sep logic slide

Separation Logic

rainoftime

rainoftime@gmail.com

Overview

• Introduction

• Applications

• Future work

Introduction

Hoare Logic Separation Logic

SL in a nutshell

• Extension of Hoare logic with Pointer

– low-level imperative programs

– shared mutable data structures

• Pointers are everywhere

– OS kernels

– network code

– C/C++,even ML has reference

– ...

Hoare Logic

• The Language: SPL C :: skip | x := a | c0; c1 | if b then c1 else c2 | while b do c • Hoare Triple: {P} C {Q}

How to prove the claims?

• Proof rule

• What does specification mean?

Program, Prdicates, and State

premise-1, premise-2,...

conclusion

Program,State and Predicate

• Consider a program with two varible:x, y

• The state of is determined by value of x and y, e.g. { x=0, y=1 }

State is a partial function mapping var to int

• Predicate

s |= P store s satisfies assertion P

Proof Rules for SPL { P } skip { P }

{ Q[e/x] } x:=e {Q}

{P} c1 {R} {R} c2 {Q}

{P} c1;c2{Q}

{Pb} c1 {Q} {P b} c2 {Q}

{P} if b then c1 else c2 {Q}

{ib} c {i}_______

{i} while b do c {ib}

P P’, {P’} c {Q’}, Q’ Q

{p} c {q}

Another form of assignment rule

{P} x:=e {Q} = P => Q[e/x]

This is more "general" than {Q[e/x]} x:= e {Q}

We can use pre-condition strengthening Rule to prove this form.

{P} c {Q}

{P} c {R}

Post-condition weakening Rule:

Likewise, pre-condition strengthening Rule

P Q R

{P} c {Q}, Q => R

{P} c {R}

c

P => R, {R} c {Q}

{P} c {Q}

Prove via weakest pre-condition

• { xy } tmp:=x; x:=y; y:=tmp { xy }

• Rule for SEQ requires you to come up with intermediate assertions

{ xy } tmp:=x{ ? }; x:=y{ ? }; y:=tmp { xy }

• What to fill?– Use Q[e/x] suggested by the ASG theorem

– Work in reverse direction.

– "Weakest pre-condition"(wp)

Weakest Pre-condiion

• W = wp(c,Q)

{P} c {Q} = P => wp(c, Q)

• