We present assumeguarantee model checking a novel tech nique for verifying correctness properties of looselycoupled multithreaded software systems Assumeguarantee model checking veri64257es each thread of a multithreaded system separately by constra ID: 7784 Download Pdf
com ABSTRACT False positives cause many promising detection tech nologies to be unworkable in practice Attackers we show face this problem too In deciding who to attack true positives are targets successfully attacked while false positives are those
com ABSTRACT False positives cause many promising detection tech nologies to be unworkable in practice Attackers we show face this problem too In deciding who to attack true positives are targets successfully attacked while false positives are those
com ABSTRACT It is often suggested that users are hopelessly lazy and unmotivated on security questions They chose weak passwords ignore security warnings and are oblivious to certi64257cates errors We argue that users rejection of the security advic
Yet things somehow muddle along two billion people use the Internet and seem to derive more good from it than harm If security is only as goo case outcomes happen 5774057630576805778157711576025774057711577995818957347t he answer may lie in economic
com Matthai Philipose Microsoft Research One Microsoft Way Redmond WA 98052 USA matthaipmicrosoftcom Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are n
The lower cost allows us to consider using two or more radios in the same device Given this we argue that wireless systems that use multiple radios in a collaborative manner dramatically improve system performance and functionality over the traditio
com Abstract Cascade detectors have been shown to operate extremely rapidly with high ac curacy and have important applications such as face detection Driven by this success cascade learning has been an area of active research in recent years Nev ert
com surajitcmicrosoftcom viveknarmicrosoftcom Abstract Automatically selecting an appropriate set of materialized views and indexes for SQL databases is a nontrivial task A judicious choice must be costdriven and influenced by the workload experience
In this paper we investigate scalable techniques for inducing discriminative features by taking ad vantage of simple second order structure in the data We focus on multiclass classi64257cation and show that features extracted from the generalized ei
com appelcaltechedu Abstract Cascades help make sliding window object detection fast nevertheless computational demands remain prohibitive for numerous applications Currently evaluation of adjacent windows proceeds inde pendently this is suboptimal a
Published bydanika-pritchard
We present assumeguarantee model checking a novel tech nique for verifying correctness properties of looselycoupled multithreaded software systems Assumeguarantee model checking veri64257es each thread of a multithreaded system separately by constra
Download Pdf - The PPT/PDF document "AssumeGuarantee Model Checking Cormac Fl..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
threadseparatelyusinganenvironmentassumptiontomodelinterleavedstepsoftheotherthreads.Theenvironmentassumptionofeachthreadisabinaryrelationoverthesetofglobalstores,andincludesallglobalstoreupdatesthatmaybeperformedbyotherthreads.Inearlierwork,weextendedtheassume-guaranteeproofruleofJonesandimplementeditintheCalvinchecker[FFQ02,FQS02]formultithreadedJavaprograms.OurexperienceusingCalvinindicatesthatthethreadsinmostsoft-waresystemsareloosely-coupled,i.e.,thereislittlecorrelationamongthelocalstatesofthevariousthreads,andassume-guaranteereasoningissucientlypow-erfultoverifythesesystems.However