SLIDE 1
Separation Logic for Non-local Control Flow and Block Scope - - PowerPoint PPT Presentation
Separation Logic for Non-local Control Flow and Block Scope - - PowerPoint PPT Presentation
Separation Logic for Non-local Control Flow and Block Scope Variables Robbert Krebbers Joint work with Freek Wiedijk Radboud University Nijmegen March 19, 2013 @ FoSSaCS, Rome, Italy What is this program supposed to do? int *p = NULL; l: if
SLIDE 2
SLIDE 3
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p NULL
SLIDE 4
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p NULL
SLIDE 5
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p NULL j 10
SLIDE 6
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p
- j
10
SLIDE 7
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p
- j
10
SLIDE 8
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p
SLIDE 9
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p
SLIDE 10
What is this program supposed to do?
int *p = NULL; l: if (p) { return (*p); } else { int j = 10; p = &j; goto l; } memory: p
- It exhibits undefined behavior, thus it may do anything
SLIDE 11
Undefined behavior in C
◮ Undefined behavior is shown by “wrong” C programs ◮ Programs may do anything on undefined behavior ◮ It allows compilers to omit (expensive) dynamic checks
SLIDE 12
Undefined behavior in C
◮ Undefined behavior is shown by “wrong” C programs ◮ Programs may do anything on undefined behavior ◮ It allows compilers to omit (expensive) dynamic checks ◮ It cannot be checked for statically ◮ Not accounting for it means that
◮ programs can be proven to be correct with respect to the
formal semantics . . .
◮ whereas they may crash when compiled with an actual compiler
SLIDE 13
Undefined behavior in C
◮ Undefined behavior is shown by “wrong” C programs ◮ Programs may do anything on undefined behavior ◮ It allows compilers to omit (expensive) dynamic checks ◮ It cannot be checked for statically ◮ Not accounting for it means that
◮ programs can be proven to be correct with respect to the
formal semantics . . .
◮ whereas they may crash when compiled with an actual compiler
This talk: undefined behavior due to dangling pointers by non-local control flow and block scopes
SLIDE 14
Goto considered harmful?
http://xkcd.com/292/
SLIDE 15
Goto considered harmful?
http://xkcd.com/292/ Not necessarily: ⊢ {P} . . . goto main_sub3; . . . {Q}
SLIDE 16
Contribution
A concise small step operational, and axiomatic, semantics for goto, supporting:
◮ local variables (and pointers to those), ◮ mutual recursion, ◮ separation logic, ◮ soundness proof fully checked by Coq
SLIDE 17
Approach
◮ Execute gotos and returns in small steps
◮ Not so much to search for labels, . . . ◮ but to naturally perform required allocations and deallocations
SLIDE 18
Approach
◮ Execute gotos and returns in small steps
◮ Not so much to search for labels, . . . ◮ but to naturally perform required allocations and deallocations
◮ Traversal through the AST in the following directions:
◮ ց downwards to the next statement ◮ ր upwards to the next statement
SLIDE 19
Approach
◮ Execute gotos and returns in small steps
◮ Not so much to search for labels, . . . ◮ but to naturally perform required allocations and deallocations
◮ Traversal through the AST in the following directions:
◮ ց downwards to the next statement ◮ ր upwards to the next statement ◮ l to a label l: after a goto l ◮ ↑
↑ to the top of the statement after a return
SLIDE 20
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l
SLIDE 21
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p NULL
SLIDE 22
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p NULL
SLIDE 23
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p NULL
SLIDE 24
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p NULL j 10
SLIDE 25
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p NULL j 10
SLIDE 26
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
- j
10
SLIDE 27
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ր
