Verification of Parameterized Concurrent Programs By Modular Reasoning about Data and Control

Transcription

1 Verification of Parameterized Concurrent Programs By Modular Reasoning about Data and Control Zachary Kincaid Azadeh Farzan University of Toronto January 18, 2013 Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

2 Parameterized concurrent programs Goal Compute numerical invariants (e.g. intervals, octagons, polyhedra) for parameterized concurrent programs. Solution: annotation ι such that if some thread T s program counter is at v, then ι(v) holds over the globals & locals of T. Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

3 Parameterized concurrent programs Goal Compute numerical invariants (e.g. intervals, octagons, polyhedra) for parameterized concurrent programs. Solution: annotation ι such that if some thread T s program counter is at v, then ι(v) holds over the globals & locals of T. Our program model has: Unbounded concurrency: program is the parallel composition of n copies of some thread T, where n is a parameter Invariants must be sound for all n Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

4 Parameterized concurrent programs Goal Compute numerical invariants (e.g. intervals, octagons, polyhedra) for parameterized concurrent programs. Solution: annotation ι such that if some thread T s program counter is at v, then ι(v) holds over the globals & locals of T. Our program model has: Unbounded concurrency: program is the parallel composition of n copies of some thread T, where n is a parameter Invariants must be sound for all n Unbounded data domains Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

5 Parameterized concurrent programs Goal Compute numerical invariants (e.g. intervals, octagons, polyhedra) for parameterized concurrent programs. Solution: annotation ι such that if some thread T s program counter is at v, then ι(v) holds over the globals & locals of T. Our program model has: Unbounded concurrency: program is the parallel composition of n copies of some thread T, where n is a parameter Invariants must be sound for all n Unbounded data domains Natural model for device drivers, file systems, client/server-type programs,... Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

6 Contributions 1 We develop an attack on the parameterized verification problem based on separating it into a data module and a control module Data module computes numerical invariants Control module computes a program model Data module Control module Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

7 Contributions 1 We develop an attack on the parameterized verification problem based on separating it into a data module and a control module Data module computes numerical invariants Control module computes a program model Data module Control module 2 We propose data flow graphs as a program representation for (parameterized) concurrent programs Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

8 Contributions 1 We develop an attack on the parameterized verification problem based on separating it into a data module and a control module Data module computes numerical invariants Control module computes a program model Data module Control module 2 We propose data flow graphs as a program representation for (parameterized) concurrent programs 3 We give a semicompositional algorithm for constructing data flow graphs Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

9 Contributions 1 We develop an attack on the parameterized verification problem based on separating it into a data module and a control module Data module computes numerical invariants Control module computes a program model Data module Control module 2 We propose data flow graphs as a program representation for (parameterized) concurrent programs 3 We give a semicompositional algorithm for constructing data flow graphs Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

10 Sequential program analysis Flow analysis: solve a system of equations valued over some abstract domain For sequential programs, equations come from the control flow graph: IN(t) = t OUT (t) = t (IN(t)) IN(u) = OUT (t) OUT (w) OUT (u) = u (IN(u)) u v IN(v) = OUT (t) OUT (v) = v (IN(v)) w IN(w) = OUT (u) OUT (v) OUT (w) = w (IN(w)) Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

11 Sequential program analysis Flow analysis: solve a system of equations valued over some abstract domain For sequential programs, equations come from the control flow graph: IN(t) = t OUT (t) = t (IN(t)) IN(u) = OUT (t) OUT (w) OUT (u) = u (IN(u)) u v IN(v) = OUT (t) OUT (v) = v (IN(v)) w IN(w) = OUT (u) OUT (v) OUT (w) = w (IN(w)) How about parameterized programs? Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

12 Data flow Represent data flow, not control flow: ABC x := x + 1 y := 1 x := x + y x := -x Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

13 Data flow Represent data flow, not control flow: ABC x := x + 1 x y := 1 y x := x + y x x := -x Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

14 Data flow Represent data flow, not control flow: x uninit ABC x y x := x + 1 x y := 1 y x := x + y x x := -x y y Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

15 Why data flow? Invariant: x = 0 y := 0 acquire(lock) assert(x = 0) release(lock) x? acquire(lock) x := 1 x := 0 release(lock) Break invariant Restore invariant Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

