model checking c programs zijiang (james) yang department of computer science western michigan...
TRANSCRIPT
Model Checking C Programs
Zijiang (James) YangDepartment of Computer Science
Western Michigan University
In collaboration with NEC Laboratories America
Economic Impact of Software Verification
Cost of software bugs to U.S. economy in 2002: $60Billion
80% of software development cost is in debugging
Simulation and Testing Effective in discovering bugs in early stages Expensive and not exhaustive!
UnpredictableNot exhaustiveUnpredictableNot exhaustive
Simulation does notscale
Legend
Testing vs. Formal Verification
1: int foo(int x) {
2: int y = 2*x ;
3: if ( y < 100 )
4: y += 50 ;
5: if ( y == 50 )
6: y+=user(-1,6);
7: return y;
8: }
9:
…
200
10-100
10: int bar (int x) {
11: int y ;
12: assume ( x >= 0 );
13: y = foo(x) ;
14: assert ( y >= 50 );
15: return y;
16: }
10-99
100
101
102 ……
1049
1050
1051
10100… …
1250
1249
1251
12100
120
121
122 … … …
10
11
12 …
149
150
151
1100… …
212
224
24998
250
100
251
102
2100200
… … …
40
50
41
52
42
54
449
148… … …
1350
100
1351
102
13100200
…131
52
132
54
1349
148
60
53
130
53
60
54
130
54
60
55
130
55
60
56
130
56
60
52
130
52
60
51
130
51
60
50
130
50
60
49
130
49
SimulationTesting
linexy
Formal Verification
Formal verification is the process of systematically checking that system behavior satisfies a given property, both described using formal models. Automated and effective debugging Systematic and exhaustive analysis
Scalability is still a problemEffective use requires some expertise
Specification
Implementation
Formal relationship
Correctness
Design
F-Soft: Automated Bug Finder and Correctness Prover
F-SoftF-Soft
1: void pivot_sort(int A[], int n){ 2: int pivot=A[0], low=0, high=n; 3: while ( low < high ) { 4: do { 5: low++ ; 6: } while ( A[low] <= pivot ) ; 7: do { 8: high - - ; 9: } while ( A[high] >= pivot );10: swap(&A[low],&A[high]); 11: }12: }
Array Bound Violations?
Line 1: n=2, A[0]=10, A[1]=10
Line 2: pivot=10, low=0, high=2
Line 5: low = 1
Line 6: A[low] <= pivot ? YES!
Line 3: low < high ? YES!
Line 5: low = 2
Line 6: A[low] <= pivot ?
Buffer Overflow!!!
F-Soft outputs a trace:
Software Verification Tool
program
property
correct
bug
Automated F-Soft Software Verification Flow
Legend
User inputAutomatic
Source code
BooleanAnalysis
Analysis & Refinement
Proof
PredicateAbstraction
BooleanModel Builder
Program slicing
Range analysis
User-specified properties
Automatedproperties
StaticAnalysis
Bug
TestbenchGenerator
Properties Considered
Basic F-Soft mode: Automatically generated standard properties (verification or warning mode)
Buffer overflow, array bound violationsUse of un-initialized variablesNULL pointer dereferencingAlternating locks and unlocks of shared resourcesFile IO handlingDivision by zero
Full mode: User specified propertiesSoftware adheres to specificationUser specified program assertionsHigh-Level System Properties
Program Slicing
A program slice is a subset of the original code that only contains relevant statements to the computation of interest.
Based on static analysis of data and control flow
void arithmetic(int *A,int n) { int sum=0, product=1, mean=0; int i = 0 ; while ( i < n ) { sum += A[i] ; product *= A[i] ; mean += A[i]/n; i++ ; }}
original program
void arithmetic(int *A,int n) { int sum=0, product=1, mean=0; int i = 0 ; while ( i < n ) { sum += A[i] ; product *= A[i] ; mean += A[i]/n; i++ ; }}
slice with respect to sum
Range Analysis
Goal: For a C program, automatically find the range and minimal number of bits needed to represent a variable
We are first to apply range analysis for verification of software
int a;
a = (b != 15);
for (a = 0; a < 6; a++) { … }
a: 32 bits/a:<MIN,MAX>
a: 1 bit/a:<0,1>
a: 3 bits/a:<0,5>
a: 3 bits/a:<0,6>
Predicate Abstraction
Predicate abstraction is powerful technique to reduce system complexity from potentially infinite-state systems to finite domain Predicates are relational expressions over program variables Abstraction using k predicates results in at most 2k abstract states
int x , y ;
if ( x>0 ){
…
y = x+1 ;
…
}
else {
…
y = x+2 ;
…
}
bool bx , by ;
if ( bx ){
…
by = T ;
…
}
else {
…
by{T,F};
…
}
Predicate abstraction
bx := (x > 0)by := (y > 0)
TF
TT
FF
FT
x
y
Abstract datavariables usingBooleans.
