Top Banner
A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg Anastasios Andronidis Cristian Cadar {l.pina / daniel.grumberg14 / a.andronidis15 / c.cadar}@imperial.ac.uk Imperial College London London, UK July 13th, 2017 2017 USENIX Annual Technical Conference (ATC)
63

A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Apr 20, 2018

Download

Documents

hanhi
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

A DSL Approach to Reconcile Equivalent Divergent ProgramExecutions

LuísPina

DanielGrumberg

AnastasiosAndronidis

CristianCadar

{l.pina / daniel.grumberg14 / a.andronidis15 / c.cadar}@imperial.ac.ukImperial College London

London, UK

July 13th, 2017

2017 USENIX Annual Technical Conference (ATC)

Page 2: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

What are“Equivalent Divergent Program Executions”?

And why should I care about reconciling them?

Page 3: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Equivalent Divergent Program Executions

>./hello1 >./hello2Hello world Hello world

>ldd hello1 >ldd hello2libc.so.6 libc.so.6

jemalloc.so.6>strace hello1 >strace hello2write(1, "Hello world", 11) write(1, "Hello ", 6)

write(1, "world" , 5)

3

Page 4: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Equivalent Divergent Program Executions

>./hello1 >./hello2Hello world Hello world>ldd hello1 >ldd hello2libc.so.6 libc.so.6

jemalloc.so.6

>strace hello1 >strace hello2write(1, "Hello world", 11) write(1, "Hello ", 6)

write(1, "world" , 5)

4

Page 5: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Equivalent Divergent Program Executions

>./hello1 >./hello2Hello world Hello world>ldd hello1 >ldd hello2libc.so.6 libc.so.6

jemalloc.so.6>strace hello1 >strace hello2write(1, "Hello world", 11) write(1, "Hello ", 6)

write(1, "world" , 5)

5

Page 6: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Multi-Version Execution (MVE)

Run multiple versions as one

I Improves reliabilitymalloc(WEIRD_NUMBER) jemalloc(WEIRD_NUMBER)SEGFAULT OK

I Improves security>strace hello1 >strace hello2write(1,"Hello world") write(1,"Hello, ")

fork()execve("/bin/sh")write(1,"world!")

Versions should be diverse but equivalent

6

Page 7: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Multi-Version Execution (MVE)

Run multiple versions as one

I Improves reliabilitymalloc(WEIRD_NUMBER) jemalloc(WEIRD_NUMBER)SEGFAULT OK

I Improves security>strace hello1 >strace hello2write(1,"Hello world") write(1,"Hello, ")

fork()execve("/bin/sh")write(1,"world!")

Versions should be diverse but equivalent

7

Page 8: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Multi-Version Execution (MVE)

Run multiple versions as one

I Improves reliabilitymalloc(WEIRD_NUMBER) jemalloc(WEIRD_NUMBER)SEGFAULT OK

I Improves security>strace hello1 >strace hello2write(1,"Hello world") write(1,"Hello, ")

fork()execve("/bin/sh")write(1,"world!")

Versions should be diverse but equivalent

8

Page 9: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Multi-Version Execution (MVE)

Run multiple versions as one

I Improves reliabilitymalloc(WEIRD_NUMBER) jemalloc(WEIRD_NUMBER)SEGFAULT OK

I Improves security>strace hello1 >strace hello2write(1,"Hello world") write(1,"Hello, ")

fork()execve("/bin/sh")write(1,"world!")

Versions should be diverse but equivalent9

Page 10: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Versions should be diverse but equivalent

What about equivalent executions that issue divergent sequencesof system calls?

>strace hello1 >strace hello2write(1,"Hello world", 11)

=>

write(1,"Hello ", 6)

,

write(1,"world" , 5)

Describe the divergences with aDomain Specific Language (DSL)

10

Page 11: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Versions should be diverse but equivalent

What about equivalent executions that issue divergent sequencesof system calls?

>strace hello1 >strace hello2write(1,"Hello world", 11)

=>

write(1,"Hello ", 6)

,

write(1,"world" , 5)

Describe the divergences with aDomain Specific Language (DSL)

11

Page 12: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Versions should be diverse but equivalent

What about equivalent executions that issue divergent sequencesof system calls?

>strace hello1 >strace hello2

write(1,"Hello world", 11)

=>

write(1,"Hello ", 6)

,

write(1,"world" , 5)

Describe the divergences with aDomain Specific Language (DSL)

12

Page 13: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Versions should be diverse but equivalent

What about equivalent executions that issue divergent sequencesof system calls?

