Verifying Concurrent Message-Passing C Programs with Recursive Calls

Abstract

Abstract. We consider the model-checking problem for C programs with (1) data ranging over very large domains, (2) (recursive) procedure calls, and (3) concurrent parallel components that communicate via synchronizing actions. We model such programs using communicating pushdown systems, and reduce the reachability problem for this model to deciding the emptiness of the intersection of two context-free languages L 1 and L 2 . We tackle this undecidable problem using a CounterExample Guided Abstraction Refinement (CEGAR) scheme. We implemented our technique in the model checker MAGIC and found a previously unknown bug in a version of a Windows NT Bluetooth driver.

Unbounded Model-Checking with Interpolation for Regular Language Constraints

“…Chaki et al [2] do this in a different context, namely the verification of concurrent C programs; an implementation was incorporated into the model checker MAGIC [3].…”

Finding concurrency-related bugs using random isolation

“…, C n ), we define the target language of a CPDS CP with respect to S as Lang(CP, S) = 1≤i≤n Lang(P i , C i ), where intersection enforces that all the P i synchronize on the global actions. The goal of the CPDS model checker [3] is to determine if Lang(CP, S) is empty. Because each language Lang(P i , C i ) can be, in general, a context-free language, and the problem of checking their intersection for emptiness is known to be undecidable, the CPDS model checker algorithm is only a semi-decision procedure.…”

“…Additionally, in some cases, the semi-decision procedure can determine that Lang(CP, S) = ∅. We refer the reader to [3] for more details.…”

“…4 In Empire, a problematic interleaving scenario with respect to a set of shared memory locations is used as an input specification to a model checker. Specifically, Empire translates a concurrent Java program into a communicating pushdown system (CPDS) [2,3], and translates the scenario into a violation monitor that checks for the occurrence of the scenario, and runs concurrently with the other CPDS processes. Once the translation is performed, the generated CPDS is fed into a CPDS model checker [3].…”

Realizability of concurrent recursive programs

“…A context switch consists in a transfer of control from one process to another. This result allows for the discovery of many errors, since they typically manifest themselves after a few context switches [8,18,23]. Other approaches to analyzing multithreaded programs restrict the kind of communication between processes [18,26], or compute over-approximations of the set of reachable states [5].…”