Verifying Multithreaded Software with Impact Bj orn Wachter , - - PowerPoint PPT Presentation

▶
verifying multithreaded software with impact
SMART_READER_LITE
LIVE PREVIEW

Verifying Multithreaded Software with Impact Bj orn Wachter , - - PowerPoint PPT Presentation

Jun 15, 2023 448 likes •1.06k views

Verifying Multithreaded Software with Impact Bj orn Wachter , Daniel Kroening and Jo el Ouaknine University of Oxford Intro Multi-threading C/C++ with POSIX/WIN 32 threads event processing, device drivers, web servers,

slide-1
SLIDE 1

Verifying Multithreaded Software with Impact

Bj¨

  • rn Wachter, Daniel Kroening and Jo¨

el Ouaknine

University of Oxford

slide-2
SLIDE 2

Intro

  • Multi-threading
  • C/C++ with POSIX/WIN 32 threads
  • event processing, device drivers, web servers, databases, ...
  • coming to embedded systems
  • Verification Challenges

SC WMM Multi threading loops variables pointers data

2 / 20

slide-3
SLIDE 3

Intro

  • Multi-threading
  • C/C++ with POSIX/WIN 32 threads
  • event processing, device drivers, web servers, databases, ...
  • coming to embedded systems
  • Verification Challenges

SC WMM Multi threading loops variables pointers data symbolic reasoning SMT SAT

2 / 20

slide-4
SLIDE 4

Intro

  • Multi-threading
  • C/C++ with POSIX/WIN 32 threads
  • event processing, device drivers, web servers, databases, ...
  • coming to embedded systems
  • Verification Challenges

SC WMM Multi threading loops variables pointers data abstraction predicate abstraction Impact algorithm [McMillan 2006] symbolic reasoning SMT SAT

2 / 20

slide-5
SLIDE 5

Intro

  • Multi-threading
  • C/C++ with POSIX/WIN 32 threads
  • event processing, device drivers, web servers, databases, ...
  • coming to embedded systems
  • Verification Challenges

SC WMM Multi threading loops variables pointers data abstraction predicate abstraction Impact algorithm [McMillan 2006] symbolic reasoning SMT SAT partial orders modular reasoning

2 / 20

slide-6
SLIDE 6

Software model checkers

Impact UFO Ultimate Wolverine SLAM Blast SatAbs ARMC Kratos CPAChecker Threader Magic CBMC ESBMC LLBMC

3 / 20

slide-7
SLIDE 7

Software model checkers

Impact UFO Ultimate Wolverine SLAM Blast SatAbs ARMC Kratos CPAChecker Threader Magic CBMC ESBMC LLBMC multithreading support

3 / 20

slide-8
SLIDE 8

Software model checkers

Impact UFO Ultimate Wolverine SLAM Blast SatAbs ARMC Kratos CPAChecker Threader Magic CBMC ESBMC LLBMC multithreading support

?

3 / 20

slide-9
SLIDE 9

Software model checkers

Impact UFO Ultimate Wolverine SLAM Blast SatAbs ARMC Kratos CPAChecker Threader Magic CBMC ESBMC LLBMC multithreading support Impara

3 / 20

slide-10
SLIDE 10

Software model checkers

Impact UFO Ultimate Wolverine SLAM Blast SatAbs ARMC Kratos CPAChecker Threader Magic CBMC ESBMC LLBMC multithreading support Impara Contribution:

  • 1st Impact-style analysis for multithreaded software
  • Partial-Order Reduction
  • implemented in Impara

3 / 20

slide-11
SLIDE 11

Outline

  • Recap: Impact for Sequential Software
  • Impact for Multithreaded Software
  • Partial order reduction
  • Experiments with our tool Impara

4 / 20

slide-12
SLIDE 12

Impact algorithm

expand check refine interpolation CEX UNSAT SAT

  • maintain abstract reachability tree
  • node labels
  • covering relation ⊲

v ⊲ w implies label(v) ⇒ label(w)

5 / 20

slide-13
SLIDE 13

Impact algorithm

expand check refine interpolation proof CEX UNSAT complete SAT

  • maintain abstract reachability tree
  • node labels
  • covering relation ⊲

v ⊲ w implies label(v) ⇒ label(w)

