A Practical Construction for Decomposing Numerical Abstract Domains - PowerPoint PPT Presentation

A Practical Construction for Decomposing Numerical Abstract Domains Gagandeep Singh Markus Püschel Martin Vechev Department of Computer Science 1

Numerical abstract domains ( 𝑑 𝜗 ℚ 𝑝𝑠 ℝ ) Cost and Numerical Domain Representable Constraints ±𝑦 𝑗 ≤ 𝑑 Expressivity ±𝑦 𝑗 ≤ 𝑑 𝑝𝑠 (𝑦 𝑗 ≤ 𝑦 𝑘 ) Interval ±𝑦 𝑗 ≤ 𝑑 𝑝𝑠 (𝑦 𝑗 − 𝑦 𝑘 ≤ 𝑑 ) Pentagon ±𝑦 𝑗 ≤ 𝑑 𝑝𝑠 (±𝑦 𝑗 ± 𝑦 𝑘 ≤ 𝑑 ) Zones 𝑏 𝑗 𝑦 𝑗 + 𝑏 𝑘 𝑦 𝑘 ≤ 𝑑 , 𝑏 𝑗 ∈ ℤ Octagon 𝑏 1 𝑦 1 + 𝑏 2 𝑦 2 + ⋯+ 𝑏 𝑜 𝑦 𝑜 ≤ 𝑑 , 𝑏 𝑗 ∈ ℤ TVPI Polyhedra Static analysis with precise numerical domains is expensive 2

Domain transformers // abstract program state: { −𝑦 1 − 𝑦 2 ≤ 0, −𝑦 2 ≤ 0, −𝑦 3 − 𝑦 4 ≤ 0 } Octagon // program statement : If ( 𝑦 2 + 𝑦 3 + 𝑦 4 ≤ 1) Best, Trivial, Standard, { −𝑦 1 − 𝑦 2 ≤ 0, −𝑦 2 ≤ { −𝑦 1 − 𝑦 2 ≤ 0, −𝑦 2 ≤ Exponential Constant Quadratic 0, −𝑦 3 − 𝑦 4 ≤ 0 , 𝑦 2 ≤ 0, −𝑦 3 − 𝑦 4 ≤ 0 , 𝑦 3 + {} 1, 𝑦 3 + 𝑦 4 ≤ 1, −𝑦 1 ≤ 1 } 𝑦 4 ≤ 1 } Best abstract transformers for even less precise domains are expensive 3

Online decomposition Octagon 𝜌 ℐ′ ℐ 𝜌 ℐ ℐ′ Numerical domain analysis can be made faster through online decomposition { −𝑦 1 − 𝑦 2 ≤ 0 , { −𝑦 1 − 𝑦 2 ≤ 0 , { 𝑦 1 , 𝑦 2 } { 𝑦 1 , 𝑦 2 } −𝑦 2 ≤ 0 } −𝑦 2 ≤ 0 } If( 𝑦 2 + 𝑦 3 + 𝑦 4 ≤ 1) { −𝑦 3 − 𝑦 4 ≤ 0 , { −𝑦 3 − 𝑦 4 ≤ 0 } { 𝑦 3 , 𝑦 4 } { 𝑦 3 , 𝑦 4 } 𝑦 3 + 𝑦 4 ≤ 1 } Decomposing standard Octagon analysis ([PLDI 2015]) • Decomposing standard Polyhedra analysis ([SAS 2003, POPL2017]) • 4

Limitations of prior work Numerical abstract domains and their transformers • ad hoc design • guided by cost precision tradeoff • tailored for specific use cases • Drawback: Prior work cannot be reused for new domain transformers Required: Universal construction for decomposing numerical domains 5

Contributions Decomposed Our decomposed analysis Original • Significantly fast 32 vars Abstract • Always sound 3 vars element + Black box • Monotonic Under practical Transformer construction 28 vars • Precise conditions 80 vars 17 vars Complete end-to-end implementation Benchmark: >30K LOC, >550 vars • Polyhedra Analysis Poly Oct Zones • Octagon Original 6142 s 28 s 3 s • Zones Decomposed 4.4 s 1.9 s 1.5 s elina.ethz.ch 6

Requirements on numerical abstract domains • An abstract element ℐ in domain 𝒠 is conjunction of finite number of • The concretization function 𝛿 for 𝒠 should be meet preserving representable constraints 𝛿 ( ℐ ∩ 𝒦 ) = 𝛿(ℐ) ∩ 𝛿 ( 𝒦 ) ℐ ⊑ ℐ′ ⟺ 𝛿(ℐ) ⊆ 𝛿(ℐ′) • The ordering of abstract elements in the domain satisfies: 7

Partitioning variable set Octagon partition 𝜌 ℐ partition ത 𝜌 ℐ ℐ ℐ Finest unique A permissible An invalid { −𝑦 1 − 𝑦 2 ≤ 0 } { 𝑦 1 , 𝑦 2 } { −𝑦 1 − 𝑦 2 ≤ 0 } { 𝑦 1 , 𝑦 2 } { 𝑦 1 , 𝑦 3 } partition { 𝑦 3 ≤ 0 } { 𝑦 3 } { 𝑦 3 ≤ 0 , 𝑦 4 ≤ 0 } { 𝑦 3 , 𝑦 4 } { 𝑦 2 } { 𝑦 4 ≤ 0 } { 𝑦 4 } { 𝑦 4 } Expensive to maintain finest partitions thus online decomposition • maintains permissible partitions 8

Decomposable transformers { 𝑦 1 + 𝑦 2 ≤ 0} { 𝑦 1 , 𝑦 2 } Polyhedra { 𝑦 3 + 𝑦 4 ≤ 5} { 𝑦 3 , 𝑦 4 } //abstract program state: //program statement: If ( 𝑦 5 + 𝑦 6 ≤ 0) 𝜌 ℐ′′ ത ℐ′′ Decomposable Non-decomposable ℐ′ { 𝑦 1 , 𝑦 2 } { 𝑦 1 + 𝑦 2 + 𝑦 3 + 𝑦 4 + 𝑦 5 + 𝑦 6 ≤ 5 } { 𝑦 1 + 𝑦 2 ≤ 0 } 𝜌 ℐ′ { 𝑦 1 , 𝑦 2 , 𝑦 3 , 𝑦 4 , 𝑦 5 , 𝑦 6 } ത { 𝑦 3 + 𝑦 4 ≤ 5 } { 𝑦 3 , 𝑦 4 } { 𝑦 5 + 𝑦 6 ≤ 0 } { 𝑦 5 , 𝑦 6 } 9

Decomposable transformers Decomposed Non-decomposed Black box transformer transformer construction Design from scratch Conditional • Assignment • • Meet Join • • Widening 10

Conditional Transformer Definition: Let ℐ be an abstract element in domain 𝒠 with the associated Polyhedra permissible partition ത 𝜌 ℐ and σ 𝑏 𝑗 𝑦 𝑗 ≤ 𝑑 be the conditional statement then, ℬ 𝑑𝑝𝑜𝑒 : ={ 𝑦 𝑗 ∶ 𝑏 𝑗 ≠ 0 } ℬ 𝑑𝑝𝑜𝑒 := ⋃ 𝒴 𝑙 ∩ℬ 𝑑𝑝𝑜𝑒 ≠∅ 𝒴 𝑙 , 𝒴 𝑙 ∈ ത 𝜌 ℐ ∗ 𝜌 ℐ ത ℐ { 𝑦 1 , 𝑦 2 , 𝑦 3 } { 2𝑦 1 − 𝑦 2 + 4𝑦 3 ≤ 0 } ℬ 𝑑𝑝𝑜𝑒 ∗ If( 𝑦 3 + 𝑦 6 ≤ 0) { 𝑦 1 , 𝑦 2 , 𝑦 3 , 𝑦 6 } { 2𝑦 4 + 3𝑦 5 ≤ 5 } { 𝑦 4 , 𝑦 5 } ℬ 𝑑𝑝𝑜𝑒 ={ 𝑦 3 , 𝑦 6 } { 𝑦 6 } { 𝑦 6 = 1 } 11

Conditional Transformer ℐ 𝑃 := 𝑈 ℐ := 𝑈 𝑑𝑝𝑜𝑒 ℐ ℬ 𝑑𝑝𝑜𝑒 ⋃ ℐ(𝒴 ∖ ℬ 𝑑𝑝𝑜𝑒 ) 𝑒 ∗ ∗ Octagon 𝑑𝑝𝑜𝑒 𝜌 ℐ 𝑃 ≔ {𝒴 𝑙 ∈ ത ത 𝜌 ℐ :𝒴 𝑙 ⋂ℬ 𝑑𝑝𝑜𝑒 = ∅}⋃{ℬ 𝑑𝑝𝑜𝑒 } ∗ ∗ ℐ 𝜌 ℐ ത 𝜌 ℐ 𝑃 ത 𝑈 ℐ 𝑒 𝑑𝑝𝑜𝑒 If( 𝑦 3 ≤ 0) { 𝑦 1 } { 𝑦 1 ≤ 0 } { 𝑦 1 } { 𝑦 1 ≤ 0 } ℬ 𝑑𝑝𝑜𝑒 ={ 𝑦 2 , 𝑦 3 } ∗ { 𝑦 2 + 𝑦 3 ≤ 0 } { 𝑦 2 , 𝑦 3 } { 𝑦 2 + 𝑦 3 ≤ 0, { 𝑦 2 , 𝑦 3 } 𝑦 3 ≤ 0 } 12

