Download - Lazy Abstraction
Lazy AbstractionLazy AbstractionThomas A. Henzinger
Ranjit JhalaRupak MajumdarGrégoire Sutre
UC Berkeley
2
MotivationMotivationVerification of systems code
Locking disciplinesInterface specifications
Essential for correct operationHigh rate of bugs
Temporal propertiesRequire path-sensitive analysisSwamped by false positives
Really hard to check
3
Model CheckingModel CheckingDoesn’t scale to low level implementations
Can only model check “abstractions”
Requires human intervention …
Abstract – Check – Refine LoopMicrosoft SLAM Project[Clarke et. al. 00], [Saidi 00]
4
Abstract-Check-Refine LoopAbstract-Check-Refine Loop
Abstract
Explanation
YES (Trace)
BUG
Feasible
???
Check
Refine
NO
SAFE
Seed AbstractionProgram
Abstraction
InfeasibleWhy infeasible ?
Is model unsafe ?
5
Model Checking 101Model Checking 101
ERROR STATES
Init
SYSTEM’S STATE SPACE
Keep searching successors until …Hit error states: report “bug” !Add no new successors: report “safe”Could take a long time …
6
Model Checking & AbstractionModel Checking & AbstractionProblem: Far too many states
Iterations don’t terminate !Solution: Abstract …
ERROR STATES
Init
7
ERROR STATES
Init
Model Checking & AbstractionModel Checking & AbstractionProblem: Abstraction too coarse
Solution: Refine abstractionMake boxes smaller
8
ERROR STATES
Init
Model Checking & AbstractionModel Checking & AbstractionProblem: Abstraction too coarse
Solution: Refine abstractionMake boxes smaller
9
Abstract Only Where RequiredAbstract Only Where Required
ERROR STATES
Init
Abstraction is very expensive Why abstract regions that are never visited ?
Reachable States
On-the-fly abstraction: driven by the search
10
Refine Only Where RequiredRefine Only Where RequiredWhy be precise everywhere ?
Don’t refine error-free regions
ERROR STATES
Init
ERROR FREE
11
Refine Only Where RequiredRefine Only Where RequiredWhy be precise everywhere ?
Don’t refine error-free regions Different precision for different regions
Local Refinement : driven by the search
ERROR STATES
Init
ERROR FREE
12
How to improve How to improve Abstract only where required
Reachable state space is very sparseConstruct the abstraction on-the-fly
Use greater precision only where requiredDifferent precisions/abstractions for different regionsRefine locally
Reuse work from earlier phasesBatch-oriented ) lose work from previous runsIntegrate the three phases
Exploit control flow structure
13
ExampleExample
Q: Is Error Reachable ?
Example ( ) {1: if (*) { 7: do { got_lock = 0;8: if (*) {9: lock(); got_lock ++; }10: if (got_lock) {11: unlock(); }12: } while (*) ; }2: do { lock(); old = new;3: if (*) {4: unlock(); new ++; }5: } while ( new != old);6: unlock (); return;}
unlock() lock()
lock()
unlock()
14
Example ( ) {1: if (*) { 7: do { got_lock = 0;8: if (*) {9: lock(); got_lock ++; }10: if (got_lock) {11: unlock(); }12: } while (*) ; }2: do { lock(); old = new;3: if (*) {4: unlock(); new ++; }5: } while ( new != old);6: unlock (); return;}
Example:CFAExample:CFA1
3
lock();old = new
2 7
[>][>]
4
5
[>]
[>]
unlock()new++
6
[new==old]
[new!=old]
retunlock()
15
Example ( ) {1: if (*) { 7: do { got_lock = 0;8: if (*) {9: lock(); got_lock ++; }10: if (got_lock) {11: unlock(); }12: } while (*) ; }2: do { lock(); old = new;3: if (*) {4: unlock(); new ++; }5: } while ( new != old);6: unlock (); return;}
Example:CFAExample:CFA
8
10
9
12
11
7
1
3
2
4
5
6
ret
got_lock=0
[>]
[>]
lock();got_lock++
[got_lock == 0]
[got_lock != 0]
unlock()
[>] [>]
16
Example:CFAExample:CFA
Q: Is Error Reachable ?
