Model Software Checking with SLAM
Thomas Ball Testing, Verification and Measurement Sriram K. Rajamani Software Productivity Tools Microsoft Research http://research.microsoft.com/slam/
People behind SLAM
Summer interns
Sagar Chaki, Todd Millstein, Rupak Majumdar (2000) Satyaki Das, Wes Weimer, Robby (2001) Jakob Lichtenberg, Mayur Naik (2002)
Visitors
Giorgio Delzanno, Andreas Podelski, Stefan Schwoon
Windows Partners
Byron Cook, Vladimir Levin, Abdullah Ustuner
Outline
Part I: Overview (30 min)
overview of SLAM process demonstration (Static Driver Verifier) lessons learned
Part II: Basic SLAM (1 hour)
foundations basic algorithms (no pointers)
Part III: Advanced Topics (30 min)
pointers + procedures imprecision in aliasing and mod analysis
Part I: Overview of SLAM
What is SLAM?
SLAM is a software model checking project at Microsoft Research
Goal: Check C programs (system software) against safety properties using model checking Application domain: device drivers
Starting to be used internally inside Windows
Working on making this into a product
Rules Static Driver Verifier
Read for understanding New API rules
Precise API Usage Rules (SLIC)
Drive testing tools
Development
Defects 100% path coverage
Software Model Checking
Testing
Source Code
SLAM Software Model Checking
SLAM innovations
boolean programs: a new model for software model creation (c2bp) model checking (bebop) model refinement (newton)
SLAM toolkit
built on MSR program analysis infrastructure
SLIC
Finite state language for stating rules
monitors behavior of C code temporal safety properties (security automata) familiar C syntax
Suitable for expressing control-dominated properties
e.g. proper sequence of events can encode data values inside state
State Machine for Locking
Rel Unlocked Rel Error Acq Locked Acq
Locking Rule in SLIC
state { enum {Locked,Unlocked} s = Unlocked; } KeAcquireSpinLock.entry { if (s==Locked) abort; else s = Locked; } KeReleaseSpinLock.entry { if (s==Unlocked) abort; else s = Unlocked; }
The SLAM Process
c2bp prog. P SLIC rule slic prog. P' predicates newton boolean program bebop path
Example
Does this code obey the locking rule?
do { KeAcquireSpinLock(); nPacketsOld = nPackets; if(request){ request = request->Next; KeReleaseSpinLock(); nPackets++; } } while (nPackets != nPacketsOld); KeReleaseSpinLock();
Example
Model checking boolean program (bebop)
U L
do { KeAcquireSpinLock();
L L U L L U U E U
if(*){ KeReleaseSpinLock(); } } while (*); KeReleaseSpinLock();
Example
Is error path feasible in C program? (newton)
U L
do { KeAcquireSpinLock(); nPacketsOld = nPackets;
L L U L L U U E U
if(request){ request = request->Next; KeReleaseSpinLock(); nPackets++; } } while (nPackets != nPacketsOld); KeReleaseSpinLock();
Example
Add new predicate b : (nPacketsOld == nPackets) to boolean program (c2bp)
U L
do { KeAcquireSpinLock(); nPacketsOld = nPackets; b = true;
L L U L L U U E U
if(request){ request = request->Next; KeReleaseSpinLock(); nPackets++; b = b ? false : *; } } while (nPackets != nPacketsOld); !b KeReleaseSpinLock();
Example
b : (nPacketsOld == nPackets)
U L
do { KeAcquireSpinLock(); b = true;
Model checking refined boolean program (bebop)
b L b L b U b L b L b U !b U U E
if(*){ KeReleaseSpinLock(); b = b ? false : *; } } while ( !b ); KeReleaseSpinLock();
Example
b : (nPacketsOld == nPackets)
U L
do { KeAcquireSpinLock(); b = true;
Model checking refined boolean program (bebop)
b L b L b U b L b L b U !b U
if(*){ KeReleaseSpinLock(); b = b ? false : *; } } while ( !b ); KeReleaseSpinLock();
Observations about SLAM
Automatic discovery of invariants
driven by property and a finite set of (false) execution paths predicates are not invariants, but observations abstraction + model checking computes inductive invariants (boolean combinations of observations)
A hybrid dynamic/static analysis
newton executes path through C code symbolically c2bp+bebop explore all paths through abstraction
A new form of program slicing
program code and data not relevant to property are dropped non-determinism allows slices to have more behaviors
Part I: Demo
Static Driver Verifier results
Part I: Lessons Learned
SLAM
Boolean program model has proved itself Successful for domain of device drivers
control-dominated safety properties few boolean variables needed to do proof or find real counterexamples
Counterexample-driven refinement
terminates in practice incompleteness of theorem prover not an issue
What is hard?