>strace hello1 >strace hello2

write(1,"Hello world", 11) => write(1,"Hello ", 6) ,write(1,"world" , 5)

Describe the divergences with aDomain Specific Language (DSL)

13

Page 14: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

14

Page 15: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

15

Page 16: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

16

Page 17: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar"

. . .

. . .

. . .

Recorded

Replayed

DSL

17

Page 18: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar"

. . .

. . .

. . .

Recorded

Replayed

DSL

18

Page 19: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar"

. . .

. . .

. . .

Recorded

Replayed

DSL

19

Page 20: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar"

. . .

. . .

. . .

Recorded

Replayed

DSL

20

Page 21: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

21

Page 22: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

22

Page 23: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

MVE ArchitectureVaran

1234

567

891011

12

RingBuffer

SharedMemory

Leader Follower

User

Varan

OS Kernel

read(0,_,128)

read(0,_,128)

read(0,_,128) = 6 // "foobar"

6, "foobar". . .

. . .

. . .

Recorded

Replayed

DSL

23

Page 24: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

DSL ArchitectureRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

24

Page 25: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

DSL ArchitectureRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

25

Page 26: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

DSL ArchitectureRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

26

Page 27: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

DSL Rules

I Default rule: read(_,_,_) as r => rI Actions

I MATCHI NOPI SKIPI EXECUTEI STORE

I Further examplesI Hello worldI nothing keywordI C predicates

27

Page 28: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World Rule

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

28

Page 29: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSL

nop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

29

Page 30: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

30

Page 31: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

31

Page 32: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

32

Page 33: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

33

Page 34: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

34

Page 35: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Hello World RuleRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

write(1, "Hello world", 11) => write(1, "Hello ", 6),write(1, "world" , 5)

35

Page 36: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

nothing Keyword

nothing => sched_yield()

36

Page 37: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

nothing KeywordRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSL

nopexec sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

nothing => sched_yield()37

Page 38: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

nothing KeywordRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

nothing => sched_yield()38

Page 39: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

nothing KeywordRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

nothing => sched_yield()39

Page 40: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

nothing KeywordRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

nothing => sched_yield()

40

Page 41: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C Predicatesand multiple left-hand side

// extern int sig1, sig2;sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

41

Page 42: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

42

Page 43: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

43

Page 44: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

44

Page 45: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

45

Page 46: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig11.

DSL

storenop

sigactionsig22.

DSL

match 2

match

sigactionsig2DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

46

Page 47: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

C PredicatesRecorded

read"foobar"

. . .Replayed

read"foobar"

. . .

DSL

match match

read"foobar"

read"foobar"

write"Hello world"

write"Hello "write

"world"

DSLnop exec

write"Hello "

DSL

skipexec

write"Hello world"

write"world"

?

sched_yield

DSLnop

exec

sched_yield

sigactionsig1

sigactionsig2

?sigaction

sig2sigaction

sig1

DSL

store

nop

sigactionsig1

1.

DSL

storenop

sigactionsig2

2.

DSL

match 2

match

sigactionsig2

DSL

match 1

match

sigactionsig1

sigactionsig2

sigactionsig1

sigact(sig,_,_) { $(sig) == sig1; } as s1,sigact(sig,_,_) { $(sig) == sig2; } as s2 => s2, s1

47

Page 48: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenarios

I Different configurationsI Different releasesI Different dynamic analyses

48

Page 49: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenariosDifferent configurations

Recorded Redis minimal configReplayed 1 Redis with persistency (3 rules)Replayed 2 Redis with verbose logs (4 rules)Replayed 3 Redis with persistency and verbose logs (7 rules)

49

Page 50: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenariosDifferent releases

ID Redis Versions Commits RulesRecorded – Replayed1 1.3.8 – 1.3.10 40 0

6

2 1.3.10 – 1.3.12 105 03 1.3.12 – 2.0.0 92 14 2.0.0 – 2.0.5 34 15 2.0.5 – 2.2.0 730 36 2.2.0 – 2.2.15 110 2

50

Page 51: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenariosAnalyses

Recorded NativeReplayed 1 Asan (3 rules)Replayed 2 Msan (1 rule)Replayed 3 Tsan (5 rules)Replayed 4 Valgrind (14 rules)1

× I git (log, blame, diff, tag)I openssh (ssh, ssh-keygen)I htopI vim

1Expands to 31 rules through group syntatic-sugar51

Page 52: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenariosAnalyses

Recorded NativeReplayed 1 Asan (3 rules)Replayed 2 Msan (1 rule)Replayed 3 Tsan (5 rules)Replayed 4 Valgrind (14 rules)1

×

I git (log, blame, diff, tag)I openssh (ssh, ssh-keygen)I htopI vim

1Expands to 31 rules through group syntatic-sugar52

Page 53: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Deployment scenariosAnalyses

Recorded NativeReplayed 1 Asan (3 rules)Replayed 2 Msan (1 rule)Replayed 3 Tsan (5 rules)Replayed 4 Valgrind (14 rules)1

× I git (log, blame, diff, tag)I openssh (ssh, ssh-keygen)I htopI vim

1Expands to 31 rules through group syntatic-sugar53

Page 54: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding these rules must be hard. . .