Example ( ) {1: if (*) { 7: do { got_lock = 0;8: if (*) {9: lock(); got_lock ++; }10: if (got_lock) {11: unlock(); }12: } while (*) ; }2: do { lock(); old = new;3: if (*) {4: unlock(); new ++; }5: } while ( new != old);6: unlock (); return;}
8
109
1211
7
1
3
2
45
6
retunlock() lock()
lock()
unlock()
17
Step 1: SearchStep 1: Search
Set of predicates: LOCK=0, LOCK=1
1 LOCK=0
2 LOCK=0
4 LOCK=1
6 LOCK=0
[>]
lock();old = new
[>]
unlock()new++
[new==old]
unlock()
8
109
1211
7
1
3
2
45
6
ret
5 LOCK=0
3 LOCK=1
Err LOCK=0
18
Q: When can:
Step 2:Step 2: Analyze CounterexampleAnalyze Counterexample1 LOCK=0
2 LOCK=0
3 LOCK=1
4 LOCK=1
5 LOCK=0
6 LOCK=0
Err LOCK=0
8
109
1211
7
1
3
2
45
6
ret
n Errops
States that can = wp( >,ops) States at node n = Rn
) check: Rn Æ wp( >,ops) = ? ?
19
Step 2:Step 2: Analyze CounterexampleAnalyze Counterexample1 LOCK=0
2 LOCK=0
3 LOCK=1
4 LOCK=1
5 LOCK=0
6 LOCK=0
Err LOCK=0
lock();old = new
[>]
unlock();new++
[new==old]
unlock()
LOCK=0
LOCK=0
LOCK=0 Æ new = old
LOCK=0 Æ new+1 = new
LOCK=1 Æ new+1 = old
LOCK=1 Æ new +1 = old
8
109
1211
7
1
3
2
45
6
ret
Rn Æ wp (>,ops) = ? ?
20
Step 2:Step 2: Analyze CounterexampleAnalyze Counterexample1 LOCK=0
2 LOCK=0
3 LOCK=1
4 LOCK=1
5 LOCK=0
6 LOCK=0
Err LOCK=0
lock();old = new
[>]
unlock();new++
[new==old]
unlock()
LOCK=0
LOCK=0
LOCK=0 Æ new = old
LOCK=0 Æ new+1 = new
LOCK=1 Æ new+1 = old
LOCK=1 Æ new +1 = old
8
109
1211
7
1
3
2
45
6
ret
Track the predicate:
new = old
21
Step 3: Resume searchStep 3: Resume search1LOCK=0
2LOCK=0
4LOCK=1 Æ new = old
lock();old = new
[>]
unlock()new++
[new==old]? 6
[new!=old]2
LOCK=0 Æ : new = old µ LOCK =0
Set of predicates: LOCK=0, LOCK=1
New predicate: new = old,
8
109
1211
7
1
3
2
45
6
ret
5LOCK=0 Æ : new = old
3LOCK=1 Æ new = old
22
Step 3: Resume searchStep 3: Resume search1LOCK=0
2LOCK=0
3LOCK=1 Æ new = old
4LOCK=1 Æ new = old
5LOCK=0 Æ : new = old
? 6 2
LOCK=0 Æ : new = old
[>]
5 LOCK=1 Æ new=old
6
[new==old][new!=old]
1
?unlock()
8
109
1211
7
1
3
2
45
6
ret
Set of predicates: LOCK=0, LOCK=1
New predicate: new = old
retLOCK=0Æ new=old
23
Example ( ) {1: if (*) { 7: do { got_lock = 0;8: if (*) {9: lock(); got_lock ++; }10: if (got_lock) {11: unlock(); }12: } while (*) ; }2: do { lock(); old = new;3: if (*) {4: unlock(); new ++; }5: } while ( new != old);6: unlock (); return;}
Example:CFAExample:CFA
8
10
9
12
11
7
1
3
2
4
5
6
ret
got_lock=0
[>]
[>]
lock();got_lock++
[got_lock == 0]
[got_lock != 0]
unlock()
[>] [>]
24
Step 4: Search Right BranchStep 4: Search Right Branch1 LOCK=0
[>]
2LOCK=0 7 LOCK=0
[>]
Err
8
109
1211
7
1
3
2
45
6
ret
Set of predicates: LOCK=0, LOCK=1
New predicate: (from trace) got_lock = 0
25
Leaves Covered (Reuse work)Leaves Covered (Reuse work)1 LOCK=0
2LOCK=0 7 LOCK=0
222
LOCK=0 Æ …COVERED !
