Compositional Shape Analysis by means of Bi-Abduction Dino - - PowerPoint PPT Presentation

▶
compositional shape analysis by means of bi abduction
SMART_READER_LITE
LIVE PREVIEW

Compositional Shape Analysis by means of Bi-Abduction Dino - - PowerPoint PPT Presentation

Dec 25, 2022 184 likes •1.54k views

Compositional Shape Analysis by means of Bi-Abduction Dino Distefano Queen Mary University of London and Monoidics Ltd MOVEP 2010, Aachen 29/06/2010 Monday, 28 June 2010 A lot of real code out there uses pointer manipulation... Is this

slide-1
SLIDE 1

Compositional Shape Analysis by means of Bi-Abduction

Dino Distefano Queen Mary University of London and Monoidics Ltd MOVEP 2010, Aachen 29/06/2010

Monday, 28 June 2010

slide-2
SLIDE 2

A lot of real code out there uses pointer manipulation...

Is this correct? Or at least: does it basic properties like it won’t crash or leak memory? We want to build tool that automatically answer such questions

Monday, 28 June 2010

slide-3
SLIDE 3

Crash course on Separation Logic

Monday, 28 June 2010

slide-4
SLIDE 4

Safe commands: S::= skip | x:=E | x:=new(E1,...,En) Heap accessing commands: A(E) ::= dispose(E) | x:=[E] | [E]:=F where E is and expression x, y, nil, etc. Command: C::= S | A | C1;C2 | if B { C1 } else {C2} | while B do { C } where B boolean guard E=E, E!=E, etc.

Simple Imperative Language

Monday, 28 June 2010

slide-5
SLIDE 5

Example Program: List Reversal

p:=nil; while (c !=nil) do { t:=p; p:=c; c:=[c]; [p]:=t; }

Monday, 28 June 2010

slide-6
SLIDE 6

Example Program: List Reversal

p:=nil; while (c !=nil) do { t:=p; p:=c; c:=[c]; [p]:=t; }

nil 1 2 3 c

Monday, 28 June 2010

slide-7
SLIDE 7

Example Program: List Reversal

p:=nil; while (c !=nil) do { t:=p; p:=c; c:=[c]; [p]:=t; }

nil 1 2 3 c nil 3 2 1 p

Monday, 28 June 2010

slide-8
SLIDE 8

Example Program: List Reversal

p:=nil; while (c !=nil) do { t:=p; p:=c; c:=[c]; [p]:=t; } Does the program preserve acyclicity/cyclicity? Does it core-dump? Does it create garbage? Some properties we would like to prove:

nil 1 2 3 c nil 3 2 1 p

Monday, 28 June 2010

slide-9
SLIDE 9

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap We are interested in pointer manipulating programs

Monday, 28 June 2010

slide-10
SLIDE 10

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap 3 3 We are interested in pointer manipulating programs

Monday, 28 June 2010

slide-11
SLIDE 11

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap 3 3 We are interested in pointer manipulating programs 4 4

Monday, 28 June 2010

slide-12
SLIDE 12

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap 3 We are interested in pointer manipulating programs 4 4

Monday, 28 June 2010

slide-13
SLIDE 13

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap 3 We are interested in pointer manipulating programs 4

Monday, 28 June 2010

slide-14
SLIDE 14

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap 3 We are interested in pointer manipulating programs 4

Monday, 28 June 2010

slide-15
SLIDE 15

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap We are interested in pointer manipulating programs 4

Monday, 28 June 2010

slide-16
SLIDE 16

x := new(3,3); y := new(4,4); [x+1] := y; [y+1] := x; y := x+1; dispose x; y := [y];

Example Program

Stack x y Heap We are interested in pointer manipulating programs 4

Monday, 28 June 2010

slide-17
SLIDE 17

Why Separation Logic?

[y] := 4; [z] := 5; Consider this code: Guarantee([y] != [z]) We need to know that things are different. How?

Monday, 28 June 2010

slide-18
SLIDE 18

Why Separation Logic?

[y] := 4; [z] := 5; Consider this code: Guarantee([y] != [z]) We need to know that things are different. How? Assume(y != z) Add assertion?

