Feature Consistency in Compile-TimeConfigurable System Software - - PowerPoint PPT Presentation

▶
feature consistency in compile time configurable system
SMART_READER_LITE
LIVE PREVIEW

Feature Consistency in Compile-TimeConfigurable System Software - - PowerPoint PPT Presentation

Jan 26, 2023 214 likes •597 views

Feature Consistency in Compile-TimeConfigurable System Software Facing the Linux 10000 Feature Problem Reinhard Tartler , Daniel Lohmann, Julio Sincero, Wolfgang Schr oder-Preikschat System Software Group Friedrich-Alexander University

slide-1
SLIDE 1

Feature Consistency in Compile-Time–Configurable System Software

Facing the Linux 10000 Feature Problem Reinhard Tartler, Daniel Lohmann, Julio Sincero, Wolfgang Schr¨

  • der-Preikschat

System Software Group Friedrich-Alexander University Erlangen-Nuremberg

September 7, 2011

supported by

slide-2
SLIDE 2

Configuration Complexity Linux has become incredibly configurable

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 2 – 16

slide-3
SLIDE 3

Configuration Complexity Linux has become incredibly configurable Complexity increases considerably

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 2 – 16

slide-4
SLIDE 4

Configuration Complexity Linux has become incredibly configurable Complexity increases considerably

Source of bugs!

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 2 – 16

slide-5
SLIDE 5

Configuration Complexity Linux has become incredibly configurable Complexity increases considerably

Source of bugs! Linux v3.0 contains: 7.702 Features 893 Kconfig files 31.281 Source files 88.897 #ifdef blocks

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 2 – 16

slide-6
SLIDE 6

The Problem

Configuration Implementation

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 3 – 16

slide-7
SLIDE 7

The Problem

Configuration Implementation

Source of Inconsistencies!

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 3 – 16

slide-8
SLIDE 8

Finding Bugs with Tools for Static Analysis Bugs in declaration and implementation Excellent tool support for static analysis:

Coccinelle: Faults in Linux: Ten Years Later (ASPLOS’11) Dingo: Taming Device Drivers (EuroSys’09) KLEE: Automatic generation of high-coverage tests (EuroSys’08) RWset: Attacking path explosion (TACAS’08) EXE: Automatically generating inputs of death (CCS’06) ...

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 4 – 16

slide-9
SLIDE 9

Finding Bugs with Tools for Static Analysis Bugs in declaration and implementation Excellent tool support for static analysis:

Coccinelle: Faults in Linux: Ten Years Later (ASPLOS’11) Dingo: Taming Device Drivers (EuroSys’09) KLEE: Automatic generation of high-coverage tests (EuroSys’08) RWset: Attacking path explosion (TACAS’08) EXE: Automatically generating inputs of death (CCS’06) ...

Each of them check a single configuration:

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 4 – 16

slide-10
SLIDE 10

Symbolic Inconsistency

config HOTPLUG_CPU bool "Support for hot -pluggable CPUs" depends

  • n SMP &&

HOTPLUG

  • --help ---
  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 5 – 16

slide-11
SLIDE 11

Symbolic Inconsistency

config HOTPLUG_CPU bool "Support for hot -pluggable CPUs" depends

  • n SMP &&

HOTPLUG

  • --help ---

static int hotplug_cfd (struct notifier_block *nfb , unsigned long action , void *hcpu) { // [...] switch (action) { case CPU_UP_PREPARE : case CPU_UP_PREPARE_FROZEN : // [...] #ifdef CONFIG_CPU_HOTPLUG case CPU_UP_CANCELED : case CPU_UP_CANCELED_FROZEN : case CPU_DEAD: case CPU_DEAD_FROZEN : free_cpumask_var (cfd ->cpumask ); break; #endif }; return NOTIFY_OK;

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 5 – 16

slide-12
SLIDE 12

Symbolic Inconsistency

config HOTPLUG_CPU bool "Support for hot -pluggable CPUs" depends

  • n SMP &&

HOTPLUG

  • --help ---

static int hotplug_cfd (struct notifier_block *nfb , unsigned long action , void *hcpu) { // [...] switch (action) { case CPU_UP_PREPARE : case CPU_UP_PREPARE_FROZEN : // [...] #ifdef CONFIG_CPU_HOTPLUG case CPU_UP_CANCELED : case CPU_UP_CANCELED_FROZEN : case CPU_DEAD: case CPU_DEAD_FROZEN : free_cpumask_var (cfd ->cpumask ); break; #endif }; return NOTIFY_OK;