memory: p
- j
10
SLIDE 28
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ր
memory: p
- j
10
SLIDE 29
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
- j
10
SLIDE 30
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
- j
10
SLIDE 31
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
l
memory: p
- j
10
SLIDE 32
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
l
memory: p
- j
10
SLIDE 33
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
l
memory: p
- j
10
SLIDE 34
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
l
memory: p
SLIDE 35
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
l
memory: p
SLIDE 36
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
SLIDE 37
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
SLIDE 38
Example
int *p = NULL l: if (p) return (*p) int j = 10 ; p = &j goto l direction:
ց
memory: p
SLIDE 39
How to model the current location in the program
Huet’s zipper Purely functional way to store a pointer into a data structure
SLIDE 40
Statement contexts
◮ Statements:
s ::= block s | el := er | f ( e) | skip | goto l | l : s | s1 ; s2 | if (e) s1 s2 | return
SLIDE 41
Statement contexts
◮ Statements:
s ::= block s | el := er | f ( e) | skip | goto l | l : s | s1 ; s2 | if (e) s1 s2 | return
◮ The block construct is unnamed as we use De Bruijn indexes
SLIDE 42
Statement contexts
◮ Statements:
s ::= block s | el := er | f ( e) | skip | goto l | l : s | s1 ; s2 | if (e) s1 s2 | return
◮ The block construct is unnamed as we use De Bruijn indexes ◮ Singular statement contexts:
ES ::= ; s2 | s1 ; | if (e) s2 | if (e) s1 | l :
SLIDE 43
Statement contexts
◮ Statements:
s ::= block s | el := er | f ( e) | skip | goto l | l : s | s1 ; s2 | if (e) s1 s2 | return
◮ The block construct is unnamed as we use De Bruijn indexes ◮ Singular statement contexts:
ES ::= ; s2 | s1 ; | if (e) s2 | if (e) s1 | l :
◮ A pair (
ES, s) forms a zipper for statements, where
◮
- ES is a statement turned
inside-out
◮ s is the focused substatement
- ES
s
SLIDE 44
Program contexts
◮ Make the zipper stateful to also contain the stack
(to assign memory indexes to local variables)
◮ Extend the zipper dynamically on function calls
SLIDE 45
Program contexts
◮ Make the zipper stateful to also contain the stack
(to assign memory indexes to local variables)
◮ Extend the zipper dynamically on function calls ◮ Program contexts k are lists of singular program contexts:
E ::= ES | blockb | . . . where blockb associates a block scope variable with its corresponding memory index b
SLIDE 46
States
A state S(k, φ, m) consists of a program context k, focus φ, and memory m
SLIDE 47
States
A state S(k, φ, m) consists of a program context k, focus φ, and memory m We consider the following focuses:
◮ (d, s) execution of a statement s in direction d
SLIDE 48
States
A state S(k, φ, m) consists of a program context k, focus φ, and memory m We consider the following focuses:
◮ (d, s) execution of a statement s in direction d ◮ call f
v calling a function f ( v)
SLIDE 49
States
A state S(k, φ, m) consists of a program context k, focus φ, and memory m We consider the following focuses:
◮ (d, s) execution of a statement s in direction d ◮ call f
v calling a function f ( v)
◮ return returning from a function
SLIDE 50
Example
int *p = NULL l: if (p) return int j = 10 ; p = &j goto l
The corresponding state is S(k, φ, m), where:
◮ k = [
; goto l, x0 := int 10 ; , blockbj , if (load x0) return , l : , x0 := NULL ; , blockbp ]
◮ φ = (ր, x1 := x0) ◮ m = {bp → ptr bj, bj → 10}
SLIDE 51
The small step semantics
Lemma
The small step semantics behaves as traversing through a zipper. That is, if S(k, (d, s), m) ∗
k S(k, (d′, s′), m′)
then s = s′.
SLIDE 52
The small step semantics
Lemma
The small step semantics behaves as traversing through a zipper. That is, if S(k, (d, s), m) ∗
k S(k, (d′, s′), m′)
then s = s′. In a picture: if k1 s1 ∗
k1
k2 s2 ∗
k1
k3 s3 . . . ∗
k1 . . .
k1 sn then s1 = sn.
