Mechanizing Abstract Interpretation Thesis Defense David Darais - - PowerPoint PPT Presentation

▶
mechanizing abstract interpretation
SMART_READER_LITE
LIVE PREVIEW

Mechanizing Abstract Interpretation Thesis Defense David Darais - - PowerPoint PPT Presentation

Feb 21, 2023 360 likes •1.81k views

Mechanizing Abstract Interpretation Thesis Defense David Darais University of Maryland Software Reliability The Usual Story } Program Testing Analysis Compiler Operating System Hardware 3 The Usual Story } Program .

slide-1
SLIDE 1

Mechanizing Abstract Interpretation

Thesis Defense David Darais University of Maryland

slide-2
SLIDE 2

Software
 Reliability

slide-3
SLIDE 3

The Usual Story

3

}

Program Testing Analysis Compiler Operating
 System Hardware

slide-4
SLIDE 4

The Usual Story

4

}

Program .

Testing Analysis Compiler Operating
 System Hardware

slide-5
SLIDE 5

The Reality

5

}

Program Testing Analysis Compiler Operating
 System Hardware

✓

slide-6
SLIDE 6

The Reality

6

}

Program Testing Analysis

Compiler .

Operating
 System Hardware

✓

slide-7
SLIDE 7

Time → Security Exploit
 In Linux Kernel (2009)

slide-8
SLIDE 8

Time → Security Exploit
 In Linux Kernel Kernel Patch to Fix Exploit (2009)

slide-9
SLIDE 9

Time → Security Exploit
 In Linux Kernel Kernel Patch to Fix Exploit Security Exploit
 In Linux Kernel (2009)

slide-10
SLIDE 10

Time → Security Exploit
 In Linux Kernel Kernel Patch to Fix Exploit Security Exploit
 In Linux Kernel (2009)

slide-11
SLIDE 11

Story 1: Linux Kernel Exploit

–Linux 2.6.30 kernel exploit [2009]

The
 Patch

slide-12
SLIDE 12

Story 1: Linux Kernel Exploit

–Linux 2.6.30 kernel exploit [2009]

The
 Patch The Buggy Optimization

slide-13
SLIDE 13

}

GCC Compiler

Program Testing Compiler Operating System Hardware }

slide-14
SLIDE 14

Linux OS Kernel

}

Program Testing Compiler Hardware }

GCC Compiler

} }

✓

slide-15
SLIDE 15

Linux OS Kernel

} }

Program Testing Compiler Operating System Hardware

✓ ✓}

Self-driving Cars Airplanes
 SpaceX Secure Web Infr.
 Pacemakers
 Medical Records DB

slide-16
SLIDE 16

Linux OS Kernel

}

Program Testing Compiler Hardware }

GCC Compiler

Program Testing Compiler Operating System Hardware }

}

Program Testing Compiler Operating System Hardware

✓ ✓ ✓ }

Self-driving Cars Airplanes
 SpaceX Secure Web Infr.
 Pacemakers
 Medical Records DB

Trust in Software Runs Deep

slide-17
SLIDE 17

Program Testing Analysis Compiler Operating
 System Hardware

✓ ✓ ✓ Critical Software Requires
 Trustworthy Tools

}

✓ ✓ ✓

✓

slide-18
SLIDE 18

Program Testing Analysis

Compiler .

Operating
 System Hardware }

✓ ✓ ✓ ✓ ✓ ✓ Trustworthy Tools are Critical Software

}

✓

slide-19
SLIDE 19

My Research:
 Tools with 0 Bugs

slide-20
SLIDE 20

The Tools I Build: Program Analyzers (lightweight)

Difficult to Implement Correctly

slide-21
SLIDE 21

The Tool I Use: Mechanized Verification (heavyweight)

Verify 0 Bugs in Program Analyzers

slide-22
SLIDE 22

Usable Trustworthy Program
 Analyzers

✓ ✗

slide-23
SLIDE 23

Usable Trustworthy Program
 Analyzers

✓ ✗

Mechanized
 Verification

✗ ✓

slide-24
SLIDE 24

Usable Trustworthy Program
 Analyzers

✓ ✗

Mechanized
 Verification

✗ ✓

Mechanically Verified Program Analyzers

✓ ✓

My Research

slide-25
SLIDE 25

Problem 
 Building one verified analyzer is
 extremely difficult.

