Synthesis of Synchronization using Uninterpreted Functions* October - - PowerPoint PPT Presentation

▶
synthesis of synchronization using uninterpreted functions
SMART_READER_LITE
LIVE PREVIEW

Synthesis of Synchronization using Uninterpreted Functions* October - - PowerPoint PPT Presentation

Mar 09, 2023 472 likes •744 views

Robert Knighofer Synthesis of Synchronization using Uninterpreted Functions Synthesis of Synchronization using Uninterpreted Functions* October 22, 2014 Roderick Bloem, Georg Hofferek, Bettina Knighofer, Robert Knighofer, Simon

slide-1
SLIDE 1

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

u www.iaik.tugraz.at u www.iaik.tugraz.at

Synthesis of Synchronization using Uninterpreted Functions*

October 22, 2014

* This work was supported in part by the Austrian Science Fund (FWF) through the national research network RiSE (S11406-N23) and the project QUAINT (I774-N23).

Roderick Bloem, Georg Hofferek, Bettina Könighofer, Robert Könighofer, Simon Außerlechner, and Raphael Spörk

slide-2
SLIDE 2

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

2
  • Specification: What?
  • From: Graz,

Inffeldgasse

  • To: Lausanne, 6pm
  • Implementation: How?
  • Walk to Moserhofgasse
  • Tram 6 to Jakominiplatz
  • Buy tram ticket
  • Tram 3 to train station Graz
  • Buy train ticket
  • Train to Salzburg
  • Train to Zürich
  • Train to Launsanne
  • Walk to Lausanne Fon
  • And so on …

What is Synthesis?

Synthesis FMCAD

Lausanne, October 22 FMCAD 2014
slide-3
SLIDE 3

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

3
  • Specification: What?
  • From: Graz,

Inffeldgasse

  • To: Lausanne, 6pm
  • Implementation: How?
  • Walk to Moserhofgasse
  • Tram ??? to Jakominiplatz
  • Buy tram ticket
  • Tram 3 to train station Graz
  • Buy train ticket
  • Train to ???
  • Train to Zürich
  • Train to Launsanne
  • Walk to Lausanne Fon
  • And so on …

What is Synthesis?

Synthesis FMCAD

Lausanne, October 22 FMCAD 2014
slide-4
SLIDE 4

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Concurrent Programs

4

Functionality:

  • Hard to specify
  • Easy to implement

 Implement manually Vision: Concurrent Correctness:

  • Easy to specify
  • Same result
  • Hard to implement

 Synthesize

FMCAD 2014 Lausanne, October 22

Synthesizing Compiler Sequentially Correct Code Parallel Code

Same Results

Programmer

slide-5
SLIDE 5

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Synthesizing Atomic Sections

5

Example:

  • RSA decryption using Chinese Remainder Theorem
  • Goal: m = cd mod (p*q)
  • Faster: mp = cd mod p
  • Parallelization:
FMCAD 2014 Lausanne, October 22

thread1() { mp := cd mod p; fin1 := true; if(!merged && fin2) merged := true; mp := crt(mp, mq); } thread2() { mq := cd mod q; fin2 := true; if(!merged && fin1) merged := true; mp := crt(mp, mq); }

1 2 3 4 5 6 7 11 12 13 14 15 16 17

mq = cd mod q m = crt(mp, mq)

slide-6
SLIDE 6

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Flow

6 FMCAD 2014 Lausanne, October 22

Program Abstraction Atomic Sections SMT Encoding Verification Counterexample Analysis Synchronized Program

slide-7
SLIDE 7

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Abstraction

7

Challenge: Complicated arithmetic

  • Synchronization should not depend on arithmetic
  •  Abstract using uninterpreted functions
FMCAD 2014 Lausanne, October 22

thread1() { mp := cd mod p; fin1 := true; if(!merged && fin2) merged := true; mp := crt(mp, mq); } thread2() { mq := cd mod q; fin2 := true; if(!merged && fin1) merged := true; mp := crt(mp, mq); }

