233 research outputs found
Reachability analysis of multithreaded software with asynchronous communication
We introduce asynchronous dynamic pushdown networks (ADPN), a new model for multithreaded programs in which pushdown systems communicate via shared memory. ADPN generalizes both CPS (concurrent pushdown systems) and DPN (dynamic pushdown networks). We show that ADPN exhibit several advantages as a program model. Since the reachability problem for ADPN is undecidable even in the case without dynamic creation of processes, we address the bounded reachability problem, which considers only those computation sequences where the (index of the) thread accessing the shared memory is changed at most a fixed given number of times. We provide efficient algorithms for both forward and backward reachability analysis. The algorithms are based on automata techniques for symbolic representation of sets of configurations
CARET analysis of multithreaded programs
Dynamic Pushdown Networks (DPNs) are a natural model for multithreaded
programs with (recursive) procedure calls and thread creation. On the other
hand, CARET is a temporal logic that allows to write linear temporal formulas
while taking into account the matching between calls and returns. We consider
in this paper the model-checking problem of DPNs against CARET formulas. We
show that this problem can be effectively solved by a reduction to the
emptiness problem of B\"uchi Dynamic Pushdown Systems. We then show that CARET
model checking is also decidable for DPNs communicating with locks. Our results
can, in particular, be used for the detection of concurrent malware.Comment: Pre-proceedings paper presented at the 27th International Symposium
on Logic-Based Program Synthesis and Transformation (LOPSTR 2017), Namur,
Belgium, 10-12 October 2017 (arXiv:1708.07854
Faster Algorithms for Weighted Recursive State Machines
Pushdown systems (PDSs) and recursive state machines (RSMs), which are
linearly equivalent, are standard models for interprocedural analysis. Yet RSMs
are more convenient as they (a) explicitly model function calls and returns,
and (b) specify many natural parameters for algorithmic analysis, e.g., the
number of entries and exits. We consider a general framework where RSM
transitions are labeled from a semiring and path properties are algebraic with
semiring operations, which can model, e.g., interprocedural reachability and
dataflow analysis problems.
Our main contributions are new algorithms for several fundamental problems.
As compared to a direct translation of RSMs to PDSs and the best-known existing
bounds of PDSs, our analysis algorithm improves the complexity for
finite-height semirings (that subsumes reachability and standard dataflow
properties). We further consider the problem of extracting distance values from
the representation structures computed by our algorithm, and give efficient
algorithms that distinguish the complexity of a one-time preprocessing from the
complexity of each individual query. Another advantage of our algorithm is that
our improvements carry over to the concurrent setting, where we improve the
best-known complexity for the context-bounded analysis of concurrent RSMs.
Finally, we provide a prototype implementation that gives a significant
speed-up on several benchmarks from the SLAM/SDV project
Reachability for dynamic parametric processes
In a dynamic parametric process every subprocess may spawn arbitrarily many,
identical child processes, that may communicate either over global variables,
or over local variables that are shared with their parent.
We show that reachability for dynamic parametric processes is decidable under
mild assumptions. These assumptions are e.g. met if individual processes are
realized by pushdown systems, or even higher-order pushdown systems. We also
provide algorithms for subclasses of pushdown dynamic parametric processes,
with complexity ranging between NP and DEXPTIME.Comment: 31 page
Context-Bounded Analysis For Concurrent Programs With Dynamic Creation of Threads
Context-bounded analysis has been shown to be both efficient and effective at
finding bugs in concurrent programs. According to its original definition,
context-bounded analysis explores all behaviors of a concurrent program up to
some fixed number of context switches between threads. This definition is
inadequate for programs that create threads dynamically because bounding the
number of context switches in a computation also bounds the number of threads
involved in the computation. In this paper, we propose a more general
definition of context-bounded analysis useful for programs with dynamic thread
creation. The idea is to bound the number of context switches for each thread
instead of bounding the number of switches of all threads. We consider several
variants based on this new definition, and we establish decidability and
complexity results for the analysis induced by them
Reachability Analysis of Communicating Pushdown Systems
The reachability analysis of recursive programs that communicate
asynchronously over reliable FIFO channels calls for restrictions to ensure
decidability. Our first result characterizes communication topologies with a
decidable reachability problem restricted to eager runs (i.e., runs where
messages are either received immediately after being sent, or never received).
The problem is EXPTIME-complete in the decidable case. The second result is a
doubly exponential time algorithm for bounded context analysis in this setting,
together with a matching lower bound. Both results extend and improve previous
work from La Torre et al
Reachability Analysis of Asynchronous Dynamic Pushdown Networks Based on Tree Semantics Approach
ADPN (Asynchronous Dynamic Pushdown Networks) are an abstract model for concurrent programs with recursive procedures and dynamic thread creation. Usually, asynchronous dynamic pushdown networks are described with interleaving semantics, in which the backward analysis is not effective. In order to improve interleaving semantics, tree semantics approach was introduced. This paper extends the tree semantics to ADPN. Because the reachability problem of ADPN is also undecidable, we address the context-bounded reachability problem and provide an algorithm for backward reachability analysis with tree-based semantics Approach
Safety verification of asynchronous pushdown systems with shaped stacks
In this paper, we study the program-point reachability problem of concurrent
pushdown systems that communicate via unbounded and unordered message buffers.
Our goal is to relax the common restriction that messages can only be retrieved
by a pushdown process when its stack is empty. We use the notion of partially
commutative context-free grammars to describe a new class of asynchronously
communicating pushdown systems with a mild shape constraint on the stacks for
which the program-point coverability problem remains decidable. Stacks that fit
the shape constraint may reach arbitrary heights; further a process may execute
any communication action (be it process creation, message send or retrieval)
whether or not its stack is empty. This class extends previous computational
models studied in the context of asynchronous programs, and enables the safety
verification of a large class of message passing programs
- …