Leaves covered:
Avoid repeating search when paths merge
8
109
1211
7
1
3
2
45
6
ret
26
Different AbstractionsDifferent Abstractions1
2 7
got_lock = 0new = old
Different predicates for
different parts of state space
Local refinement:
Preserves work on left tree
8
109
1211
7
1
3
2
45
6
ret
27
Predicate DiscoveryPredicate Discovery
Information lost in substitution
Keep substitutions explicit
Ask a proof of unsatisfiability
Pick predicates appearing in proof
2 LOCK=0
3 LOCK=1
4 LOCK=1
5 LOCK=0
6 LOCK=0
Err LOCK=0
lock();old = new
[>]
unlock();new++
[new==old]
unlock()
LOCK=0 Æ new+1 = new
28
New Predicates from proof of unsatisfiability
old’ = new, new’ = old’, new’ = new + 1
Predicate DiscoveryPredicate Discovery Weakest Precondition:
wp(, x=e) ´ [e/x]
Explicit WP:
wp(, x=e) ´ 9 x’. x’ = e Æ [x’/x]
LOCK = 0 Æ
9 old’ new’ LOCK’.
old’ = new Æ LOCK’=0
Æ new’ = old’ Æ new’ = new’ + 1
2 LOCK=0
3 LOCK=1
4 LOCK=1
5 LOCK=0
6 LOCK=0
Err LOCK=0
lock();old = new
[>]
unlock();new++
[new==old]
unlock()
LOCK=0 Æ new+1 = new
29
Lazy abstraction Lazy abstraction For any system, require:
Region representationBoolean operations: [, Å, :“Covering” check: µ
post#: Region ! Approx. succ. RegionForward Search
pre: Region ! Exact pred. RegionBackward counterexample analysis
focus : why a trace is infeasible
30
BLASTBLAST
LAZY ABSTRACTION
Berkeley Lazy Abstraction Software verification Tool10K Lines of OcamlAnalyze Linux/Windows Device Drivers
CIL(C ! CFA)
REGION STRUCTURE
BDD Engine(Boolean ops)
Simplify
(Post#)
Vampyre(focus)
31
Experiments Experiments [Not in POPL paper][Not in POPL paper]Linux Device Drivers (Locking protocol)
Windows Drivers (IRP Spec – 22 states)
Program Lines Predicates Timeide.c 18131 22 9 5 ½ min
aironet.c 18152 17 11 4 min
aha152x.c 17736 6 6 42 sec
Program Lines Predicates Timefloppy.c 17386 100 51 21 min
kbfiltr.c 12131 12 8 10 sec
32
Why Abstract Lazily ?Why Abstract Lazily ?Reach set is very sparse
Abstract on-the-flyOnly the reachable regionRequires very fast post#
Exploit Control-Flow StructureFree partitioning of state spacePartition preds: different abstractionsRefine locally: don’t repeat old work
33
Problems/Future workProblems/Future workMonolithic vs. Multi-model abstractions
How to partition predicates ?Predicate-flow analyses ?
RecursionSummaries tricky with on-the-fly search
Smarter abstractionsHeap data structures ?
34
Predicate AbstractionPredicate Abstraction
P1 : x = y
P3 : x z+1
P2 : z = t + y
P4 : *u = x
Karnaugh Map
:P1,:P2
P1, P2
P1, :P2
:P1, P2
:P3
:P4
:P3
P4
P3
P4
P3
:P4
Set of states
Abstract Set: P1P2P4 Ç : P1 P2 P3 P4
Region Representation: formulas over predicates
35
Predicate AbstractionPredicate Abstraction
Box: abstract variable valuationBoxCover(S): Set of boxes covering STheorem prover used to compute BoxCover
P1 : x = y
P3 : x z+1
P2 : z = t + y
P4 : *u = x
Karnaugh Map
:P1,:P2
P1, P2
P1, :P2
:P1, P2
:P3
:P4
:P3
P4
P3
P4
P3
:P4
36
PostPost##, Pre, Pre
pre(S,op) = { s | 9s’2S. s !op s’} (Weakest Precondition)post(S,op) = { s | 9s’2S. s’ !op s} (Strongest Postcondition)
Abstract Operators: post#
post(S,op) µ post#(S,op)
Concrete Operators: pre Classical Weakest Precondition
:P1,:P2
P1, P2
P1, :P2
:P1, P2
:P3
:P4
:P3
P4
P3
P4
P3
:P4
S
post post(S)post#(S)
53
Model Checking & AbstractionModel Checking & AbstractionProblem: Abstraction too coarse
Solution: Refine abstractionMake boxes smaller