Monday, 28 June 2010

slide-19
SLIDE 19

Why Separation Logic?

[y] := 4; [z] := 5; Consider this code: Guarantee([y] != [z]) We need to know that things are different. How? Assume(y != z) Add assertion? We need to know that things stay the same. How?

Monday, 28 June 2010

slide-20
SLIDE 20

Why Separation Logic?

[y] := 4; [z] := 5; Consider this code: Guarantee([y] != [z]) We need to know that things are different. How? Assume(y != z) Add assertion? Assume([x] = 3) Guarantee([x] = 3) We need to know that things stay the same. How?

Monday, 28 June 2010

slide-21
SLIDE 21

Why Separation Logic?

[y] := 4; [z] := 5; Consider this code: Guarantee([y] != [z]) We need to know that things are different. How? Assume(y != z) Add assertion? Guarantee([x] = 3) We need to know that things stay the same. How? Add assertion? Assume([x] = 3 && x!=y && x!=z)

Monday, 28 June 2010

slide-22
SLIDE 22

Framing

We want a general concept of things not being affected. What are the conditions on C and R? Hard to define if reasoning about a heap and aliasing

{P} C {Q} {R && P } C {Q && R }

Monday, 28 June 2010

slide-23
SLIDE 23

Framing

We want a general concept of things not being affected. What are the conditions on C and R? Hard to define if reasoning about a heap and aliasing

{P} C {Q} {R && P } C {Q && R }

This is where separation logic comes in Introduces new connective * used to separate state.

{P} C {Q} {R * P } C {Q * R }

Monday, 28 June 2010

slide-24
SLIDE 24

Storage Model

Vars

def

= {x, y, z, . . .} Locs

def

= {1, 2, 3, 4, . . .} Vals ⊇ Locs Heaps

def

= Locs →fin Vals Stacks

def

= Vars → Vals States

def

= Stacks × Heaps

Monday, 28 June 2010

slide-25
SLIDE 25

Storage Model

Vars

def

= {x, y, z, . . .} Locs

def

= {1, 2, 3, 4, . . .} Vals ⊇ Locs Heaps

def

= Locs →fin Vals Stacks

def

= Vars → Vals States

def

= Stacks × Heaps

Stack x y 7 42

Monday, 28 June 2010

slide-26
SLIDE 26

Storage Model

Vars

def

= {x, y, z, . . .} Locs

def

= {1, 2, 3, 4, . . .} Vals ⊇ Locs Heaps

def

= Locs →fin Vals Stacks

def

= Vars → Vals States

def

= Stacks × Heaps

Stack x y 7 42 Heap 7 9 42 11 9

Monday, 28 June 2010

slide-27
SLIDE 27

Storage Model

Vars

def

= {x, y, z, . . .} Locs

def

= {1, 2, 3, 4, . . .} Vals ⊇ Locs Heaps

def

= Locs →fin Vals Stacks

def

= Vars → Vals States

def

= Stacks × Heaps

Stack x y 7 42 Heap 7 9 42 11 9

Monday, 28 June 2010

slide-28
SLIDE 28

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning

Monday, 28 June 2010

slide-29
SLIDE 29

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning

Monday, 28 June 2010

slide-30
SLIDE 30

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

Monday, 28 June 2010

slide-31
SLIDE 31

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

Monday, 28 June 2010

slide-32
SLIDE 32

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

Monday, 28 June 2010

slide-33
SLIDE 33

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap F E

Monday, 28 June 2010

slide-34
SLIDE 34

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

Monday, 28 June 2010

slide-35
SLIDE 35

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

Monday, 28 June 2010

slide-36
SLIDE 36

Assertions

E, F ::= x | n | E+F | −E | . . . Heap-independent Exprs P, Q ::= E = F | E ≥ F | E → F Atomic Predicates | emp | P ∗ Q Separating Connectives | true | P ∧ Q | ¬P | ∀x. P Classical Logic