  • complete iff all nodes either
  • covered
  • expanded

5 / 20

slide-14
SLIDE 14

Classical SLAM example do { lock();

  • ld=new;

if(*) { unlock(); new++; } } while (new!=old);

6 / 20

slide-15
SLIDE 15

Classical SLAM example do { lock();

  • ld=new;

if(*) { unlock(); new++; } } while (new!=old); * ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

6 / 20

slide-16
SLIDE 16

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True True

ERR

True

L=0 [L!=0]

  • reachable states ⊆ label

6 / 20

slide-17
SLIDE 17

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

  • reachable states ⊆ label

6 / 20

slide-18
SLIDE 18

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

True

True ERR

True

True

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

  • reachable states ⊆ label

6 / 20

slide-19
SLIDE 19

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

True

L = 0 ERR

False

L = 0

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

  • reachable states ⊆ label

6 / 20

slide-20
SLIDE 20

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

True

L = 0 ERR

False

L = 0

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

⊲

L = 0

  • reachable states ⊆ label

6 / 20

slide-21
SLIDE 21

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

True

L = 0 ERR

False

L = 0

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

⊲

L = 0 ERR

[new!=old] [L!=0]

  • reachable states ⊆ label

6 / 20

slide-22
SLIDE 22

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

  • ld = new

L = 0 ERR

False

L = 0

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

⊲

L = 0

  • ld = new

False

ERR

False

[new!=old] [L!=0]

  • reachable states ⊆ label

6 / 20

slide-23
SLIDE 23

* ERR L=0 [L!=0] L=1; old=new L=0;new++ [new!=old] [new==old]

Abstract Reachability Tree

True L = 0

ERR

False

L=0 [L!=0]

  • ld = new

L = 0 ERR

False

L = 0

True

L=1

  • ld=new

L=0 new++ [new!=old] [new==old] [L!=0]

⊲

L = 0

  • ld = new

False

ERR

False

[new!=old] [L!=0]

⊲

  • reachable states ⊆ label
  • terminates if all nodes
  • covered
  • or fully expanded

6 / 20

slide-24
SLIDE 24

Impact for Multithreaded Software

7 / 20

slide-25
SLIDE 25

Naive Impact for Multi-threading

  • interleave at every step

threads 1,2,3

1 2 3 1 2 3

8 / 20

slide-26
SLIDE 26

Example

0, 0 0, 1

assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

9 / 20

slide-27
SLIDE 27

Example

0, 0 0, 1

assert(x==0)

2, 0 3, 0 3, 1

∗ x=0 assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

9 / 20

slide-28
SLIDE 28

Example

0, 0 0, 1

assert(x==0)

2, 0 3, 0 3, 1

∗ x=0 assert(x==0) T rue x = 0

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

9 / 20

slide-29
SLIDE 29

Example

0, 0 0, 1

assert(x==0)

2, 0 3, 0 3, 1

∗ x=0 assert(x==0) x = 0 x = 0

2, 1

assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

9 / 20

slide-30
SLIDE 30

Example

0, 0 0, 1

assert(x==0)

2, 0 3, 0 3, 1

∗ x=0 assert(x==0) x = 0 x = 0

2, 1

assert(x==0)

2, 0 2, 1 1, 0

assert(x==0) x=1 ∗

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

9 / 20

slide-31
SLIDE 31

Naive Impact blows up

ART from a concrete case study (Peterson’s algorithm)

10 / 20

slide-32
SLIDE 32

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90]

avoid unnecessary interleavings resulting in same state

main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create(T1); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create(T2); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join(T1); pthread_join(T2); assert(v[j] ≥ 0); A a B a b C a b c a C b c A b C c B c C A B A B

A || a and TID(A) < TID(a)

11 / 20

slide-33
SLIDE 33

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90]

avoid unnecessary interleavings resulting in same state

main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create(T1); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create(T2); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join(T1); pthread_join(T2); assert(v[j] ≥ 0); A a B a b C a b c a C b c A b C c B c C A B A B

