Algorithmic verification

Transcription

1 Algorithmic verification Ahmed Rezine IDA, Linköpings Universitet Hösttermin 2018

2 Outline Overview Model checking Symbolic execution

3 Outline Overview Model checking Symbolic execution

4 Program verification and Approximations We often want to answer whether the program is safe or not (i.e., has some erroneous reachable configurations or not): Safe Program Unsafe Program

5 Program Verification and Approximations I Finding all configurations or behaviours (and hence errors) of arbitrary computer programs can be easily reduced to the halting problem of a Turing machine. I This problem is proven to be undecidable, i.e., there is no algorithm that is guaranteed to terminate and to give an exact answer to the problem. I An algorithm is sound in the case where each time it reports the program is safe wrt. some errors, then the original program is indeed safe wrt. those errors I An algorithm is complete in the case where each time it is given a program that is safe wrt. some errors, then it does report it to be safe wrt. those errors

6 Program Verification and Approximations I The idea is then to come up with efficient approximations and algorithms to give correct answers in as many cases as possible. Over-approximation Under-approximation

7 Program Verification and Approximations I A sound analysis cannot give false negatives I A complete analysis cannot give false positives False Positive False Negative

8 In this lecture We will briefly introduce different types of verification approaches: I Model checking: exhaustive, aims for soundness I Symbolic execution: partial, aims for completeness

9 Administrative Aspects: I The lab sessions might not be enough and you might have to work more I You will need to write down your answers to each question on a draft. I You will need to demonstrate (individually) your answers in one of the lab sessions on a computer. I Once you get the green light, you can write your report in a pdf form and send it (in pairs) to the person you demonstrated for. I You will get questions in the final exam about this lecture and the labs.

10 Outline Overview Model checking Correctness properties Symbolic execution

11 Model checking I Model checking is a push button verification approach I Given: I a model M of the system to be verified, and I a correctness property Φ to be checked: absence of deadlocks, livelocks, starvation, violations of constraints/assertions, etc I The model checking tool returns: I a counter example in case M does not model Φ, or I a mathematical guaranty that the M does model Φ

12 Model Checking: Verification vs debugging I Model checking tools are used both: I To establish correctness of a model M with respect to a correctness property Φ I More importantly, to find bugs and errors in M early during the design

13 M as a Kripke structure Assume a set of atomic propositions AP. A Kripke structure M is a tuple (S ; S 0 ; R ; L) where: 1. S is a finite set of states 2. S 0 S is the set of initial states 3. R S S is the transition relation s.t. for any s 2 S, R(s ; s 0 ) holds for some s 0 2 S 4. L : S! 2 AP labels each state with the atomic propositions that hold on it.

14 Programs as Kripke structures 1 int x = 0; 2 3 void thread (){ 4 int v = x; 5 x = v + 1; 6 } 7 8 void main (){ 9 fork ( thread ); 10 int u = x; 11 x = u + 1; 12 join ( thread ); 13 assert (x == 2); 14 }

15 Synchronous circuits as Kripke structures v 0 0 = :v 0 (1) v 0 1 = v 0 v 1 (2) v 0 2 = (v 0 ^ v 1 ) v 2 (3)

16 Synchronous circuits as Kripke structures v 0 0 = :v 0 (1) v 0 1 = v 0 v 1 (2) v 0 2 = (v 0 ^ v 1 ) v 2 (3) Asynchronous circuits handled using a disjunctive R instead of a conjunctive one like for synchronous circuits.

17 Temporal Logics I Temporal logics are formalisms to describe sequences of transitions I Time is not mentioned explicitly (in today s lecture) I Instead, temporal operators are used to express that certain states are: I never reached I eventually reached I more complex combinations of those

18 Computation Tree Logic (CTL) Computation trees are obtained by unwinding the Kripke structure

19 Computation Tree Logic (CTL) M ; s 0 j= EF g M ; s 0 j= AF g M ; s 0 j= EG g M ; s 0 j= AG g

20 Outline Overview Model checking Symbolic execution

21 Testing I Most common form of software validation I Explores only one possible execution at a time I For each new value, run a new test. I On a 32 bit machine, if(i==2014) bug() would require 2 32 different values to make sure there is no bug. I The idea in symbolic testing is to associate symbolic values to the variables

22 Symbolic Testing I Main idea by JC. King in Symbolic Execution and Program Testing in the 70s I Use symbolic values instead of concrete ones I Along the path, maintain a Path Constraint (PC) and a symbolic state (Σ) I PC collects constraints on variables values along a path, I Σ associates variables to symbolic expressions, I We get concrete values if PC is satisfiable I The program can be run on these values I Negate a condition in the path constraint to get another path

23 Symbolic Execution: a simple example I Can we get to the ERROR? explore using SSA forms. I Useful to check array out of bounds, assertion violations, etc. 1 foo ( int x,y,z){ 2 x = y - z; 3 if (x==z){ 4 z = z - 3; 5 if (4* z < x + y){ 6 if (25 > x + y) { } 9 else { 10 ERROR ; 11 } 12 } 13 } PC 1 = true PC 2 = PC 1 x 7! x 0 ; y 7! y 0 ; z 7! z 0 PC 3 = PC 2 ^ x 1 = y 0 z 0 x 7! y 0 z 0 ; y 7! y 0 ; z 7! z 0 PC 4 = PC 3 ^ x 1 = z 0 x 7! y 0 z 0 ; y 7! y 0 ; z 7! z 0 PC 5 = PC 4 ^ z 1 = z 0 3 x 7! y 0 z 0 ; y 7! y 0 ; z 7! z 0 3 PC 6 = PC 5 ^ 4 z 1 < x 1 + y 0 x 7! y 0 z 0 ; y 7! y 0 ; z 7! z 0 3 PC 10 = PC 6 ^ 25 x 1 + y 0 x 7! y 0 z 0 ; y 7! y 0 ; z 7! z 0 3 PC = (x 1 = y 0 z 0 ^ x 1 = z 0 ^ z 1 = z 0 3 ^ 4 z 1 < x 1 + y 0 ^ 25 x 1 + y 0 ) Check satisfiability with an SMT solver (e.g.,

24 Symbolic execution today I Leverages on the impressive advancements for SMT solvers I Modern symbolic execution frameworks are not purely symbolic, and not necessarily static: I They can follow a concrete execution while collecting constraints along the way, or I They can treat some of the variables concretely, and some other symbolically I This allows them to scale, to handle closed code or complex queries

25 Symbolic execution today I C (actullay llvm) I Java (more than a symbolic executer) I C# (actually.net) I...