Topic: Software Model Checking via Counter-Example Guided Abstraction Refinement. Having a BLAST with SLAM. Combining Strengths. SLAM Overview SLAM

Transcription

1 Hving BLAST with SLAM Topic: Softwre Model Checking vi Counter-Exmple Guided Abstrction Refinement There re esily two dozen SLAM/BLAST/MAGIC ppers; I will skim. # # Theorem Proving Combining Strengths - Need loop invrints (will find utomticlly) + Behviors encoded in logic (used to refine bstrction) + Theorem provers (used to compute successors, refine bstrction) SLAM Progrm Anlysis - Imprecise (will be precise) + Abstrction (will shrink the stte spce we must explore) Model Checking - Finite-stte model, stte explosion (will find smll good model) + Stte Spce Explortion (used to get pth sensitive nlysis) + Counterexmples (used to find relevnt fcts, refine bstrction) # SLAM Overview INPUT: Progrm nd Specifiction Stndrd C Progrm (pointers, procedures) Specifiction = Prtil Correctness Given s finite stte mchine (typestte) I use s correctly not I m webserver OUTPUT: Verified or Counterexmple Verified = progrm does not violte spec Cn come with proof! Counterexmple = concrete bug instnce A pth through the progrm tht violtes the spec # Property : Double Locking Property : Drop Root Privilege un un An ttempt to re-cuire n cuired or relese relesed will cuse ded. [Chen-Den-Wgner 0] Clls to nd un must lternte. # User pplictions must not run with root privilege When execv is clled, must hve suid 0 #6

2 Property : IRP Hndler Exmple SLAM Input MPR strt NP SKIP CllDriver SKIP Skip CllDriver IPC MPR synch NP prop CllDriver PPC MPR completion Complete CllDriver completion MPR reuest DC not pending returned no prop synch completion CllDriver IRP ccessible N/A N/A strt P Mrk Pending CllDriver SKIP SKIP Skip CllDriver IPC MPR synch NP prop CllDriver PPC MPR completion Complete CllDriver completion MPR reuest DC MPRnot pending returned return child sttus return not Pend return Pending : do{ = ; : if (!= NULL){ : ->dt = ; un ++; : while(!= ); : un (); return; un un no prop completion N/A CllDriver [Fhndrich] #7 #8 SLAM in Nutshell SLAM(Progrm p, Spec s) = Progrm = incorporte_spec(p,s); PredicteSet bs = { ; while true do BoolenProgrm b = bstrct(,bs); mtch model_check(b) with No_Error printf( no bug ); exit(0) Counterexmple(c) if is_vlid_pth(c, p) then printf( rel bug ); exit() else bs bs _preds(c) done // progrm nme // slic // cbp // bebop // ton // ton #9 : : do{ = ; : : if if ( (!=!= NULL){ : : ->dt = ; un ++; : : while(!=!= ); : : un (); return; un 0 un ERR Incorporting Specs : do{ if L= goto ERR; else L=; = ; : if (!= NULL){ : ->dt = ; if L=0 goto ERR; else L=0; ++; : while(!= ); : if L=0 goto ERR; else L=0; Originl progrm return; violtes spec iff ERR: bort(); progrm reches ERR #0 Progrm As Lbeled Trnsition System Stte Trnsition The Sfety Verifiction Problem Error (e.g., sttes with PC = Err) 0x : : un ++; : Exmple : : do do { NULL){ : : ->dt ->dt = ; ; un : : while(!=!= ); ); : : un un (); (); return; return; 6 0x # Initil Sfe Sttes (never rech Error) Is there pth from n initil to n error stte Problem: Infinite stte grph (=, =, = ) Solution : Set of sttes logicl formul #

3 Representing [Sets of Sttes] s Formuls [F] sttes stisfying F {s s F [F ] [F ] F F [F ] [F ] F F [F] F FO fml over prog. vrs F [F ] [F ] F F i.e. F F unstisfible # Ide : Predicte Abstrction Predictes on progrm stte: (i.e., =true) = Sttes stisfying sme predictes re euivlent Merged into one bstrct stte #bstrct sttes is finite Thus model-checking the bstrction will be fesible! # Abstrct Sttes nd Trnsitions Abstrction Stte Stte c c 0x : : un ++; : 6 0x 0x : : un ++; : 6 0x = Theorem Prover = # Existentil Lifting (i.e., A A iff c A. c A. c c ) A A Theorem Prover = = #6 Abstrction Anlyze Abstrction Stte 0x : : un ++; : 6 0x Anlyze finite grph Over Approximte: Sfe System Sfe No flse negtives = = Problem Spurious counterexmples #7 #8

4 Ide : Counterex.-Guided Refinement Ide : Counterex.-Guided Refinement Solution Use spurious counterexmples to refine bstrction! Solution Use spurious counterexmples to refine bstrction. Add predictes to distinguish sttes cross cut. Imprecision Build refined due bstrction to merge #9 #0 Itertive Abstrction-Refinement Problem: Abstrction is Expensive Solution Use spurious counterexmples to refine bstrction [Kurshn et l 9] [Clrke et l 00] [Bll-Rjmni 0]. Add predictes to distinguish sttes cross cut. Build refined bstrction -elimintes counterexmple. Repet serch Untill rel counterexmple or system proved sfe Problem #bstrct sttes = #predictes Exponentil Thm. Prover ueries Rechble Observe Frction of stte spce rechble #Preds ~ 00 s, #Sttes ~ 00, #Rech ~ 000 s # # Solution: Only Abstrct Rechble Sttes Solution: Don t Refine Error-Free Regions Sfe Error Free Problem #bstrct sttes = #predictes Exponentil Thm. Prover ueries Solution Build bstrction during serch Problem #bstrct sttes = #predictes Exponentil Thm. Prover ueries Solution Don t refine error-free regions # #