A || a and TID(A) < TID(a)

11 / 20

slide-34
SLIDE 34

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90]

avoid unnecessary interleavings resulting in same state

main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create(T1); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create(T2); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join(T1); pthread_join(T2); assert(v[j] ≥ 0);

consecutive independent actions only occur in the order of increasing thread ids, e.g., Aa but not aA

A a B a b C a b c a C b c A b C c B c C A B A B

A || a and TID(A) < TID(a)

B || b and TID(B) < TID(b) A || b and TID(A) < TID(b)

11 / 20

slide-35
SLIDE 35

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90]

avoid unnecessary interleavings resulting in same state

main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create(T1); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create(T2); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join(T1); pthread_join(T2); assert(v[j] ≥ 0);

consecutive independent actions only occur in the order of increasing thread ids, e.g., Aa but not aA

A a B a b C a b c a C b c A b C c B c C A B A B

A || a and TID(A) < TID(a)

B || b and TID(B) < TID(b) A || b and TID(A) < TID(b)

11 / 20

slide-36
SLIDE 36

Algorithm: POR+Impact (First Attempt)

  • POR restricts expansion

1: procedure Expand♦(v) 2: for T ∈ T with ¬Skip♦(v, T) do 3: Expand-thread(T, v)

12 / 20

slide-37
SLIDE 37

Algorithm: POR+Impact (First Attempt)

  • POR restricts expansion

1: procedure Expand♦(v) 2: for T ∈ T with ¬Skip♦(v, T) do 3: Expand-thread(T, v) 4: 5: procedure Skip♦(v, T) 6: select unique parent action T ′, a′ s.t. u

T ′,a′

→ v 7: return   T < T ′ ∧ Action(v, T) || a′

  • dependence check

  

12 / 20

slide-38
SLIDE 38

Algorithm: POR+Impact (First Attempt)

  • POR restricts expansion

1: procedure Expand♦(v) 2: for T ∈ T with ¬Skip♦(v, T) do 3: Expand-thread(T, v) 4: 5: procedure Skip♦(v, T) 6: select unique parent action T ′, a′ s.t. u

T ′,a′

→ v 7: return   T < T ′ ∧ Action(v, T) || a′

  • dependence check

  

Is that sound?

12 / 20

slide-39
SLIDE 39

Impact + POR

0, 0 1, 0 2, 0 2, 0 3, 0 2, 1 3, 1

x = 0 x = 0 ∗ ∗ x=1 x=0 assert(x==0) ∗

2, 1

assert(x==0) assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

  • ∗ and assert(x==0) independent

13 / 20

slide-40
SLIDE 40

Impact + POR

0, 0 1, 0 2, 0 2, 0 3, 0 3, 1

x = 0 x = 0 ∗ ∗ x=1 x=0

2, 1

assert(x==0) assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

  • ∗ and assert(x==0) independent
  • reduction

13 / 20

slide-41
SLIDE 41

Impact + POR

0, 0 1, 0 2, 0 2, 0 3, 0 3, 1

T rue x = 0 ∗ ∗ x=1 x=0

2, 1

assert(x==0) assert(x==0)

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

  • ∗ and assert(x==0) independent
  • reduction

13 / 20

slide-42
SLIDE 42

Impact + POR

0, 0 1, 0 2, 0 2, 0 3, 0 3, 1

T rue x = 0 ∗ ∗ x=1 x=0

2, 1

assert(x==0) assert(x==0)

⊲

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

  • ∗ and assert(x==0) independent
  • reduction

13 / 20

slide-43
SLIDE 43

Impact + POR

0, 0 1, 0 2, 0 2, 0 3, 0 3, 1

T rue x = 0 ∗ ∗ x=1 x=0 assert(x==0)

⊲

int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3:

CEX

  • ∗ and assert(x==0) independent
  • reduction

13 / 20

slide-44
SLIDE 44

Let’s take a step back

expand?