Abstraction Refinement Flow
unsafe path
safe systemabstract
abstract system
concretepath
spurious path
refinemodel
forward analysis
concrete system
analysisengine
Control Flow Graph Computation
1: void bar() {
2: int x = 3 , y = x-3 ;
3: while ( x <= 4 ) {
4: y++ ;
5: x = foo(x);
6: }
7: y = foo(y);
8: }
9: 10: int foo ( int l ) {
11: int t = l+2 ;
12: if ( t>6 )
13: t -= 3;
14: else
15: t--;
16: return t;
17: }
Line 2
Line 3 Line 4
Line 7(call)
Line 5(call)
Lines11-12,14Line 13
Line 15Line 16
Line 5(return)
Line 7(return)
Control Logic Example
x<=4
0
1 2
x>4
3 4
t>6
t<=6
56
78
!rtr
rtr10
9
c3 c2 c1 c0 c3' c2' c1' c0' condition0 0 0 0 0 0 0 1 10 0 0 1 0 0 1 0 x<=40 0 0 1 0 0 1 1 x>40 0 1 0 0 1 0 0 10 0 1 1 0 1 0 1 10 1 0 0 0 1 0 1 10 1 0 1 0 1 1 0 t>60 1 0 1 0 1 1 1 t<=60 1 1 0 1 0 0 0 10 1 1 1 1 0 0 0 11 0 0 0 1 0 0 1 rtr=01 0 0 0 1 0 1 0 rtr=11 0 0 1 0 0 0 1 1
Control Logic
Let N be the number of basic blocks, PC variable needs logN bits
Next state logic
ci’=j:vij’=1(kj p:vpj=1 cp p:vpj=0 cp)
Data Logic
Simplify assignments in basic blocks Sequential --> parallel Pointers
Assume a variable vj
Assigned in blocks {b1…bk} with expressions {Lj1…Ljk}
Not assigned in blocks {bk+1…bN}
Next state logic of vj
vj’= i=1,k(c1…cn=biLji) i=k+1,N(c1…cn=bivj)
Bounded Model Checking (BMC)
Search for a bounded length counterexample By unrolling steps of programs, no complete (fixpoint)
traversal Formula is satisfiable if and only if a counterexample exists Checked by a SAT solver
Step nStep n-1Step 2Step1Input
PS1 NS1=PS2
F-Soft Case Study: Network Protocol PPP
Point-to-Point Protocol (PPP) Analyzed LCP (link control
protocol) part of PPP that establishes, configures, and tests a data-link connection
Specification is given as RFC 1661 Linux implementation contains
about 2000 lines of C code Property: Implementation
adheres to specification
StatesEvents Req-Sent OpenedClose Term-Req
goto ClosingTerm-Reqgoto Closing
Conf-Ackgoto Ack-Rcvd
goto Req-Sent
Term-Ack
Conf-Reqgoto Req-Sent
Term-Req
Term-Ack Term-Ackgoto Stopping
RFC 1661
static void fsm_rtermack(fsm *f){ switch (f->state) { /* other cases here */ case OPENED: if ( f->callbacks->down) (*f->callbacks->down)(f); /* informing upper layers */ fsm_sconfreq(f,0); break ; }}
Public implementation
Missing: f->state = REQSENT;
F-Soft Case Study: Floppy Disk Driver Important property: Does the code obey the locking
rules? Rule 1: Only an unlocked resource can be locked. Rule 2: Only a locked resource can be unlocked.
VOID FloppyProcessQueuedRequests ( IN OUT PDISKETTE_EXTENSION DisketteExtension) { PLIST_ENTRY headOfList; KeAcquireSpinLock(&DisketteExtension, &oldIrql); while ((headOfList = ExInterlockedRemoveHeadList(…)!=NULL{ currentIrp = CONTAINING_RECORD( headOfList,…); if (IoSetCancelRoutine( currentIrp, NULL)) irpSp = IoGetCurrentIrpStackLocation( currentIrp ); else { … } KeReleaseSpinLock(&DisketteExtension,oldIrql); if (currentIrp) { … } else switch ( irpSp->MajorFunction ) { case IRP_MJ_READ: case IRP_MJ_WRITE: (VOID)FloppyReadWrite( DisketteExtension,currentIrp); break; case IRP_MJ_DEVICE_CONTROL: (VOID)FloppyDeviceControl(DisketteExtension, currentIrp); break; default: … } if (currentIrp) FloppyPageEntireDriver(); KeAcquireSpinLock(&DisketteExtension,&oldIrql); } KeReleaseSpinLock(&DisketteExtension,oldIrql);}
Disk driver implementation
Property specified using automatically generated code:
bool locked=FALSE;
void KeAcquireSpinLock(…) { if (locked) abort() ; locked = TRUE;}
void KeReleaseSpinLock(…){ if (!locked) abort() ; locked = FALSE ;}
void abort() { assert(0);}
Automaticallygenerated propertymonitor
F-Soft Case Study: Serial Device Driver
Source code from WINDDK 3790 for Windows NT “Plug and Play” compliant serial 16550-based RS-
232 driver Lines of code measures
31,930 lines of C source code for this device driver Additionally, > 600,000 lines of C code in included
header files Property analyzed for this device driver
Alternating use of acquiring and releasing locks Among the 93 API functions
Basic F-Soft v0.3 proves 72 API functions correct within a few minutes
Improvements expected in follow-up releases
Conclusions
Software verification can Find tricky bugs otherwise cannot be found by
traditional methods improve software development productivity
F-Soft provides R&D framework for efficient SW verification Controlling complexity by block-wise program analysis Various techniques to reduce the program sizes Boolean representation of C programs Specialized heuristics for analysis of program model
Thank you!
Zijiang (James) Yang