The need for a formal model of Java Safety guarantees of Java - PowerPoint PPT Presentation

Making the Java Memory Model Safe ∗ Andreas Lochbihler Institute for Information Security ETH Zurich ∗ supported by DFG Sn11/10-1,2

The need for a formal model of Java Safety guarantees of Java ◮ definedness ◮ type safety ◮ security architecture (sandbox) Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

The need for a formal model of Java Safety guarantees of Java ◮ definedness ◮ type safety ◮ security architecture (sandbox) rely on KeY-System Krakatoa / Why3 Java Path Finder Joana Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

The need for a formal model of Java Concurrency in Java Safety guarantees of Java ◮ threads ◮ definedness ◮ synchronisation primitives ◮ type safety ◮ memory model ◮ security architecture (sandbox) rely on KeY-System Krakatoa / Why3 Java Path Finder Joana Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

The need for a formal model of Java Concurrency in Java Safety guarantees of Java ◮ threads ◮ definedness ◮ synchronisation primitives ◮ type safety ◮ memory model ◮ security architecture (sandbox) rely on Implications? KeY-System Krakatoa / Why3 Java Path Finder Joana Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 2 / 9

Why do we need a memory model? initially: x = y = 0; y = 2; x = 1; j = y; i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 y = 2; i == 0 x = 1; j = y; i == 1 i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 y = 2; i == 0 x = 1; √ j = y; i == 1 i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 √ y = 2; i == 0 x = 1; √ j = y; i == 1 i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 √ y = 2; i == 0 x = 1; √ √ j = y; i == 1 i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 √ y = 2; i == 0 X x = 1; √ √ j = y; i == 1 i = x; Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? interleaving semantics initially: x = y = 0; j == 0 j == 2 √ y = 2; i == 0 X x = 1; √ √ j = y; i == 1 i = x; compiler and hardware reorder statements j == 0 j == 2 √ j = y; i = x; i == 0 y = 2; x = 1; i == 1 Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? Java memory model initially: x = y = 0; j == 0 j == 2 √ √ y = 2; i == 0 x = 1; √ √ j = y; i == 1 i = x; compiler and hardware reorder statements j == 0 j == 2 √ j = y; i = x; i == 0 y = 2; x = 1; i == 1 Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Why do we need a memory model? Java memory model data races initially: x = y = 0; j == 0 j == 2 √ √ y = 2; i == 0 x = 1; √ √ j = y; i == 1 i = x; compiler and hardware reorder statements j == 0 j == 2 √ j = y; i = x; i == 0 y = 2; x = 1; i == 1 Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 4 / 9

Semantics in layers Java memory model set of well-formed candidate executions operational semantics shared memory Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers Java memory model set of well-formed candidate executions operational semantics shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers Java memory model set of well-formed candidate executions operational t : α semantics shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers Java memory model set of well-formed candidate executions thread communication operational t : α semantics shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers Java memory model set of well-formed candidate executions transition system thread communication 1 α . : . . t 1 operational t : α ′ t : 1 . α ′ . semantics . 1 . . . shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers Java memory model � [ t 1 : α 1 , t 2 : α 2 , . . . ] , set of well-formed [ t ′ 1 : α ′ 1 , t ′ 2 : α ′ 2 , . . . ] , candidate executions [ t ′′ 1 : α ′′ 1 , t ′′ 2 : α ′′ � 2 , . . . ] , . . . paths in the transition system thread communication 1 α . : . . t 1 operational t : α ′ t : 1 . α ′ . semantics . 1 . . . shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers legality constraints Java memory model pair read and write ops � [ t 1 : α 1 , t 2 : α 2 , . . . ] , set of well-formed [ t ′ 1 : α ′ 1 , t ′ 2 : α ′ 2 , . . . ] , legal candidate executions [ t ′′ 1 : α ′′ 1 , t ′′ 2 : α ′′ � 2 , . . . ] , . . . paths in the transition system thread communication 1 α . : . . t 1 operational t : α ′ t : 1 . α ′ . semantics . 1 . . . shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Semantics in layers need set of legality constraints Java memory model candidate executions pair read and write ops cf. [Batty et al.’15] � [ t 1 : α 1 , t 2 : α 2 , . . . ] , set of well-formed [ t ′ 1 : α ′ 1 , t ′ 2 : α ′ 2 , . . . ] , legal candidate executions [ t ′′ 1 : α ′′ 1 , t ′′ 2 : α ′′ � 2 , . . . ] , . . . paths in the transition system thread communication 1 α . : . . t 1 operational t : α ′ t : 1 . α ′ . semantics . 1 . . . shared allocation & memory type information Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 5 / 9

Type safety for method calls Dynamic method lookup finds a unique method. class A { void m() {} } initially: x = y = null; r2 = y; r1 = x; if (r1 != null) r1.m(); x = r2; y = new A(); Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

Type safety for method calls Dynamic method lookup finds a unique method. JMM allows reordering with allocations. class A { void m() {} } initially: x = y = null; r2 = y; r1 = x; reorder if (r1 != null) r1.m(); x = r2; y = new A(); Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

Type safety for method calls Dynamic method lookup finds a unique method. JMM allows reordering with allocations. class A { void m() {} } initially: x = y = null; r2 = y; r1 = x; reorder if (r1 != null) r1.m(); x = r2; y = new A(); Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

Type safety for method calls Dynamic method lookup finds a unique method. JMM allows reordering with allocations. class A { void m() {} } initially: x = y = null; r2 = y; r1 = x; reorder if (r1 != null) r1.m(); x = r2; y = new A(); object accessed before allocated Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

Type safety for method calls Dynamic method lookup finds a unique method. JMM allows reordering with allocations. class A { void m() {} } initially: x = y = null; r2 = y; r1 = x; reorder if (r1 != null) r1.m(); x = r2; y = new A(); object accessed before allocated Separate type information of addresses from their allocation! Index addresses by dynamic type! Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 6 / 9

Type safety for fields Accessed fields exist and contain only type-conform values. Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

Type safety for fields progress Accessed fields exist and contain only type-conform values. Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

Type safety for fields progress Accessed fields exist and contain only type-conform values. Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9

Type safety for fields progress subject reduction Accessed fields exist and contain only type-conform values. Andreas Lochbihler (ETH Z¨ urich) Making the Java Memory Model Safe 7 / 9