(decades for first compiler)

slide-26
SLIDE 26

Assumption
 
 Calculational and compositional methods can make analyzers
 easier to construct.

slide-27
SLIDE 27

Research Question
 How can we construct
 mechanically verified
 program analyzers
 using calculational and compositional methods?

slide-28
SLIDE 28

Thesis
 
 Constructing mechanically verified program analyzers via calculation and composition is feasible using constructive Galois connections and modular abstract interpreters.

slide-29
SLIDE 29

Contribution 1

State of the art in program analysis and mechanized verification: Abstract interpretation: 0 bugs in analyzer design+specification Mechanized verification: 0 bugs in analyzer implementation ~20 year old problem: how to combine these two techniques

slide-30
SLIDE 30

Contribution 1

State of the art in program analysis and mechanized verification: Abstract interpretation: 0 bugs in analyzer design+specification Mechanized verification: 0 bugs in analyzer implementation ~20 year old problem: how to combine these two techniques Result: achieved mechanically verified calculational AI
 
 Idea: new AI framework which supports mechanization
 
 [Darais and Van Horn, ICFP ’16]

slide-31
SLIDE 31

Contribution 2

State of the art in reusable program analyzers: Some features easy to reuse: context and object sens. Some features had to reuse: path and flow sens. Challenge: achieve reuse in both implementation and proof

slide-32
SLIDE 32

Contribution 2

State of the art in reusable program analyzers: Some features easy to reuse: context and object sens. Some features had to reuse: path and flow sens. Challenge: achieve reuse in both implementation and proof Result: compositional PA components, implementation + proofs
 
 Idea: combine monad transformers and Galois connections
 
 [Darais, Might and Van Horn, OOPSLA ’15]

slide-33
SLIDE 33

Contribution 3

State of the art in reusable program analysis: Control flow abstraction: often too imprecise Pushdown precision: precise abstraction for control No technique which supports compositional interpreters

slide-34
SLIDE 34

Contribution 3

State of the art in reusable program analysis: Control flow abstraction: often too imprecise Pushdown precision: precise abstraction for control No technique which supports compositional interpreters Result: pushdown precision for definitional interpreters
 
 Idea: inherit precision from defining metalanguage
 
 [Darais, Labich, Nguyễn and Van Horn, ICFP ‘17]

slide-35
SLIDE 35

Abstracting
 Definitional
 Interpreters Constructive
 Galois
 Connections Galois Transformers

32
slide-36
SLIDE 36

Constructive Galois Connections

slide-37
SLIDE 37

Classical Galois Connections

int a[3];
 if (b) {x ≔ 2} else {x ≔ 4}; a[4 - x] ≔ 1;

slide-38
SLIDE 38

Classical Galois Connections

x ∈ {2,4} int a[3];
 if (b) {x ≔ 2} else {x ≔ 4}; a[4 - x] ≔ 1;

slide-39
SLIDE 39

Classical Galois Connections

x ∈ {2,4} x ∈ [2,4] int a[3];
 if (b) {x ≔ 2} else {x ≔ 4}; a[4 - x] ≔ 1;

slide-40
SLIDE 40

Classical Galois Connections

x ∈ {2,4} x ∈ [2,4] x ∈ {2,3,4} ⊆ int a[3];
 if (b) {x ≔ 2} else {x ≔ 4}; a[4 - x] ≔ 1;

slide-41
SLIDE 41

Classical Galois Connections

ℤ × ℤ ℘(ℤ)

x ∈ {2,4} x ∈ [2,4] x ∈ {2,3,4} ⊆ int a[3];
 if (b) {x ≔ 2} else {x ≔ 4}; a[4 - x] ≔ 1;

slide-42
SLIDE 42

℘(ℤ) ℤ × ℤ

{2,4} [2,4]

α

{2,3,4}

γ ⊆

slide-43
SLIDE 43

℘(ℤ) ℤ × ℤ

+ ̂

[5,5] [2,4]

slide-44
SLIDE 44

℘(ℤ) ℤ × ℤ

+ ̂

[5,5] [2,4]