Abstracting
from a language with pointers (C) to one without pointers (boolean programs)
All side effects need to be modeled by copying (as in dataflow) Open environment problem
What stayed fixed?
Boolean program model Basic tool flow Repercussions:
newton has to copy between scopes c2bp has to model side-effects by value-result finite depth precision on the heap is all boolean programs can do
What changed?
Interface between newton and c2bp We now use predicates for doing more things
refine alias precision via aliasing predicates newton helps resolve pointer aliasing imprecision in c2bp
Scaling SLAM
Largest driver we have processed has ~60K lines of code Largest abstractions we have analyzed have several hundred boolean variables Routinely get results after 20-30 iterations Out of 672 runs we do daily, 607 terminate within 20 minutes
Scale and SLAM components
Out of 67 runs that time out, tools that take longest time:
bebop: 50, c2bp: 10, newton: 5, constrain: 2
C2bp:
fast predicate abstraction (fastF) and incremental predicate abstraction (constrain) re-use across iterations
Newton:
biggest problems are due to scope-copying
Bebop:
biggest issue is no re-use across iterations solution in the works
SLAM Status
2000-2001
foundations, algorithms, prototyping papers in CAV, PLDI, POPL, SPIN, TACAS
March 2002
Bill Gates review
May 2002
Windows committed to hire two people with model checking background to support Static Driver Verifier (SLAM+driver rules)
July 2002
running SLAM on 100+ drivers, 20+ properties
September 3, 2002
made initial release of SDV to Windows (friends and family)
April 1, 2003
made wide release of SDV to Windows (any internal driver developer)
Part II: Basic SLAM
CTypes Expressions LExpression Declaration Statements e l d s ::= ::= ::= ::= ::= | | | | | Procedures Program p g ::= ::= void | bool | int | ref c | x | e1 op e2 | &x | *x x | *x
skip
x1,x2 ,...,xn | goto L1,L2 ...Ln | L: s
assume(e) l = e l = f (e1 ,e2 ,...,en ) return x s1 ; s2 ;... ; sn f (x1: 1,x2 : 2,...,xn : n ) d1 d2 ... dn p1 p2 ... pn
C-Types Expressions LExpression Declaration Statements e l d s ::= ::= ::= ::= ::= | | | | | Procedures Program p g ::= ::= void | bool | int c | x | e1 op e2 x
skip
x1,x2 ,...,xn | goto L1,L2 ...Ln | L: s
assume(e) l = e f (e1 ,e2 ,...,en ) return s1 ; s2 ;... ; sn f (x1: 1,x2 : 2,...,xn : n ) d1 d2 ... dn p1 p2 ... pn
BP
Types Expressions LExpression Declaration Statements e l d s ::= ::= ::= ::= ::= | | | | | Procedures Program p g ::= ::= void | bool c | x | e1 op e2 x
skip
x1,x2 ,...,xn | goto L1,L2 ...Ln | L: s
assume(e) l = e f (e1 ,e2 ,...,en ) return s1 ; s2 ;... ; sn f (x1: 1,x2 : 2,...,xn : n ) d1 d2 ... dn p1 p2 ... pn
Syntactic sugar
goto L1, L2; if (e) { S1; } else { S2; } S3; L1: assume(e); S1; goto L3; L2: assume(!e); S2; goto L3; L3: S3;
Example, in C
int g; main(int x, int y){ cmp(x, y); if (!g) { if (x != y) assert(0); } } void cmp (int a , int b) { if (a == b) g = 0; else g = 1; }
Example, in C-int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); } L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } void cmp(int a , int b) { goto L1, L2;
The SLAM Process
c2bp prog. P SLIC rule slic prog. P' predicates newton boolean program bebop path
