The Auspicious Couple: Symbolic Execution Jens Knoop, Laura Kov - PowerPoint PPT Presentation

The Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, The Auspicious Couple: Symbolic Execution Jens Knoop, Laura Kov´ acs, and WCET Analysis Jakob Zwirchmayr Motivation Armin Biere, Jens Knoop, Laura Kov´ acs, Jakob Zwirchmayr Introduction Symbolic Execution in TU Vienna, JKU Linz r-TuBound Symbolic Execution July 9, 2013 without Path Explosion Conclusion 1 / 23

The WCET Analysis Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Jens Knoop, WCET Analysis Laura Kov´ acs, ◮ mandatory for safety-critical real-time systems Jakob Zwirchmayr Computed WCET bounds Motivation ◮ must be safe Introduction ◮ shall be tight Symbolic Execution in r-TuBound Problem Symbolic Execution ◮ precise knowledge about the program without Path Explosion Conclusion 2 / 23

The Symbolic Execution Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Symbolic Execution Jens Knoop, Laura ◮ use symbolic instead of concrete data Kov´ acs, Jakob Zwirchmayr Control-flow split (branch) Motivation ◮ follow both paths Introduction ◮ assume respective condition Symbolic Execution in r-TuBound Problem: path explosion Symbolic ◮ unbounded loops Execution without Path Explosion ◮ number of conditionals Conclusion 3 / 23

The Our Remedy Auspicious Couple: Symbolic Execution and WCET Analysis Combine symbolic execution and WCET analysis as a remedy Armin Biere, Jens Knoop, Laura WCET analysis guides symbolic execution Kov´ acs, Jakob ◮ select only WCET relevant parts Zwirchmayr Motivation Symbolic execution infers precise information Introduction ◮ for relevant parts Symbolic Execution in r-TuBound Partial vs full symbolic coverage Symbolic ◮ full symbolic coverage often infeasible in practice Execution without Path Explosion Partial coverage often good enough to improve the WCET estimate Conclusion 4 / 23

The r-TuBound Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Jens Knoop, Laura Kov´ acs, Jakob Zwirchmayr Motivation Introduction Symbolic Execution in r-TuBound Symbolic Execution without Path Explosion Conclusion 5 / 23

The Symbolic Execution: SmacC Auspicious Couple: Symbolic SmacC Execution and WCET ◮ SMT representation of the program (BV, arrays) Analysis ◮ select paths via path-expressions Armin Biere, Jens Knoop, Laura Exact analysis Kov´ acs, Jakob Zwirchmayr Motivation Introduction Symbolic Execution in r-TuBound Symbolic Execution without Path Explosion Conclusion Full symbolic coverage requires execution of all paths! 6 / 23

The Symbolic Execution in r-TuBound Auspicious Couple: Symbolic Execution and WCET Analysis 1) on selected program fragments Armin Biere, Jens Knoop, ◮ check properties on conditional updates to the loopcounter Laura Kov´ acs, Jakob ◮ if successful, loop bound computation safe Zwirchmayr 2) on single loops Motivation Introduction ◮ only if all other techniques fail Symbolic Execution in 3) on single paths r-TuBound Symbolic ◮ as post-process, after initial WCET anlysis Execution without Path ◮ symbolically check feasibility of WCET path Explosion Conclusion = Selective Symbolic Execution 7 / 23

The Architecture Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Jens Knoop, Laura Kov´ acs, Jakob Zwirchmayr Motivation Introduction Symbolic Execution in r-TuBound Symbolic Execution without Path Explosion Conclusion 8 / 23

The Analyzing Program Fragments Auspicious Couple: Symbolic Execution and WCET Conditional update to loop counter i prevents bound calculation Analysis Armin Biere, Jens Knoop, ◮ verify that updates strictly int main ( int flag ) { Laura Kov´ acs, int i ; increase(decrease) i Jakob for ( i = 0 ; i < 5 ; i + +) Zwirchmayr if ( i == 4 && flag ) { ◮ can check arbitrary i = 0 ; Motivation expressions (in flag = 0 ; Introduction } bitvectors/array theory) } Symbolic Execution in r-TuBound Success Symbolic Execution ◮ apply bound computation without Path Explosion ◮ (combined minimal update) Conclusion Fails for example 9 / 23