+ ̑

{2,3,4} {5}

γ

slide-45
SLIDE 45

℘(ℤ) ℤ × ℤ

=

{7,8,9}

+ ̂

[5,5] [2,4]

+ ̑

{2,3,4} {5}

γ

slide-46
SLIDE 46

℘(ℤ) ℤ × ℤ

=

{7,8,9}

+ ̂

[5,5] [2,4]

α

[7,9]

= + ̑

{2,3,4} {5}

γ

slide-47
SLIDE 47

[3,3] + ̂ [2,4] = α(γ([2,4]) + ̑ γ([5,5])) [2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5]))

slide-48
SLIDE 48

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5]))

slide-49
SLIDE 49

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5])) α({ i + j | i ∈ γ([2,4]) ∧ j ∈ γ([5,5]) }) =

slide-50
SLIDE 50

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5])) α({ i + j | i ∈ γ([2,4]) ∧ j ∈ γ([5,5]) }) = α({7,8,9}) =

slide-51
SLIDE 51

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5])) α({ i + j | i ∈ γ([2,4]) ∧ j ∈ γ([5,5]) }) = α({7,8,9}) = α({7}) ⊔ α({8}) ⊔ α({9}) =

slide-52
SLIDE 52

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5])) α({ i + j | i ∈ γ([2,4]) ∧ j ∈ γ([5,5]) }) = α({7,8,9}) = α({7}) ⊔ α({8}) ⊔ α({9}) = [7,9] =

slide-53
SLIDE 53

[2,4] + ̂ [5,5] α(γ([2,4]) + ̑ γ([5,5])) α({ i + j | i ∈ γ([2,4]) ∧ j ∈ γ([5,5]) }) = α({7,8,9}) = α({7}) ⊔ α({8}) ⊔ α({9}) = [7,9] = ≜

slide-54
SLIDE 54

α(γ([w,x]) + ̑ γ([y,z])) α({w+y}) ⊔ ⋯ ⊔ α({x+z}) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

slide-55
SLIDE 55

α(γ([w,x]) + ̑ γ([y,z])) α({w+y}) ⊔ ⋯ ⊔ α({x+z}) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-56
SLIDE 56

Mechanized Verification (MV)

slide-57
SLIDE 57

Traditional Approach

Verified Model

slide-58
SLIDE 58

Traditional Approach

–The Calculational Design of a Generic Abstract Interpreter [Cousot, 1998]

slide-59
SLIDE 59

Traditional Approach

–CDGAI Errata [Cousot, 2000] ... (*** bug corrected on 02/09/2000 ***) (* let b_unary b_uop r x = *) let b_unary b_uop x r = ... (*** bug corrected on 02/09/2000 ***) (* let b_binary b_bop r x y = *) let b_binary b_bop x y r = ...

slide-60
SLIDE 60

–Donald Knuth

“Beware of bugs in the above code;
 I have only proved it correct, not tried it.”

Traditional Approach

slide-61
SLIDE 61

Traditional Approach

Verified Model

slide-62
SLIDE 62

Mechanized Verification

Verified Model Certified
 Implementation

slide-63
SLIDE 63

The Plan

α({w+y}) ⊔ ⋯ ⊔ α({x+z}) α(γ([w,x]) + ̑ γ([y,z])) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-64
SLIDE 64

The Plan

Step 1:
 Check These Calculations Using a Proof Assistant

α({w+y}) ⊔ ⋯ ⊔ α({x+z}) α(γ([w,x]) + ̑ γ([y,z])) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-65
SLIDE 65

The Plan

Step 1:
 Check These Calculations Using a Proof Assistant Step 2:
 Extract a Certified
 Implementation

α({w+y}) ⊔ ⋯ ⊔ α({x+z}) α(γ([w,x]) + ̑ γ([y,z])) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-66
SLIDE 66

The Plan

Step 1:
 Check These Calculations Using a Proof Assistant Step 2:
 Extract a Certified
 Implementation ✗

α({w+y}) ⊔ ⋯ ⊔ α({x+z}) α(γ([w,x]) + ̑ γ([y,z])) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-67
SLIDE 67

“This looks like an algorithm”
 (to a human) “I know how to execute this” (to a machine)

slide-68
SLIDE 68

“This looks like an algorithm”
 (to a human) “I know how to execute this” (to a machine)

