereg = m_region.find_ptr_or_mapfd_type(u.access_reg.v);
     auto maybe_mapfd = m_region.find_ptr_or_mapfd_type(u.map_fd_reg.v);
     if (maybe_ptr_or_mapfd_basereg && maybe_mapfd) {
-        auto mapfd = maybe_mapfd.value();
+        auto type = *maybe_ptr_or_mapfd_basereg;
         if (is_mapfd_type(maybe_mapfd)) {
-            if (is_stack_ptr(maybe_ptr_or_mapfd_basereg)) {
-                auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd_basereg);
-                auto offset_singleton = ptr_with_off.get_offset().singleton();
-                if (!offset_singleton) {
-                    //std::cout << "type error: reading the stack at an unknown offset\n";
-                    m_errors.push_back("reading the stack at an unknown offset");
+            if (std::holds_alternative<ptr_with_off_t>(type)) {
+                auto ptr_with_off = std::get<ptr_with_off_t>(type);
+                auto region = ptr_with_off.get_region();
+                auto offset_interval = ptr_with_off.get_offset();
+                if (region == region_t::R_STACK) {
+                    // stack
+                    auto offset_singleton = offset_interval.singleton();
+                    if (!offset_singleton) {
+                        m_errors.push_back(loc_str + ": Pointer must be singleton");
+                        return;
+                    }
+                    auto offset = offset_singleton.value().cast_to<uint64_t>();
+                    if (!m_interval.all_numeric_in_stack(offset, width)) {
+                        m_errors.push_back(loc_str + ": Illegal map update with a non-numerical value");
+                        return;
+                    }
+                    else if (thread_local_options.strict && fd_type.has_value()) {
+                        EbpfMapType map_type = global_program_info->platform->get_map_type(*fd_type);
+                        if (map_type.is_array && u.key) {
+                            // Array bounds checks
+                            if (auto cell = m_interval.find_in_stack_signed(offset)) {
+                                auto rf = cell->first;
+                                auto size = cell->second;
+                                auto key_value = rf.get_interval_value();
+                                if (size != sizeof(uint32_t)) {
+                                    m_errors.push_back(loc_str + ": Array map key must be 32 bits");
+                                    return;
+                                }
+                                if (auto max_entries = m_region.get_map_max_entries(u.map_fd_reg).lb().number()) {
+                                    if (key_value.ub() >= *max_entries) {
+                                        m_errors.push_back(loc_str + ": Array index overflow");
+                                    }
+                                } else {
+                                    m_errors.push_back(loc_str + ": Max entries is not finite");
+                                }
+                                if (key_value.lb() < bound_t{number_t{0}}) {
+                                    m_errors.push_back(loc_str + ": Array index underflow");
+                                    return;
+                                }
+                            }
+                        }
+                    }
+                    return;
+                }
+                else if (region == region_t::R_SHARED) {
+                    // shared
+                    auto offset_lb = offset_interval.lb();
+                    auto offset_ub = offset_interval.ub() + bound_t{width};
+                    if (bound_t{SHARED_BEGIN} <= offset_lb &&
+                        offset_ub <= ptr_with_off.get_region_size().lb()) {
+                        auto nullness = ptr_with_off.get_nullness();
+                        if (nullness != nullness_t::NOT_NULL) {
+                            m_errors.push_back(loc_str + ": Possible null access");
+                        }
+                    }
+                    else {
+                        m_errors.push_back(loc_str + ": Shared region access out of bounds");
+                    }
                     return;
                 }
-                auto offset_to_check = offset_singleton.value().cast_to<uint64_t>();
-                auto it = m_interval.all_numeric_in_stack(offset_to_check, width);
-                if (it) return;
-            }
-            else if (is_packet_ptr(maybe_ptr_or_mapfd_basereg)) {
-                if (m_offset.check_packet_access(u.access_reg, width, 0, true)) return;
             }
-            else {
-                m_errors.push_back("Only stack or packet can be used as a parameter");
+            else if (std::holds_alternative<packet_ptr_t>(type)) {
+                // packet
+                if (!m_offset.check_packet_access(u.access_reg, width, 0, true)) {
+                    m_errors.push_back(loc_str + ": Packet access out of bounds");
+                }
                 return;
             }
+            m_errors.push_back(loc_str + ": Only stack, packet or shared regions can be used as a parameter");
+        }
+        else {
+            m_errors.push_back(loc_str + ": Not a mapfd type");
         }
     }
-    m_errors.push_back("map update with a non-numerical value");
 }
 
 void inference_domain_t::operator()(const ZeroCtxOffset& u, location_t loc) {

From 425411b3186c6157f86e3212311903025337bf70 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Sun, 22 Jun 2025 16:54:18 -0400
Subject: [PATCH 349/373] Refactor: Minor change in an error text

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index a3283b163..02f12f0ed 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -515,7 +515,7 @@ void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
             return;
         }
     }
-    m_errors.push_back("Valid Size assertion fail");
+    m_errors.push_back(loc.to_string() + ": Invalid size");
 }
 
 void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {

From 18034a46952e788e13f85a2fabb270e51cb4eb1f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 23 Jun 2025 00:50:43 -0400
Subject: [PATCH 350/373] Refactoring in Bin transformer

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 17 ++++++-------
 src/crab/interval_domain.hpp |  2 +-
 src/crab/offset_domain.cpp   | 48 ++++++++++++++++++------------------
 src/crab/offset_domain.hpp   |  2 +-
 src/crab/region_domain.cpp   | 21 ++++++++--------
 src/crab/region_domain.hpp   |  3 +--
 src/crab/type_inference.cpp  |  5 ++--
 7 files changed, 48 insertions(+), 50 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index a20d5e2a7..6c6a3c08c 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1540,7 +1540,7 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
     insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
 }
 
-void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>& subtracted_opt,
+void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtracted_opt,
                                location_t loc) {
     
     using Op = Bin::Op;
@@ -1572,6 +1572,7 @@ void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>&
         return;
     }
 
+    std::string loc_str = loc.to_string();
     if (auto pimm = std::get_if<Imm>(&bin.v)) {
         int64_t imm;
         if (bin.is64) {
@@ -1582,7 +1583,7 @@ void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>&
             imm = gsl::narrow_cast<int32_t>(pimm->v);
             bitwise_and(dst_register, number_t{std::numeric_limits<uint32_t>::max()}, loc);
         }
-        auto imm_interval = interval_t{number_t{imm}};
+        auto imm_interval = interval_t{imm};
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm
@@ -1594,20 +1595,16 @@ void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>&
             }
             case Op::MOVSX8:
             case Op::MOVSX16:
-            case Op::MOVSX32: m_errors.push_back("MOVSX not implemented"); break;
+            case Op::MOVSX32: m_errors.push_back(loc_str + ": Unsupported Operation"); break;
             case Op::ADD: {
                 // ra += imm
-                if (imm == 0) {
-                    return;
-                }
+                if (imm == 0) return;
                 add_overflow(dst_register, number_t{gsl::narrow<int>(imm)}, finite_width, loc);
                 break;
             }
             case Op::SUB: {
                 // ra -= imm
-                if (imm == 0) {
-                    return;
-                }
+                if (imm == 0) return;
                 add_overflow(dst_register, number_t{gsl::narrow<int>(-imm)}, finite_width, loc);
                 break;
             }
@@ -1675,6 +1672,7 @@ void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>&
             case Op::ARSH: {
                 // ra >>>= imm
                 //ashr(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
+                // TODO: implement ARSH
                 m_signed.insert_in_registers(dst_register, loc,
                                              refinement_t::numeric_refinement_top(m_slacks));
                 m_unsigned.insert_in_registers(dst_register, loc,
@@ -1813,6 +1811,7 @@ void interval_domain_t::do_bin(const Bin& bin, const std::optional<interval_t>&
                 //    ashr(dst_register, src_register, finite_width, loc);
                 //    break;
                 //}
+                // TODO: implement ARSH
                 m_signed.insert_in_registers(dst_register, loc,
                                              refinement_t::numeric_refinement_top(m_slacks));
                 m_unsigned.insert_in_registers(dst_register, loc,
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index ed8d3281c..9b5547a51 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -131,7 +131,7 @@ class interval_domain_t final {
     void do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, bool, bool, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
-    void do_bin(const Bin&, const std::optional<interval_t>&, location_t);
+    void do_bin(const Bin&, std::optional<interval_t>, location_t);
     void check_valid_access(const ValidAccess&, interval_t, location_t);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
     void assume_signed_cst(Condition::Op, bool, const interval_t&, const interval_t&,
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index f818126a7..0e513a461 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -495,21 +495,21 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol);
 }
 
-void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>& numeric_rf_dst,
-                             const std::optional<refinement_t>& numeric_rf_src, location_t loc) {
+void offset_domain_t::do_bin(const Bin& bin, std::optional<refinement_t> dst_rf_numeric_opt,
+                             std::optional<refinement_t> src_rf_numeric_opt, location_t loc) {
 
     using Op = Bin::Op;
 
     auto dst_register = register_t{bin.dst.v};
 
-    if (std::holds_alternative<Imm>(bin.v)) {
+    if (auto pimm = std::get_if<Imm>(&bin.v)) {
         int64_t imm;
         if (bin.is64) {
             // Use the full signed value.
-            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+            imm = to_signed(pimm->v);
         } else {
             // Use only the low 32 bits of the value.
-            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+            imm = gsl::narrow_cast<int32_t>(imm);
         }
         auto imm_interval = interval_t{imm};
         switch (bin.op) {
@@ -521,8 +521,8 @@ void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>&
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
-                if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                    m_registers.insert(dst_register, loc, *dst_rf_opt + imm_interval);
+                if (auto dst_rf_ptr_opt = m_registers.find(dst_register)) {
+                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt + imm_interval);
                 }
                 else {
                     m_registers -= dst_register;
@@ -532,8 +532,8 @@ void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>&
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) break;
-                if (auto dst_rf_opt = m_registers.find(dst_register)) {
-                    m_registers.insert(dst_register, loc, *dst_rf_opt + (-imm_interval));
+                if (auto dst_rf_ptr_opt = m_registers.find(dst_register)) {
+                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt + (-imm_interval));
                 }
                 else {
                     m_registers -= dst_register;
@@ -552,8 +552,8 @@ void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>&
         switch (bin.op) {
             case Op::MOV: {
                 // ra = rb
-                if (auto src_rf_opt = m_registers.find(src.v)) {
-                    m_registers.insert(dst_register, loc, *src_rf_opt);
+                if (auto src_rf_ptr_opt = m_registers.find(src.v)) {
+                    m_registers.insert(dst_register, loc, *src_rf_ptr_opt);
                 }
                 else {
                     m_registers -= dst_register;
@@ -562,17 +562,17 @@ void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>&
             }
             case Op::ADD: {
                 // ra += rb
-                auto dst_rf_opt = m_registers.find(dst_register);
-                auto src_rf_opt = m_registers.find(src.v);
-                if (dst_rf_opt.has_value() && src_rf_opt.has_value()) {
+                auto dst_rf_ptr_opt = m_registers.find(dst_register);
+                auto src_rf_ptr_opt = m_registers.find(src.v);
+                if (dst_rf_ptr_opt.has_value() && src_rf_ptr_opt.has_value()) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
-                else if (dst_rf_opt.has_value() && numeric_rf_src.has_value()) {
-                    m_registers.insert(dst_register, loc, *dst_rf_opt + *numeric_rf_src);
+                else if (dst_rf_ptr_opt.has_value() && src_rf_numeric_opt.has_value()) {
+                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt + *src_rf_numeric_opt);
                 }
-                else if (numeric_rf_dst.has_value() && src_rf_opt.has_value()) {
-                    m_registers.insert(dst_register, loc, *numeric_rf_dst + *src_rf_opt);
+                else if (dst_rf_numeric_opt.has_value() && src_rf_ptr_opt.has_value()) {
+                    m_registers.insert(dst_register, loc, *dst_rf_numeric_opt + *src_rf_ptr_opt);
                 }
                 else {
                     m_registers -= dst_register;
@@ -581,16 +581,16 @@ void offset_domain_t::do_bin(const Bin& bin, const std::optional<refinement_t>&
             }
             case Op::SUB: {
                 // ra -= rb
-                auto dst_rf_opt = m_registers.find(dst_register);
-                auto src_rf_opt = m_registers.find(src.v);
-                if (dst_rf_opt.has_value() && src_rf_opt.has_value()) {
+                auto dst_rf_ptr_opt = m_registers.find(dst_register);
+                auto src_rf_ptr_opt = m_registers.find(src.v);
+                if (dst_rf_ptr_opt.has_value() && src_rf_ptr_opt.has_value()) {
                     // possibly subtracting two pointers
                     m_registers -= dst_register;
                 }
-                else if (dst_rf_opt.has_value() && numeric_rf_src.has_value()) {
-                    m_registers.insert(dst_register, loc, *dst_rf_opt - *numeric_rf_src);
+                else if (dst_rf_ptr_opt.has_value() && src_rf_numeric_opt.has_value()) {
+                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt - *src_rf_numeric_opt);
                 }
-                else {
+                else { // when dst is numeric, we keep no information about subtraction
                     m_registers -= dst_register;
                 }
                 break;
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 862158dd2..ec6331c0c 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -161,7 +161,7 @@ class offset_domain_t final {
 
     bool do_load(const Mem&, const register_t&, std::optional<ptr_or_mapfd_t>, location_t);
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>&);
-    void do_bin(const Bin&, const std::optional<refinement_t>&, const std::optional<refinement_t>&,
+    void do_bin(const Bin&, std::optional<refinement_t>, std::optional<refinement_t>,
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     bool check_packet_access(const Reg&, int, int, bool) const;
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index ba7f41916..c05d8ba8d 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1081,7 +1081,7 @@ void region_domain_t::update_ptr_or_mapfd(const ptr_or_mapfd_t& ptr_or_mapfd, co
         m_registers.insert(reg, loc, ptr_or_mapfd);
     }
     else {
-        m_errors.push_back("mapfd register cannot be incremented/decremented");
+        m_errors.push_back(loc.to_string() + ": Cannot update mapfd type through arithmetic");
         m_registers -= reg;
     }
 }
@@ -1091,15 +1091,14 @@ void region_domain_t::operator()(const Bin& b, location_t loc) {
 }
 
 void region_domain_t::do_bin(const Bin& bin,
-                             const std::optional<interval_t>& dst_signed_interval_opt,
-                             const std::optional<interval_t>& src_signed_interval_opt,
+                             std::optional<interval_t> dst_signed_interval_opt,
+                             std::optional<interval_t> src_signed_interval_opt,
                              location_t loc) {
 
     auto dst_register = register_t{bin.dst.v};
     auto dst_ptr_or_mapfd_opt = m_registers.find(dst_register);
-    bool is_numeric_dst = !(dst_ptr_or_mapfd_opt.has_value());
-    bool is_numeric_src = std::holds_alternative<Imm>(bin.v) ||
-        !(find_ptr_or_mapfd_type(register_t{std::get<Reg>(bin.v).v}).has_value());
+    bool is_numeric_dst = dst_signed_interval_opt.has_value();
+    bool is_numeric_src = std::holds_alternative<Imm>(bin.v) || src_signed_interval_opt.has_value();
 
     if (is_numeric_dst && is_numeric_src) {
         m_registers -= dst_register;
@@ -1108,16 +1107,16 @@ void region_domain_t::do_bin(const Bin& bin,
 
     using Op = Bin::Op;
 
-    if (std::holds_alternative<Imm>(bin.v)) {
+    if (auto pimm = std::get_if<Imm>(&bin.v)) {
         int64_t imm;
         if (bin.is64) {
             // Use the full signed value.
-            imm = static_cast<int64_t>(std::get<Imm>(bin.v).v);
+            imm = to_signed(pimm->v);
         } else {
             // Use only the low 32 bits of the value.
-            imm = static_cast<int>(std::get<Imm>(bin.v).v);
+            imm = gsl::narrow_cast<int64_t>(pimm->v);
         }
-        auto imm_interval = interval_t{number_t{imm}};
+        auto imm_interval = interval_t{imm};
         switch (bin.op) {
             case Op::MOV: {
                 // ra = imm, we forget the type in the region domain
@@ -1201,7 +1200,7 @@ void region_domain_t::do_bin(const Bin& bin,
                 }
                 else {
                     // ptr -= ptr
-                    // this case already handled in type domain
+                    // this case already handled in the inference domain
                 }
                 break;
             }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index db53882e9..c7f4687e3 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -174,8 +174,7 @@ class region_domain_t final {
     void do_load_mapfd(register_t, int, location_t);
     bool do_load(const Mem&, const register_t&, location_t);
     void do_mem_store(const Mem&, location_t);
-    void do_bin(const Bin&, const std::optional<interval_t>&, const std::optional<interval_t>&,
-                location_t);
+    void do_bin(const Bin&, std::optional<interval_t>, std::optional<interval_t>, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int, location_t);
     void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 02f12f0ed..abea9c912 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -655,6 +655,7 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
         dst_signed_interval = dst_signed_rf->get_interval_value();
     }
 
+    std::string loc_str = loc.to_string();
     std::optional<interval_t> subtracted;
     using Op = Bin::Op;
     // ptr -= ptr
@@ -664,7 +665,7 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
             auto src_ptr = *src_ptr_or_mapfd;
             if (std::holds_alternative<mapfd_t>(dst_ptr)
                     && std::holds_alternative<mapfd_t>(src_ptr)) {
-                m_errors.push_back("mapfd registers subtraction not defined");
+                m_errors.push_back(loc_str + ": Subtraction between mapfds is not allowed");
             }
             else if (same_region(dst_ptr, src_ptr)) {
                 if (std::holds_alternative<ptr_with_off_t>(dst_ptr)) {
@@ -679,7 +680,7 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
                 }
                 else {
                     // This should not happen as same_region only allows non-shared pointers
-                    m_errors.push_back("subtraction between pointers of different region");
+                    m_errors.push_back(loc_str + ": Subtraction between pointers of different regions");
                 }
             }
             m_region -= dst_register;

From 5efc52894c337288b719d785ca127413a0d6da71 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Mon, 23 Jun 2025 01:22:29 -0400
Subject: [PATCH 351/373] Changes in Assume function

Added some extra checks to identify potential issues;
Refactoring

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp  |  2 +-
 src/crab/region_domain.hpp  |  2 +-
 src/crab/type_inference.cpp | 52 +++++++++++++++++++++----------------
 3 files changed, 31 insertions(+), 25 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index c05d8ba8d..5ec600c4c 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -602,7 +602,7 @@ void region_domain_t::operator()(const Exit &u, location_t loc) {}
 void region_domain_t::operator()(const Jmp &u, location_t loc) {}
 
 
-void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t&& shared_ptr, int64_t imm,
+void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t shared_ptr, int64_t imm,
         register_t left, location_t loc) {
     // we only reach here when the ptr is shared ptr
     auto nullness = shared_ptr.get_nullness();
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index c7f4687e3..eed6e28f0 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -177,7 +177,7 @@ class region_domain_t final {
     void do_bin(const Bin&, std::optional<interval_t>, std::optional<interval_t>, location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void check_valid_access(const ValidAccess &, int, location_t);
-    void assume_cst(Condition::Op, ptr_with_off_t&&, int64_t, register_t, location_t);
+    void assume_cst(Condition::Op, ptr_with_off_t, int64_t, register_t, location_t);
     void update_ptr_or_mapfd(const ptr_or_mapfd_t&, const interval_t&, location_t, register_t);
 
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_type(register_t) const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index abea9c912..654212e02 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -309,10 +309,9 @@ void inference_domain_t::operator()(const Packet& u, location_t loc) {
 }
 
 static inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
-        const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd2,
-        const std::optional<refinement_t>& interval1,
-        const std::optional<refinement_t>& interval2) {
-    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return false;
+        std::optional<ptr_or_mapfd_t> ptr_or_mapfd2, std::optional<refinement_t> interval1,
+        std::optional<refinement_t> interval2) {
+    if (is_mapfd_type(ptr_or_mapfd1) && is_mapfd_type(ptr_or_mapfd2)) return true;
     if (ptr_or_mapfd1 && ptr_or_mapfd2 && same_region(*ptr_or_mapfd1, *ptr_or_mapfd2))
         return true;
     if (interval1 && interval2) return true;
@@ -321,27 +320,33 @@ static inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
 
 void inference_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
-    const auto& maybe_left_type = m_region.find_ptr_or_mapfd_type(cond.left.v);
-    const auto& maybe_left_rf = m_interval.find_interval_value(cond.left.v);
-    assert(!maybe_left_type.has_value() || !maybe_left_rf.has_value());
-    if (std::holds_alternative<Reg>(cond.right)) {
-        const auto& right_reg = std::get<Reg>(cond.right);
-        const auto& maybe_right_type = m_region.find_ptr_or_mapfd_type(right_reg.v);
-        const auto& maybe_right_rf = m_interval.find_interval_value(right_reg.v);
-        assert(!maybe_right_type.has_value() || !maybe_right_rf.has_value());
-        // TODO: it does not handle for mapfd yet
-        if (same_type(maybe_left_type, maybe_right_type, maybe_left_rf, maybe_right_rf)) {
+    const auto maybe_left_ptr = m_region.find_ptr_or_mapfd_type(cond.left.v);
+    const auto maybe_left_rf = m_interval.find_interval_value(cond.left.v);
+    assert(!maybe_left_ptr.has_value() || !maybe_left_rf.has_value());
+    if (const auto pright_reg = std::get_if<Reg>(&cond.right)) {
+        const auto maybe_right_ptr = m_region.find_ptr_or_mapfd_type(pright_reg->v);
+        const auto maybe_right_rf = m_interval.find_interval_value(pright_reg->v);
+        assert(!maybe_right_ptr.has_value() || !maybe_right_rf.has_value());
+        if (same_type(maybe_left_ptr, maybe_right_ptr, maybe_left_rf, maybe_right_rf)) {
             if (maybe_left_rf) {
                 // both numbers
                 m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v},
                         cond.right, loc);
             }
-            else if (maybe_left_type) {
-                if (is_packet_ptr(maybe_left_type)) {
+            else if (maybe_left_ptr) {
+                if (is_packet_ptr(maybe_left_ptr)) {
                     // both packet pointers
                     m_offset(s, loc);
                 }
+                else if (is_mapfd_type(maybe_left_ptr)) {
+                    CRAB_ERROR("Mapfd type is not supported in inference domain");
+                    // both mapfds
+                }
+                else if (is_stack_ptr(maybe_left_ptr) || is_ctx_ptr(maybe_left_ptr)) {
+                    CRAB_ERROR("Assume on stack/ctx pointers is not supported in inference domain");
+                }
                 else {
+                    CRAB_ERROR("Assume on shared pointers is not supported in inference domain");
                     // other cases, not implemented yet
                 }
             }
@@ -350,18 +355,19 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
             // We should only reach here if `--assume-assert` is off
             assert(!thread_local_options.assume_assertions || is_bottom());
             // be sound in any case, it happens to flush out bugs:
-            m_region.set_registers_to_top();
+            set_to_top();
         }
     }
     else {
-        if (is_shared_ptr(maybe_left_type)) {
+        if (is_shared_ptr(maybe_left_ptr)) {
             // left is a shared pointer
-            int64_t imm = static_cast<int64_t>(std::get<Imm>(cond.right).v);
-            auto shared_ptr = std::get<ptr_with_off_t>(*maybe_left_type);
-            m_region.assume_cst(cond.op, std::move(shared_ptr), imm, cond.left.v, loc);
+            const int64_t imm = gsl::narrow_cast<int64_t>(std::get<Imm>(cond.right).v);
+            auto shared_ptr = std::get<ptr_with_off_t>(*maybe_left_ptr);
+            m_region.assume_cst(cond.op, shared_ptr, imm, cond.left.v, loc);
         }
-        if (is_mapfd_type(maybe_left_type)) {
-            // left is  a mapfd
+        if (is_mapfd_type(maybe_left_ptr)) {
+            CRAB_ERROR("Mapfd type is not supported in inference domain");
+            // left is a mapfd
             // TODO: need to work with values
         }
         else if (maybe_left_rf) {

From 4a6d2af44aa6558329d0e721618832c5df34a8b2 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Tue, 24 Jun 2025 11:20:18 -0400
Subject: [PATCH 352/373] Refactoring in Refinement, expression, constraint,
 symbol class

Major change: rather than keeping pointer to values of slacks in each of
these classes, use a single pointer that is being passed to wherever it
is needed;
A lot of cleanup of code, addressed some minor issues;
Better printing;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp               |  97 +++++++------
 src/crab/constraint.hpp               |  24 ++--
 src/crab/expression.cpp               | 163 ++++++++++-----------
 src/crab/expression.hpp               |  58 ++++----
 src/crab/interval_domain.cpp          |  63 ++++-----
 src/crab/offset_domain.cpp            |  77 +++++-----
 src/crab/offset_domain.hpp            |  14 +-
 src/crab/refinement.cpp               | 195 ++++++++++++++------------
 src/crab/refinement.hpp               |  83 ++++++-----
 src/crab/signed_interval_domain.cpp   |  56 +++++---
 src/crab/signed_interval_domain.hpp   |  16 ++-
 src/crab/symbol.hpp                   |   7 +-
 src/crab/type_inference.cpp           |  63 +++++----
 src/crab/type_ostream.cpp             |  65 +++++----
 src/crab/type_ostream.hpp             |  28 ++--
 src/crab/unsigned_interval_domain.cpp |  55 +++++---
 src/crab/unsigned_interval_domain.hpp |  18 ++-
 17 files changed, 597 insertions(+), 485 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index 60e5b21c4..b3a558275 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -16,24 +16,41 @@ bool constraint_t::contains(const symbol_t &s) const {
 }
 
 // get slack intervals for all symbols in the constraint
-std::map<symbol_t, interval_t> constraint_t::get_slack_intervals() const {
-    return _lhs.get_slack_intervals();
+std::vector<symbol_t> constraint_t::get_slacks() const {
+    return _lhs.get_slacks();
 }
 
-interval_t constraint_t::compute_subtraction(const symbol_t &a, const symbol_t &b) const {
-    expression_t lhs = _lhs.get_equivalent_expression();
-    int coeff_a = static_cast<int>(lhs.get_coefficient(a));
-    int coeff_b = static_cast<int>(lhs.get_coefficient(b));
-    interval_t constant = lhs.get_constant_term();
-    if (coeff_a == 1 && coeff_b == -1) {
-        // a - b + [lb, ub] <= 0 -> a - b = [-oo, -lb]
-        return interval_t{bound_t::minus_infinity(), -constant.lb()};
-    } else if (coeff_a == -1 && coeff_b == 1) {
-        // b - a + [lb, ub] <= 0 -> a - b = [lb, +oo]
-        return interval_t{constant.lb(), bound_t::plus_infinity()};
-    } else {
+// compute the subtraction of two symbols present in the constraint
+interval_t constraint_t::compute_subtraction(const symbol_t &a, const symbol_t &b,
+                                             std::shared_ptr<slacks_t> slacks) const {
+    if (!contains(a) || !contains(b)) {
+        // if either symbol is not present, return top interval
         return interval_t::top();
     }
+    expression_t lhs = _lhs.get_equivalent_expression(slacks);
+    if (lhs.get_num_terms() == 2) {
+        int coeff_a = static_cast<int>(lhs.get_coefficient(a));
+        int coeff_b = static_cast<int>(lhs.get_coefficient(b));
+        interval_t constant = lhs.get_constant_term();
+        if (coeff_a == 1 && coeff_b == -1) {
+            // a - b + [lb, ub] <= 0
+            // -> a - b + k <= 0, k in [lb, ub]
+            // -> a - b <= -k, k in [lb, ub]
+            // -> a - b <= -ub, a - b <= -lb
+            // -> a - b <= -lb is a weaker constraint
+            // -> a - b = [-oo, -lb]
+            return interval_t{bound_t::minus_infinity(), -constant.lb()};
+        } else if (coeff_a == -1 && coeff_b == 1) {
+            // b - a + [lb, ub] <= 0
+            // -> b - a + k <= 0, k in [lb, ub]
+            // -> b - a <= -k, k in [lb, ub]
+            // -> b - a <= -ub, b - a <= -lb
+            // -> lb <= a - b, ub <= a - b
+            // -> a - b = [lb, +oo]
+            return interval_t{constant.lb(), bound_t::plus_infinity()};
+        }
+    }
+    return interval_t::top();
 }
 
 constraint_t constraint_t::negate() const {
@@ -41,11 +58,11 @@ constraint_t constraint_t::negate() const {
     return constraint_t(_rhs, _lhs - 1);
 }
 
-constraint_t constraint_t::operator|(const constraint_t &other) const {
-    if (other.implies(*this)) {
+constraint_t constraint_t::join(const constraint_t &other, std::shared_ptr<slacks_t> slacks) const {
+    if (other.implies(*this, slacks)) {
         // other => this
         return *this;
-    } else if (implies(other)) {
+    } else if (implies(other, slacks)) {
         // this => other
         return other;
     } else {
@@ -58,13 +75,13 @@ constraint_t constraint_t::operator|(const constraint_t &other) const {
             return constraint_t::begin_end_init_constraint();
         }
         else {
-            return constraint_t::get_true();
+            return constraint_t::true_constraint();
         }
     }
 }
 
-constraint_t constraint_t::widen(const constraint_t &other) const {
-    if (this->implies(other) && other.implies(*this)) {
+constraint_t constraint_t::widen(const constraint_t &other, std::shared_ptr<slacks_t> slacks) const {
+    if (this->implies(other, slacks) && other.implies(*this, slacks)) {
         // this == other
         return *this;
     } else {
@@ -77,16 +94,11 @@ constraint_t constraint_t::widen(const constraint_t &other) const {
             return constraint_t::begin_end_init_constraint();
         }
         else {
-            return constraint_t::get_true();
+            return constraint_t::true_constraint();
         }
     }
 }
 
-// inclusion operator
-bool constraint_t::operator<=(const constraint_t &other) const {
-    return this->implies(other);
-}
-
 bool constraint_t::is_meta_begin_constraint() const {
     return _lhs.contains(symbol_t::meta()) && _lhs.contains(symbol_t::begin());
 }
@@ -95,31 +107,38 @@ bool constraint_t::is_begin_end_constraint() const {
     return _lhs.contains(symbol_t::begin()) && _lhs.contains(symbol_t::end());
 }
 
-bool constraint_t::is_bottom() const {
-    // lhs > rhs is bottom
-    return _lhs > _rhs;
+bool constraint_t::check_eq(const constraint_t &other, std::shared_ptr<slacks_t> slacks) const {
+    // check if this constraint is equal to the other constraint
+    return _lhs.check_eq(other.get_lhs(), slacks);
 }
 
-bool constraint_t::is_top() const {
-    // lhs <= rhs is top
-    // in expression_t, we need to support <= operator as inclusion operator,
-    // hence we use check_le instead of operator<=
-    return _lhs.check_le(_rhs);
+bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) const {
+    if (this->check_eq(constraint_t::false_constraint(), slacks)) {
+        return true; // false constraint is bottom
+    }
+    // lhs > rhs is bottom
+    return _lhs.check_gt(_rhs, slacks);
 }
 
 constraint_t constraint_t::operator+(constraint_t c2) const {
     return constraint_t(_lhs + c2.get_lhs());
 }
 
-bool constraint_t::is_unsat(constraint_t other) const {
+bool constraint_t::is_unsat(constraint_t other, std::shared_ptr<slacks_t> slacks) const {
     // check if the other constraint is unsat with this constraint
-    return operator+(other).is_bottom();
+    return operator+(other).is_bottom(slacks);
 }
 
-bool constraint_t::implies(const constraint_t& other) const {
+bool constraint_t::implies(const constraint_t& other, std::shared_ptr<slacks_t> slacks) const {
+    if (this->check_eq(constraint_t::true_constraint(), slacks)
+        && other.check_eq(constraint_t::false_constraint(), slacks)) {
+        return false;
+    }
+    if (other.check_eq(constraint_t::true_constraint(), slacks)) {
+        return true;
+    }
     // c1 => c2 iff c1 and not c2 is unsat
-    constraint_t negated = other.negate();
-    return is_unsat(std::move(negated));
+    return is_unsat(std::move(other.negate()), slacks);
 }
 
 void constraint_t::write(std::ostream &o) const {
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index c2724aff7..bba306df9 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -16,12 +16,12 @@ class constraint_t {
     constraint_t(bool is_true) : _lhs(is_true ? 0 : 1), _rhs(0) {}
 
   public:
-    constraint_t() : _lhs(1), _rhs(0) {} // false constraint
+    constraint_t() : constraint_t(true) {} // default is true constraint
     constraint_t(expression_t lhs, expression_t rhs)
         : _lhs(lhs - rhs), _rhs(expression_t(0)) {}
     constraint_t(expression_t lhs) : _lhs(lhs), _rhs(expression_t(0)) {}
-    static constraint_t get_false() { return constraint_t(false); }
-    static constraint_t get_true() { return constraint_t(true); }
+    static constraint_t false_constraint() { return constraint_t(false); }
+    static constraint_t true_constraint() { return constraint_t(true); }
     static constraint_t meta_begin_init_constraint() {
         // construct meta <= begin
         return constraint_t(expression_t::meta(), expression_t::begin());
@@ -34,18 +34,18 @@ class constraint_t {
     bool is_meta_begin_constraint() const;
     bool is_begin_end_constraint() const;
     [[nodiscard]] expression_t get_lhs() const { return _lhs; }
-    std::map<symbol_t, interval_t> get_slack_intervals() const;
+    std::vector<symbol_t> get_slacks() const;
     bool contains(const symbol_t&) const;
-    bool implies(const constraint_t&) const;
+    bool implies(const constraint_t&, std::shared_ptr<slacks_t>) const;
     constraint_t operator+(constraint_t) const;
-    bool is_unsat(constraint_t) const;
-    bool is_bottom() const;
-    bool is_top() const;
-    interval_t compute_subtraction(const symbol_t&, const symbol_t&) const;
+    bool check_eq(const constraint_t&, std::shared_ptr<slacks_t>) const;
+    bool is_unsat(constraint_t, std::shared_ptr<slacks_t>) const;
+    bool is_bottom(std::shared_ptr<slacks_t>) const;
+    interval_t compute_subtraction(const symbol_t&, const symbol_t&,
+                                   std::shared_ptr<slacks_t>) const;
     [[nodiscard]] constraint_t negate() const;
-    constraint_t operator|(const constraint_t&) const;
-    constraint_t widen(const constraint_t&) const;
-    bool operator<=(const constraint_t&) const;
+    constraint_t join(const constraint_t&, std::shared_ptr<slacks_t>) const;
+    constraint_t widen(const constraint_t&, std::shared_ptr<slacks_t>) const;
     void write(std::ostream&) const;
     friend std::ostream& operator<<(std::ostream &, const constraint_t&);
 };
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index e0e0f8354..ee71fc6df 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -10,20 +10,15 @@ std::ostream& operator<<(std::ostream& o, const expression_t& e) {
     return o;
 }
 
