Certificate Translation in Abstract Interpretation Gilles Barthe and - PowerPoint PPT Presentation

Certificate Translation in Abstract Interpretation Gilles Barthe and C´ esar Kunz Inria April 2, 2008 Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 1 / 25

Motivation: source code verification Traditional PCC Source Program Compiler Compiled Execution Program VCGen VCGen Verification Verification Conditions Conditions Proof Prover Certificate OK Checker Producer Consumer Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 2 / 25

Motivation: source code verification Source Code Verification Source Program Compiler Compiled Execution Program VCGen VCGen Verification Verification Conditions Conditions Proof Prover Certificate OK Checker Producer Consumer Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 2 / 25

Motivation: source code verification Certificate Translation Source Program Compiler Compiled Execution Program VCGen VCGen Verification Certificate Verification Translator Conditions Conditions Proof Prover Certificate Certificate OK Checker Producer Consumer Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 2 / 25

Certificate translation vs certifying compilation Source Compiler Compiled Execution Source Compiler Compiled Execution Program Program Program Program VCGen VCGen VCGen VCGen Verification Verification Verification Certificate Verification Translator Conditions Conditions Conditions Conditions Proof Proof Prover Certificate OK Prover Certificate Certificate OK Checker Checker Conventional PCC Certificate Translation Automatically in- Specification Interactive ferred invariants Automatic certifying Interactive source Verification compiler verification Complex func- Safety Properties tional properties Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 3 / 25

An Abstract Model for Certificate Translation particular language    particular VCgen hard to generate a single unify-  ing framework particular program    optimizations Model: Abstract interpretation of low step trace semantics 1 we show: � interactive verification instances of the same abstract model. automatic program analysis 2 study their interaction in certificate translation Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 4 / 25

Program Representation c := 1 x ′ := x y ′ := y while ( y ′ � = 1 ) do if ( y ′ mod 2 = 1 ) then c := c × x ′ fi done x ′ = x ′ × c Program: directed graph Nodes denoting execution points ( N ). Edges denoting possible transitions between nodes ( E ). Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 5 / 25

Abstract Interpretation Program semantics { η 1 , η ′ 1 , η ′′ 1 } l 1 { η 2 , η ′ 2 } l 2 { η 3 } { η ′ 5 } l 3 l 5 . . . . . . { η f , η ′ f } f , η ′′ l f Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 6 / 25

Abstract Interpretation Program semantics Abstract representation a 1 l 1 { η 1 , η ′ 1 , η ′′ 1 } l 1 a 2 l 2 { η 2 , η ′ 2 } l 2 a 3 l 3 l 5 a 5 { η 3 } { η ′ 5 } l 3 l 5 . . . . . . . . . . . . a f l f { η f , η ′ f } f , η ′′ l f Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 6 / 25

Solution of an Abstract Interpretation D = � D, ⊑ , ⊓ , . . . � , T � l i ,l j � : D → D a transfer function (for any edge � l i , l j � ) a 1 l 1 { a 1 , a 2 , . . . , a f } a solution of ( D , T ) if: a 2 l 2 T � l 1 ,l 2 � ( a 1 ) ⊑ a 2 a 3 l 3 l 5 a 5 T � l 2 ,l 5 � ( a 2 ) ⊑ a 5 T � l 1 ,l f � ( a 1 ) ⊑ a f . . . . . . . . . a f l f Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 7 / 25

Example of decidable solution (e.g. constant propagation) ( D, T ) : constant analysis ⊥ i:=0 ( i, 0) x:=b+i ( x, b ) i � = n ( x, b ) j:=x.i i=c+i ( x, b ) i = 0 ⊥ Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 8 / 25

Example of non-decidable solution (e.g. program verification) ( D, T ) : weakest precondition calculus { j = 0 } i:=0 { j = ( b + i ) ∗ i ∧ b ≤ ( b + i ) ∧ 0 ≤ i } x:=b+i { Inv : j = x ∗ i ∧ b ≤ x ∧ 0 ≤ i } i � = n { x ∗ i = x ∗ i ∧ b ≤ x ∧ 0 ≤ i } j:=x.i i=c+i { j = x ∗ i ∧ b ≤ x ∧ 0 ≤ i } i = 0 { n ∗ b ≤ j } Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 9 / 25

Galois connections captures notion of imprecision In the following (intuition): ( D, T ) : weakest precondition based verification framework ( D ♯ , T ♯ ) : static analysis that justifies a program optimization. Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 10 / 25

