Automatic Abstraction for Congruences

Transcription

1 A Story of Beauty and the Beast Portcullis Computer Security University of Melbourne

2 Structure of this talk Related work: Philippe Granger: Static Analysis of Linear Congruence Equalities among Variables of a Program, TAPSOFT, 1991! Markus Müller-Olm and Helmut Seidl: Analysis of Modular Arithmetic, TOPLAS, 2007 David Monniaux: Automatic Modular Abstractions for Linear Constraints, POPL, 2009 Björn Wachter and Lijun Zhang: Best Probabilistic Transformers, VMCAI, 2010? Heart of the technique: describe (abstract) a Boolean function with a system of congruences technique interleaves SAT solving and merge for congruences

3 Describing a function with congruence constraints Consider the function f = (c 0 c 0) (c 1 (c 1 c 0 )) where denotes exclusive or Observe that f is described by the congruence constraints: { s = } { = c 0 + c c 0 + c 2c 1 + 2c 0 + 2c c 0 + 2c c 0 + 2c 1 s describes f since every solution of f is a solution of s: c 0 c 1 c 0 c 1 c 0 + c c 1 + 2c 0 + 2c s f }

4 Finding a congruence system s that describes f 11 Find a solution to f, namely, the satisfying assignment: m 1 = {c 0 1, c 1 0, c 0 0, c 1 1} 12 Represent m 1 as a triangular system of congruences: c c s 1 = c c Construct a function g 1 that holds iff c does not hold: g 1 = (c 1 1)

5 Finding a congruence system s that describes f (cont ) 21 Find a solution to f g 1, namely, the satisfying assignment: m 2 = {c 0 1, c 1 1, c 0 0, c 1 0} 22 Represent m 2 as a system of congruence constraints s 2 : c c s 2 c = c c 0 and recall s = c c c c Merge s 2 and s 1 to obtain s 2 = c 1 + c c Construct a function g 2 that holds iff c does not hold: g 2 = (c 0 0)

6 Finding a congruence system s that describes f (cont ) 31 Find a solution to f g 2, namely, the satisfying assignment: m 3 = {c 0 0, c 1 0, c 0 1, c 1 0} 32 Represent m 3 as a system of congruence constraints s 3 : c c s 3 c = c 0 and recall s = c 1 + c 1 c c Merge s 3 and s 2 to obtain { c0 + c s 3 = 0 } 4 1 c 1 + c 0 + c Construct g 3 that holds iff c 1 + c 0 + c does not hold: g 3 = (t 0 c 1 c 0 ) (t 1 c 1 c 0 ) (t 0 c 1 t 0) (t 1 (c 1 t 0) t 1 ) ( t 0 t 1 )

7 Finding a congruence system s that describes f (cont ) 41 Find a solution to f g 3, namely, the satisfying assignment: m 4 = {c 0 0, c 1 1, c 0 1, c 1 1} 42 Represent m 4 as a system of congruence constraints s 4 : c s 4 c = c c Merge s 3 and s 4 to obtain s 4: { c0 + c s 4 = 0 } 4 1 2c 1 + 2c 0 + 2c Construct g 4 that holds iff c 1 + c 0 + c does not hold: g 4 = (c 1 c 0 c 1) 1

8 Finding a congruence system s that describes f (cont ) 51 Detect that f g 4 does not have a solution { c0 + c s 4 = c 1 + 2c 0 + 2c } 52 Construct g 5 that holds iff c 0 + c does not hold: g 5 = (t 0 c 1 c 0) (t 1 c 1 c 0) ( t 0 t 1 ) 53 Detect that f g 5 does not have a solution { c0 + c s 4 = } 2c 1 + 2c 0 + 2c 1 4 2

9 Summary of story so far The systems s 1, s 2, s 3, s 4 constitute an increasing chain of congruence constraints: The system si+1 has strictly more solutions than s i ; The maximal number of systems in chain is pn + 1 where 2 p = 4 is the modulo [TOPLAS, 2007] But does it scale? Depends on hardness of the SAT/SMT instance Depends on the join algorithm (needs to be inplace)

10 Parity example l 0 : p := 0; y := x; l 1 : while (y 0) y := y & (y 1); p := 1 - p; l 2 : skip Then t 1 = l 0, l 1, c 1, t 2 = l 1, l 1, c 2 and t 3 = l 1, l 2, c 3 where ( 15 i=0 p i 2 0) c 1 = ( 15 i=0 y i 2 x i ) ( 15 i=0 x i 2 x i ) ( 15 i=0 p i 2 p i ) p 0 + p 0 ( 2 1 c 3 = 15 i=0 x i 2 x i ) ( 15 i=1 p i 2 p i ) ( 15 i=0 y i 2 0) c 2 = ( 15 i=0 x i 2 x i ) ( 15 i=0 y i 2 0) y i=1 y i 15 2 i=0 y i

11 Bit reversal example l 0 : y := x; y := ((y 1) & 0x5555) ((y & 0x5555) 1); y := ((y 2) & 0x3333) ((y & 0x3333) 2); y := ((y 4) & 0x0F0F) ((y & 0x0F0F) 4); y := (y 8) (y 8); l 1 : skip Then t = l 0, l 1, c where c = 15 i=0 (x i 2 16 x i y 15 i 2 16 x i )

12 Bonus tracks Presented a new algorithm for congruence closure; Show how inequalities can be traced (see paper); l 0 : assume(0 < n); x := 0; y := 0; l 1 : while (x < n) y := y + 2; x := x + 1; l 2 : skip l 0 : assume(0 < n); x := 0; y := 0; δ := n x; l 1 : while (0 < δ) y := y + 2; x := x + 1; δ := n x; l 2 : skip Formulate the ideas with an unrestricted flowchart language with non-linear, bit-manipulating operations (see paper)