-// get values for all slack variables in the expression
-std::map<symbol_t, interval_t> expression_t::get_slack_intervals() const {
-    std::map<symbol_t, interval_t> slack_intervals;
-    for (const auto &term : _symbol_terms) {
-        if (term.first.is_slack()) {
-            // assuming that there are no conflicting values
-            // TODO: check what to do in case value is not found
-            auto it = _slacks->find(term.first);
-            if (it != _slacks->end()) {
-                slack_intervals.insert_or_assign(term.first, it->second);
-            }
+// get all slack variables in the expression
+std::vector<symbol_t> expression_t::get_slacks() const {
+    std::vector<symbol_t> slacks;
+    for (const auto [s, v] : _symbol_terms) {
+        if (s.is_slack()) {
+            slacks.push_back(s);
         }
     }
-    return slack_intervals;
+    return slacks;
 }
 
 int8_t expression_t::get_coefficient(const symbol_t &s) const {
@@ -35,21 +30,24 @@ int8_t expression_t::get_coefficient(const symbol_t &s) const {
 }
 
 // get an equivalent expression with all slack variables replaced by their values
-expression_t expression_t::get_equivalent_expression() const {
+expression_t expression_t::get_equivalent_expression(std::shared_ptr<slacks_t> _slacks) const {
     interval_t value = _constant_term;
     symbol_terms_t symbol_terms;
-    for (const auto &term : _symbol_terms) {
-        if (term.first.is_slack()) {
-            auto it = _slacks->find(term.first);
-            // TODO: check what to do in case value is not found
+    for (const auto [s, v] : _symbol_terms) {
+        if (s.is_slack()) {
+            auto it = _slacks->find(s);
             if (it != _slacks->end()) {
-                value = value + (it->second * interval_t{static_cast<int>(term.second)});
+                value = value + (it->second * interval_t{static_cast<int>(v)});
+            }
+            else {
+                // if slack variable is not found, we can't resolve it, hence return top
+                return expression_t();
             }
         } else {
-            symbol_terms[term.first] = term.second;
+            symbol_terms[s] = v;
         }
     }
-    return expression_t(symbol_terms, value, _slacks);
+    return expression_t(symbol_terms, value);
 }
 
 template <typename T, typename Op>
@@ -59,15 +57,15 @@ static bool check_op(const symbol_terms_t& s1, const symbol_terms_t& s2, const T
 }
 
 // equality
-bool expression_t::operator==(const expression_t &other) const {
+bool expression_t::check_eq(const expression_t &other, std::shared_ptr<slacks_t> _slacks) const {
     auto check = [](const interval_t &a, const interval_t &b) { return a == b; };
     if (check_op(_symbol_terms, other._symbol_terms, _constant_term, other._constant_term, check)) {
         // syntactic equality
         return true;
     }
     // check if two expressions are equal, by getting equivalent expressions and comparing them
-    expression_t e1 = get_equivalent_expression();
-    expression_t e2 = other.get_equivalent_expression();
+    expression_t e1 = get_equivalent_expression(_slacks);
+    expression_t e2 = other.get_equivalent_expression(_slacks);
     if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term, e2._constant_term, check)) {
         return true;
     }
@@ -75,14 +73,14 @@ bool expression_t::operator==(const expression_t &other) const {
     return false;
 }
 
-// less than or equal, named check_le to avoid confusion with operator<= (inclusion operator)
-bool expression_t::check_le(const expression_t &other) const {
+// less than or equal
+bool expression_t::check_le(const expression_t &other, std::shared_ptr<slacks_t> _slacks) const {
     auto check = [](const bound_t &a, const bound_t &b) { return a <= b; };
     if (check_op(_symbol_terms, other._symbol_terms, _constant_term.ub(), other._constant_term.lb(), check)) {
         return true;
     }
-    expression_t e1 = get_equivalent_expression();
-    expression_t e2 = other.get_equivalent_expression();
+    expression_t e1 = get_equivalent_expression(_slacks);
+    expression_t e2 = other.get_equivalent_expression(_slacks);
     if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.ub(), e2._constant_term.lb(), check)) {
         return true;
     }
@@ -91,13 +89,13 @@ bool expression_t::check_le(const expression_t &other) const {
 }
 
 // greater than
-bool expression_t::operator>(const expression_t &other) const {
+bool expression_t::check_gt(const expression_t &other, std::shared_ptr<slacks_t> _slacks) const {
     auto check = [](const bound_t &a, const bound_t &b) { return a > b; };
     if (check_op(_symbol_terms, other._symbol_terms, _constant_term.lb(), other._constant_term.ub(), check)) {
         return true;
     }
-    expression_t e1 = get_equivalent_expression();
-    expression_t e2 = other.get_equivalent_expression();
+    expression_t e1 = get_equivalent_expression(_slacks);
+    expression_t e2 = other.get_equivalent_expression(_slacks);
     if (check_op(e1._symbol_terms, e2._symbol_terms, e1._constant_term.lb(), e2._constant_term.ub(), check)) {
         return true;
     }
@@ -105,12 +103,7 @@ bool expression_t::operator>(const expression_t &other) const {
     return false;
 }
 
-// check if an expression contains only an interval
-bool expression_t::only_has_interval() const {
-    return _symbol_terms.empty();
-}
-
-// check if an expression contains a single symbol, which can be slack or not
+// check if an expression contains a single symbol, which can be slack or packet symbol
 bool expression_t::is_singleton() const {
     return _symbol_terms.size() == 1 && _constant_term == interval_t{0};
 }
@@ -129,8 +122,9 @@ symbol_t expression_t::get_singleton() const {
 // insert a symbol term into a list of symbol terms
 static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv) {
     // add coefficient to term if it already exists
-    if (terms.find(kv.first) != terms.end()) {
-        terms[kv.first] += kv.second;
+    auto it = terms.find(kv.first);
+    if (it != terms.end()) {
+        terms.insert_or_assign(kv.first, it->second + kv.second);
         // remove term if coefficient is zero
         if (terms[kv.first] == 0) {
             terms.erase(kv.first);
@@ -143,26 +137,24 @@ static void insert(symbol_terms_t &terms, const std::pair<symbol_t, int8_t>& kv)
 // add two expressions, and return the result
 expression_t expression_t::operator+(const expression_t &other) const {
     auto new_terms = _symbol_terms;
-    for (const auto &term : other._symbol_terms) {
+    for (const auto term : other._symbol_terms) {
         insert(new_terms, term);
     }
-    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
-    return expression_t(new_terms, _constant_term + other._constant_term, slacks);
+    return expression_t(new_terms, _constant_term + other._constant_term);
 }
 
 // add a constant to an expression, and return the result
 expression_t expression_t::operator+(interval_t constant) const {
-    return expression_t(_symbol_terms, _constant_term + constant, _slacks);
+    return expression_t(_symbol_terms, _constant_term + constant);
 }
 
 // subtract an expression from another, and return the result
 expression_t expression_t::operator-(const expression_t &other) const {
     auto new_terms = _symbol_terms;
-    for (const auto &term : other._symbol_terms) {
-        insert(new_terms, {term.first, -term.second});
+    for (const auto [s, v] : other._symbol_terms) {
+        insert(new_terms, {s, -v});
     }
-    auto slacks = _slacks == nullptr ? other._slacks : _slacks;
-    return expression_t(new_terms, _constant_term - other._constant_term, slacks);
+    return expression_t(new_terms, _constant_term - other._constant_term);
 }
 
 // add an integer to an expression, and return the result
@@ -172,10 +164,9 @@ expression_t expression_t::operator+(int n) const {
 
 using IntervalJoin = std::function<interval_t(const interval_t&, const interval_t&)>;
 
-static inline expression_t join(const expression_t* e1, const expression_t &e2,
-                                IntervalJoin join) {
-    auto slacks = e1->get_slacks() == nullptr ? e2.get_slacks() : e1->get_slacks();
-    if (*e1 == e2) {
+static inline expression_t join_or_widen(const expression_t* e1, const expression_t &e2,
+                                std::shared_ptr<slacks_t> slacks, IntervalJoin joinFunc) {
+    if (e1->check_eq(e2, slacks)) {
         // both expressions are equal
         return *e1;
     }
@@ -184,18 +175,20 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
     const symbol_terms_t& e1_terms = e1->get_symbol_terms();
     const symbol_terms_t& e2_terms = e2.get_symbol_terms();
     symbol_terms_t new_terms;
-    for (const auto &term : e1_terms) {
-        if (e2_terms.find(term.first) != e2_terms.end()
-            && term.second == e2_terms.at(term.first)) {
+    for (const auto [s, v] : e1_terms) {
+        if (e2_terms.find(s) != e2_terms.end() && v == e2_terms.at(s)) {
             // for any symbol, if it exists in both expressions, and the coefficients are the same
             // then the term can be added to the new expression
-            new_terms[term.first] = term.second;
-        } else if (term.first.is_slack()) {
+            new_terms.insert_or_assign(s, v);
+        } else if (s.is_slack()) {
             // either the symbol was not found in the e2 expression, or the coefficients are different
-            auto it = slacks->find(term.first);
+            auto it = slacks->find(s);
             if (it != slacks->end()) {
-                e1_constant_term = e1_constant_term +
-                    (interval_t{static_cast<int>(term.second)} * it->second);
+                e1_constant_term = e1_constant_term + (interval_t{static_cast<int>(v)} * it->second);
+            }
+            else {
+                // if slack variable is not found, we can't resolve it, hence return top
+                return expression_t();
             }
         }
         else {
@@ -204,17 +197,20 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
             return expression_t();
         }
     }
-    for (const auto &term : e2_terms) {
-        if (new_terms.find(term.first) != new_terms.end()) {
+    for (const auto [s, v] : e2_terms) {
+        if (new_terms.find(s) != new_terms.end()) {
             // if the symbol is already handled in the previous loop, then we skip it
             continue;
         }
-        if (term.first.is_slack()) {
+        if (s.is_slack()) {
             // the slack variable was not handled before, hence we resolve its value
-            auto it = slacks->find(term.first);
+            auto it = slacks->find(s);
             if (it != slacks->end()) {
-                e2_constant_term = e2_constant_term +
-                    (interval_t{static_cast<int>(term.second)} * it->second);
+                e2_constant_term = e2_constant_term + (interval_t{static_cast<int>(v)} * it->second);
+            }
+            else {
+                // if slack variable is not found, we can't resolve it, hence return top
+                return expression_t();
             }
         }
         else {
@@ -226,26 +222,31 @@ static inline expression_t join(const expression_t* e1, const expression_t &e2,
     // in case there are different slack variables in the two expressions, we can't merge them,
     // so we construct a new slack variable and assign its value to the join of added intervals
     symbol_t new_slack = symbol_t::make();
-    new_terms[new_slack] = 1;
-    // either join or widen
-    slacks->insert_or_assign(new_slack, join(e1_constant_term, e2_constant_term));
-    return expression_t(new_terms, interval_t{0}, slacks);
+    new_terms.insert_or_assign(new_slack, 1);
+    // joinFunc is either join or widen
+    slacks->insert_or_assign(new_slack, joinFunc(e1_constant_term, e2_constant_term));
+    return expression_t(new_terms, interval_t{0});
 }
 
-expression_t expression_t::operator|(const expression_t &other) const {
-    return join(this, other, [](const interval_t& a, const interval_t& b) { return a | b; });
+expression_t expression_t::join(const expression_t &other,
+                                std::shared_ptr<slacks_t> _slacks) const {
+    return join_or_widen(this, other, _slacks, [](const interval_t& a, const interval_t& b)
+                { return a | b; });
 }
 
-expression_t expression_t::widen(const expression_t &other) const {
-    return join(this, other, [](const interval_t& a, const interval_t& b) { return a.widen(b); });
+expression_t expression_t::widen(const expression_t &other,
+                                 std::shared_ptr<slacks_t> _slacks) const {
+    return join_or_widen(this, other, _slacks, [](const interval_t& a, const interval_t& b)
+                { return a.widen(b); });
 }
 
 
 // inclusion operator
-bool expression_t::operator<=(const expression_t &other) const {
-    expression_t e1 = get_equivalent_expression();
-    expression_t e2 = other.get_equivalent_expression();
-    // if after removing slack variables, the expressions are equal, then the inclusion holds
+bool expression_t::inclusion(const expression_t &other, std::shared_ptr<slacks_t> _slacks) const {
+    expression_t e1 = get_equivalent_expression(_slacks);
+    expression_t e2 = other.get_equivalent_expression(_slacks);
+    // if after removing slack variables, the expressions contain the same (packet symbols),
+    // and (interval1 <= interval2) holds, then the inclusion holds;
     // otherwise, we can't prove the inclusion
     return e1._symbol_terms == e2._symbol_terms && e1._constant_term <= e2._constant_term;
 }
@@ -253,11 +254,11 @@ bool expression_t::operator<=(const expression_t &other) const {
 void expression_t::write(std::ostream &o) const {
     size_t i = 0;
     // print all symbol terms
-    for (const auto &term : _symbol_terms) {
-        if (term.second != 1) {
-            o << static_cast<int>(term.second) << " * ";
+    for (const auto [s, v] : _symbol_terms) {
+        if (v != 1) {
+            o << static_cast<int>(v) << " * ";
         }
-        o << term.first;
+        o << s;
         if (i < _symbol_terms.size() - 1) {
             o << " + ";
         }
@@ -266,7 +267,7 @@ void expression_t::write(std::ostream &o) const {
     // print constant term
     if (auto s = _constant_term.singleton()) {
         // print constant (singleton) term either if it is not zero,
-        // of if it is zero but there are no other terms
+        // or if it is zero but there are no other terms
         if ((cpp_int)*s != 0 || _symbol_terms.empty()) {
             if (!_symbol_terms.empty()) o << " + ";
             o <<  *s;
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index 18e233ef8..f447a9831 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -12,67 +12,61 @@ namespace crab {
 // x, y, z, ... are symbols, and A, B, C, ... are coefficients.
 // I is an interval.
     
-using slacks_t = std::map<symbol_t, interval_t>;
-using symbol_terms_t = std::map<symbol_t, int8_t>;
+using slacks_t = std::map<symbol_t, interval_t>; // mapping from slack symbols to their values
+using symbol_terms_t = std::map<symbol_t, int8_t>; // mapping from symbols to their coefficients
 class expression_t {
   private:
     symbol_terms_t _symbol_terms;
     interval_t _constant_term;
-    std::shared_ptr<slacks_t> _slacks = nullptr;
 
   public:
     expression_t() : _constant_term(interval_t::top()) {};
-    expression_t(symbol_t symbol, std::shared_ptr<slacks_t> slacks = nullptr)
-        : _constant_term(interval_t{0}), _slacks(slacks) {
+    // We assume that the symbol is either a pkt symbol, or a slack variable whose interval is known.
+    expression_t(symbol_t symbol) : _constant_term(interval_t{0}) {
         _symbol_terms[symbol] = 1;
     }
-    expression_t(symbol_terms_t symbol_terms, interval_t interval,
-            std::shared_ptr<slacks_t> slacks = nullptr)
-        : _symbol_terms(symbol_terms), _constant_term(interval), _slacks(slacks) {}
-    expression_t(interval_t interval, std::shared_ptr<slacks_t> slacks = nullptr)
-        : _constant_term(interval), _slacks(slacks) {}
-    expression_t(int n, std::shared_ptr<slacks_t> slacks = nullptr)
-        : _constant_term(interval_t{n}), _slacks(slacks) {}
-    expression_t get_equivalent_expression() const;
-    bool operator==(const expression_t &other) const;
-    bool check_le(const expression_t &other) const;
-    bool operator>(const expression_t &other) const;
+    expression_t(symbol_terms_t symbol_terms, interval_t interval)
+        : _symbol_terms(std::move(symbol_terms)), _constant_term(interval) {}
+    expression_t(interval_t interval) : _constant_term(interval) {}
+    expression_t(int n) : _constant_term(interval_t{n}) {}
+    expression_t get_equivalent_expression(std::shared_ptr<slacks_t>) const;
+    bool check_eq(const expression_t &other, std::shared_ptr<slacks_t>) const;
+    bool check_le(const expression_t &other, std::shared_ptr<slacks_t>) const;
+    bool check_gt(const expression_t &other, std::shared_ptr<slacks_t>) const;
     void operator-=(const symbol_t& s) { _symbol_terms.erase(s); }
     bool is_constant() const { return _symbol_terms.empty(); }
+    interval_t get_constant_term() const { return _constant_term; }
     expression_t operator+(const expression_t &other) const;
     expression_t operator+(interval_t) const;
     expression_t operator+(int n) const;
     expression_t operator-(const expression_t &other) const;
-    expression_t operator|(const expression_t &other) const;
-    expression_t widen(const expression_t &other) const;
-    bool operator<=(const expression_t &other) const;
+    expression_t join(const expression_t &other, std::shared_ptr<slacks_t>) const;
+    expression_t widen(const expression_t &other, std::shared_ptr<slacks_t>) const;
+    bool inclusion(const expression_t &other, std::shared_ptr<slacks_t>) const;
     void write(std::ostream &o) const;
     symbol_terms_t get_symbol_terms() const { return _symbol_terms; }
+    int get_num_terms() const { return _symbol_terms.size(); }
     int8_t get_coefficient(const symbol_t &s) const;
     bool is_singleton() const;
     bool contains(const symbol_t &s) const;
-    bool only_has_interval() const;
     symbol_t get_singleton() const;
-    interval_t get_constant_term() const { return _constant_term; }
-    const std::shared_ptr<slacks_t>& get_slacks() const { return _slacks; }
-    void set_slacks(std::shared_ptr<slacks_t> slacks) { _slacks = slacks; }
-    std::map<symbol_t, interval_t> get_slack_intervals() const;
+    std::vector<symbol_t> get_slacks() const;
     friend std::ostream& operator<<(std::ostream &, const expression_t&);
 
-    static expression_t begin(std::shared_ptr<slacks_t> slacks = nullptr) {
-        return expression_t(symbol_t::begin(), slacks);
+    static expression_t begin() {
+        return expression_t(symbol_t::begin());
     }
 
-    static expression_t end(std::shared_ptr<slacks_t> slacks = nullptr) {
-        return expression_t(symbol_t::end(), slacks);
+    static expression_t end() {
+        return expression_t(symbol_t::end());
     }
 
-    static expression_t meta(std::shared_ptr<slacks_t> slacks = nullptr) {
-        return expression_t(symbol_t::meta(), slacks);
+    static expression_t meta() {
+        return expression_t(symbol_t::meta());
     }
 
-    static expression_t top(std::shared_ptr<slacks_t> slacks = nullptr) {
-        return expression_t(interval_t::top(), slacks);
+    static expression_t top() {
+        return expression_t(interval_t::top());
     }
 };
 
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 6c6a3c08c..3c7e2d6ca 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -209,7 +209,7 @@ interval_domain_t interval_domain_t::setup_entry(std::shared_ptr<slacks_t> slack
 void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, const int finite_width, location_t loc, bool is_signed) {
     auto rf_opt = is_signed ? m_signed.find_interval_value(lhs) : m_unsigned.find_interval_value(lhs);
     if (!rf_opt) return;
-    interval_t interval = rf_opt->get_interval_value();
+    interval_t interval = rf_opt->get_interval_value(m_slacks);
     // numeric_refinement_top() represents interval_t::top()
     refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (interval.ub() - interval.lb() >= span) {
@@ -300,8 +300,8 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
-        zi = zi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
+        zi = zi_opt->get_interval_value(m_slacks);
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
@@ -309,8 +309,8 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
-        zi = zi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
+        zi = zi_opt->get_interval_value(m_slacks);
     }
 
     switch (op) {
@@ -358,14 +358,14 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
             //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
             //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
     }
 
     switch (op) {
@@ -396,14 +396,14 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         if (!yi_opt) {
             //std::cerr << "Error: register " << y << " not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
     }
     interval_t zi{number_t{k.cast_to<uint64_t>()}};
 
@@ -436,8 +436,8 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
-        zi = zi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
+        zi = zi_opt->get_interval_value(m_slacks);
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
@@ -445,8 +445,8 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
             //std::cerr << "Error: registers not found in the interval environment\n";
             return;
         }
-        yi = yi_opt->get_interval_value();
-        zi = zi_opt->get_interval_value();
+        yi = yi_opt->get_interval_value(m_slacks);
+        zi = zi_opt->get_interval_value(m_slacks);
     }
 
     switch (op) {
@@ -533,7 +533,7 @@ void interval_domain_t::sub(const register_t& lhs, const number_t& op2, location
 // Add/subtract with overflow are both signed and unsigned. We can use either one of the two to compute the
 // result before adjusting for overflow, though if one is top we want to use the other to retain precision.
 void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
-    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
     if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
@@ -542,7 +542,7 @@ void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op
 }
 
 void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
-    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
     if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
@@ -551,7 +551,7 @@ void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2,
 }
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
-    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
     if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
@@ -560,7 +560,7 @@ void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op
 }
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
-    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value();
+    interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
     if (!lhs_signed.is_top()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
@@ -1294,14 +1294,14 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
         Value right, location_t loc) {
     using Op = Condition::Op;
 
-    auto left_signed = find_signed_interval_value(left)->get_interval_value();
-    auto left_unsigned = find_unsigned_interval_value(left)->get_interval_value();
+    auto left_signed = find_signed_interval_value(left)->get_interval_value(m_slacks);
+    auto left_unsigned = find_unsigned_interval_value(left)->get_interval_value(m_slacks);
     auto right_signed = interval_t::bottom();
     auto right_unsigned = interval_t::bottom();
     if (std::holds_alternative<Reg>(right)) {
         auto right_reg = register_t{std::get<Reg>(right).v};
-        right_signed = find_signed_interval_value(right_reg)->get_interval_value();
-        right_unsigned = find_unsigned_interval_value(right_reg)->get_interval_value();
+        right_signed = find_signed_interval_value(right_reg)->get_interval_value(m_slacks);
+        right_unsigned = find_unsigned_interval_value(right_reg)->get_interval_value(m_slacks);
     } else if (std::holds_alternative<Imm>(right)) {
         auto right_imm = std::get<Imm>(right).v;
         right_signed = interval_t{number_t{right_imm}};
@@ -1401,24 +1401,23 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
     int offset = b.access.offset;
     auto basereg_ptr_or_mapfd_type = basereg_type.value();
 
-    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (is_ctx_ptr(basereg_type)) {
         if (!ptrs_in_ctx_range) {
+            refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
             insert_in_registers(target_register, loc, top_rf);
         }
     } else if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
         if (width == 1) {
-            interval_t to_insert = interval_t(number_t{0}, number_t{UINT8_MAX});
-            expression_t e(to_insert, m_slacks);
+            expression_t e(interval_t{number_t{0}, number_t{UINT8_MAX}});
             insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
         }
         else if (width == 2) {
-            interval_t to_insert = interval_t(number_t{0}, number_t{UINT16_MAX});
-            expression_t e(to_insert, m_slacks);
+            expression_t e(interval_t{number_t{0}, number_t{UINT16_MAX}});
             insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
         }
         else {
-            insert_in_registers(target_register, loc, refinement_t::numeric_refinement_top(m_slacks));
+            refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+            insert_in_registers(target_register, loc, top_rf);
         }
     } else if (is_stack_ptr(basereg_type)) {
         auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
@@ -1471,7 +1470,7 @@ void interval_domain_t::shl(const register_t& reg, int imm, const int finite_wid
     imm &= finite_width - 1;
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
-        interval_t interval = interval_opt->get_interval_value();
+        interval_t interval = interval_opt->get_interval_value(m_slacks);
         if (interval.finite_size()) {
             const number_t lb = interval.lb().number().value();
             const number_t ub = interval.ub().number().value();
@@ -1508,7 +1507,7 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
     imm &= finite_width - 1;
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
-        interval_t interval = interval_opt->get_interval_value();
+        interval_t interval = interval_opt->get_interval_value(m_slacks);
         number_t lb_n{0};
         number_t ub_n{std::numeric_limits<uint64_t>::max() >> imm};
         if (interval.finite_size()) {
@@ -1639,7 +1638,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                 if (gsl::narrow<int32_t>(imm) > 0) {
                     // AND with immediate is only a 32-bit operation so svalue and uvalue
                     // are the same.
-                    auto dst_signed = m_signed.find_interval_value(dst_register)->get_interval_value();
+                    auto dst_signed = m_signed.find_interval_value(dst_register)->get_interval_value(m_slacks);
                     auto lb = dst_signed.lb().number().value();
                     auto ub = dst_signed.ub().number().value();
                     dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
@@ -1767,7 +1766,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
             case Op::LSH: {
                 // ra <<= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
-                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value();
+                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value(m_slacks);
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<int32_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
@@ -1786,7 +1785,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
             case Op::RSH: {
                 // ra >>= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
-                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value();
+                    auto src_unsigned = src_unsigned_interval_opt->get_interval_value(m_slacks);
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 0e513a461..f56c6fc39 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -74,20 +74,22 @@ void offset_registers_t::operator-=(register_t to_forget) {
     m_cur_register_def[to_forget] = nullptr;
 }
 
-bool offset_registers_t::operator<=(const offset_registers_t& other) const {
+bool offset_registers_t::inclusion(const offset_registers_t& other,
+                                   std::shared_ptr<slacks_t> slacks) const {
     for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
         auto it1 = find(*(m_cur_register_def[i]));
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
-            if (!(it1->operator<=(*it2))) return false;
+            if (!(it1->inclusion(*it2, slacks))) return false;
         }
     }
     return true;
 }
 
-offset_registers_t offset_registers_t::operator|(const offset_registers_t& other) const {
+offset_registers_t offset_registers_t::join(const offset_registers_t& other,
+                                            std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -104,14 +106,15 @@ offset_registers_t offset_registers_t::operator|(const offset_registers_t& other
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             if (rf1.same_type(rf2)) {
-                joined_state.insert(register_t{i}, loc, rf1 | rf2);
+                joined_state.insert(register_t{i}, loc, rf1.join(rf2, slacks));
             }
         }
     }
     return joined_state;
 }
 
-offset_registers_t offset_registers_t::widen(const offset_registers_t& other) const {
+offset_registers_t offset_registers_t::widen(const offset_registers_t& other,
+                                             std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -128,7 +131,7 @@ offset_registers_t offset_registers_t::widen(const offset_registers_t& other) co
         if (it1 && it2) {
             auto rf1 = *it1, rf2 = *it2;
             if (rf1.same_type(rf2)) {
-                joined_state.insert(register_t{i}, loc, rf1.widen(rf2));
+                joined_state.insert(register_t{i}, loc, rf1.widen(rf2, slacks));
             }
         }
     }
@@ -217,7 +220,7 @@ void offset_stack_t::operator-=(const std::vector<uint64_t>& keys) {
     }
 }
 
-bool offset_stack_t::operator<=(const offset_stack_t& other) const {
+bool offset_stack_t::inclusion(const offset_stack_t& other, std::shared_ptr<slacks_t> slacks) const {
     size_t size1 = m_stack_cells.size();
     size_t size2 = other.m_stack_cells.size();
     if (size2 > size1) return false;
@@ -228,12 +231,13 @@ bool offset_stack_t::operator<=(const offset_stack_t& other) const {
         auto rf2 = kv.second.first;
         auto width1 = it->second.second;
         auto width2 = kv.second.second;
-        if (!(rf1 <= rf2) || width1 != width2) return false;
+        if (!(rf1.inclusion(rf2, slacks) && width1 == width2)) return false;
     }
     return true;
 }
 
-offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
+offset_stack_t offset_stack_t::join(const offset_stack_t& other,
+                                    std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -254,14 +258,15 @@ offset_stack_t offset_stack_t::operator|(const offset_stack_t& other) const {
             // TODO: for numerical values, the width does not have to be the same
             // hence, handle accordingly
             if (rf1.same_type(rf2) && width1 == width2) {
-                out_stack_rfs.insert({kv.first, std::make_pair(rf1 | rf2, width1)});
+                out_stack_rfs.insert({kv.first, std::make_pair(rf1.join(rf2, slacks), width1)});
             }
         }
     }
     return offset_stack_t(std::move(out_stack_rfs));
 }
 
-offset_stack_t offset_stack_t::widen(const offset_stack_t& other) const {
+offset_stack_t offset_stack_t::widen(const offset_stack_t& other,
+                                     std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -282,23 +287,23 @@ offset_stack_t offset_stack_t::widen(const offset_stack_t& other) const {
             // TODO: for numerical values, the width does not have to be the same
             // hence, handle accordingly
             if (rf1.same_type(rf2) && width1 == width2) {
-                out_stack_rfs.insert({kv.first, std::make_pair(rf1.widen(rf2), width1)});
+                out_stack_rfs.insert({kv.first, std::make_pair(rf1.widen(rf2, slacks), width1)});
             }
         }
     }
     return offset_stack_t(std::move(out_stack_rfs));
 }
 
-offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t> slacks) {
+offset_ctx_t::offset_ctx_t(const ebpf_context_descriptor_t* desc) {
     if (desc == nullptr) return;
     if (desc->data >= 0) {
-        m_ctx_cells.insert_or_assign(desc->data, refinement_t::begin(slacks));
+        m_ctx_cells.insert_or_assign(desc->data, refinement_t::begin());
     }
     if (desc->end >= 0) {
-        m_ctx_cells.insert_or_assign(desc->end, refinement_t::end(slacks));
+        m_ctx_cells.insert_or_assign(desc->end, refinement_t::end());
     }
     if (desc->meta >= 0) {
-        m_ctx_cells.insert_or_assign(desc->meta, refinement_t::meta(slacks));
+        m_ctx_cells.insert_or_assign(desc->meta, refinement_t::meta());
     }
     m_size = std::max(0, desc->size);
 }
@@ -327,7 +332,7 @@ offset_domain_t offset_domain_t::setup_entry(std::shared_ptr<slacks_t> slacks) {
     offset_regs.insert(r12_pkt_begin, loc, type_begin_rf);
 
     return offset_domain_t{std::move(offset_regs), offset_stack_t::top(),
-            std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor, slacks),
+            std::make_shared<offset_ctx_t>(global_program_info->type.context_descriptor),
             slacks};
 }
 
@@ -361,7 +366,8 @@ bool offset_domain_t::is_top() const {
 
 // inclusion
 bool offset_domain_t::operator<=(const offset_domain_t& other) const {
-    return (m_registers <= other.m_registers && m_stack <= other.m_stack);
+    return (m_registers.inclusion(other.m_registers, m_slacks)
+    && m_stack.inclusion(other.m_stack, m_slacks));
 }
 
 // join
@@ -384,7 +390,8 @@ offset_domain_t offset_domain_t::operator|(const offset_domain_t& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(m_registers | other.m_registers, m_stack | other.m_stack, m_ctx, m_slacks);
+    return offset_domain_t(m_registers.join(other.m_registers, m_slacks),
+                           m_stack.join(other.m_stack, m_slacks), m_ctx, m_slacks);
 }
 
 offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
@@ -393,9 +400,10 @@ offset_domain_t offset_domain_t::operator|(offset_domain_t&& other) const {
     } else if (other.is_bottom() || is_top()) {
         return *this;
     }
+    // TODO: check if slacks need to be moved
     return offset_domain_t(
-        m_registers | std::move(other.m_registers),
-        m_stack | std::move(other.m_stack),
+        m_registers.join(std::move(other.m_registers), m_slacks),
+        m_stack.join(std::move(other.m_stack), m_slacks),
         std::move(other.m_ctx),
         std::move(other.m_slacks)
     );
@@ -415,8 +423,8 @@ offset_domain_t offset_domain_t::widen(const offset_domain_t& other, bool to_con
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return offset_domain_t(m_registers.widen(other.m_registers),
-            m_stack.widen(other.m_stack), m_ctx, m_slacks);
+    return offset_domain_t(m_registers.widen(other.m_registers, m_slacks),
+            m_stack.widen(other.m_stack, m_slacks), m_ctx, m_slacks);
 }
 
