compositional shape analysis by means of bi abduction
play

Compositional Shape Analysis by means of Bi-Abduction Dino - PowerPoint PPT Presentation

Compositional Shape Analysis by means of Bi-Abduction Dino Distefano Queen Mary University of London and Monoidics Ltd MOVEP 2010, Aachen 29/06/2010 Monday, 28 June 2010 A lot of real code out there uses pointer manipulation... Is this


  1. Semantics of Assertions → ( s, h ) | = P s, h | = E �→ F h ) = { [ ] s } and h ([ iffdom( [ E ] [ E ] ] s ) = [ [ F ] ] s s, h | h ) = ∅ = emp iffdom( s, h | = P ∗ Q iff ∃ h 0 , h 1 . dom( h 0 ) ∩ dom( h 1 ) = ∅ and h 0 · h 1 = h and s, h 0 | = P and s, h 1 | = Q s, h | = P ∧ Q s, h | = P and s, h | = Q i ff where meaning of expressions [ [ E ] ] : Stacks → Vals Monday, 28 June 2010

  2. Example x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  3. Example x �→ 3 , y x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  4. Example x �→ 3 , y x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  5. Example x �→ 3 , y x y y �→ 3 , x Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  6. Example x �→ 3 , y x y y �→ 3 , x Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  7. Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  8. Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  9. Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 x �→ 3 , y ∧ y �→ 3 , x 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  10. Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap 3 x �→ 3 , y ∧ y �→ 3 , x 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010

  11. An inconsistency What’ s wrong with the following formula? 10|->3 * 10|->3 Monday, 28 June 2010

  12. An inconsistency What’ s wrong with the following formula? 10|->3 * 10|->3 Try to be in two places at the same time 10 10 Monday, 28 June 2010

  13. ...back to the real stuff: Compositional Shape Analysis by means of Bi-Abduction Monday, 28 June 2010

  14. Literature C. Calcagno, D. Distefano, P . O’Hearn and H. Yang. Compositional Shape Analysis by Means of Bi- Abduction. POPL 2009. D. Distefano. Attacking Large Industrial Code with Bi-Abductive Inference. FMICS 2009 Monday, 28 June 2010

  15. A lot of real code out there uses pointer manipulation... Is this correct? Or at least: does it basic properties like it won’t crash or leak memory? We want to build tool that automatically answer such questions Monday, 28 June 2010

  16. Space Invader analyzer: overview Shape analyses discover deep properties about the heap: e.g., a variable points to a cyclic/acyclic doubly linked list,... Space Invader is Inter-procedural shape analysis for C programs Based on Separation Logic and Abstract interpretation to infer invariants Builds proofs or reports possible memory faults or memory leaks Monday, 28 June 2010

  17. Shape Analysis and Real Code So far shape analysis mostly applied to toy programs Monday, 28 June 2010

  18. Shape Analysis and Real Code So far shape analysis mostly applied to toy programs analysis running months/weeks/days days/hours/min. push button get results Monday, 28 June 2010

  19. Shape Analysis and Real Code So far shape analysis mostly applied to toy programs change code, analysis running write model, etc . months/weeks/days days/hours/min. get code push button get results Monday, 28 June 2010

  20. Fiction: “no worries, device drivers use moslty lists” Monday, 28 June 2010

  21. typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010

  22. typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; around 600 loc struct definitions ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010

  23. typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; around 600 loc struct definitions ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; many big structs (around 20 fields) mutually typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; pointing to aeach other in several way with PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; several fields typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010

  24. AsynchAddressData_Flink DeviceExtension DeviceExtension DeviceExtension AsynchAddressData_Blink ASYNCH_ADDRESS_DATA ASYNCH_ADDRESS_DATA ASYNCH_ADDRESS_DATA pMdl pMdl pMdl MDL MDL NULL MDL MDL MDL NULL NULL BusResetIrp_Flink DEVICE_E XTENSION BUS_RESET_IRPS BUS_RESET_IRPS BUS_RESET_IRPS BUS_RESET_IRPS BusResetIrp_Blink IsochDetachData_Blink IsochDetachData_Flink DeviceExtension DeviceExtension DeviceExtension ISOCH_DETACH_DATA ISOCH_DETACH_DATA ISOCH_DETACH_DATA DeviceExtension IsochDetachData_Mdl IsochDetachData_Mdl IsochDetachData_Mdl DEVICE_OBJECT NULL MDL MDL MDL MDL MDL MDL NULL NULL devObj Monday, 28 June 2010

  25. Fact: Real device drivers use lists in combination, resulting in more complicated data structures than those found in previous papers on shape analysis Monday, 28 June 2010

  26. Shape Analysis and Real Code Monday, 28 June 2010

  27. Shape Analysis and Real Code change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Monday, 28 June 2010

  28. Shape Analysis and Real Code change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010

  29. Shape Analysis and Real Code Need very high modularity change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010

  30. Shape Analysis and Real Code Need very high Start with something modularity partial change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010

  31. Our response: compositional Space Invader ✓ Handles incomplete code ✓ Admits partial results ✓ Modular Monday, 28 June 2010

  32. Our response: compositional Space Invader ✓ Handles incomplete code ✓ Admits partial results ✓ Modular ...demo! Monday, 28 June 2010

  33. Basics Monday, 28 June 2010

  34. Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010

  35. Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp nil E An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010

  36. Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010

  37. Small specs Small specs encourage local reasoning and help to get small proofs When proving code involving procedures we use only their footprint Monday, 28 June 2010

  38. Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010

  39. Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010

  40. Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {emp*list(l2)} Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010

  41. Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {list(l2)} Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010

  42. Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {list(l2)} Dispose(l2); {emp} Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010

  43. Novelties Monday, 28 June 2010

  44. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); Monday, 28 June 2010

  45. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Monday, 28 June 2010

  46. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* X Monday, 28 June 2010

  47. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010

  48. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010

  49. Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); {emp*list(l2)} Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010

  50. Abduction Monday, 28 June 2010

  51. Monday, 28 June 2010

  52. Abduction for Space Invader Monday, 28 June 2010

  53. Abduction for Space Invader Monday, 28 June 2010

  54. Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Monday, 28 June 2010

  55. Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Example: Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp} list(l1) Monday, 28 June 2010

  56. Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Example: Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp} list(l1)*X ⊢ list(l1)*list(l2) Monday, 28 June 2010

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend