Efficient Decision Procedure for Bounded Integer Non-linear Operations using SMT( LIA LIA ) Oct 28, 2008 Malay Ganai System Analysis & Verification Group NEC Labs America Princeton, U. S. A.
2 � Existing Approaches � Our Approach � Experiments � Conclusions � Motivation Outline
Motivation � Theory of non-linear operations: un-decidable, in general – imprecise formulation and/or incomplete reasoning adopted � Non-linear integer operations on program variables occur sparingly in application programs – multiplication, divide, left and right shifts, mod, bitwise � Overflow and Underflow are not used as a programming feature typically – signed over/under flow not defined (C99/C++98 standard) – programmers avoid them due to portability reasons • more interested in detection: knowing if overflow/underflow occurs • less interested in casualties: knowing how overflow/underflow affects – exploited by most static analysis methods (abstract interpretation) • soundness results depend on un-boundedness of variables 3
Existing Approaches (1/2) � Encoding: Bit-blasting, Solver: Boolean SAT – Both operands bounded – Bit-blasting linear integer arithmetic can lead to large formula – Arithmetic semantics is “lost” in such encoding – For eg: CBMC � Encoding: Bit-vector Arithmetic, Solver: SMT( BV ) – Preprocessor followed by a Boolean SAT – overflow/underflow handled specific to machines architecture – precision/scalability trade-off? – For eg: Calysto (Program Analysis) using Spear � Abstractions/Refinement – Iterative steps • SAT solver on (under-approx) bounded data paths, • an abstraction on UNSAT core, followed by • a refinement guided by Presburger/SAT solver – No incremental formulation • each problem solved and generated separately – For eg: ASAP , DP for bit-vector using abstraction 4
Existing Approaches (2/2) � Encoding: Booleanization, Solver: SMT( LIA ) – Naïve encoding for non-linear multiplications, bit-wise operations – Booleanization followed by Linearization Given integer x ∈ [0,2 N ) Introduce integer-vars x k = [0,1] for 0 ≤ k ≤ N-1 − N 1 = ∑ ∗ k Bitwise Relational x Linear Constraint 0 2 x k c Decomposition (BRD) = k ∏ = == Boolean Constraint B ( 1 ) x k k k Boolean vector: B N-1 … B k … B 0 representing x – No guidance to SMT( LIA ) ’ s as it is not explicitly related to x • Solver has to guess B k – For eg: MathSat 5
Our Approach: Highlights � Better Encoding (over BRD) – Bit-wise structural decomposition (BSD) • Structural relationship between a variable and its decomposition provides better guidance to solver – Linearize multiplier, divide, mod, shifts – Linearization criteria • rules to select non-linear operand for BSD. � Lazy Bound Refinement ( LBR ) algorithm – Incremental formulation using under and over-approximations • Successive refined problems are solved incrementally – Refinement step • tighten bounds for un-decomposed variables (X variables) • relax bounds for decomposed variables (Y variables) – Exploits SMT( LIA ) solvers’ incremental solving capability • assertion/retraction of bound constraints are typically supported 6
Our Approach: Overview Linear Arithmetic Constraints LBR SMT( NLIA NLIA ) SMT( LIA LIA ) Boolean combination DP: Encoding + LBR LBR of Non-Linear + Linear Solver Integer Arithmetic on bounded integers “Linearize” Integer Non-linear Operations ( ∗ , /, %, <<, >>, &, ||, ⊗ ) 7
Linearization (multiplier) � MULT: z = u ∗ v, with u,v unsigned integer (u ≥ 0, v>0 ) � Select u for Boolean decomposition, U N-1 … U 0 0 = 0 r Initialize ≤ ≤ − = + ∗ k 0 k N 1 ITE ( , v , 0 ) r r U 2 + Partial Sum k 1 k k C = z Final result r N u < = ∗ = ∗ N ( ) z u v u v 2 if Linearized Multiplier: L � z = x ∗ y, with x,y signed integer = < − ( 0 , , ) u ITE x x x = < − v ITE ( y 0 , y , y ) = ∗ w u v L = < ⊗ < − z ITE ( y 0 x 0 , w , w ) 8
Linearization (divide, mod) � DIV: d = u/v, with u ≥ 0,v>0 (general case similar to multiplier) � MOD: r=u%v, with u ≥ 0,v>0 (general case similar to multiplier) − + ≤ ≤ ∗ t u v 1 t v u is integer-var Bounding Constraint L = < == == d ITE ( u v , 0 , ITE ( u v , 1 , ITE ( v 1 , u , t ))) DIV = < == == − r ITE ( u v , u , ITE ( u v , 0 , ITE ( v 1 , 0 , u t ))) MOD 9