Symbolic Result: Fix for a critical bug

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 5 – 16

slide-13
SLIDE 13

Logic Inconsistencies

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 6 – 16

slide-14
SLIDE 14

Logic Inconsistencies

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif

Feature DISCONTIGMEM requires NUMA Inner block is not configuration dependent anymore

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 6 – 16

slide-15
SLIDE 15

Logic Inconsistencies

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif

Feature DISCONTIGMEM requires NUMA Inner block is not configuration dependent anymore Result: code cleanup Logic

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 6 – 16

slide-16
SLIDE 16

General Approach

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 7 – 16

slide-17
SLIDE 17

General Approach

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 7 – 16

slide-18
SLIDE 18

General Approach

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif C = (FLATMEM → MEMORY MODEL) ∧ (DISCONTIGMEM → MEMORY MODEL) ∧ (SPARSEMEM → MEMORY MODEL) ∧ (NUMA → MEMORY MODEL) ∧ (DISCONTIGMEM → NUMA) extract

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 7 – 16

slide-19
SLIDE 19

General Approach

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif C = (FLATMEM → MEMORY MODEL) ∧ (DISCONTIGMEM → MEMORY MODEL) ∧ (SPARSEMEM → MEMORY MODEL) ∧ (NUMA → MEMORY MODEL) ∧ (DISCONTIGMEM → NUMA) extract I = (Block1 ↔ DISCONTIGMEM) ∧ (Block2 ↔ Block1 ∧ (NUMA) ∧ (Block3 ↔ Block1 ∧ ¬Block2) extract

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 7 – 16

slide-20
SLIDE 20

General Approach

MEMORY MODEL FLATMEM DISCONTIGMEM SPARSEMEM NUMA d e p e n d s

  • n

#ifdef CONFIG DISCONTIGMEM // Block1 static . . . int pfn_to_mid (. . .) # ifdef CONFIG NUMA // Block2 # else // Block3 # endif #endif C = (FLATMEM → MEMORY MODEL) ∧ (DISCONTIGMEM → MEMORY MODEL) ∧ (SPARSEMEM → MEMORY MODEL) ∧ (NUMA → MEMORY MODEL) ∧ (DISCONTIGMEM → NUMA) extract I = (Block1 ↔ DISCONTIGMEM) ∧ (Block2 ↔ Block1 ∧ (NUMA) ∧ (Block3 ↔ Block1 ∧ ¬Block2) extract

Crosscheck both formulas with a SAT solver: dead? = sat(C ∧ I ∧ BlockN) undead? = sat(C ∧ I ∧ ¬BlockN ∧ parent(BlockN))

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 7 – 16

slide-21
SLIDE 21

Implementation Challenges Accuracy

Conceptually no false positives Exact identification of variation points

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 8 – 16

slide-22
SLIDE 22

Implementation Challenges Accuracy

Conceptually no false positives Exact identification of variation points

Coverage

Extract configuration model for all 22 architectures Defect detected on each architecture

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 8 – 16

slide-23
SLIDE 23

Implementation Challenges Accuracy

Conceptually no false positives Exact identification of variation points

Coverage

Extract configuration model for all 22 architectures Defect detected on each architecture

Performance

Easy and fast to use during incremental builds Possible by problem slicing Complete run on Linux in less than 10 minutes

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 8 – 16

slide-24
SLIDE 24

Results

subsystem #ifdefs logic symbolic total arch/ 33757 345 581 926 drivers/ 32695 88 648 736 fs/ 3000 4 13 17 include/ 7241 6 11 17 kernel/ 1412 7 2 9 mm/ 555 1 1 net/ 2731 1 49 50 sound/ 3246 5 10 15 virt/ 53

  • ther subsystems

601 4 1 5

  • 85291

460 1316 1776 fix proposed 150 (1) 214 (22) 364 (23) confirmed defect 38 (1) 116 (20) 154 (21) confirmed rule-violation 88 (0) 21 (2) 109 (2) pending 24 (0) 77 (0) 101 (0)