14 / 20

slide-45
SLIDE 45

Let’s take a step back

  • POR inspects node history

dep

expand? POR: “yes”

14 / 20

slide-46
SLIDE 46

Let’s take a step back

  • POR inspects node history
  • covers merge distinct histories

dep

expand? POR: “yes”

⊲

14 / 20

slide-47
SLIDE 47

Let’s take a step back

  • POR inspects node history
  • covers merge distinct histories

dep indep

expand? POR: “no” expand? POR: “yes”

⊲

14 / 20

slide-48
SLIDE 48

Let’s take a step back

  • POR inspects node history
  • covers merge distinct histories

⇒ incomplete: lost program path

  • no corresponding ART path

dep indep

expand? POR: “no” expand? POR: “yes”

cover: “no” ⊲

14 / 20

slide-49
SLIDE 49

Let’s take a step back

  • POR inspects node history
  • covers merge distinct histories

⇒ incomplete: lost program path

  • no corresponding ART path
  • How to fix this?
  • corresponding path?
  • allow cover edges
  • jump to more abstract node

dep ⊲

14 / 20

slide-50
SLIDE 50

Let’s take a step back

  • POR inspects node history
  • covers merge distinct histories

⇒ incomplete: lost program path

  • no corresponding ART path
  • How to fix this?
  • corresponding path?
  • allow cover edges
  • jump to more abstract node

dep ⊲

14 / 20

slide-51
SLIDE 51

Complete Algorithm

  • v ⊲ w

⇒ consider both histories

  • v’s and w’s

v w dep indep expand ⊲

15 / 20

slide-52
SLIDE 52

Complete Algorithm

  • v ⊲ w

⇒ consider both histories

  • v’s and w’s
  • Note: we’re still doing POR

v w dep indep expand ⊲

15 / 20

slide-53
SLIDE 53

Π-completeness

Π determined by POR strategy

Definition (Π-complete ART)

ART A is Π-complete iff: for every π ∈ Π, there is a corresponding path v0, . . . , vn.

16 / 20

slide-54
SLIDE 54

Π-completeness

v2 v0 v1 u2 v3 v4 Π determined by POR strategy

Definition (Π-complete ART)

ART A is Π-complete iff: for every π ∈ Π, there is a corresponding path v0, . . . , vn.

16 / 20

slide-55
SLIDE 55

Π-completeness

v2 v0 v1 u2 v3 v4 Π determined by POR strategy

Definition (Π-complete ART)

ART A is Π-complete iff: for every π ∈ Π, there is a corresponding path v0, . . . , vn.

⇒ Soundness

16 / 20

slide-56
SLIDE 56

Impara

  • C++ implementation
  • CBMC frontend
  • bit-precise interpolation
  • unsatisfiable cores + weakest preconditions

17 / 20

slide-57
SLIDE 57

Impara vs. other tools

CBMC 4.5 ESMBC SatAbs Threader Impara technique BMC BMC

  • Pred. Abs.
  • Pred. Abs.

Interpolation threads PO encoding POR POR Modular Reasoning POR unbounded loops

  • bit-precise
  • weak memory
  • ∗

∗

SVCOMP’13 multi-threading benchmarks

program

safe

CBMC

ESBMC SatAbs Threader

Impara dekker y 0.6∗ 2.2∗ 0.2 TO 0.1 lamport y 12.4∗ 18.1∗ 0.3 38.1 0.3 peterson y 0.2∗ 2.0∗ 0.3 4.8 0.1 szymanski y 0.5∗ 4.7∗ 0.2 13.5 0.2 read_write_u n 0.2 TO 0.8 58.4 0.6 read_write_s y 0.4 TO 0.8 58.1 0.9 time_var_mutex y 0.2 110.3 95.4 4.3 0.1 stack_u n 1.0 TO TO 80.6 0.5 stack_s y 33.5 TO TO 250.1 38.8

18 / 20

slide-58
SLIDE 58

Conclusion

  • Impact abstraction + POR
  • take-home message: look at both histories
  • Experiments
  • SVCOMP’13
  • weak memory benchmarks (low-lock algorithms)
  • Impara gives correct results
  • which gives us confidence
  • Binary & benchmarks at:

http://www.cprover.org/concurrent-impact/

19 / 20

slide-59
SLIDE 59

Thank you!

20 / 20