Ownership, Pointer Arithmetic and Memory Separation Romain Bardou - - PowerPoint PPT Presentation

▶
ownership pointer arithmetic and memory separation
SMART_READER_LITE
LIVE PREVIEW

Ownership, Pointer Arithmetic and Memory Separation Romain Bardou - - PowerPoint PPT Presentation

Aug 22, 2023 163 likes •501 views

Ownership, Pointer Arithmetic and Memory Separation Romain Bardou INRIA Saclay, France FTfJP2008 Ownership, Pointer Arithmetic, and Memory Separation 1 / 32 Introduction Jessie Ownership and Invariants Problems Our Approach Core Language

slide-1
SLIDE 1

Ownership, Pointer Arithmetic and Memory Separation

Romain Bardou INRIA Saclay, France FTfJP2008

Ownership, Pointer Arithmetic, and Memory Separation 1 / 32

slide-2
SLIDE 2

Introduction Jessie Ownership and Invariants Problems Our Approach Core Language Pointer Arithmetic Memory Separation Conclusion

Ownership, Pointer Arithmetic, and Memory Separation Introduction 2 / 32

slide-3
SLIDE 3

Jessie (1/2)

Context: deductive verification INRIA Saclay: the Why platform to verify C or Java programs

Ownership, Pointer Arithmetic, and Memory Separation Introduction Jessie 3 / 32

slide-4
SLIDE 4

Jessie (2/2)

❈ ❏❛✈❛ ❏❡ss✐❡ ❲❤② ❱❈● ❙✐♠♣❧✐❢② ❆❧t✲❊r❣♦ ❩✸ ❨✐❝❡s ❈♦q ✳✳✳ ❑r❛❦❛t♦❛ ❈❛❞✉❝❡✉s

Ownership, Pointer Arithmetic, and Memory Separation Introduction Jessie 4 / 32

slide-5
SLIDE 5

Ownership and Invariants (1/2)

Examples of invariants:

◮ x = 0 ◮ t.size = length(t.data) ◮ Tree t is a search tree ◮ Tree t is balanced

Ownership, Pointer Arithmetic, and Memory Separation Introduction Ownership and Invariants 5 / 32

slide-6
SLIDE 6

Ownership and Invariants (2/2)

Existing systems:

◮ Spec# / Boogie ◮ Universes type system ◮ Capabilities ◮ ...

And in Jessie?

Ownership, Pointer Arithmetic, and Memory Separation Introduction Ownership and Invariants 6 / 32

slide-7
SLIDE 7

Problems

Memory model of Jessie:

◮ Pointer arithmetic

◮ Used to encode arrays ◮ A single pointer may be shifted to access several others

◮ Memory separation

◮ Memory is split into several maps from pointers to values ◮ Simplifies pointer aliasing problems ◮ Global properties of the ownership system are harder to express Ownership, Pointer Arithmetic, and Memory Separation Introduction Problems 7 / 32

slide-8
SLIDE 8

Our Approach

◮ Provide a small core language formalizing ownership and

invariants

◮ Captures the core ideas of ownership ◮ Simple formalization usable in proofs ◮ Easy to extend ◮ Pointer arithmetic

◮ Express the global properties of the ownership system, in the

logic, using assumptions

Ownership, Pointer Arithmetic, and Memory Separation Introduction Our Approach 8 / 32

slide-9
SLIDE 9

Introduction Core Language Syntax Semantics Example Pointer Arithmetic Memory Separation Conclusion

Ownership, Pointer Arithmetic, and Memory Separation Core Language 9 / 32

slide-10
SLIDE 10

Syntax

e ::= v Values | x Variables | let x = e in e Binding | e; e Sequence | while e do e Turing-completion | if e then e else e Test | new e; I; r Allocation | !e Dereferencing | e := e Assignment | pack e Packing | unpack e Unpacking

Ownership, Pointer Arithmetic, and Memory Separation Core Language Syntax 10 / 32

slide-11
SLIDE 11

Semantics (1/4)

