17-355/17-665: Program Analysis Introduction to Program Analysis Jonathan Aldrich Introduction 17-355/17-665: Program Analysis 1 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Find the Bug! Compiler Extensions, OSDI ’00. disable interrupts re-enable interrupts Introduction 17-355/17-665: Program Analysis 2 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Find the Bug! Compiler Extensions, OSDI ’00. disable interrupts ERROR: returning with interrupts disabled re-enable interrupts Introduction 17-355/17-665: Program Analysis 3 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. Introduction 17-355/17-665: Program Analysis 4 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. is_enabled Introduction 17-355/17-665: Program Analysis 5 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. is_enabled disable is_disabled Introduction 17-355/17-665: Program Analysis 6 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. enable => err(double enable) is_enabled disable is_disabled Introduction 17-355/17-665: Program Analysis 7 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. enable => err(double enable) is_enabled enable disable is_disabled Introduction 17-355/17-665: Program Analysis 8 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. enable => err(double enable) is_enabled enable disable is_disabled disable => err(double disable) Introduction 17-355/17-665: Program Analysis 9 © 2017 Jonathan Aldrich Metal Interrupt Analysis Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Compiler Extensions, OSDI ’00. enable => err(double enable) is_enabled enable disable is_disabled end path => err(end path with/intr disabled) disable => err(double disable) Introduction 17-355/17-665: Program Analysis 10 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. Introduction 17-355/17-665: Program Analysis 11 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. initial state is_enabled Introduction 17-355/17-665: Program Analysis 12 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. initial state is_enabled transition to is_disabled Introduction 17-355/17-665: Program Analysis 13 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. initial state is_enabled transition to is_disabled final state is_disabled: ERROR! Introduction 17-355/17-665: Program Analysis 14 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. initial state is_enabled transition to is_disabled final state is_disabled: ERROR! transition to is_enabled Introduction 17-355/17-665: Program Analysis 15 © 2017 Jonathan Aldrich Source: Engler et al., Checking System Rules Using System-Specific, Programmer-Written Applying the Analysis Compiler Extensions, OSDI ’00. initial state is_enabled transition to is_disabled final state is_disabled: ERROR! transition to is_enabled final state is_enabled is OK Introduction 17-355/17-665: Program Analysis 16 © 2017 Jonathan Aldrich Outline • Why program analysis? • The limits of testing and inspection • What is program analysis? • Course outline • Representing programs • AST-walking analyses Introduction 17-355/17-665: Program Analysis 17 © 2017 Jonathan Aldrich Introduction 17-355/17-665: Program Analysis 18 © 2017 Jonathan Aldrich Static Analysis Finds “Mechanical” Errors • Defects that result from inconsistently following simple, mechanical design rules • Security vulnerabilities • Buffer overruns, unvalidated input… • Memory errors • Null dereference, uninitialized data… • Resource leaks • Memory, OS resources… • Violations of API or framework rules • e.g. Windows device drivers; real time libraries; GUI frameworks • Exceptions • Arithmetic/library/user-defined • Encapsulation violations • Accessing internal data, calling private functions… • Race conditions • Two threads access the same data without synchronization Introduction 17-355/17-665: Program Analysis 19 © 2017 Jonathan Aldrich Difficult to Find with Testing, Inspection • Non-local, uncommon paths • Security vulnerabilities • Memory errors • Resource leaks • Violations of API or framework rules • Exceptions • Encapsulation violations • Non-deterministic • Race conditions Introduction 17-355/17-665: Program Analysis 20 © 2017 Jonathan Aldrich Quality Assurance at Microsoft (Part 1) • Original process: manual code inspection • Effective when system and team are small • Too many paths to consider as system grew Early 1990s: add massive system and unit testing Tests took weeks to run Diversity of platforms and configurations Sheer volume of tests Inefficient detection of common patterns, security holes Non-local, intermittent, uncommon path bugs Was treading water in Windows Vista development Early 2000s: add static analysis More on this later Introduction 17-355/17-665: Program Analysis 21 © 2017 Jonathan Aldrich Quality Assurance at Microsoft (Part 1) • Original process: manual code inspection • Effective when system and team are small • Too many paths to consider as system grew • Early 1990s: add massive system and unit testing • Tests took weeks to run • Diversity of platforms and configurations • Sheer volume of tests • Inefficient detection of common patterns, security holes • Non-local, intermittent, uncommon path bugs • Was treading water in Windows Vista development Early 2000s: add static analysis More on this later Introduction 17-355/17-665: Program Analysis 22 © 2017 Jonathan Aldrich Quality Assurance at Microsoft (Part 1) • Original process: manual code inspection • Effective when system and team are small • Too many paths to consider as system grew • Early 1990s: add massive system and unit testing • Tests took weeks to run • Diversity of platforms and configurations • Sheer volume of tests • Inefficient detection of common patterns, security holes • Non-local, intermittent, uncommon path bugs • Was treading water in Windows Vista development • Early 2000s: add program analysis • More on this later Introduction 17-355/17-665: Program Analysis 23 © 2017 Jonathan Aldrich Process, Cost, and Quality Slide: William Scherlis Process intervention, Additional technology testing, and inspection and tools are needed to yield first-order close the gap software quality improvement Perfection (unattainable) Critical Systems Acceptability Software Quality Process CMM: 1 2 3 4 5 Rigor, Cost S&S, Agile, RUP, etc: less rigorous . more rigorous Introduction 17-355/17-665: Program Analysis 24 © 2017 Jonathan Aldrich Outline • Why static analysis? • What is static analysis? • Abstract state space exploration • Course outline • Representing programs • AST-walking analyses Introduction 17-355/17-665: Program Analysis 25 © 2017 Jonathan Aldrich Static Program Analysis Definition • Static program analysis is the automated, systematic examination of an abstraction of a program’s state space Introduction 17-355/17-665: Program Analysis 26 © 2017 Jonathan Aldrich Static Program Analysis Definition • Static program analysis is the automated, systematic examination of an abstraction of a program’s state space • Metal interrupt analysis • Abstraction • 2 states: enabled and disabled • All program information—variable values, heap contents—is abstracted by these two states, plus the program counter Introduction 17-355/17-665: Program Analysis 27 © 2017 Jonathan Aldrich Static Program Analysis Definition • Static program analysis is the automated, systematic examination of an abstraction of a program’s state space • Metal interrupt analysis • Abstraction • 2 states: enabled and disabled • All program information—variable values, heap contents—is abstracted by these two states, plus the program counter • Systematic • Examines all paths through a function • What about loops? More later… • Each path explored for each reachable state • Assume interrupts initially enabled (Linux practice) • Since the two states abstract all program information, the exploration is exhaustive Introduction 17-355/17-665: Program Analysis 28 © 2017 Jonathan Aldrich Static Program Analysis Definition • Static program analysis is the automated, systematic examination of an abstraction of a program’s state space • Mathematical properties (recurring theme) • Soundness • All reported results are true • Verification: analysis says OK correctness property