 // narrowing
@@ -456,19 +464,19 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
         }
         auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
         if (cond.op == Condition::Op::LE) {
-            begin->add_constraint(rf_left->assume_le(*rf_right));
+            begin->add_constraint(rf_left->assume_le(*rf_right), m_slacks);
             m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GT) {
-            begin->add_constraint(rf_left->assume_gt(*rf_right));
+            begin->add_constraint(rf_left->assume_gt(*rf_right), m_slacks);
             m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GE) {
-            begin->add_constraint(rf_right->assume_le(*rf_left));
+            begin->add_constraint(rf_right->assume_le(*rf_left), m_slacks);
             m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::LT) {
-            begin->add_constraint(rf_right->assume_gt(*rf_left));
+            begin->add_constraint(rf_right->assume_gt(*rf_left), m_slacks);
             m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
         }
         // other comparisons not supported
@@ -481,8 +489,8 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     if (!dst_rf || !src_rf) return interval_t::bottom();
     expression_t dst_expr = dst_rf->get_value();
     expression_t src_expr = src_rf->get_value();
-    refinement_t result_rf = *dst_rf - *src_rf;
-    expression_t result_expr = result_rf.get_value().get_equivalent_expression();
+    refinement_t result_rf = dst_rf->subtract(*src_rf, m_slacks);
+    expression_t result_expr = result_rf.get_value().get_equivalent_expression(m_slacks);
     if (result_expr.is_constant()) {
         return result_expr.get_constant_term();
     }
@@ -492,7 +500,7 @@ interval_t offset_domain_t::compute_packet_subtraction(register_t dst, register_
     auto dst_symbol = dst_expr.get_singleton();
     auto src_symbol = src_expr.get_singleton();
     std::optional<refinement_t> begin_rf = m_registers.find(register_t{R12_PKT_BEGIN});
-    return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol);
+    return begin_rf->simplify_for_subtraction(dst_symbol, src_symbol, m_slacks);
 }
 
 void offset_domain_t::do_bin(const Bin& bin, std::optional<refinement_t> dst_rf_numeric_opt,
@@ -569,10 +577,10 @@ void offset_domain_t::do_bin(const Bin& bin, std::optional<refinement_t> dst_rf_
                     set_to_bottom();
                 }
                 else if (dst_rf_ptr_opt.has_value() && src_rf_numeric_opt.has_value()) {
-                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt + *src_rf_numeric_opt);
+                    m_registers.insert(dst_register, loc, dst_rf_ptr_opt->add(*src_rf_numeric_opt, m_slacks));
                 }
                 else if (dst_rf_numeric_opt.has_value() && src_rf_ptr_opt.has_value()) {
-                    m_registers.insert(dst_register, loc, *dst_rf_numeric_opt + *src_rf_ptr_opt);
+                    m_registers.insert(dst_register, loc, dst_rf_numeric_opt->add(*src_rf_ptr_opt, m_slacks));
                 }
                 else {
                     m_registers -= dst_register;
@@ -588,7 +596,7 @@ void offset_domain_t::do_bin(const Bin& bin, std::optional<refinement_t> dst_rf_
                     m_registers -= dst_register;
                 }
                 else if (dst_rf_ptr_opt.has_value() && src_rf_numeric_opt.has_value()) {
-                    m_registers.insert(dst_register, loc, *dst_rf_ptr_opt - *src_rf_numeric_opt);
+                    m_registers.insert(dst_register, loc, dst_rf_ptr_opt->subtract(*src_rf_numeric_opt, m_slacks));
                 }
                 else { // when dst is numeric, we keep no information about subtraction
                     m_registers -= dst_register;
@@ -656,7 +664,8 @@ bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
     if (!reg) return false;
     auto check_lb = *reg + offset;
     auto check_ub = check_lb + width;
-    return begin->safe_access(check_lb.get_value(), check_ub.get_value(), is_comparison_check);
+    return begin->safe_access(check_lb.get_value(), check_ub.get_value(), is_comparison_check,
+                              m_slacks);
 }
 
 void offset_domain_t::check_valid_access(const ValidAccess& s,
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index ec6331c0c..45cf67c08 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -40,9 +40,9 @@ class offset_registers_t {
         }
         offset_registers_t(offset_registers_t&& other) = default;
         offset_registers_t& operator=(offset_registers_t&& other) = default;
-        offset_registers_t operator|(const offset_registers_t&) const;
-        bool operator<=(const offset_registers_t&) const;
-        offset_registers_t widen(const offset_registers_t&) const;
+        offset_registers_t join(const offset_registers_t&, std::shared_ptr<slacks_t>) const;
+        bool inclusion(const offset_registers_t&, std::shared_ptr<slacks_t>) const;
+        offset_registers_t widen(const offset_registers_t&, std::shared_ptr<slacks_t>) const;
         void operator-=(register_t);
         void set_to_top();
         void set_to_bottom();
@@ -77,9 +77,9 @@ class offset_stack_t {
         bool is_bottom() const;
         bool is_top() const;
         static offset_stack_t top();
-        offset_stack_t operator|(const offset_stack_t&) const;
-        bool operator<=(const offset_stack_t&) const;
-        offset_stack_t widen(const offset_stack_t&) const;
+        offset_stack_t join(const offset_stack_t&, std::shared_ptr<slacks_t>) const;
+        bool inclusion(const offset_stack_t&, std::shared_ptr<slacks_t>) const;
+        offset_stack_t widen(const offset_stack_t&, std::shared_ptr<slacks_t>) const;
         std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
         std::vector<uint64_t> get_keys() const;
 };
@@ -90,7 +90,7 @@ class offset_ctx_t {
     size_t m_size = 0;
 
     public:
-        offset_ctx_t(const ebpf_context_descriptor_t* desc, std::shared_ptr<slacks_t>);
+        offset_ctx_t(const ebpf_context_descriptor_t* desc);
         std::optional<refinement_t> find(uint64_t) const;
         size_t get_size() const { return m_size; }
         std::vector<uint64_t> get_keys() const;
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index ca430023c..07a34583a 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -5,11 +5,6 @@
 
 namespace crab {
 
-std::ostream& operator<<(std::ostream& o, const refinement_t& r) {
-    r.write(o);
-    return o;
-}
-
 bool refinement_t::is_numeric_refinement() const {
     return _type == refinement_type_t::NUM;
 }
@@ -18,26 +13,33 @@ bool refinement_t::is_packet_refinement() const {
     return _type == refinement_type_t::PACKET;
 }
 
-interval_t refinement_t::get_interval_value() const {
-    expression_t e = _value.get_equivalent_expression();
-    if (e.only_has_interval()) {
+// compute an interval value for the refinement
+interval_t refinement_t::get_interval_value(std::shared_ptr<slacks_t> slacks) const {
+    if (is_packet_refinement()) {
+        // cannot compute an interval value for packet refinements
+        return interval_t::bottom();
+    }
+    expression_t e = _value.get_equivalent_expression(slacks);
+    if (e.is_constant()) {
         return e.get_constant_term();
     }
     return interval_t::bottom();
 }
 
-std::map<symbol_t, interval_t> refinement_t::get_slack_intervals() const {
-    std::map<symbol_t, interval_t> slack_intervals = _value.get_slack_intervals();
-    if (has_constraints) {
-        slack_intervals.merge(meta_begin_constraint.get_slack_intervals());
-        slack_intervals.merge(begin_end_constraint.get_slack_intervals());
+std::vector<symbol_t> refinement_t::get_all_slacks() const {
+    std::vector<symbol_t> slacks = _value.get_slacks();
+    if (_contains_pkt_constraints) {
+        auto meta_begin_slacks = _meta_begin_constraint.get_slacks();
+        auto begin_end_slacks = _begin_end_constraint.get_slacks();
+        slacks.insert(slacks.end(), meta_begin_slacks.begin(), meta_begin_slacks.end());
+        slacks.insert(slacks.end(), begin_end_slacks.begin(), begin_end_slacks.end());
     }
-    return slack_intervals;
+    return slacks;
 }
 
-void refinement_t::write(std::ostream& o) const {
-    std::map<symbol_t, interval_t> slack_intervals = get_slack_intervals();
-    bool has_extra_info = has_constraints || !slack_intervals.empty();
+void refinement_t::write(std::ostream& o, std::shared_ptr<slacks_t> slack_intervs) const {
+    std::vector<symbol_t> slack_vars = get_all_slacks();
+    bool has_extra_info = _contains_pkt_constraints || !slack_vars.empty();
     if (has_extra_info) o << "{";
     if (is_numeric_refinement()) {
         o << "num<" << _value << ">";
@@ -49,15 +51,16 @@ void refinement_t::write(std::ostream& o) const {
         o << "_";
     }
     if (has_extra_info) o << " | ";
-    if (has_constraints) {
-        o << meta_begin_constraint << " & " << begin_end_constraint;
+    if (_contains_pkt_constraints) {
+        o << _meta_begin_constraint << " & " << _begin_end_constraint;
     }
     size_t i = 0;
-    size_t n = slack_intervals.size();
-    if (n > 0 && has_constraints) {
+    size_t n = slack_vars.size();
+    if (n > 0 && _contains_pkt_constraints) {
         o << " & ";
     }
-    for (auto [s, interv] : slack_intervals) {
+    for (const auto s : slack_vars) {
+        auto interv = slack_intervs->at(s);
         o << s << " in " << interv;
         if (i < n - 1) {
             o << " & ";
@@ -69,25 +72,34 @@ void refinement_t::write(std::ostream& o) const {
 
 refinement_t refinement_t::operator+(interval_t i) const {
     expression_t added_value = _value + i;
-    return refinement_t(_type, added_value);
+    return refinement_t(_type, added_value, _meta_begin_constraint, _begin_end_constraint,
+                        _contains_pkt_constraints);
 }
 
 refinement_t refinement_t::operator+(int n) const {
     return operator+(interval_t{n});
 }
 
-refinement_t refinement_t::operator+(const refinement_t &other) const {
+refinement_t refinement_t::add(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
     expression_t new_value = _value + other._value;
     refinement_type_t new_type = (_type == other._type) ? _type
         : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
           ? refinement_type_t::PACKET : refinement_type_t::ANY;
+    if (_contains_pkt_constraints || other._contains_pkt_constraints) {
+        auto new_rf = refinement_t(new_type, new_value,
+                            _meta_begin_constraint, _begin_end_constraint, true);
+        new_rf.add_constraint(other._meta_begin_constraint, slacks);
+        new_rf.add_constraint(other._begin_end_constraint, slacks);
+        return new_rf;
+    }
     return refinement_t(new_type, new_value);
 }
 
 // use the constraints to compute a value for the subtraction, if possible
-interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src) const {
-    bound_t max_packet_size = bound_t{number_t{MAX_PACKET_SIZE}};
-    bound_t max_meta_size = bound_t{number_t{MAX_META_SIZE}};
+interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const symbol_t& src,
+                                                  std::shared_ptr<slacks_t> slacks) const {
+    bound_t max_packet_size = bound_t{MAX_PACKET_SIZE};
+    bound_t max_meta_size = bound_t{MAX_META_SIZE};
     bound_t zero = bound_t{number_t{0}};
     symbol_t begin = symbol_t::begin();
     symbol_t end = symbol_t::end();
@@ -95,34 +107,34 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
 
     if (dst == meta && src == begin) {
         // compute meta - begin
-        interval_t i = meta_begin_constraint.compute_subtraction(meta, begin);
+        interval_t i = _meta_begin_constraint.compute_subtraction(meta, begin, slacks);
         return i & interval_t{-max_meta_size, zero};
     }
     else if (dst == begin && src == meta) {
         // compute begin - meta
-        interval_t i = meta_begin_constraint.compute_subtraction(begin, meta);
+        interval_t i = _meta_begin_constraint.compute_subtraction(begin, meta, slacks);
         return i & interval_t{zero, max_meta_size};
     }
     else if (dst == end && src == begin) {
         // compute end - begin
-        interval_t i = begin_end_constraint.compute_subtraction(end, begin);
+        interval_t i = _begin_end_constraint.compute_subtraction(end, begin, slacks);
         return i & interval_t{zero, max_packet_size};
     }
     else if (dst == begin && src == end) {
         // compute begin - end
-        interval_t i = begin_end_constraint.compute_subtraction(begin, end);
+        interval_t i = _begin_end_constraint.compute_subtraction(begin, end, slacks);
         return i & interval_t{-max_packet_size, zero};
     }
     else if (dst == end && src == meta) {
         // compute end - meta
         constraint_t meta_end_constraint = construct_meta_end_constraint();
-        interval_t i = meta_end_constraint.compute_subtraction(end, meta);
+        interval_t i = meta_end_constraint.compute_subtraction(end, meta, slacks);
         return i & interval_t{zero, max_meta_size + max_packet_size};
     }
     else if (dst == meta && src == end) {
         // compute meta - end
         constraint_t meta_end_constraint = construct_meta_end_constraint();
-        interval_t i = meta_end_constraint.compute_subtraction(meta, end);
+        interval_t i = meta_end_constraint.compute_subtraction(meta, end, slacks);
         return i & interval_t{-max_meta_size - max_packet_size, zero};
     }
     else {
@@ -131,19 +143,20 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
     }
 }
 
-static constraint_t solve_constraints(constraint_t c1, constraint_t c2) {
+static constraint_t solve_constraints(constraint_t c1, constraint_t c2, 
+                                      std::shared_ptr<slacks_t> slacks) {
     // We are adding c2 to a system already containing c1
-    if (c1.is_unsat(c2)) {
+    if (c1.is_unsat(c2, slacks)) {
         // c1 and c2 are unsatisfiable
         // e.g., c1 := begin + 14 <= end and c2 := begin + 14 > end
-        return constraint_t::get_false();
+        return constraint_t::false_constraint();
     }
-    if (c1.implies(c2)) {
+    if (c1.implies(c2, slacks)) {
         // c1 implies c2, so c2 is a weaker constraint. We keep c1.
         // e.g., c1 := begin + 14 <= end and c2 := begin + 12 <= end
         return c1;
     }
-    if (c2.implies(c1)) {
+    if (c2.implies(c1, slacks)) {
         // c2 implies c1, so c1 is a weaker constraint. We keep c2.
         // e.g., c1 := begin + 14 <= end and c2 := begin + 18 <= end
         return c2;
@@ -152,15 +165,12 @@ static constraint_t solve_constraints(constraint_t c1, constraint_t c2) {
     // c1 := begin + 34 <= end and c2 := begin + a_0 + 18 <= end, a_0 in [0, 60]
     // it will not fall in any category above
     // We can prefer to keep c2 in this case as it might contain more information than c1
-    // as it contains a slack variable a_0
-    expression_t c2_lhs = c2.get_lhs();
+    // as it contains a slack variable a_0, which might be needed in some context.
     expression_t c1_lhs = c1.get_lhs();
-    auto c2_slacks = c2_lhs.get_slack_intervals();
-    auto c1_slacks = c1_lhs.get_slack_intervals();
-    if (!c2_slacks.empty() && c1_slacks.empty()) {
+    expression_t c2_lhs = c2.get_lhs();
+    if (c2_lhs.get_num_terms() > c1_lhs.get_num_terms()) {
         // very specific heuristic but could be beneficial if expressed properly
-        // TODO: fix later
-        expression_t c2_eq = c2_lhs.get_equivalent_expression();
+        expression_t c2_eq = c2_lhs.get_equivalent_expression(slacks);
         interval_t c2_interval = c2_eq.get_constant_term();
         auto symbol_terms = c2_eq.get_symbol_terms();
         if (c2_interval.singleton()) {
@@ -170,30 +180,39 @@ static constraint_t solve_constraints(constraint_t c1, constraint_t c2) {
         auto ub = interval_t{c2_interval.ub()};
         expression_t lb_c2 = expression_t{symbol_terms, lb};
         expression_t ub_c2 = expression_t{symbol_terms, ub};
-        if (c1.implies(constraint_t(lb_c2)) && constraint_t(ub_c2).implies(c1)) {
+        if (c1.implies(constraint_t(lb_c2), slacks) && constraint_t(ub_c2).implies(c1, slacks)) {
             return c2;
         }
-        return c1;
     }
     // c1 and c2 are not comparable, i.e., c2 is providing information not affecting c1
-    // e.g., c1 := begin + 14 <= end and c2 := begin + 18 > end
+    // e.g., c1 := begin + 14 <= end and c2 := begin + 18 > end,
+    // or the previous heuristic did not apply;
+    // We can lose some information here, but this keeps the constraints simple
     return c1;
 }
 
-void refinement_t::add_constraint(constraint_t c) {
+void refinement_t::add_constraint(constraint_t c, std::shared_ptr<slacks_t> slacks) {
     if (c.is_meta_begin_constraint()) {
-        meta_begin_constraint = solve_constraints(meta_begin_constraint, std::move(c));
+        _meta_begin_constraint = solve_constraints(_meta_begin_constraint, std::move(c), slacks);
     }
     else if (c.is_begin_end_constraint()) {
-        begin_end_constraint = solve_constraints(begin_end_constraint, std::move(c));
+        _begin_end_constraint = solve_constraints(_begin_end_constraint, std::move(c), slacks);
     }
 }
 
-refinement_t refinement_t::operator-(const refinement_t &other) const {
+refinement_t refinement_t::subtract(const refinement_t &other,
+                                    std::shared_ptr<slacks_t> slacks) const {
     expression_t new_value = _value - other._value;
     refinement_type_t new_type = (_type == other._type) ? refinement_type_t::NUM
-        : (_type == refinement_type_t::PACKET || other._type == refinement_type_t::PACKET)
-          ? refinement_type_t::PACKET : refinement_type_t::ANY;
+        : (_type == refinement_type_t::PACKET) ? refinement_type_t::PACKET
+        : refinement_type_t::ANY;
+    if (_contains_pkt_constraints || other._contains_pkt_constraints) {
+        auto new_rf = refinement_t(new_type, new_value,
+                            _meta_begin_constraint, _begin_end_constraint, true);
+        new_rf.add_constraint(other._meta_begin_constraint, slacks);
+        new_rf.add_constraint(other._begin_end_constraint, slacks);
+        return new_rf;
+    }
     return refinement_t(new_type, new_value);
 }
 
@@ -203,31 +222,24 @@ bool refinement_t::same_type(const refinement_t &other) const {
 
 
 // inclusion operator
-bool refinement_t::operator<=(const refinement_t &other) const {
-    if (!has_constraints) {
-        return _value <= other._value;
-    }
-    return _value <= other._value &&
-           meta_begin_constraint <= other.meta_begin_constraint &&
-           begin_end_constraint <= other.begin_end_constraint;
+bool refinement_t::inclusion(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
+    return _value.inclusion(other._value, slacks) &&
+              _meta_begin_constraint.implies(other._meta_begin_constraint, slacks) &&
+              _begin_end_constraint.implies(other._begin_end_constraint, slacks);
 }
 
-refinement_t refinement_t::widen(const refinement_t &other) const {
-    if (!has_constraints) {
-        return refinement_t(_type, _value.widen(other._value));
-    }
-    return refinement_t(_type, _value.widen(other._value),
-                        meta_begin_constraint.widen(other.meta_begin_constraint),
-                        begin_end_constraint.widen(other.begin_end_constraint));
+refinement_t refinement_t::widen(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
+    return refinement_t(_type, _value.widen(other._value, slacks),
+                        _meta_begin_constraint.widen(other._meta_begin_constraint, slacks),
+                        _begin_end_constraint.widen(other._begin_end_constraint, slacks),
+                        _contains_pkt_constraints || other._contains_pkt_constraints);
 }
 
-refinement_t refinement_t::operator|(const refinement_t &other) const {
-    if (!has_constraints) {
-        return refinement_t(_type, _value | other._value);
-    }
-    return refinement_t(_type, _value | other._value,
-                        meta_begin_constraint | other.meta_begin_constraint,
-                        begin_end_constraint | other.begin_end_constraint);
+refinement_t refinement_t::join(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
+    return refinement_t(_type, _value.join(other._value, slacks),
+                        _meta_begin_constraint.join(other._meta_begin_constraint, slacks),
+                        _begin_end_constraint.join(other._begin_end_constraint, slacks),
+                        _contains_pkt_constraints || other._contains_pkt_constraints);
 }
 
 // assume that the current refinement is less than or equal to the other refinement
@@ -241,45 +253,48 @@ constraint_t refinement_t::assume_gt(const refinement_t &other) const {
 }
 
 constraint_t refinement_t::construct_meta_end_constraint() const {
-    return meta_begin_constraint + begin_end_constraint;
+    return _meta_begin_constraint + _begin_end_constraint;
 }
 
-bool refinement_t::check_consistent(const constraint_t& c) const {
-    if (c.is_bottom()) {
+bool refinement_t::check_consistent(const constraint_t& c, std::shared_ptr<slacks_t> slacks) const {
+    if (c.is_bottom(slacks)) {
         return false;
     }
-    else if (c.is_top()) {
-        return true;
-    }
     else if (c.is_begin_end_constraint()) {
-        return begin_end_constraint.implies(c);
+        return _begin_end_constraint.implies(c, slacks);
     }
     else if (c.is_meta_begin_constraint()) {
-        return meta_begin_constraint.implies(c);
+        return _meta_begin_constraint.implies(c, slacks);
     }
     else {
-        return construct_meta_end_constraint().implies(c);
+        return construct_meta_end_constraint().implies(c, slacks);
     }
 }
 
 bool refinement_t::safe_access(const expression_t& access_lb, const expression_t& access_ub,
-                               bool is_comparison_check) const {
+                               bool is_comparison_check, std::shared_ptr<slacks_t> slacks) const {
     // access is at least meta
     constraint_t lb = constraint_t(expression_t::meta(), access_lb);
-    bool lb_satisfied = check_consistent(lb);
+    bool lb_satisfied = check_consistent(lb, slacks);
 
     // access is at most end or MAX_PACKET_SIZE, depending on the check
     constraint_t ub = is_comparison_check ?
         constraint_t(access_ub, expression_t(interval_t{MAX_PACKET_SIZE}))
         : constraint_t(access_ub, expression_t::end());
-    bool ub_satisfied = check_consistent(ub);
+    bool ub_satisfied = check_consistent(ub, slacks);
 
     return lb_satisfied && ub_satisfied;
 }
 
-bool refinement_t::operator==(const refinement_t &other) const {
-    // TODO: we need to compare constraints as well
-    return _type == other._type && _value == other._value;
+bool refinement_t::check_eq(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
+    // Checking strict equality between constraints might be too strict
+    // TODO: revisit this
+    bool meta_begin_eq = _meta_begin_constraint.implies(other._meta_begin_constraint, slacks) &&
+                         other._meta_begin_constraint.implies(_meta_begin_constraint, slacks);
+    bool begin_end_eq = _begin_end_constraint.implies(other._begin_end_constraint, slacks) &&
+                        other._begin_end_constraint.implies(_begin_end_constraint, slacks);
+    return _type == other._type && _value.check_eq(other._value, slacks) 
+           && meta_begin_eq && begin_end_eq;
 }
 
 } // namespace crab
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 3f713acf0..da0e257f2 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -15,63 +15,68 @@ enum class refinement_type_t {
 class refinement_t {
     refinement_type_t _type;
     expression_t _value;
-    constraint_t meta_begin_constraint; // meta + sth <= begin
-    constraint_t begin_end_constraint; // begin + sth <= end
-    bool has_constraints = false;
+    constraint_t _meta_begin_constraint; // meta + sth <= begin
+    constraint_t _begin_end_constraint; // begin + sth <= end
+    bool _contains_pkt_constraints = false;
 
   public:
     refinement_t() : _type(refinement_type_t::ANY) {}
     refinement_t(refinement_type_t type, expression_t value,
-                 constraint_t meta_begin_constraint, constraint_t begin_end_constraint) :
-        _type(type), _value(value), meta_begin_constraint(meta_begin_constraint),
-        begin_end_constraint(begin_end_constraint), has_constraints(true) {}
+                 constraint_t meta_begin_constraint, constraint_t begin_end_constraint,
+                 bool contains_pkt_constraints) :
+        _type(type), _value(value), _meta_begin_constraint(meta_begin_constraint),
+        _begin_end_constraint(begin_end_constraint),
+        _contains_pkt_constraints(contains_pkt_constraints) {}
     refinement_t(refinement_type_t type, expression_t value) :
-        _type(type), _value(value), meta_begin_constraint(constraint_t::get_true()),
-        begin_end_constraint(constraint_t::get_true()) {}
+        _type(type), _value(value), _meta_begin_constraint(constraint_t::true_constraint()),
+        _begin_end_constraint(constraint_t::true_constraint()) {}
  
-    [[nodiscard]] interval_t get_interval_value() const;
+    [[nodiscard]] interval_t get_interval_value(std::shared_ptr<slacks_t>) const;
     [[nodiscard]] refinement_type_t get_type() const { return _type; }
     [[nodiscard]] expression_t get_value() const { return _value; }
-    [[nodiscard]] expression_t get_equivalent_expression() const;
     refinement_t operator+(int n) const;
     refinement_t operator+(interval_t) const;
-    refinement_t operator+(const refinement_t &other) const;
-    refinement_t operator-(const refinement_t &other) const;
-    refinement_t operator|(const refinement_t &other) const;
-    refinement_t widen(const refinement_t &other) const;
-    bool operator<=(const refinement_t &other) const;
+    refinement_t add(const refinement_t &other, std::shared_ptr<slacks_t>) const;
+    refinement_t subtract(const refinement_t &other, std::shared_ptr<slacks_t>) const;
+    refinement_t join(const refinement_t &other, std::shared_ptr<slacks_t>) const;
+    refinement_t widen(const refinement_t &other, std::shared_ptr<slacks_t>) const;
+    bool inclusion(const refinement_t &other, std::shared_ptr<slacks_t>) const;
     constraint_t assume_le(const refinement_t &other) const;
     constraint_t assume_gt(const refinement_t &other) const;
-    bool operator==(const refinement_t &other) const;
-    void write(std::ostream &o) const;
+    bool check_eq(const refinement_t &other, std::shared_ptr<slacks_t>) const;
+    void write(std::ostream &o, std::shared_ptr<slacks_t>) const;
     bool same_type(const refinement_t &other) const;
-    bool safe_access(const expression_t&, const expression_t&, bool) const;
-    bool check_consistent(const constraint_t&) const;
+    bool safe_access(const expression_t&, const expression_t&, bool,
+                     std::shared_ptr<slacks_t>) const;
+    bool check_consistent(const constraint_t&, std::shared_ptr<slacks_t>) const;
     constraint_t construct_meta_end_constraint() const;
     bool is_numeric_refinement() const;
     bool is_packet_refinement() const;
-    interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&) const;
-    std::map<symbol_t, interval_t> get_slack_intervals() const;
-    void add_constraint(constraint_t);
-    friend std::ostream &operator<<(std::ostream &, const refinement_t&);
+    interval_t simplify_for_subtraction(const symbol_t&, const symbol_t&,
+                                        std::shared_ptr<slacks_t>) const;
+    std::vector<symbol_t> get_all_slacks() const;
+    void add_constraint(constraint_t, std::shared_ptr<slacks_t>);
 
+    // construct a packet refinement type for begin of packet with initial constraints:
+    // meta <= begin and begin <= end
     static refinement_t begin_with_constraints() {
-        constraint_t meta_begin_constraint = constraint_t::meta_begin_init_constraint();
-        constraint_t begin_end_constraint = constraint_t::begin_end_init_constraint();
-        return refinement_t(refinement_type_t::PACKET, expression_t::begin(),
-                            meta_begin_constraint, begin_end_constraint);
+        return refinement_t(refinement_type_t::PACKET,
+                            expression_t::begin(),
+                            constraint_t::meta_begin_init_constraint(),
+                            constraint_t::begin_end_init_constraint(),
+                            true);
     }
 
-    static refinement_t begin(std::shared_ptr<slacks_t> slacks = nullptr) {
-        return refinement_t(refinement_type_t::PACKET, expression_t::begin(slacks));
+    static refinement_t begin() {
+        return refinement_t(refinement_type_t::PACKET, expression_t::begin());
     }
 
-    static refinement_t end(std::shared_ptr<slacks_t> slacks) {
-        return refinement_t(refinement_type_t::PACKET, expression_t::end(slacks));
+    static refinement_t end() {
+        return refinement_t(refinement_type_t::PACKET, expression_t::end());
     }
 
-    static refinement_t meta(std::shared_ptr<slacks_t> slacks) {
-        return refinement_t(refinement_type_t::PACKET, expression_t::meta(slacks));
+    static refinement_t meta() {
+        return refinement_t(refinement_type_t::PACKET, expression_t::meta());
     }
 
     static refinement_t numeric_refinement(expression_t value) {
@@ -80,13 +85,19 @@ class refinement_t {
 
     static refinement_t numeric_refinement(interval_t i, std::shared_ptr<slacks_t> slacks) {
         symbol_t s = symbol_t::make();
-        slacks->insert_or_assign(s, i);
-        return numeric_refinement(expression_t(s, slacks));
+        auto it = slacks->find(s);
+        if (it != slacks->end()) {
+            // Slack already exists, this should not happen.
+            throw std::runtime_error("Newly-generated slack already exists.");
+        }
+        slacks->emplace(s, i);
+        return numeric_refinement(expression_t(s));
     }
 
     static refinement_t numeric_refinement_top(std::shared_ptr<slacks_t> slacks = nullptr) {
+        if (slacks) return numeric_refinement(interval_t::top(), slacks);
         // expression_t::top() represents a top interval
-        return numeric_refinement(expression_t::top(slacks));
+        return numeric_refinement(expression_t::top());
     }
 };
 
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 82cdcbc63..6f5f2cf14 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -48,7 +48,8 @@ std::optional<refinement_t> signed_interval_registers_t::find(register_t key) co
     return find(reg);
 }
 
-bool signed_interval_registers_t::operator<=(const signed_interval_registers_t& other) const {
+bool signed_interval_registers_t::inclusion(const signed_interval_registers_t& other,
+                                            std::shared_ptr<slacks_t> slacks) const {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
@@ -56,13 +57,16 @@ bool signed_interval_registers_t::operator<=(const signed_interval_registers_t&
         auto it2 = other.find(*(m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            if (!(rf1 <= rf2)) return false;
+            if (!(rf1.inclusion(rf2, slacks))) {
+                return false;
+            }
         }
     }
     return true;
 }
 
-signed_interval_registers_t signed_interval_registers_t::operator|(const signed_interval_registers_t& other) const {
+signed_interval_registers_t signed_interval_registers_t::join(
+    const signed_interval_registers_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -76,13 +80,14 @@ signed_interval_registers_t signed_interval_registers_t::operator|(const signed_
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1 | rf2);
+            refinements_joined.insert(register_t{i}, loc, rf1.join(rf2, slacks));
         }
     }
     return refinements_joined;
 }
 
-signed_interval_registers_t signed_interval_registers_t::widen(const signed_interval_registers_t& other) const {
+signed_interval_registers_t signed_interval_registers_t::widen(
+    const signed_interval_registers_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -96,7 +101,7 @@ signed_interval_registers_t signed_interval_registers_t::widen(const signed_inte
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2));
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2, slacks));
         }
     }
     return refinements_joined;
@@ -233,7 +238,8 @@ std::vector<uint64_t> signed_interval_stack_t::find_overlapping_cells(uint64_t s
     return overlapping_cells;
 }
 
-bool signed_interval_stack_t::operator<=(const signed_interval_stack_t& other) const {
+bool signed_interval_stack_t::inclusion(const signed_interval_stack_t& other,
+                                        std::shared_ptr<slacks_t> slacks) const {
     size_t size1 = size(), size2 = other.size();
     if (size2 > size1) return false;
     for (auto const &kv : other.m_cells) {
@@ -245,7 +251,9 @@ bool signed_interval_stack_t::operator<=(const signed_interval_stack_t& other) c
         auto rf2 = cells2.first;
         auto width1 = cells1.second; auto width2 = cells2.second;
         if (width1 != width2) return false;
-        if (!(rf1 <= rf2)) return false;
+        if (!(rf1.inclusion(rf2, slacks))) {
+            return false;
+        }
     }
     return true;
 }
@@ -292,7 +300,8 @@ static inline void join_stack(const signed_interval_stack_t& stack1, uint64_t ke
     }
 }
 
-signed_interval_stack_t signed_interval_stack_t::operator|(const signed_interval_stack_t& other) const {
+signed_interval_stack_t signed_interval_stack_t::join(const signed_interval_stack_t& other,
+                                                      std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -305,12 +314,15 @@ signed_interval_stack_t signed_interval_stack_t::operator|(const signed_interval
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
         join_stack(*this, key1, i, other, key2, j, refinements_joined,
-                [](const refinement_t& a, const refinement_t& b) { return a | b; });
+                   [slacks](const refinement_t& a, const refinement_t& b) {
+                    return a.join(b, slacks);
+                });
     }
     return signed_interval_stack_t(std::move(refinements_joined));
 }
 
-signed_interval_stack_t signed_interval_stack_t::widen(const signed_interval_stack_t& other) const {
+signed_interval_stack_t signed_interval_stack_t::widen(const signed_interval_stack_t& other,
+                                                        std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -323,7 +335,9 @@ signed_interval_stack_t signed_interval_stack_t::widen(const signed_interval_sta
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
         join_stack(*this, key1, i, other, key2, j, refinements_joined,
-                [](const refinement_t& a, const refinement_t& b) { return a.widen(b); });
+                [slacks](const refinement_t& a, const refinement_t& b) {
+                   return a.widen(b, slacks);
+                });
     }
     return signed_interval_stack_t(std::move(refinements_joined));
 }
@@ -439,7 +453,8 @@ void signed_interval_domain_t::store_in_stack(uint64_t key, interval_t interval,
 }
 
 bool signed_interval_domain_t::operator<=(const signed_interval_domain_t& abs) const {
-    return (m_registers <= abs.m_registers && m_stack <= abs.m_stack);
+    return (m_registers.inclusion(abs.m_registers, m_slacks) &&
+            m_stack.inclusion(abs.m_stack, m_slacks));
 }
 
 void signed_interval_domain_t::operator|=(const signed_interval_domain_t& abs) {
@@ -463,8 +478,8 @@ signed_interval_domain_t signed_interval_domain_t::operator|(const signed_interv
         return *this;
     }
     return signed_interval_domain_t(
-        m_registers | other.m_registers,
-        m_stack | other.m_stack,
+        m_registers.join(other.m_registers, m_slacks),
+        m_stack.join(other.m_stack, m_slacks),
         m_slacks);
 }
 
@@ -475,9 +490,10 @@ signed_interval_domain_t signed_interval_domain_t::operator|(signed_interval_dom
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
+    // TODO: check if we can use move semantics for m_slacks
     return signed_interval_domain_t(
-        m_registers | std::move(other.m_registers),
-        m_stack | std::move(other.m_stack),
+        m_registers.join(std::move(other.m_registers), m_slacks),
+        m_stack.join(std::move(other.m_stack), m_slacks),
         std::move(other.m_slacks));
 }
 
