1. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Static and Dynamic Analyses
Leo Borges (leonardo.borges@intel.com)
Intel - Software and Services Group
iStep-Brazil, August 2013
1
Intel® Software
Correctness Tools

2. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Correctness tools in development cycle,
increase ROI by 12%-21%
Cost Factors – Square Project Analysis
CERT: U.S. Computer Emergency Readiness Team, and Carnegie Mellon CyLab
NIST: National Institute of Standards & Technology : Square Project Results
2
Size and complexity of applications are
greater, organizations facing more
application defects, vulnerabilities and
costs
Reworking defects 40%-50% of total
project effort*
Effective analysis tools to find coding
defects and vulnerabilities during the
development lifecycle
Reduce time, effort, and cost required
to find and repair coding defects and
security vulnerabilities, prior to
deploying software
Increase developer productivity and
proficiencies in delivering application
reliability & integrity

3. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Where are my application’s…
Memory Errors Threading Errors Security Errors
• Invalid Accesses
• Memory Leaks
• Uninitialized Memory
Accesses
• Races
• Deadlocks
• Cross Stack References
• Buffer overflows and
underflows
• Incorrect pointer usage
• Over 250 error types…
Intel® Software Correctness Tools
Move correctness analysis earlier in the design cycle
3
• Workflow for developers
• Multiple tools – common i/f
• Windows & Linux
Jean Kypreos
Advanced Video Processing Team Manager
Envivio
"Having such a tool this early in the development stage frees the
validation from trivial bug reports and gives our engineers the
opportunity to code more efficiently from the very beginning of the
product cycle."
When is the best time to find a leak? A race? Security error?

4. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Tiny example
char *p1, *p2 = (char *)malloc(10);
p1 = p2;
free(p1);
*p2 = ‘a’;
free(p2);
4

5. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Intel® Software Correctness Tools
Two Types of Analysis
• Dynamic Analysis
– Tool instruments & runs the app,
watches for errors
• Static Analysis
– Tool inspects the source
5

6. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Dynamic Analysis
Detects memory and threading errors
• Memory errors
• Invalid Memory Accesses
• Memory Leaks
• Uninitialized Memory Accesses
• Improper usage of Memory API(s)
• Resource Leaks (Windows only)
•Threading Errors
• Data Races
• Deadlock/Lock Hierarchy Violation
• Cross Stack Memory Accesses
• Use your normal build & compiler
(dynamic binary instrumentation)
• Analyze DLLs (source optional)
• Runs threaded if app threaded
• Requires a workload (app is run)
• 32 and 64-bit OSs
• Easy user interface + cmd line
• Errors do not have to occur to be
detected
6

7. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Dynamic Analysis: Before You Start
• Inspector instruments your code at run-time
– Intercepts memory, thread and
synchronization API’s, memory accesses
– Increases execution time and size
• Use small data sets (workloads)
– Execution time and space is expanded
– But no need to execute every iteration.
– Multiple runs over different paths yield best
results
Workload selection is important!

8. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Static Analysis
Detects over 250 different kinds of errors & security risks
Coding Errors (partial list)
• Memory and resource leaks
• Incorrect OpenMP* and Cilk directives
• Pointer and array errors
Security Errors (partial list)
• Buffer overflows and underflows
• Uninitialized variables and objects
• Incorrect pointer usage
• Misuse of string, memory formatting library
routines
• No compiler change required
- Existing compiler for code generation
- Intel compiler front end for static analysis
• No workload required
• Fast ~1.5X time of an optimizing compile†
• Every developer can run SSA
(no central server, it is like a regular build)
• Easy user interface + cmd line
8

9. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Static & Dynamic Analysis
Complement Each Other
9
Dynamic Analysis Static Analysis
Memory & Threading Errors Memory, Code & Security Errors
Slow (1x – 20x - 100x workload) Fast (~1.5x optimizing compile†)
Workload must exercise path
(does not need to cause a program error)
All paths checked
Fewer false errors – only on real paths More errors – we rank by risk
No source required – check DLLs Source required
Use your normal compiler
Use your current build - No rebuild
(debug build with symbols recommended)
No compiler change required
- Existing compiler for code generation
- Intel compiler front end for static analysis
No central server to set up
Just create a build for static analysis
- Auto setup available in Visual Studio††
Both reduce total lifecycle costs.
† Estimate. Your results may vary. †† Requires Parallel Studio XE SP1

10. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Intel Inspector XE
Productive User Interface
One productive interface for both static and dynamic analysis.
Dynamic Static
View Context of Problem
Stack
Multiple Contributing Source Locations




Collapse multiple “sightings” to one error
(e.g., memory allocated in a loop, then leaked is 1 error)
 
Suppression, Filtering, and Workflow Management  
Visual Studio Integration (Windows)  
Command line for automated tests  
Time Line visualization 
Memory Growth during a transaction 
Static Analysis is included in Studio XE products. It is not sold separately.
10

11. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Intel Inspector XE
Productive User Interface
11
Problem States:
New, Not Fixed, Fixed, Confirmed, Not a
problem, Regression
Use filters to focus on a
module, or error type, or…
Code locations
displayed for
selected problem
Select a problem
set

12. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Double Click Problem for
Source & Call Stacks
12
Source code
locations
displayed for
selected problem
Call Stacks

13. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Filtering lets you focus on
what’s important
(2) Error count drops
(1) Filter – Show only one
source file
Before – All Errors After – Only errors from one source file
13

14. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Problem State Lifecycle
makes problem tracking easier
State Description
New Detected by this run
Not Fixed Previously seen error detected by this run
Not a Problem Set by user – tool will not change
Confirmed Set by user – tool will not change
Fixed Set by user
Regression Error detected with previous state of “Fixed”
14

15. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Suppressions Manage False Errors
• Suppressions are saved in one or more files
• Tool suppresses all files from specified folder(s)
• Private & Public suppression folders
• Copy a suppression to public folder to promote
Suppressions are
marked (shown) or
hidden entirely
Be specific or use a
wild card for any
column
Team sharing of suppression files reduces false error count
15

16. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Timeline makes it easier to understand
timing relationships
Individual code locations are shown in
the context of their respective threads
Hover gives
details
16

17. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Analyze Memory Growth in
Transactional Applications
17
Set Start Point
Set End Point
Memory Growth
Problem Set
Code location for each
block of memory that was
allocated but not de-
allocated during the time
period
During Analysis:
Analysis Results:

18. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Automate analysis
Command Line Interface
• inspxe-cl is the command line:
– Windows: C:Program FilesIntelInspector XE
bin[32|64]inspxe-cl.exe
– Linux: /opt/intel/inspector_xe/bin[32|64]/inspxe-cl
• Help:
inspxe-cl –help
• Set up command line with GUI
• Command examples:
1. inspxe-cl -collect-list
2. inspxe-cl –collect ti2 -- MyApp.exe
3. inspxe-cl –report problems
Great for regression analysis – send results file to developer
Command line results can also be opened in the GUI
18

19. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Integrated Debugger Support
Break into debugger
Analysis can stop when it
detects a problem
User is put into a standard
debugging session
Windows*
Microsoft* Visual Studio
Debugger
Linux*
gdb
Intel® Debugger

20. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others. 20
Using the Intel® Inspector XE with
MPI
• Compile the inspector_example.c code with the MPI scripts
• Use the command-line tool under the MPI run scripts to gather
report data
>mpirun -n 4 inspxe-cl –-result-dir insp_results
-collect mi1 -- ./insp_example.exe
• Output is: a results directory for each MPI rank in the job ls
>grep inspector_results on Linux
• Launch the GUI and view the results for each particular rank
>inspxe-gui insp_results.<rank#> on Linux

21. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
Additional Material
• Short demo & “how to” movies:
– Intel® Inspector XE memory and thread checking
– Static Analysis correctness and security checking
– Intel® VTune™ Amplifier XE performance profiler
• Evaluation Guides
– Static Analysis (cheat sheet on how to set up static analysis)
– Eliminate Memory Errors
– Resolve Resource Leaks
• Knowledge Base
21

22. © 2013, Intel Corporation. All rights reserved. Intel and the Intel logo are trademarks of Intel Corporation in the U.S.
and/or other countries. *Other names and brands may be claimed as the property of others.
22