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 9 – 16

slide-25
SLIDE 25

Results

subsystem #ifdefs logic symbolic total arch/ 33757 345 581 926 drivers/ 32695 88 648 736 fs/ 3000 4 13 17 include/ 7241 6 11 17 kernel/ 1412 7 2 9 mm/ 555 1 1 net/ 2731 1 49 50 sound/ 3246 5 10 15 virt/ 53

  • ther subsystems

601 4 1 5

  • 85291

460 1316 1776 fix proposed 150 (1) 214 (22) 364 (23) confirmed defect 38 (1) 116 (20) 154 (21) confirmed rule-violation 88 (0) 21 (2) 109 (2) pending 24 (0) 77 (0) 101 (0)

We have found 1776 configurability issues Submitted 123 patches for 364 defects 20 are confirmed new bugs

(affecting binary code)

Cleaned up 5129 lines of cruft code

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 9 – 16

slide-26
SLIDE 26

Further Application: Configuration Coverage

Current ongoing work, accepted at PLOS’11 Configuration Coverage is defined as:

fraction of selected configuration-conditional blocks divided by the number of available configuration-conditional blocks.

How to catch bugs that apply only on specific kernel configurations?

⇒ Test them on as many configurations as possible

Static analyzers (sparse, smatch, ...) scan a particular kernel configuration

⇒ How to effeciently exand their coverage?

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 10 – 16

slide-27
SLIDE 27

Historical analysis of allyes coverage

v2.6.22 v2.6.24 v2.6.26 v2.6.28 v2.6.30 v2.6.32 v2.6.34 v2.6.36 v2.6.38 v3.0-rc2 2000 4000 6000 8000 10000 12000 14000 16000 18000 20000 0,00% 10,00% 20,00% 30,00% 40,00% 50,00% 60,00% 70,00% 80,00% 90,00% 100,00% allyesconfig blocks (n) total blocks (n) files (n) coverage allyesconfig (%)

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 11 – 16

slide-28
SLIDE 28

Concrete Example

#ifdef CONFIG_DISCONTIGMEM Block 1 static inline int pfn_to_nid (unsigned long pfn) { #ifdef CONFIG_NUMA Block 2 return (( int) physnode_map [( pfn) / PAGES_PER_ELEMENT ]); #else Block 3 return 0; #endif } #endif Block 1

Possible Configurations:

Neither, DISCONTIGMEM, DISCONTIGMEM ∧ NUMA

Additionally testing the configuration NUMA does not increase the Configuration Coverage.

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 12 – 16

slide-29
SLIDE 29

Realization

KConfig Files

config HOTPLUG_CPU bool "Support for ..." depends on SMP && ...

undertaker Dead Block Detection K C

  • n

fi g P a r s e r

#ifdef CONFIG_HOTPLUG_CPU ... #endif

Linux source file Calculate Partial Configs Expand Partial Configs Build and T esting

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 13 – 16

slide-30
SLIDE 30

Implementation Challenges

Proper extraction of Configurations constraints

Kconfig (implemented in undertaker) Kbuild constraints (largely unhandled)

Expansion of Partial Configurations

Na¨ ıve approach has some surprising effects (i.e., fails sometimes) Kconfig-sat seems promising, but unfortunately discontinued

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 14 – 16

slide-31
SLIDE 31

Evaluation

Analyzed files 10,365 Files with variability 3,163 Rate of files with variability 30.52% Sum of all (partial) configurations 4,435 Sum of configuration controlled conditional blocks 16,444 Sum of blocks selected by allyesconfig 11,511 Sum of all blocks selected by undertaker-coverage 13,844 Coverage allyesconfig (non-dead-corrected) 70.00% Coverage undertaker (non-dead-corrected) 84.19% Dead blocks 1,778 Selectable blocks (excluding dead blocks) 14,666 Selected by allyesconfig 11,511 Covered by undertaker 13,844 allyesconfig coverage 78.49% undertaker coverage 94.40% undertaker coverage / allyesconfig coverage 1.20