Informal Meaning Heap

P Q

Monday, 28 June 2010

slide-37
SLIDE 37

x

Examples

Stack x y y z z Heap Formula: emp

Monday, 28 June 2010

slide-38
SLIDE 38

x

Examples

x|->y Stack x y y z z Heap Formula: emp*

Monday, 28 June 2010

slide-39
SLIDE 39

x

Examples

x|->y Stack x y y y z z Heap Formula: emp*

Monday, 28 June 2010

slide-40
SLIDE 40

x

Examples

x|->y Stack x y y y z z Heap Formula:

Monday, 28 June 2010

slide-41
SLIDE 41

x

Examples

x|->y * y|->z Stack x y y y z z Heap Formula:

Monday, 28 June 2010

slide-42
SLIDE 42

x

Examples

x|->y * y|->z Stack x y y y z z z Heap Formula:

Monday, 28 June 2010

slide-43
SLIDE 43

x

Examples

x|->y * y|->z * z|->x Stack x y y y z z z Heap Formula:

Monday, 28 June 2010

slide-44
SLIDE 44

x

Examples

x|->y * y|->z * z|->x Stack x y y y z z z x Heap Formula:

Monday, 28 June 2010

slide-45
SLIDE 45

Semantics of Assertions

[ [E] ] : Stacks → Vals

where meaning of expressions

→ (s, h) | = P

s, h | = E → F iffdom( h) = {[ [E] ]s} and h([ [E] ]s) = [ [F] ]s s, h | = emp iffdom( h) = ∅ s, h | = P ∗ Q iff ∃h0, h1. dom(h0) ∩ dom(h1) = ∅ and h0 · h1 = h and s, h0 | = P and s, h1 | = Q s, h | = P ∧ Q

iff s, h | = P and s, h | = Q

Monday, 28 June 2010

slide-46
SLIDE 46

x

Example

Stack x y x 3 Heap y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-47
SLIDE 47

x

Example

Stack x y x 3 Heap

x → 3, y

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-48
SLIDE 48

x

Example

Stack x y x 3 Heap

x → 3, y

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-49
SLIDE 49

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-50
SLIDE 50

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-51
SLIDE 51

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x x → 3, y ∗ y → 3, x

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-52
SLIDE 52

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x x → 3, y ∗ y → 3, x

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-53
SLIDE 53

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x x → 3, y ∗ y → 3, x x → 3, y ∧ y → 3, x

y x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-54
SLIDE 54

x

Example

Stack x y x 3 Heap

x → 3, y y → 3, x x → 3, y ∗ y → 3, x x → 3, y ∧ y → 3, x

x+1 3 y y+1

Abbreviation: E points to a record of several fields: E → E1, . . . , En E → E1 ∗ · · · ∗ E + n − 1 → En

Monday, 28 June 2010

slide-55
SLIDE 55

An inconsistency

What’ s wrong with the following formula? 10|->3 * 10|->3

Monday, 28 June 2010

slide-56
SLIDE 56

An inconsistency

What’ s wrong with the following formula? 10|->3 * 10|->3

10 10 Try to be in two places at the same time

Monday, 28 June 2010

slide-57
SLIDE 57

...back to the real stuff:

Compositional Shape Analysis by means of Bi-Abduction

Monday, 28 June 2010

slide-58
SLIDE 58

Literature

  • C. Calcagno, D. Distefano, P

. O’Hearn and H. Yang. Compositional Shape Analysis by Means of Bi-

  • Abduction. POPL 2009.
  • D. Distefano. Attacking Large Industrial Code with

Bi-Abductive Inference. FMICS 2009

Monday, 28 June 2010

slide-59
SLIDE 59

A lot of real code out there uses pointer manipulation...