,asignicantcostofusingCalvinisthattheprogrammerisrequiredtoprovidetheappropriateenvironmentassumption.Theassume-guaranteemodelcheckingtechniqueinthispaperavoidsthiscostbyautomaticallyinferringtheseenvironmentassumptions.Assume-guaranteemodelcheckinginferstheenvironmentassumptionforeachthreadbyrstinferingaguaranteeforeachthread,whichmodelsallglobalstoreupdatesperformedbythatthread.Theenvironmentassumptionofathreadisthenthedisjunctionoftheguaranteesofalltheotherthreads.Theguaranteeofeachthreadisinitiallytheemptyrelation,andisiterativelyextendedduringthemodelcheckingprocess.Eachthreadisveriedusingthestandardalgorithmformodelcheckingasequentialpushdownsystemexceptthatateachcontrolpointofthethread,theglobalstateisallowedtomutateaccordingtotheguar-anteesoftheotherthreads.Inaddition,wheneverathreadmodiestheglobalstore,thattransitionontheglobalstatesisaddedtothatthread'sguarantee.Theiterationcontinuesuntilthereachablestatespaceandguaranteeofeachthreadconverges.ThecomplexityofthisprocedureisO(n:G3:L3:F),wherenisthenumberofthreads,Fisthenumberofstacksymbols,Gisthesizeoftheglobalstore,andListhesizeoflocalstoreperthread.Evenifthethreadsdonothaveastackandareconsequentlynite-state,assume-guaranteemodelcheckingoerssignicantsavingsoverstandardmodelchecking.Thenaivemodelcheckingalgorithmexplicitlymodelstheprogramcountersofallthreads.Therefore,itexploresallinterleavingsofthevariousthreadsanditscomplexityisexponentialinthenumberofthreads.However,assume-guaranteemodelcheckingverieseachthreadseparatelyanditscom-plexityO(n:G2:L:(n+L))issignicantlybetterthanthatofthenaivealgorithm.1.1ExampleToillustratethebenetsofassume-guaranteemodelchecking,weconsideritsapplicationtoasimplemultithreadedprogram.ThemultithreadedprogramSimple(n)hasnthreadswhichareconcurrentlyexecutingtheprocedurep.EachthreadisidentiedbyuniqueintegervaluefromthesetTid=f1;:::;ng.Thesethreadsmanipulateasharedintegervariablexinitializedto1.Thevariablexisprotectedbyamutexm,whichiseitherthe(non-zero)identierofthethreadholdingthelock,orelse0,ifthelockisnotheldbyanythread.Thus,thetypeMutex=f0g[Tid.Themutexmismanipulatedbytwooperations,acquireandrelease.Theoperationacquireblocksuntilm=0andthenatomically Theenvironmentassumptionofthethreadtidcanbecomputedfromtheguar-anteeasfollows:E(tid)def=9t2Tid:t6=tid^G[tid:=t]AnexaminationofRprovesthatSimple(n)satisesitsthreecorrectnessproperties:1.Thethreadwithidentiertidaccessesxonlywhenitsprogramcounterpc2f2;3;4g.EverymemberofRsatisesthepropertythatifpc2f2;3;4gthenm=tid.Therefore,itisimpossiblefortwodierentthreadstobeatacontrollocationinf2;3;4gsimulaneously.Consequently,thereisnoraceonthevariablex.2.EverymemberofRsatisesthepropertythatm=1whenpc=4.Therefore,theassertionatcontrollocation4holds.3.EverymemberofRsatisesthepredicatem=0)x=1,whichisthereforeaninvariantofSimple(n).ToverifytheprogramSimple(n),theassume-guaranteemodelcheckingalgo-rithmanalyzeseachthreadseparately.Whenanalyzingthreadtid,eachglobalstatestoredbythealgorithmcontainsvaluesform,x,andtheprogramcounterofthreadtid.ThealgorithmexploresO(n)statesandtransitionsforeachthread.Sincetherearenthreads,thenumberofexploredstatesandtransitionsisO(n2).Ontheotherhand,eachstatestoredbyanaivemodelcheckingalgorithmwillprovidevaluesform,x,andtheprogramcountersofallthethreads.Consequently,thenumberofstatesandtransitionsexploredareO(2n).Thus,forthisexample,theassume-guaranteemodelcheckingalgorithmprovidesexponentialsavingsinthetimeandspacerequiredforstate-spaceenumeration.Ourmodelofthemutexmisanimportantreasonforthesuccessofassume-guaranteemodelcheckingonthisexample.Althoughamutexcanbemodeledasasinglebit,wechosetomodelmasavariablewhosevalueindicatestheidentierofthethreadthatcurrentlyholdsthemutex.Thismutexmodeliscrucialforinferringthreadguaranteesandenvironmentassumptionsthatarestrongenoughtoverifyeachthreadseparately.1.2RelatedworkWereferthereadertoourearlierpapers[FFQ02,FQS02]foradiscussionoftherelatedworkonvericationofmultithreadedsoftwarebycompositionalreason-ingandmodelchecking.Cobleighetal.