16 Data flow graphs A DFG for a program P is a directed graph P = Loc,, where Loc V ars Loc is a set of directed edges labeled by program variables x x := x + 1 x := x + y Loc contains a distinguished uninit vertex Note: # of vertices does not depend on # of threads Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

17 Representing traces A program is represented by a DFG P if all its feasible traces are represented by P. Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

18 Representing traces A program is represented by a DFG P if all its feasible traces are represented by P. A trace is represented by a DFG P if all data flow edges it witnesses belong to P Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

19 Representing traces A program is represented by a DFG P if all its feasible traces are represented by P. A trace is represented by a DFG P if all data flow edges it witnesses belong to P A trace witnesses a data flow u x v iff it is of the form: Thread n executes u, u modifies x T n, u Thread m at v No modifications to x (x local requires n = m) Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

20 Representing traces A program is represented by a DFG P if all its feasible traces are represented by P. A trace is represented by a DFG P if all data flow edges it witnesses belong to P A trace witnesses a data flow u x v iff it is of the form: uninit ABC Thread n executes u, u modifies x T n, u Thread m at v x x y x := x + 1 x y := 1 y No modifications to x (x local requires n = m) y x := x + y y x x := -x Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

21 Computing invariants with DFGs DFGs induce a set of equations: IN(v) x = (V ars \ {x}).out (u) u x v IN(v) = IN(v) x x V ar OUT (v) = v (IN(v)) Define an inductive annotation to be a solution to these equations. Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

22 Computing invariants with DFGs DFGs induce a set of equations: IN(v) x = u x v IN(v) = IN(v) x x V ar OUT (v) = v (IN(v)) (V ars \ {x}).out (u) Define an inductive annotation to be a solution to these equations. Theorem (DFG soundness) If σ is a trace represented by a DFG P, and ι is an inductive annotation for P, then ι safely approximates the states reached by σ. Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

23 Overview Data module Control module Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

24 Overview Data module Control module Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

25 Constructing data flow graphs Goal Compute the set of all u, x, v such that there is some feasible trace that witnesses u x v Strategy: Overapproximate the set of feasible traces Compute dataflow edges witnessed by one of these traces Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

26 Precise DFG construction needs data (flag is initially 0) assume(flag) x? x := null assert(x!= null) x := alloc(...) flag := 1 Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

27 Precise DFG construction needs data (flag is initially 0) assume(flag) x? x := null T 1,x := null assert(x!= null) x := alloc(...) x T 2,assume(flag) flag := 1 T 2,assert(x!= null) Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

28 Precise DFG construction needs data (flag is initially 0) assume(flag) assert(x!= null) x? x := null T 1,x := null x := alloc(...) x T 2,assume(flag) flag = 0 Cannot execute! flag := 1 T 2,assert(x!= null) Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

29 ι-feasible traces Use an annotation ι to rule out infeasible traces: a trace σ is ι-infeasible if there is some subtrace σ T n, v, some thread m, and some location u such that Thread m is at location u after executing σ Thread n may not execute v in any state satisfying ι(u). Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

30 ι-feasible traces: example (flag is initially 0) assume(flag) x? x := null assert(x!= null) x := alloc(...) flag := 1 Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

31 ι-feasible traces: example (flag is initially 0) assume(flag) T 1,x := null assert(x!= null) x? x := null x T 2,assume(flag) x := alloc(...) T 2,assert(x!= null) flag := 1 Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

32 ι-feasible traces: example (flag is initially 0) assume(flag) T 1,x := null assert(x!= null) x? x := null x T 2,assume(flag) x := alloc(...) T 2,assert(x!= null) flag := 1 guard: flag 0 T 1 at x := alloc(...) T 2 at assume(flag) is ι(x := alloc(...)) flag 0 satisfiable? Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

33 ι-feasible traces: example (flag is initially 0) assume(flag) T 1,x := null assert(x!= null) x? x := null x T 2,assume(flag) x := alloc(...) T 2,assert(x!= null) flag := 1 guard: flag 0 T 1 at x := alloc(...) T 2 at assume(flag) is ι(x := alloc(...)) flag 0 satisfiable? ι(x := alloc(...)) : flag = 0 infeasible Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

