Synthesis of Synchronization using Uninterpreted Functions* October - PowerPoint PPT Presentation

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Synthesis of Synchronization using Uninterpreted Functions* October 22, 2014 Roderick Bloem, Georg Hofferek, Bettina Könighofer, Robert Könighofer, Simon Außerlechner, and Raphael Spörk * This work was supported in part by the Austrian Science Fund (FWF) through the national research network RiSE (S11406-N23) and the project QUAINT (I774-N23). u www.iaik.tugraz.at u www.iaik.tugraz.at

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions 2 What is Synthesis?   Specification: What? Implementation: How?  Walk to Moserhofgasse  From: Graz, Synthesis  Tram 6 to Jakominiplatz Inffeldgasse  Buy tram ticket  To: Lausanne, 6pm  Tram 3 to train station Graz  Buy train ticket  Train to Salzburg  Train to Zürich  Train to Launsanne  Walk to Lausanne Fon FMCAD  And so on … FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions 3 What is Synthesis?   Specification: What? Implementation: How?  Walk to Moserhofgasse  From: Graz, Synthesis  Tram ??? to Jakominiplatz Inffeldgasse  Buy tram ticket  To: Lausanne, 6pm  Tram 3 to train station Graz  Buy train ticket  Train to ???  Train to Zürich  Train to Launsanne  Walk to Lausanne Fon FMCAD  And so on … FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Concurrent Programs 4 Functionality: Concurrent Correctness:   Hard to specify Easy to specify   Same result Easy to implement   Implement manually Hard to implement  Synthesize Vision: Same Results Sequentially Parallel Synthesizing Correct Code Code Compiler Programmer FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Synthesizing Atomic Sections 5 Example:  RSA decryption using Chinese Remainder Theorem  Goal: m = c d mod (p*q)  Faster: m p = c d mod p m q = c d mod q m = crt(m p , m q )  Parallelization: thread2() { thread1() { 11 1 m q := c d mod q; m p := c d mod p; 12 2 fin 2 := true; fin 1 := true; 13 3 if(!merged && fin 1 ) if(!merged && fin 2 ) 14 4 merged := true; merged := true; 15 5 m p := crt(m p , m q ); m p := crt(m p , m q ); 16 6 } } 17 7 FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Flow 6 Counterexample Atomic Program Analysis Sections Abstraction SMT Encoding Verification Synchronized Program FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Abstraction 7 Challenge: Complicated arithmetic  Synchronization should not depend on arithmetic   Abstract using uninterpreted functions thread2() { thread1() { 11 1 m q := c d mod q; m p := c d mod p; 12 2 fin 2 := true; fin 1 := true; 13 3 if(!merged && fin 1 ) if(!merged && fin 2 ) 14 4 merged := true; merged := true; 15 5 m p := crt(m p , m q ); m p := crt(m p , m q ); 16 6 } } 17 7 FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Abstraction 8 Challenge: Complicated arithmetic  Synchronization should not depend on arithmetic   Abstract using uninterpreted functions  All arithmetic operations: +,- ,*, …  Calls of functions without side-effects thread2() { thread1() { 11 1 m q := f me (c, d, q) ; m p := f me (c, d, p) ; 12 2 fin 2 := true; fin 1 := true; 13 3 if(!merged && fin 1 ) if(!merged && fin 2 ) 14 4 merged := true; merged := true; 15 5 m p := f crt (m p , m q ) ; m p := f crt (m p , m q ) ; 16 6 } } 17 7 FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Flow 9 Counterexample Atomic Program Analysis Sections Abstraction SMT Encoding Verification Synchronized Program FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions SMT Encoding 10  Implicit specification  result(Thread1 || Thread2) = result(Thread1 ○ Thread2) or result(Thread2 ○ Thread1)  result(): global variables at termination  Often called “ serializability ” or “ linearizability ”  Construct SMT formula:  incorrect(inputs, scheduling)  Satisfying assignment = incorrect execution  Approach based on Bounded Model Checking [CAV’05]  Loops are unrolled  Function calls are inlined (or abstracted) FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Flow 11 Counterexample Atomic Program Analysis Sections counterexample SMT Solver SMT Abstraction SMT Encoding Verification UNSAT Synchronized Program FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Counterexample Analysis: 12 Method 1 [POPL’10]  Eliminate counterexample: Thread 1 Thread 2  Atomic section at 𝑩 ∨ 𝑪 Line A Line B Line C (end of T1)  FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Counterexample Analysis: 13 Method 1 [POPL’10] Iteration 2:  Eliminate counterexample: Thread 1 Thread 2  Atomic section at 𝑩 ∨ 𝑪 Line A  Atomic section at 𝑩 ∨ 𝑬 Line D Line C (end of T1)  FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Counterexample Analysis: 14 Method 1 [POPL’10] Iteration 3:  Eliminate counterexample: Thread 1 Thread 2  Atomic section at 𝑩 ∨ 𝑪  Atomic section at 𝑩 ∨ 𝑬   Minimal satisfying assignment   Atomic section at 𝑩 No more counterexamples FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Counterexample Analysis: 15 Method 2  Start with last (non-mandatory) Thread 1 Thread 2 thread switch B Line A  Can we build a valid run from B on? Line B Line C (end of T1)  FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Counterexample Analysis: 16 Method 2  Start with last (non-mandatory) Thread 1 Thread 2 thread switch B Line A  Can we build a valid run from B on?  No? Problem already before Line B  Investigate A in the same way  Yes? B is suspicious.  Add atomic section at B  This is a heuristic!  May not find the minimal solution  FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Flow 17 Counterexample Atomic Program Analysis Sections counterexample SMT Solver SMT Abstraction SMT Encoding Verification UNSAT Synchronized Program FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Experimental Results 18  Prototype tool for (simple) C programs  Toy examples:  linEq:  Given: linear equation 4a + 3b + 9c -4d = 6  Given: assignment a=100, b=0, c=3, d=12  Program performs parallelized check  Abstraction: +,*  f + (), f * ()  VecPrime:  Counts prime numbers in a vector  Abstraction: isPrime()  f p () FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Experimental Results: Toy Examples 19 Speedup due to Abstraction With abstraction (UIF) [sec] 1000 Method 1 Method 2 100 Average speedup factor: 10 110 not counting time-outs 160 when counting time-outs 1 1 10 100 1000 Without abstraction [sec] FMCAD 2014 Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Experimental Results 20  Real-world examples:  CVE-2014-0196 bug in Linux TTY driver  Race condition can produce buffer overflow FMCAD 2014 Lausanne, October 22