Allocation (p fresh in Γ): Γ; new v; I; r → Γ, p = v; I; r◦; p Assignment: Γ, p = v1; I; r◦; p := v2 → Γ, p = v2; I; r◦; unit

Ownership, Pointer Arithmetic, and Memory Separation Core Language Semantics 11 / 32

slide-12
SLIDE 12

Semantics (2/4)

Packing (only if I holds in Γ): Γ, p = v; I; p1 · · · pn◦ p1 = R×

1 , · · · , pn = R× n

  • ; pack p

→ Γ, p = v; I; p1 · · · pn× p1 = R⊗

1 , · · · , pn = R⊗ n

  • ; unit

Ownership, Pointer Arithmetic, and Memory Separation Core Language Semantics 12 / 32

slide-13
SLIDE 13

Semantics (3/4)

Unpacking: Γ, p = v; I; p1 · · · pn× p1 = R⊗

1 , · · · , pn = R⊗ n

  • ; unpack p

→ Γ, p = v; I; p1 · · · pn◦ p1 = R×

1 , · · · , pn = R× n

  • ; unit

Ownership, Pointer Arithmetic, and Memory Separation Core Language Semantics 13 / 32

slide-14
SLIDE 14

Semantics (4/4)

Assignment can only be done on open (unpacked) pointers: Γ, p = v1; I; r◦; p := v2 → Γ, p = v2; I; r◦; unit This ensures that invariants are not broken.

Ownership, Pointer Arithmetic, and Memory Separation Core Language Semantics 14 / 32

slide-15
SLIDE 15

Example (1/2)

[M¨ uller, challenges in Java program verification] Let t be an array of integer of size n. int i, j, count = 0; for (i=0; i < t.length; i++) if (t[i] > 0) count++; int u[] = new int[count]; for (i=0, j=0; i < n; i++) if (t[i] > 0) u[j++] = t[i]; This copies the positive elements of t in the new array u. Problem: access u[j++] inside array bounds?

Ownership, Pointer Arithmetic, and Memory Separation Core Language Example 15 / 32

slide-16
SLIDE 16

Example (2/2)

let i = new 0; true; ∅ in let j = new 0; true; ∅ in let count = new 0; (λp.!p = Card{i | t[i] > 0}); t[0..n] in while !i ≤ n do (if !t[!i] > 0 then count :=!count + 1; i :=!i + 1); pack count; let u = new 0; true; ∅[!count] in i := 0; while !i ≤ n do (if !t[!i] > 0 then (u[!j] :=!t[!i]; j :=!j + 1)) i :=!i + 1)

Ownership, Pointer Arithmetic, and Memory Separation Core Language Example 16 / 32

slide-17
SLIDE 17

Introduction Core Language Pointer Arithmetic Pointer Shifting Extending Allocation Examples Memory Separation Conclusion

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic 17 / 32

slide-18
SLIDE 18

Pointer Shifting

We axiomatize pointer shifting ⊕: p ⊕ i = p ⇐ ⇒ i = 0 (p ⊕ i) ⊕ j = p ⊕ (i + j) Pointers do not have to be all related together by ⊕.

· · · p ⊕ 2 p ⊕ 1 p p ⊕ −1 · · ·

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic Pointer Shifting 18 / 32

slide-19
SLIDE 19

Extending Allocation

new λo.v; I(o); r(o)[n] allocates the following fresh pointers: p ⊕ o = v; I(o); r(o) where o ∈ {0, · · · , n − 1}. All these pointers are known to be related by ⊕.

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic Extending Allocation 19 / 32

slide-20
SLIDE 20

Examples (1/3)

An array of positive integers: new λo.0; (λp.!p ≥ 0); ∅[n]

≥ 0 n − 1 · · · · · · ≥ 0 1 ≥ 0

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic Examples 20 / 32

slide-21
SLIDE 21

Examples (2/3)

