RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage •...
Transcript of RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage •...
![Page 1: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/1.jpg)
Cristian Cadar, Peter Boonstoppel, Dawson Engler
RWset: Attacking Path Explosion in Constraint-Based Test Generation
TACAS 2008, Budapest, Hungary ETAPS 2008
![Page 2: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/2.jpg)
Goal: generate inputs that explore (ideally) all paths of a program
Run program on symbolic input, whose initial value is anything
At conditionals that use symbolic inputs, fork execution and follow both paths: On true branch, add constraint that condition is true On false, that it is not
When a path terminates, generate a test case by solving the constraints on that path
Constraint-Based Test Generation
![Page 3: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/3.jpg)
• EGT / EXE / KLEE • DART [Godefroid/Klarlund/Sen] • CUTE [Sen et al.] • SAGE, Pex [Godefroid et al.] • Vigilante [Castro et al ] • BitScope [Song et al.]
• RWset applicable to any of these
Constraint-Based Test Generation
![Page 4: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/4.jpg)
Effective bug-finding tool File system code
ext2, ext3, JFS Networking applications
bpf, udhcpd Library code
PCRE, Pintos Device drivers
Minix
EXE Results
![Page 5: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/5.jpg)
Scalability challenge
• Exponential space! – Relatively small number of interesting paths: e.g., those that achieve
maximum branch coverage
• Mixed symbolic/concrete execution (EXE/DART) • Search heuristics
– Best First Search (EXE) – Generational Search (SAGE)
• Symbolic execution + random testing (Hybrid CUTE) • Caching function summaries (SMART) • Demand-Driven Compositional Symbolic Execution (Pex)
![Page 6: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/6.jpg)
RWset (read-write set) analysis
• Determine whether continuing to execute the current program path will explore new states
• Only a value observed by the program can determine the execution of new program states
![Page 7: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/7.jpg)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
![Page 8: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/8.jpg)
flag = 0
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
![Page 9: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/9.jpg)
arg1 > 100
flag = 0
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 ≤ 100
. . . . . .
![Page 10: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/10.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100 false: arg2 ≤ 100
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 ≤ 100
![Page 11: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/11.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 ≤ 100
process(data, 1)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 ≤ 100
![Page 12: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/12.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 ≤ 100
process(data, 1) process(data, 1)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 ≤ 100
![Page 13: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/13.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 ≤ 100
process(data, 1) process(data, 1)
If arg1, arg2 not read
true: arg1 > 100 false: arg1 ≤ 100
![Page 14: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/14.jpg)
Write-set analysis • Look at values written in the past • State abstraction in model checking • Memory state = write set up to current progr. pt.
– Concrete writes: concr loc = concr val – Symbolic writes: constraint(sym loc)
• Program point P, two paths w/ same write-set – prune the second one
![Page 15: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/15.jpg)
Write-sets • Precision: reason at the byte-level • Minimize write-set size
1. Overwrites 2. Dead locations 3. Alpha renaming
• Complicated in the symbolic domain
a[i] = 17; a[j] = 20;
• Cannot discard all constraints on dead locations
![Page 16: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/16.jpg)
Read-set analysis
• Key idea: can ignore from write-set writes to locations that are never read again – Definition of read driven by goal to achieve
high branch coverage – Location read if can hit a new branch by
changing its value
![Page 17: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/17.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
RWset
arg1 = *
True-True path
arg2 = *
data = *
![Page 18: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/18.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 = *
True-True path
arg2 = * flag = 0
data = *
RWset
![Page 19: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/19.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 > 100
True-True path
arg2 = * flag = 0
data = *
RWset
![Page 20: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/20.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 > 100
True-True path
arg2 = * flag = 1
data = *
RWset
![Page 21: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/21.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = *
RWset
![Page 22: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/22.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = *
RWset
![Page 23: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/23.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = *
RWset
![Page 24: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/24.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
True-True path
flag = 1
data = *
arg1, arg2 not read
arg1 > 100 arg2 > 100
RWset
![Page 25: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/25.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = * arg1 > 100 arg2 ≤ 100
flag = 1
data = *
arg1, arg2 not read
RWset RWset
![Page 26: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/26.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = * arg1 > 100 arg2 ≤ 100
flag = 1
data = *
arg1, arg2 not read
RWset RWset
![Page 27: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/27.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 ≤ 100
process(data, 1)
true: arg1 > 100 false: arg1 ≤ 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100 flag = 1
data = * arg1 > 100 arg2 ≤ 100
flag = 1
data = *
arg1, arg2 not read
RWset RWset
![Page 28: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/28.jpg)
Implementation Execution path Global cache
P
W1
W2
Wp
(W1, R1) (W2, R2)
… (Wn, Rn)
RW-Set(P)
WP
![Page 29: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/29.jpg)
Implementation
P
W1
W2
Wp
(W1, R1) (W2, R2)
… (Wn, Rn) Write-set Hit!