Consistency of T ♯ w.r.t. T T ( γ ( a )) ⊑ γ ( T ♯ ( a )) Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 11 / 25

Consistency of T ♯ w.r.t. T T ( γ ( a )) ⊑ γ ( T ♯ ( a )) Smaller elements: more information Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 11 / 25

Consistency of T ♯ w.r.t. T γ ( a 1 ) a 1 l 1 l 1 γ ( a 2 ) a 2 l 2 l 2 γ ( a 3 ) γ ( a 5 ) a 3 l 3 l 5 a 5 l 3 l 5 . . . . . . . . . . . . a f l f γ ( a f ) l f Result: { a 1 , a 2 . . . a n } a solution of ( D ♯ , T ♯ ) , then { γ ( a 1 ) , γ ( a 2 ) . . . γ ( a n ) } is a solution of ( D, T ) . Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 12 / 25

A Primer on Certificate Translation x:=4 y:=x x = y ? x � = y ? Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 13 / 25

A Primer on Certificate Translation D :logic formulae true x:=4 x ≥ 0 y:=x x = y ? x � = y ? true false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 13 / 25

A Primer on Certificate Translation D ♯ :const. analysis D :logic formulae ⊤ true x:=4 ( x, 4) x ≥ 0 y:=x ( x, 4) , ( y, 4) x = y ? x � = y ? . . . true . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 13 / 25

A Primer on Certificate Translation D ♯ :const. analysis D :logic formulae ⊤ true ⊤ true x:=4 x:=4 ( x, 4) x ≥ 0 ( x, 4) x ≥ 0 y:=4 y:=x ( x, 4) , ( y, 4) ( x, 4) , ( y, 4) x = y ? x = y ? x � = y ? . . . true x � = y ? . . . true . . . false . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 13 / 25

A Primer on Certificate Translation D ♯ :const. analysis D :logic formulae ⊤ true ⊤ true x:=4 x:=4 ( x, 4) x ≥ 0 ( x, 4) x ≥ 0 y:=4 y:=x ( x, 4) , ( y, 4) ( x, 4) , ( y, 4) x = y ? x = y ? x � = y ? . . . true x � = y ? . . . true . . . false . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 13 / 25

A Primer on Certificate Translation Key Idea sufficiently strong solution ↔ preservation along transformations ⊤ true x:=4 ( x, 4) x ≥ 0 { a 1 . . . a n } solution of ( D ♯ , T ♯ ) y:=x ( x, 4) , ( y, 4) x = y ? x � = y ? . . . true . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 14 / 25

A Primer on Certificate Translation Key Idea sufficiently strong solution ↔ preservation along transformations γ ( ⊤ ) true x:=4 γ (( x, 4)) x ≥ 0 { a 1 . . . a n } solution of ( D ♯ , T ♯ ) y:=x { γ ( a 1 ) . . . γ ( a n ) } solution of ( D, T ) γ (( x, 4) , ( y, 4)) x = y ? x � = y ? . . . true . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 14 / 25

A Primer on Certificate Translation Key Idea sufficiently strong solution ↔ preservation along transformations true true x:=4 x ≥ 0 x = 4 { a 1 . . . a n } solution of ( D ♯ , T ♯ ) y:=x { γ ( a 1 ) . . . γ ( a n ) } solution of ( D, T ) x = 4 ∧ y = 4 x = y ? x � = y ? . . . true . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 14 / 25

A Primer on Certificate Translation Key Idea sufficiently strong solution ↔ preservation along transformations true true x:=4 x ≥ 0 x = 4 { a 1 . . . a n } solution of ( D ♯ , T ♯ ) y:=x { γ ( a 1 ) . . . γ ( a n ) } solution of ( D, T ) x = 4 ∧ y = 4 { a 1 . . . a n } solution of ( D, T ) x = y ? { b 1 . . . b n } solution of ( D, T ) { a 1 ⊓ b 1 . . . a n ⊓ b n } solution of ( D, T ) x � = y ? . . . true . . . false Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 14 / 25

Certified Setting ( a i ) i ∈N a solution of ( D, T ) Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 15 / 25

Certified Setting ( a i ) i ∈N a solution of ( D, T ) ⊑ is undecidable, e.g. D = logic formulae Gilles Barthe and C´ esar Kunz (Inria) Certificate Translation in A. I. April 2, 2008 15 / 25