A Practical Construction for Decomposing Numerical Abstract Domains Gagandeep Singh Markus PΓΌschel Martin Vechev Department of Computer Science 1
Numerical abstract domains ( π π β ππ β ) Cost and Numerical Domain Representable Constraints Β±π¦ π β€ π Expressivity Β±π¦ π β€ π ππ (π¦ π β€ π¦ π ) Interval Β±π¦ π β€ π ππ (π¦ π β π¦ π β€ π ) Pentagon Β±π¦ π β€ π ππ (Β±π¦ π Β± π¦ π β€ π ) Zones π π π¦ π + π π π¦ π β€ π , π π β β€ Octagon π 1 π¦ 1 + π 2 π¦ 2 + β―+ π π π¦ π β€ π , π π β β€ TVPI Polyhedra Static analysis with precise numerical domains is expensive 2
Domain transformers // abstract program state: { βπ¦ 1 β π¦ 2 β€ 0, βπ¦ 2 β€ 0, βπ¦ 3 β π¦ 4 β€ 0 } Octagon // program statement : If ( π¦ 2 + π¦ 3 + π¦ 4 β€ 1) Best, Trivial, Standard, { βπ¦ 1 β π¦ 2 β€ 0, βπ¦ 2 β€ { βπ¦ 1 β π¦ 2 β€ 0, βπ¦ 2 β€ Exponential Constant Quadratic 0, βπ¦ 3 β π¦ 4 β€ 0 , π¦ 2 β€ 0, βπ¦ 3 β π¦ 4 β€ 0 , π¦ 3 + {} 1, π¦ 3 + π¦ 4 β€ 1, βπ¦ 1 β€ 1 } π¦ 4 β€ 1 } Best abstract transformers for even less precise domains are expensive 3
Online decomposition Octagon π ββ² β π β ββ² Numerical domain analysis can be made faster through online decomposition { βπ¦ 1 β π¦ 2 β€ 0 , { βπ¦ 1 β π¦ 2 β€ 0 , { π¦ 1 , π¦ 2 } { π¦ 1 , π¦ 2 } βπ¦ 2 β€ 0 } βπ¦ 2 β€ 0 } If( π¦ 2 + π¦ 3 + π¦ 4 β€ 1) { βπ¦ 3 β π¦ 4 β€ 0 , { βπ¦ 3 β π¦ 4 β€ 0 } { π¦ 3 , π¦ 4 } { π¦ 3 , π¦ 4 } π¦ 3 + π¦ 4 β€ 1 } Decomposing standard Octagon analysis ([PLDI 2015]) β’ Decomposing standard Polyhedra analysis ([SAS 2003, POPL2017]) β’ 4
Limitations of prior work Numerical abstract domains and their transformers β’ ad hoc design β’ guided by cost precision tradeoff β’ tailored for specific use cases β’ Drawback: Prior work cannot be reused for new domain transformers Required: Universal construction for decomposing numerical domains 5
Contributions Decomposed Our decomposed analysis Original β’ Significantly fast 32 vars Abstract β’ Always sound 3 vars element + Black box β’ Monotonic Under practical Transformer construction 28 vars β’ Precise conditions 80 vars 17 vars Complete end-to-end implementation Benchmark: >30K LOC, >550 vars β’ Polyhedra Analysis Poly Oct Zones β’ Octagon Original 6142 s 28 s 3 s β’ Zones Decomposed 4.4 s 1.9 s 1.5 s elina.ethz.ch 6