A pointer on an array of positive integers: let p = new λo.0; true; ∅[n] in new 0; (∀o, !(!p ⊕ o) ≥ 0); p ⊕ [0..(n − 1)]

n − 1 · · · 1 ❛❧❧ ≥ 0

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic Examples 21 / 32

slide-22
SLIDE 22

Examples (3/3)

let i = new 0; true; ∅ in let j = new 0; true; ∅ in let count = new 0; (λp.!p = Card{i | t ⊕ i > 0}); t ⊕ [0..n] in while !i ≤ n do (if !t⊕!i > 0 then count :=!count + 1; i :=!i + 1); pack count; let u = new λo.0; true; ∅[!count] in i := 0; while !i ≤ n do (if !t⊕!i > 0 then (u⊕!j :=!t⊕!i; j :=!j + 1)) i :=!i + 1)

Ownership, Pointer Arithmetic, and Memory Separation Pointer Arithmetic Examples 22 / 32

slide-23
SLIDE 23

Introduction Core Language Pointer Arithmetic Memory Separation With One Heap With Multiple Memories Linking Memories Example Conclusion

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation 23 / 32

slide-24
SLIDE 24

With One Heap (1/3)

Global ownership properties:

◮ p is closed =

⇒ Inv(p)

◮ p is closed =

⇒ reps of p are owned

◮ Owner of p is unique

Axioms? Depends on the heap. In Spec# / Boogie: IsHeap ∀h. IsHeap(h) = ⇒ Global ownership properties(h)

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation With One Heap 24 / 32

slide-25
SLIDE 25

With One Heap (2/3)

Another point of view: assumptions The following code: x :=!y becomes, at the Boogie or Why level: assume Global ownership properties(h) h := store(h, x, select(h, y)) assume Global ownership properties(h)

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation With One Heap 25 / 32

slide-26
SLIDE 26

With One Heap (3/3)

Suppose a free variable x. let y = new 0; (λp.!p >!x); x in y :=!x + 1; pack y; y Post-condition: !y >!x Resulting proof obligation (simplified): ∀h, x, y IsHeap(h) closed(h, y)    = ⇒ select(h, y) > select(h, x)

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation With One Heap 26 / 32

slide-27
SLIDE 27

With Multiple Memories

The heap h is split into several maps from pointers to values. ∀hx, hy,x, y IsHeap(???) closed(hy, y)    = ⇒ select(hy, y) > select(hx, x)

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation With Multiple Memories 27 / 32

slide-28
SLIDE 28

Linking Memories (1/2)

Axiom: ∀h,hx, hy. linked(h, hx) linked(h, hy) IsHeap(h)        = ⇒ Global ownership properties(h, hx, hy) Proof obligation: ∀h,hx, hy,x, y linked(h, hx) linked(h, hy) IsHeap(h) closed(hy, y)            = ⇒ select(hy, y) > select(hx, x) This is inconsistent!

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation Linking Memories 28 / 32

slide-29
SLIDE 29

Linking Memories (2/2)

Solution: use the assumption point of view. ...some code... assume Global ownership properties(Current heapx, Current heapy) ...some code... Proof obligation: ∀hx, hy, x, y Global ownership properties(hx, hy) closed(hy, y)    ⇒ select(hy, y) > select(hx, x)

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation Linking Memories 29 / 32

slide-30
SLIDE 30

Example

· · · pack count; · · · while !i ≤ n do (if !t⊕!i > 0 then (u⊕!j :=!t⊕!i; j :=!j + 1)) i :=!i + 1) Thanks to memory separation:

◮ Contents of array t is not modified: trivial

Thanks to the invariant system:

◮ All accesses to array u are valid: immediate consequence of

closed(count) and the assumed global ownership properties

Ownership, Pointer Arithmetic, and Memory Separation Memory Separation Example 30 / 32

slide-31
SLIDE 31

Introduction Core Language Pointer Arithmetic Memory Separation Conclusion

Ownership, Pointer Arithmetic, and Memory Separation Conclusion 31 / 32

slide-32
SLIDE 32

Conclusion

The power of the ownership system of Spec#...

◮ captured in a small core language, ◮ implemented with pointer arithmetic, ◮ and memory separation.

Other possible extensions such as classes (implemented in Jessie). Could be used in ESC/Java, ...

Ownership, Pointer Arithmetic, and Memory Separation Conclusion 32 / 32