SLIDE 53
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q}
SLIDE 54
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q} where:
◮ {P} s {Q} is a Hoare triple, as usual
SLIDE 55
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q} where:
◮ {P} s {Q} is a Hoare triple, as usual ◮ ∆ maps function names to their pre- and post-conditions
SLIDE 56
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q} where:
◮ {P} s {Q} is a Hoare triple, as usual ◮ ∆ maps function names to their pre- and post-conditions ◮ J maps labels to their jumping condition
When executing a goto l, the assertion J l has to hold
SLIDE 57
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q} where:
◮ {P} s {Q} is a Hoare triple, as usual ◮ ∆ maps function names to their pre- and post-conditions ◮ J maps labels to their jumping condition
When executing a goto l, the assertion J l has to hold
◮ R has to hold to execute a return
SLIDE 58
Hoare sextuples
Our Hoare sextuples are of the shape ∆; J; R ⊢ {P} s {Q} where:
◮ {P} s {Q} is a Hoare triple, as usual ◮ ∆ maps function names to their pre- and post-conditions ◮ J maps labels to their jumping condition
When executing a goto l, the assertion J l has to hold
◮ R has to hold to execute a return
Remark: the assertions P, Q, J and R correspond to the directions
ց, ր, and ↑ ↑ of traversal
SLIDE 59
Some Hoare rules
Composition: ∆; J; R ⊢ {P} s1 {P′} ∆; J; R ⊢ {P′} s2 {Q} ∆; J; R ⊢ {P} s1 ; s2 {Q}
SLIDE 60
Some Hoare rules
Composition: ∆; J; R ⊢ {P} s1 {P′} ∆; J; R ⊢ {P′} s2 {Q} ∆; J; R ⊢ {P} s1 ; s2 {Q} Goto: ∆; J; R ⊢ {J l} goto l {Q} ∆; J; R ⊢ {J l} s {Q} ∆; J; R ⊢ {J l} l : s {Q}
SLIDE 61
Some Hoare rules
Composition: ∆; J; R ⊢ {P} s1 {P′} ∆; J; R ⊢ {P′} s2 {Q} ∆; J; R ⊢ {P} s1 ; s2 {Q} Goto: ∆; J; R ⊢ {J l} goto l {Q} ∆; J; R ⊢ {J l} s {Q} ∆; J; R ⊢ {J l} l : s {Q} Return: ∆; J; R ⊢ {R} return {Q}
SLIDE 62
The frame rule
Used for local reasoning ∆; J; R ⊢ {P} s {Q} ∆; J ∗ A; R ∗ A ⊢ {P ∗ A} s {Q ∗ A}
SLIDE 63
The block scope variable rule
∆; J ↑ ∗ x0 → -; R ↑ ∗ x0 → - ⊢ {P ↑ ∗ x0 → -} s {Q ↑ ∗ x0 → -} ∆; J; R ⊢ {P} block s {Q} When entering a block:
◮ The De Bruijn indexes are lifted: ( ) ↑ ◮ The memory is extended: ( ) ∗ x0 → -
SLIDE 64
The block scope variable rule
∆; J ↑ ∗ x0 → -; R ↑ ∗ x0 → - ⊢ {P ↑ ∗ x0 → -} s {Q ↑ ∗ x0 → -} ∆; J; R ⊢ {P} block s {Q} When entering a block:
◮ The De Bruijn indexes are lifted: ( ) ↑ ◮ The memory is extended: ( ) ∗ x0 → -
When leaving a block: the reverse
SLIDE 65
The block scope variable rule
∆; J ↑ ∗ x0 → -; R ↑ ∗ x0 → - ⊢ {P ↑ ∗ x0 → -} s {Q ↑ ∗ x0 → -} ∆; J; R ⊢ {P} block s {Q} When entering a block:
◮ The De Bruijn indexes are lifted: ( ) ↑ ◮ The memory is extended: ( ) ∗ x0 → -
When leaving a block: the reverse Important: using De Bruijn indexes avoids shadowing
SLIDE 66
Formalization in Coq
◮ Extremely useful for debugging
Proved in Coq
SLIDE 67
Formalization in Coq
◮ Extremely useful for debugging ◮ Notations close to those on paper ◮ Also supports while and functions with
return values Proved in Coq
SLIDE 68
Formalization in Coq
◮ Extremely useful for debugging ◮ Notations close to those on paper ◮ Also supports while and functions with
return values
◮ Uses lots of automation ◮ 3500 lines of code
Proved in Coq
SLIDE 69
Future research
◮ Expressions with side effects (recently finished) ◮ Machine integers (recently finished)
SLIDE 70
Future research
◮ Expressions with side effects (recently finished) ◮ Machine integers (recently finished) ◮ The C type system (in progress) ◮ Non-aliasing restrictions (in progress)
SLIDE 71
Future research
◮ Expressions with side effects (recently finished) ◮ Machine integers (recently finished) ◮ The C type system (in progress) ◮ Non-aliasing restrictions (in progress) ◮ Verification condition generator in Coq
SLIDE 72
Future research
◮ Expressions with side effects (recently finished) ◮ Machine integers (recently finished) ◮ The C type system (in progress) ◮ Non-aliasing restrictions (in progress) ◮ Verification condition generator in Coq ◮ Correspondence with CompCert
SLIDE 73