CPALockator Thread-Modular Approach with Transition Abstraction for - - PowerPoint PPT Presentation

▶

Aug 17, 2022 343 likes •603 views

CPALockator Thread-Modular Approach with Transition Abstraction for Analysis of Multithreaded Software Pavel Andrianov, andrianov@ispras.ru Motivation Linux module drivers/net/irda/w83977af_ir.ko: 10 000 LOC static void

SLIDE 1

Thread-Modular Approach with Transition Abstraction for Analysis of Multithreaded Software

Pavel Andrianov, andrianov@ispras.ru

CPALockator

SLIDE 2

Motivation

Linux module drivers/net/irda/w83977af_ir.ko: 10 000 LOC

static void w83977af_change_speed(struct w83977af_ir *self , __u32 speed ){ ... self->io.speed = speed; ... }

SMACK: memory limit CBMC: time limit Yogar-CBMC: segmentation fault Mu-Cseq: –, UNKNOWN CPALockator: 15 sec

static void w83977af_hard_xmit(struct sk_buff *skb , struct net_device *dev){ ... speed = irda_get_next_speed(skb); tmp_speed = self->io.speed; assert(self->io.speed == tmp_speed); if ((speed != self->io.speed) && ...) { … } }

SLIDE 3

The goals of a new theory

Scaling on a real software Small amount of false alarms Flexible balance between speed and precision

SLIDE 4

Thread-Modular Approach

Environment || || || … Thread || , … , Environment Thread || Thread Thread Thread || Thread

SLIDE 5

Partial states

a1 b1 c1 Thread1 ... ... a2 b2 c2 Thread2 ... ...

Interleavings

a1 a2 b1 a2 a1 b2 c1 a2 b1 b2 ... ... ... Environment Environment

SLIDE 6

Environment actions based on inference objects

Thread1 ... ... Thread2 ... ... ... Environment

SLIDE 7

Environment actions based on abstract transitions

Thread1 ... ... Thread2 ... ... ... Environment

SLIDE 8

Abstract transitions

Abstract state Operation over the state (abstract edge) x → 2 y = x

SLIDE 9

Abstract transitions

x → 2 y = x x → 2 y → 2 [x > 0]

Transfer relation

SLIDE 10

Environment computation

Thread1 Thread 1 as environment Thread2 x → 2 Normal transition y = x x → 2 y = 2 Projected transition y → 0 [y > 0] Normal transition y → 0 y = 2 Applied transition

SLIDE 11

Extension of the theory

SLIDE 12

Transfer Relation of ThreadModularCPA

SLIDE 13

Optimized Transfer Relation

SLIDE 14

Experiments

ThreadModularCPA ARGCPA CompositeCPA LocationCPA CallstackCPA LockCPA ThreadCPA PredicateCPA

16 tasks x {true, false} = 32 benchmarks Limits: 15 min, 8 Gb

SLIDE 15

Results

Approach Theory with inference objects Theory with abstract transitions False verdicts Correct 10 12 Incorrect 2 2 True verdicts 12 11 Unknowns 8 7 Time(s) 10200 9820

SLIDE 16

Refinement of environment formula encoding

tmp = 2 g = * [g == 0] tmp < 10 int f() { int tmp = 2; g = 1; if (g != 0) { g++; } if (tmp < 10) { ERROR(); } } Imprecise formula tmp = 2 g = 1 [g == 0] tmp < 10 Precise formula [ tmp == 2 ] [ g != 0 ] Interpolants tmp = 2; g = 1; [ g == 0 ] [ tmp < 10 ] ERROR(); Error Path

SLIDE 17

Results

Approach Base refinement Imprecise+Precise combination False verdicts Correct 12 12 Incorrect 2 2 True verdicts 11 11 Unknowns 7 7 Time(s) 9820 9790

SLIDE 18

Refinement with iterative proactive effects application

int f() { int tmp = 2; g = 1; if (g != 0) { g++; } if (tmp < 10) { ERROR(); } } tmp = 2 g = 1 [g == 0] tmp < 10 Precise formula [ g != 0 ] Interpolants tmp = 2 g = 1 [g == 0] tmp < 10 Precise formula with effects [ tmp == 2 ] g = * tmp = 2; g = 1; [ g == 0 ] [ tmp < 10 ] ERROR(); Error Path

SLIDE 19

Results

Approach Base version Proactive refinement False verdicts Correct 12 15 Incorrect 2 2 True verdicts 11 12 Unknowns 7 3 Time(s) 9820 7780

SLIDE 20

Predicate Abstract edge (effect)

Statement g = g + 1 g = g + 1 convert to PathFormula [g6 = g5 + 1] Projected Edge: Origin Edge: Applied Edge:

SLIDE 21

Predicate Abstract edge (effect)

Boolean formula Statement g = g + 1 [g3 = g2 + 1] g = g + 1 convert to PathFormula Change SSA indices [g6 = g5 + 1] Projected Edge: Origin Edge: Applied Edge: [g6 = g5 + 1]

SLIDE 22

Instantiating of formulas

Boolean formula g = g + 1 [g3 = g2 + 1] Origin edge project g5 = 2 Thread state apply SSA indices update g2 ➝ g5 g3 ➝ g6 g5 = 2 ∧ g6 = g5 + 1 apply

SLIDE 23

Results

Approach Base version Formula effects False verdicts Correct 12 13 Incorrect 2 2 True verdicts 11 12 Unknowns 7 5 Time(s) 9820 6600

SLIDE 24

Results

Approach Base version Proactive refinement + Formula effects False verdicts Correct 12 16 Incorrect 2 2 True verdicts 11 13 Unknowns 7 2 Time(s) 9820 3950

SLIDE 25

Adjustable block encoding

[ p == 0] y2 = p2 [p == 1] y2 = p2 p3 = y2 + 1 [ p == 0] y2 = p2 [p == 1] p3 = y2 + 1 [ y == 0] y2 = p2 g = * ... p3 = * ... [true] ABE SBE