Mathematical
 Formulas
 
 
 
 
 Backed by an Algorithm

slide-69
SLIDE 69

“This looks like an algorithm”
 (to a human) “I know how to execute this” (to a machine)

Classical
 Mathematics
 
 
 
 
 Constructive
 Mathematics

slide-70
SLIDE 70

Classical
 Mathematics
 
 
 
 
 Constructive
 Mathematics

“This looks like an algorithm”
 (to a human) “I know how to execute this” (to a machine) PROBLEM: how to know
 when boundary is crossed SOLUTION: explicitly
 account for algorithmic content

slide-71
SLIDE 71

Classical Galois Connections

ℤ × ℤ

α

℘(ℤ)

slide-72
SLIDE 72

Constructive Galois Connections

ℤ × ℤ ℤ

η

slide-73
SLIDE 73

Constructive Galois Connections

ℤ × ℤ ℤ

η η(i) ≔ [i,i]

defn algorithmic
 content of
 abstraction

slide-74
SLIDE 74

Constructive Galois Connections

ℤ × ℤ ℤ

η η(i) ≔ [i,i] α = ⟨η⟩

defn law 1 embedding
 algorithms

slide-75
SLIDE 75

Constructive Galois Connections

ℤ × ℤ ℤ

η η(i) ≔ [i,i] ⟨η⟩({x}) = ⟨η(x)⟩ α = ⟨η⟩

defn law 1 law 2 singleton powersets compute

slide-76
SLIDE 76

α({w+y}) ⊔ ⋯ ⊔ α({x+z}) α(γ([w,x]) + ̑ γ([y,z])) = α({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = α({w+y,…,x+z}) = [w+y,x+z] = [w,x] + ̂ [y,z] ≜

slide-77
SLIDE 77

α(γ([w,x]) + ̑ γ([y,z]))

slide-78
SLIDE 78

α(γ([w,x]) + ̑ γ([y,z]))

α = ⟨η⟩

law 1

slide-79
SLIDE 79

α(γ([w,x]) + ̑ γ([y,z]))

slide-80
SLIDE 80

⟨η⟩(γ([w,x]) + ̑ γ([y,z]))

slide-81
SLIDE 81

⟨η⟩({w+y}) ⊔ ⋯ ⊔ ⟨η⟩({x+z}) ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = = ⟨η⟩({w+y,…,x+z}) = ⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) })

slide-82
SLIDE 82

⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) ⟨η⟩({w+y}) ⊔ ⋯ ⊔ ⟨η⟩({x+z}) ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = = ⟨η⟩({w+y,…,x+z}) =

⟨η⟩({x}) = ⟨η(x)⟩

law 2

slide-83
SLIDE 83

⟨η⟩({w+y}) ⊔ ⋯ ⊔ ⟨η⟩({x+z}) ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = = ⟨η⟩({w+y,…,x+z}) = ⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) })

slide-84
SLIDE 84

⟨η(w+y)⟩ ⊔ ⋯ ⊔ ⟨η(x+z)⟩ ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = = ⟨η⟩({w+y,…,x+z}) = ⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) })

slide-85
SLIDE 85

⟨[w+y,x+z]⟩ = [w,x] + ̂ [y,z] ≜ ⟨η(w+y)⟩ ⊔ ⋯ ⊔ ⟨η(x+z)⟩ ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = ⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = ⟨η⟩({w+y,…,x+z}) =

slide-86
SLIDE 86

The Plan

Step 1:
 Check These Calculations Using a Proof Assistant Step 2:
 Extract a Certified
 Implementation✓

⟨η(w+y)⟩ ⊔ ⋯ ⊔ ⟨η(x+z)⟩ ⟨η⟩(γ([w,x]) + ̑ γ([y,z])) = ⟨η⟩({ i + j | i ∈ γ([w,x]) ∧ j ∈ γ([y,z]) }) = ⟨η⟩({w+y,…,x+z}) = ⟨[w+y,x+z]⟩ = [w,x] + ̂ [y,z] ≜

Spec Algorithm

slide-87
SLIDE 87

calc.cousot α(eval[n])(ρ♯) ⟅ defn of α ⟆ = αᴵ(eval[n](γᴿ(ρ♯))) ⟅ defn of eval[n] ⟆ = αᴵ({i | ρ ⊢ n ↦ i}) ⟅ defn of _⊢_↦_ ⟆ = αᴵ({n}) ⟅ defn of eval♯[n] ⟆ ≜ eval♯[n](ρ♯) calc.agda

  • ⟬ α[ ⇄ᴿ ⇗ ⇄ᴵ ]

⋅ eval[ Num n ] ⋅ ρ♯ ⟭

  • ⟬ ηᴵ * ⋅ (eval[ Num n ] *

⋅ (μᴿ ⋅ ρ♯)) ⟭

  • [focus-right [⋅] of ηᴵ * ]

⟅ defn[eval[ Num n ]] ⟆

  • ⟬ ηᴵ * ⋅ (return ⋅ n) ⟭
  • ⟅ right-unit[*] ⟆
  • ⟬ pure ⋅ (ηᴵ ⋅ n) ⟭
  • ⟬ pure ⋅ eval♯[ Num n ] ⋅ ρ♯ ⟭
67
slide-88
SLIDE 88

x ⊑ γ(y) ⟺ α(x) ⊑ y ∧ ===========================

Classical GCs

x ⊑ γ(α(x)) α(γ(y)) ⊑ y

68

α : A ↗ B γ : B ↗ A A : poset B : poset

slide-89
SLIDE 89

id(x) ⊑ γ(y) ⟺ α(x) ⊑ id(y) ∧ =========================== id ⊑ γ∘α α∘γ ⊑ id

Classical GCs

69

α : A ↗ B γ : B ↗ A A : poset B : poset

slide-90
SLIDE 90

ret(n) ⊆ μ* (r) ⟺ η* (n) ⊆ ret(r) ∧ =========================== ret ⊑ μ⊛η η⊛μ ⊑ ret

Constructive GCs

70

η : A ↗ ℘(B) μ : B ↗ ℘(A) A : poset B : poset

slide-91
SLIDE 91

ret(n) ⊆ μ* (r) ⟺ ⟨η⟩ * (n) ⊆ ret(r) ∧ =========================== ret ⊑ μ⊛⟨η⟩ ⟨η⟩⊛μ ⊑ ret

Constructive GCs

71

η : A ↗ B μ : B ↗ ℘(A) A : poset B : poset

slide-92
SLIDE 92

ret(n) ⊆ μ* (r) ⟺ ⟨η⟩ * (n) ⊆ ret(r) ∧ =========================== ret ⊑ μ⊛⟨η⟩ ⟨η⟩⊛μ ⊑ ret

Constructive GCs

72

μ : B ↗ ℘(A) A : poset B : poset η : A ↗ B

slide-93
SLIDE 93

ret(n) ⊆ μ* (r) ⟺ ⟨η⟩ * (n) ⊆ ret(r) ∧ =========================== ret ⊑ μ⊛⟨η⟩ ⟨η⟩⊛μ ⊑ ret

Constructive GCs

73

μ : B ↗ ℘(A) A : poset B : poset η : A ↗ B

slide-94
SLIDE 94

Classical GCs = adjunction in
 category of posets (adjoints are mono. functions) Constructive GCs = biadjunction in
 category of posets enriched over ℘-Kleisli (adjoints are mono. ℘-monadic functions)

slide-95
SLIDE 95

✓ First theory to support both calculation and extraction ✓ Soundness and completeness w.r.t. classical GCs ✓ Two case studies: calculational AI and gradual typing ✗ Only (constr.) equivalent to subset of classical GCs ✗ Same limitations as classical GCs (∄α for some γ)

Constructive Galois Connections

75
slide-96
SLIDE 96

Abstracting
 Definitional
 Interpreters Constructive
 Galois
 Connections Galois Transformers

76
slide-97
SLIDE 97

0: int x y; 1: void safe_fun(int N) { 2: if (N≠0) {x := 0;} 3: else {x := 1;} 4: if (N≠0) {y := 100/N;} 5: else {y := 100/x;}}

Galois Transformers

77
slide-98
SLIDE 98

0: int x y; 1: void safe_fun(int N) { 2: if (N≠0) {x := 0;} 3: else {x := 1;} 4: if (N≠0) {y := 100/N;} 5: else {y := 100/x;}}

Galois Transformers

77

Flow-insensitive

results : var ↦ ℘({-,0,+})

slide-99
SLIDE 99

0: int x y; 1: void safe_fun(int N) { 2: if (N≠0) {x := 0;} 3: else {x := 1;} 4: if (N≠0) {y := 100/N;} 5: else {y := 100/x;}} N ∈ {-,0,+} x ∈ {0,+} y ∈ {-,0,+}
 UNSAFE: {100/N}
 UNSAFE: {100/x}

Galois Transformers

77

Flow-insensitive

results : var ↦ ℘({-,0,+})

slide-100
SLIDE 100

Galois Transformers

78

Flow-sensitive

results : loc ↦ (var ↦ ℘({-,0,+}))

4: x ∈ {0,+} 4.T: N ∈ {-,+} 5.F: x ∈ {0,+} N,y ∈ {-,0,+} UNSAFE: {100/x} 0: int x y; 1: void safe_fun(int N) { 2: if (N≠0) {x := 0;} 3: else {x := 1;} 4: if (N≠0) {y := 100/N;} 5: else {y := 100/x;}}

slide-101
SLIDE 101

Galois Transformers

79

Path-sensitive

results : loc ↦ ℘(var ↦ ℘({-,0,+}))

4: N∈{-,+},x∈{0} 4: N∈{0} ,x∈{+} N∈{-,+},y∈{-,0,+} N∈{0} ,y∈{0,+} SAFE 0: int x y; 1: void safe_fun(int N) { 2: if (N≠0) {x := 0;} 3: else {x := 1;} 4: if (N≠0) {y := 100/N;} 5: else {y := 100/x;}}

slide-102
SLIDE 102

Precision Performance

⌁

80
slide-103
SLIDE 103

Insight

Single
 Analyzer Monadic
 Abstraction FI, FS and PS Monads + +

results : var ↦ ℘({-,0,+}) results : loc ↦ (var ↦ ℘({-,0,+})) results : loc ↦ ℘(var ↦ ℘({-,0,+}))

slide-104
SLIDE 104

𝒟 : loc × store → loc × store

  • ⋯

𝒟

slide-105
SLIDE 105

𝒟 : loc × store → loc × store 𝒝 : loc × store♯ → ℘(loc × store♯)

  • ⋯

𝒟 𝒝

slide-106
SLIDE 106

𝒟 : loc × store → loc × store 𝒝 : loc × store♯ → ℘(loc × store♯)

  • ⋯

𝒟 𝒝

slide-107
SLIDE 107

𝒟 : loc × store → loc × store 𝒝 : loc × store♯ → ℘(loc × store♯) analyzer ≔ lfp X. X ∪ 𝒝* (X) ∪ ❴⟨l₀,⊥⟩❵

  • ⋯

𝒟 𝒝

slide-108
SLIDE 108

𝒝 : ℘(loc × store♯) → ℘(loc × store♯) Σ | {z } | {z } Σ

slide-109
SLIDE 109

𝒝 : ℘(loc × store♯) → ℘(loc × store♯) Σ | {z } | {z } Σ Σ ≔ loc ↦ ℘(store♯) ≈ ℘(loc × store♯) Path
 Sensitive Σ ≔ loc ↦ store♯ Flow
 Sensitive Σ ≔ ℘(loc) × store♯ Flow
 Insensitive

slide-110
SLIDE 110

ℳ : loc → 𝑛(loc)

slide-111
SLIDE 111

ℳ : loc → 𝑛(loc) 𝑛(A) ≔ store♯ → A ↦ ℘(store♯) Path
 Sensitive 𝑛(A) ≔ store♯ → A ↦ store♯ Flow
 Sensitive Flow
 Insensitive 𝑛(A) ≔ store♯ → ℘(A) × store♯

slide-112
SLIDE 112

ℳ : loc → 𝑛(loc) 𝑛(A) ≔ (S[store♯]∘ND)(ID)(A) Path
 Sensitive 𝑛(A) ≔ FS[store♯](ID)(A) Flow
 Sensitive Flow Insensitive 𝑛(A) ≔ (ND∘S[store♯])(ID)(A)

slide-113
SLIDE 113

ND S[σ♯]

Collecting
 Semantics

S[σ] ND ID S[σ♯] ND ID FS[σ♯] ID ID

Path
 Sensitive Flow
 Sensitive Flow Insensitive ⊑ ⊑ ⊑ ⊑ ⊑

slide-114
SLIDE 114

S[σ] S[σ♯]

α γ

slide-115
SLIDE 115

S[σ] S[σ♯]

α γ

  • α

γ α γ α γ

⊑

slide-116
SLIDE 116

S[σ] S[σ♯]

α γ

  • α

γ α γ α γ

⊑ Analyzer Collecting

slide-117
SLIDE 117

S[σ♯] ND ID

Analyzer = One Monadic
 Interpreter Must Be
 Monotonic Must Recover
 Collecting Semantics + Monad
 Stack Monadic
 Interpreter

slide-118
SLIDE 118

Galois Transformers

✓ Flow sensitive and path sensitive precision ✓ Compositional end-to-end correctness proofs ✓ Implemented in Haskell and available on Github ✗ Not whole story for path-sensitive refinement ✗ Naive fixpoint strategies

89
slide-119
SLIDE 119

Abstracting
 Definitional
 Interpreters Constructive
 Galois
 Connections Galois Tranformers

90
slide-120
SLIDE 120

1: function id(x : any) → any 2: return x 3: function main() → void 4: var y ≔ id(1) 5: print("Y") 6: var z ≔ id(2) 7: print("Z")

91

Abstracting Definitional Interpreters

slide-121
SLIDE 121

1: function id(x : any) → any 2: return x 3: function main() → void 4: var y ≔ id(1) 5: print("Y") 6: var z ≔ id(2) 7: print("Z")

91

Abstracting Definitional Interpreters

slide-122
SLIDE 122

1: function id(x : any) → any 2: return x 3: function main() → void 4: var y ≔ id(1) 5: print("Y") 6: var z ≔ id(2) 7: print("Z")

91

Abstracting Definitional Interpreters

slide-123
SLIDE 123

1: function id(x : any) → any 2: return x 3: function main() → void 4: var y ≔ id(1) 5: print("Y") 6: var z ≔ id(2) 7: print("Z")

91

Abstracting Definitional Interpreters

slide-124
SLIDE 124

1: function id(x : any) → any 2: return x 3: function main() → void 4: var y ≔ id(1) 5: print("Y") 6: var z ≔ id(2) 7: print("Z")

91

> Z > YYYYYYZ

Abstracting Definitional Interpreters

slide-125
SLIDE 125

Pushdown Precision

Reps et al 1995 Doesn’t support
 HO control Earl Diss
 2012 Dyck
 State Graphs Vardoulakis Diss 2012 “Big”CFA Johnson and Van Horn 2014 Instrumented
 AAM Gilray et al 2016 Instrumented AAM

slide-126
SLIDE 126

Definitional Interpreters

  • Modeled features vs inherited features
  • (e.g., Reynolds’ inherited CBV and CBN)
  • Things often modeled in Abstract Interpreters
  • Control (continuations)
  • Fixpoints
slide-127
SLIDE 127

Definitional Interpreters

  • Modeled features vs inherited features
  • (e.g., Reynolds’ inherited CBV and CBN)
  • Things often modeled in Abstract Interpreters
  • Control (continuations)
  • Fixpoints

Idea: Inherit from metalanguage

slide-128
SLIDE 128

ℰ⟦⋅⟧ : exp → env × store → (val × env × store)

slide-129
SLIDE 129

ℰ⟦⋅⟧ : exp → env × store → (val × env × store) … ℰ⟦if(e₁){e₂}{e₃}⟧(ρ,σ) ≔ match ℰ⟦e₁⟧(ρ,σ) | ⟨true ,σ′⟩ ⇒ ℰ⟦e₂⟧(ρ,σ′) | ⟨false,σ′⟩ ⇒ ℰ⟦e₃⟧(ρ,σ′) …

slide-130
SLIDE 130

ℰ⟦⋅⟧ : exp → env × store → (val × env × store) No explicit model for control (continuations). It’s inherited from the metalanguage. … ℰ⟦if(e₁){e₂}{e₃}⟧(ρ,σ) ≔ match ℰ⟦e₁⟧(ρ,σ) | ⟨true ,σ′⟩ ⇒ ℰ⟦e₂⟧(ρ,σ′) | ⟨false,σ′⟩ ⇒ ℰ⟦e₃⟧(ρ,σ′) …

slide-131
SLIDE 131

Step 1 Monadic Interpreter ℰ⟦⋅⟧ : exp → 𝑛(val)

slide-132
SLIDE 132

… ℰ⟦if(e₁){e₂}{e₃}⟧ ≔ do v ← ℰ⟦e₁⟧ match v | true ⇒ ℰ⟦e₂⟧ | false ⇒ ℰ⟦e₃⟧ … Step 1 Monadic Interpreter ℰ⟦⋅⟧ : exp → 𝑛(val)

slide-133
SLIDE 133

ℰ⟦⋅⟧ : exp → (exp → 𝑛(val)) → 𝑛(val) Step 2 Unfixed Recursion

slide-134
SLIDE 134

ℰ⟦⋅⟧ : exp → (exp → 𝑛(val)) → 𝑛(val) … ℰ⟦if(e₁){e₂}{e₃}⟧(ℰ′) ≔ do v ← ℰ′⟦e₁⟧ match v | true ⇒ ℰ′⟦e₂⟧ | false ⇒ ℰ′⟦e₃⟧ … Step 2 Unfixed Recursion

slide-135
SLIDE 135

Step 3 Abstract Monad … ℰ⟦if(e₁){e₂}{e₃}⟧(ℰ′) ≔ do v ← ℰ′⟦e₁⟧ match v | true ⇒ ℰ′⟦e₂⟧ | false ⇒ ℰ′⟦e₃⟧ … ℰ⟦⋅⟧ : exp → (exp → 𝑛♯(val)) → 𝑛♯(val)

slide-136
SLIDE 136

ℰ⟦⋅⟧ : exp → (exp → 𝑛♯(val)) → 𝑛♯(val) Y(λ ℰ′.λ e.ℰ⟦e⟧(ℰ′)) Abstract Evaluator
 (Doesn’t Terminate)

slide-137
SLIDE 137

ℰ⟦⋅⟧ : exp → (exp → 𝑛♯(val)) → 𝑛♯(val) Y(λ ℰ′.λ e.ℰ⟦e⟧(ℰ′)) Abstract Evaluator
 (Doesn’t Terminate) CY(λ ℰ′.λ e.ℰ⟦e⟧(ℰ′)) Caching Evaluator
 (Terminates) | {z } Pushdown Precision

slide-138
SLIDE 138

Formalism

ρ,τ ⊢ e,σ ⇓ v,σ ρ,τ ⊢ e,σ ⇑ ⟨e,ρ,τ,σ⟩ Evaluation Reachability

slide-139
SLIDE 139

Formalism

ρ,τ ⊢ e,σ ⇓ v,σ ρ,τ ⊢ e,σ ⇑ ⟨e,ρ,τ,σ⟩ Evaluation Reachability ⟦e⟧(ρ,τ,σ) ≔ {⟨v,σ″⟩ | ρ ,τ ⊢ e ,σ ⇑ ⟨e′,ρ′,τ′,σ′⟩ ∧ ρ′,τ′ ⊢ e′,σ′ ⇓ ⟨v,σ″⟩}

slide-140
SLIDE 140

✓ Compositional program analyzers ✓ Formalized w.r.t. big-step reachability semantics ✓ Pushdown precision inherited from metalanguage ✓ Implemented in Racket and available on Github ✗ Naive caching algorithm (could be improved) ✗ Monadic, open-recursive interpreters

Definitional Abstract Interpreters

100
slide-141
SLIDE 141

Usable Trustworthy Program
 Analysis

✓ ✗

Mechanized
 Verification

✗ ✓

MVPA

✓ ✓

My Research

slide-142
SLIDE 142

Thesis
 
 Constructing mechanically verified program analyzers via calculation and composition is feasible using constructive Galois connections and modular abstract interpreters.

slide-143
SLIDE 143

Abstracting
 Definitional
 Interpreters Constructive
 Galois
 Connections Galois Tranformers

103

Mechanization
 +
 Calculation Compositional
 Path-sens. + Flow-sens. Compositional
 Interpreters
 +
 Pushdown
 Precision