Is this correct? Or at least: does it basic properties like it won’t crash or leak memory? We want to build tool that automatically answer such questions

Monday, 28 June 2010

slide-60
SLIDE 60

Space Invader analyzer:

  • verview

Shape analyses discover deep properties about the heap: e.g., a variable points to a cyclic/acyclic doubly linked list,... Space Invader is Inter-procedural shape analysis for C programs Based on Separation Logic and Abstract interpretation to infer invariants Builds proofs or reports possible memory faults or memory leaks

Monday, 28 June 2010

slide-61
SLIDE 61

Shape Analysis and Real Code

So far shape analysis mostly applied to toy programs

Monday, 28 June 2010

slide-62
SLIDE 62

Shape Analysis and Real Code

push button get results months/weeks/days days/hours/min.

analysis running

So far shape analysis mostly applied to toy programs

Monday, 28 June 2010

slide-63
SLIDE 63

Shape Analysis and Real Code

get code push button get results months/weeks/days days/hours/min.

change code, write model, etc. analysis running

So far shape analysis mostly applied to toy programs

Monday, 28 June 2010

slide-64
SLIDE 64

Fiction: “no worries, device drivers use moslty lists”

Monday, 28 June 2010

slide-65
SLIDE 65

typedef struct { PDEVICE_OBJECT StackDeviceObject; PDEVICE_OBJECT PortDeviceObject; PDEVICE_OBJECT PhysicalDeviceObject; UNICODE_STRING SymbolicLinkName; KSPIN_LOCK ResetSpinLock; KSPIN_LOCK CromSpinLock; KSPIN_LOCK AsyncSpinLock; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; BOOLEAN bShutdown; DEVICE_POWER_STATE CurrentDevicePowerState; SYSTEM_POWER_STATE CurrentSystemPowerState; ULONG GenerationCount; PASYNC_ADDRESS_DATA Flink1; PASYNC_ADDRESS_DATA Blink1; PBUS_RESET_IRP Flink2; PBUS_RESET_IRP Blink2; PCROM_DATA Flink3; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; _PISOCH_DETACH_DATA Blink4; PISOCH_RESOURCE_DATA Flink5; PISOCH_RESOURCE_DATA Blink5; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; struct ASYNC_ADDRESS_DATA* Blink1; _PDEVICE_EXTENSION DeviceExtension; PVOID Buffer; ULONG nLength; ULONG nAddressesReturned; PADDRESS_RANGE AddressRange; HANDLE hAddressRange; PMDL pMdl; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; PIRP Irp; } BUS_RESET_IRP, *PBUS_RESET_IRP; typedef struct CROM_DATA { struct CROM_DATA *Flink3; struct CROM_DATA *Blink3; HANDLE hCromData; PVOID Buffer; PMDL pMdl; } CROM_DATA, *PCROM_DATA; typedef struct ISOCH_RESOURCE_DATA { struct ISOCH_RESOURCE_DATA *Flink5; struct ISOCH_RESOURCE_DATA *Blink5; HANDLE hResource; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA;

Monday, 28 June 2010

slide-66
SLIDE 66

typedef struct { PDEVICE_OBJECT StackDeviceObject; PDEVICE_OBJECT PortDeviceObject; PDEVICE_OBJECT PhysicalDeviceObject; UNICODE_STRING SymbolicLinkName; KSPIN_LOCK ResetSpinLock; KSPIN_LOCK CromSpinLock; KSPIN_LOCK AsyncSpinLock; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; BOOLEAN bShutdown; DEVICE_POWER_STATE CurrentDevicePowerState; SYSTEM_POWER_STATE CurrentSystemPowerState; ULONG GenerationCount; PASYNC_ADDRESS_DATA Flink1; PASYNC_ADDRESS_DATA Blink1; PBUS_RESET_IRP Flink2; PBUS_RESET_IRP Blink2; PCROM_DATA Flink3; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; _PISOCH_DETACH_DATA Blink4; PISOCH_RESOURCE_DATA Flink5; PISOCH_RESOURCE_DATA Blink5; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; struct ASYNC_ADDRESS_DATA* Blink1; _PDEVICE_EXTENSION DeviceExtension; PVOID Buffer; ULONG nLength; ULONG nAddressesReturned; PADDRESS_RANGE AddressRange; HANDLE hAddressRange; PMDL pMdl; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; PIRP Irp; } BUS_RESET_IRP, *PBUS_RESET_IRP; typedef struct CROM_DATA { struct CROM_DATA *Flink3; struct CROM_DATA *Blink3; HANDLE hCromData; PVOID Buffer; PMDL pMdl; } CROM_DATA, *PCROM_DATA; typedef struct ISOCH_RESOURCE_DATA { struct ISOCH_RESOURCE_DATA *Flink5; struct ISOCH_RESOURCE_DATA *Blink5; HANDLE hResource; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA;