[CGP03]shareourmotivationofreducingtheannotationcostofcompositionalreasoning.Theyuseacounterexample-guidedlearningal-gorithmtoinferenvironmentassumptions,anapproachthatisverydierentfromours.Ouralgorithmisbasedentirelyonmodelchecking;thecorrectnesspropertiesoftheprogramareveriedandappropriateenvironmentassumptionsareinferredsolelybystate-spaceenumeration. theleastsolutionRStatetothefollowinginferencerulesdescribesthesetofreachablestates.Standardmodelchecking (basicinit) R(g0;ls0)(basicstep)R(g;ls)T(t;g;ls(t);g0;l0) R(g0;ls[t:=l0]) AlthoughweprovideadeclarativedenitionofRhere,itiseasilycomputedusingaworklist-basedalgorithm.HavingcomputedR,itisstraightforwardtodetermineifanyerroneousstateisreachable,i.e.,ifthereexistt,g,andlssuchthatR(g;ls)^E(t;g;ls).Unfortunately,thecomputationalcostofthisalgorithmbecomesexcessiveinthepresenceofmultiplethreads.Letn=jTidjbethenumberofthreadsandletG=jGlobalStorejandL=jLocalStorejbethesizesoftheglobalandlocalstores,respectively.ThenthesizeofRisG:Ln.Furthermore,foreachentryinRtheremayben:G:Lapplicationsof(basicstep).HencethetimecomplexityofthisalgorithmisO(n:G2:Ln+1).2.2Assume-guaranteemodelcheckingThecomplexityofstandardmodelcheckingisexponentialinthenumberofthreads,sinceitexplicitlycorrelatesthelocalstates(andprogramcounters)ofallthevariousthreads.However,sincethethreadsinmostsoftwaresystemsarepredominantlyloosely-coupled,thiscorrelationislargelyredundant.Assume-guaranteemodelcheckingprovidesameanstoavoidthisredundancy.Underassume-guaranteemodelchecking,eachthreadischeckedseparately,usingtheguaranteesthatabstractthebehaviorofinterleavedstepsofotherthreads.Thealgorithmworksbycomputingtworelations:R,whichspeciesthereachablestatesofeachthread,andG,whichistheguaranteeofeachthread.Thus,theguaranteeisinferredautomaticallyduringthemodelcheckingprocess.RTidGlobalStoreLocalStoreGTidGlobalStoreGlobalStoreTherelationR(t;g;l)holdsifthesystemcanreachastatewithglobalstoregandwherethethreadthaslocalstorel.Similarly,G(t;g;g0)holdsifastepbythreadtcangofromareachablestatewithglobalstoregtoastatewithglobalstoreg0.Whilemodelcheckingathreadwithidentierdierentfromt,weknowthatwhenevertheglobalstoreisgandG(t;g;g0)holds,aninterleavedstepofthreadtcanchangetheglobalstoretog0.TherelationsRandGaredenedastheleastsolutiontothefollowingrules. TherelationTmodelsthreadstepsthatdonotmanipulatethestack.Therela-tionT(t;g;l;g0;l0)holdsifthethreadtcantakeastepfromastatewithglobalandlocalstoresgandl,respectively,yielding(possiblymodied)storesg0andl0,andwherethestackisnotaccessedorupdatedduringthisstep.TherelationT+(t;g;l;l0;f)modelsstepsofthreadtthatpushaframeontothestack.Theglobalandlocalstoresareinitiallygandl,theglobalstoreisunmodiedduringthisstep,thelocalstoreisupdatedtol0,andtheframefispushedontothestack.Similarly,therelationT(t;g;l;f;l0)modelsstepsofthreadtthatpopaframefromthestack.Theglobalandlocalstoresareinitiallygandlandtheframefisinitiallyontopofthestack.Afterthestep,theglobalstoreisunmodied,thelocalstoreisupdatedtol0,andtheframefhasbeenpoppedfromthestack.Weassumethatallstacksareemptyintheinitialstate,andletss0mapeachthreadidentiertotheemptystack.ThesetofreachablestatesisthendenedbytheleastrelationRStatesatisfyingthefollowingrules.BasicPDAmodelchecking (basicpdainit) R(g0;ls0;ss0)(basicpdastep)R(g;ls;ss)T(t;g;ls(t);g0;l0) R(g0;ls[t:=l0];ss)(basicpdapush)R(g;ls;ss)T+(t;g;ls(t);l0;f) R(g0;ls[t:=l0];ss[t:=ss(t):f])(basicpdapop)R(g;ls;ss)ss(t)=s:fT(t;g;ls(t);f;l0) R(g;ls[t:=l0];ss[t:=s]) Sincethestacksizesareunbounded,thesetofreachablestatesmayalsobeunbounded.Consequently,anyalgorithmtocomputeRmaydiverge.Infact,themodelcheckingproblemforconcurrentpushdownsystemsisundecidable,aresultthatcanbeprovedbyreductionfromtheundecidableproblemofdeter-miningiftheintersectionoftwocontext-freelanguagesisempty[Ram00].3.1Assume-guaranteemodelcheckingAlthoughsoundandcompletemodelcheckingofconcurrentpushdownsystemsisundecidable,assume-guaranteereasoningallowsustomodelchecksuchsys-temsanaconservativeyetusefulmanner.Again,wemodelcheckeachthreadseparately,usingtheguaranteestoreasonabouttheeectofinterleavedstepsofotherthreads.ThealgorithmworksbycomputingtheguaranteerelationGandthereachabilityrelationsPandQ.GTidGlobalStoreGlobalStorePTidGlobalStoreLocalStoreGlobalStoreLocalStoreQTidGlobalStoreLocalStoreFrameGlobalStoreLocalStoreTheguaranteeG(t;g;g0)holdsifastepbythreadtcangofromareachablestateswithglobalstoregtoastatewithglobalstoreg0.ThereachabilityrelationP(t;g;l;g0;l0)holdsif(1)thesystemcanreachastatewithglobalstoregand 4DiscussionWehavepresentedanewtechniquecalledassume-guaranteemodelcheckingforverifyingmultithreadedsoftwaresystems.Althoughincompleteforgeneralsystems,thistechniqueisparticularlyeectiveforloosely-coupledmultithreadedsoftwarewherethethevariousthreadssynchronizeusingprimitivessuchasmutexes,readers-writerlocks,etc.Ifthesynchronizationprimitivesaremodeledwithappropriateauxiliaryinformation,thesesystemscanbeveriedonethreadatatime.Realisticsoftwaresystemsoftenhavedynamicthreadcreationthatmayleadtounboundednumberofthreads.Thisaspectofmultithreadedsoftwareiscur-rentlynothandledbyouralgorithm.However,thesetofthreadidentifers,evenifinnite,isascalarsettype[ID96].Consequently,thesesystemsareamenabletosymmetryreductionwhichweplantoexploitinfuturework.Theassume-guaranteemodelcheckingalgorithmconstructsaparticularab-stractionofmultithreadedsoftwareusingenvironmentassumptions.However,theabstractionmightbetoocoarsetoverifytherelevantcorrectnessproperty.Ifthealgorithmreportsanerror,wewouldlikeanecientproceduretocheckwhethertheviolationisrealorintroducedduetotheabstractionprocess.Inthesecondcase,wewouldliketoautomaticallyrenetheenvironmentassump-tionsbypossiblyexplicatingsomeaspectoftheprogramcountersoftheotherthreadsintheenvironment.Aftertherenement,themodelcheckingalgorithmcanberepeated.Thus,theassume-guaranteemodelcheckingalgorithmmaybeconvertedtoasemi-algorithmthatissoundandalsocompleteontermination.References[BET03]A.Bouajjani,J.Esparza,andT.Touili.Agenericapproachtothestaticanalysisofconcurrentprogramswithprocedures.InPOPL03:PrinciplesofProgrammingLanguages,2003.toappear.[CE81]E.M.ClarkeandE.A.Emerson.Designandsynthesisofsynchronizationskeletonsusingbranching-timetemporallogic.InWorkshoponLogicofPro-grams,LectureNotesinComputerScience131,pages52{71.Springer-Verlag,1981.[CGP03]J.M.Cobleigh,D.Giannakopoulou,andC.S.Pasareanu.Learningassump-tionsforcompositionalverication.InTACAS03:ToolsandAlgorithmsfortheConstructionandAnalysisofSystems,2003.toappear.[FFQ02]C.Flanagan,S.N.Freund,andS.Qadeer.Thread-modularvericationforshared-memoryprograms.InESOP02:EuropeanSymposiumonProgram-ming,LectureNotesinComputerScience2305,pages262{277,2002.[FQS02]C.Flanagan,S.Qadeer,andS.Seshia.Amodularcheckerformultithreadedprograms.InCAV02:ComputerAidedVerication,LectureNotesinCom-puterScience2404,pages180{194,2002.[HU79]J.E.HopcroftandJ.D.Ullman.IntroductiontoAutomataTheory,Languages,andComputation.Addison-WesleyPublishingCompany,1979.[ID96]C.N.IpandD.L.Dill.Bettervericationthroughsymmetry.FormalMethodsinSystemDesign,9(1{2):41{75,1996.
© 2021 docslides.com Inc.
All rights reserved.