@@ -493,8 +509,8 @@ signed_interval_domain_t signed_interval_domain_t::widen(const signed_interval_d
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return signed_interval_domain_t(m_registers.widen(other.m_registers),
-            m_stack.widen(other.m_stack), m_slacks);
+    return signed_interval_domain_t(m_registers.widen(other.m_registers, m_slacks),
+            m_stack.widen(other.m_stack, m_slacks), m_slacks);
 }
 
 signed_interval_domain_t signed_interval_domain_t::narrow(const signed_interval_domain_t& other) const {
@@ -543,7 +559,7 @@ void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
 
     auto rf_opt = m_registers.find(u.dst.v);
     if (!rf_opt) return;
-    auto interval = rf_opt->get_interval_value();
+    auto interval = rf_opt->get_interval_value(m_slacks);
     if (interval.is_bottom()) {
         m_registers.insert(u.dst.v, loc, top_rf);
         return;
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index dc2c75093..da3fc0e21 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -46,10 +46,12 @@ class signed_interval_registers_t {
     std::optional<refinement_t> find(register_t key) const;
     void insert(register_t, const location_t&, refinement_t);
     void operator-=(register_t);
-    signed_interval_registers_t operator|(const signed_interval_registers_t& other) const;
+    signed_interval_registers_t join(const signed_interval_registers_t& other,
+            std::shared_ptr<slacks_t>) const;
     void adjust_bb_for_registers(location_t);
-    bool operator<=(const signed_interval_registers_t& other) const;
-    signed_interval_registers_t widen(const signed_interval_registers_t& other) const;
+    bool inclusion(const signed_interval_registers_t& other, std::shared_ptr<slacks_t>) const;
+    signed_interval_registers_t widen(const signed_interval_registers_t& other,
+                                      std::shared_ptr<slacks_t>) const;
 };
 
 using signed_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
@@ -72,14 +74,16 @@ class signed_interval_stack_t {
     void store(uint64_t, refinement_t, int);
     void operator-=(uint64_t);
     bool all_numeric(uint64_t, int) const;
-    signed_interval_stack_t operator|(const signed_interval_stack_t& other) const;
+    signed_interval_stack_t join(const signed_interval_stack_t& other,
+            std::shared_ptr<slacks_t>) const;
     [[nodiscard]] std::vector<uint64_t> get_keys() const;
     size_t size() const;
     std::vector<uint64_t> find_overlapping_cells(uint64_t, int) const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values(const std::vector<uint64_t>&, uint64_t, int);
-    bool operator<=(const signed_interval_stack_t& other) const;
-    signed_interval_stack_t widen(const signed_interval_stack_t& other) const;
+    bool inclusion(const signed_interval_stack_t& other, std::shared_ptr<slacks_t> slacks) const;
+    signed_interval_stack_t widen(const signed_interval_stack_t& other,
+                                  std::shared_ptr<slacks_t> slacks) const;
 };
 
 class signed_interval_domain_t final {
diff --git a/src/crab/symbol.hpp b/src/crab/symbol.hpp
index a2b5bed0d..5fab7411d 100644
--- a/src/crab/symbol.hpp
+++ b/src/crab/symbol.hpp
@@ -3,7 +3,6 @@
 #pragma once
 
 #include <iostream>
-#include <vector>
 
 namespace crab {
 
@@ -13,11 +12,11 @@ class symbol_t final {
     explicit symbol_t(uint64_t id) : _id(id) {}
 
   public:
-    [[nodiscard]] std::size_t hash() const { return _id; }
+    [[nodiscard]] std::size_t hash() const {
+        return std::hash<uint64_t>()(_id);
+    }
     bool operator==(symbol_t o) const { return _id == o._id; }
     bool operator!=(symbol_t o) const { return (!(operator==(o))); }
-    bool operator<(symbol_t o) const { return _id < o._id; }
-    bool operator>(symbol_t o) const { return _id > o._id; }
     operator uint64_t() const { return _id; }
 
   private:
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 654212e02..8ddc39493 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -97,20 +97,21 @@ string_invariant inference_domain_t::to_set() const {
         auto maybe_rf = m_offset.find_refinement_info(register_t{i});
         if (maybe_ptr_or_mapfd.has_value()) {
             std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, {}, false);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, {}, false, m_slacks);
             result.insert(elem.str());
         }
         auto maybe_signed_interval = m_interval.find_signed_interval_value(register_t{i});
         if (maybe_signed_interval.has_value()) {
             std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_signed_interval, true);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_signed_interval, true,
+                           m_slacks);
             result.insert(elem.str());
         }
         auto maybe_unsigned_interval = m_interval.find_unsigned_interval_value(register_t{i});
         if (maybe_unsigned_interval.has_value()) {
             std::stringstream elem;
             print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf,
-                    maybe_unsigned_interval, false);
+                    maybe_unsigned_interval, false, m_slacks);
             result.insert(elem.str());
         }
     }
@@ -125,10 +126,11 @@ string_invariant inference_domain_t::to_set() const {
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
             elem << "stack";
             if (rf) {
-                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, rf->first);
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, rf->first,
+                                              m_slacks);
             }
             else {
-                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd);
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, {}, m_slacks);
             }
         }
         result.insert(elem.str());
@@ -142,7 +144,7 @@ string_invariant inference_domain_t::to_set() const {
             auto signed_interval_cells = maybe_interval_cells_signed.value();
             elem << "stack";
             print_numeric_memory_cell(elem, k, k+signed_interval_cells.second,
-                    signed_interval_cells.first, true);
+                    signed_interval_cells.first, true, m_slacks);
             result.insert(elem.str());
         }
         auto maybe_interval_cells_unsigned = m_interval.find_in_stack_unsigned(k);
@@ -151,7 +153,7 @@ string_invariant inference_domain_t::to_set() const {
             auto unsigned_interval_cells = maybe_interval_cells_unsigned.value();
             elem << "stack";
             print_numeric_memory_cell(elem, k, k+unsigned_interval_cells.second,
-                    unsigned_interval_cells.first, false);
+                    unsigned_interval_cells.first, false, m_slacks);
             result.insert(elem.str());
         }
     }
@@ -260,7 +262,7 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
             auto maybe_width_rf = m_interval.find_signed_interval_value(param.size.v);
             if (is_stack_ptr(maybe_ptr_or_mapfd)) {
                 auto ptr_with_off = std::get<ptr_with_off_t>(*maybe_ptr_or_mapfd);
-                auto width_interval = maybe_width_rf->get_interval_value();
+                auto width_interval = maybe_width_rf->get_interval_value(m_slacks);
 
                 if (const auto offset_singleton = ptr_with_off.get_offset().singleton()) {
                     uint64_t offset = offset_singleton->cast_to<uint64_t>();
@@ -391,8 +393,8 @@ void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
         m_errors.push_back(loc_str + ": Only numbers can be used as divisors");
     }
     if (!thread_local_options.allow_division_by_zero) {
-        interval_t to_check = u.is_signed ? maybe_signed_reg->get_interval_value()
-                                          : maybe_unsigned_reg->get_interval_value();
+        interval_t to_check = u.is_signed ? maybe_signed_reg->get_interval_value(m_slacks)
+                                          : maybe_unsigned_reg->get_interval_value(m_slacks);
         if (interval_t{number_t{0}} <= to_check) {
             m_errors.push_back(loc_str + ": Possible division by zero");
         }
@@ -410,7 +412,7 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
                 m_errors.push_back(loc_str + ": Width is unknown for valid access");
                 return;
             }
-            width_interval = width_rf->get_interval_value();
+            width_interval = width_rf->get_interval_value(m_slacks);
         }
         else {
             auto imm = std::get<Imm>(s.width); 
@@ -432,7 +434,7 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
     else {
         auto rf_type = m_interval.find_interval_value(s.reg.v);
         if (rf_type) {
-            m_interval.check_valid_access(s, rf_type->get_interval_value(), loc);
+            m_interval.check_valid_access(s, rf_type->get_interval_value(m_slacks), loc);
         }
         else {
             m_errors.push_back(loc_str + ": Access on unknown register");
@@ -515,7 +517,7 @@ void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
     assert(!maybe_ptr_or_mapfd || !maybe_num_type);
 
     if (maybe_num_type) {
-        auto reg_value = maybe_num_type->get_interval_value();
+        auto reg_value = maybe_num_type->get_interval_value(m_slacks);
         if ((u.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
                 || (!u.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
             return;
@@ -574,7 +576,7 @@ void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
                             if (auto cell = m_interval.find_in_stack_signed(offset)) {
                                 auto rf = cell->first;
                                 auto size = cell->second;
-                                auto key_value = rf.get_interval_value();
+                                auto key_value = rf.get_interval_value(m_slacks);
                                 if (size != sizeof(uint32_t)) {
                                     m_errors.push_back(loc_str + ": Array map key must be 32 bits");
                                     return;
@@ -652,13 +654,13 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
         src_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(r.v);
         src_signed_rf = m_interval.find_signed_interval_value(r.v);
         if (src_signed_rf) {
-            src_signed_interval = src_signed_rf->get_interval_value();
+            src_signed_interval = src_signed_rf->get_interval_value(m_slacks);
         }
     }
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(dst_register);
     auto dst_signed_rf = m_interval.find_signed_interval_value(dst_register);
     if (dst_signed_rf) {
-        dst_signed_interval = dst_signed_rf->get_interval_value();
+        dst_signed_interval = dst_signed_rf->get_interval_value(m_slacks);
     }
 
     std::string loc_str = loc.to_string();
@@ -745,7 +747,7 @@ void inference_domain_t::print_ctx(std::ostream& o) const {
         auto dist = m_offset.find_in_ctx(k);
         if (dist) {
             o << "\t\t";
-            print_non_numeric_memory_cell(o, k, k+3, packet_ptr_t{}, dist);
+            print_non_numeric_memory_cell(o, k, k+3, packet_ptr_t{}, dist, m_slacks);
             o << ",\n";
         }
     }
@@ -766,10 +768,11 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             o << "\t\t";
             if (dist) {
                 print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd),
-                        std::optional<refinement_t>(dist->first));
+                        std::optional<refinement_t>(dist->first), m_slacks);
             }
             else {
-                print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd));
+                print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd), {},
+                        m_slacks);
             }
             o << ",\n";
         }
@@ -780,7 +783,7 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto interval_cells = maybe_signed_interval_cells.value();
             o << "\t\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first, true);
+                    interval_cells.first, true, m_slacks);
             o << ",\n";
         }
         auto maybe_unsigned_interval_cells = m_interval.find_in_stack_unsigned(k);
@@ -788,7 +791,7 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto interval_cells = maybe_unsigned_interval_cells.value();
             o << "\t\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first, false);
+                    interval_cells.first, false, m_slacks);
             o << ",\n";
         }
     }
@@ -1113,9 +1116,11 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
             auto region = find_ptr_or_mapfd_at_loc(r0_reg);
             auto rf = find_refinement_at_loc(r0_reg);
             auto signed_interval = find_signed_interval_at_loc(r0_reg);
-            print_annotated(o, std::get<Call>(statement), region, rf, signed_interval, true);
+            print_annotated(o, std::get<Call>(statement), region, rf, signed_interval, true,
+                            m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(r0_reg);
-            //print_annotated(o, std::get<Call>(statement), region, unsigned_interval, false);
+            //print_annotated(o, std::get<Call>(statement), region, unsigned_interval, false,
+            //                            m_slacks);
         }
         else if (std::holds_alternative<Bin>(statement)) {
             auto b = std::get<Bin>(statement);
@@ -1123,9 +1128,9 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
             auto region = find_ptr_or_mapfd_at_loc(register_location);
             auto rf = find_refinement_at_loc(register_location);
             auto signed_interval = find_signed_interval_at_loc(register_location);
-            print_annotated(o, b, region, rf, signed_interval, true);
+            print_annotated(o, b, region, rf, signed_interval, true, m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(register_location);
-            //print_annotated(o, b, region, rf, unsigned_interval, false);
+            //print_annotated(o, b, region, rf, unsigned_interval, false, m_slacks);
         }
         else if (std::holds_alternative<Mem>(statement)) {
             auto u = std::get<Mem>(statement);
@@ -1135,9 +1140,9 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
                 auto region = find_ptr_or_mapfd_at_loc(target_reg_loc);
                 auto rf = find_refinement_at_loc(target_reg_loc);
                 auto signed_interval = find_signed_interval_at_loc(target_reg_loc);
-                print_annotated(o, u, region, rf, signed_interval, true);
+                print_annotated(o, u, region, rf, signed_interval, true, m_slacks);
                 auto unsigned_interval = find_unsigned_interval_at_loc(target_reg_loc);
-                //print_annotated(o, u, region, rf, unsigned_interval, false);
+                //print_annotated(o, u, region, rf, unsigned_interval, false, m_slacks);
             }
             else print_instr(o, u);
         }
@@ -1151,9 +1156,9 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
             auto u = std::get<Un>(statement);
             auto reg = crab::register_location_t(u.dst.v, loc);
             auto signed_interval = find_signed_interval_at_loc(reg);
-            print_annotated(o, u, signed_interval, true);
+            print_annotated(o, u, signed_interval, true, m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(reg);
-            print_annotated(o, u, unsigned_interval, false);
+            print_annotated(o, u, unsigned_interval, false, m_slacks);
         }
         else print_instr(o, statement);
     }
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 21c91299e..b9fc66a9e 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -4,13 +4,15 @@
 #include "crab/type_ostream.hpp"
 
 void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
-        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d) {
+        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d,
+                                   std::shared_ptr<crab::slacks_t> slacks) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
-            o << "[" << start << "-" << end << "] : " << *d;
+            o << "[" << start << "-" << end << "] : ";
+            d->write(o, slacks);
         }
         else {
             o << "[" << start << "-" << end << "] : " << std::get<crab::packet_ptr_t>(ptr);
@@ -22,8 +24,8 @@ void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
 }
 
 void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::refinement_t n,
-        bool is_signed) {
-    crab::interval_t i = n.get_interval_value();
+        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
+    crab::interval_t i = n.get_interval_value(slacks);
     if (i.is_top()) {
         if (is_signed) {
             o << "[" << start << "-" << end << "] : snumber";
@@ -34,33 +36,36 @@ void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::refine
     }
     else {
         // TODO: differentiate between signed and unsigned
-        o << "[" << start << "-" << end << "] : " << n;
+        o << "[" << start << "-" << end << "] : ";
+        n.write(o, slacks);
     }
 }
 
 void print_memory_cell(std::ostream& o, int start, int end,
         const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t> d
         , std::optional<crab::refinement_t> signed_numeric,
-        std::optional<crab::refinement_t> unsigned_numeric) {
+        std::optional<crab::refinement_t> unsigned_numeric,
+                       std::shared_ptr<crab::slacks_t> slacks) {
     if (signed_numeric) {
-        print_numeric_memory_cell(o, start, end, *signed_numeric, true);
+        print_numeric_memory_cell(o, start, end, *signed_numeric, true, slacks);
     }
     if (unsigned_numeric) {
-        print_numeric_memory_cell(o, start, end, *unsigned_numeric, false);
+        print_numeric_memory_cell(o, start, end, *unsigned_numeric, false, slacks);
     }
     else if (p) {
-        print_non_numeric_memory_cell(o, start, end, *p, d);
+        print_non_numeric_memory_cell(o, start, end, *p, d, slacks);
     }
 }
 
 void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::refinement_t> d) {
+        std::optional<crab::refinement_t> d, std::shared_ptr<crab::slacks_t> slacks) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << r << " : " << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
-            o << r << " : " << *d;
+            o << r << " : ";
+            d->write(o, slacks);
         }
         else {
             o << r << " : " << std::get<crab::packet_ptr_t>(ptr);
@@ -71,8 +76,9 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
     }
 }
 
-void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool is_signed) {
-    crab::interval_t i = n.get_interval_value();
+void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool is_signed,
+        std::shared_ptr<crab::slacks_t> slacks) {
+    crab::interval_t i = n.get_interval_value(slacks);
     if (i.is_top()) {
         if (is_signed) {
             o << r << " : snumber";
@@ -82,44 +88,49 @@ void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool i
         }
     }
     else {
-        o << r << " : " << n;
+        o << r << " : ";
+        n.write(o, slacks);
     }
 }
 
 void print_register(std::ostream& o, Reg r, const std::optional<crab::ptr_or_mapfd_t>& p,
         const std::optional<crab::refinement_t>& d, const std::optional<crab::refinement_t>& numeric,
-        bool is_signed) {
-    if (numeric) print_numeric_register(o, r, *numeric, is_signed);
-    else if (p) print_non_numeric_register(o, r, *p, d);
+        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
+    if (numeric) print_numeric_register(o, r, *numeric, is_signed, slacks);
+    else if (p) print_non_numeric_register(o, r, *p, d, slacks);
+    else o << r << " : unknown";
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t>& d,
-        std::optional<crab::refinement_t>& n, bool is_signed) {
+void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p,
+                     std::optional<crab::refinement_t>& d,
+                     std::optional<crab::refinement_t>& n, bool is_signed,
+                     std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, d, n, is_signed);
+    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, d, n, is_signed, slacks);
     o << " = " << call.name << ":" << call.func << "(...)\n";
 }
 
 void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
         std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n,
-        bool is_signed) {
+        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, b.dst, p, d, n, is_signed);
+    print_register(o, b.dst, p, d, n, is_signed, slacks);
     o << " " << b.op << "= " << b.v << "\n";
 }
 
 void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
     o << "  ";
-    print_register(o, u.dst, p, std::nullopt, std::nullopt, false);
+    print_register(o, u.dst, p, std::nullopt, std::nullopt, false, nullptr);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
 void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n, bool is_signed) {
+        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n, bool is_signed,
+                     std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, std::get<Reg>(b.value), p, d, n, is_signed);
+    print_register(o, std::get<Reg>(b.value), p, d, n, is_signed, slacks);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
     int offset = std::abs(b.access.offset);
@@ -149,9 +160,9 @@ std::string op(Un::Op op) {
 }
 
 void print_annotated(std::ostream& o, const Un& b, std::optional<crab::refinement_t>& n,
-        bool is_signed) {
+        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed);
+    print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed, slacks);
     o << " = " << op(b.op) << " " << b.dst << "\n";
 }
 
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 30803b702..b7a5eae3d 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -5,25 +5,33 @@
 
 #include "crab/offset_domain.hpp"
 
-void print_numeric_register(std::ostream&, Reg, crab::refinement_t, bool);
-void print_numeric_memory_cell(std::ostream&, int, int, crab::refinement_t, bool);
+void print_numeric_register(std::ostream&, Reg, crab::refinement_t, bool, 
+                            std::shared_ptr<crab::slacks_t>);
+void print_numeric_memory_cell(std::ostream&, int, int, crab::refinement_t, bool,
+                               std::shared_ptr<crab::slacks_t>);
 void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::refinement_t> = std::nullopt);
+        std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>);
 void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::refinement_t> = std::nullopt);
+        std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>);
 void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
-        const std::optional<crab::refinement_t>&, const std::optional<crab::refinement_t>&, bool);
+        const std::optional<crab::refinement_t>&, const std::optional<crab::refinement_t>&, bool,
+                    std::shared_ptr<crab::slacks_t>);
 void print_memory_cell(std::ostream&, int, int, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>, std::optional<crab::refinement_t>);
+        std::optional<crab::refinement_t>, std::optional<crab::refinement_t>,
+                       std::shared_ptr<crab::slacks_t>);
 
 // Print select transformers
 void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+                     std::shared_ptr<crab::slacks_t>);
 void print_annotated(std::ostream&, const Bin&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+                     std::shared_ptr<crab::slacks_t>);
 void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or_mapfd_t>&);
 void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool);
-void print_annotated(std::ostream&, const Un&, std::optional<crab::refinement_t>&, bool);
+        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+                     std::shared_ptr<crab::slacks_t>);
+void print_annotated(std::ostream&, const Un&, std::optional<crab::refinement_t>&, bool,
+                     std::shared_ptr<crab::slacks_t>);
 void print_bb(std::ostream&, const basic_block_t&);
 void print_instr(std::ostream&, const Instruction&);
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index dd38d384b..ae3cef860 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -48,7 +48,8 @@ std::optional<refinement_t> unsigned_interval_registers_t::find(register_t key)
     return find(reg);
 }
 
-bool unsigned_interval_registers_t::operator<=(const unsigned_interval_registers_t& other) const {
+bool unsigned_interval_registers_t::inclusion(const unsigned_interval_registers_t& other,
+        std::shared_ptr<slacks_t> slacks) const {
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
@@ -56,13 +57,14 @@ bool unsigned_interval_registers_t::operator<=(const unsigned_interval_registers
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            if (!(rf1 <= rf2)) return false;
+            if (!(rf1.inclusion(rf2, slacks))) return false;
         }
     }
     return true;
 }
 
-unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const unsigned_interval_registers_t& other) const {
+unsigned_interval_registers_t unsigned_interval_registers_t::join(
+    const unsigned_interval_registers_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -76,13 +78,14 @@ unsigned_interval_registers_t unsigned_interval_registers_t::operator|(const uns
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1 | rf2);
+            refinements_joined.insert(register_t{i}, loc, rf1.join(rf2, slacks));
         }
     }
     return refinements_joined;
 }
 
-unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigned_interval_registers_t& other) const {
+unsigned_interval_registers_t unsigned_interval_registers_t::widen(
+    const unsigned_interval_registers_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -96,7 +99,7 @@ unsigned_interval_registers_t unsigned_interval_registers_t::widen(const unsigne
         auto it2 = other.find(*(other.m_cur_register_def[i]));
         if (it1 && it2) {
             refinement_t rf1 = it1.value(), rf2 = it2.value();
-            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2));
+            refinements_joined.insert(register_t{i}, loc, rf1.widen(rf2, slacks));
         }
     }
     return refinements_joined;
@@ -245,7 +248,8 @@ static inline void join_stack(const unsigned_interval_stack_t& stack1, uint64_t
     }
 }
 
-bool unsigned_interval_stack_t::operator<=(const unsigned_interval_stack_t& other) const {
+bool unsigned_interval_stack_t::inclusion(const unsigned_interval_stack_t& other,
+                                          std::shared_ptr<slacks_t> slacks) const {
     size_t size1 = size(), size2 = other.size();
     if (size2 > size1) return false;
     for (auto const &kv : other.m_cells) {
@@ -257,12 +261,15 @@ bool unsigned_interval_stack_t::operator<=(const unsigned_interval_stack_t& othe
         auto rf2 = cells2.first;
         auto width1 = cells1.second; auto width2 = cells2.second;
         if (width1 != width2) return false;
-        if (!(rf1 <= rf2)) return false;
+        if (!(rf1.inclusion(rf2, slacks))) {
+            return false;
+        }
     }
     return true;
 }
 
-unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_interval_stack_t& other) const {
+unsigned_interval_stack_t unsigned_interval_stack_t::join(
+    const unsigned_interval_stack_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -275,12 +282,15 @@ unsigned_interval_stack_t unsigned_interval_stack_t::operator|(const unsigned_in
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
         join_stack(*this, key1, i, other, key2, j, refinements_joined,
-                [](const refinement_t& a, const refinement_t& b) { return a | b; });
+                [slacks](const refinement_t& a, const refinement_t& b) {
+                   return a.join(b, slacks);
+                });
     }
     return unsigned_interval_stack_t(std::move(refinements_joined));
 }
 
-unsigned_interval_stack_t unsigned_interval_stack_t::widen(const unsigned_interval_stack_t& other) const {
+unsigned_interval_stack_t unsigned_interval_stack_t::widen(
+    const unsigned_interval_stack_t& other, std::shared_ptr<slacks_t> slacks) const {
     if (is_bottom() || other.is_top()) {
         return other;
     } else if (other.is_bottom() || is_top()) {
@@ -293,7 +303,9 @@ unsigned_interval_stack_t unsigned_interval_stack_t::widen(const unsigned_interv
     while (i < static_cast<int>(stack1_keys.size()) && j < static_cast<int>(stack2_keys.size())) {
         int key1 = stack1_keys[i], key2 = stack2_keys[j];
         join_stack(*this, key1, i, other, key2, j, refinements_joined,
-                [](const refinement_t& a, const refinement_t& b) { return a.widen(b); });
+                [slacks](const refinement_t& a, const refinement_t& b) {
+                   return a.widen(b, slacks);
+                });
     }
     return unsigned_interval_stack_t(std::move(refinements_joined));
 }
@@ -395,7 +407,9 @@ void unsigned_interval_domain_t::store_in_stack(uint64_t key, interval_t interva
 }
 
 bool unsigned_interval_domain_t::operator<=(const unsigned_interval_domain_t& abs) const {
-    return (m_registers <= abs.m_registers && m_stack <= abs.m_stack);
+    return (
+    m_registers.inclusion(abs.m_registers, m_slacks) &&
+    m_stack.inclusion(abs.m_stack, m_slacks));
 }
 
 void unsigned_interval_domain_t::operator|=(const unsigned_interval_domain_t& abs) {
@@ -419,8 +433,8 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator|(const unsigned_
         return *this;
     }
     return unsigned_interval_domain_t(
-        m_registers | other.m_registers,
-        m_stack | other.m_stack,
+        m_registers.join(other.m_registers, m_slacks),
+        m_stack.join(other.m_stack, m_slacks),
         m_slacks);
 }
 
@@ -431,9 +445,10 @@ unsigned_interval_domain_t unsigned_interval_domain_t::operator|(unsigned_interv
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
+    // TODO: check if we can use std::move here for m_slacks
     return unsigned_interval_domain_t(
-            m_registers | std::move(other.m_registers),
-            m_stack | std::move(other.m_stack),
+            m_registers.join(std::move(other.m_registers), m_slacks),
+            m_stack.join(std::move(other.m_stack), m_slacks),
             std::move(m_slacks));
 }
 
@@ -449,8 +464,8 @@ unsigned_interval_domain_t unsigned_interval_domain_t::widen(const unsigned_inte
     else if (other.is_bottom() || is_top()) {
         return *this;
     }
-    return unsigned_interval_domain_t(m_registers.widen(other.m_registers),
-            m_stack.widen(other.m_stack), m_slacks);
+    return unsigned_interval_domain_t(m_registers.widen(other.m_registers, m_slacks),
+            m_stack.widen(other.m_stack, m_slacks), m_slacks);
 }
 
 unsigned_interval_domain_t unsigned_interval_domain_t::narrow(const unsigned_interval_domain_t& other) const {
@@ -501,7 +516,7 @@ void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
 
     auto rf_opt = m_registers.find(u.dst.v);
     if (!rf_opt) return;
-    auto interval = rf_opt->get_interval_value();
+    auto interval = rf_opt->get_interval_value(m_slacks);
     if (interval.is_bottom()) {
         m_registers.insert(u.dst.v, loc, top_rf);
         return;
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index 7821c157d..cae693e06 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -46,10 +46,13 @@ class unsigned_interval_registers_t {
     std::optional<refinement_t> find(register_t key) const;
     void insert(register_t, const location_t&, refinement_t);
     void operator-=(register_t);
-    unsigned_interval_registers_t operator|(const unsigned_interval_registers_t& other) const;
+    unsigned_interval_registers_t join(const unsigned_interval_registers_t& other,
+                                       std::shared_ptr<slacks_t> slacks) const;
     void adjust_bb_for_registers(location_t);
-    bool operator<=(const unsigned_interval_registers_t& other) const;
-    unsigned_interval_registers_t widen(const unsigned_interval_registers_t& other) const;
+    bool inclusion(const unsigned_interval_registers_t& other,
+                   std::shared_ptr<slacks_t> slacks) const;
+    unsigned_interval_registers_t widen(const unsigned_interval_registers_t& other,
+                                        std::shared_ptr<slacks_t> slacks) const;
 };
 
 using unsigned_interval_stack_cell_t = std::pair<refinement_t, int>;    // intervals with width
@@ -71,13 +74,16 @@ class unsigned_interval_stack_t {
     std::optional<unsigned_interval_stack_cell_t> find(uint64_t) const;
     void store(uint64_t, refinement_t, int);
     void operator-=(uint64_t);
-    unsigned_interval_stack_t operator|(const unsigned_interval_stack_t& other) const;
+    unsigned_interval_stack_t join(const unsigned_interval_stack_t& other,
+                                      std::shared_ptr<slacks_t> slacks) const;
     [[nodiscard]] std::vector<uint64_t> get_keys() const;
     size_t size() const;
     void remove_overlap(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values(const std::vector<uint64_t>&, uint64_t, int);
-    bool operator<=(const unsigned_interval_stack_t& other) const;
-    unsigned_interval_stack_t widen(const unsigned_interval_stack_t& other) const;
+    bool inclusion(const unsigned_interval_stack_t& other,
+                   std::shared_ptr<slacks_t> slacks) const;
+    unsigned_interval_stack_t widen(const unsigned_interval_stack_t& other,
+                                    std::shared_ptr<slacks_t> slacks) const;
 };
 
 class unsigned_interval_domain_t final {

From d5f5e756c1e9718a522a827b63f1b1581f37a725 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:50:25 -0400
Subject: [PATCH 353/373] Fixed ValidAccess check issues in Packet

Packet access required for constraints when not comparing different
packet symbols, which needed special handling;
Renamed some functions for better understanding;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/constraint.cpp     | 27 +++++++++++++++++++++++----
 src/crab/constraint.hpp     |  7 +++++--
 src/crab/expression.cpp     | 36 ++++++++++++++++++++++++++++++++++++
 src/crab/expression.hpp     |  2 ++
 src/crab/offset_domain.cpp  | 36 +++++++++++++++++++++++-------------
 src/crab/offset_domain.hpp  |  4 ++--
 src/crab/refinement.cpp     | 20 +++++++++++++++-----
 src/crab/refinement.hpp     |  2 +-
 src/crab/type_inference.cpp |  4 ++--
 9 files changed, 109 insertions(+), 29 deletions(-)

diff --git a/src/crab/constraint.cpp b/src/crab/constraint.cpp
index b3a558275..05a9e4571 100644
--- a/src/crab/constraint.cpp
+++ b/src/crab/constraint.cpp
@@ -99,11 +99,22 @@ constraint_t constraint_t::widen(const constraint_t &other, std::shared_ptr<slac
     }
 }
 
+bool constraint_t::contains_single_pkt_symbol() const {
+    // check if the contraint contains a single packet symbol: begin, end, or meta
+    return _lhs.contains_single_pkt_symbol();
+}
+
+constraint_t constraint_t::substitute_for_pkt_symbols() const {
+    return constraint_t(_lhs.substitute_for_pkt_symbols());
+}
+
 bool constraint_t::is_meta_begin_constraint() const {
+    // Handles following case: meta + sth <= begin
     return _lhs.contains(symbol_t::meta()) && _lhs.contains(symbol_t::begin());
 }
 
 bool constraint_t::is_begin_end_constraint() const {
+    // Handles following case: begin + sth <= end
     return _lhs.contains(symbol_t::begin()) && _lhs.contains(symbol_t::end());
 }
 
@@ -112,7 +123,7 @@ bool constraint_t::check_eq(const constraint_t &other, std::shared_ptr<slacks_t>
     return _lhs.check_eq(other.get_lhs(), slacks);
 }
 
-bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) const {
+bool constraint_t::is_unsat(std::shared_ptr<slacks_t> slacks) const {
     if (this->check_eq(constraint_t::false_constraint(), slacks)) {
         return true; // false constraint is bottom
     }
@@ -120,13 +131,21 @@ bool constraint_t::is_bottom(std::shared_ptr<slacks_t> slacks) const {
     return _lhs.check_gt(_rhs, slacks);
 }
 
+bool constraint_t::is_sat(std::shared_ptr<slacks_t> slacks) const {
+    if (this->check_eq(constraint_t::true_constraint(), slacks)) {
+        return true; // true constraint is always satisfiable
+    }
+    // lhs <= rhs is satisfiable
+    return _lhs.check_le(_rhs, slacks);
+}
+
 constraint_t constraint_t::operator+(constraint_t c2) const {
     return constraint_t(_lhs + c2.get_lhs());
 }
 
-bool constraint_t::is_unsat(constraint_t other, std::shared_ptr<slacks_t> slacks) const {
+bool constraint_t::is_inconsistent(constraint_t other, std::shared_ptr<slacks_t> slacks) const {
     // check if the other constraint is unsat with this constraint
-    return operator+(other).is_bottom(slacks);
+    return operator+(other).is_unsat(slacks);
 }
 
 bool constraint_t::implies(const constraint_t& other, std::shared_ptr<slacks_t> slacks) const {
@@ -138,7 +157,7 @@ bool constraint_t::implies(const constraint_t& other, std::shared_ptr<slacks_t>
         return true;
     }
     // c1 => c2 iff c1 and not c2 is unsat
-    return is_unsat(std::move(other.negate()), slacks);
+    return is_inconsistent(std::move(other.negate()), slacks);
 }
 
 void constraint_t::write(std::ostream &o) const {
diff --git a/src/crab/constraint.hpp b/src/crab/constraint.hpp
index bba306df9..3e71a676b 100644
--- a/src/crab/constraint.hpp
+++ b/src/crab/constraint.hpp
@@ -33,14 +33,17 @@ class constraint_t {
 
     bool is_meta_begin_constraint() const;
     bool is_begin_end_constraint() const;
+    bool contains_single_pkt_symbol() const;
+    constraint_t substitute_for_pkt_symbols() const;
     [[nodiscard]] expression_t get_lhs() const { return _lhs; }
     std::vector<symbol_t> get_slacks() const;
     bool contains(const symbol_t&) const;
     bool implies(const constraint_t&, std::shared_ptr<slacks_t>) const;
     constraint_t operator+(constraint_t) const;
     bool check_eq(const constraint_t&, std::shared_ptr<slacks_t>) const;
-    bool is_unsat(constraint_t, std::shared_ptr<slacks_t>) const;
-    bool is_bottom(std::shared_ptr<slacks_t>) const;
+    bool is_inconsistent(constraint_t, std::shared_ptr<slacks_t>) const;
+    bool is_sat(std::shared_ptr<slacks_t>) const;
+    bool is_unsat(std::shared_ptr<slacks_t>) const;
     interval_t compute_subtraction(const symbol_t&, const symbol_t&,
                                    std::shared_ptr<slacks_t>) const;
     [[nodiscard]] constraint_t negate() const;
diff --git a/src/crab/expression.cpp b/src/crab/expression.cpp
index ee71fc6df..1c3767150 100644
--- a/src/crab/expression.cpp
+++ b/src/crab/expression.cpp
@@ -103,6 +103,42 @@ bool expression_t::check_gt(const expression_t &other, std::shared_ptr<slacks_t>
     return false;
 }
 