around 600 loc struct definitions

Monday, 28 June 2010

slide-67
SLIDE 67

typedef struct { PDEVICE_OBJECT StackDeviceObject; PDEVICE_OBJECT PortDeviceObject; PDEVICE_OBJECT PhysicalDeviceObject; UNICODE_STRING SymbolicLinkName; KSPIN_LOCK ResetSpinLock; KSPIN_LOCK CromSpinLock; KSPIN_LOCK AsyncSpinLock; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; BOOLEAN bShutdown; DEVICE_POWER_STATE CurrentDevicePowerState; SYSTEM_POWER_STATE CurrentSystemPowerState; ULONG GenerationCount; PASYNC_ADDRESS_DATA Flink1; PASYNC_ADDRESS_DATA Blink1; PBUS_RESET_IRP Flink2; PBUS_RESET_IRP Blink2; PCROM_DATA Flink3; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; _PISOCH_DETACH_DATA Blink4; PISOCH_RESOURCE_DATA Flink5; PISOCH_RESOURCE_DATA Blink5; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; struct ASYNC_ADDRESS_DATA* Blink1; _PDEVICE_EXTENSION DeviceExtension; PVOID Buffer; ULONG nLength; ULONG nAddressesReturned; PADDRESS_RANGE AddressRange; HANDLE hAddressRange; PMDL pMdl; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; PIRP Irp; } BUS_RESET_IRP, *PBUS_RESET_IRP; typedef struct CROM_DATA { struct CROM_DATA *Flink3; struct CROM_DATA *Blink3; HANDLE hCromData; PVOID Buffer; PMDL pMdl; } CROM_DATA, *PCROM_DATA; typedef struct ISOCH_RESOURCE_DATA { struct ISOCH_RESOURCE_DATA *Flink5; struct ISOCH_RESOURCE_DATA *Blink5; HANDLE hResource; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA;

around 600 loc struct definitions many big structs (around 20 fields) mutually pointing to aeach other in several way with several fields

Monday, 28 June 2010

slide-68
SLIDE 68

DEVICE_E XTENSION DEVICE_OBJECT DeviceExtension ISOCH_DETACH_DATA BUS_RESET_IRPS ASYNCH_ADDRESS_DATA ISOCH_DETACH_DATA ISOCH_DETACH_DATA BUS_RESET_IRPS BUS_RESET_IRPS BUS_RESET_IRPS ASYNCH_ADDRESS_DATA ASYNCH_ADDRESS_DATA MDL MDL MDL NULL MDL MDL NULL MDL MDL MDL NULL pMdl pMdl NULL pMdl IsochDetachData_Mdl IsochDetachData_Mdl NULL IsochDetachData_Mdl DeviceExtension DeviceExtension DeviceExtension AsynchAddressData_Flink AsynchAddressData_Blink BusResetIrp_Flink BusResetIrp_Blink DeviceExtension DeviceExtension DeviceExtension IsochDetachData_Flink IsochDetachData_Blink devObj MDL MDL MDL NULL

Monday, 28 June 2010

slide-69
SLIDE 69

Real device drivers use lists in combination, resulting in more complicated data structures than those found in previous papers on shape analysis

Fact:

Monday, 28 June 2010

slide-70
SLIDE 70

Shape Analysis and Real Code

Monday, 28 June 2010

slide-71
SLIDE 71

Shape Analysis and Real Code

get code push button get results months/weeks/days days/hours/min.

change code, write model, etc. analysis running

Monday, 28 June 2010

slide-72
SLIDE 72

Shape Analysis and Real Code

get code push button get results months/weeks/days days/hours/min.

change code, write model, etc. analysis running

Need to handle incomplete code

Monday, 28 June 2010

slide-73
SLIDE 73

Shape Analysis and Real Code

get code push button get results months/weeks/days days/hours/min.

change code, write model, etc. analysis running

Need to handle incomplete code Need very high modularity

Monday, 28 June 2010

slide-74
SLIDE 74

Shape Analysis and Real Code

get code push button get results months/weeks/days days/hours/min.

change code, write model, etc. analysis running

Need to handle incomplete code Need very high modularity Start with something partial

Monday, 28 June 2010

slide-75
SLIDE 75

Our response: compositional Space Invader

✓Handles incomplete code ✓Admits partial results ✓Modular

Monday, 28 June 2010

slide-76
SLIDE 76

Our response: compositional Space Invader

...demo!

