Static Analysis of Race-Free Interrupt-Driven Programs Deepak - PowerPoint PPT Presentation

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Static Analysis of Race-Free Interrupt-Driven Programs Deepak D’Souza Department of Computer Science and Automation Indian Institute of Science, Bangalore. FM Update, BITS Goa, 19 July 2018. Joint work with Nikita Chopra and Rekha Pai

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Outline Data Flow Analysis 1 Concurrent Programs 2 Race-Free Programs 3 Sync-CFG Analysis 4 Analysis 5

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts 1. p := 17; about the program state at each 2. q := 10; 3. while (p > q) { program point. 4. p := p + 1; 5. q := q + 2; Use abstract states to represent the 6. } concrete state. 7. print p, q; Example: Concrete state: � p �→ 17 , q �→ 10 � Abstract state: � p �→ o , q �→ e � . Interpret execution along a path by transforming the abstract state.

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation ( e , e ) Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. ( o , e ) Use abstract states to represent the q:= 10 concrete state. A Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A ( o , e ) Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A Example: ( o , e ) B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C ( o , e ) Interpret execution along a path by E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by E F p:=p+1 transforming the abstract state. D ( e , e ) q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Data-Flow Analysis / Abstract Interpretation Aim: To obtain conservative facts about the program state at each p:= 17 program point. Use abstract states to represent the q:= 10 concrete state. A Example: B Concrete state: � p �→ 17 , q �→ 10 � p > q Abstract state: � p �→ o , q �→ e � . C Interpret execution along a path by ( e , e ) E F p:=p+1 transforming the abstract state. D q:=q+2 print p,q

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) B ⊥ p > q ⊥ C ⊥ We usually further over-approximate the JOP by E F p:=p+1 ⊥ ⊥ computing the least fixpoint (LFP) (least solution) D of data-flow equations. ⊥ q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) ( o , e ) B p > q ⊥ C ⊥ We usually further over-approximate the JOP by E F p:=p+1 ⊥ ⊥ computing the least fixpoint (LFP) (least solution) D of data-flow equations. ⊥ q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) ( o , e ) B p > q ⊥ C ( o , e ) We usually further over-approximate the JOP by E ( o F p:=p+1 ⊥ computing the least fixpoint (LFP) (least solution) D of data-flow equations. ⊥ q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) ( o , e ) B p > q ⊥ C ( o , e ) We usually further over-approximate the JOP by E ( o F p:=p+1 ⊥ computing the least fixpoint (LFP) (least solution) D ( e , e ) of data-flow equations. q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) ( o , e ) B p > q ⊥ C ( o , e ) ( e , e ) We usually further over-approximate the JOP by E ( o F p:=p+1 computing the least fixpoint (LFP) (least solution) ( e , e ) D of data-flow equations. q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) B ( oe , e ) p > q ⊥ C ( o , e ) We usually further over-approximate the JOP by ( e , e ) E ( o F p:=p+1 computing the least fixpoint (LFP) (least solution) ( e , e ) D of data-flow equations. q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) B ( oe , e ) p > q ⊥ ( oe , e ) C We usually further over-approximate the JOP by ( e , e ) E F p:=p+1 ( o computing the least fixpoint (LFP) (least solution) ( e , e ) D of data-flow equations. q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥

Data Flow Analysis Concurrent Programs Race-Free Programs Sync-CFG Analysis Analysis Computing JOP/LFP ( e , e ) ( oe , oe ) p:= 17 ( o , e ) ( o , oe ) ( oe , o ) ( oe , e ) ( e , oe ) q:= 10 ( o , e ) A ( o , o ) ( o , e ) ( e , o ) ( e , e ) B ( oe , e ) p > q ⊥ C ( oe , e ) We usually further over-approximate the JOP by ( e , e ) E F p:=p+1 ( o computing the least fixpoint (LFP) (least solution) D ( oe , e ) of data-flow equations. q:=q+2 The number of steps in the LFP computation is bounded by print p,q number of program points × height of G abstract lattice. ⊥