+bool expression_t::contains_single_pkt_symbol() const {
+    // check if the expression contains only one packet symbol: begin, end, or meta
+    // However, this might still contain other slack symbols.
+    int contains_single = 0;
+    int8_t coeff = 0;
+    for (const auto &[s, v] : _symbol_terms) {
+        if (!s.is_slack()) {
+            contains_single++;
+            coeff = v;
+        }
+    }
+    return (contains_single == 1 && (coeff == 1 || coeff == -1));
+}
+
+expression_t expression_t::substitute_for_pkt_symbols() const {
+    // substitute packet symbols with their values
+    interval_t begin_value = interval_t{0};
+    interval_t end_value = interval_t{0, MAX_PACKET_SIZE};
+    interval_t meta_value = interval_t{-MAX_META_SIZE, 0};
+    interval_t constant_term = _constant_term;
+    symbol_terms_t new_terms;
+
+    for (const auto &[s, v] : _symbol_terms) {
+        if (s == symbol_t::begin()) {
+            constant_term = constant_term + begin_value * interval_t{static_cast<int>(v)};
+        } else if (s == symbol_t::end()) {
+            constant_term = constant_term + end_value * interval_t{static_cast<int>(v)};
+        } else if (s == symbol_t::meta()) {
+            constant_term = constant_term + meta_value * interval_t{static_cast<int>(v)};
+        } else {
+            new_terms[s] = v; // keep other symbols as they are
+        }
+    }
+    return expression_t(new_terms, constant_term);
+}
+
 // check if an expression contains a single symbol, which can be slack or packet symbol
 bool expression_t::is_singleton() const {
     return _symbol_terms.size() == 1 && _constant_term == interval_t{0};
diff --git a/src/crab/expression.hpp b/src/crab/expression.hpp
index f447a9831..263cd796e 100644
--- a/src/crab/expression.hpp
+++ b/src/crab/expression.hpp
@@ -48,6 +48,8 @@ class expression_t {
     int get_num_terms() const { return _symbol_terms.size(); }
     int8_t get_coefficient(const symbol_t &s) const;
     bool is_singleton() const;
+    bool contains_single_pkt_symbol() const;
+    expression_t substitute_for_pkt_symbols() const;
     bool contains(const symbol_t &s) const;
     symbol_t get_singleton() const;
     std::vector<symbol_t> get_slacks() const;
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index f56c6fc39..e5b97e4d5 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -658,27 +658,37 @@ void offset_domain_t::operator()(const Packet& u, location_t loc) {
 }
 
 bool offset_domain_t::check_packet_access(const Reg& r, int width, int offset,
-        bool is_comparison_check) const {
+        bool is_comparison_check, location_t loc) {
     auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
+    std::string loc_str = loc.to_string();
     auto reg = m_registers.find(r.v);
-    if (!reg) return false;
+    if (!reg) {
+        m_errors.push_back(loc_str + ": Checking valid access on unknown register");
+        return false;
+    }
     auto check_lb = *reg + offset;
     auto check_ub = check_lb + width;
-    return begin->safe_access(check_lb.get_value(), check_ub.get_value(), is_comparison_check,
-                              m_slacks);
-}
-
-void offset_domain_t::check_valid_access(const ValidAccess& s,
-        std::optional<ptr_or_mapfd_t>& reg_type, int w, location_t loc) {
-    bool is_comparison_check = s.width == (Value)Imm{0};
-    if (!check_packet_access(s.reg, w, s.offset, is_comparison_check)) {
-        std::string loc_str = loc.to_string();
+    auto [check_lb_satisfied, check_ub_satisfied] = begin->safe_access(check_lb.get_value(),
+                                            check_ub.get_value(), is_comparison_check, m_slacks);
+    if (!check_lb_satisfied) {
+        m_errors.push_back(loc_str + ": Lower bound must be at least meta_offset");
+        return false;
+    }
+    if (!check_ub_satisfied) {
         if (is_comparison_check) {
-            m_errors.push_back(loc_str + ": Lower bound must be at least meta_offset and upper bound must be at most " + std::to_string(MAX_PACKET_SIZE));
+            m_errors.push_back(loc_str + ": Upper bound must be at most " +
+                               std::to_string(MAX_PACKET_SIZE));
         } else {
-            m_errors.push_back(loc_str + ": Lower bound must be at least meta_offset and upper bound must be at most packet size");
+            m_errors.push_back(loc_str + ": Upper bound must be at most packet size");
         }
+        return false;
     }
+    return true;
+}
+
+void offset_domain_t::check_valid_access(const ValidAccess& s, int w, location_t loc) {
+    bool is_comparison_check = s.width == (Value)Imm{0};
+    check_packet_access(s.reg, w, s.offset, is_comparison_check, loc);
 }
 
 void offset_domain_t::operator()(const Assert &u, location_t loc) {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index 45cf67c08..b4c8ec1c8 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -164,8 +164,8 @@ class offset_domain_t final {
     void do_bin(const Bin&, std::optional<refinement_t>, std::optional<refinement_t>,
                 location_t);
     void do_call(const Call&, const stack_cells_t&, location_t);
-    bool check_packet_access(const Reg&, int, int, bool) const;
-    void check_valid_access(const ValidAccess&, std::optional<ptr_or_mapfd_t>&, int, location_t);
+    bool check_packet_access(const Reg&, int, int, bool, location_t);
+    void check_valid_access(const ValidAccess&, int, location_t);
     interval_t compute_packet_subtraction(register_t, register_t) const;
 
     std::vector<uint64_t> get_ctx_keys() const;
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 07a34583a..260c4c5c9 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -146,7 +146,7 @@ interval_t refinement_t::simplify_for_subtraction(const symbol_t& dst, const sym
 static constraint_t solve_constraints(constraint_t c1, constraint_t c2, 
                                       std::shared_ptr<slacks_t> slacks) {
     // We are adding c2 to a system already containing c1
-    if (c1.is_unsat(c2, slacks)) {
+    if (c1.is_inconsistent(c2, slacks)) {
         // c1 and c2 are unsatisfiable
         // e.g., c1 := begin + 14 <= end and c2 := begin + 14 > end
         return constraint_t::false_constraint();
@@ -257,9 +257,17 @@ constraint_t refinement_t::construct_meta_end_constraint() const {
 }
 
 bool refinement_t::check_consistent(const constraint_t& c, std::shared_ptr<slacks_t> slacks) const {
-    if (c.is_bottom(slacks)) {
+    if (c.is_unsat(slacks)) {
         return false;
     }
+    else if (c.contains_single_pkt_symbol()) {
+        // This is a specific case containing single packet symbol, we can substitute all possible
+        // values for the symbol, and check if the constraint is satisfiable
+        // for example, for begin + 14 <= 65535, we can substitute begin with 0
+        // for end <= 65535, we can substitute end with [0, 65535] and check
+        constraint_t new_c = c.substitute_for_pkt_symbols();
+        return new_c.is_sat(slacks);
+    }
     else if (c.is_begin_end_constraint()) {
         return _begin_end_constraint.implies(c, slacks);
     }
@@ -271,8 +279,10 @@ bool refinement_t::check_consistent(const constraint_t& c, std::shared_ptr<slack
     }
 }
 
-bool refinement_t::safe_access(const expression_t& access_lb, const expression_t& access_ub,
-                               bool is_comparison_check, std::shared_ptr<slacks_t> slacks) const {
+std::pair<bool, bool> refinement_t::safe_access(const expression_t& access_lb,
+                                                const expression_t& access_ub,
+                                                bool is_comparison_check,
+                                                std::shared_ptr<slacks_t> slacks) const {
     // access is at least meta
     constraint_t lb = constraint_t(expression_t::meta(), access_lb);
     bool lb_satisfied = check_consistent(lb, slacks);
@@ -283,7 +293,7 @@ bool refinement_t::safe_access(const expression_t& access_lb, const expression_t
         : constraint_t(access_ub, expression_t::end());
     bool ub_satisfied = check_consistent(ub, slacks);
 
-    return lb_satisfied && ub_satisfied;
+    return {lb_satisfied, ub_satisfied};
 }
 
 bool refinement_t::check_eq(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index da0e257f2..25c12c081 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -46,7 +46,7 @@ class refinement_t {
     bool check_eq(const refinement_t &other, std::shared_ptr<slacks_t>) const;
     void write(std::ostream &o, std::shared_ptr<slacks_t>) const;
     bool same_type(const refinement_t &other) const;
-    bool safe_access(const expression_t&, const expression_t&, bool,
+    std::pair<bool, bool> safe_access(const expression_t&, const expression_t&, bool,
                      std::shared_ptr<slacks_t>) const;
     bool check_consistent(const constraint_t&, std::shared_ptr<slacks_t>) const;
     constraint_t construct_meta_end_constraint() const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 8ddc39493..231a978d6 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -421,7 +421,7 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
         if (auto width_number = width_interval.ub().number()) {
             int width = width_number->cast_to<int>();
             if (is_packet_ptr(reg_type)) {
-                m_offset.check_valid_access(s, reg_type, width, loc);
+                m_offset.check_valid_access(s, width, loc);
             }
             else {
                 m_region.check_valid_access(s, width, loc);
@@ -616,7 +616,7 @@ void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
             }
             else if (std::holds_alternative<packet_ptr_t>(type)) {
                 // packet
-                if (!m_offset.check_packet_access(u.access_reg, width, 0, true)) {
+                if (!m_offset.check_packet_access(u.access_reg, width, 0, true, loc)) {
                     m_errors.push_back(loc_str + ": Packet access out of bounds");
                 }
                 return;

From 6b0c9b8487cff06a76013e5abd43988726ec91af Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:53:13 -0400
Subject: [PATCH 354/373] Fixed Memory operations issues

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp          |  5 ++++-
 src/crab/region_domain.cpp            | 12 ++++++------
 src/crab/signed_interval_domain.cpp   |  2 ++
 src/crab/unsigned_interval_domain.cpp |  1 +
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 3c7e2d6ca..f7d0a0ddb 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1405,19 +1405,23 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
         if (!ptrs_in_ctx_range) {
             refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
             insert_in_registers(target_register, loc, top_rf);
+            return;
         }
     } else if (is_packet_ptr(basereg_type) || is_shared_ptr(basereg_type)) {
         if (width == 1) {
             expression_t e(interval_t{number_t{0}, number_t{UINT8_MAX}});
             insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
+            return;
         }
         else if (width == 2) {
             expression_t e(interval_t{number_t{0}, number_t{UINT16_MAX}});
             insert_in_registers(target_register, loc, refinement_t::numeric_refinement(e));
+            return;
         }
         else {
             refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
             insert_in_registers(target_register, loc, top_rf);
+            return;
         }
     } else if (is_stack_ptr(basereg_type)) {
         auto ptr_with_off = std::get<ptr_with_off_t>(basereg_ptr_or_mapfd_type);
@@ -1441,7 +1445,6 @@ void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>
         // we only store for stack pointers
         return;
     }
-
     auto basereg_with_off = std::get<ptr_with_off_t>(*maybe_basereg_type);
     auto offset_reg = basereg_with_off.get_offset();
     if (auto finite = offset_reg.finite_size()) {
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 5ec600c4c..4d7614e83 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1248,6 +1248,12 @@ bool region_domain_t::do_load(const Mem& b, const register_t& target_register, l
             m_errors.push_back(loc_str + ": Invalid width for stack load");
             return false;
         }
+        auto loaded = m_stack.find(load_at);
+        if (!loaded) {
+            // no field at loaded offset in stack, but possibly a number is there
+            m_registers -= target_register;
+            return false;
+        }
         if (width != 8) {
             // we do not support loading pointers from stack with width != 8
             // can be relaxed, if needed
@@ -1255,12 +1261,6 @@ bool region_domain_t::do_load(const Mem& b, const register_t& target_register, l
             m_errors.push_back(loc_str + ": Only 8-byte stack loads for pointers are supported");
             return false;
         }
-        auto loaded = m_stack.find(load_at);
-        if (!loaded) {
-            // no field at loaded offset in stack, but possibly a number is there
-            m_registers -= target_register;
-            return false;
-        }
         auto ptr_or_mapfd = loaded->first;
         if (is_shared_ptr(ptr_or_mapfd)) {
             auto shared_ptr = std::get<ptr_with_off_t>(ptr_or_mapfd);
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 6f5f2cf14..f06ad5439 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -448,6 +448,8 @@ void signed_interval_domain_t::store_in_stack(uint64_t key, refinement_t interva
 }
 
 void signed_interval_domain_t::store_in_stack(uint64_t key, interval_t interval, int width) {
+    // TODO: check if this is only done if new slack variables are created,
+    // otherwise, we shouldn't create new slacks.
     refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
     m_stack.store(key, rf, width);
 }
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index ae3cef860..b5184bb1d 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -402,6 +402,7 @@ void unsigned_interval_domain_t::store_in_stack(uint64_t key, refinement_t rf, i
 }
 
 void unsigned_interval_domain_t::store_in_stack(uint64_t key, interval_t interval, int width) {
+    // TODO: check if new slacks are created only when needed
     refinement_t rf = refinement_t::numeric_refinement(interval, m_slacks);
     m_stack.store(key, rf, width);
 }

From 9fa13e79511c4ce9743b8d864130470369e2e449 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:54:00 -0400
Subject: [PATCH 355/373] Fixed Bin operation issues

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp |  6 +++++-
 src/crab/region_domain.cpp   | 18 ++++++++++--------
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index f7d0a0ddb..7394851f0 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1550,6 +1550,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
     auto dst_register = register_t{bin.dst.v};
     auto finite_width = (bin.is64 ? 64 : 32);
 
+    // computing ptr -= ptr, and storing resultant as a numeric value
     if (subtracted_opt.has_value()) {
         interval_t dst_signed = *subtracted_opt;
         interval_t dst_unsigned = *subtracted_opt;
@@ -1569,7 +1570,10 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
     bool is_numeric_src = std::holds_alternative<Imm>(bin.v) ||
             find_signed_interval_value(register_t{std::get<Reg>(bin.v).v}).has_value();
 
-    if (!is_numeric_dst && bin.op != Op::MOV) {
+    if ((bin.op != Op::MOV && !is_numeric_dst) || (bin.op == Op::MOV && !is_numeric_src)) {
+        // Either the operation is not MOV, then dst must be numeric for storing into interval
+        // domain, or the operation is MOV and the src is not numeric, then we do not get
+        // a numeric value in dst.
         operator-=(dst_register);
         return;
     }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 4d7614e83..b6313d587 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1097,6 +1097,7 @@ void region_domain_t::do_bin(const Bin& bin,
 
     auto dst_register = register_t{bin.dst.v};
     auto dst_ptr_or_mapfd_opt = m_registers.find(dst_register);
+    bool is_ptr_or_mapfd_dst = dst_ptr_or_mapfd_opt.has_value();
     bool is_numeric_dst = dst_signed_interval_opt.has_value();
     bool is_numeric_src = std::holds_alternative<Imm>(bin.v) || src_signed_interval_opt.has_value();
 
@@ -1126,7 +1127,7 @@ void region_domain_t::do_bin(const Bin& bin,
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) break;
-                if (!is_numeric_dst) {
+                if (is_ptr_or_mapfd_dst) {
                     update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, imm_interval, loc, dst_register);
                 }
                 else {
@@ -1137,7 +1138,7 @@ void region_domain_t::do_bin(const Bin& bin,
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) break;
-                if (!is_numeric_dst) {
+                if (is_ptr_or_mapfd_dst) {
                     update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, -imm_interval, loc, dst_register);
                 }
                 else {
@@ -1155,10 +1156,11 @@ void region_domain_t::do_bin(const Bin& bin,
     else {
         auto src_register = register_t{std::get<Reg>(bin.v).v};
         auto src_ptr_or_mapfd_opt = m_registers.find(src_register);
+        bool is_ptr_or_mapfd_src = src_ptr_or_mapfd_opt.has_value();
         switch (bin.op) {
             case Op::MOV: {
                 // ra = rb
-                if (!is_numeric_src) {
+                if (is_ptr_or_mapfd_src) {
                     if (is_shared_ptr(*src_ptr_or_mapfd_opt)) {
                         auto shared_ptr = std::get<ptr_with_off_t>(*src_ptr_or_mapfd_opt);
                         set_aliases(dst_register, shared_ptr);
@@ -1175,15 +1177,15 @@ void region_domain_t::do_bin(const Bin& bin,
             }
             case Op::ADD: {
                 // ra += rb
-                if (!is_numeric_dst && is_numeric_src) {
+                if (is_ptr_or_mapfd_dst && is_numeric_src) {
                     update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, *src_signed_interval_opt, loc,
                                         dst_register);
                 }
-                else if (is_numeric_dst && !is_numeric_src) {
+                else if (is_numeric_dst && is_ptr_or_mapfd_src) {
                     update_ptr_or_mapfd(*src_ptr_or_mapfd_opt, *dst_signed_interval_opt, loc,
                                         dst_register);
                 }
-                else if (!is_numeric_dst && !is_numeric_src) {
+                else if (is_ptr_or_mapfd_dst && is_ptr_or_mapfd_src) {
                     // possibly adding two pointers
                     set_to_bottom();
                 }
@@ -1191,11 +1193,11 @@ void region_domain_t::do_bin(const Bin& bin,
             }
             case Op::SUB: {
                 // ra -= rb
-                if (!is_numeric_dst && is_numeric_src) {
+                if (is_ptr_or_mapfd_dst && is_numeric_src) {
                     update_ptr_or_mapfd(*dst_ptr_or_mapfd_opt, -(*src_signed_interval_opt),
                                         loc, dst_register);
                 }
-                else if (is_numeric_dst && !is_numeric_src) {
+                else if (is_numeric_dst && is_ptr_or_mapfd_src) {
                     m_registers -= dst_register;
                 }
                 else {

From aa2e32fe8057bd4c15c7ba1a2e681ee80a20f775 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:54:33 -0400
Subject: [PATCH 356/373] Fixed issues with Shared Ptr nullness initialization
 and updates

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b6313d587..b222a3a4b 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -641,7 +641,7 @@ void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t shared_ptr, in
     if (imm == 0) {
         if (op == Condition::Op::EQ) {
             if (nullness == nullness_t::_NULL) {
-                //m_registers.set_to_top();
+                // m_registers.set_to_top();
             }
             else if (nullness == nullness_t::NOT_NULL) {
                 m_registers.set_to_bottom();
@@ -653,7 +653,7 @@ void region_domain_t::assume_cst(Condition::Op op, ptr_with_off_t shared_ptr, in
         }
         else if (op == Condition::Op::NE) {
             if (nullness == nullness_t::NOT_NULL) {
-                //m_registers.set_to_top();
+                // m_registers.set_to_top();
             }
             else if (nullness == nullness_t::_NULL) {
                 m_registers.set_to_bottom();
@@ -882,7 +882,7 @@ void region_domain_t::do_call(const Call& u, const stack_cells_t& cells, locatio
                         goto out;
                     }
                 } else {
-                    auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::NOT_NULL,
+                    auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::MAYBE_NULL,
                                                get_map_value_size(*maybe_fd_reg));
                     set_aliases((int)r0, type);
                     m_registers.insert(r0, loc, type);
@@ -973,7 +973,7 @@ void region_domain_t::check_valid_access(const ValidAccess &s, int width, locati
             }
             if (!is_comparison_check && !s.or_null) {
                 auto nullness = ptr_with_off_type.get_nullness();
-                if (nullness == nullness_t::NOT_NULL) {
+                if (!(nullness == nullness_t::NOT_NULL)) {
                     m_errors.push_back(loc_str + ": Possible null access");
                 }
             }

From 2f210d753a3d12a31644a65d5d39f07e78402e9e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:55:22 -0400
Subject: [PATCH 357/373] Small refactor

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index e5b97e4d5..75d865379 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -155,7 +155,7 @@ void offset_registers_t::scratch_caller_saved_registers() {
 void offset_registers_t::forget_packet_pointers(location_t loc) {
     for (uint8_t r = R0_RETURN_VALUE; r < NUM_REGISTERS-2; r++) {
         if (auto it = find(register_t{r})) {
-            if (it->get_type() == refinement_type_t::PACKET) {
+            if (it->is_packet_refinement()) {
                 operator-=(register_t{r});
             }
         }

From f3e4f7cef49f72541bb21d970e6f884961640454 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 11:55:40 -0400
Subject: [PATCH 358/373] Fixed incorrect reporting of error in Comparable

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 231a978d6..4415cb016 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -471,6 +471,7 @@ void inference_domain_t::operator()(const Comparable& u, location_t loc) {
         }
         this->operator()(ValidAccess{u.r1, 0, Imm{0}, false}, loc);
         this->operator()(ValidAccess{u.r2, 0, Imm{0}, false}, loc);
+        return;
     }
     else if (maybe_num_type2) {
         // _Maybe_ different types, so r2 must be a number.

From 4a49e2d576eeb54f868aca13a84492fcb1cbdbf5 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 12:48:41 -0400
Subject: [PATCH 359/373] Fixed the functionality for detecting non-numeric
 stack access

The code was accidentally removed before, to check for a stack numeric
access when the access type is read, which has been added;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp        |  8 +++---
 src/crab/interval_domain.hpp        |  2 +-
 src/crab/signed_interval_domain.cpp | 39 ++++++++++++++++++++++-------
 src/crab/signed_interval_domain.hpp |  2 +-
 src/crab/type_inference.cpp         | 11 ++++++--
 5 files changed, 46 insertions(+), 16 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 7394851f0..47f3637b8 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1461,10 +1461,12 @@ void interval_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>
     }
 }
 
-void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
-        location_t loc) {
+void interval_domain_t::check_valid_access(const ValidAccess& s, interval_t stack_offset,
+                                           interval_t reg_interval_value, int width,
+                                           bool check_stack_all_numeric, location_t loc) {
     // access can be checked only in the signed domain
-    m_signed.check_valid_access(s, interval, loc);
+    m_signed.check_valid_access(s, stack_offset, reg_interval_value, width,
+                                check_stack_all_numeric, loc);
 }
 
 
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 9b5547a51..6d00892ce 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -132,7 +132,7 @@ class interval_domain_t final {
     void do_mem_store(const Mem&, std::optional<ptr_or_mapfd_t>);
     void do_call(const Call&, const stack_cells_t&, location_t);
     void do_bin(const Bin&, std::optional<interval_t>, location_t);
-    void check_valid_access(const ValidAccess&, interval_t, location_t);
+    void check_valid_access(const ValidAccess&, interval_t, interval_t, int, bool, location_t);
     void assume_cst(Condition::Op, bool, register_t, Value, location_t);
     void assume_signed_cst(Condition::Op, bool, const interval_t&, const interval_t&,
             const interval_t&, const interval_t&, register_t, Value, location_t);
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index f06ad5439..809a98b22 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -660,19 +660,40 @@ void signed_interval_domain_t::store_in_stack(const Mem& b, uint64_t offset, int
     }
 }
 
-void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t interval,
-        location_t loc) {
+void signed_interval_domain_t::check_valid_access(const ValidAccess& s, interval_t stack_offset,
+                                                  interval_t reg_interval_value, int width,
+                                                  bool check_stack_all_numeric, location_t loc) {
     std::string loc_str = loc.to_string();
-    bool is_comparison_check = s.width == (Value)Imm{0};
-    if (!is_comparison_check) {
-        if (s.or_null) {
-            if (auto singleton = interval.singleton()) {
-                if (*singleton == number_t{0}) return;
+    if (check_stack_all_numeric) {
+        auto start_interval = stack_offset + interval_t{s.offset};
+        if (auto finite_size = start_interval.finite_size()) {
+            if (auto start_interval_lb = start_interval.lb().number()) {
+                auto start_offset = (*start_interval_lb).cast_to<uint64_t>();
+                int width_from_start = finite_size->cast_to<int>() + width;
+                if (!m_stack.all_numeric(start_offset, width_from_start)) {
+                    m_errors.push_back(loc_str + ": Stack access not numeric");
+                }
+            }
+            else {
+                m_errors.push_back(loc_str + ": Offset information not available");
             }
-            m_errors.push_back(loc_str + ": Non-null number");
         }
         else {
-            m_errors.push_back(loc_str + ": Only pointers can be dereferenced");
+            m_errors.push_back(loc_str + ": Register interval not finite for stack access");
+        }
+    }
+    else {
+        bool is_comparison_check = s.width == (Value)Imm{0};
+        if (!is_comparison_check) {
+            if (s.or_null) {
+                if (auto singleton = reg_interval_value.singleton()) {
+                    if (*singleton == number_t{0}) return;
+                }
+                m_errors.push_back(loc_str + ": Non-null number");
+            }
+            else {
+                m_errors.push_back(loc_str + ": Only pointers can be dereferenced");
+            }
         }
     }
 }
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index da3fc0e21..21c8b986b 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -149,7 +149,7 @@ class signed_interval_domain_t final {
     string_invariant to_set();
     void set_require_check(check_require_func_t f);
 
-    void check_valid_access(const ValidAccess&, interval_t, location_t);
+    void check_valid_access(const ValidAccess&, interval_t, interval_t, int, bool, location_t);
     std::optional<refinement_t> find_interval_value(register_t) const;
     std::optional<refinement_t> find_interval_at_loc(const register_location_t reg) const;
     std::optional<signed_interval_stack_cell_t> find_in_stack(uint64_t) const;
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 4415cb016..3668573f2 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -416,7 +416,7 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
         }
         else {
             auto imm = std::get<Imm>(s.width); 
-            width_interval = interval_t{number_t{imm.v}};
+            width_interval = interval_t{imm.v};
         }
         if (auto width_number = width_interval.ub().number()) {
             int width = width_number->cast_to<int>();
@@ -425,6 +425,12 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
             }
             else {
                 m_region.check_valid_access(s, width, loc);
+                if (is_stack_ptr(reg_type) && s.access_type == AccessType::read) {
+                    auto stack_ptr = std::get<ptr_with_off_t>(*reg_type);
+                    auto offset_ptr = stack_ptr.get_offset();
+                    m_interval.check_valid_access(s, offset_ptr, interval_t::bottom(), width, true,
+                                                  loc);
+                }
             }
         }
         else {
@@ -434,7 +440,8 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
     else {
         auto rf_type = m_interval.find_interval_value(s.reg.v);
         if (rf_type) {
-            m_interval.check_valid_access(s, rf_type->get_interval_value(m_slacks), loc);
+            m_interval.check_valid_access(s, interval_t::bottom(),
+                                          rf_type->get_interval_value(m_slacks), 0, false, loc);
         }
         else {
             m_errors.push_back(loc_str + ": Access on unknown register");

From f2910dc39ffbbdbcc26916e0057795561d1d45f1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 14:49:16 -0400
Subject: [PATCH 360/373] Fixed solving some trivial constraints which do not
 contain pkt symbols

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/refinement.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 260c4c5c9..499ecfadf 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -258,8 +258,13 @@ constraint_t refinement_t::construct_meta_end_constraint() const {
 
 bool refinement_t::check_consistent(const constraint_t& c, std::shared_ptr<slacks_t> slacks) const {
     if (c.is_unsat(slacks)) {
+        // The constraint is unsatisfiable
         return false;
     }
+    if (c.is_sat(slacks)) {
+        // This checks if the constraint is trivially satisfiable, like -1 <= 0
+        return true;
+    }
     else if (c.contains_single_pkt_symbol()) {
         // This is a specific case containing single packet symbol, we can substitute all possible
         // values for the symbol, and check if the constraint is satisfiable

From c6cc6ba7e3dfa21b40a39cbd12ca1ed05a12be6a Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 17:00:21 -0400
Subject: [PATCH 361/373] Fixed error while checking ctx loads

When loading a numerical value, there should not be an overlap with
packet pointers, which was incorrectly being reported due to bad
computation of offsets; Fixed now

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 75d865379..ddbb097a9 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -778,8 +778,8 @@ bool offset_domain_t::do_load(const Mem& b, const register_t& target_register,
         // or a numeric value (when cells contains nothing).
         for (auto const& k : m_ctx->get_keys()) {
             // The value 4 should be dynamic, however, pkt pointers are always stored as 4-byte
-            auto start = p_offset.lb();
-            auto end = p_offset.ub() + bound_t{offset+width-1};
+            auto start = p_offset.lb() + bound_t{offset};
+            auto end = start + bound_t{width-1};
             if (end < bound_t{k} || start > bound_t{k + 4 - 1}) {
                 // no overlap with stored range
                 continue;

From 9f9eb73c0e77cdebd06cea9f22521661ae9a542f Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 17:22:44 -0400
Subject: [PATCH 362/373] Removed a redundant error reporting

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 3668573f2..2bd27be94 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -340,11 +340,8 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
                     // both packet pointers
                     m_offset(s, loc);
                 }
-                else if (is_mapfd_type(maybe_left_ptr)) {
-                    CRAB_ERROR("Mapfd type is not supported in inference domain");
-                    // both mapfds
-                }
                 else if (is_stack_ptr(maybe_left_ptr) || is_ctx_ptr(maybe_left_ptr)) {
+                    // TODO: fix this if these scenarios do not occur
                     CRAB_ERROR("Assume on stack/ctx pointers is not supported in inference domain");
                 }
                 else {
@@ -368,7 +365,6 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
             m_region.assume_cst(cond.op, shared_ptr, imm, cond.left.v, loc);
         }
         if (is_mapfd_type(maybe_left_ptr)) {
-            CRAB_ERROR("Mapfd type is not supported in inference domain");
             // left is a mapfd
             // TODO: need to work with values
         }

From d535452cc150439afbd65655f41aff43984066ea Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 18:14:56 -0400
Subject: [PATCH 363/373] Removed a redundant error

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b222a3a4b..7ca23cda9 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -1237,7 +1237,7 @@ bool region_domain_t::do_load(const Mem& b, const register_t& target_register, l
 
     std::string loc_str = loc.to_string();
     if (!offset_singleton) {
-        m_errors.push_back(loc_str + ": Load at an unknown offset");
+        // We cannot load a pointer from an unknown offset
         m_registers -= target_register;
         return false;
     }

From 66a125fe989671d56b3d5e7691bb1a564f356a23 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Wed, 25 Jun 2025 18:45:59 -0400
Subject: [PATCH 364/373] Changed how add and subtract on refinements is done

Removed previously added overflow checks, needs revisiting;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 24 ++++++++++++++++++++++--
 src/crab/refinement.cpp      |  4 ++++
 src/crab/refinement.hpp      |  1 +
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 47f3637b8..85f3d940d 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1607,13 +1607,33 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
             case Op::ADD: {
                 // ra += imm
                 if (imm == 0) return;
-                add_overflow(dst_register, number_t{gsl::narrow<int>(imm)}, finite_width, loc);
+                //add_overflow(dst_register, number_t{gsl::narrow<int>(imm)}, finite_width, loc);
+                auto rf_signed = m_signed.find_interval_value(dst_register);
+                auto rf_unsigned = m_unsigned.find_interval_value(dst_register);
+                // TODO: possibly more checks are needed here
+                if (rf_signed && rf_unsigned) {
+                    m_signed.insert_in_registers(dst_register, loc, *rf_signed + imm_interval);
+                    m_unsigned.insert_in_registers(dst_register, loc, *rf_unsigned + imm_interval);
+                }
+                else {
+                    operator-=(dst_register);
+                }
                 break;
             }
             case Op::SUB: {
                 // ra -= imm
                 if (imm == 0) return;
-                add_overflow(dst_register, number_t{gsl::narrow<int>(-imm)}, finite_width, loc);
+                //add_overflow(dst_register, number_t{gsl::narrow<int>(-imm)}, finite_width, loc);
+                // TODO: possibly more checks are needed here
+                auto rf_signed = m_signed.find_interval_value(dst_register);
+                auto rf_unsigned = m_unsigned.find_interval_value(dst_register);
+                if (rf_signed && rf_unsigned) {
+                    m_signed.insert_in_registers(dst_register, loc, *rf_signed - imm_interval);
+                    m_unsigned.insert_in_registers(dst_register, loc, *rf_unsigned - imm_interval);
+                }
+                else {
+                    operator-=(dst_register);
+                }
                 break;
             }
             case Op::MUL: {
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index 499ecfadf..cc62de941 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -80,6 +80,10 @@ refinement_t refinement_t::operator+(int n) const {
     return operator+(interval_t{n});
 }
 
+refinement_t refinement_t::operator-(interval_t i) const {
+    return operator+(-i);
+}
+
 refinement_t refinement_t::add(const refinement_t &other, std::shared_ptr<slacks_t> slacks) const {
     expression_t new_value = _value + other._value;
     refinement_type_t new_type = (_type == other._type) ? _type
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index 25c12c081..e526f4567 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -36,6 +36,7 @@ class refinement_t {
     [[nodiscard]] expression_t get_value() const { return _value; }
     refinement_t operator+(int n) const;
     refinement_t operator+(interval_t) const;
+    refinement_t operator-(interval_t) const;
     refinement_t add(const refinement_t &other, std::shared_ptr<slacks_t>) const;
     refinement_t subtract(const refinement_t &other, std::shared_ptr<slacks_t>) const;
     refinement_t join(const refinement_t &other, std::shared_ptr<slacks_t>) const;

From ca65852e473946039d1e0191cb7e2f3e1ffbbe8d Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 12:07:47 -0400
Subject: [PATCH 365/373] Fixed nullness for ptr in LoadVariable function

