Semantics of Assertions → ( s, h ) | = P s, h | = E �→ F h ) = { [ ] s } and h ([ iffdom( [ E ] [ E ] ] s ) = [ [ F ] ] s s, h | h ) = ∅ = emp iffdom( s, h | = P ∗ Q iff ∃ h 0 , h 1 . dom( h 0 ) ∩ dom( h 1 ) = ∅ and h 0 · h 1 = h and s, h 0 | = P and s, h 1 | = Q s, h | = P ∧ Q s, h | = P and s, h | = Q i ff where meaning of expressions [ [ E ] ] : Stacks → Vals Monday, 28 June 2010
Example x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap y 3 x �→ 3 , y ∧ y �→ 3 , x 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
Example x �→ 3 , y x y y �→ 3 , x Stack x �→ 3 , y ∗ y �→ 3 , x x Heap 3 x �→ 3 , y ∧ y �→ 3 , x 3 y y+1 x x+1 Abbreviation: E points to a record of several fields: E �→ E 1 , . . . , E n � E �→ E 1 ∗ · · · ∗ E + n − 1 �→ E n Monday, 28 June 2010
An inconsistency What’ s wrong with the following formula? 10|->3 * 10|->3 Monday, 28 June 2010
An inconsistency What’ s wrong with the following formula? 10|->3 * 10|->3 Try to be in two places at the same time 10 10 Monday, 28 June 2010
...back to the real stuff: Compositional Shape Analysis by means of Bi-Abduction Monday, 28 June 2010
Literature C. Calcagno, D. Distefano, P . O’Hearn and H. Yang. Compositional Shape Analysis by Means of Bi- Abduction. POPL 2009. D. Distefano. Attacking Large Industrial Code with Bi-Abductive Inference. FMICS 2009 Monday, 28 June 2010
A lot of real code out there uses pointer manipulation... Is this correct? Or at least: does it basic properties like it won’t crash or leak memory? We want to build tool that automatically answer such questions Monday, 28 June 2010
Space Invader analyzer: overview Shape analyses discover deep properties about the heap: e.g., a variable points to a cyclic/acyclic doubly linked list,... Space Invader is Inter-procedural shape analysis for C programs Based on Separation Logic and Abstract interpretation to infer invariants Builds proofs or reports possible memory faults or memory leaks Monday, 28 June 2010
Shape Analysis and Real Code So far shape analysis mostly applied to toy programs Monday, 28 June 2010
Shape Analysis and Real Code So far shape analysis mostly applied to toy programs analysis running months/weeks/days days/hours/min. push button get results Monday, 28 June 2010
Shape Analysis and Real Code So far shape analysis mostly applied to toy programs change code, analysis running write model, etc . months/weeks/days days/hours/min. get code push button get results Monday, 28 June 2010
Fiction: “no worries, device drivers use moslty lists” Monday, 28 June 2010
typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010
typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; around 600 loc struct definitions ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010
typedef struct ASYNC_ADDRESS_DATA { struct ASYNC_ADDRESS_DATA* Flink1; typedef struct { struct ASYNC_ADDRESS_DATA* Blink1; PDEVICE_OBJECT StackDeviceObject; _PDEVICE_EXTENSION DeviceExtension; PDEVICE_OBJECT PortDeviceObject; PVOID Buffer; PDEVICE_OBJECT PhysicalDeviceObject; around 600 loc struct definitions ULONG nLength; ULONG nAddressesReturned; UNICODE_STRING SymbolicLinkName; PADDRESS_RANGE AddressRange; KSPIN_LOCK ResetSpinLock; HANDLE hAddressRange; KSPIN_LOCK CromSpinLock; PMDL pMdl; KSPIN_LOCK AsyncSpinLock; } ASYNC_ADDRESS_DATA, *PASYNC_ADDRESS_DATA; KSPIN_LOCK IsochSpinLock; KSPIN_LOCK IsochResourceSpinLock; many big structs (around 20 fields) mutually typedef struct BUS_RESET_IRP { struct BUS_RESET_IRP *Flink2; struct BUS_RESET_IRP *Blink2; BOOLEAN bShutdown; pointing to aeach other in several way with PIRP Irp; DEVICE_POWER_STATE CurrentDevicePowerState; } BUS_RESET_IRP, *PBUS_RESET_IRP; SYSTEM_POWER_STATE CurrentSystemPowerState; several fields typedef struct CROM_DATA { ULONG GenerationCount; struct CROM_DATA *Flink3; PASYNC_ADDRESS_DATA Flink1; struct CROM_DATA *Blink3; PASYNC_ADDRESS_DATA Blink1; HANDLE hCromData; PBUS_RESET_IRP Flink2; PVOID Buffer; PBUS_RESET_IRP Blink2; PMDL pMdl; PCROM_DATA Flink3; } CROM_DATA, *PCROM_DATA; PCROM_DATA Blink3; _PISOCH_DETACH_DATA Flink4; typedef struct ISOCH_RESOURCE_DATA { _PISOCH_DETACH_DATA Blink4; struct ISOCH_RESOURCE_DATA *Flink5; PISOCH_RESOURCE_DATA Flink5; struct ISOCH_RESOURCE_DATA *Blink5; PISOCH_RESOURCE_DATA Blink5; HANDLE hResource; } DEVICE_EXTENSION, *PDEVICE_EXTENSION; } ISOCH_RESOURCE_DATA, *PISOCH_RESOURCE_DATA; Monday, 28 June 2010