c2bp: Predicate Abstraction for C Programs
Given P : a C program 1 n F = {e ,...,e }
each ei a pure boolean expression each ei represents set of states for which ei is true
Produce a boolean program B(P,F) same control-flow structure as P
Assumptions
Given P : a C program 1 n F = {e ,...,e } i
each ei a pure boolean expression each e represents set of states for which ei is true
i
Assume: each e uses either:
only globals (global predicate) local variables from some procedure (local predicate for that procedure)
C2bp Algorithm
Performs modular abstraction
abstracts each procedure in isolation
Within each procedure, abstracts each statement in isolation
no control-flow analysis no need for loop invariants
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void cmp (int a , int b) { goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; }
Preds: {x==y} {g==0} {a==b}
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void cmp (int a , int b) { goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } void cmp ( {a==b} ) {
decl {g==0} ; main( {x==y} ) {
Preds: {x==y} {g==0} {a==b}
}
}
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void equal (int a , int b) { goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } void cmp ( {a==b} ) { goto L1, L2; L1: assume( {a==b} ); {g==0} = T; return; L2: assume( !{a==b} ); {g==0} = F; return; }
decl {g==0} ; main( {x==y} ) { cmp( {x==y} ); assume( {g==0} ); assume( !{x==y} ); assert(0); }
Preds: {x==y} {g==0} {a==b}
C-Types Expressions LExpression Declaration Statements e l d s ::= ::= ::= ::= ::= void | bool | int c | x | e1 op e2 x
skip
x1,x2 ,...,xn | goto L1,L2 ...Ln | L: s
| assume(e) | l = e | f (e1 ,e2 ,...,en ) | return | s1 ; s2 ;... ; sn Procedures Program p g ::= ::= f (x1: 1,x2 : 2,...,xn : n ) d1 d2 ... dn p1 p2 ... pn
Abstracting Assigns via WP
Statement y=y+1 and F={ y<4, y<5 }
{y<4}, {y<5} = ((!{y<5} || !{y<4}) ? F : *), {y<4} ;
WP(x=e,Q) = Q[x -> e]
WP(y=y+1, y<5)
(y<5) [y -> y+1] (y+1<5) (y<4)
=
= =
WP Problem
i 1 n
WP(s, e ) not always expressible via { e ,...,e }
Example
F = { x==0, x==1, x<5 } WP( x=x+1 , x<5 ) = x<4 Best possible: x==0 || x==1
Abstracting Expressions via F
1 n
F = { e ,...,e }
ImpliesF(e)
best boolean function over F that implies e
ImpliedByF(e)
best boolean function over F implied by e
ImpliesF(e) and ImpliedByF(e)
e
ImpliedByF(e)
ImpliesF(e)
Computing ImpliesF(e)
1 n
minterm m = i d && ... && d i i i
where d = e or d = !e
ImpliesF(e)
disjunction of all minterms that imply e
Nave approach
generate all 2n possible minterms for each minterm m, use decision procedure to
Abstracting Assignments
i
if ImpliesF(WP(s, e )) is true before s then
i
e is true after s
i
if ImpliesF(WP(s, !e )) is true before s then
i
e is false after s
Assignment Example
Statement in P: y = y+1; Predicates in E: {x==y}
Weakest Precondition: WP(y=y+1, x==y) = x==y+1
ImpliesF( x==y+1 ) = false ImpliesF( x!=y+1 ) = x==y
Abstraction of assignment in B: {x==y} = {x==y} ? false : *;
Absracting Assumes
WP( assume(e) , Q) = eQ
assume(e) is abstracted to: assume( ImpliedByF(e) ) Example: F = {x==2, x<5} assume(x < 2) is abstracted to: assume( {x<5} && !{x==2} )
Abstracting Procedures
Each predicate in F is annotated as being either global or local to a particular procedure Procedures abstracted in two passes:
a signature is produced for each procedure in isolation procedure calls are abstracted given the callees' signatures
Abstracting a procedure call
Procedure call
a sequence of assignments from actuals to formals see assignment abstraction
Procedure return
NOP for C-- with assumption that all predicates mention either only globals or only locals with pointers and with mixed predicates:
Most complicated part of c2bp Covered in the advanced topics section
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; }
decl {g==0} ; main( {x==y} ) { cmp( {x==y} ); assume( {g==0} ); assume( !{x==y} ); assert(0); }
{x==y} {g==0} {a==b}
void cmp ( {a==b} ) { Goto L1, L2 L1: assume( {a==b} ); {g==0} = T; return; L2: assume( !{a==b} ); {g==0} = F; return; }
Precision
For program P and E = {e1,...,en}, there exist two "ideal" abstractions:
Boolean(P,E) : most precise abstraction Cartesian(P,E) : less precise abtraction, where each boolean variable is updated independently [See Ball-Podelski-Rajamani, TACAS 00]
Theory:
with an "ideal" theorem prover, c2bp can compute Cartesian(P,E)
Practice:
c2bp computes a less precise abstraction than Cartesian(P,E) we use Das/Dill's technique to incrementally improve precision with an "ideal" theorem prover, the combination of c2bp + Das/Dill can compute Boolean(P,E)
The SLAM Process
c2bp prog. P SLIC rule slic prog. P' predicates newton boolean program bebop path
Bebop
Model checker for boolean programs Based on CFL reachability
[Sharir-Pnueli [Reps-Sagiv-Horwitz 81] 95]
Iterative addition of edges to graph
"path edges": <entry,d1> <v,d2> "summary edges": <call,d1> <ret,d2>
Symbolic CFL reachability
Partition path edges by their "target" PE(v) = { <d1,d2> | <entry,d1> <v,d2> } What is <d1,d2> for boolean programs? A bit-vector! What is PE(v)? A set of bit-vectors Use a BDD (attached to v) to represent PE(v)
BDDs
Canonical representation of
boolean functions set of (fixed-length) bitvectors binary relations over finite domains
void cmp ( e2 ) { [5]Goto L1, L2 [6]L1: assume( e2 ); [7] gz = T; goto L3; [8]L2: assume( !e2 ); [9]gz = F; goto L3 [10] L3: return; }
Efficient algorithms for common dataflow operations
transfer function join/meet subsumption test
BDD at line [10] of cmp:
e2=e2' & gz'=e2'
Read: "cmp leaves e2 unchanged and sets gz to have the same final value as e2"
decl gz ; main( e ) { [1] equal( e );
gz=gz'& e=e' e=e'& gz'=e'
[2] assume( gz ); [3] assume( !e ); [4] assert(F); } void cmp ( e2 ) { [5]Goto L1, L2 [6]L1: assume( e2 ); [7] gz = T; goto L3; [8]L2: assume( !e2 ); [9]gz = F; goto L3 [10] L3: return; }
e=e' & gz'=1 & e'=1
e2=e gz=gz'& e2=e2' gz=gz'& e2=e2'& e2'=T e2=e2'& e2'=T & gz'=T gz=gz'& e2=e2'& e2'=F e2=e2'& e2'=F & gz'=F e2=e2'& gz'=e2'
Bebop: summary
Explicit representation of CFG Implicit representation of path edges and summary edges Generation of hierarchical error traces
The SLAM Process
c2bp prog. P SLIC rule slic prog. P' predicates newton boolean program bebop path
Newton
Given an error path p in boolean program B
is p a feasible path of the corresponding C program?
Yes: found an error No: find predicates that explain the infeasibility
uses the same interfaces to the theorem provers as c2bp.