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/region_domain.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index 7ca23cda9..b4298ff77 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -831,8 +831,8 @@ void region_domain_t::operator()(const LoadVariable& u, location_t loc) {
         m_registers -= register_t{u.dst.v};
         return;
     } else {
-        auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::MAYBE_NULL,
-                              interval_t{number_t{desc->value_size}});
+        auto type = ptr_with_off_t::shared_region_ptr(0, -1, nullness_t::NOT_NULL,
+                              interval_t{desc->value_size});
         m_registers.insert(u.dst.v, loc, type);
     }
 }

From aa6d824527ac05b2ded18b6cba308e68d477cd57 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 13:58:25 -0400
Subject: [PATCH 366/373] Added checks for checking bottom intervals, but
 disabled

Since these checks make previously verified benchmarks to be unsafe,
special care is needed;
Recheck later;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp | 57 +++++++++++++++++++++++++++++++++---
 src/crab/type_inference.cpp  | 50 ++++++++++++++++++++++++++-----
 src/crab/type_ostream.cpp    |  8 +++++
 3 files changed, 103 insertions(+), 12 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 85f3d940d..7f6a50b15 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -210,6 +210,12 @@ void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, co
     auto rf_opt = is_signed ? m_signed.find_interval_value(lhs) : m_unsigned.find_interval_value(lhs);
     if (!rf_opt) return;
     interval_t interval = rf_opt->get_interval_value(m_slacks);
+    /*
+    if (interval.is_bottom()) {
+        // TODO: Check what to do here
+        return; // No valid interval, nothing to do.
+    }
+    */
     // numeric_refinement_top() represents interval_t::top()
     refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
     if (interval.ub() - interval.lb() >= span) {
@@ -302,6 +308,12 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
         }
         yi = yi_opt->get_interval_value(m_slacks);
         zi = zi_opt->get_interval_value(m_slacks);
+        /*
+        if (yi.is_bottom() || zi.is_bottom()) {
+            // TODO: Check what to do here
+            return;
+        }
+        */
     } else {
         auto yi_opt = m_unsigned.find_interval_value(y);
         auto zi_opt = m_unsigned.find_interval_value(z);
@@ -311,6 +323,12 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
         }
         yi = yi_opt->get_interval_value(m_slacks);
         zi = zi_opt->get_interval_value(m_slacks);
+        /*
+        if (yi.is_bottom() || zi.is_bottom()) {
+            // TODO: Check what to do here
+            return;
+        }
+        */
     }
 
     switch (op) {
@@ -367,6 +385,12 @@ void interval_domain_t::apply(const arith_binaryop_t& op, const register_t& x, c
         }
         yi = yi_opt->get_interval_value(m_slacks);
     }
+    /*
+    if (yi.is_bottom()) {
+        // TODO: Check what to do here
+        return; // No valid interval, nothing to do.
+    }
+    */
 
     switch (op) {
         case arith_binaryop_t::ADD: xi = yi + interval_t{k}; break;
@@ -405,6 +429,12 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
         }
         yi = yi_opt->get_interval_value(m_slacks);
     }
+    /*
+    if (yi.is_bottom()) {
+        // TODO: Check what to do here
+        return; // No valid interval, nothing to do.
+    }
+    */
     interval_t zi{number_t{k.cast_to<uint64_t>()}};
 
     switch (op) {
@@ -448,6 +478,12 @@ void interval_domain_t::apply(const bitwise_binaryop_t& op, const register_t& x,
         yi = yi_opt->get_interval_value(m_slacks);
         zi = zi_opt->get_interval_value(m_slacks);
     }
+    /*
+    if (yi.is_bottom() || zi.is_bottom()) {
+        // TODO: Check what to do here
+        return; // No valid interval, nothing to do.
+    }
+    */
 
     switch (op) {
         case bitwise_binaryop_t::AND: xi = yi.And(zi); break;
@@ -533,8 +569,9 @@ void interval_domain_t::sub(const register_t& lhs, const number_t& op2, location
 // Add/subtract with overflow are both signed and unsigned. We can use either one of the two to compute the
 // result before adjusting for overflow, though if one is top we want to use the other to retain precision.
 void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
+    // TODO: Check what to do with bottom intervals in all add_overflow methods
     interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
-    if (!lhs_signed.is_top()) {
+    if (!lhs_signed.is_top() && !lhs_signed.is_bottom()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
@@ -543,7 +580,7 @@ void interval_domain_t::add_overflow(const register_t& lhs, const register_t& op
 
 void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
     interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
-    if (!lhs_signed.is_top()) {
+    if (!lhs_signed.is_top() && !lhs_signed.is_bottom()) {
         apply_signed(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::ADD, lhs, lhs, op2, finite_width, loc);
@@ -552,7 +589,7 @@ void interval_domain_t::add_overflow(const register_t& lhs, const number_t& op2,
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op2, const int finite_width, location_t loc) {
     interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
-    if (!lhs_signed.is_top()) {
+    if (!lhs_signed.is_top() && !lhs_signed.is_bottom()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
@@ -561,7 +598,7 @@ void interval_domain_t::sub_overflow(const register_t& lhs, const register_t& op
 
 void interval_domain_t::sub_overflow(const register_t& lhs, const number_t& op2, const int finite_width, location_t loc) {
     interval_t lhs_signed = m_signed.find_interval_value(lhs)->get_interval_value(m_slacks);
-    if (!lhs_signed.is_top()) {
+    if (!lhs_signed.is_top() && !lhs_signed.is_bottom()) {
         apply_signed(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
     } else {
         apply_unsigned(arith_binaryop_t::SUB, lhs, lhs, op2, finite_width, loc);
@@ -1296,6 +1333,7 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
 
     auto left_signed = find_signed_interval_value(left)->get_interval_value(m_slacks);
     auto left_unsigned = find_unsigned_interval_value(left)->get_interval_value(m_slacks);
+    // TODO: Check if these intervals can be bottom
     auto right_signed = interval_t::bottom();
     auto right_unsigned = interval_t::bottom();
     if (std::holds_alternative<Reg>(right)) {
@@ -1476,6 +1514,7 @@ void interval_domain_t::shl(const register_t& reg, int imm, const int finite_wid
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
         interval_t interval = interval_opt->get_interval_value(m_slacks);
+        // TODO: Check if intervals can be bottom.
         if (interval.finite_size()) {
             const number_t lb = interval.lb().number().value();
             const number_t ub = interval.ub().number().value();
@@ -1513,6 +1552,7 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
 
     if (auto interval_opt = find_unsigned_interval_value(reg)) {
         interval_t interval = interval_opt->get_interval_value(m_slacks);
+        // TODO: Check if intervals can be bottom.
         number_t lb_n{0};
         number_t ub_n{std::numeric_limits<uint64_t>::max() >> imm};
         if (interval.finite_size()) {
@@ -1668,6 +1708,13 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                     // AND with immediate is only a 32-bit operation so svalue and uvalue
                     // are the same.
                     auto dst_signed = m_signed.find_interval_value(dst_register)->get_interval_value(m_slacks);
+                    /*
+                    if (dst_signed.is_bottom()) {
+                        // If the value is bottom, we cannot refine it further.
+                        operator-=(dst_register);
+                        return;
+                    }
+                    */
                     auto lb = dst_signed.lb().number().value();
                     auto ub = dst_signed.ub().number().value();
                     dst_signed = dst_signed & interval_t{number_t{0}, number_t{imm}};
@@ -1796,6 +1843,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                 // ra <<= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
                     auto src_unsigned = src_unsigned_interval_opt->get_interval_value(m_slacks);
+                    // TODO: Check if intervals can be bottom.
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<int32_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
@@ -1815,6 +1863,7 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                 // ra >>= rb
                 if (auto src_unsigned_interval_opt = find_unsigned_interval_value(src_register)) {
                     auto src_unsigned = src_unsigned_interval_opt->get_interval_value(m_slacks);
+                    // TODO: Check if intervals can be bottom.
                     if (std::optional<number_t> sn = src_unsigned.singleton()) {
                         uint64_t imm = sn->cast_to<uint64_t>() & (bin.is64 ? 63 : 31);
                         if (imm <= std::numeric_limits<int32_t>::max()) {
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 2bd27be94..6ff8f6724 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -270,7 +270,7 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
                         int width = single_width->cast_to<int>();
                         stack_values.emplace_back(offset, width);
                     } else {
-                        m_errors.push_back(loc_str + ": Width for stack stores cannot be an interval");
+                        m_errors.push_back(loc_str + ": Width for stack stores is not a constant");
                     }
                 }
                 else {
@@ -391,7 +391,7 @@ void inference_domain_t::operator()(const ValidDivisor& u, location_t loc) {
     if (!thread_local_options.allow_division_by_zero) {
         interval_t to_check = u.is_signed ? maybe_signed_reg->get_interval_value(m_slacks)
                                           : maybe_unsigned_reg->get_interval_value(m_slacks);
-        if (interval_t{number_t{0}} <= to_check) {
+        if (/*to_check.is_bottom() || */interval_t{0} <= to_check) {
             m_errors.push_back(loc_str + ": Possible division by zero");
         }
     }
@@ -409,6 +409,13 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
                 return;
             }
             width_interval = width_rf->get_interval_value(m_slacks);
+            /*
+            if (width_interval.is_bottom()) {
+                // TODO: handle this case better
+                //m_errors.push_back(loc_str + ": Width is unknown for valid access");
+                return;
+            }
+            */
         }
         else {
             auto imm = std::get<Imm>(s.width); 
@@ -436,8 +443,14 @@ void inference_domain_t::operator()(const ValidAccess& s, location_t loc) {
     else {
         auto rf_type = m_interval.find_interval_value(s.reg.v);
         if (rf_type) {
-            m_interval.check_valid_access(s, interval_t::bottom(),
-                                          rf_type->get_interval_value(m_slacks), 0, false, loc);
+            auto interval_val = rf_type->get_interval_value(m_slacks);
+            /*
+            if (interval_val.is_bottom()) {
+                //m_errors.push_back(loc_str + ": Interval value for register is unknown for valid access");
+                return;
+            }
+            */
+            m_interval.check_valid_access(s, interval_t::bottom(), interval_val, 0, false, loc);
         }
         else {
             m_errors.push_back(loc_str + ": Access on unknown register");
@@ -522,8 +535,14 @@ void inference_domain_t::operator()(const ValidSize& u, location_t loc) {
 
     if (maybe_num_type) {
         auto reg_value = maybe_num_type->get_interval_value(m_slacks);
-        if ((u.can_be_zero && reg_value.lb() >= bound_t{number_t{0}})
-                || (!u.can_be_zero && reg_value.lb() > bound_t{number_t{0}})) {
+        //if (!reg_value.is_bottom()) {
+            if ((u.can_be_zero && reg_value.lb() >= bound_t{0})
+                    || (!u.can_be_zero && reg_value.lb() > bound_t{0})) {
+                return;
+            }
+        //}
+        else {
+            // TODO: handle this case better
             return;
         }
     }
@@ -581,7 +600,7 @@ void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
                                 auto rf = cell->first;
                                 auto size = cell->second;
                                 auto key_value = rf.get_interval_value(m_slacks);
-                                if (size != sizeof(uint32_t)) {
+                                if (/*key_value.is_bottom() || */size != sizeof(uint32_t)) {
                                     m_errors.push_back(loc_str + ": Array map key must be 32 bits");
                                     return;
                                 }
@@ -592,7 +611,7 @@ void inference_domain_t::operator()(const ValidMapKeyValue& u, location_t loc) {
                                 } else {
                                     m_errors.push_back(loc_str + ": Max entries is not finite");
                                 }
-                                if (key_value.lb() < bound_t{number_t{0}}) {
+                                if (key_value.lb() < bound_t{0}) {
                                     m_errors.push_back(loc_str + ": Array index underflow");
                                     return;
                                 }
@@ -659,12 +678,27 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
         src_signed_rf = m_interval.find_signed_interval_value(r.v);
         if (src_signed_rf) {
             src_signed_interval = src_signed_rf->get_interval_value(m_slacks);
+            /*
+            if (src_signed_interval->is_bottom()) {
+                // TODO: handle this case better
+                //m_errors.push_back(loc.to_string() + ": Source register has no valid value");
+                return;
+            }
+            */
         }
     }
     auto dst_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(dst_register);
     auto dst_signed_rf = m_interval.find_signed_interval_value(dst_register);
     if (dst_signed_rf) {
         dst_signed_interval = dst_signed_rf->get_interval_value(m_slacks);
+        /*
+        if (dst_signed_interval->is_bottom()) {
+            // TODO: handle this case better
+            //m_errors.push_back(loc.to_string() + ": Destination register has no valid value");
+            m_interval -= dst_register;
+            return;
+        }
+        */
     }
 
     std::string loc_str = loc.to_string();
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index b9fc66a9e..ef81c4b66 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -26,6 +26,10 @@ void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
 void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::refinement_t n,
         bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
     crab::interval_t i = n.get_interval_value(slacks);
+    if (i.is_bottom()) {
+        o << "[" << start << "-" << end << "] : bottom";
+        return;
+    }
     if (i.is_top()) {
         if (is_signed) {
             o << "[" << start << "-" << end << "] : snumber";
@@ -79,6 +83,10 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
 void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool is_signed,
         std::shared_ptr<crab::slacks_t> slacks) {
     crab::interval_t i = n.get_interval_value(slacks);
+    if (i.is_bottom()) {
+        o << r << " : bottom";
+        return;
+    }
     if (i.is_top()) {
         if (is_signed) {
             o << r << " : snumber";

From c344e89176ec0973ddf694682a4fc4fa9c303221 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 14:07:13 -0400
Subject: [PATCH 367/373] Removed creating top interval refinements with slacks

These refinements generally do not help with packet operations, so using
slacks with these should not help, hence removed it;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/interval_domain.cpp          | 40 +++++++++++++--------------
 src/crab/refinement.hpp               |  3 +-
 src/crab/signed_interval_domain.cpp   |  2 +-
 src/crab/unsigned_interval_domain.cpp |  2 +-
 4 files changed, 23 insertions(+), 24 deletions(-)

diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 7f6a50b15..243c4f994 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -217,7 +217,7 @@ void interval_domain_t::overflow_bounds(const register_t& lhs, number_t span, co
     }
     */
     // numeric_refinement_top() represents interval_t::top()
-    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (interval.ub() - interval.lb() >= span) {
         // Interval covers the full space.
         // We do not forget the interval, as it will remove the information that it is a number.
@@ -709,7 +709,7 @@ void interval_domain_t::scratch_caller_saved_registers() {
 
 void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_stack,
         location_t loc) {
-    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     for (const auto& [offset, width] : store_in_stack) {
         auto overlapping_cells = find_overlapping_cells_in_stack(offset, width);
         /*
@@ -737,7 +737,7 @@ void interval_domain_t::do_call(const Call& u, const stack_cells_t& store_in_sta
 
 void interval_domain_t::operator()(const Packet& u, location_t loc) {
     auto r0 = register_t{R0_RETURN_VALUE};
-    insert_in_registers(r0, loc, refinement_t::numeric_refinement_top(m_slacks));
+    insert_in_registers(r0, loc, refinement_t::numeric_refinement_top());
     scratch_caller_saved_registers();
 }
 
@@ -785,7 +785,7 @@ void interval_domain_t::assume_unsigned_lt(bool is64, bool strict,
         register_t left, Value right, location_t loc) {
 
     auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
-    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     if (right_interval <= interval_t::nonnegative(64)) {
         // Both left_interval and right_interval fit in [0, INT_MAX],
         // and can be treated as both signed and unsigned values
@@ -841,7 +841,7 @@ void interval_domain_t::assume_unsigned_gt(bool is64, bool strict,
         const interval_t& right_signed, const interval_t& right_unsigned,
         register_t left, Value right, location_t loc) {
 
-    refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    refinement_t top_rf = refinement_t::numeric_refinement_top();
     auto positive = interval_t{number_t{0}, bound_t::plus_infinity()};
     if (left_interval <= interval_t::unsigned_int(64) &&
             right_interval <= interval_t::unsigned_int(64)) {
@@ -1418,7 +1418,7 @@ bool interval_domain_t::load_from_stack(register_t reg, interval_t load_at, int
     //if (overlapping_cells.size() == 1) {
         // only allow loading from a single cell
         if (all_numeric_in_stack(start_offset, width)) {
-            insert_in_registers(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
+            insert_in_registers(reg, loc, refinement_t::numeric_refinement_top());
             return true;
         }
     //}
@@ -1441,7 +1441,7 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
 
     if (is_ctx_ptr(basereg_type)) {
         if (!ptrs_in_ctx_range) {
-            refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+            refinement_t top_rf = refinement_t::numeric_refinement_top();
             insert_in_registers(target_register, loc, top_rf);
             return;
         }
@@ -1457,7 +1457,7 @@ void interval_domain_t::do_load(const Mem& b, const register_t& target_register,
             return;
         }
         else {
-            refinement_t top_rf = refinement_t::numeric_refinement_top(m_slacks);
+            refinement_t top_rf = refinement_t::numeric_refinement_top();
             insert_in_registers(target_register, loc, top_rf);
             return;
         }
@@ -1538,7 +1538,7 @@ void interval_domain_t::shl(const register_t& reg, int imm, const int finite_wid
             if (to_signed(ub_n) >= to_signed(lb_n)) {
                 insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
             } else {
-                insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
+                insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top());
             }
             return;
         }
@@ -1576,12 +1576,12 @@ void interval_domain_t::lshr(const register_t& reg, int imm, const int finite_wi
         if (ub_n.narrow<int64_t>() >= lb_n.narrow<int64_t>()) {
             insert_in_registers_signed(reg, loc, interval_t{lb_n, ub_n});
         } else {
-            insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
+            insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top());
         }
         return;
     }
-    insert_in_registers_unsigned(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
-    insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top(m_slacks));
+    insert_in_registers_unsigned(reg, loc, refinement_t::numeric_refinement_top());
+    insert_in_registers_signed(reg, loc, refinement_t::numeric_refinement_top());
 }
 
 void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtracted_opt,
@@ -1749,9 +1749,9 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                 //ashr(dst_register, gsl::narrow<int32_t>(imm), finite_width, loc);
                 // TODO: implement ARSH
                 m_signed.insert_in_registers(dst_register, loc,
-                                             refinement_t::numeric_refinement_top(m_slacks));
+                                             refinement_t::numeric_refinement_top());
                 m_unsigned.insert_in_registers(dst_register, loc,
-                                               refinement_t::numeric_refinement_top(m_slacks));
+                                               refinement_t::numeric_refinement_top());
                 break;
             }
             default: {
@@ -1770,9 +1770,9 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
             case Op::MOVSX16:
             case Op::MOVSX32:
                 m_signed.insert_in_registers(dst_register, loc,
-                                            refinement_t::numeric_refinement_top(m_slacks));
+                                            refinement_t::numeric_refinement_top());
                 m_unsigned.insert_in_registers(dst_register, loc,
-                                            refinement_t::numeric_refinement_top(m_slacks));
+                                            refinement_t::numeric_refinement_top());
                 break;
             case Op::MOV: {
                 // ra = rb
@@ -1877,9 +1877,9 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                     }
                 }
                 m_signed.insert_in_registers(dst_register, loc,
-                                             refinement_t::numeric_refinement_top(m_slacks));
+                                             refinement_t::numeric_refinement_top());
                 m_unsigned.insert_in_registers(dst_register, loc,
-                                             refinement_t::numeric_refinement_top(m_slacks));
+                                             refinement_t::numeric_refinement_top());
                 break;
             }
             case Op::ARSH: {
@@ -1890,9 +1890,9 @@ void interval_domain_t::do_bin(const Bin& bin, std::optional<interval_t> subtrac
                 //}
                 // TODO: implement ARSH
                 m_signed.insert_in_registers(dst_register, loc,
-                                             refinement_t::numeric_refinement_top(m_slacks));
+                                             refinement_t::numeric_refinement_top());
                 m_unsigned.insert_in_registers(dst_register, loc,
-                                             refinement_t::numeric_refinement_top(m_slacks));
+                                             refinement_t::numeric_refinement_top());
                 break;
             }
             default: {
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index e526f4567..c64bd953d 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -95,8 +95,7 @@ class refinement_t {
         return numeric_refinement(expression_t(s));
     }
 
-    static refinement_t numeric_refinement_top(std::shared_ptr<slacks_t> slacks = nullptr) {
-        if (slacks) return numeric_refinement(interval_t::top(), slacks);
+    static refinement_t numeric_refinement_top() {
         // expression_t::top() represents a top interval
         return numeric_refinement(expression_t::top());
     }
diff --git a/src/crab/signed_interval_domain.cpp b/src/crab/signed_interval_domain.cpp
index 809a98b22..01b665f5a 100644
--- a/src/crab/signed_interval_domain.cpp
+++ b/src/crab/signed_interval_domain.cpp
@@ -546,7 +546,7 @@ constexpr T truncate(T x) noexcept {
 
 void signed_interval_domain_t::operator()(const Un& u, location_t loc) {
     // numeric_refinement_top() creates interval_t::top()
-    auto top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    auto top_rf = refinement_t::numeric_refinement_top();
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {
diff --git a/src/crab/unsigned_interval_domain.cpp b/src/crab/unsigned_interval_domain.cpp
index b5184bb1d..7527720c9 100644
--- a/src/crab/unsigned_interval_domain.cpp
+++ b/src/crab/unsigned_interval_domain.cpp
@@ -502,7 +502,7 @@ constexpr T truncate(T x) noexcept {
 
 void unsigned_interval_domain_t::operator()(const Un& u, location_t loc) {
     // numeric_refinement_top() creates interval_t::top()
-    auto top_rf = refinement_t::numeric_refinement_top(m_slacks);
+    auto top_rf = refinement_t::numeric_refinement_top();
     auto swap_endianness = [&](interval_t& v, auto be_or_le) {
         if (const auto n = v.singleton()) {
             if (n->fits_cast_to<int64_t>()) {

From 3755f2b1e915cbe99e671275c5bc3319c4621ce1 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 14:18:49 -0400
Subject: [PATCH 368/373] Removed the check for min width for pointer joins

For joins, pointers should have exact width; even if this doesn't work
in all cases, it gives a safe analysis;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/offset_domain.cpp |  4 ----
 src/crab/region_domain.cpp | 14 ++++++++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index ddbb097a9..246fc9422 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -255,8 +255,6 @@ offset_stack_t offset_stack_t::join(const offset_stack_t& other,
             auto rf2 = rf_cells2.first;
             int width1 = rf_cells1.second;
             int width2 = rf_cells2.second;
-            // TODO: for numerical values, the width does not have to be the same
-            // hence, handle accordingly
             if (rf1.same_type(rf2) && width1 == width2) {
                 out_stack_rfs.insert({kv.first, std::make_pair(rf1.join(rf2, slacks), width1)});
             }
@@ -284,8 +282,6 @@ offset_stack_t offset_stack_t::widen(const offset_stack_t& other,
             auto rf2 = rf_cells2.first;
             int width1 = rf_cells1.second;
             int width2 = rf_cells2.second;
-            // TODO: for numerical values, the width does not have to be the same
-            // hence, handle accordingly
             if (rf1.same_type(rf2) && width1 == width2) {
                 out_stack_rfs.insert({kv.first, std::make_pair(rf1.widen(rf2, slacks), width1)});
             }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index b4298ff77..c67afb380 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -299,8 +299,11 @@ region_stack_t region_stack_t::operator|(const region_stack_t& other) const {
             auto ptr_or_mapfd2 = ptr_or_mapfd_stack_cell2.first;
             int width1 = ptr_or_mapfd_stack_cell1.second;
             int width2 = ptr_or_mapfd_stack_cell2.second;
-            // this should be fixed in the future
-            int width_joined = std::min(width1, width2);
+            if (width1 != width2) {
+                // we only join pointers with the same width
+                continue;
+            }
+            int width_joined = width1;
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
                 auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);
@@ -340,8 +343,11 @@ region_stack_t region_stack_t::widen(const region_stack_t& other) const {
             auto ptr_or_mapfd2 = ptr_or_mapfd_cells2.first;
             int width1 = ptr_or_mapfd_cells1.second;
             int width2 = ptr_or_mapfd_cells2.second;
-            // this should be fixed in the future
-            int width_joined = std::min(width1, width2);
+            if (width1 != width2) {
+                // we only widen pointers with the same width
+                continue;
+            }
+            int width_joined = width1;
             if (std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd1) &&
                     std::holds_alternative<ptr_with_off_t>(ptr_or_mapfd2)) {
                 auto ptr_with_off1 = std::get<ptr_with_off_t>(ptr_or_mapfd1);

From 3a18d6693312fe9ca17d6498518ba60df85d825b Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 15:22:46 -0400
Subject: [PATCH 369/373] Refactoring in Assume function

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 6ff8f6724..3cf58474b 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -340,13 +340,8 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
                     // both packet pointers
                     m_offset(s, loc);
                 }
-                else if (is_stack_ptr(maybe_left_ptr) || is_ctx_ptr(maybe_left_ptr)) {
-                    // TODO: fix this if these scenarios do not occur
-                    CRAB_ERROR("Assume on stack/ctx pointers is not supported in inference domain");
-                }
                 else {
-                    CRAB_ERROR("Assume on shared pointers is not supported in inference domain");
-                    // other cases, not implemented yet
+                    // We do not currently support any assumptions on pointers other than packets
                 }
             }
         }
@@ -366,7 +361,7 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
         }
         if (is_mapfd_type(maybe_left_ptr)) {
             // left is a mapfd
-            // TODO: need to work with values
+            // Checks on mapfd values do not affect the program safety reasoning; revisit in future
         }
         else if (maybe_left_rf) {
             m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v}, cond.right, loc);

From 4b372aebe3a08fd3303447fed760765601ab7e76 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 17:19:48 -0400
Subject: [PATCH 370/373] Better printing for initial and in-instruction types

For now, extra annotations have not been added like stack locations
accessed, and types on the right-hand side;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp          |  7 +++
 src/crab/abstract_domain.hpp          |  3 ++
 src/crab/ebpf_domain.hpp              |  1 +
 src/crab/interval_domain.hpp          |  1 +
 src/crab/offset_domain.hpp            |  1 +
 src/crab/refinement.cpp               | 14 ++++--
 src/crab/refinement.hpp               |  2 +-
 src/crab/region_domain.hpp            |  1 +
 src/crab/register_utils.cpp           |  9 +++-
 src/crab/signed_interval_domain.hpp   |  1 +
 src/crab/symbol_factory.cpp           |  2 +-
 src/crab/type_inference.cpp           | 70 +++++++++++++++++++--------
 src/crab/type_inference.hpp           |  1 +
 src/crab/type_ostream.cpp             | 69 ++++++++++++++++----------
 src/crab/type_ostream.hpp             | 10 ++--
 src/crab/types.cpp                    | 10 ++--
 src/crab/unsigned_interval_domain.hpp |  1 +
 src/crab_verifier.cpp                 | 17 ++++---
 18 files changed, 151 insertions(+), 69 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index da9ba3baf..f8cd4d95f 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -122,6 +122,11 @@ void abstract_domain_t::abstract_domain_model<Domain>::print_stack(std::ostream&
     m_abs_val.print_stack(o);
 }
 
+template <typename Domain>
+void abstract_domain_t::abstract_domain_model<Domain>::print_state(std::ostream& o) const {
+    m_abs_val.print_state(o);
+}
+
 template <typename Domain>
 void abstract_domain_t::abstract_domain_model<Domain>::print_annotated_bb(std::ostream& o,
                                                                 const basic_block_t& bb) const {
@@ -317,6 +322,8 @@ void abstract_domain_t::print_ctx(std::ostream& o) const { m_concept->print_ctx(
 
 void abstract_domain_t::print_stack(std::ostream& o) const { m_concept->print_stack(o); }
 
+void abstract_domain_t::print_state(std::ostream& o) const { m_concept->print_state(o); }
+
 void abstract_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {
     m_concept->print_annotated_bb(o, bb);
 }
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index e690deee7..20da94645 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -58,6 +58,7 @@ class abstract_domain_t {
         virtual std::vector<std::string> get_errors() = 0;
         virtual void print_ctx(std::ostream&) const = 0;
         virtual void print_stack(std::ostream&) const = 0;
+        virtual void print_state(std::ostream&) const = 0;
         virtual void print_annotated_bb(std::ostream&, const basic_block_t& bb) const = 0;
     }; // end class abstract_domain_concept
 
@@ -101,6 +102,7 @@ class abstract_domain_t {
         std::vector<std::string> get_errors() override;
         void print_ctx(std::ostream&) const override;
         void print_stack(std::ostream&) const override;
+        void print_state(std::ostream&) const override;
         void print_annotated_bb(std::ostream&, const basic_block_t& bb) const override;
     }; // end class abstract_domain_model
 
@@ -148,6 +150,7 @@ class abstract_domain_t {
     std::vector<std::string> get_errors();
     void print_ctx(std::ostream&) const;
     void print_stack(std::ostream&) const;
+    void print_state(std::ostream&) const;
     void print_annotated_bb(std::ostream&, const basic_block_t& bb) const;
 
     friend std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 6d09ca025..1401efe9c 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -85,6 +85,7 @@ class ebpf_domain_t final {
     void write(std::ostream& o) const;
     void print_ctx(const std::ostream& o) const {}
     void print_stack(const std::ostream& o) const {}
+    void print_state(std::ostream& o) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
 
     void initialize_loop_counter(const label_t& label);
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index 6d00892ce..d6ba45e0f 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -174,6 +174,7 @@ class interval_domain_t final {
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void print_stack(std::ostream& o) const {};
+    void print_state(std::ostream& o) const {}
     void print_ctx(std::ostream& o) const {};
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() {
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index b4c8ec1c8..b2c5a969f 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -178,6 +178,7 @@ class offset_domain_t final {
     void adjust_bb_for_types(location_t);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {}
+    void print_state(std::ostream& o) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/refinement.cpp b/src/crab/refinement.cpp
index cc62de941..6fb3db70b 100644
--- a/src/crab/refinement.cpp
+++ b/src/crab/refinement.cpp
@@ -37,12 +37,18 @@ std::vector<symbol_t> refinement_t::get_all_slacks() const {
     return slacks;
 }
 
-void refinement_t::write(std::ostream& o, std::shared_ptr<slacks_t> slack_intervs) const {
+void refinement_t::write(std::ostream& o, std::shared_ptr<slacks_t> slack_intervs,
+                         bool is_signed) const {
     std::vector<symbol_t> slack_vars = get_all_slacks();
     bool has_extra_info = _contains_pkt_constraints || !slack_vars.empty();
-    if (has_extra_info) o << "{";
+    if (has_extra_info) o << "{ ";
     if (is_numeric_refinement()) {
-        o << "num<" << _value << ">";
+        if (is_signed) {
+            o << "snumber<" << _value << ">";
+        }
+        else {
+            o << "unumber<" << _value << ">";
+        }
     }
     else if (is_packet_refinement()) {
         o << "pkt<" << _value << ">";
@@ -67,7 +73,7 @@ void refinement_t::write(std::ostream& o, std::shared_ptr<slacks_t> slack_interv
         }
         i++;
     }
-    if (has_extra_info) o << "}";
+    if (has_extra_info) o << " }";
 }
 
 refinement_t refinement_t::operator+(interval_t i) const {
diff --git a/src/crab/refinement.hpp b/src/crab/refinement.hpp
index c64bd953d..eb40c4cee 100644
--- a/src/crab/refinement.hpp
+++ b/src/crab/refinement.hpp
@@ -45,7 +45,7 @@ class refinement_t {
     constraint_t assume_le(const refinement_t &other) const;
     constraint_t assume_gt(const refinement_t &other) const;
     bool check_eq(const refinement_t &other, std::shared_ptr<slacks_t>) const;
-    void write(std::ostream &o, std::shared_ptr<slacks_t>) const;
+    void write(std::ostream &o, std::shared_ptr<slacks_t>, bool) const;
     bool same_type(const refinement_t &other) const;
     std::pair<bool, bool> safe_access(const expression_t&, const expression_t&, bool,
                      std::shared_ptr<slacks_t>) const;
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index eed6e28f0..50194a5d3 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -194,6 +194,7 @@ class region_domain_t final {
     void adjust_bb_for_types(location_t);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {}
+    void print_state(std::ostream& o) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/register_utils.cpp b/src/crab/register_utils.cpp
index 5447ef45d..598773400 100644
--- a/src/crab/register_utils.cpp
+++ b/src/crab/register_utils.cpp
@@ -11,7 +11,12 @@ std::size_t register_t::hash() const {
 }
 
 std::ostream& operator<<(std::ostream& o, const register_t& p) {
-    o << "r" << (int)p;
+    if (p == register_t{R12_PKT_BEGIN}) {
+        o << "r_offset";
+    }
+    else {
+        o << "r" << (int)p;
+    }
     return o;
 }
 
@@ -20,7 +25,7 @@ bool location_t::operator==(const location_t& other) const {
 }
 
 void location_t::write(std::ostream& o) const {
-    o << m_line_num << " in " << m_bb_label << " ";
+    o << "line#" << m_line_num << " in " << m_bb_label << " ";
 }
 
 std::string location_t::to_string() const {
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 21c8b986b..06d279cc1 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -169,6 +169,7 @@ class signed_interval_domain_t final {
     void store_in_stack(const Mem&, uint64_t, int);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {};
+    void print_state(std::ostream& o) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end signed_interval_domain_t
 
diff --git a/src/crab/symbol_factory.cpp b/src/crab/symbol_factory.cpp
index 6d33594cf..6d5228a11 100644
--- a/src/crab/symbol_factory.cpp
+++ b/src/crab/symbol_factory.cpp
@@ -20,7 +20,7 @@ void symbol_t::write(std::ostream& o) const {
     //} else if (is_nu()) {
     //    o << "v";
     } else {
-        o << "a_" << ((uint64_t)_id-3);
+        o << "s_" << ((uint64_t)_id-3);
     }
 }
 
