Can Logic Tame Systems Programs? Cristiano Calcagno Imperial College Wroclaw, July 2007 Joint work with Josh Berdine, Dino Distefano, Peter O’Hearn, Matthew Parkinson,Viktor Vafeiadis, Hongseok Yang
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Can Logic Tame Systems Programs?
Cristiano CalcagnoImperial College
Wroclaw, July 2007
Joint work with Josh Berdine, Dino Distefano, Peter O’Hearn, Matthew Parkinson, Viktor Vafeiadis, Hongseok Yang
Beginning: Smallfoot
• Toy language
• Symbolic execution over SL fragment
• Annotations: pre/post and loop invariants
• Hard-coded predicates: list segments, trees (complete proof theory no induction)
• Concurrency: explicit || and ccr’s
Systems programs?
• Handling C (current project, using CIL)
• Inferring annotations: shape analysis
• Composite data structures (CAV): predicate discovery, parameterised lists
• Open code/modularity: footprint analysis
• Interprocedural analysis
• (non-blocking) concurrency
Non-Blocking Stack3 5 7 11 13
TOP
Non-Blocking Stack
push(e) { local y,n,b; y = new(); y->val = e; b=0; while(b==0) { n = TOP->tl; y->tl = n; b = CAS(TOP->tl,n,y); }}
3 5 7 11 13TOP
Non-Blocking Stack
push(e) { local y,n,b; y = new(); y->val = e; b=0; while(b==0) { n = TOP->tl; y->tl = n; b = CAS(TOP->tl,n,y); }}
pop() { local y,z,b; b=0; while(b==0) { atomic when (TOP->tl != 0) { y = TOP->tl; z = y->tl; } b = CAS(TOP->tl,y,z); } ret = y->val; dispose y;}
3 5 7 11 13TOP
Non-Blocking Stack
3 5
7 11 13
TOP
Non-Blocking Stack
3 5
7 11 13
TOP
y = TOP->tl; z = y->tl;
Non-Blocking Stack
3 5
7 11 13
TOP
y z
y = TOP->tl; z = y->tl;
Non-Blocking Stack
3 5
7 11 13
TOP
y z
Non-Blocking Stack
3 5
7 11 13
TOP
y z
pop();
Non-Blocking Stack
5
7 11 13
TOP
y z
pop();
Non-Blocking Stack
5
7 11 13
TOP
y z
Non-Blocking Stack
5
7 11 13
TOP
y z
pop();
Non-Blocking Stack
7 11 13
TOP
y z
pop();
Non-Blocking Stack
7 11 13
TOP
y z
Non-Blocking Stack
7 11 13
TOP
y z
push(15);
Non-Blocking Stack
15
7 11 13
TOP
y z
push(15);
Non-Blocking Stack
15
7 11 13
TOP
y z
Non-Blocking Stack
15
7 11 13
TOP
y z
b = CAS(TOP->tl,y,z);
Non-Blocking Stack
15
7 11 13
TOP
y z
b = CAS(TOP->tl,y,z);
Non-Blocking Stack
15
7 11 13
TOP
y z
b = CAS(TOP->tl,y,z);
DANGLING!
Reasoning
Separation logic: separation
Rely-Guarantee: interference
Parkinson and Vafeiadis: SL + RG
• local and shared state
• actions
Reasoning
Separation logic: separation
Rely-Guarantee: interference
Parkinson and Vafeiadis: SL + RG
• local and shared state
• actions
Tool: SmallfootRG
Operations
Push
TOP TOP
Pop
TOP TOP
Interference
3 5
7 11 13
TOP
y z
Interference
3 5
7 11 13
TOP
y z
Interference
3 5
7 11 13
TOP
y z
TOP
y z
??