1 2 3 4 5 6 7 11 12 13 14 15 16 17

slide-8
SLIDE 8

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Abstraction

8

Challenge: Complicated arithmetic

  • Synchronization should not depend on arithmetic
  •  Abstract using uninterpreted functions
  • All arithmetic operations: +,-,*, …
  • Calls of functions without side-effects
FMCAD 2014 Lausanne, October 22

thread1() { mp := fme(c, d, p); fin1 := true; if(!merged && fin2) merged := true; mp := fcrt(mp, mq); } thread2() { mq := fme(c, d, q); fin2 := true; if(!merged && fin1) merged := true; mp := fcrt(mp, mq); }

1 2 3 4 5 6 7 11 12 13 14 15 16 17

slide-9
SLIDE 9

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Flow

9 FMCAD 2014 Lausanne, October 22

Program Abstraction Atomic Sections SMT Encoding Verification Counterexample Analysis Synchronized Program

slide-10
SLIDE 10

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

SMT Encoding

10
  • Implicit specification
  • result(Thread1 || Thread2) = result(Thread1 ○ Thread2) or

result(Thread2 ○ Thread1)

  • result(): global variables at termination
  • Often called “serializability” or “linearizability”
  • Construct SMT formula:
  • incorrect(inputs, scheduling)
  • Satisfying assignment = incorrect execution
  • Approach based on Bounded Model Checking [CAV’05]
  • Loops are unrolled
  • Function calls are inlined (or abstracted)
FMCAD 2014 Lausanne, October 22
slide-11
SLIDE 11

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Flow

11 FMCAD 2014 Lausanne, October 22

Program Abstraction Atomic Sections SMT Encoding Verification Counterexample Analysis Synchronized Program

SMT SMT Solver UNSAT counterexample

slide-12
SLIDE 12

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Counterexample Analysis:

Method 1 [POPL’10]

12
  • Eliminate counterexample:
  • Atomic section at 𝑩 ∨ 𝑪
FMCAD 2014 Lausanne, October 22

Thread 1 Thread 2 Line A Line B Line C

(end of T1)

slide-13
SLIDE 13

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Counterexample Analysis:

Method 1 [POPL’10]

13
  • Eliminate counterexample:
  • Atomic section at 𝑩 ∨ 𝑪
  • Atomic section at 𝑩 ∨ 𝑬
FMCAD 2014 Lausanne, October 22

Thread 1 Thread 2 Line A Line D Line C Iteration 2:

(end of T1)

slide-14
SLIDE 14

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Counterexample Analysis:

Method 1 [POPL’10]

14
  • Eliminate counterexample:
  • Atomic section at 𝑩 ∨ 𝑪
  • Atomic section at 𝑩 ∨ 𝑬
  • Minimal satisfying assignment
  •  Atomic section at 𝑩
FMCAD 2014 Lausanne, October 22

Thread 1 Thread 2 Iteration 3:

No more counterexamples

slide-15
SLIDE 15

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Counterexample Analysis:

Method 2

15
  • Start with last (non-mandatory)

thread switch B

  • Can we build a valid run from B on?
FMCAD 2014 Lausanne, October 22

Thread 1 Thread 2 Line A Line B Line C

(end of T1)

slide-16
SLIDE 16

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Counterexample Analysis:

Method 2

16
  • Start with last (non-mandatory)

thread switch B

  • Can we build a valid run from B on?
  • No? Problem already before
  • Investigate A in the same way
  • Yes? B is suspicious.
  • Add atomic section at B
  • This is a heuristic!
  • May not find the minimal solution
FMCAD 2014 Lausanne, October 22

Thread 1 Thread 2 Line A Line B

slide-17
SLIDE 17

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Flow

17 FMCAD 2014 Lausanne, October 22

Program Abstraction Atomic Sections SMT Encoding Verification Counterexample Analysis Synchronized Program