Requirements on numerical abstract domains β’ An abstract element β in domain π is conjunction of finite number of β’ The concretization function πΏ for π should be meet preserving representable constraints πΏ ( β β© π¦ ) = πΏ(β) β© πΏ ( π¦ ) β β ββ² βΊ πΏ(β) β πΏ(ββ²) β’ The ordering of abstract elements in the domain satisfies: 7
Partitioning variable set Octagon partition π β partition ΰ΄€ π β β β Finest unique A permissible An invalid { βπ¦ 1 β π¦ 2 β€ 0 } { π¦ 1 , π¦ 2 } { βπ¦ 1 β π¦ 2 β€ 0 } { π¦ 1 , π¦ 2 } { π¦ 1 , π¦ 3 } partition { π¦ 3 β€ 0 } { π¦ 3 } { π¦ 3 β€ 0 , π¦ 4 β€ 0 } { π¦ 3 , π¦ 4 } { π¦ 2 } { π¦ 4 β€ 0 } { π¦ 4 } { π¦ 4 } Expensive to maintain finest partitions thus online decomposition β’ maintains permissible partitions 8
Decomposable transformers { π¦ 1 + π¦ 2 β€ 0} { π¦ 1 , π¦ 2 } Polyhedra { π¦ 3 + π¦ 4 β€ 5} { π¦ 3 , π¦ 4 } //abstract program state: //program statement: If ( π¦ 5 + π¦ 6 β€ 0) π ββ²β² ΰ΄€ ββ²β² Decomposable Non-decomposable ββ² { π¦ 1 , π¦ 2 } { π¦ 1 + π¦ 2 + π¦ 3 + π¦ 4 + π¦ 5 + π¦ 6 β€ 5 } { π¦ 1 + π¦ 2 β€ 0 } π ββ² { π¦ 1 , π¦ 2 , π¦ 3 , π¦ 4 , π¦ 5 , π¦ 6 } ΰ΄€ { π¦ 3 + π¦ 4 β€ 5 } { π¦ 3 , π¦ 4 } { π¦ 5 + π¦ 6 β€ 0 } { π¦ 5 , π¦ 6 } 9
Decomposable transformers Decomposed Non-decomposed Black box transformer transformer construction Design from scratch Conditional β’ Assignment β’ β’ Meet Join β’ β’ Widening 10
Conditional Transformer Definition: Let β be an abstract element in domain π with the associated Polyhedra permissible partition ΰ΄€ π β and Ο π π π¦ π β€ π be the conditional statement then, β¬ ππππ : ={ π¦ π βΆ π π β 0 } β¬ ππππ := β π΄ π β©β¬ ππππ β β π΄ π , π΄ π β ΰ΄€ π β β π β ΰ΄€ β { π¦ 1 , π¦ 2 , π¦ 3 } { 2π¦ 1 β π¦ 2 + 4π¦ 3 β€ 0 } β¬ ππππ β If( π¦ 3 + π¦ 6 β€ 0) { π¦ 1 , π¦ 2 , π¦ 3 , π¦ 6 } { 2π¦ 4 + 3π¦ 5 β€ 5 } { π¦ 4 , π¦ 5 } β¬ ππππ ={ π¦ 3 , π¦ 6 } { π¦ 6 } { π¦ 6 = 1 } 11
Conditional Transformer β π := π β := π ππππ β β¬ ππππ β β(π΄ β β¬ ππππ ) π β β Octagon ππππ π β π β {π΄ π β ΰ΄€ ΰ΄€ π β :π΄ π ββ¬ ππππ = β }β{β¬ ππππ } β β β π β ΰ΄€ π β π ΰ΄€ π β π ππππ If( π¦ 3 β€ 0) { π¦ 1 } { π¦ 1 β€ 0 } { π¦ 1 } { π¦ 1 β€ 0 } β¬ ππππ ={ π¦ 2 , π¦ 3 } β { π¦ 2 + π¦ 3 β€ 0 } { π¦ 2 , π¦ 3 } { π¦ 2 + π¦ 3 β€ 0, { π¦ 2 , π¦ 3 } π¦ 3 β€ 0 } 12
