© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Static and Dynamic Analyses

Leo Borges (leonardo.borges@intel.com)

Intel - Software and Services Group

iStep-Brazil, August 2013

1

Intel® Software Correctness Tools

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Correctness tools in development cycle, increase ROI by 12%-21%

Cost Factors – Square Project AnalysisCERT: U.S. Computer Emergency Readiness Team, and Carnegie Mellon CyLab

NIST: National Institute of Standards & Technology : Square Project Results

2

Size and complexity of applications are greater, organizations facing more

application defects, vulnerabilities and costs

Reworking defects 40%-50% of total project effort*

Effective analysis tools to find coding defects and vulnerabilities during the development lifecycle

Reduce time, effort, and cost required to find and repair coding defects and

security vulnerabilities, prior to deploying software

Increase developer productivity and proficiencies in delivering application

reliability & integrity

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Where are my application’s…

Memory Errors Threading Errors Security Errors

• Invalid Accesses• Memory Leaks• Uninitialized Memory

Accesses

• Races• Deadlocks• Cross Stack References

• Buffer overflows and underflows

• Incorrect pointer usage• Over 250 error types…

Intel® Software Correctness ToolsMove correctness analysis earlier in the design cycle

3

• Workflow for developers• Multiple tools – common i/f• Windows & Linux

Jean KypreosAdvanced Video Processing Team Manager

Envivio

"Having such a tool this early in the development stage frees the validation from trivial bug reports and gives our engineers the opportunity to code more efficiently from the very beginning of the product cycle."

When is the best time to find a leak? A race? Security error?

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Tiny example

char *p1, *p2 = (char *)malloc(10);

p1 = p2;

free(p1);

*p2 = ‘a’;

free(p2);

4

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Intel® Software Correctness Tools

Two Types of Analysis

• Dynamic Analysis

– Tool instruments & runs the app, watches for errors

• Static Analysis

– Tool inspects the source

5

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Dynamic AnalysisDetects memory and threading errors

• Memory errors• Invalid Memory Accesses• Memory Leaks• Uninitialized Memory Accesses • Improper usage of Memory API(s)• Resource Leaks (Windows only)

• Threading Errors• Data Races• Deadlock/Lock Hierarchy Violation• Cross Stack Memory Accesses

• Use your normal build & compiler (dynamic binary instrumentation)

• Analyze DLLs (source optional)

• Runs threaded if app threaded• Requires a workload (app is run)

• 32 and 64-bit OSs• Easy user interface + cmd line• Errors do not have to occur to be

detected

6

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Dynamic Analysis: Before You Start

• Inspector instruments your code at run-time

– Intercepts memory, thread and synchronization API’s, memory accesses

– Increases execution time and size

• Use small data sets (workloads)

– Execution time and space is expanded

– But no need to execute every iteration.

– Multiple runs over different paths yield best results

Workload selection is important!

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Static AnalysisDetects over 250 different kinds of errors & security risks

Coding Errors (partial list)

• Memory and resource leaks• Incorrect OpenMP* and Cilk directives• Pointer and array errors

Security Errors (partial list)

• Buffer overflows and underflows• Uninitialized variables and objects• Incorrect pointer usage• Misuse of string, memory formatting library

routines

• No compiler change required- Existing compiler for code generation- Intel compiler front end for static analysis

• No workload required• Fast ~1.5X time of an optimizing compile†

• Every developer can run SSA(no central server, it is like a regular build)

• Easy user interface + cmd line

8

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Static & Dynamic Analysis Complement Each Other

9

Dynamic Analysis Static Analysis

Memory & Threading Errors Memory, Code & Security Errors

Slow (1x – 20x - 100x workload) Fast (~1.5x optimizing compile†)

Workload must exercise path(does not need to cause a program error)

All paths checked

Fewer false errors – only on real paths More errors – we rank by risk

No source required – check DLLs Source required

Use your normal compilerUse your current build - No rebuild(debug build with symbols recommended)

No compiler change required- Existing compiler for code generation- Intel compiler front end for static analysis

No central server to set upJust create a build for static analysis- Auto setup available in Visual Studio††

Both reduce total lifecycle costs.† Estimate. Your results may vary. †† Requires Parallel Studio XE SP1

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Intel Inspector XE

Productive User Interface

One productive interface for both static and dynamic analysis.