SMT SMT Solver UNSAT counterexample

slide-18
SLIDE 18

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results

18
  • Prototype tool for (simple) C programs
  • Toy examples:
  • linEq:
  • Given: linear equation 4a + 3b + 9c -4d = 6
  • Given: assignment a=100, b=0, c=3, d=12
  • Program performs parallelized check
  • Abstraction: +,*  f+(), f*()
  • VecPrime:
  • Counts prime numbers in a vector
  • Abstraction: isPrime()  fp()
FMCAD 2014 Lausanne, October 22
slide-19
SLIDE 19

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results: Toy Examples

Speedup due to Abstraction

19 FMCAD 2014 Lausanne, October 22

1 10 100 1000 1 10 100 1000 Method 1 Method 2

With abstraction (UIF) [sec] Without abstraction [sec] Average speedup factor: 110 not counting time-outs 160 when counting time-outs

slide-20
SLIDE 20

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results

20 FMCAD 2014 Lausanne, October 22
  • Real-world examples:
  • CVE-2014-0196 bug in Linux TTY driver
  • Race condition can produce buffer overflow
slide-21
SLIDE 21

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results

21 FMCAD 2014 Lausanne, October 22
  • Real-world examples:
  • CVE-2014-0196 bug in Linux TTY driver
  • Race condition can produce buffer overflow
int tty_size; int tty_offset; int OPOST_tty; int STATE = 1; void thread1() { int c = 0; int nr = 22; int b = 77; int true_int = 1; while(true_int == 1) { if(OPOST_tty) { STATE = 2; while(nr > 0) { int num = nr + 3; b = b + num; nr = nr - num; if(nr != 0){ c = b; b = b + 1; nr = nr - 1; } } } else { STATE = 3; while(nr > 0) { int tmpOffset = tty_offset; int tty_space_left = tty_size - tmpOffset; if( tty_space_left - nr >= 0 ) c = nr; else c = tty_space_left; tmpOffset = tty_offset; tmpOffset = tmpOffset + c; tty_offset = tmpOffset; if(c>0){ b = b + c; nr = nr - c; } } } } }

atomic section

slide-22
SLIDE 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results

22 FMCAD 2014 Lausanne, October 22
  • Real-world examples:
  • CVE-2014-0196 bug in Linux TTY driver
  • Race condition can produce buffer overflow
  • Race condition in iio-subsystem of linux-kernel
  • Variable that counts the number of running threads
  • Race condition in broadcom tigon3 ethernet driver
  • Statistics can get inconsistent
slide-23
SLIDE 23

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Experimental Results: Real-World Bugs

23
  • TTY and Tigon3:
  • Our tool finds exactly the suggested fix
  • IIO:
  • Our tool finds a slightly different fix
  • No user-defined specification necessary
  • Serialzability as implicit specification is enough
  • Execution times [sec]:
FMCAD 2014 Lausanne, October 22

Without Abstraction With Abstraction Method 1 Method 2 Method 1 Method 2 TTY 11 13 4.1 5.8 IIO 1.1 1.3 0.9 1.1 Tigon3 17 21 9.8 13

slide-24
SLIDE 24

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

Summary and Conclusions

24

Highlights:

  • No manual specifications  usability
  • Abstraction with uninterpreted functions  scalability
  • Proof-of-concept implementation
  • http://www.iaik.tugraz.at/content/research/design verification/atoss/

Future work:

  • Abstraction refinement (e.g., associativity,

commutativity), other abstractions, loops, …

FMCAD 2014 Lausanne, October 22
slide-25
SLIDE 25

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions

References

25 FMCAD 2014 Lausanne, October 22

[CAV’05]

  • I. Rabinovitz and O. Grumberg. Bounded model checking of

concurrent programs. In CAV’05, LNCS 3576. Springer, 2005. [POPL’10]

  • M. T. Vechev, E. Yahav, and G. Yorsh. Abstraction-guided synthesis
  • f synchronization. In POPL’10. ACM, 2010.