✓Handles incomplete code ✓Admits partial results ✓Modular

Monday, 28 June 2010

slide-77
SLIDE 77

Basics

Monday, 28 June 2010

slide-78
SLIDE 78

Notation

Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: An allocated cell: A “complete” list: P*Q means P and Q hold for disjoint portion of memory

emp E → F list(E)

Monday, 28 June 2010

slide-79
SLIDE 79

Notation

Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: An allocated cell: A “complete” list: P*Q means P and Q hold for disjoint portion of memory

emp E → F list(E) E nil

Monday, 28 June 2010

slide-80
SLIDE 80

Notation

Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: An allocated cell: A “complete” list: P*Q means P and Q hold for disjoint portion of memory

emp E → F list(E)

Monday, 28 June 2010

slide-81
SLIDE 81

Small specs

Small specs encourage local reasoning and help to get small proofs When proving code involving procedures we use only their footprint

Monday, 28 June 2010

slide-82
SLIDE 82

Example: use of small specs in proofs

Dispose(l1); Dispose(l2);

{P} C {Q} {P*R} C {Q*R} Frame Rule Spec: {list(l)} Dispose(l) {emp}

{list(l1)*list(l2)}

Monday, 28 June 2010

slide-83
SLIDE 83

Example: use of small specs in proofs

Dispose(l1); Dispose(l2);

{P} C {Q} {P*R} C {Q*R} Frame Rule Spec: {list(l)} Dispose(l) {emp}

{list(l1)*list(l2)}

Monday, 28 June 2010

slide-84
SLIDE 84

Example: use of small specs in proofs

Dispose(l1); Dispose(l2);

{P} C {Q} {P*R} C {Q*R} Frame Rule Spec: {list(l)} Dispose(l) {emp}

{emp*list(l2)} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-85
SLIDE 85

Example: use of small specs in proofs

Dispose(l1); Dispose(l2);

{P} C {Q} {P*R} C {Q*R} Frame Rule Spec: {list(l)} Dispose(l) {emp}

{list(l1)*list(l2)} {list(l2)}

Monday, 28 June 2010

slide-86
SLIDE 86

Example: use of small specs in proofs

Dispose(l1); Dispose(l2);

{P} C {Q} {P*R} C {Q*R} Frame Rule Spec: {list(l)} Dispose(l) {emp}

{emp} {list(l1)*list(l2)} {list(l2)}

Monday, 28 June 2010

slide-87
SLIDE 87

Novelties

Monday, 28 June 2010

slide-88
SLIDE 88

Frame Inference

{P} C {Q} {P*R} C {Q*R} Frame Rule

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-89
SLIDE 89

Frame Inference

In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that {P} C {Q} {P*R} C {Q*R} Frame Rule A ⊢ B∗X

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-90
SLIDE 90

Frame Inference

In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that {P} C {Q} {P*R} C {Q*R} Frame Rule

Example:

A ⊢ B∗X list(l1)*list(l2) list(l1)*

⊢

X

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-91
SLIDE 91

Frame Inference

In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that {P} C {Q} {P*R} C {Q*R} Frame Rule

Example:

A ⊢ B∗X list(l1)*list(l2) list(l1)*

⊢

list(l2)

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-92
SLIDE 92

Frame Inference

In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that {P} C {Q} {P*R} C {Q*R} Frame Rule

Example:

A ⊢ B∗X list(l1)*list(l2) list(l1)*

⊢

list(l2)

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-93
SLIDE 93

Frame Inference

In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that {P} C {Q} {P*R} C {Q*R} Frame Rule

