Compositional and Mechanically Verified Program Analyzers David - PowerPoint PPT Presentation

Compositional and Mechanically Verified Program Analyzers David Darais University of Maryland

Let's Design an Analysis 2

Let's Design an Analysis Property x/0 2

Let's Design an Analysis Property Program x/0 0: int x y; 1: void safe_fun(int N) { 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} 3

Let's Design an Analysis Property Program 0: int x y; 1: void safe_fun(int N) { Value Abstraction x/0 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} ℤ ⊑ {-,0,+} 4

Let's Design an Analysis Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { Implement x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} analyze : exp → results analyze(x := æ) := .. x .. æ .. analyze( IF( æ ){ e ₁ }{ e ₂ } ) := .. æ .. e ₁ .. e ₂ .. 5

Let's Design an Analysis Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { Results x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} N ∈ {-,0,+} x ∈ {0,+} Implement y ∈ {-,0,+} 
 analyze : exp → results analyze(x := æ) := UNSAFE : {100/N} 
 .. x .. æ .. UNSAFE : {100/x} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := .. æ .. e ₁ .. e ₂ .. 6

Let's Design an Analysis Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { Prove Correct x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ Implement Results analyze : exp → results N ∈ {-,0,+} analyze(x := æ) := x ∈ {0,+} .. x .. æ .. y ∈ {-,0,+} 
 analyze( IF( æ ){ e ₁ }{ e ₂ } ) := .. æ .. e ₁ .. e ₂ .. UNSAFE : {100/N} 
 UNSAFE : {100/x} 7

Let's Design an Analysis Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} Implement Results Prove Correct analyze : exp → results N ∈ {-,0,+} analyze(x := æ) := x ∈ {0,+} ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. y ∈ {-,0,+} 
 analyze( IF( æ ){ e ₁ }{ e ₂ } ) := .. æ .. e ₁ .. e ₂ .. UNSAFE : {100/N} 
 UNSAFE : {100/x} 8

Let's Design an Analysis 0: int x y; N ∈ {-,0,+} 1: void safe_fun(int N) { x ∈ {0,+} 2: if (N ≠ 0) {x := 0;} y ∈ {-,0,+} 
 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} UNSAFE : {100/N} 
 5: else {y := 100/x;}} UNSAFE : {100/x} Flow-insensitive results : var ↦ ℘ ({-,0,+}) 9

Let's Design an Analysis 4: x ∈ {0,+} 0: int x y; 4.T: N ∈ {-,+} 1: void safe_fun(int N) { 5.F: x ∈ {0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} N,y ∈ {-,0,+} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} UNSAFE : {100/x} Flow-sensitive results : loc ↦ (var ↦ ℘ ({-,0,+})) 10

Let's Design an Analysis 4: N ∈ {-,+},x ∈ {0} 0: int x y; 4: N ∈ {0},x ∈ {+} 1: void safe_fun(int N) { 2: if (N ≠ 0) {x := 0;} N ∈ {-,+},y ∈ {-,0,+} 3: else {x := 1;} N ∈ {0},y ∈ {0,+} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} SAFE Path-sensitive results : loc ↦ ℘ (var ↦ ℘ ({-,0,+})) 11

Let's Design an Analysis Property Program Value Abstraction ✓ 0: int x y; 1: void safe_fun(int N) { x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} Implement Results Prove Correct ? ✗ ✗ 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 13

Let's Design an Analysis Property Program Value Abstraction ✓ ? x/0 safe_fun.js ℤ ⊑ {-,0,+} Implement Results Prove Correct ✗ ✗ 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 14

Contributions Orthogonal Systematic Mechanized Components Design Proofs Abstracting Constructive Galois Definitional Galois Transformers 
 Interpreters 
 Connections 
 [OOPSLA’15] [draft] [ICFP’16] 15

Contributions Orthogonal Systematic Mechanized Components Design Proofs Abstracting Constructive Galois Definitional Galois Transformers 
 Interpreters 
 Connections 
 [OOPSLA’15] [draft] [ICFP’16] 16