Dynamic Static

View Context of Problem StackMultiple Contributing Source Locations

Collapse multiple “sightings” to one error(e.g., memory allocated in a loop, then leaked is 1 error)

Suppression, Filtering, and Workflow Management

Visual Studio Integration (Windows)

Command line for automated tests

Time Line visualization

Memory Growth during a transaction

Static Analysis is included in Studio XE products. It is not sold separately.

10

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Intel Inspector XE

Productive User Interface

11

Problem States:New, Not Fixed, Fixed, Confirmed, Not a problem, Regression

Use filters to focus on a module, or error type, or…

Code locations displayed for selected problem

Select a problem set

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Double Click Problem for Source & Call Stacks

12

Source code locations displayed for selected problem

Call Stacks

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Filtering lets you focus on what’s important

(2) Error count drops

(1) Filter – Show only one source file

Before – All Errors After – Only errors from one source file

13

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Problem State Lifecyclemakes problem tracking easier

State Description

New Detected by this run

Not Fixed Previously seen error detected by this run

Not a Problem Set by user – tool will not change

Confirmed Set by user – tool will not change

Fixed Set by user

Regression Error detected with previous state of “Fixed”

14

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Suppressions Manage False Errors

• Suppressions are saved in one or more files

• Tool suppresses all files from specified folder(s)

• Private & Public suppression folders

• Copy a suppression to public folder to promote

Suppressions are marked (shown) or hidden entirely

Be specific or use a wild card for any column

Team sharing of suppression files reduces false error count

15

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Timeline makes it easier to understandtiming relationships

Individual code locations are shown in the context of their respective threads

Hover gives details

16

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Analyze Memory Growth inTransactional Applications

17

Set Start Point

Set End Point

Memory GrowthProblem Set

Code location for each block of memory that was

allocated but not de-allocated during the time

period

During Analysis:

Analysis Results:

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Automate analysisCommand Line Interface• inspxe-cl is the command line:

– Windows: C:\Program Files\Intel\Inspector XE \bin[32|64]\inspxe-cl.exe

– Linux: /opt/intel/inspector_xe/bin[32|64]/inspxe-cl

• Help:inspxe-cl –help

• Set up command line with GUI

• Command examples:1. inspxe-cl -collect-list

2. inspxe-cl –collect ti2 -- MyApp.exe

3. inspxe-cl –report problems

Great for regression analysis – send results file to developerCommand line results can also be opened in the GUI

18

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Integrated Debugger Support

Break into debugger

Analysis can stop when it detects a problem

User is put into a standard debugging session

Windows*

Microsoft* Visual Studio Debugger

Linux*

gdb

Intel® Debugger

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others. 20

Using the Intel® Inspector XE with MPI

• Compile the inspector_example.c code with the MPI scripts

• Use the command-line tool under the MPI run scripts to gather report data

>mpirun -n 4 inspxe-cl –-result-dir insp_results

-collect mi1 -- ./insp_example.exe

• Output is: a results directory for each MPI rank in the job ls

>grep inspector_results on Linux

• Launch the GUI and view the results for each particular rank

>inspxe-gui insp_results.<rank#> on Linux

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.

Additional Material

• Short demo & “how to” movies:– Intel® Inspector XE memory and thread checking

– Static Analysis correctness and security checking

– Intel® VTune™ Amplifier XE performance profiler

• Evaluation Guides

– Static Analysis (cheat sheet on how to set up static analysis)

– Eliminate Memory Errors

– Resolve Resource Leaks

• Knowledge Base

21

© 2013, Intel Corporation. All righ ts reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.

and/or other countries. *Other names and brands may be claimed as the property of others.22