Part I. Hunting for Bugs Vadim Mutilin Institute for System - - PowerPoint PPT Presentation

▶
part i hunting for bugs
SMART_READER_LITE
LIVE PREVIEW

Part I. Hunting for Bugs Vadim Mutilin Institute for System - - PowerPoint PPT Presentation

Oct 25, 2023 195 likes •508 views

Part I. Hunting for Bugs Vadim Mutilin Institute for System Programming of the Russian Academy of Sciences 2 Bugs Found for Subsystems 3 Bugs Found for Subsystems 4 5 Bugs Found by CPAchecker 6 Total Bugs Found 7 Top 10 of 35 Rules 8

slide-1
SLIDE 1

Institute for System Programming of the Russian Academy of Sciences

Vadim Mutilin

Part I. Hunting for Bugs

slide-2
SLIDE 2

2

slide-3
SLIDE 3

3

Bugs Found for Subsystems

slide-4
SLIDE 4

4

Bugs Found for Subsystems

slide-5
SLIDE 5

5

slide-6
SLIDE 6

6

Bugs Found by CPAchecker

slide-7
SLIDE 7

7

Total Bugs Found

slide-8
SLIDE 8

8

Top 10 of 35 Rules

slide-9
SLIDE 9

9

Consequences

slide-10
SLIDE 10

10

Consequences (by the tool)

slide-11
SLIDE 11

11

On the Error Path? (by the tool)

slide-12
SLIDE 12

12

On the Error Path? (for top 10 rules)

slide-13
SLIDE 13

Institute for System Programming of the Russian Academy of Sciences

Sergey Lesovoy

Part II. ARINC to AADL

slide-14
SLIDE 14

17

  • Partition & process management

...

  • Inter & intra partition communication

...

  • etc
slide-15
SLIDE 15

18

Architecture Analysis and Design Language (AADL)

Example 1. Communicating with intra partition port and global variable Example 2. Communicating with inter partition port

slide-16
SLIDE 16

19

ARINC processes

“process 1” does not start here “process 1“ starts here Initialization of ARINC entities

slide-17
SLIDE 17

20

ARINC processes Solution 1

  • Preliminary Value analysis collecting set of process

function pointers

  • Inserting function calls explicitly

Start “process 1”

slide-18
SLIDE 18

21

ARINC processes Solution 2

  • A model with nondeterministic choice

Save nondeterministically Call saved pointer

slide-19
SLIDE 19

22

ARINC entities

Creation of port entity with name “QP1” Identifier is stored in variable QP1 Entering “process 1” Creation of process with name “process 1” and function pointer first_process. Identifier is stored in variable pid

slide-20
SLIDE 20

23

ARINC entities Solution

pid → {“process 1”, first_function}

slide-21
SLIDE 21

24

ARINC entities Solution

pid → {“process 1”, first_function} pid → {“process 1”, first_function} QP1 → “QP1”

slide-22
SLIDE 22

25

ARINC entities Solution

pid → {“process 1”, first_function} pid → {“process 1”, first_function} QP1 → “QP1” current → “process 1” pid → {“process 1”, first_function} QP1 → “QP1”

slide-23
SLIDE 23

26

ARINC entities Solution

pid → {“process 1”, first_function} pid → {“process 1”, first_function} QP1 → “QP1” current → “process 1” pid → {“process 1”, first_function} QP1 → “QP1”

slide-24
SLIDE 24

27

Collect values only on reachable paths

  • 1. The path should be reachable
  • 2. Get the value
slide-25
SLIDE 25

28

Collect values only on reachable paths

  • Solution. Refinement

Mark as target state (violation) Take the value from Value analysis

slide-26
SLIDE 26

29

CPAchecker ARINC2AADL

  • ARINC processes
  • Solution 1. Preliminary analysis – requires modification of CFA
  • Solution 2. Nondeterministic choice – sound for sequential

analysis only

  • ARINC entities
  • Solution. Extension of Value analysis – supports pointers only

heuristically

  • Generalize for other analyses?
  • Collect values on reachable paths
  • Value Analysis – supports pointers only heuristically
  • Predicate Analysis – how to exclude undefined values?
slide-27
SLIDE 27

Institute for System Programming of the Russian Academy of Sciences

Part III. Topics

slide-28
SLIDE 28

31

Topics (unsorted)

  • Collect data values with predicate analysis
  • Correctness witness visualization
  • Stepwise input program simplification and debugging of CPAchecker
  • Type and BnB regions for array encoding in predicate analysis
  • CPALockator
  • Support for atomic access primitives
  • Support for interrupts model
  • Shared analysis with refinement
  • Support for message passing
  • Support for control dependencies
  • Checking memsafety properties for multithreaded programs
  • Simplifying input source code for the verification (CIL-less)
  • Loop iterations abstraction and refinement
  • Generation of exploits
  • Checking for undefined behavior with symbolic memory graphs
  • Local path refinement selection in BAM
  • On-demand memory for predicate analysis
  • Runtime learning of environment models
slide-29
SLIDE 29

Institute for System Programming of the Russian Academy of Sciences

Thank you!

Vadim Mutilin http://linuxtesting.org/project/ldv