Orthogonal Components Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} Implement Results Prove Correct ? ✗ ✗ 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 17

Orthogonal Components Problem: Isolate path and flow sensitivity in analysis 18

Orthogonal Components Problem: Isolate path and flow sensitivity in analysis Challenge: Path and flow sensitivity are deeply integrated 18

Orthogonal Components Problem: Isolate path and flow sensitivity in analysis Challenge: Path and flow sensitivity are deeply integrated State-of-the-art: Redesign from scratch 18

Orthogonal Components Problem: Isolate path and flow sensitivity in analysis Challenge: Path and flow sensitivity are deeply integrated State-of-the-art: Redesign from scratch Our Insight: Monads capture path and flow sensitivity 18

Galois Transformers type ! (t) op x ← e ₁ ; e ₂ Monadic small-step interpreter op return(e) 19

Galois Transformers type ! (t) op x ← e ₁ ; e ₂ Monadic small-step interpreter op return(e) + Monad Transformers FlowT[ 퓈 ] 19

Galois Transformers type ! (t) op x ← e ₁ ; e ₂ Monadic small-step interpreter op return(e) + Monad Transformers FlowT[ 퓈 ] + α Galois Connections γ 19

Galois Transformers ✓ Prototype flow insensitive, flow sensitive and path sensitive CFA—no change to code or proof 20

Galois Transformers ✓ Prototype flow insensitive, flow sensitive and path sensitive CFA—no change to code or proof ✓ End-to-end correctness proofs given parameters 20

Galois Transformers ✓ Prototype flow insensitive, flow sensitive and path sensitive CFA—no change to code or proof ✓ End-to-end correctness proofs given parameters ✓ Implemented in Haskell and available on Github 20

Galois Transformers ✓ Prototype flow insensitive, flow sensitive and path sensitive CFA—no change to code or proof ✓ End-to-end correctness proofs given parameters ✓ Implemented in Haskell and available on Github ✗ Not whole story for path-sensitivity refinement 20

Galois Transformers ✓ Prototype flow insensitive, flow sensitive and path sensitive CFA—no change to code or proof ✓ End-to-end correctness proofs given parameters ✓ Implemented in Haskell and available on Github ✗ Not whole story for path-sensitivity refinement ✗ Somewhat naive fixpoint iteration strategies 20

Orthogonal Components Property Program Value Abstraction 0: int x y; 1: void safe_fun(int N) { x/0 ℤ ⊑ {-,0,+} 2: if (N ≠ 0) {x := 0;} 3: else {x := 1;} 4: if (N ≠ 0) {y := 100/N;} 5: else {y := 100/x;}} Implement Results Prove Correct ✓ ✓ ? 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 21

Contributions Orthogonal Systematic Mechanized Components Design Proofs Abstracting Constructive Galois Definitional Galois Transformers 
 Interpreters 
 Connections 
 [OOPSLA’15] [draft] [ICFP’16] 22

Contributions Orthogonal Systematic Mechanized Components Design Proofs Abstracting Constructive Galois Definitional Galois Transformers 
 Interpreters 
 Connections 
 [OOPSLA’15] [draft] [ICFP’16] 23

Systematic Design Property Program Value Abstraction x/0 ℤ ⊑ {-,0,+} Implement Results Prove Correct ✗ ✗ 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 24

Systematic Design Property Program Value Abstraction ? x/0 safe_fun.js ℤ ⊑ {-,0,+} Implement Results Prove Correct ✗ ✗ 4: N ∈ {-,+},x ∈ {0} analyze : exp → results 4: N ∈ {0},x ∈ {+} analyze(x := æ) := ⟦ e ⟧ ∈ ⟦ analyze(e) ⟧ .. x .. æ .. N ∈ {-,+},y ∈ {-,0,+} analyze( IF( æ ){ e ₁ }{ e ₂ } ) := N ∈ {0},y ∈ {0,+} .. æ .. e ₁ .. e ₂ .. SAFE 24

Systematic Design Problem: Turn interpreters into program analyzers 25