Conditional Transformer Theorem: πΏ(π ππππ β ) = πΏ(π β ) if for any associated permissible π Octagon ππππ partition ΰ΄€ π β , the output π ππππ (β) satisfies: π ππππ β = βββ β² ββ β²β² where ββ² is a set of non-redundant constraints between the variables from β¬ ππππ only and β β²β² is a set of redundant β β’ constraints between the variables in π΄ πΏ(π ππππ β β¬ ππππ ) = πΏ(β(β¬ ππππ )βββ²) β β β π β ΰ΄€ π ππππ β ββ² β’ If( π¦ 3 β€ 0) { π¦ 1 } { π¦ 1 β€ 0 } {π¦ 3 β€ 0} { π¦ 1 β€ 0, π¦ 2 + π¦ 3 β€ 0, π¦ 1 + β¬ ππππ ={ π¦ 2 , π¦ 3 } ββ²β² β { π¦ 2 , π¦ 3 } { π¦ 2 + π¦ 3 β€ 0 } π¦ 3 β€ 0, π¦ 3 β€ 0 } {π¦ 1 + π¦ 3 β€ 0} πΏ(π ππππ β β¬ ππππ ) = πΏ(β(β¬ ππππ )βββ²) = πΏ ({ π¦ 2 + π¦ 3 β€ 0, π¦ 3 β€ 0 }) β β 13
Refinement β’ The output partition can be refined after computing the output β’ non-invertible assignment β’ join β’ Allows us to produce finer output partitions than prior work for β’ Polyhedra β’ Octagon 14
Experimental Evaluation β’ Crab-llvm analyzer β’ intra procedural analysis β’ analyzes llvm bitcode β’ Software verification competition benchmarks β’ linux device drivers β’ control flow β’ Polyhedra β’ n on decomposed transformers from PPL and decomposed from [POPLβ17] β’ Octagon β’ n on decomposed and decomposed transformers from [PLDIβ15] β’ Zones β’ Implemented non decomposed transformers 15
Polyhedra Benchmark PPL POPLβ17 POPLβ18 Speedup vs (s) (s) (s) PPL POPLβ17 β net_fddi_skfp 6142 9.2 4.4 1386 2 mtd_ubi MO 4 1.9 2.1 β usb_core_main0 4003 65 29 136 2.2 tty_synclinkmp MO 3.4 2.5 1.4 scsi_advansys TO 4 3.4 >4183 1.2 staging_vt6656 TO 2 0.5 >28800 4 net_ppp 10530 924 891 11.8 1 β p10_l00 121 11 5.4 22.4 2 β MO 11 2.9 3.8 p16_l40 β p12_l57 MO 14 6.5 2.1 β p13_l53 MO 54 25 2.2 16 p19_l59 MO 70 12 5.9
Octagon Benchmark PLDIβ15 PLDIβ15 POPLβ18 Speedup vs ND(s) D(s) (s) ND D net_fddi_skfp 28 2.6 1.9 15 1.4 mtd_ubi 3411 979 532 6.4 1.8 usb_core_main0 107 6.1 4.9 22 1.2 tty_synclinkmp 8.2 1 0.8 10 1.2 scsi_advansys 9.3 1.5 0.8 12 1.9 staging_vt6656 4.8 0.3 0.2 24 1.5 net_ppp 11 1.1 1.2 9.2 0.9 p10_l00 20 0.5 0.5 40 1 8.8 0.6 0.5 18 1.2 p16_l40 p12_l57 19 1.2 0.7 27 1.7 p13_l53 43 1.7 1.3 33 1.3 17 p19_l59 41 2.8 1.2 31 2.2
Zones Benchmark Non Decomposed POPLβ18 Speedup (s) (s) net_fddi_skfp 3 1.5 2 mtd_ubi 1.4 0.7 2 usb_core_main0 10.3 4.6 2.2 tty_synclinkmp 1.1 0.7 1.6 scsi_advansys 0.9 0.7 1.3 staging_vt6656 0.5 0.2 2.5 net_ppp 1.1 0.7 1.5 p10_l00 1.9 0.4 4.6 p16_l40 1.7 0.7 2.5 p12_l57 3.5 0.9 3.9 8.7 2.1 4.2 p13_l53 p19_l59 9.8 1.6 6.1 18
Complete end-to-end implementation Benchmark: >30K LOC, >550 vars β’ Polyhedra Analysis Poly Oct Zones β’ Octagon Original 6142 s 28 s 3 s β’ Zones Decomposed 4.4 s 1.9 s 1.5 s elina.ethz.ch 19
Recommend
More recommend