Emit test case ∃i.(WP = Wi)
RW-Set(P)
WP
Execution path Global cache
![Page 30: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/30.jpg)
Implementation
P
W1
W2
Wp WP
Read-set Hit!
∃i.(WP ∩ Ri = Wi ∩ Ri) Add (WP,Ri) to RW-Set(P)
(W1, R1) (W2, R2)
… (Wn, Rn) (WP, Ri) Emit test case
RW-Set(P)
Execution path Global cache
![Page 31: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/31.jpg)
Implementation
P
W1
W2
Wp
(W1, R1) (W2, R2)
… (Wn, Rn) (WP, _) Miss!
Add (WP,_) to RW-Set(P)
. . .
RW-Set(P)
WP
Execution path Global cache
![Page 32: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/32.jpg)
Evaluation
• Medium-sized open source benchmarks – bpf, udhcpd, expat, tcpdump, pcre
• Minix 3 device drivers – lance, pci, sb16
![Page 33: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/33.jpg)
Medium-sized apps
• bpf: Berkeley Packet Filter • expat: XML parsing library • pcre: Perl compatible reg exp library • tcpdump: tool for printing packet headers • udhcpd: a DHCPD server
![Page 34: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/34.jpg)
Medium-sized apps
• Ran base EXE on each app for 30 minutes – Except 30,000 test cases for PCRE
• Recorded number of branches hit • Reran in RWset mode until we reached
the same branch coverage
![Page 35: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/35.jpg)
Medium-sized apps
![Page 36: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/36.jpg)
Non-redundant states pcre
tcpdump
expat
udhcpd
bpf
Test cases
Non
-red
unda
nt st
ates
Test cases Test cases
Test cases Test cases
Non
-red
unda
nt st
ates
Non
-red
unda
nt st
ates
![Page 37: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/37.jpg)
Performance
• Dry run for the medium-sized apps: compute write-sets and read-sets but do no pruning
![Page 38: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/38.jpg)
Device drivers
• Hard to check w/o the physical device or outside of the kernel
• Focused on three MINIX 3 drivers: – lance: AMD lance ethernet card driver – pci: PCI bus driver – sb16: Sound Blaster 16 driver
![Page 39: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/39.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
while (1) {
/* receive message from other processes, the kernel, or the hardware */
message = read_message(); process(message);
}
![Page 40: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/40.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
while (1) {
/* receive message from other processes, the kernel, or the hardware */
message = read_symbolic_data(); process(message);
}
![Page 41: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/41.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
for (k=0; k < n; k++) {
/* receive message from other processes, the kernel, or the hardware */
message = read_symbolic_data(); process(message);
}
![Page 42: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/42.jpg)
Minix drivers - evaluation
• Three versions of EXE: – Base – Write-set – RWset
• Fixed the # of iterations in each version – mainly to have the base version terminate
• Ran each version for an hour – recorded branch coverage + non-redundant states
![Page 43: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/43.jpg)
Branch coverage (pci)
RWset Write-set
Base
![Page 44: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/44.jpg)
Branch coverage (lance)
RWset Write-set
Base
![Page 45: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/45.jpg)
RWset Write-set
Base
Branch coverage (sb16)
![Page 46: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/46.jpg)
Non-redundant states
RWset DFS
RWset DFS
RWset DFS
RWset Base
RWset Base
RWset Base
![Page 47: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/47.jpg)
Bugs in device drivers
![Page 48: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/48.jpg)
Summary
• RWset analysis – efficient way to prune large numbers of
redundant paths – only values observed by the program trigger the
execution of new paths • Evaluated on Minix drivers and medium
size applications – big reduction in the number of paths explored
![Page 49: RWset: Attacking Path Explosion in Constraint-Based Test ...€¦ · maximum branch coverage • Mixed symbolic/concrete execution (EXE/DART) • Search heuristics – Best First](https://reader034.fdocuments.in/reader034/viewer/2022042216/5ebef895607646403a7dac9f/html5/thumbnails/49.jpg)
Questions?