5 Key Ide: Key Ide: Initil Unroll Abstrction. Pick tree-node (=bs. stte). Add children (=bs. successors). On re-visiting bs. stte, cut-off Initil Unroll Abstrction. Pick tree-node (=bs. stte). Add children (=bs. successors). On re-visiting bs. stte, cut-off 6 Find min infesible suffix - Lern predictes - Rebuild subtree with preds. 7 Find min infesible suffix - Lern predictes - Rebuild subtree with preds. Error Free # #6 Key Ide: Build-nd-Serch Initil Unroll. Pick tree-node (=bs. stte). Add children (=bs. successors). On re-visiting bs. stte, cut-off Find min spurious suffix - Lern predictes - Rebuild subtree with preds. : : do{ do{ : : ->dt = ; un :while(!=!= ); Error Free S: Only Abstrct Rechble Sttes S: Don t refine error-free regions #7 Predictes: #8 Build-nd-Serch Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= ); () = =->next : : do{ do{ : : ->dt = ; un :while(!=!= ); [!=NULL] Predictes: #9 Predictes: #0

6 Build-nd-Serch Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= ); ->dt = un() ++ : : do{ do{ : : ->dt = ; un :while(!=!= ); [==] Predictes: # Predictes: # Build-nd-Serch Anlyze Counterexmple : : do{ do{ : : ->dt = ; un :while(!=!= ); : : do{ do{ : : ->dt = ; un :while(!=!= ); () = =->next [!=NULL] ->dt = un() ++ [==] un() un() Predictes: # Predictes: # Anlyze Counterexmple Repet Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= ); = ++ : : do{ do{ : : ->dt = ; un :while(!=!= ); Predictes: [==] Inconsistent == # #6 6

7 Repet Build-nd-Serch Repet Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= );, == () = =->next : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, ==, = ->dt = un() ++ #7 #8 Repet Build-nd-Serch Repet Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, ==, = [==] : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, ==, = [!=], == #9 #0 Repet Build-nd-Serch : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, ==, =, ==, ==, = # Key Ide: Error Free Initil Unroll. Pick tree-node (=bs. stte). Add children (=bs. successors). On re-visiting bs. stte, cut-off Find min spurious suffix - Lern predictes - Rebuild subtree with preds. S: Only Abstrct Rechble Sttes S: Don t refine error-free regions # 7

8 Two hndwves Two hndwves : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, ==, =, = : : do{ do{ : : ->dt = ; Q. un How to compute, == successors :while(!=!= );, == ->dt = un(), = ++, =, ==, ==, == #, == # Two hndwves Two hndwves : : do{ do{ : : ->dt = ; Q. un How to compute, == successors :while(!=!= );, ==, =, = : : do{ do{ : : ->dt = ; Q. un How to compute, == successors :while(!=!= );, ==, =, = Q. How to find predictes, == Refinement, == Refinement, ==, == # #6 Wekest Preconditions Wekest Preconditions WP(P,OP) Wekest formul P s.t. if P is true before OP then P is true fter OP OP [WP(P, OP)] [P] WP(P,OP) Wekest formul P s.t. if P is true before OP then P is true fter OP OP [WP(P, OP)] [P] Assign x=e P[e/x] P + = = =+ #7 #8 8

9 How to compute successor How to compute successor : : do{ do{ : : ->dt = ; un :while(!=!= );, ==, = F OP For ech p Check if p is true (or flse) fter OP Q: When is p true fter OP - If WP(p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F WP(p, OP) : : do{ do{ : : ->dt = ; un :while(!=!= ); 7 7, == F OP For ech p Check if p is true (or flse) fter OP Q: When is p flse fter OP - If WP( p, OP) is true before OP! - We know F is true before OP - Thm. Pvr. Query: F WP( p, OP) #9 #0 How to compute successor Advnced SLAM/BLAST : : do{ do{ : : ->dt = ; un :while(!=!= ); Predicte: == True Flse, ==, = F OP For ech p Check if p is true (or flse) fter OP Q: When is p flse fter OP - If WP( p, OP) is true before OP! - We know F is true before OP (, ==) ( + = ) (, ==) ( + ) - Thm. Pvr. Query: F WP( p, OP) NO YES Too Mny Predictes - Use Predictes Loclly Counter-Exmples - Crig Interpolnts Procedures - Summries Concurrency - Thred-Context Resoning # # SLAM Summry ) Instrument Progrm With Sfety Policy ) Predictes = { ) Abstrct Progrm With Predictes ) Use Wekest Preconditions nd Theorem Prover Clls ) Model-Check Resulting Boolen Progrm ) Use Symbolic Model Checking ) Error Stte Not Rechble ) Originl Progrm Hs No Errors: Done! 6) Check Counterexmple Fesibility ) Use Symbolic Execution 7) Counterexmple Is Fesible ) Rel Bug: Done! 8) Counterexmple Is Not Fesible ) Find New Predictes (Refine Abstrction) ) Goto Line # Optionl: SLAM Wekness : F() { : int x=0; : : do x++; : while (x 88); 6: if (x < 77) 7: 8: Preds = {, Pth = 67 [x=0, x+ 88, x+<77] Preds = {x=0, Pth = 67 [x=0, x+ 88, x+<77] Preds = {x=0, x+=88 Pth = 67 [x=0, x+ 88, x+<77] Preds = {x=0,x+=88,x+=88 Pth = 67 Result: the predictes count the loop itertions # 9

10 Homework Project Sttus Updte Project Due Tue Apr You hve ~ dys to complete it. Need help Stop by my office or send emil. # 0