Operations (leaks)
Push
TOP TOP
Pop
TOP TOP
Interference (leaks)
7 11 13
TOP
3 5
y z
Interference (leaks)
7 11 13
TOP
3 5
y z1 of 2
Interference (leaks)
7 11 13
TOP
3 5
y z1 of 2
TOP
3
y
z
Interference (leaks)
7 11 13
TOP
3 5
y z2 of 2
Interference (leaks)
7 11 13
TOP
3 5
y z2 of 2
TOP
3
y z
Fragment
A ::= E = E | E != E | · · ·S ::= E "#E | lseg(E,E) | treeE | · · ·! ::= A1 $ · · · $An
" ::= S1 % · · · % Sn
P,Q ::= ! $ "
Shape Information Only
Symbolic Execution
Safe Preconditions (re-arrangement)
Px:=E
!!!!!!!" x = E[x!/x] # P [x!/x]
P $ E %"Fx:=[E]
!!!!!!!" x = F [x!/x] # (P $ E %"F )[x!/x]
P $ E %"F[E]:=F !
!!!!!!!" P $ E %"F !
Px:=new()!!!!!!!" P $ x%"!
P $ E %"Fdispose E!!!!!!!" P
Frame Inference
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{x!"l, r # tree(l) # emp}{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{x!"l, r # tree(l) # emp}{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{x!"l, r # tree(l) # emp}{x!"l, r # emp # emp}
{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{x!"l, r # tree(l) # emp}{x!"l, r # emp # emp}
{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{emp ! emp ! emp}
{x!"l, r # tree(l) # emp}{x!"l, r # emp # emp}
{x!"l, r # tree(l) # tree(r)}
Frame Inference
{P}C{Q}{P ! R}C{Q ! R}
Frame Rule Frame Inference
P ! P ! " F
...dispose_tree(r);dispose_tree(l);dispose x;...
{tree(x)}dispose tree(x){emp}
{emp}
{x!"l, r # tree(l) # emp}{x!"l, r # emp # emp}
{x!"l, r # tree(l) # tree(r)}
Parallel
{P1}C1{Q1}{P2}C2{Q2}
{P1 ! P2}C1"C2{Q1 ! Q2}Parallel rule
Parallel
{P1}C1{Q1}{P2}C2{Q2}
{P1 ! P2}C1"C2{Q1 ! Q2}Parallel rule
Symbolic execution
{P1}proc1(){Q1}{P2}proc2(){Q2}X ! P1 " P2 " F
Xproc1();! proc2();#############$ Q1 "Q2 " F
Parallel
{P1}C1{Q1}{P2}C2{Q2}
{P1 ! P2}C1"C2{Q1 ! Q2}Parallel rule
No interleavings
Symbolic execution
{P1}proc1(){Q1}{P2}proc2(){Q2}X ! P1 " P2 " F
Xproc1();! proc2();#############$ Q1 "Q2 " F
Atomic
X ! S " X ! P ! F
X ! PC
##$ X !
X ! " Q ! Ystab(Q ! F ) = R
X ! Satomic C as Act;
#############$ Y ! R
where Act is P ! Q
Atomic
X ! S " X ! P ! F
X ! PC
##$ X !
X ! " Q ! Ystab(Q ! F ) = R
X ! Satomic C as Act;
#############$ Y ! R
where Act is P ! Q
Must be stable
Stability Inference
Stable assertion calculation:Sn+1 = ((P !! Sn) "Q) # Sn
Stability Inference
Stable assertion calculation:
Abstract domain: [Distefano et al.]Sn+1 = !((P !! Sn) "Q) # Sn
Sn+1 = ((P !! Sn) "Q) # Sn
Stability Inference
Stable assertion calculation:
Abstract domain: [Distefano et al.]
Septraction Elimination Procedure
Sn+1 = !((P !! Sn) "Q) # Sn
Sn+1 = ((P !! Sn) "Q) # Sn
Summary
Mechanisms:
• Symbolic execution
• Frame inference
• Abstraction
• Stability
Inferring actions?
Questions?
Septraction Elimination
(E !"E!) !F #$ F %= E & (E !"E!)(P &Q) !E #$ P !E &Q !E
(P 'Q) !E #$ P !E 'Q !E
(E !"E!)#! (F !"F !) $% E=F & E!=F ! & emp(E !"E!)#! (P 'Q) $% P "E '(E !"E! #! Q)
( (E !"E! #! P ) 'Q"E
(E !"E!)#! (P (Q) $% (E !"E! #! P ) ( (E !"E! #! Q)(P 'Q)#! R $% P #! (Q#! R)(P (Q)#! R $% (P #! R) ( (Q#! R)
Related Documents