Newton
Execute path symbolically Check conditions for inconsistency using theorem prover (satisfiability) After detecting inconsistency:
minimize inconsistent conditions traverse dependencies obtain predicates
Symbolic simulation for C-Domains
variables: names in the program values: constants + symbols
State of the simulator has 3 components:
store: map from variables to values conditions: predicates over symbols history: past valuations of the store
Symbolic simulation Algorithm
Input: path p
For each statement s in p do match s with Assign(x,e): let val = Eval(e) in if (Store[x]) is defined then History[x] := History[x] Store[x] Store[x] := val Assume(e): let val = Eval(e) in Cond := Cond and val let result = CheckConsistency(Cond) in if (result == "inconsistent") then GenerateInconsistentPredicates() End Say "Path p is feasible"
Symbolic Simulation: Caveats
Procedure calls
add a stack to the simulator push and pop stack frames on calls and returns implement mappings to keep values "in scope" at calls and returns
Dependencies
for each condition or store, keep track of which values where used to generate this value traverse dependency during predicate generation
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; }
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global:
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
main:
(1) (2) x: y: X Y
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global:
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
main:
(1) (2) x: y: X Y
Map:
X A Y B
cmp:
(1) (2) a: b: A B
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global: (6) g: 0 main:
(1) (2) x: y: X Y
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
Map:
X A Y B
(1) (A == B)
[3, 4]
cmp:
(1) (2) a: b: A B
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global: (6) g: 0 main:
(1) (2) x: y: X Y
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
Map:
X A Y B
(1) (A == B) (2) (X == Y)
[3, 4] [5]
cmp:
(1) (2) a: b: A B
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global: (6) g: 0 main:
(1) (2) x: y: X Y
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
(1) (A == B) (2) (X == Y) [3, 4] [5] [1, 2]
cmp:
(1) (2) a: b: A B
(3) (X != Y)
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global: (6) g: 0 main:
(1) (2) x: y: X Y
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
Contradictory!
(1) (A == B) (2) (X == Y)
[3, 4] [5] [1, 2]
cmp:
(1) (2) a: b: A B
(3) (X != Y)
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
Global: (6) g: 0 main:
(1) (2) x: y: X Y
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; } Conditions:
Contradictory!
(1) (A == B) (2) (X == Y)
[3, 4] [5] [1, 2]
cmp:
(1) (2) a: b: A B
(3) (X != Y)
int g; main(int x, int y){ cmp(x, y); assume(!g); assume(x != y) assert(0); }
void cmp (int a , int b) { Goto L1, L2 L1: assume(a==b); g = 0; return; L2: assume(a!=b); g = 1; return; }
Predicates after simplification: { x == y, a == b }
Part III: Advanced Topics
CTypes Expressions LExpression Declaration Statements e l d s ::= ::= ::= ::= ::= | | | | | Procedures Program p g ::= ::= void | bool | int | ref c | x | e1 op e2 | &x | *x x | *x
skip
x1,x2 ,...,xn | goto L1,L2 ...Ln | L: s
assume(e) l = e l = f (e1 ,e2 ,...,en ) return x s1 ; s2 ;... ; sn f (x1: 1,x2 : 2,...,xn : n ) d1 d2 ... dn p1 p2 ... pn
Two Problems
Extending SLAM tools for pointers Dealing with imprecision of alias analysis
Pointers and SLAM
With pointers, C supports call by reference
Strictly speaking, C supports only call by value With pointers and the address-of operator, one can simulate call-by-reference
Boolean programs support only call-by-value-result
SLAM mimics call-by-reference with call-by-value-result
Extra complications:
address operator (&) in C multiple levels of pointer dereference in C
What changes with pointers?
C2bp
abstracting assignments abstracting procedure returns
Newton
simulation needs to handle pointer accesses need to copy local heap across scopes to match Bebop's semantics need to refine imprecise alias analysis using predicates
Bebop
remains unchanged!
Assignments + Pointers
Statement in P: *p = 3 Predicates in E: {x==5} What if *p and x alias?
Weakest Precondition: WP( *p=3 , x==5 ) = x==5
Correct Weakest Precondition: (p==&x and 3==5) or (p!=&x and x==5) We use Das's pointer analysis [PLDI 2000] to prune disjuncts representing infeasible alias scenarios.
Abstracting Procedure Return
Need to account for
lhs of procedure call mixed predicates side-effects of procedure
Boolean programs support only call-byvalue-result
C2bp models all side-effects using return processing
Abstracting Procedure Returns
Let a be an actual at call-site P(...)
pre(a) = the value of a before transition to P
Let f be a formal of a procedure P
pre(f) = the value of f upon entry to P
predicate
call/return relation
call/return assign
{x==1} {x==2}
Q() { int x = 1; x = R(x) }
int R (int f) { f=x int r = f+1; pre(f) == pre(x) f = 0; return r; x=r }
{f==pre(f)} {r==pre(f)+1}
WP(f=x, f==pre(f) ) = x==pre(f) WP(x=r, x==2) = r==2
x==pre(f) is true at the call to R
pre(f)==pre(x) and pre(x)==1 and r==pre(f)+1 implies ...