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 3cf58474b..d34dd10f9 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -124,13 +124,14 @@ string_invariant inference_domain_t::to_set() const {
             auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
-            elem << "stack";
+            //elem << "stack";
             if (rf) {
                 print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, rf->first,
-                                              m_slacks);
+                                              m_slacks, region_t::R_STACK);
             }
             else {
-                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, {}, m_slacks);
+                print_non_numeric_memory_cell(elem, k, k+width-1, ptr_or_mapfd, {}, m_slacks,
+                                              region_t::R_STACK);
             }
         }
         result.insert(elem.str());
@@ -142,18 +143,18 @@ string_invariant inference_domain_t::to_set() const {
         if (maybe_interval_cells_signed.has_value()) {
             std::stringstream elem;
             auto signed_interval_cells = maybe_interval_cells_signed.value();
-            elem << "stack";
+            //elem << "stack";
             print_numeric_memory_cell(elem, k, k+signed_interval_cells.second,
-                    signed_interval_cells.first, true, m_slacks);
+                    signed_interval_cells.first, true, m_slacks, region_t::R_STACK);
             result.insert(elem.str());
         }
         auto maybe_interval_cells_unsigned = m_interval.find_in_stack_unsigned(k);
         if (maybe_interval_cells_unsigned.has_value()) {
             std::stringstream elem;
             auto unsigned_interval_cells = maybe_interval_cells_unsigned.value();
-            elem << "stack";
+            //elem << "stack";
             print_numeric_memory_cell(elem, k, k+unsigned_interval_cells.second,
-                    unsigned_interval_cells.first, false, m_slacks);
+                    unsigned_interval_cells.first, false, m_slacks, region_t::R_STACK);
             result.insert(elem.str());
         }
     }
@@ -773,24 +774,53 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
     }
 }
 
+void inference_domain_t::print_state(std::ostream& o) const {
+    print_ctx(o);
+    for (uint8_t i = 0; i < NUM_REGISTERS; ++i) {
+        register_t r{i};
+        // we currently only call this function for entry point
+        location_t loc{label_t::entry, 0};
+        register_location_t r_loc{r, loc};
+        auto ptr_or_mapfd = m_region.find_ptr_or_mapfd_at_loc(r_loc);
+        auto pkt_offset = m_offset.find_refinement_at_loc(r_loc);
+        auto signed_interval = m_interval.find_signed_interval_at_loc(r_loc);
+        auto unsigned_interval = m_interval.find_unsigned_interval_at_loc(r_loc);
+        if (!ptr_or_mapfd && !pkt_offset && !signed_interval && !unsigned_interval) {
+            continue; // Skip registers that are not used
+        }
+        o << "\t";
+        if (ptr_or_mapfd) {
+            print_register(o, Reg{i}, ptr_or_mapfd, pkt_offset, {}, false, m_slacks);
+            o << ",\n";
+        }
+        else {
+            print_register(o, Reg{i}, {}, {}, signed_interval, true, m_slacks);
+            o << ",\n";
+            print_register(o, Reg{i}, {}, {}, unsigned_interval, false, m_slacks);
+            o << ",\n";
+        }
+    }
+}
+
 void inference_domain_t::print_ctx(std::ostream& o) const {
     const std::vector<uint64_t>& ctx_keys = m_region.get_ctx_keys();
-    o << "\tctx: {";
+    //o << "\tctx: {";
     for (auto const& k : ctx_keys) {
         auto dist = m_offset.find_in_ctx(k);
         if (dist) {
-            o << "\t\t";
-            print_non_numeric_memory_cell(o, k, k+3, packet_ptr_t{}, dist, m_slacks);
+            o << "\t";
+            print_non_numeric_memory_cell(o, k, k+3, packet_ptr_t{}, dist, m_slacks,
+                                          region_t::R_CTX);
             o << ",\n";
         }
     }
-    o << "\t}\n";
+    //o << "\t}\n";
 }
 
 void inference_domain_t::print_stack(std::ostream& o) const {
     const std::vector<uint64_t>& stack_keys_region = m_region.get_stack_keys();
     const std::vector<uint64_t>& stack_keys_interval = m_interval.get_stack_keys();
-    o << "\tstack: {\n";
+    //o << "\tstack: {\n";
     for (auto const& k : stack_keys_region) {
         auto maybe_ptr_or_mapfd_cells = m_region.find_in_stack(k);
         auto dist = m_offset.find_in_stack(k);
@@ -798,14 +828,14 @@ void inference_domain_t::print_stack(std::ostream& o) const {
             auto ptr_or_mapfd_cells = maybe_ptr_or_mapfd_cells.value();
             int width = ptr_or_mapfd_cells.second;
             auto ptr_or_mapfd = ptr_or_mapfd_cells.first;
-            o << "\t\t";
+            o << "\t";
             if (dist) {
                 print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd),
-                        std::optional<refinement_t>(dist->first), m_slacks);
+                        std::optional<refinement_t>(dist->first), m_slacks, region_t::R_STACK);
             }
             else {
                 print_non_numeric_memory_cell(o, k, k+width-1, std::move(ptr_or_mapfd), {},
-                        m_slacks);
+                        m_slacks, region_t::R_STACK);
             }
             o << ",\n";
         }
@@ -814,21 +844,21 @@ void inference_domain_t::print_stack(std::ostream& o) const {
         auto maybe_signed_interval_cells = m_interval.find_in_stack_signed(k);
         if (maybe_signed_interval_cells) {
             auto interval_cells = maybe_signed_interval_cells.value();
-            o << "\t\t";
+            o << "\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first, true, m_slacks);
+                    interval_cells.first, true, m_slacks, region_t::R_STACK);
             o << ",\n";
         }
         auto maybe_unsigned_interval_cells = m_interval.find_in_stack_unsigned(k);
         if (maybe_unsigned_interval_cells) {
             auto interval_cells = maybe_unsigned_interval_cells.value();
-            o << "\t\t";
+            o << "\t";
             print_numeric_memory_cell(o, k, k+interval_cells.second-1,
-                    interval_cells.first, false, m_slacks);
+                    interval_cells.first, false, m_slacks, region_t::R_STACK);
             o << ",\n";
         }
     }
-    o << "\t}\n";
+    //o << "\t}\n";
 }
 
 void inference_domain_t::adjust_bb_for_types(location_t loc) {
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 3c8431efc..6a3005ba3 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -113,6 +113,7 @@ class inference_domain_t final {
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void print_ctx(std::ostream&) const;
     void print_stack(std::ostream&) const;
+    void print_state(std::ostream&) const;
     void print_annotated_bb(std::ostream&, const basic_block_t&) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     std::optional<crab::refinement_t> find_refinement_at_loc(const crab::register_location_t&) const;
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index ef81c4b66..f28f5891c 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -3,61 +3,80 @@
 
 #include "crab/type_ostream.hpp"
 
+void print_region(std::ostream& o, crab::region_t region) {
+    if (region == crab::region_t::R_STACK) {
+        o << "stack";
+    }
+    else if (region == crab::region_t::R_CTX) {
+        o << "ctx";
+    }
+    else if (region == crab::region_t::R_PACKET) {
+        o << "packet";
+    }
+    else if (region == crab::region_t::R_SHARED) {
+        o << "shared";
+    }
+}
+
 void print_non_numeric_memory_cell(std::ostream& o, int start, int end,
-        const crab::ptr_or_mapfd_t& ptr, std::optional<crab::refinement_t> d,
-                                   std::shared_ptr<crab::slacks_t> slacks) {
+                                   const crab::ptr_or_mapfd_t& ptr,
+                                   std::optional<crab::refinement_t> d,
+                                   std::shared_ptr<crab::slacks_t> slacks,
+                                   crab::region_t region) {
+    print_region(o, region);
+    o << "[" << start << "-" << end << "] : ";
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
-        o << "[" << start << "-" << end << "] : " << std::get<crab::ptr_with_off_t>(ptr);
+        o << std::get<crab::ptr_with_off_t>(ptr);
     }
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
-            o << "[" << start << "-" << end << "] : ";
-            d->write(o, slacks);
+            d->write(o, slacks, false); // pkt pointers are not un/signed
         }
         else {
-            o << "[" << start << "-" << end << "] : " << std::get<crab::packet_ptr_t>(ptr);
+            o << std::get<crab::packet_ptr_t>(ptr);
         }
     }
     else {
-        o << "[" << start << "-" << end << "] : " << std::get<crab::mapfd_t>(ptr);
+        o << std::get<crab::mapfd_t>(ptr);
     }
 }
 
 void print_numeric_memory_cell(std::ostream& o, int start, int end, crab::refinement_t n,
-        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
+        bool is_signed, std::shared_ptr<crab::slacks_t> slacks, crab::region_t region) {
+    print_region(o, region);
     crab::interval_t i = n.get_interval_value(slacks);
+    o << "[" << start << "-" << end << "] : ";
     if (i.is_bottom()) {
-        o << "[" << start << "-" << end << "] : bottom";
+        o << "bottom";
         return;
     }
     if (i.is_top()) {
         if (is_signed) {
-            o << "[" << start << "-" << end << "] : snumber";
+            o << "snumber<-oo, +oo>";
         }
         else {
-            o << "[" << start << "-" << end << "] : unumber";
+            o << "unumber<-oo, +oo>";
         }
     }
     else {
-        // TODO: differentiate between signed and unsigned
-        o << "[" << start << "-" << end << "] : ";
-        n.write(o, slacks);
+        n.write(o, slacks, is_signed);
     }
 }
 
 void print_memory_cell(std::ostream& o, int start, int end,
-        const std::optional<crab::ptr_or_mapfd_t>& p, std::optional<crab::refinement_t> d
-        , std::optional<crab::refinement_t> signed_numeric,
-        std::optional<crab::refinement_t> unsigned_numeric,
-                       std::shared_ptr<crab::slacks_t> slacks) {
+                       std::optional<crab::ptr_or_mapfd_t> p,
+                       std::optional<crab::refinement_t> d,
+                       std::optional<crab::refinement_t> signed_numeric,
+                       std::optional<crab::refinement_t> unsigned_numeric,
+                       std::shared_ptr<crab::slacks_t> slacks, crab::region_t region) {
     if (signed_numeric) {
-        print_numeric_memory_cell(o, start, end, *signed_numeric, true, slacks);
+        print_numeric_memory_cell(o, start, end, *signed_numeric, true, slacks, region);
     }
     if (unsigned_numeric) {
-        print_numeric_memory_cell(o, start, end, *unsigned_numeric, false, slacks);
+        print_numeric_memory_cell(o, start, end, *unsigned_numeric, false, slacks, region);
     }
     else if (p) {
-        print_non_numeric_memory_cell(o, start, end, *p, d, slacks);
+        print_non_numeric_memory_cell(o, start, end, *p, d, slacks, region);
     }
 }
 
@@ -69,7 +88,7 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
     else if (std::holds_alternative<crab::packet_ptr_t>(ptr)) {
         if (d) {
             o << r << " : ";
-            d->write(o, slacks);
+            d->write(o, slacks, false); // pkt pointers are not un/signed
         }
         else {
             o << r << " : " << std::get<crab::packet_ptr_t>(ptr);
@@ -89,15 +108,15 @@ void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool i
     }
     if (i.is_top()) {
         if (is_signed) {
-            o << r << " : snumber";
+            o << r << " : snumber<-oo, +oo>";
         }
         else {
-            o << r << " : unumber";
+            o << r << " : unumber<-oo, +oo>";
         }
     }
     else {
         o << r << " : ";
-        n.write(o, slacks);
+        n.write(o, slacks, is_signed);
     }
 }
 
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index b7a5eae3d..079c37f80 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -8,17 +8,17 @@
 void print_numeric_register(std::ostream&, Reg, crab::refinement_t, bool, 
                             std::shared_ptr<crab::slacks_t>);
 void print_numeric_memory_cell(std::ostream&, int, int, crab::refinement_t, bool,
-                               std::shared_ptr<crab::slacks_t>);
+                               std::shared_ptr<crab::slacks_t>, crab::region_t);
 void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>);
 void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
-        std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>);
+        std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>, crab::region_t);
 void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
         const std::optional<crab::refinement_t>&, const std::optional<crab::refinement_t>&, bool,
                     std::shared_ptr<crab::slacks_t>);
-void print_memory_cell(std::ostream&, int, int, const std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>, std::optional<crab::refinement_t>,
-                       std::shared_ptr<crab::slacks_t>);
+void print_memory_cell(std::ostream&, int, int, std::optional<crab::ptr_or_mapfd_t>,
+                       std::optional<crab::refinement_t>, std::optional<crab::refinement_t>,
+                       std::shared_ptr<crab::slacks_t>, crab::region_t);
 
 // Print select transformers
 void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
diff --git a/src/crab/types.cpp b/src/crab/types.cpp
index 91344f4df..e81a9f9d7 100644
--- a/src/crab/types.cpp
+++ b/src/crab/types.cpp
@@ -8,13 +8,13 @@ namespace crab {
 inline std::string region_to_string(const region_t& r) noexcept {
     switch (r) {
         case region_t::R_CTX:
-            return "ctx_p";
+            return "ctx";
         case region_t::R_STACK:
-            return "stack_p";
+            return "stk";
         case region_t::R_SHARED:
-            return "shared_p";
+            return "shared";
         case region_t::R_PACKET:
-            return "packet_p";
+            return "pkt";
         default:
             __builtin_unreachable();
     }
@@ -130,7 +130,7 @@ std::ostream& operator<<(std::ostream& o, const ptr_with_off_t& p) {
 }
 
 std::ostream& operator<<(std::ostream& o, const packet_ptr_t& p) {
-    o << "packet_p";
+    o << "pkt";
     return o;
 }
 
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index cae693e06..b5d846f52 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -163,6 +163,7 @@ class unsigned_interval_domain_t final {
     void store_in_stack(const Mem&, uint64_t, int);
     void print_ctx(std::ostream& o) const {};
     void print_stack(std::ostream& o) const {};
+    void print_state(std::ostream& o) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end unsigned_interval_domain_t
 
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 2fb740a35..69a968f2b 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -100,7 +100,7 @@ static auto get_line_info(const InstructionSeq& insts) {
 }
 
 static void print_report(std::ostream& os, const checks_db& db, const InstructionSeq& prog,
-                         const bool print_line_info) {
+                         const bool print_line_info, bool print_label = true) {
     auto label_to_line_info = get_line_info(prog);
     os << "\n";
     for (auto [label, messages] : db.m_db) {
@@ -111,7 +111,10 @@ static void print_report(std::ostream& os, const checks_db& db, const Instructio
                     os << line_info->second;
                 }
             }
-            os << label << ": " << msg << "\n";
+            if (print_label) {
+                os << label << ": ";
+            }
+            os << msg << "\n";
         }
     }
     os << "\n";
@@ -130,8 +133,9 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::in
     if (thread_local_options.abstract_domain == abstract_domain_kind::INFERENCE_DOMAIN) {
         db = generate_report_inference_domain(cfg, post_invariants);
         if (thread_local_options.print_invariants) {
-            auto final_state = pre_invariants.at(label_t::exit);
-            final_state.print_ctx(std::cout); final_state.print_stack(std::cout);
+            auto entry_state = pre_invariants.at(label_t::entry);
+            // print the initial state
+            entry_state.print_state(std::cout);
             for (const label_t& label : cfg.sorted_labels()) {
                 post_invariants.at(label).print_annotated_bb(std::cout, cfg.get_node(label));
             }
@@ -272,7 +276,7 @@ ebpf_analyze_program_for_test(abstract_domain_kind domain, std::ostream& os, con
         cfg_t cfg = prepare_cfg(prog, info, options.simplify, false);
         auto [pre_invariants, post_invariants] = run_forward_analyzer(cfg, std::move(entry_inv));
         const checks_db report = get_analysis_report(std::cerr, cfg, pre_invariants, post_invariants);
-        print_report(os, report, prog, false);
+        print_report(os, report, prog, false, domain == abstract_domain_kind::EBPF_DOMAIN);
 
         auto pre_invariant_map = to_string_invariant_map(pre_invariants);
 
@@ -302,7 +306,8 @@ crab_results ebpf_verify_program(std::ostream& os, const InstructionSeq& prog, c
     crab_results results = get_ebpf_report(os, cfg, info, options, prog_opt);
     checks_db& report = results.db;
     if (options->print_failures) {
-        print_report(os, report, prog, options->print_line_info);
+        print_report(os, report, prog, options->print_line_info,
+                     options->abstract_domain == abstract_domain_kind::EBPF_DOMAIN);
     }
     if (stats) {
         stats->total_unreachable = report.total_unreachable;

From a7fba2aa53dc784fd8e3a0b39ce02eef0a75461e Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Thu, 26 Jun 2025 23:19:08 -0400
Subject: [PATCH 371/373] Better printing of types

For now, all important instructions can print relevant register
information, and each basic block prints initial types;
Call instruction needs to print the types of parameters;
Need to print stack content information as well;

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/abstract_domain.cpp          |   8 +-
 src/crab/abstract_domain.hpp          |   6 +-
 src/crab/ebpf_domain.hpp              |   2 +-
 src/crab/interval_domain.cpp          |  37 +++++-
 src/crab/interval_domain.hpp          |   2 +-
 src/crab/offset_domain.cpp            |  17 ++-
 src/crab/offset_domain.hpp            |   2 +-
 src/crab/region_domain.cpp            |   8 +-
 src/crab/region_domain.hpp            |   2 +-
 src/crab/register_utils.cpp           |   2 +-
 src/crab/signed_interval_domain.hpp   |   2 +-
 src/crab/type_inference.cpp           | 182 +++++++++++++++++---------
 src/crab/type_inference.hpp           |   2 +-
 src/crab/type_ostream.cpp             | 101 ++++++++++----
 src/crab/type_ostream.hpp             |  38 ++++--
 src/crab/unsigned_interval_domain.hpp |   2 +-
 src/crab_verifier.cpp                 |   7 +-
 17 files changed, 284 insertions(+), 136 deletions(-)

diff --git a/src/crab/abstract_domain.cpp b/src/crab/abstract_domain.cpp
index f8cd4d95f..3542ce9a8 100644
--- a/src/crab/abstract_domain.cpp
+++ b/src/crab/abstract_domain.cpp
@@ -123,8 +123,8 @@ void abstract_domain_t::abstract_domain_model<Domain>::print_stack(std::ostream&
 }
 
 template <typename Domain>
-void abstract_domain_t::abstract_domain_model<Domain>::print_state(std::ostream& o) const {
-    m_abs_val.print_state(o);
+void abstract_domain_t::abstract_domain_model<Domain>::print_state_init(std::ostream& o, label_t l) const {
+    m_abs_val.print_state_init(o, l);
 }
 
 template <typename Domain>
@@ -322,7 +322,9 @@ void abstract_domain_t::print_ctx(std::ostream& o) const { m_concept->print_ctx(
 
 void abstract_domain_t::print_stack(std::ostream& o) const { m_concept->print_stack(o); }
 
-void abstract_domain_t::print_state(std::ostream& o) const { m_concept->print_state(o); }
+void abstract_domain_t::print_state_init(std::ostream& o, label_t l) const {
+    m_concept->print_state_init(o, l);
+}
 
 void abstract_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {
     m_concept->print_annotated_bb(o, bb);
diff --git a/src/crab/abstract_domain.hpp b/src/crab/abstract_domain.hpp
index 20da94645..a3b9ee4b7 100644
--- a/src/crab/abstract_domain.hpp
+++ b/src/crab/abstract_domain.hpp
@@ -58,7 +58,7 @@ class abstract_domain_t {
         virtual std::vector<std::string> get_errors() = 0;
         virtual void print_ctx(std::ostream&) const = 0;
         virtual void print_stack(std::ostream&) const = 0;
-        virtual void print_state(std::ostream&) const = 0;
+        virtual void print_state_init(std::ostream&, label_t) const = 0;
         virtual void print_annotated_bb(std::ostream&, const basic_block_t& bb) const = 0;
     }; // end class abstract_domain_concept
 
@@ -102,7 +102,7 @@ class abstract_domain_t {
         std::vector<std::string> get_errors() override;
         void print_ctx(std::ostream&) const override;
         void print_stack(std::ostream&) const override;
-        void print_state(std::ostream&) const override;
+        void print_state_init(std::ostream&, label_t) const override;
         void print_annotated_bb(std::ostream&, const basic_block_t& bb) const override;
     }; // end class abstract_domain_model
 
@@ -150,7 +150,7 @@ class abstract_domain_t {
     std::vector<std::string> get_errors();
     void print_ctx(std::ostream&) const;
     void print_stack(std::ostream&) const;
-    void print_state(std::ostream&) const;
+    void print_state_init(std::ostream&, label_t) const;
     void print_annotated_bb(std::ostream&, const basic_block_t& bb) const;
 
     friend std::ostream& operator<<(std::ostream& o, const abstract_domain_t& dom);
diff --git a/src/crab/ebpf_domain.hpp b/src/crab/ebpf_domain.hpp
index 1401efe9c..0a67cc7f1 100644
--- a/src/crab/ebpf_domain.hpp
+++ b/src/crab/ebpf_domain.hpp
@@ -85,7 +85,7 @@ class ebpf_domain_t final {
     void write(std::ostream& o) const;
     void print_ctx(const std::ostream& o) const {}
     void print_stack(const std::ostream& o) const {}
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
 
     void initialize_loop_counter(const label_t& label);
diff --git a/src/crab/interval_domain.cpp b/src/crab/interval_domain.cpp
index 243c4f994..0a909a9a8 100644
--- a/src/crab/interval_domain.cpp
+++ b/src/crab/interval_domain.cpp
@@ -1331,15 +1331,21 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
         Value right, location_t loc) {
     using Op = Condition::Op;
 
-    auto left_signed = find_signed_interval_value(left)->get_interval_value(m_slacks);
-    auto left_unsigned = find_unsigned_interval_value(left)->get_interval_value(m_slacks);
+    auto left_signed_rf = find_signed_interval_value(left);
+    auto left_unsigned_rf = find_unsigned_interval_value(left);
+    auto left_signed = left_signed_rf->get_interval_value(m_slacks);
+    auto left_unsigned = left_unsigned_rf->get_interval_value(m_slacks);
     // TODO: Check if these intervals can be bottom
     auto right_signed = interval_t::bottom();
     auto right_unsigned = interval_t::bottom();
+    std::optional<refinement_t> right_signed_rf;
+    std::optional<refinement_t> right_unsigned_rf;
     if (std::holds_alternative<Reg>(right)) {
         auto right_reg = register_t{std::get<Reg>(right).v};
-        right_signed = find_signed_interval_value(right_reg)->get_interval_value(m_slacks);
-        right_unsigned = find_unsigned_interval_value(right_reg)->get_interval_value(m_slacks);
+        right_signed_rf = find_signed_interval_value(right_reg);
+        right_unsigned_rf = find_unsigned_interval_value(right_reg);
+        right_signed = right_signed_rf->get_interval_value(m_slacks);
+        right_unsigned = right_unsigned_rf->get_interval_value(m_slacks);
     } else if (std::holds_alternative<Imm>(right)) {
         auto right_imm = std::get<Imm>(right).v;
         right_signed = interval_t{number_t{right_imm}};
@@ -1384,6 +1390,29 @@ void interval_domain_t::assume_cst(Condition::Op op, bool is64, register_t left,
             break;
         }
     }
+    // This is done to keep the required refinement info at the location
+    // if no new refinement was inserted, we insert the old known refinement
+    register_location_t reg_left_loc{left, loc};
+    auto left_signed_value = find_signed_interval_at_loc(reg_left_loc);
+    auto left_unsigned_value = find_unsigned_interval_at_loc(reg_left_loc);
+    if (!left_signed_value) {
+        m_signed.insert_in_registers(left, loc, *left_signed_rf);
+    }
+    if (!left_unsigned_value) {
+        m_unsigned.insert_in_registers(left, loc, *left_unsigned_rf);
+    }
+    if (auto pright_reg = std::get_if<Reg>(&right)) {
+        register_t reg_right{pright_reg->v};
+        register_location_t reg_right_loc{reg_right, loc};
+        auto right_signed_v = find_signed_interval_at_loc(reg_right_loc);
+        auto right_unsigned_v = find_unsigned_interval_at_loc(reg_right_loc);
+        if (!right_signed_v) {
+            m_signed.insert_in_registers(reg_right, loc, *right_signed_rf);
+        }
+        if (!right_unsigned_v) {
+            m_unsigned.insert_in_registers(reg_right, loc, *right_unsigned_rf);
+        }
+    }
 }
 
 void interval_domain_t::operator()(const Assume& s, location_t loc) {
diff --git a/src/crab/interval_domain.hpp b/src/crab/interval_domain.hpp
index d6ba45e0f..e96601ea6 100644
--- a/src/crab/interval_domain.hpp
+++ b/src/crab/interval_domain.hpp
@@ -174,7 +174,7 @@ class interval_domain_t final {
     void remove_overlap_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void fill_values_in_stack(const std::vector<uint64_t>&, uint64_t, int);
     void print_stack(std::ostream& o) const {};
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_ctx(std::ostream& o) const {};
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() {
diff --git a/src/crab/offset_domain.cpp b/src/crab/offset_domain.cpp
index 246fc9422..f1a953f66 100644
--- a/src/crab/offset_domain.cpp
+++ b/src/crab/offset_domain.cpp
@@ -455,27 +455,32 @@ void offset_domain_t::operator()(const Assume &b, location_t loc) {
         if (!rf_left || !rf_right) {
             // this should not happen, comparison between a packet pointer and either
             // other region's pointers or numbers; possibly raise type error
-            m_errors.push_back("one of the pointers being compared isn't packet pointer");
+            m_errors.push_back(loc.to_string() + ": Both registers are not packet pointers.");
             return;
         }
-        auto begin = m_registers.find(register_t{R12_PKT_BEGIN});
+        register_t pkt_begin{R12_PKT_BEGIN};
+        auto begin = m_registers.find(pkt_begin);
         if (cond.op == Condition::Op::LE) {
             begin->add_constraint(rf_left->assume_le(*rf_right), m_slacks);
-            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
+            m_registers.insert(pkt_begin, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GT) {
             begin->add_constraint(rf_left->assume_gt(*rf_right), m_slacks);
-            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
+            m_registers.insert(pkt_begin, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::GE) {
             begin->add_constraint(rf_right->assume_le(*rf_left), m_slacks);
-            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
+            m_registers.insert(pkt_begin, loc, std::move(*begin));
         }
         else if (cond.op == Condition::Op::LT) {
             begin->add_constraint(rf_right->assume_gt(*rf_left), m_slacks);
-            m_registers.insert(register_t{R12_PKT_BEGIN}, loc, std::move(*begin));
+            m_registers.insert(pkt_begin, loc, std::move(*begin));
         }
         // other comparisons not supported
+
+        // To keep the info about the packet pointer, we store the types here again
+        m_registers.insert(register_t{cond.left.v}, loc, *rf_left);
+        m_registers.insert(register_t{right_reg}, loc, *rf_right);
     }
 }
 
diff --git a/src/crab/offset_domain.hpp b/src/crab/offset_domain.hpp
index b2c5a969f..2f43da6bd 100644
--- a/src/crab/offset_domain.hpp
+++ b/src/crab/offset_domain.hpp
@@ -178,7 +178,7 @@ class offset_domain_t final {
     void adjust_bb_for_types(location_t);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {}
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {}
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/region_domain.cpp b/src/crab/region_domain.cpp
index c67afb380..d538f7153 100644
--- a/src/crab/region_domain.cpp
+++ b/src/crab/region_domain.cpp
@@ -95,7 +95,7 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
     // the bb label, we can fix
     location_t loc = location_t::top();
 
-    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (m_cur_register_def[i] == nullptr || other.m_cur_register_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(register_t{i});
         auto maybe_ptr2 = other.find(register_t{i});
@@ -126,7 +126,7 @@ region_registers_t region_registers_t::operator|(const region_registers_t& other
 }
 
 bool region_registers_t::operator<=(const region_registers_t& other) const {
-    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         if (m_cur_register_def[i] == nullptr) return false;
         auto maybe_ptr1 = find(register_t{i});
@@ -164,7 +164,7 @@ region_registers_t region_registers_t::widen(const region_registers_t& other) co
     region_registers_t joined_reg_types;
 
     location_t loc = location_t::top();
-    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (other.m_cur_register_def[i] == nullptr) continue;
         auto maybe_ptr1 = find(register_t{i});
         auto maybe_ptr2 = other.find(register_t{i});
@@ -241,7 +241,7 @@ std::optional<ptr_or_mapfd_t> region_registers_t::find(register_t key) const {
 }
 
 void region_registers_t::adjust_bb_for_registers(location_t loc) {
-    for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
+    for (uint8_t i = 0; i < NUM_REGISTERS; i++) {
         if (auto it = find(register_t{i})) {
             insert(register_t{i}, loc, *it);
         }
diff --git a/src/crab/region_domain.hpp b/src/crab/region_domain.hpp
index 50194a5d3..8512b5f23 100644
--- a/src/crab/region_domain.hpp
+++ b/src/crab/region_domain.hpp
@@ -194,7 +194,7 @@ class region_domain_t final {
     void adjust_bb_for_types(location_t);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {}
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void reset_errors() { m_errors.clear(); }
diff --git a/src/crab/register_utils.cpp b/src/crab/register_utils.cpp
index 598773400..d5795c45b 100644
--- a/src/crab/register_utils.cpp
+++ b/src/crab/register_utils.cpp
@@ -25,7 +25,7 @@ bool location_t::operator==(const location_t& other) const {
 }
 
 void location_t::write(std::ostream& o) const {
-    o << "line#" << m_line_num << " in " << m_bb_label << " ";
+    o << "instr#" << m_line_num << " in " << m_bb_label << " ";
 }
 
 std::string location_t::to_string() const {
diff --git a/src/crab/signed_interval_domain.hpp b/src/crab/signed_interval_domain.hpp
index 06d279cc1..f240454b7 100644
--- a/src/crab/signed_interval_domain.hpp
+++ b/src/crab/signed_interval_domain.hpp
@@ -169,7 +169,7 @@ class signed_interval_domain_t final {
     void store_in_stack(const Mem&, uint64_t, int);
     void print_ctx(std::ostream& o) const {}
     void print_stack(std::ostream& o) const {};
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end signed_interval_domain_t
 
diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index d34dd10f9..50b8b8095 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -93,27 +93,18 @@ string_invariant inference_domain_t::to_set() const {
     if (is_top()) return string_invariant::top();
     std::set<std::string> result;
     for (uint8_t i = 0; i < NUM_REGISTERS-2; i++) {
-        auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(register_t{i});
-        auto maybe_rf = m_offset.find_refinement_info(register_t{i});
-        if (maybe_ptr_or_mapfd.has_value()) {
-            std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, {}, false, m_slacks);
-            result.insert(elem.str());
-        }
-        auto maybe_signed_interval = m_interval.find_signed_interval_value(register_t{i});
-        if (maybe_signed_interval.has_value()) {
-            std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_signed_interval, true,
-                           m_slacks);
-            result.insert(elem.str());
-        }
-        auto maybe_unsigned_interval = m_interval.find_unsigned_interval_value(register_t{i});
-        if (maybe_unsigned_interval.has_value()) {
+        /*
+        register_t reg{i};
+        auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(reg);
+        auto maybe_rf = m_offset.find_refinement_info(reg);
+        auto maybe_signed = m_interval.find_signed_interval_value(reg);
+        auto maybe_unsigned = m_interval.find_unsigned_interval_value(reg);
             std::stringstream elem;
-            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf,
-                    maybe_unsigned_interval, false, m_slacks);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_signed, true, m_slacks);
+            print_register(elem, Reg{i}, maybe_ptr_or_mapfd, maybe_rf, maybe_unsigned, false, m_slacks);
             result.insert(elem.str());
         }
+        */
     }
    const std::vector<uint64_t>& stack_keys_region = m_region.get_stack_keys();
     for (auto const& k : stack_keys_region) {
@@ -323,23 +314,29 @@ static inline bool same_type(const std::optional<ptr_or_mapfd_t>& ptr_or_mapfd1,
 
 void inference_domain_t::operator()(const Assume& s, location_t loc) {
     Condition cond = s.cond;
-    const auto maybe_left_ptr = m_region.find_ptr_or_mapfd_type(cond.left.v);
-    const auto maybe_left_rf = m_interval.find_interval_value(cond.left.v);
+    register_t left_reg{cond.left.v};
+    const auto maybe_left_ptr = m_region.find_ptr_or_mapfd_type(left_reg);
+    const auto maybe_left_rf = m_interval.find_interval_value(left_reg);
     assert(!maybe_left_ptr.has_value() || !maybe_left_rf.has_value());
     if (const auto pright_reg = std::get_if<Reg>(&cond.right)) {
-        const auto maybe_right_ptr = m_region.find_ptr_or_mapfd_type(pright_reg->v);
-        const auto maybe_right_rf = m_interval.find_interval_value(pright_reg->v);
+        register_t right_reg{pright_reg->v};
+        const auto maybe_right_ptr = m_region.find_ptr_or_mapfd_type(right_reg);
+        const auto maybe_right_rf = m_interval.find_interval_value(right_reg);
         assert(!maybe_right_ptr.has_value() || !maybe_right_rf.has_value());
         if (same_type(maybe_left_ptr, maybe_right_ptr, maybe_left_rf, maybe_right_rf)) {
             if (maybe_left_rf) {
                 // both numbers
-                m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v},
-                        cond.right, loc);
+                m_interval.assume_cst(cond.op, cond.is64, left_reg, cond.right, loc);
             }
             else if (maybe_left_ptr) {
                 if (is_packet_ptr(maybe_left_ptr)) {
                     // both packet pointers
                     m_offset(s, loc);
+                    register_t begin_reg{R12_PKT_BEGIN};
+                    // We keep relevant information at the instruction location
+                    m_region.insert_in_registers(begin_reg, loc, packet_ptr_t{});
+                    m_region.insert_in_registers(left_reg, loc, packet_ptr_t{});
+                    m_region.insert_in_registers(right_reg, loc, packet_ptr_t{});
                 }
                 else {
                     // We do not currently support any assumptions on pointers other than packets
@@ -358,14 +355,14 @@ void inference_domain_t::operator()(const Assume& s, location_t loc) {
             // left is a shared pointer
             const int64_t imm = gsl::narrow_cast<int64_t>(std::get<Imm>(cond.right).v);
             auto shared_ptr = std::get<ptr_with_off_t>(*maybe_left_ptr);
-            m_region.assume_cst(cond.op, shared_ptr, imm, cond.left.v, loc);
+            m_region.assume_cst(cond.op, shared_ptr, imm, left_reg, loc);
         }
         if (is_mapfd_type(maybe_left_ptr)) {
             // left is a mapfd
             // Checks on mapfd values do not affect the program safety reasoning; revisit in future
         }
         else if (maybe_left_rf) {
-            m_interval.assume_cst(cond.op, cond.is64, register_t{cond.left.v}, cond.right, loc);
+            m_interval.assume_cst(cond.op, cond.is64, left_reg, cond.right, loc);
         }
     }
 }
@@ -735,15 +732,31 @@ void inference_domain_t::operator()(const Bin& bin, location_t loc) {
     m_offset.do_bin(bin, dst_signed_rf, src_signed_rf, loc);
 }
 
