From Array Domains to Abstract Interpretation Under - PowerPoint PPT Presentation

From Array Domains to Abstract Interpretation Under Store-Buffer-Based Memory Models Thibault Suzanne, Antoine Miné Static Analysis: 23rd International Symposium, SAS 2016 September, 2016, Edinburgh, UK Pirmin Schmid Seminar Software Engineering December 7, 2016 1

De quoi s’agit-il? • New abstract interpretation of concurrent programs • Setting: Weak memory consistency • Model: store-buffer (FIFO) of infinite size • including theoretical model, proof and working implementation (OCaml) 2

Memory models in Hardware and Languages • Strong consistency core 0 core 1 core 2 core 3 cache(s) cache(s) cache(s) cache(s) shared cache(s) RAM 4

Memory models in Hardware and Languages • Weak consistency core 0 core 1 core 2 core 3 cache(s) cache(s) cache(s) cache(s) shared cache(s) RAM 5

Memory models in Hardware and Languages • Weak consistency. TSO: total store ordering (x86) core 0 core 1 Array buffer FIFO pipeline shared memory 6

Memory models in Hardware and Languages • Weak consistency. TSO: total store ordering (x86) What can it see? core 0 core 1 initial, shared X=0; Y=0 1: X = 1 2: Y = 2 3: shared memory (X=0; Y=0) 7

Memory models in Hardware and Languages • Weak consistency. TSO: total store ordering (x86) core 0 core 1 initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3: shared memory 8

Memory models in Hardware and Languages • Weak consistency. TSO: total store ordering (x86) core 0 core 1 initial, shared X=0; Y=0 1: X = 1 X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3: shared memory 9

Memory models in Hardware and Languages • Weak consistency. TSO: total store ordering (x86) What can it see? core 0 core 1 initial, shared X=0; Y=0 1: X = 1 Y = 2 1b: ? flush 2: Y = 2 X = 1 2b: ? flush 3: shared memory 10

Memory models in Hardware and Languages • Weak consistency. PSO: partial store ordering (ARM) What can it see? core 0 core 1 initial, shared X=0; Y=0 1: X = 1 X: Y: 1b: ? flush 2: Y = 2 2b: ? flush 3: shared memory 11

Memory models in Hardware and Languages • Weak consistency. PSO: partial store ordering (ARM) core 0 core 1 initial, shared X=0; Y=0 1: X = 1 X: Y: 1b: ? flush 2: Y = 2 1 2b: ? flush 3: shared memory 12

Memory models in Hardware and Languages • Weak consistency. PSO: partial store ordering (ARM) What can it see? core 0 core 1 initial, shared X=0; Y=0 1: X = 1 X: Y: 1b: ? flush 2: Y = 2 1 2 2b: ? flush 3: shared memory 13

Memory models in Hardware and Languages • Weak consistency. PSO: partial store ordering (ARM) What can it see? core 0 core 1 initial, shared X=0; Y=0 1: X = 1 X: Y: 1b: ? flush 2: Y = 2 1 2 2b: ? flush 3: fence 4: shared memory 14

Verification: Model checkers • Promela / spin • Scyther: crypto protocols • Limitation: only finite state space • State space explosion 15

Verification: Abstract interpretation. SC 16

Verification: Abstract interpretation. Dan et al. 17

Verification: Abstract interpretation. This study 18

Comparison buffer size n ∞ m Model Checker ----- state size ∞ Dan et al. This study 19

PSO model: concrete domain thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 20

PSO model: concrete domain thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 21

PSO model: concrete domain thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 22

PSO model: concrete domain thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 23

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 24

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 25

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 =e z 12 x 21 y 21 x 22 z 22 x 31 y 31 x 32 z 32 x 41 x 51 shared: x mem , y mem , z mem 26

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 x 32 z 32 x 41 x 51 shared: x mem , y mem , z mem 27

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 x 32 z 32 x 41 x 51 shared: x mem , y mem , z mem 28

PSO model: concrete semantics thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 x 22 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 29

Abstraction: handling ∞ • Key insight: summarize and partition. 𝛽 "#$ : thread 1 thread 2 x 11 y 11 x 12 z 12 x 21 y 21 z 22 x 31 y 31 z 32 x 41 x 51 shared: x mem , y mem , z mem 32

Abstraction: handling ∞ • Key insight: summarize and partition. 𝛽 "#$ : thread 1 thread 2 x 11 y 11 x 12 z 12 x bot1 y bot1 z bot2 shared: x mem , y mem , z mem 33

Abstraction: handling ∞ • Key insight: summarize and partition. 𝛽 "#$ : thread 1 thread 2 x 11 y 11 x 12 z 12 ∞ solved x bot1 y bot1 z bot2 cost: loosing precision shared: x mem , y mem , z mem 34

Abstraction: partial buffer state information thread 1 thread 2 x 11 y 11 x 12 z 12 x bot1 y bot1 z bot2 shared: x mem , y mem , z mem 35

Abstraction: partial buffer state information thread 1 thread 2 x 11 y 11 x 12 z 12 x bot1 y bot1 z bot2 2 steps: 1) summarize 2) resolve partition shared: x mem , y mem , z mem 36

Abstract transformers 37

Abstract transformers on partitions {.} 38

Abstract transformers on partitions {.} 39

Abstract transformers [[.]] using the {.} 40

Abstraction: partial buffer state information thread 1 thread 2 x 11 y 11 x 12 z 12 x bot1 y bot1 z bot2 2 steps: 1) summarize 2) resolve partition shared: x mem , y mem , z mem 41

My own code example 42

Result PSO 43

My own code example with fences 44

Result with fences 45

Code example from paper 46

Benchmark 47

Benchmark 48

Benchmark 49

Benchmark 50

Benchmark 51

Discussion • Good things • Limitations • Suggested improvements 52

Acknowledgment • Thibault Suzanne for the VM with the working analyzer • Andrei Dan for interesting discussion 53