34 ι-feasible traces: example (flag is initially 0) assume(flag) T 1,x := null assert(x!= null) x? x := null x T 2,assume(flag) x := alloc(...) T 2,assert(x!= null) flag := 1 guard: flag 0 T 1 at x := alloc(...) T 2 at assume(flag) is ι(x := alloc(...)) flag 0 satisfiable? ι(x := alloc(...)) : flag = 0 infeasible ι(x := alloc(...)) : true feasible Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

35 Constructing data flow graphs Goal Compute the set of all u, x, v such that there is some feasible trace that witnesses u x v Strategy: Overapproximate the set of feasible traces Compute dataflow edges witnessed by one of these traces Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

36 Constructing data flow graphs Goal Compute the set of all u, x, v such that there is some feasible trace that witnesses u x v Strategy: Overapproximate the set of feasible traces by ι-feasible traces Compute dataflow edges witnessed by one of these traces Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

37 Constructing data flow graphs Goal Compute the set of all u, x, v such that there is some feasible trace that witnesses u x v Strategy: Overapproximate the set of feasible traces by ι-feasible traces Compute dataflow edges witnessed by one of these traces Parameterization is still an obstacle Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

38 Constructing data flow graphs Goal Compute the set of all u, x, v such that there is some feasible trace that witnesses u x v Strategy: Overapproximate the set of feasible traces by ι-feasible traces Compute dataflow edges witnessed by one of these traces Parameterization is still an obstacle Data flow edges for 2-thread ι-feasible witnesses can be computed efficiently Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

39 Projection Lemma (projection) Let ι be an annotation, let σ be an ι-feasible trace, and let N be a set of threads. Then σ N, the projection of σ onto N, is also ι-feasible. Thread n executes u, u modifies x T n, u Thread m at v No modifications to x Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

40 Projection Lemma (projection) Let ι be an annotation, let σ be an ι-feasible trace, and let N be a set of threads. Then σ N, the projection of σ onto N, is also ι-feasible. Thread n executes u, u modifies x T n, u Thread m at v No modifications to x Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

41 Projection Lemma (projection) Let ι be an annotation, let σ be an ι-feasible trace, and let N be a set of threads. Then σ N, the projection of σ onto N, is also ι-feasible. Thread n executes u, u modifies x T n, u Thread m at v No modifications to x A data flow edge u x v has an ι-feasible witness iff it has a 2-thread ι-feasible witness Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

42 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data analysis DFG construction Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

43 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data analysis DFG construction Annotation Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

44 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data flow edges Data analysis DFG construction Annotation Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

45 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data flow edges Data analysis DFG construction Annotation Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

46 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data flow edges Data analysis DFG construction Annotation Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

47 Feedback loop Given a DFG, we know how to compute numerical invariants Given numerical invariants, we know how to compute a DFG Sequential reaching definitions Sequential DFG Data flow edges Data analysis DFG construction Annotation Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

48 Experimental results We implemented our algorithm in a tool, DUET Integer overflow & array bounds checks for 15 Linux device drivers DUET proves 1312/1597 (82%) assertions correct in 13m9s Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

49 Experimental results: Boolean programs Boolean abstractions of Linux device drivers: Suite 1 DUET Linear interfaces 1 Improvement Assertions proved % increase Average time 3.4s 16.9s 5x speedup Suite 2 DUET Dynamic cutoff detection 2 Improvement Assertions proved % increase Average time 8.2s 24.9s 3x speedup 1 S. La Torre, P. Madhusudan, and G. Parlato. Model-checking parameterized concurrent programs using linear interfaces. In CAV, pages A. Kaiser, D. Kroening, and T. Wahl. Dynamic cutoff detection in parameterized concurrent programs. In CAV, pages Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

50 Conclusion Separate reasoning into a data module and a control module Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

51 Conclusion Separate reasoning into a data module and a control module Data flow graphs represent parameterized programs Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

52 Conclusion Separate reasoning into a data module and a control module Data flow graphs represent parameterized programs Semi-compositional DFG construction algorithm Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

53 Questions? Thank you for your attention. Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22

54 Bonus slide: future work Improved algorithms for inferring groups of related variables to improve DFGs analyses over relational domains (e.g., octagons, polyhedra) Extension to handle aliasing Z. Kincaid (U. Toronto) Modular Reasoning about Data and Control January 18, / 22