AsynchAddressData_Flink DeviceExtension DeviceExtension DeviceExtension AsynchAddressData_Blink ASYNCH_ADDRESS_DATA ASYNCH_ADDRESS_DATA ASYNCH_ADDRESS_DATA pMdl pMdl pMdl MDL MDL NULL MDL MDL MDL NULL NULL BusResetIrp_Flink DEVICE_E XTENSION BUS_RESET_IRPS BUS_RESET_IRPS BUS_RESET_IRPS BUS_RESET_IRPS BusResetIrp_Blink IsochDetachData_Blink IsochDetachData_Flink DeviceExtension DeviceExtension DeviceExtension ISOCH_DETACH_DATA ISOCH_DETACH_DATA ISOCH_DETACH_DATA DeviceExtension IsochDetachData_Mdl IsochDetachData_Mdl IsochDetachData_Mdl DEVICE_OBJECT NULL MDL MDL MDL MDL MDL MDL NULL NULL devObj Monday, 28 June 2010
Fact: Real device drivers use lists in combination, resulting in more complicated data structures than those found in previous papers on shape analysis Monday, 28 June 2010
Shape Analysis and Real Code Monday, 28 June 2010
Shape Analysis and Real Code change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Monday, 28 June 2010
Shape Analysis and Real Code change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010
Shape Analysis and Real Code Need very high modularity change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010
Shape Analysis and Real Code Need very high Start with something modularity partial change code, write model, etc . analysis running months/weeks/days days/hours/min. get code push button get results Need to handle incomplete code Monday, 28 June 2010
Our response: compositional Space Invader ✓ Handles incomplete code ✓ Admits partial results ✓ Modular Monday, 28 June 2010
Our response: compositional Space Invader ✓ Handles incomplete code ✓ Admits partial results ✓ Modular ...demo! Monday, 28 June 2010
Basics Monday, 28 June 2010
Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010
Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp nil E An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010
Notation Separation Logic’s formulae to represent program states Some useful predicates: The empty heap: emp An allocated cell: E �→ F A “complete” list: list ( E ) P*Q means P and Q hold for disjoint portion of memory Monday, 28 June 2010
Small specs Small specs encourage local reasoning and help to get small proofs When proving code involving procedures we use only their footprint Monday, 28 June 2010
Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010
Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010
Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {emp*list(l2)} Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010
Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {list(l2)} Dispose(l2); Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010
Example: use of small specs in proofs {list(l1)*list(l2)} Dispose(l1); {list(l2)} Dispose(l2); {emp} Spec: {list(l)} Dispose(l) {emp} {P} C {Q} Frame Rule {P*R} C {Q*R} Monday, 28 June 2010
Novelties Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* X Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010
Frame Inference {P} C {Q} Frame Rule {list(l1)*list(l2)} {P*R} C {Q*R} Dispose(l1); {emp*list(l2)} Spec: {list(l)} Dispose(l) {emp} Dispose(l2); In analysis to use the Frame Rule we need to compute R Frame inference problem: given A and B compute X such that A ⊢ B ∗ X Example: ⊢ list(l1)*list(l2) list(l1)* list(l2) Monday, 28 June 2010
Abduction Monday, 28 June 2010
Monday, 28 June 2010
Abduction for Space Invader Monday, 28 June 2010
Abduction for Space Invader Monday, 28 June 2010
Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Monday, 28 June 2010
Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Example: Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp} list(l1) Monday, 28 June 2010
Abduction for Space Invader Abduction Inference: given A and B compute X such that A ∗ X ⊢ B Example: Spec: {list(l1)*list(l2)} Dispose_Two_Lists(l1,l2) {emp} list(l1)*X ⊢ list(l1)*list(l2) Monday, 28 June 2010
Recommend
More recommend