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 15 – 16

slide-32
SLIDE 32

Evaluation

Analyzed files 10,365 Files with variability 3,163 Rate of files with variability 30.52% Sum of all (partial) configurations 4,435 Sum of configuration controlled conditional blocks 16,444 Sum of blocks selected by allyesconfig 11,511 Sum of all blocks selected by undertaker-coverage 13,844 Coverage allyesconfig (non-dead-corrected) 70.00% Coverage undertaker (non-dead-corrected) 84.19% Dead blocks 1,778 Selectable blocks (excluding dead blocks) 14,666 Selected by allyesconfig 11,511 Covered by undertaker 13,844 allyesconfig coverage 78.49% undertaker coverage 94.40% undertaker coverage / allyesconfig coverage 1.20

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 15 – 16

slide-33
SLIDE 33

Evaluation

Analyzed files 10,365 Files with variability 3,163 Rate of files with variability 30.52% Sum of all (partial) configurations 4,435 Sum of configuration controlled conditional blocks 16,444 Sum of blocks selected by allyesconfig 11,511 Sum of all blocks selected by undertaker-coverage 13,844 Coverage allyesconfig (non-dead-corrected) 70.00% Coverage undertaker (non-dead-corrected) 84.19% Dead blocks 1,778 Selectable blocks (excluding dead blocks) 14,666 Selected by allyesconfig 11,511 Covered by undertaker 13,844 allyesconfig coverage 78.49% undertaker coverage 94.40% undertaker coverage / allyesconfig coverage 1.20

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 15 – 16

slide-34
SLIDE 34

Evaluation

Analyzed files 10,365 Files with variability 3,163 Rate of files with variability 30.52% Sum of all (partial) configurations 4,435 Sum of configuration controlled conditional blocks 16,444 Sum of blocks selected by allyesconfig 11,511 Sum of all blocks selected by undertaker-coverage 13,844 Coverage allyesconfig (non-dead-corrected) 70.00% Coverage undertaker (non-dead-corrected) 84.19% Dead blocks 1,778 Selectable blocks (excluding dead blocks) 14,666 Selected by allyesconfig 11,511 Covered by undertaker 13,844 allyesconfig coverage 78.49% undertaker coverage 94.40% undertaker coverage / allyesconfig coverage 1.20

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 15 – 16

slide-35
SLIDE 35

Evaluation

Analyzed files 10,365 Files with variability 3,163 Rate of files with variability 30.52% Sum of all (partial) configurations 4,435 Sum of configuration controlled conditional blocks 16,444 Sum of blocks selected by allyesconfig 11,511 Sum of all blocks selected by undertaker-coverage 13,844 Coverage allyesconfig (non-dead-corrected) 70.00% Coverage undertaker (non-dead-corrected) 84.19% Dead blocks 1,778 Selectable blocks (excluding dead blocks) 14,666 Selected by allyesconfig 11,511 Covered by undertaker 13,844 allyesconfig coverage 78.49% undertaker coverage 94.40% undertaker coverage / allyesconfig coverage 1.20

With 30 percent more compiler calls (static analysis runs) We get 15 percent more Configuration Coverage

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 15 – 16

slide-36
SLIDE 36

Conclusions

Configurability has to be seen as a significant cause of software defects in its own respect Configuration and implementation need to be kept consistent Configuration Coverage increases the effectiveness of existing tools.

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 16 – 16

slide-37
SLIDE 37

Conclusions

Configurability has to be seen as a significant cause of software defects in its own respect Configuration and implementation need to be kept consistent Configuration Coverage increases the effectiveness of existing tools. Vision:

Explorative tool for visualizing and checking Variability in Kconfig and realization Linux Feature Explorer (LIFE)

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 16 – 16

slide-38
SLIDE 38

Conclusions

Configurability has to be seen as a significant cause of software defects in its own respect Configuration and implementation need to be kept consistent Configuration Coverage increases the effectiveness of existing tools. Vision:

Explorative tool for visualizing and checking Variability in Kconfig and realization Linux Feature Explorer (LIFE)

http://vamos.informatik.uni-erlangen.de/trac/undertaker

  • R. Tartler

Feature Consistency in Compile-Time–Configurable System Software (September 7, 2011) 16 – 16