int tty_size; Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions int tty_offset; int OPOST_tty; int STATE = 1; Experimental Results void thread1() { 21 int c = 0; int nr = 22; int b = 77; int true_int = 1; while(true_int == 1) { if(OPOST_tty) {  STATE = 2; Real-world examples: while(nr > 0) { int num = nr + 3;  CVE-2014-0196 bug in Linux TTY driver b = b + num; nr = nr - num; if(nr != 0){  Race condition can produce buffer overflow c = b; b = b + 1; nr = nr - 1; } } } else { STATE = 3; while(nr > 0) { atomic section int tmpOffset = tty_offset ; int tty_space_left = tty_size - tmpOffset; if( tty_space_left - nr >= 0 ) c = nr; else c = tty_space_left; tmpOffset = tty_offset; tmpOffset = tmpOffset + c; tty_offset = tmpOffset; if(c>0){ b = b + c; nr = nr - c; } } } } FMCAD 2014 } Lausanne, October 22

Robert Könighofer Synthesis of Synchronization using Uninterpreted Functions Experimental Results 22  Real-world examples:  CVE-2014-0196 bug in Linux TTY driver  Race condition can produce buffer overflow  Race condition in iio-subsystem of linux-kernel  Variable that counts the number of running threads  Race condition in broadcom tigon3 ethernet driver  Statistics can get inconsistent FMCAD 2014 Lausanne, October 22