From Array Domains to Abstract Interpretation Under - - PowerPoint PPT Presentation

▶
from array domains to abstract interpretation under store
SMART_READER_LITE
LIVE PREVIEW

From Array Domains to Abstract Interpretation Under - - PowerPoint PPT Presentation

Feb 15, 2024 246 likes •763 views

From Array Domains to Abstract Interpretation Under Store-Buffer-Based Memory Models Thibault Suzanne, Antoine Min Static Analysis: 23rd International Symposium, SAS 2016 September, 2016, Edinburgh, UK Pirmin Schmid Seminar Software

slide-1
SLIDE 1

From Array Domains to Abstract Interpretation Under Store-Buffer-Based Memory Models

Thibault Suzanne, Antoine Miné Static Analysis: 23rd International Symposium, SAS 2016 September, 2016, Edinburgh, UK

1 Pirmin Schmid Seminar Software Engineering December 7, 2016

slide-2
SLIDE 2

De quoi s’agit-il?

  • New abstract interpretation of concurrent programs
  • Setting: Weak memory consistency
  • Model: store-buffer (FIFO) of infinite size
  • including theoretical model, proof and

working implementation (OCaml)

2

slide-3
SLIDE 3

Memory models in Hardware and Languages

  • Strong consistency

4

RAM shared cache(s) cache(s) cache(s) cache(s) cache(s) core 0 core 1 core 2 core 3

slide-4
SLIDE 4

Memory models in Hardware and Languages

  • Weak consistency

5

RAM shared cache(s) cache(s) cache(s) cache(s) cache(s) core 0 core 1 core 2 core 3

slide-5
SLIDE 5

Memory models in Hardware and Languages

  • Weak consistency. TSO: total store ordering (x86)

6

core 0 shared memory core 1

Array buffer FIFO pipeline

slide-6
SLIDE 6

Memory models in Hardware and Languages

  • Weak consistency. TSO: total store ordering (x86)

7

core 0 shared memory (X=0; Y=0)

initial, shared X=0; Y=0 1: X = 1 2: Y = 2 3:

core 1

What can it see?

slide-7
SLIDE 7

Memory models in Hardware and Languages

  • Weak consistency. TSO: total store ordering (x86)

8

core 0 shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

slide-8
SLIDE 8
  • Weak consistency. TSO: total store ordering (x86)

X = 1

Memory models in Hardware and Languages

9

core 0 shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

slide-9
SLIDE 9
  • Weak consistency. TSO: total store ordering (x86)

Y = 2 X = 1

Memory models in Hardware and Languages

10

core 0 shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

What can it see?

slide-10
SLIDE 10
  • Weak consistency. PSO: partial store ordering (ARM)

X:

Memory models in Hardware and Languages

11

shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

What can it see? Y:

core 0

slide-11
SLIDE 11
  • Weak consistency. PSO: partial store ordering (ARM)

X: 1

Memory models in Hardware and Languages

12

shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

Y:

core 0

slide-12
SLIDE 12
  • Weak consistency. PSO: partial store ordering (ARM)

X: 1

Memory models in Hardware and Languages

13

shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3:

core 1

Y: 2

core 0

What can it see?

slide-13
SLIDE 13
  • Weak consistency. PSO: partial store ordering (ARM)

X: 1

Memory models in Hardware and Languages

14

shared memory

initial, shared X=0; Y=0 1: X = 1 1b: ? flush 2: Y = 2 2b: ? flush 3: fence 4:

core 1

Y: 2

core 0

What can it see?

slide-14
SLIDE 14

Verification: Model checkers

  • Promela / spin
  • Scyther: crypto protocols
  • Limitation: only finite state space
  • State space explosion

15

slide-15
SLIDE 15

Verification: Abstract interpretation. SC

16

slide-16
SLIDE 16

Verification: Abstract interpretation. Dan et al.

17

slide-17
SLIDE 17

Verification: Abstract interpretation. This study

18

slide-18
SLIDE 18

Comparison

19

buffer size n ∞ state size m Model Checker

  • ∞

Dan et al. This study

slide-19
SLIDE 19

x11 x21 x31 x41 x51

PSO model: concrete domain

20

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-20
SLIDE 20

x11 x21 x31 x41 x51

PSO model: concrete domain

21

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-21
SLIDE 21

x11 x21 x31 x41 x51

PSO model: concrete domain

22

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-22
SLIDE 22

x11 x21 x31 x41 x51

PSO model: concrete domain

23

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-23
SLIDE 23

x11 x21 x31 x41 x51

PSO model: concrete semantics

24

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-24
SLIDE 24

x11 x21 x31 x41 x51

PSO model: concrete semantics

25

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-25
SLIDE 25

x11 x21 x31 x41 x51

PSO model: concrete semantics

26

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12=e x22 x32 z12 z22 z32

thread 2

slide-26
SLIDE 26

x11 x21 x31 x41 x51

PSO model: concrete semantics

27

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 x32 z12 z22 z32

thread 2

slide-27
SLIDE 27

x11 x21 x31 x41 x51

PSO model: concrete semantics

28

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 x32 z12 z22 z32

thread 2

slide-28
SLIDE 28

x11 x21 x31 x41 x51

PSO model: concrete semantics

29

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 x22 z12 z22 z32

thread 2

slide-29
SLIDE 29
  • Key insight: summarize and partition.

x11 x21 x31 x41 x51

Abstraction: handling ∞

32

shared: xmem, ymem, zmem

y11 y21 y31

thread 1

x12 z12 z22 z32

thread 2

𝛽"#$ :

slide-30
SLIDE 30
  • Key insight: summarize and partition.

x11 xbot1

Abstraction: handling ∞

33

shared: xmem, ymem, zmem

y11 ybot1

thread 1

x12 z12 zbot2

thread 2

𝛽"#$ :

slide-31
SLIDE 31
  • Key insight: summarize and partition.

x11 xbot1

Abstraction: handling ∞

34

shared: xmem, ymem, zmem

y11 ybot1

thread 1

x12 z12 zbot2

thread 2

𝛽"#$ :

∞ solved cost: loosing precision

slide-32
SLIDE 32

x11 xbot1

Abstraction: partial buffer state information

35

shared: xmem, ymem, zmem

y11 ybot1

thread 1

x12 z12 zbot2

thread 2

slide-33
SLIDE 33

x11 xbot1

Abstraction: partial buffer state information

36

shared: xmem, ymem, zmem

y11 ybot1

thread 1

x12 z12 zbot2

thread 2 2 steps: 1) summarize 2) resolve partition

slide-34
SLIDE 34

Abstract transformers

37

slide-35
SLIDE 35

Abstract transformers on partitions {.}

38

slide-36
SLIDE 36

Abstract transformers on partitions {.}

39

slide-37
SLIDE 37

Abstract transformers [[.]] using the {.}

40

slide-38
SLIDE 38

x11 xbot1

Abstraction: partial buffer state information

41

shared: xmem, ymem, zmem

y11 ybot1

thread 1

x12 z12 zbot2

thread 2 2 steps: 1) summarize 2) resolve partition

slide-39
SLIDE 39

My own code example

42

slide-40
SLIDE 40

Result

43

PSO

slide-41
SLIDE 41

My own code example with fences

44

slide-42
SLIDE 42

Result with fences

45

slide-43
SLIDE 43

Code example from paper

46

slide-44
SLIDE 44

Benchmark

47

slide-45
SLIDE 45

Benchmark

48

slide-46
SLIDE 46

Benchmark

49

slide-47
SLIDE 47

Benchmark

50

slide-48
SLIDE 48

Benchmark

51

slide-49
SLIDE 49

Discussion

  • Good things
  • Limitations
  • Suggested improvements

52

slide-50
SLIDE 50

Acknowledgment

  • Thibault Suzanne for the VM with the working analyzer
  • Andrei Dan for interesting discussion

53