Linearization (bit-wise operation) � z = u bop v, with u,v unsigned integer, bop ∈ {&,||, ⊗ } � U N-1 … U 0 and V N-1 … V 0 are bit decomposition of U and V , resp. 0 = 0 r Initialize ≤ ≤ − = + k 0 k N 1 ITE ( , , 0 ) r r U V 2 + bop Partial Sum k 1 k k k = z Final result r N 10
Lazy Bounding and Refinement ( LBR LBR ): Overview � Input – Formula: SMT( LIA ) φ L (linearized formula) – Partition term sets: • X = {x 1 . … x n } terms not bit-decomposed • Y = {y 1 . … y m } terms bit-decomposed – Bounding constraints: -2 N ≤ x i ,y j < 2 N � Incremental Formulation – Do not re-encode the linearized formula φ L – Use assert/retract procedures of the SMT( LIA ) solver to tighten/relax bounding constraints � Start y j variables with small bound, relax as needed – -b(y j ) ≤ y j < b(y j ), with b(y j ) = 2 β , 0< β≤ N – predicates B k (k th bit of y j ) gets simplified to false for k ≥β – increase β as required � Start x i variables with no bounds, tighten as needed – add constraints -2 N ≤ x i < 2 N as needed 11
LBR Algorithm (flow) LBR SMT_Init ( φ L ) Linearized SMT(LIA) : φ L = ∀ ∈ ( ) 1 b y y Y Partition term-sets: X,Y = Φ = Y ; Y X b b Relax Bound SMT_Assert ( φ Xb ) ← ∗ ∀ ∈ b ( y ) 2 b ( y ) SMT_Assert ( φ Yb ) y Y b Tighten Bound ∧ = − ≤ < ϕ X b ← X b’ ( ( ) ( )) b y y b y ∈ Yb y Yb ∧ = − ≤ < ϕ N N SMT_Retract ( φ Yb ) ( x ) 2 2 ∈ X b x X b = ∧ ∈ − ≤ < ϕ N ( b ( y ) y b ( y )) Yb y Yb Y N Y SMT_Check Bound Relax Tighten X b’ =X b ? SAT Y b = ∅ ? Bound UNSAT X b’ := X b ∪ Y b := { y | - b(y) ≤ y or b(y) < y ) Y N { x | -2 N > α (x) SAT? cause for UNSAT or 2 N ≤ α (x) } with b(y) < 2 N } α : sat assgn 12
LBR LBR : Termination and Correctness � Theorem 1: LBR always terminates It requires O( n+N.m ) iterations where – n is the number of X variables, – m is the number of Y variables – [-2 N ,2 N ) is the system bound � Theorem 2: LBR decides correctly Let φ all be φ L with -2 N ≤ x i ,y j < 2 N Let φ i be the formula at i th iteration when LBR terminates – Claim: φ all satisfiable iff φ i is satisfiable. 13
Linearization Criteria (LC) � Given z = u ∗ v, prefer u over v as per following rules � R1: u is an input operand to more MULT – to reduce number of operands considered for bit decomposition � R2: u has a fewer MULT in its transitive input – to reduce bound relaxing refinements � R3: u has lower bound size – to reduce bound relaxing refinements Candidate-sets Apply LC Example for decomposition = { , } w 2 =u 1 ∗ w 1 Y u u w 3 =u 2 * u 3 a 1 2 ∗ = ∗ { , } w u Y w 1 =u 2 * u 2 b 1 2 ∗ = { , , } Y u u u c 1 2 3 = { , , } Y w u u d 1 2 3 u 1 u 2 u 2 u 3 14
Linearization Criteria (LC) � Given z = u ∗ v, prefer u over v as per following rules � R1: u is an input operand to more MULT – to reduce number of operands considered for bit decomposition � R2: u has a fewer MULT in its transitive input – to reduce bound relaxing refinements � R3: u has lower bound size – to reduce bound relaxing refinements Candidate-sets Apply LC Example for decomposition = { , } w 2 =u 1 ∗ w 1 Y u u w 3 =u 2 * u 3 a 1 2 ∗ = ∗ { , } w u Y w 1 =u 2 * u 2 b 1 2 ∗ = { , , } Y u u u c 1 2 3 = { , , } Y w u u d 1 2 3 u 1 u 2 u 2 u 3 15
Linearization Criteria (LC) � Given z = u ∗ v, prefer u over v as per following rules � R1: u is an input operand to more MULT – to reduce number of operands considered for bit decomposition � R2: u has a fewer MULT in its transitive input – to reduce bound relaxing refinements � R3: u has lower bound size – to reduce bound relaxing refinements Candidate-sets Apply LC Example for decomposition = { , } w 2 =u 1 ∗ w 1 Y u u w 3 =u 2 * u 3 a 1 2 ∗ = ∗ { , } w u Y w 1 =u 2 * u 2 b 1 2 ∗ = { , , } Y u u u c 1 2 3 = { , , } Y w u u d 1 2 3 u 1 u 2 u 2 u 3 16
Linearization Criteria (LC) � Given z = u ∗ v, prefer u over v as per following rules � R1: u is an input operand to more MULT – to reduce number of operands considered for bit decomposition � R2: u has a fewer MULT in its transitive input – to reduce bound relaxing refinements � R3: u has lower bound size – to reduce bound relaxing refinements Candidate-sets Apply LC Example for decomposition = { , } w 2 =u 1 ∗ w 1 Y u u w 3 =u 2 * u 3 a 1 2 ∗ = ∗ { , } w u Y w 1 =u 2 * u 2 b 1 2 ∗ = { , , } Y u u u c 1 2 3 = { , , } Y w u u d 1 2 3 u 1 u 2 u 2 u 3 17
Recommend
More recommend