-void inference_domain_t::do_load(const Mem& b, const Reg& target_reg,
+void inference_domain_t::do_load(const Mem& b, const Reg& target,
         std::optional<ptr_or_mapfd_t> basereg_opt, location_t loc) {
-    bool loaded_in_region = m_region.do_load(b, register_t{target_reg.v}, loc);
-    bool ptrs_in_range = m_offset.do_load(b, register_t{target_reg.v}, basereg_opt, loc);
-    m_interval.do_load(b, register_t{target_reg.v}, basereg_opt, loaded_in_region, ptrs_in_range,
-                       loc);
+    register_t target_reg{target.v};
+    register_t basereg{b.access.basereg.v};
+    bool loaded_in_region = m_region.do_load(b, target_reg, loc);
+    bool ptrs_in_range = m_offset.do_load(b, target_reg, basereg_opt, loc);
+    m_interval.do_load(b, target_reg, basereg_opt, loaded_in_region, ptrs_in_range, loc);
+    if (target_reg != basereg) {
+        // this is done to keep relevant basereg info at the loc
+        m_region.insert_in_registers(basereg, loc, *basereg_opt);
+        if (is_packet_ptr(basereg_opt)) {
+            const auto offset_info = m_offset.find_refinement_info(basereg);
+            m_offset.insert_in_registers(basereg, loc, *offset_info);
+        }
+    }
 }
 
 void inference_domain_t::do_mem_store(const Mem& b, std::optional<ptr_or_mapfd_t>& basereg_opt, location_t loc) {
+    register_t basereg{b.access.basereg.v};
+    // this is done to keep relevant basereg info at the loc
+    m_region.insert_in_registers(basereg, loc, *basereg_opt);
+    if (is_packet_ptr(basereg_opt)) {
+        const auto offset_info = m_offset.find_refinement_info(basereg);
+        m_offset.insert_in_registers(basereg, loc, *offset_info);
+    }
     m_region.do_mem_store(b, loc);
     m_interval.do_mem_store(b, basereg_opt);
     m_offset.do_mem_store(b, basereg_opt);
@@ -774,12 +787,11 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
     }
 }
 
-void inference_domain_t::print_state(std::ostream& o) const {
-    print_ctx(o);
+void inference_domain_t::print_state_init(std::ostream& o, label_t label) const {
+    location_t loc{label, 0};
     for (uint8_t i = 0; i < NUM_REGISTERS; ++i) {
         register_t r{i};
         // we currently only call this function for entry point
-        location_t loc{label_t::entry, 0};
         register_location_t r_loc{r, loc};
         auto ptr_or_mapfd = m_region.find_ptr_or_mapfd_at_loc(r_loc);
         auto pkt_offset = m_offset.find_refinement_at_loc(r_loc);
@@ -795,7 +807,7 @@ void inference_domain_t::print_state(std::ostream& o) const {
         }
         else {
             print_register(o, Reg{i}, {}, {}, signed_interval, true, m_slacks);
-            o << ",\n";
+            o << ",\n\t";
             print_register(o, Reg{i}, {}, {}, unsigned_interval, false, m_slacks);
             o << ",\n";
         }
@@ -869,7 +881,6 @@ void inference_domain_t::adjust_bb_for_types(location_t loc) {
 
 void inference_domain_t::operator()(const basic_block_t& bb) {
 
-    // A temporary fix to avoid printing errors for multiple basic blocks
     m_errors.clear();
     m_region.reset_errors();
     m_offset.reset_errors();
@@ -1168,60 +1179,103 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
 
     o << bb.label() << ":\n";
     uint32_t curr_pos = 0;
-    // TODO: add support for printing unsigned intervals as well
     for (const Instruction& statement : bb) {
         ++curr_pos;
         crab::location_t loc{bb.label(), curr_pos};
         o << "   " << curr_pos << ".";
-        // TODO: print unsigned intervals in a proper way
-        if (std::holds_alternative<Call>(statement)) {
+        if (const auto call = std::get_if<Call>(&statement)) {
             auto r0_reg = crab::register_location_t(register_t{R0_RETURN_VALUE}, loc);
             auto region = find_ptr_or_mapfd_at_loc(r0_reg);
             auto rf = find_refinement_at_loc(r0_reg);
             auto signed_interval = find_signed_interval_at_loc(r0_reg);
-            print_annotated(o, std::get<Call>(statement), region, rf, signed_interval, true,
-                            m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(r0_reg);
-            //print_annotated(o, std::get<Call>(statement), region, unsigned_interval, false,
-            //                            m_slacks);
+            print_annotated(o, *call, region, rf, signed_interval, unsigned_interval, m_slacks);
         }
-        else if (std::holds_alternative<Bin>(statement)) {
-            auto b = std::get<Bin>(statement);
-            auto register_location = crab::register_location_t(b.dst.v, loc);
+        else if (const auto bin = std::get_if<Bin>(&statement)) {
+            auto register_location = crab::register_location_t(bin->dst.v, loc);
             auto region = find_ptr_or_mapfd_at_loc(register_location);
             auto rf = find_refinement_at_loc(register_location);
             auto signed_interval = find_signed_interval_at_loc(register_location);
-            print_annotated(o, b, region, rf, signed_interval, true, m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(register_location);
-            //print_annotated(o, b, region, rf, unsigned_interval, false, m_slacks);
+            print_annotated(o, *bin, region, rf, signed_interval, unsigned_interval, m_slacks);
         }
-        else if (std::holds_alternative<Mem>(statement)) {
-            auto u = std::get<Mem>(statement);
-            if (u.is_load) {
-                auto target_reg = std::get<Reg>(u.value);
+        else if (const auto mem = std::get_if<Mem>(&statement)) {
+            if (mem->is_load) {
+                auto target_reg = std::get<Reg>(mem->value);
                 auto target_reg_loc = crab::register_location_t(target_reg.v, loc);
                 auto region = find_ptr_or_mapfd_at_loc(target_reg_loc);
                 auto rf = find_refinement_at_loc(target_reg_loc);
                 auto signed_interval = find_signed_interval_at_loc(target_reg_loc);
-                print_annotated(o, u, region, rf, signed_interval, true, m_slacks);
                 auto unsigned_interval = find_unsigned_interval_at_loc(target_reg_loc);
-                //print_annotated(o, u, region, rf, unsigned_interval, false, m_slacks);
+                print_annotated(o, *mem, region, rf, signed_interval, unsigned_interval, m_slacks);
+            }
+            else print_instr(o, *mem);
+            register_t basereg{mem->access.basereg.v};
+            if (!mem->is_load || register_t{std::get<Reg>(mem->value).v} != basereg) { 
+                // this avoids printing the basereg for loads, when base register is the same as
+                // the target register, as old value has been lost
+                auto basereg_loc = crab::register_location_t(basereg, loc);
+                auto maybe_ptr_or_mapfd = find_ptr_or_mapfd_at_loc(basereg_loc);
+                o << "\t\t\t";
+                print_register(o, mem->access.basereg, maybe_ptr_or_mapfd, {}, {}, false, m_slacks);
+                o << "\n";
             }
-            else print_instr(o, u);
         }
-        else if (std::holds_alternative<LoadMapFd>(statement)) {
-            auto u = std::get<LoadMapFd>(statement);
-            auto reg = crab::register_location_t(u.dst.v, loc);
+        else if (const auto loadmapfd = std::get_if<LoadMapFd>(&statement)) {
+            auto reg = crab::register_location_t(loadmapfd->dst.v, loc);
             auto region = find_ptr_or_mapfd_at_loc(reg);
-            print_annotated(o, u, region);
+            print_annotated(o, *loadmapfd, region);
         }
-        else if (std::holds_alternative<Un>(statement)) {
-            auto u = std::get<Un>(statement);
-            auto reg = crab::register_location_t(u.dst.v, loc);
+        else if (const auto un = std::get_if<Un>(&statement)) {
+            auto reg = crab::register_location_t(un->dst.v, loc);
             auto signed_interval = find_signed_interval_at_loc(reg);
-            print_annotated(o, u, signed_interval, true, m_slacks);
             auto unsigned_interval = find_unsigned_interval_at_loc(reg);
-            print_annotated(o, u, unsigned_interval, false, m_slacks);
+            print_annotated(o, *un, signed_interval, unsigned_interval, m_slacks);
+        }
+        else if (const auto assume = std::get_if<Assume>(&statement)) {
+            // print the actual assume instruction
+            print_instr(o, *assume);
+            Condition cond = assume->cond;
+            // print the left register type info
+            register_location_t left_loc{register_t{cond.left.v}, loc};
+            auto maybe_left_ptr = m_region.find_ptr_or_mapfd_at_loc(left_loc);
+            auto maybe_left_signed = m_interval.find_signed_interval_at_loc(left_loc);
+            auto maybe_left_unsigned = m_interval.find_unsigned_interval_at_loc(left_loc);
+            auto maybe_left_offset = m_offset.find_refinement_at_loc(left_loc);
+            o << "\t\t\t";
+            print_register(o, cond.left, maybe_left_ptr, maybe_left_offset, maybe_left_signed, true, m_slacks);
+            o << "\n";
+            if (maybe_left_unsigned) {
+                // If the left register has an unsigned value, print it as well
+                o << "\t\t\t";
+                print_register(o, cond.left, {}, {}, maybe_left_unsigned, false, m_slacks);
+                o << "\n";
+            }
+            if (const auto right_reg = std::get_if<Reg>(&cond.right)) {
+                // print the right register type info
+                register_location_t right_loc{right_reg->v, loc};
+                const auto maybe_right_ptr = m_region.find_ptr_or_mapfd_at_loc(right_loc);
+                const auto maybe_right_signed = m_interval.find_signed_interval_at_loc(right_loc);
+                const auto maybe_right_unsigned = m_interval.find_unsigned_interval_at_loc(right_loc);
+                const auto maybe_right_offset = m_offset.find_refinement_at_loc(right_loc);
+                o << "\t\t\t";
+                print_register(o, *right_reg, maybe_right_ptr, maybe_right_offset, maybe_right_signed, true, m_slacks);
+                o << "\n";
+                if (maybe_right_unsigned) {
+                    // If the right register has an unsigned value, print it as well
+                    o << "\t\t\t";
+                    print_register(o, *right_reg, {}, {}, maybe_right_unsigned, false, m_slacks);
+                    o << "\n";
+                }
+            }
+            if (maybe_left_offset) {
+                // If the left register is a packet pointer, print the begin pointer as well
+                o << "\t\t\t";
+                register_location_t begin_ptr_reg{register_t{R12_PKT_BEGIN}, loc};
+                auto begin_ptr = m_offset.find_refinement_at_loc(begin_ptr_reg);
+                print_register(o, Reg{R12_PKT_BEGIN}, packet_ptr_t{}, begin_ptr, {}, false, m_slacks);
+                o << "\n";
+            }
         }
         else print_instr(o, statement);
     }
diff --git a/src/crab/type_inference.hpp b/src/crab/type_inference.hpp
index 6a3005ba3..aca7c4ad0 100644
--- a/src/crab/type_inference.hpp
+++ b/src/crab/type_inference.hpp
@@ -113,7 +113,7 @@ class inference_domain_t final {
     [[nodiscard]] std::vector<std::string>& get_errors() { return m_errors; }
     void print_ctx(std::ostream&) const;
     void print_stack(std::ostream&) const;
-    void print_state(std::ostream&) const;
+    void print_state_init(std::ostream&, label_t) const;
     void print_annotated_bb(std::ostream&, const basic_block_t&) const;
     std::optional<crab::ptr_or_mapfd_t> find_ptr_or_mapfd_at_loc(const crab::register_location_t&) const;
     std::optional<crab::refinement_t> find_refinement_at_loc(const crab::register_location_t&) const;
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index f28f5891c..32ef20c3c 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -80,7 +80,7 @@ void print_memory_cell(std::ostream& o, int start, int end,
     }
 }
 
-void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd_t& ptr,
+void print_non_numeric_register(std::ostream& o, crab::register_t r, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t> d, std::shared_ptr<crab::slacks_t> slacks) {
     if (std::holds_alternative<crab::ptr_with_off_t>(ptr)) {
         o << r << " : " << std::get<crab::ptr_with_off_t>(ptr);
@@ -99,7 +99,7 @@ void print_non_numeric_register(std::ostream& o, Reg r, const crab::ptr_or_mapfd
     }
 }
 
-void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool is_signed,
+void print_numeric_register(std::ostream& o, crab::register_t r, crab::refinement_t n, bool is_signed,
         std::shared_ptr<crab::slacks_t> slacks) {
     crab::interval_t i = n.get_interval_value(slacks);
     if (i.is_bottom()) {
@@ -120,49 +120,85 @@ void print_numeric_register(std::ostream& o, Reg r, crab::refinement_t n, bool i
     }
 }
 
-void print_register(std::ostream& o, Reg r, const std::optional<crab::ptr_or_mapfd_t>& p,
-        const std::optional<crab::refinement_t>& d, const std::optional<crab::refinement_t>& numeric,
-        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
-    if (numeric) print_numeric_register(o, r, *numeric, is_signed, slacks);
-    else if (p) print_non_numeric_register(o, r, *p, d, slacks);
-    else o << r << " : unknown";
+void print_register(std::ostream& o, Reg r,
+                    std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
+                    std::optional<crab::refinement_t> offset,
+                    std::optional<crab::refinement_t> numeric,
+                    bool is_signed,
+                    std::shared_ptr<crab::slacks_t> slacks) {
+    crab::register_t reg(r.v);
+    if (ptr_or_mapfd) {
+        print_non_numeric_register(o, reg, *ptr_or_mapfd, offset, slacks);
+    }
+    else if (numeric) {
+        print_numeric_register(o, reg, *numeric, is_signed, slacks);
+    }
+    else {
+        o << reg << " : unknown";
+    }
 }
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
-void print_annotated(std::ostream& o, const Call& call, std::optional<crab::ptr_or_mapfd_t>& p,
-                     std::optional<crab::refinement_t>& d,
-                     std::optional<crab::refinement_t>& n, bool is_signed,
+void print_annotated(std::ostream& o, const Call& call,
+                     std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
+                     std::optional<crab::refinement_t> offset,
+                     std::optional<crab::refinement_t> signed_numeric,
+                     std::optional<crab::refinement_t> unsigned_numeric,
                      std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, Reg{(uint8_t)R0_RETURN_VALUE}, p, d, n, is_signed, slacks);
-    o << " = " << call.name << ":" << call.func << "(...)\n";
+    Reg r0 = Reg{R0_RETURN_VALUE};
+    print_register(o, r0, ptr_or_mapfd, offset, signed_numeric, true, slacks);
+    o << " = " << call.name << ":" << call.func << "(...)";
+    if (unsigned_numeric) {
+        o << "\n\t\t\t";
+        print_register(o, r0, {}, {}, unsigned_numeric, false, slacks);
+    }
+    o << "\n";
 }
 
-void print_annotated(std::ostream& o, const Bin& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n,
-        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
+void print_annotated(std::ostream& o, const Bin& b,
+                     std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
+                     std::optional<crab::refinement_t> offset,
+                     std::optional<crab::refinement_t> signed_numeric,
+                     std::optional<crab::refinement_t> unsigned_numeric,
+                     std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, b.dst, p, d, n, is_signed, slacks);
-    o << " " << b.op << "= " << b.v << "\n";
+    print_register(o, b.dst, ptr_or_mapfd, offset, signed_numeric, true, slacks);
+    o << " " << b.op << "= " << b.v;
+    if (unsigned_numeric) {
+        o << "\n\t\t\t";
+        print_register(o, b.dst, {}, {}, unsigned_numeric, false, slacks);
+    }
+    o << "\n";
 }
 
-void print_annotated(std::ostream& o, const LoadMapFd& u, std::optional<crab::ptr_or_mapfd_t>& p) {
+void print_annotated(std::ostream& o, const LoadMapFd& u,
+                     std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd) {
     o << "  ";
-    print_register(o, u.dst, p, std::nullopt, std::nullopt, false, nullptr);
+    print_register(o, u.dst, ptr_or_mapfd, {}, {}, false, nullptr);
     o << " = map_fd " << u.mapfd << "\n";
 }
 
-void print_annotated(std::ostream& o, const Mem& b, std::optional<crab::ptr_or_mapfd_t>& p,
-        std::optional<crab::refinement_t>& d, std::optional<crab::refinement_t>& n, bool is_signed,
+void print_annotated(std::ostream& o, const Mem& b,
+                     std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
+                     std::optional<crab::refinement_t> offset,
+                     std::optional<crab::refinement_t> signed_numeric,
+                     std::optional<crab::refinement_t> unsigned_numeric,
                      std::shared_ptr<crab::slacks_t> slacks) {
+    // This is load operation
     o << "  ";
-    print_register(o, std::get<Reg>(b.value), p, d, n, is_signed, slacks);
+    print_register(o, std::get<Reg>(b.value), ptr_or_mapfd, offset, signed_numeric, true, slacks);
     o << " = ";
     std::string sign = b.access.offset < 0 ? " - " : " + ";
-    int offset = std::abs(b.access.offset);
+    int offset_int = std::abs(b.access.offset);
     o << "*(" << size_(b.access.width) << " *)";
-    o << "(" << b.access.basereg << sign << offset << ")\n";
+    o << "(" << b.access.basereg << sign << offset_int << ")";
+    if (unsigned_numeric) {
+        o << "\n\t\t\t";
+        print_register(o, std::get<Reg>(b.value), {}, {}, unsigned_numeric, false, slacks);
+    }
+    o << "\n";
 }
 
 std::string op(Un::Op op) {
@@ -186,11 +222,18 @@ std::string op(Un::Op op) {
     }
 }
 
-void print_annotated(std::ostream& o, const Un& b, std::optional<crab::refinement_t>& n,
-        bool is_signed, std::shared_ptr<crab::slacks_t> slacks) {
+void print_annotated(std::ostream& o, const Un& b,
+                     std::optional<crab::refinement_t> signed_numeric,
+                     std::optional<crab::refinement_t> unsigned_numeric,
+                     std::shared_ptr<crab::slacks_t> slacks) {
     o << "  ";
-    print_register(o, b.dst, std::nullopt, std::nullopt, n, is_signed, slacks);
-    o << " = " << op(b.op) << " " << b.dst << "\n";
+    print_register(o, b.dst, {}, {}, signed_numeric, true, slacks);
+    o << " = " << op(b.op) << " " << b.dst;
+    if (unsigned_numeric) {
+        o << "\n\t\t\t";
+        print_register(o, b.dst, {}, {}, unsigned_numeric, false, slacks);
+    }
+    o << "\n";
 }
 
 void print_bb(std::ostream& o, const basic_block_t& bb) {
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index 079c37f80..f631ef55c 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -5,33 +5,47 @@
 
 #include "crab/offset_domain.hpp"
 
-void print_numeric_register(std::ostream&, Reg, crab::refinement_t, bool, 
+void print_numeric_register(std::ostream&, crab::register_t, crab::refinement_t, bool, 
                             std::shared_ptr<crab::slacks_t>);
 void print_numeric_memory_cell(std::ostream&, int, int, crab::refinement_t, bool,
                                std::shared_ptr<crab::slacks_t>, crab::region_t);
-void print_non_numeric_register(std::ostream&, Reg, const crab::ptr_or_mapfd_t& ptr,
+void print_non_numeric_register(std::ostream&, crab::register_t, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>);
 void print_non_numeric_memory_cell(std::ostream&, int, int, const crab::ptr_or_mapfd_t& ptr,
         std::optional<crab::refinement_t>, std::shared_ptr<crab::slacks_t>, crab::region_t);
-void print_register(std::ostream&, Reg, const std::optional<crab::ptr_or_mapfd_t>&,
-        const std::optional<crab::refinement_t>&, const std::optional<crab::refinement_t>&, bool,
+void print_register(std::ostream&, Reg, std::optional<crab::ptr_or_mapfd_t>,
+                    std::optional<crab::refinement_t>,
+                    std::optional<crab::refinement_t>,
+                    bool,
                     std::shared_ptr<crab::slacks_t>);
 void print_memory_cell(std::ostream&, int, int, std::optional<crab::ptr_or_mapfd_t>,
                        std::optional<crab::refinement_t>, std::optional<crab::refinement_t>,
                        std::shared_ptr<crab::slacks_t>, crab::region_t);
 
 // Print select transformers
-void print_annotated(std::ostream&, const Call&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+void print_annotated(std::ostream&, const Call&,
+                     std::optional<crab::ptr_or_mapfd_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
                      std::shared_ptr<crab::slacks_t>);
-void print_annotated(std::ostream&, const Bin&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+void print_annotated(std::ostream&, const Bin&,
+                     std::optional<crab::ptr_or_mapfd_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
                      std::shared_ptr<crab::slacks_t>);
-void print_annotated(std::ostream&, const LoadMapFd&, std::optional<crab::ptr_or_mapfd_t>&);
-void print_annotated(std::ostream&, const Mem&, std::optional<crab::ptr_or_mapfd_t>&,
-        std::optional<crab::refinement_t>&, std::optional<crab::refinement_t>&, bool,
+void print_annotated(std::ostream&, const LoadMapFd&,
+                     std::optional<crab::ptr_or_mapfd_t>);
+void print_annotated(std::ostream&, const Mem&,
+                     std::optional<crab::ptr_or_mapfd_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
                      std::shared_ptr<crab::slacks_t>);
-void print_annotated(std::ostream&, const Un&, std::optional<crab::refinement_t>&, bool,
+void print_annotated(std::ostream&, const Un&,
+                     std::optional<crab::refinement_t>,
+                     std::optional<crab::refinement_t>,
                      std::shared_ptr<crab::slacks_t>);
 void print_bb(std::ostream&, const basic_block_t&);
 void print_instr(std::ostream&, const Instruction&);
diff --git a/src/crab/unsigned_interval_domain.hpp b/src/crab/unsigned_interval_domain.hpp
index b5d846f52..4124b2e37 100644
--- a/src/crab/unsigned_interval_domain.hpp
+++ b/src/crab/unsigned_interval_domain.hpp
@@ -163,7 +163,7 @@ class unsigned_interval_domain_t final {
     void store_in_stack(const Mem&, uint64_t, int);
     void print_ctx(std::ostream& o) const {};
     void print_stack(std::ostream& o) const {};
-    void print_state(std::ostream& o) const {}
+    void print_state_init(std::ostream& o, label_t) const {}
     void print_annotated_bb(std::ostream& o, const basic_block_t& bb) const {};
 }; // end unsigned_interval_domain_t
 
diff --git a/src/crab_verifier.cpp b/src/crab_verifier.cpp
index 69a968f2b..93fd5148b 100644
--- a/src/crab_verifier.cpp
+++ b/src/crab_verifier.cpp
@@ -134,10 +134,11 @@ static checks_db get_analysis_report(std::ostream& s, cfg_t& cfg, const crab::in
         db = generate_report_inference_domain(cfg, post_invariants);
         if (thread_local_options.print_invariants) {
             auto entry_state = pre_invariants.at(label_t::entry);
-            // print the initial state
-            entry_state.print_state(std::cout);
+            entry_state.print_ctx(s);
             for (const label_t& label : cfg.sorted_labels()) {
-                post_invariants.at(label).print_annotated_bb(std::cout, cfg.get_node(label));
+                const auto& post_inv = post_invariants.at(label);
+                post_inv.print_state_init(s, label);
+                post_inv.print_annotated_bb(s, cfg.get_node(label));
             }
         }
     }

From 50390420fa63af71c1b76246cc53badb262699ed Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 27 Jun 2025 00:56:07 -0400
Subject: [PATCH 372/373] Added proper printing for Call instruction
 annotations

This only prints the register types for arguments and return value

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 91 ++++++++++++++++++++++++++++++++++---
 src/crab/type_ostream.cpp   | 17 -------
 src/crab/type_ostream.hpp   |  6 ---
 3 files changed, 85 insertions(+), 29 deletions(-)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 50b8b8095..7785ba1df 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -243,6 +243,46 @@ void inference_domain_t::operator()(const Call& u, location_t loc) {
 
     if (is_bottom()) return;
     std::string loc_str = loc.to_string();
+
+    // Hack: keep relevant information about the call at the previous instruction line,
+    // because calls clear the arguments;
+    // this works because the call always has at least one instruction before it
+    // Revisit in the future
+    auto previous_line_num = loc.m_line_num - 1;
+    auto bb_label = loc.m_bb_label;
+    location_t previous_loc{bb_label, previous_line_num};
+    for (uint8_t r = 1; r <= 5; r++) {
+        auto single = std::ranges::find_if(u.singles, [r](ArgSingle arg) {
+            return arg.reg.v == r;
+        });
+        auto pair = std::ranges::find_if(u.pairs, [r](ArgPair arg) {
+            return arg.mem.v == r;
+        });
+        if (single == u.singles.end() && pair == u.pairs.end()) {
+            // If the register is not used, skip it
+            continue;
+        }
+        register_t reg{r};
+        auto maybe_ptr_or_mapfd = m_region.find_ptr_or_mapfd_type(reg);
+        auto maybe_offset = m_offset.find_refinement_info(reg);
+        auto maybe_signed_interval = m_interval.find_signed_interval_value(reg);
+        auto maybe_unsigned_interval = m_interval.find_unsigned_interval_value(reg);
+        if (maybe_ptr_or_mapfd) {
+            m_region.insert_in_registers(reg, previous_loc, *maybe_ptr_or_mapfd);
+            if (is_packet_ptr(maybe_ptr_or_mapfd)) {
+                m_offset.insert_in_registers(reg, previous_loc, *maybe_offset);
+            }
+        }
+        if (maybe_signed_interval) {
+            m_interval.insert_in_registers_signed(reg, previous_loc,
+                    *maybe_signed_interval);
+        }
+        if (maybe_unsigned_interval) {
+            m_interval.insert_in_registers_unsigned(reg, previous_loc,
+                    *maybe_unsigned_interval);
+        }
+    }
+
     stack_cells_t stack_values;
     for (ArgPair param : u.pairs) {
         if (param.kind == ArgPair::Kind::PTR_TO_WRITABLE_MEM) {
@@ -1184,12 +1224,51 @@ void inference_domain_t::print_annotated_bb(std::ostream& o, const basic_block_t
         crab::location_t loc{bb.label(), curr_pos};
         o << "   " << curr_pos << ".";
         if (const auto call = std::get_if<Call>(&statement)) {
-            auto r0_reg = crab::register_location_t(register_t{R0_RETURN_VALUE}, loc);
-            auto region = find_ptr_or_mapfd_at_loc(r0_reg);
-            auto rf = find_refinement_at_loc(r0_reg);
-            auto signed_interval = find_signed_interval_at_loc(r0_reg);
-            auto unsigned_interval = find_unsigned_interval_at_loc(r0_reg);
-            print_annotated(o, *call, region, rf, signed_interval, unsigned_interval, m_slacks);
+            // We kept some relevant type information, but at the previous position
+            crab::location_t prev_loc{bb.label(), curr_pos - 1};
+            register_t r0{R0_RETURN_VALUE};
+            auto r0_loc = crab::register_location_t{r0, loc};
+            auto ptr_or_mapfd = find_ptr_or_mapfd_at_loc(r0_loc);
+            auto offset = find_refinement_at_loc(r0_loc);
+            auto signed_numeric = find_signed_interval_at_loc(r0_loc);
+            auto unsigned_numeric = find_unsigned_interval_at_loc(r0_loc);
+            o << "  ";
+            print_register(o, Reg{R0_RETURN_VALUE}, ptr_or_mapfd, offset, signed_numeric, true,
+                           m_slacks);
+            o << " = " << call->name << ":" << call->func << "(\n";
+            for (uint8_t r = 1; r <= 5; r++) {
+                auto single = std::ranges::find_if(call->singles, [r](ArgSingle arg) {
+                    return arg.reg.v == r;
+                });
+                auto pair = std::ranges::find_if(call->pairs, [r](ArgPair arg) {
+                    return arg.mem.v == r;
+                });
+                if (single == call->singles.end() && pair == call->pairs.end()) {
+                    // If the register is not used, skip it
+                    continue;
+                }
+                register_t r_reg{r};
+                auto r_loc = crab::register_location_t{r_reg, prev_loc};
+                auto maybe_ptr_or_mapfd = find_ptr_or_mapfd_at_loc(r_loc);
+                auto maybe_offset = find_refinement_at_loc(r_loc);
+                auto maybe_signed_interval = find_signed_interval_at_loc(r_loc);
+                auto maybe_unsigned_interval = find_unsigned_interval_at_loc(r_loc);
+                o << "\t\t\t\t\t\t\t";
+                print_register(o, Reg{r}, maybe_ptr_or_mapfd, maybe_offset,
+                               maybe_signed_interval, true, m_slacks);
+                if (maybe_unsigned_interval) {
+                    o << ",\n\t\t\t\t\t\t\t";
+                    print_register(o, Reg{r}, {}, {}, maybe_unsigned_interval, false, m_slacks);
+                }
+                if (r < 5) o << ",";
+                o << "\n";
+            }
+            o << "\t\t\t)";
+            if (unsigned_numeric) {
+                o << "\n\t\t\t";
+                print_register(o, Reg{R0_RETURN_VALUE}, {}, {}, unsigned_numeric, false, m_slacks);
+            }
+            o << "\n";
         }
         else if (const auto bin = std::get_if<Bin>(&statement)) {
             auto register_location = crab::register_location_t(bin->dst.v, loc);
diff --git a/src/crab/type_ostream.cpp b/src/crab/type_ostream.cpp
index 32ef20c3c..1ca758965 100644
--- a/src/crab/type_ostream.cpp
+++ b/src/crab/type_ostream.cpp
@@ -140,23 +140,6 @@ void print_register(std::ostream& o, Reg r,
 
 inline std::string size_(int w) { return std::string("u") + std::to_string(w * 8); }
 
-void print_annotated(std::ostream& o, const Call& call,
-                     std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
-                     std::optional<crab::refinement_t> offset,
-                     std::optional<crab::refinement_t> signed_numeric,
-                     std::optional<crab::refinement_t> unsigned_numeric,
-                     std::shared_ptr<crab::slacks_t> slacks) {
-    o << "  ";
-    Reg r0 = Reg{R0_RETURN_VALUE};
-    print_register(o, r0, ptr_or_mapfd, offset, signed_numeric, true, slacks);
-    o << " = " << call.name << ":" << call.func << "(...)";
-    if (unsigned_numeric) {
-        o << "\n\t\t\t";
-        print_register(o, r0, {}, {}, unsigned_numeric, false, slacks);
-    }
-    o << "\n";
-}
-
 void print_annotated(std::ostream& o, const Bin& b,
                      std::optional<crab::ptr_or_mapfd_t> ptr_or_mapfd,
                      std::optional<crab::refinement_t> offset,
diff --git a/src/crab/type_ostream.hpp b/src/crab/type_ostream.hpp
index f631ef55c..8b4ed48c6 100644
--- a/src/crab/type_ostream.hpp
+++ b/src/crab/type_ostream.hpp
@@ -23,12 +23,6 @@ void print_memory_cell(std::ostream&, int, int, std::optional<crab::ptr_or_mapfd
                        std::shared_ptr<crab::slacks_t>, crab::region_t);
 
 // Print select transformers
-void print_annotated(std::ostream&, const Call&,
-                     std::optional<crab::ptr_or_mapfd_t>,
-                     std::optional<crab::refinement_t>,
-                     std::optional<crab::refinement_t>,
-                     std::optional<crab::refinement_t>,
-                     std::shared_ptr<crab::slacks_t>);
 void print_annotated(std::ostream&, const Bin&,
                      std::optional<crab::ptr_or_mapfd_t>,
                      std::optional<crab::refinement_t>,

From ef5fe119fda3f49db840fd07ca628c91074a21f5 Mon Sep 17 00:00:00 2001
From: Ameer Hamza <ah18r@fsu.edu>
Date: Fri, 27 Jun 2025 19:56:21 -0400
Subject: [PATCH 373/373] Small print change

Signed-off-by: Ameer Hamza <ah18r@fsu.edu>
---
 src/crab/type_inference.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/crab/type_inference.cpp b/src/crab/type_inference.cpp
index 7785ba1df..7dde5bdca 100644
--- a/src/crab/type_inference.cpp
+++ b/src/crab/type_inference.cpp
@@ -828,6 +828,7 @@ void inference_domain_t::operator()(const Mem& b, location_t loc) {
 }
 
 void inference_domain_t::print_state_init(std::ostream& o, label_t label) const {
+    o << "\n";
     location_t loc{label, 0};
     for (uint8_t i = 0; i < NUM_REGISTERS; ++i) {
         register_t r{i};