The Loop Bounds via Symbolic Execution Auspicious Couple: Symbolic Execution and WCET (r-)loopbounds fails to compute a loop bound Analysis Armin Biere, only then Jens Knoop, Laura ◮ apply exhaustive symbolic execution of the loop Kov´ acs, Jakob Zwirchmayr The loop + required decls + additional analysis information Motivation ◮ = reduced program Introduction ◮ example: program = reduced program Symbolic Execution in r-TuBound Symbolically execute reduced program Symbolic Execution ◮ with initial bound 0 without Path Explosion ◮ increase bound while loop cond is SAT in last iteration Conclusion Example: loop bound 9 10 / 23

The Precise WCET Bounds Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Jens Knoop, Laura a.k.a WCET Squeezing Kov´ acs, Jakob ◮ post-proces for IPET based WCET analyzer Zwirchmayr ◮ allows to tighten WCET estimates Motivation Introduction ◮ ultimately prove WCET bounds precise Symbolic Execution in Is a combination of WCET analysis and symbolic execution r-TuBound Symbolic ◮ overcomes problems inherent in both approaches! Execution without Path Explosion Conclusion 11 / 23

The Problems of the Approaches Auspicious Couple: Symbolic Execution and WCET Analysis Armin Biere, Jens Knoop, Laura Kov´ acs, Jakob Zwirchmayr Symbolic Execution deficiency: path explosion (doesn’t scale due to exponential number of paths) Motivation Introduction IPET deficiency: considers little information about the program Symbolic (flow-facts) Execution in r-TuBound Symbolic Execution without Path Explosion Conclusion 12 / 23

The Some Remedy Auspicious Couple: Symbolic Execution and WCET Analysis Combine IPET and Symbolic Execution for mutual Armin Biere, Jens Knoop, benefit! Laura Kov´ acs, extract path from ILP result and symbolically execute it Jakob Zwirchmayr Motivation Introduction Symbolic Execution in r-TuBound Symbolic Execution without Path Explosion Conclusion 13 / 23

The Some Remedy Auspicious Couple: Symbolic Execution and WCET Analysis Combine IPET and Symbolic Execution for mutual Armin Biere, Jens Knoop, benefit! Laura Kov´ acs, extract path from ILP result and symbolically execute it Jakob Zwirchmayr Path explosion: Motivation ◮ less severe, initially examine only one path Introduction Symbolic Lack of information: Execution in r-TuBound ◮ rule out infeasible paths using precise symbolic execution Symbolic Execution ◮ by deriving new ILP constraints without Path Explosion Conclusion Requires an initial WCET analysis 13 / 23

The Squeezing in a Nutshell Auspicious Couple: Symbolic in: ILP problem (from IPET), out wcet bound Execution and WCET Analysis 1. solve ILP problem Armin Biere, Jens Knoop, Laura 2. extract “abstract” WCET path candidates from ILP Kov´ acs, Jakob Zwirchmayr 3. compute “concrete” path(s) encoded by abstract path Motivation 4. symbolically execute concrete path(s) Introduction Symbolic 5. use result of execution to refine ILP problem or stop: Execution in r-TuBound 5.1 path feasible: done (path is indeed WCET path) Symbolic Execution without Path 5.2 infeasible: refine ILP, goto 2 Explosion Conclusion On termination: ◮ precise WCET bound (wrt the HW-model) ◮ optional: timeout, threshhold 14 / 23

The Expected Results Auspicious Couple: Symbolic Execution and WCET Analysis Refined WC path is feasible: Armin Biere, Jens Knoop, ◮ real WCET-path, overestimation due to hardware modelling Laura Kov´ acs, Jakob ◮ precise bound Zwirchmayr Refined WC path is infeasible + TO: Motivation Introduction ◮ some improvement after a few iteration Symbolic ◮ estimate tightened Execution in r-TuBound Symbolic ILP WC path is feasible: Execution without Path ◮ no gain in precision Explosion Conclusion ◮ precise bound 15 / 23

The Example Auspicious Couple: Symbolic Execution and WCET Loop bound = 9 Analysis Armin Biere, ◮ analyze example with r-TuBound Jens Knoop, Laura ◮ yields WCET estimate + ILP solution Kov´ acs, Jakob (computed from generated ILP problem) Zwirchmayr Motivation ILP Introduction ◮ problem: constraints on execution frequencies Symbolic Execution in ◮ solution: valid execution frequencies of blocks r-TuBound ◮ example: execution frequency of then -block = 9 Symbolic Execution without Path Explosion The solution is INFEASIBLE Conclusion ◮ no such concrete execution exists ◮ therefore, WCET bound is an over-estimation 16 / 23