Example:

A ⊢ B∗X list(l1)*list(l2) list(l1)*

⊢

list(l2)

Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {emp*list(l2)} {list(l1)*list(l2)}

Monday, 28 June 2010

slide-94
SLIDE 94

Abduction

Monday, 28 June 2010

slide-95
SLIDE 95

Monday, 28 June 2010

slide-96
SLIDE 96

Abduction for Space Invader

Monday, 28 June 2010

slide-97
SLIDE 97

Abduction for Space Invader

Monday, 28 June 2010

slide-98
SLIDE 98

Abduction for Space Invader

given A and B compute X such that

A∗ ⊢ B X

Abduction Inference:

Monday, 28 June 2010

slide-99
SLIDE 99

Abduction for Space Invader

given A and B compute X such that

A∗ ⊢ B X

Abduction Inference: Example:

Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp}

list(l1)

Monday, 28 June 2010

slide-100
SLIDE 100

Abduction for Space Invader

list(l1)*list(l2) list(l1)*X ⊢

given A and B compute X such that

A∗ ⊢ B X

Abduction Inference: Example:

Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp}

Monday, 28 June 2010

slide-101
SLIDE 101

Abduction for Space Invader

list(l1)*list(l2)

⊢

list(l1)*list(l2)

given A and B compute X such that

A∗ ⊢ B X

Abduction Inference: Example:

Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp}

Monday, 28 June 2010

slide-102
SLIDE 102

Abduction is not enough

Heap A If heaps A and B are incomparable abduction and frame inference alone are not enough.

*

y → y′ x → y Heap B

*

w → nil

y → y′ We need to synthesize both missing portion of state and leftover portion of state

Monday, 28 June 2010

slide-103
SLIDE 103

Abduction is not enough

Heap A Frame Anti-frame If heaps A and B are incomparable abduction and frame inference alone are not enough.

*

y → y′ x → y Heap B

*

w → nil

y → y′ We need to synthesize both missing portion of state and leftover portion of state

Monday, 28 June 2010

slide-104
SLIDE 104

Bi-Abduction

Synthesizing both missing portion of state (anti-frame) and leftover portion of state (frame) give rise to a new notion

Bi-Abduction:

given A and B compute ?antiframe and ?frame such that

A ∗ ?antiframe ⊢ B ∗ ?frame

Monday, 28 June 2010

slide-105
SLIDE 105

Bi-Abduction

Synthesizing both missing portion of state (anti-frame) and leftover portion of state (frame) give rise to a new notion

Bi-Abduction:

given A and B compute ?antiframe and ?frame such that

x → 0 ∗ z → 0 ∗ ?antiframe ⊢ list(x) ∗ list(y) ∗ ?frame

Example:

A ∗ ?antiframe ⊢ B ∗ ?frame

Monday, 28 June 2010

slide-106
SLIDE 106

Bi-Abduction

Synthesizing both missing portion of state (anti-frame) and leftover portion of state (frame) give rise to a new notion

Bi-Abduction:

given A and B compute ?antiframe and ?frame such that

x → 0 ∗ z → 0 ∗ list(y) ⊢ list(x) ∗ list(y) ∗ z → 0

Example:

A ∗ ?antiframe ⊢ B ∗ ?frame

Monday, 28 June 2010

slide-107
SLIDE 107

Bi-Abduction

Synthesizing both missing portion of state (anti-frame) and leftover portion of state (frame) give rise to a new notion

Bi-Abduction:

given A and B compute ?antiframe and ?frame such that

x → 0 ∗ z → 0 ∗ list(y) ⊢ list(x) ∗ list(y) ∗ z → 0

Example:

A ∗ ?antiframe ⊢ B ∗ ?frame

Our POPL’09 paper defines a theorem prover for Bi-Abduction

Monday, 28 June 2010

slide-108
SLIDE 108

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

emp

Monday, 28 June 2010

slide-109
SLIDE 109

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

x → 0 emp

Monday, 28 June 2010

slide-110
SLIDE 110

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-111
SLIDE 111

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Pre FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-112
SLIDE 112