Conditional Transformer Theorem: 𝛿(𝑈 𝑑𝑝𝑜𝑒 ℐ ) = 𝛿(𝑈 ℐ ) if for any associated permissible 𝑒 Octagon 𝑑𝑝𝑜𝑒 partition ത 𝜌 ℐ , the output 𝑈 𝑑𝑝𝑜𝑒 (ℐ) satisfies: 𝑈 𝑑𝑝𝑜𝑒 ℐ = ℐ⋃ℐ ′ ⋃ℐ ′′ where ℐ′ is a set of non-redundant constraints between the variables from ℬ 𝑑𝑝𝑜𝑒 only and ℐ ′′ is a set of redundant ∗ • constraints between the variables in 𝒴 𝛿(𝑈 𝑑𝑝𝑜𝑒 ℐ ℬ 𝑑𝑝𝑜𝑒 ) = 𝛿(ℐ(ℬ 𝑑𝑝𝑜𝑒 )⋃ℐ′) ∗ ∗ ℐ 𝜌 ℐ ത 𝑈 𝑑𝑝𝑜𝑒 ℐ ℐ′ • If( 𝑦 3 ≤ 0) { 𝑦 1 } { 𝑦 1 ≤ 0 } {𝑦 3 ≤ 0} { 𝑦 1 ≤ 0, 𝑦 2 + 𝑦 3 ≤ 0, 𝑦 1 + ℬ 𝑑𝑝𝑜𝑒 ={ 𝑦 2 , 𝑦 3 } ℐ′′ ∗ { 𝑦 2 , 𝑦 3 } { 𝑦 2 + 𝑦 3 ≤ 0 } 𝑦 3 ≤ 0, 𝑦 3 ≤ 0 } {𝑦 1 + 𝑦 3 ≤ 0} 𝛿(𝑈 𝑑𝑝𝑜𝑒 ℐ ℬ 𝑑𝑝𝑜𝑒 ) = 𝛿(ℐ(ℬ 𝑑𝑝𝑜𝑒 )⋃ℐ′) = 𝛿 ({ 𝑦 2 + 𝑦 3 ≤ 0, 𝑦 3 ≤ 0 }) ∗ ∗ 13

Refinement • The output partition can be refined after computing the output • non-invertible assignment • join • Allows us to produce finer output partitions than prior work for • Polyhedra • Octagon 14

Experimental Evaluation • Crab-llvm analyzer • intra procedural analysis • analyzes llvm bitcode • Software verification competition benchmarks • linux device drivers • control flow • Polyhedra • n on decomposed transformers from PPL and decomposed from [POPL’17] • Octagon • n on decomposed and decomposed transformers from [PLDI’15] • Zones • Implemented non decomposed transformers 15

Polyhedra Benchmark PPL POPL’17 POPL’18 Speedup vs (s) (s) (s) PPL POPL’17 ∞ net_fddi_skfp 6142 9.2 4.4 1386 2 mtd_ubi MO 4 1.9 2.1 ∞ usb_core_main0 4003 65 29 136 2.2 tty_synclinkmp MO 3.4 2.5 1.4 scsi_advansys TO 4 3.4 >4183 1.2 staging_vt6656 TO 2 0.5 >28800 4 net_ppp 10530 924 891 11.8 1 ∞ p10_l00 121 11 5.4 22.4 2 ∞ MO 11 2.9 3.8 p16_l40 ∞ p12_l57 MO 14 6.5 2.1 ∞ p13_l53 MO 54 25 2.2 16 p19_l59 MO 70 12 5.9

Octagon Benchmark PLDI’15 PLDI’15 POPL’18 Speedup vs ND(s) D(s) (s) ND D net_fddi_skfp 28 2.6 1.9 15 1.4 mtd_ubi 3411 979 532 6.4 1.8 usb_core_main0 107 6.1 4.9 22 1.2 tty_synclinkmp 8.2 1 0.8 10 1.2 scsi_advansys 9.3 1.5 0.8 12 1.9 staging_vt6656 4.8 0.3 0.2 24 1.5 net_ppp 11 1.1 1.2 9.2 0.9 p10_l00 20 0.5 0.5 40 1 8.8 0.6 0.5 18 1.2 p16_l40 p12_l57 19 1.2 0.7 27 1.7 p13_l53 43 1.7 1.3 33 1.3 17 p19_l59 41 2.8 1.2 31 2.2

Zones Benchmark Non Decomposed POPL’18 Speedup (s) (s) net_fddi_skfp 3 1.5 2 mtd_ubi 1.4 0.7 2 usb_core_main0 10.3 4.6 2.2 tty_synclinkmp 1.1 0.7 1.6 scsi_advansys 0.9 0.7 1.3 staging_vt6656 0.5 0.2 2.5 net_ppp 1.1 0.7 1.5 p10_l00 1.9 0.4 4.6 p16_l40 1.7 0.7 2.5 p12_l57 3.5 0.9 3.9 8.7 2.1 4.2 p13_l53 p19_l59 9.8 1.6 6.1 18

Complete end-to-end implementation Benchmark: >30K LOC, >550 vars • Polyhedra Analysis Poly Oct Zones • Octagon Original 6142 s 28 s 3 s • Zones Decomposed 4.4 s 1.9 s 1.5 s elina.ethz.ch 19