The need for a formal model of Java Safety guarantees of Java - - PowerPoint PPT Presentation

▶
the need for a formal model of java
SMART_READER_LITE
LIVE PREVIEW

The need for a formal model of Java Safety guarantees of Java - - PowerPoint PPT Presentation

Sep 02, 2023 140 likes •596 views

Making the Java Memory Model Safe Andreas Lochbihler Institute for Information Security ETH Zurich supported by DFG Sn11/10-1,2 The need for a formal model of Java Safety guarantees of Java definedness type safety security

slide-1
SLIDE 1

Making the Java Memory Model Safe∗

Andreas Lochbihler

Institute for Information Security ETH Zurich

∗supported by DFG Sn11/10-1,2

slide-2
SLIDE 2

The need for a formal model of Java

Safety guarantees of Java

◮ definedness ◮ type safety ◮ security architecture (sandbox)

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

slide-3
SLIDE 3

The need for a formal model of Java

Safety guarantees of Java

◮ definedness ◮ type safety ◮ security architecture (sandbox)

KeY-System Krakatoa / Why3 Java Path Finder Joana

rely on

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

slide-4
SLIDE 4

The need for a formal model of Java

Concurrency in Java

◮ threads ◮ synchronisation primitives ◮ memory model

Safety guarantees of Java

◮ definedness ◮ type safety ◮ security architecture (sandbox)

KeY-System Krakatoa / Why3 Java Path Finder Joana

rely on

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

slide-5
SLIDE 5

The need for a formal model of Java

Concurrency in Java

◮ threads ◮ synchronisation primitives ◮ memory model

Safety guarantees of Java

◮ definedness ◮ type safety ◮ security architecture (sandbox)

KeY-System Krakatoa / Why3 Java Path Finder Joana

rely on

Implications?

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

slide-6
SLIDE 6

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0;

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-7
SLIDE 7

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-8
SLIDE 8

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics √

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-9
SLIDE 9

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics √ √

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-10
SLIDE 10

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics √ √ √

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-11
SLIDE 11

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics √ √ √ X

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-12
SLIDE 12

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

interleaving semantics √ √ √ X compiler and hardware reorder statements

j = y; x = 1; i = x; y = 2; i == 0 i == 1 j == 0 j == 2

√

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-13
SLIDE 13

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

Java memory model √ √ √ √ compiler and hardware reorder statements

j = y; x = 1; i = x; y = 2; i == 0 i == 1 j == 0 j == 2

√

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-14
SLIDE 14

Why do we need a memory model?

x = 1; j = y; y = 2; i = x; initially: x = y = 0; i == 0 i == 1 j == 0 j == 2

Java memory model √ √ √ √ compiler and hardware reorder statements

j = y; x = 1; i = x; y = 2; i == 0 i == 1 j == 0 j == 2

√ data races

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

slide-15
SLIDE 15

Semantics in layers

Java memory model set of well-formed candidate executions

  • perational

semantics shared memory

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-16
SLIDE 16

Semantics in layers

Java memory model set of well-formed candidate executions

  • perational

semantics shared memory allocation & type information

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-17
SLIDE 17

Semantics in layers

Java memory model set of well-formed candidate executions

  • perational

semantics t : α shared memory allocation & type information

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-18
SLIDE 18

Semantics in layers

Java memory model set of well-formed candidate executions

  • perational

semantics t : α shared memory allocation & type information thread communication

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-19
SLIDE 19

Semantics in layers

Java memory model set of well-formed candidate executions

  • perational

semantics t : α

t

1

: α

1

t

′ 1

: α

′ 1

. . . . . . . . .

transition system shared memory allocation & type information thread communication

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-20
SLIDE 20

Semantics in layers

Java memory model set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α

t

1

: α

1

t

′ 1

: α

′ 1

. . . . . . . . .

paths in the transition system shared memory allocation & type information thread communication

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-21
SLIDE 21

Semantics in layers

Java memory model legality constraints pair read and write ops set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α

t

1

: α

1

t

′ 1

: α

′ 1

. . . . . . . . .

paths in the transition system shared memory allocation & type information thread communication legal

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-22
SLIDE 22

Semantics in layers

Java memory model legality constraints pair read and write ops need set of candidate executions

  • cf. [Batty et al.’15]

set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α

t

1

: α

1

t

′ 1

: α

′ 1

. . . . . . . . .

paths in the transition system shared memory allocation & type information thread communication legal

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

slide-23
SLIDE 23

Type safety for method calls Dynamic method lookup finds a unique method.

r1 = x; if (r1 != null) r1.m(); y = new A(); r2 = y; x = r2; initially: x = y = null; class A { void m() {} }

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

slide-24
SLIDE 24

Type safety for method calls Dynamic method lookup finds a unique method.

JMM allows reordering with allocations.

r1 = x; if (r1 != null) r1.m(); y = new A(); r2 = y; x = r2; initially: x = y = null; class A { void m() {} }

reorder

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

slide-25
SLIDE 25

Type safety for method calls Dynamic method lookup finds a unique method.

JMM allows reordering with allocations.

r1 = x; if (r1 != null) r1.m(); y = new A(); r2 = y; x = r2; initially: x = y = null; class A { void m() {} }

reorder

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

slide-26
SLIDE 26

Type safety for method calls Dynamic method lookup finds a unique method.

JMM allows reordering with allocations.

r1 = x; if (r1 != null) r1.m(); y = new A(); r2 = y; x = r2; initially: x = y = null; class A { void m() {} }

reorder

  • bject accessed

before allocated

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

slide-27
SLIDE 27

Type safety for method calls Dynamic method lookup finds a unique method.

JMM allows reordering with allocations.

r1 = x; if (r1 != null) r1.m(); y = new A(); r2 = y; x = r2; initially: x = y = null; class A { void m() {} }

reorder

  • bject accessed

before allocated Separate type information of addresses from their allocation! Index addresses by dynamic type!

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

slide-28
SLIDE 28

Type safety for fields Accessed fields exist and contain only type-conform values.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-29
SLIDE 29

Type safety for fields Accessed fields exist and contain only type-conform values.

progress

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-30
SLIDE 30

Type safety for fields Accessed fields exist and contain only type-conform values.

progress

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-31
SLIDE 31

Type safety for fields Accessed fields exist and contain only type-conform values.

progress subject reduction

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-32
SLIDE 32

Type safety for fields Accessed fields exist and contain only type-conform values.

progress subject reduction

Java memory model legality constraints pair read and write ops set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-33
SLIDE 33

Type safety for fields Accessed fields exist and contain only type-conform values.

progress subject reduction

Java memory model legality constraints pair read and write ops set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α Subject reduction fails, when read op returns value of wrong type.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-34
SLIDE 34

Type safety for fields Accessed fields exist and contain only type-conform values.

progress subject reduction

Java memory model legality constraints pair read and write ops set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α Subject reduction fails, when read op returns value of wrong type. Show that reads in legal executions are type-correct.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-35
SLIDE 35

Type safety for fields Accessed fields exist and contain only type-conform values.

progress subject reduction

Java memory model legality constraints pair read and write ops set of well-formed candidate executions

  • [t1 : α1, t2 : α2, . . .],

[t′

1 : α′ 1, t′ 2 : α′ 2, . . .],

[t′′

1 : α′′ 1, t′′ 2 : α′′ 2, . . .], . . .

  • perational

semantics t : α Subject reduction fails, when read op returns value of wrong type. Show that reads in legal executions are type-correct. Subject reduction may assume type-correct reads

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

slide-36
SLIDE 36

Type safety for allocation No statement about allocation!

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 8 / 9

slide-37
SLIDE 37

Type safety for allocation No statement about allocation!

There are legal executions in which some objects are never allocated . . . r1 = x; r2 = y; b = true; if (!b) r1 = new C(); x = r2 y = r1; initially: b = false; x = y = null; allowed: x,y != null, if condition is false. . . . because the allocation happened in another execution.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 8 / 9

slide-38
SLIDE 38

Type safety for allocation No statement about allocation!

There are legal executions in which some objects are never allocated . . . r1 = x; r2 = y; b = true; if (!b) r1 = new C(); x = r2 y = r1; initially: b = false; x = y = null; allowed: x,y != null, if condition is false. . . . because the allocation happened in another execution.

Variations on this program allow you to forge (type-correct) references.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 8 / 9

slide-39
SLIDE 39

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9

slide-40
SLIDE 40

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references Semantics for all Java program achieved. Main reason for technical complexity

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9

slide-41
SLIDE 41

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references Semantics for all Java program achieved. Main reason for technical complexity Security architecture (sandboxing) compromised by forged references

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9

slide-42
SLIDE 42

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references Semantics for all Java program achieved. Main reason for technical complexity Security architecture (sandboxing) compromised by forged references DRF guarantee Interleaving semantics for programs without data races proved.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9

slide-43
SLIDE 43

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references Semantics for all Java program achieved. Main reason for technical complexity Security architecture (sandboxing) compromised by forged references DRF guarantee Interleaving semantics for programs without data races proved. Compiler optimisations [ˇ

Sevˇ c´ ık et al.]

JMM fails to allow common optimisations.

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9

slide-44
SLIDE 44

Beyond type safety [TOPLAS 2014]

Goals of the Java memory model:

λ → ∀

=

Isabelle

β α

H O L

Type safety holds despite forging of references Semantics for all Java program achieved. Main reason for technical complexity Security architecture (sandboxing) compromised by forged references DRF guarantee Interleaving semantics for programs without data races proved. Compiler optimisations [ˇ

Sevˇ c´ ık et al.]

JMM fails to allow common optimisations.

Work on another JMM revision has started (JEP 188).

Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 9 / 9