It isn’t

Page 55: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding these rules must be hard. . .

It isn’t

Page 56: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding Rules

1. strace -o native.log native

2. strace -o valgrind.log valgrind

3. vimdiff native.log valgrind.log

56

Page 57: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding Rulesvimdiff native.log

gettid

read(3, ..., 4096)gettid

lseek(3, -2347, SEEK_CUR)gettid

read(3, ..., 4096)gettid

close(3)

valgrind.loggettid()write(1029, "D", 1)sigprocmask([], ~[...])read(3, ..., 4096)sigprocmask(~[...], NULL)gettid()read(1028, "D", 1)lseek(3, -2347, SEEK_CUR)gettid()write(1029, "E", 1)sigprocmask([], ~[...])read(3, ..., 4096)sigprocmask( [...], NULL)gettid()read(1028, "E", 1)close(3)

57

Page 58: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding Rulesvimdiff native.log

gettid

read(3, ..., 4096)gettid

lseek(3, -2347, SEEK_CUR)

gettid

read(3, ..., 4096)gettid

close(3)

valgrind.loggettid()write(1029, "D", 1)sigprocmask([], ~[...])read(3, ..., 4096)sigprocmask(~[...], NULL)gettid()read(1028, "D", 1)

lseek(3, -2347, SEEK_CUR)

gettid()write(1029, "E", 1)sigprocmask([], ~[...])read(3, ..., 4096)sigprocmask( [...], NULL)gettid()read(1028, "E", 1)

close(3)

58

Page 59: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Finding Rulesvimdiff native.log

gettid

read( _ , _ , _ ) as r =>gettid

lseek(3, -2347, SEEK_CUR)

gettid

read(3, ..., 4096)gettid

close(3)

valgrind.loggettid() ,write(1029, _ , 1) ,sigprocmask( _ , _ ) ,r,

sigprocmask( _ , _ ) ,gettid() ,read(1028, _ , 1)

lseek(3, -2347, SEEK_CUR)

gettid()write(1029, "E", 1)sigprocmask([], ~[...])read(3, ..., 4096)sigprocmask( [...], NULL)gettid()read(1028, "E", 1)

close(3)

59

Page 60: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Rule synthesis algorithm

I Rules with the shape: syscall as s => ..., s, ...I Input: recorded and replayed tracesI Output: set of candidate rulesI Was able to find 16 out of 19 applicable rules

I Non-determinism and infrequent syscalls impact quality of rulesI Details in the paper

60

Page 61: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

Conclusion

A DSL Approach to Reconcile EquivalentDivergent Program Executions

I Increases the applicability of multi-version executionI For reliability and securityI State-of-the-art MVE struggles with divergences

I Simple expressive language for reconciling system call sequencesI Recorded and replayedI DSL provides the required action to tolerate divergences

I Necessary rules are easy to identifyI vimdiff of strace logs

I Automatic algorithm to synthethize rulesI From equivalent strace logs

61

Page 62: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

We’re hiring!

I Post-doc position in Software Systems and Program AnalysisI Starting in November 2017, apply until August 2017I Up to 17 months, possibly extendable to 24I Details: https://srg.ic.ac.uk/vacancies

62

Page 63: A DSL Approach to Reconcile Equivalent Divergent … · A DSL Approach to Reconcile Equivalent Divergent Program Executions Luís Pina Daniel Grumberg ... >strace hello1>strace hello2

A DSL Approach to Reconcile EquivalentDivergent Program Executions

I Increases the applicability of multi-version executionI For reliability and securityI State-of-the-art MVE struggles with divergences

I Simple expressive language for reconciling system call sequencesI Recorded and replayedI DSL provides the required action to tolerate divergences

I Necessary rules are easy to identifyI vimdiff of strace logs

I Automatic algorithm to synthethize rulesI From equivalent strace logs

Luís Pina, Daniel Grumberg, Anastasios Andronidis, Cristian CadarImperial College London

63