Verifying Multithreaded Software with Impact Bj orn Wachter , - PowerPoint PPT Presentation

Verifying Multithreaded Software with Impact Bj¨ orn Wachter , Daniel Kroening and Jo¨ el Ouaknine University of Oxford

Intro • Multi-threading • C/C++ with POSIX/WIN 32 threads • event processing, device drivers, web servers, databases, ... • coming to embedded systems • Verification Challenges Multi threading WMM SC data variables pointers loops 2 / 20

Intro • Multi-threading • C/C++ with POSIX/WIN 32 threads • event processing, device drivers, web servers, databases, ... • coming to embedded systems • Verification Challenges Multi threading WMM SC data variables pointers loops symbolic reasoning SMT SAT 2 / 20

Intro • Multi-threading • C/C++ with POSIX/WIN 32 threads • event processing, device drivers, web servers, databases, ... • coming to embedded systems • Verification Challenges Multi threading WMM SC data variables pointers loops symbolic reasoning SMT abstraction SAT predicate abstraction Impact algorithm [McMillan 2006] 2 / 20

Intro • Multi-threading • C/C++ with POSIX/WIN 32 threads • event processing, device drivers, web servers, databases, ... • coming to embedded systems • Verification Challenges Multi threading WMM partial orders SC modular reasoning data variables pointers loops symbolic reasoning SMT abstraction SAT predicate abstraction Impact algorithm [McMillan 2006] 2 / 20

Software model checkers CBMC SatAbs Threader ESBMC Kratos Impact SLAM LLBMC Blast UFO CPAChecker Ultimate ARMC Wolverine Magic 3 / 20

Software model checkers multithreading support CBMC SatAbs Threader ESBMC Kratos Impact SLAM LLBMC Blast UFO CPAChecker Ultimate ARMC Wolverine Magic 3 / 20

Software model checkers multithreading support CBMC ? SatAbs Threader ESBMC Kratos Impact SLAM LLBMC Blast UFO CPAChecker Ultimate ARMC Wolverine Magic 3 / 20

Software model checkers multithreading support CBMC Impara SatAbs Threader ESBMC Kratos Impact SLAM LLBMC Blast UFO CPAChecker Ultimate ARMC Wolverine Magic 3 / 20

Software model checkers multithreading support CBMC Impara SatAbs Threader ESBMC Contribution: Kratos • 1st Impact -style analysis for multithreaded software Impact SLAM • Partial-Order Reduction LLBMC Blast UFO • implemented in Impara CPAChecker Ultimate ARMC Wolverine Magic 3 / 20

Outline • Recap: Impact for Sequential Software • Impact for Multithreaded Software • Partial order reduction • Experiments with our tool Impara 4 / 20

Impact algorithm expand UNSAT SAT refine check CEX interpolation • maintain abstract reachability tree • node labels • covering relation ⊲ v ⊲ w implies label ( v ) ⇒ label ( w ) 5 / 20

Impact algorithm complete expand proof � UNSAT SAT refine check CEX interpolation • maintain abstract reachability tree • node labels • covering relation ⊲ v ⊲ w implies label ( v ) ⇒ label ( w ) • complete iff all nodes either • covered • expanded 5 / 20

Classical SLAM example do { lock(); old=new; if(*) { unlock(); new++; } } while (new!=old); 6 / 20

Classical SLAM example L=0 do { [L!=0] lock(); ERR L=1; old=new old=new; if(*) { * [new!=old] unlock(); L=0;new++ new++; } [new==old] } while (new!=old); 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 True [L!=0] True ERR 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 ERR 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new True L=0 True new++ [new!=old] [new==old] True [L!=0] True ERR True 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new True L=0 L = 0 new++ [new!=old] [new==old] False [L!=0] True ERR L = 0 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new True ⊲ L=0 L = 0 new++ [new!=old] [new==old] False [L!=0] True ERR L = 0 L = 0 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new True ⊲ L=0 L = 0 new++ [new!=old] [new==old] [new!=old] False [L!=0] [L!=0] True ERR L = 0 L = 0 ERR 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new * [new!=old] L=0;new++ [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new old = new ⊲ L=0 L = 0 old = new new++ [new!=old] [new==old] [new!=old] False False [L!=0] [L!=0] True ERR L = 0 L = 0 False ERR 6 / 20

L=0 [L!=0] • reachable states ⊆ label ERR L=1; old=new • terminates if all nodes * [new!=old] • covered L=0;new++ • or fully expanded [new==old] Abstract Reachability Tree True L=0 False [L!=0] L = 0 L=1 ERR old=new ⊲ old = new ⊲ L=0 L = 0 old = new new++ [new!=old] [new==old] [new!=old] False False [L!=0] [L!=0] True ERR L = 0 L = 0 False ERR 6 / 20

Impact for Multithreaded Software 7 / 20

Naive Impact for Multi-threading • interleave at every step threads 1,2,3 1 2 3 1 2 3 8 / 20

Example int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3: assert(x==0) 0 , 0 0 , 1 9 / 20

Example int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3: assert(x==0) 0 , 0 0 , 1 ∗ 2 , 0 x=0 3 , 0 assert(x==0) 3 , 1 9 / 20

Example int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3: assert(x==0) 0 , 0 0 , 1 ∗ 2 , 0 T rue x=0 3 , 0 x = 0 assert(x==0) 3 , 1 9 / 20

Example int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3: assert(x==0) 0 , 0 0 , 1 ∗ 2 , 0 x = 0 x=0 assert(x==0) 3 , 0 x = 0 2 , 1 assert(x==0) 3 , 1 9 / 20

Example int x=0; thread 1 thread 2 0: assert(x==0); 0: if(*) 1: 1: x=1; 2: x=0; 3: assert(x==0) CEX 0 , 0 0 , 1 ∗ ∗ 1 , 0 x=1 2 , 0 2 , 0 x = 0 assert(x==0) x=0 assert(x==0) 2 , 1 3 , 0 x = 0 2 , 1 assert(x==0) 3 , 1 9 / 20

Naive Impact blows up ART from a concrete case study (Peterson’s algorithm) 10 / 20

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90] avoid unnecessary interleavings resulting in same state main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create ( T 1 ); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create ( T 2 ); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join ( T 1 ); pthread_join ( T 2 ); assert(v[j] ≥ 0); A a B a A b C a B b A c A || a and TID ( A ) < TID ( a ) a C b B c A b C c B c C 11 / 20

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90] avoid unnecessary interleavings resulting in same state main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create ( T 1 ); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create ( T 2 ); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join ( T 1 ); pthread_join ( T 2 ); assert(v[j] ≥ 0); A a B a A b C a B b A c A || a and TID ( A ) < TID ( a ) a C b B c A b C c B c C 11 / 20

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90] avoid unnecessary interleavings resulting in same state main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create ( T 1 ); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create ( T 2 ); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join ( T 1 ); pthread_join ( T 2 ); assert(v[j] ≥ 0); consecutive independent actions only occur in the order of increasing thread ids, e.g., Aa but not aA A a B a A b C a B b A c A || a and TID ( A ) < TID ( a ) B || b and TID ( B ) < TID ( b ) a C b B c A A || b and TID ( A ) < TID ( b ) b C c B c C 11 / 20

Partial-Order Reduction [Godefroid’94, Peled’93, Valmari’90] avoid unnecessary interleavings resulting in same state main() thread 1 thread 2 assume(i!=j); v[i]=0; v[j]=0; A : v[i]=1; a : v[j]=-2; pthread_create ( T 1 ); B : v[i]=v[i]+1; b : v[j]=v[j]+1; pthread_create ( T 2 ); C : v[i]=v[j]; c : v[i]=v[i]+1; pthread_join ( T 1 ); pthread_join ( T 2 ); assert(v[j] ≥ 0); consecutive independent actions only occur in the order of increasing thread ids, e.g., Aa but not aA A a B a A b C a B b A c A || a and TID ( A ) < TID ( a ) B || b and TID ( B ) < TID ( b ) a C b B c A A || b and TID ( A ) < TID ( b ) b C c B c C 11 / 20

Algorithm: POR+Impact (First Attempt) • POR restricts expansion 1: procedure Expand ♦ ( v ) 2: for T ∈ T with ¬ Skip ♦ ( v, T ) do 3: Expand-thread ( T, v ) 12 / 20