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Pre FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-113
SLIDE 113

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Frame Pre FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-114
SLIDE 114

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Frame Pre AntiF FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-115
SLIDE 115

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Frame Pre AntiF FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-116
SLIDE 116

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Frame Pre AntiF FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-117
SLIDE 117

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

H Frame Pre AntiF FootPrint Post

f(x) f(x)

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-118
SLIDE 118

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp Bi-abductive prover

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-119
SLIDE 119

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp

x → 0 ∗ z → 0 ∗ ?antiframe ⊢ list(x) ∗ list(y) ∗ ?frame

Bi-abductive prover

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-120
SLIDE 120

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

emp

x → 0 ∗ z → 0 ∗ list(y) ⊢ list(x) ∗ list(y) ∗ z → 0

Bi-abductive prover

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-121
SLIDE 121

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

list(y)

x → 0 ∗ z → 0 ∗ list(y) ⊢ list(x) ∗ list(y) ∗ z → 0

Bi-abductive prover

list(x) ∗ z → 0

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-122
SLIDE 122

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

list(y)

list(x) ∗ z → 0 ∗ ?antiframe ⊢ list(x) ∗ list(z) ∗ ?frame

Bi-abductive prover

list(x) ∗ z → 0

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-123
SLIDE 123

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

list(y)

list(x) ∗ z → 0 ∗ emp ⊢ list(x) ∗ list(z) ∗ emp

Bi-abductive prover

list(x) ∗ z → 0

x → 0 ∗ z → 0 x → 0

emp

Monday, 28 June 2010

slide-124
SLIDE 124

Bi-Abductive spec synthesis

1 void p(list_item *y) { 2 list_item *x, *z; 3 x=malloc(sizeof(list_item)); x->tail = 0; 4 z=malloc(sizeof(list_item)); z->tail = 0; 5 foo(x,y); 6 foo(x,z); 7 } Pre: list(x) * list(y) void foo(list_item *x,list_item *y) Post: list(x)

list(y)

list(x) ∗ z → 0 ∗ emp ⊢ list(x) ∗ list(z) ∗ emp

Bi-abductive prover

list(x) ∗ z → 0

x → 0 ∗ z → 0

list(x)

x → 0 emp

Monday, 28 June 2010

slide-125
SLIDE 125

General Schema Compositional Analysis

Recursive function are analyzed with an iterative method until it reaches fixed point For function in the program we compute tables of specs {Tf1, . . . , Tfn} Tables are sets of entries of type: (pre, {post1, post2, . . . }) The computation follows the call graph (start from leaves)

Monday, 28 June 2010

slide-126
SLIDE 126

0.00% 16.67% 33.33% 50.00% 66.67% 83.33% 100.00% Apache OpenSSL Linux Distribution

Running on really big code

54k Loc 62k Loc 220k Loc 2.5M Loc 294 sec 142 sec 605 sec 1739 sec (8 cores) Specs found No spec 226k Loc 450 sec

Test for precision: run on Firewire device driver and small recursive procedures handling nested data structures

OpenSSH IMap

Monday, 28 June 2010

slide-127
SLIDE 127

freeattvalues

Monday, 28 June 2010

slide-128
SLIDE 128

freeattvalues

Monday, 28 June 2010

slide-129
SLIDE 129

freeentryatts freeattvalues

Monday, 28 June 2010

slide-130
SLIDE 130

freeentryatts freeattvalues

Monday, 28 June 2010

slide-131
SLIDE 131

freeentryatts freeattvalues

````` `

Monday, 28 June 2010

slide-132
SLIDE 132

freeentryatts freeattvalues

Monday, 28 June 2010

slide-133
SLIDE 133

The bi-abduction manifesto

Frame inference allows an analyzer to use small specs Abduction helps to synthesize small specs Their combination, bi-abduction helps to achieve compositional bottom-up analysis. Furthermore it brings the benefits of local reasoning (as introduced in Separation Logic) to automatic program verification A ⊢ B ∗ X ⊢ B ∗ X′ X A ∗ ⊢ B X A ∗

Monday, 28 June 2010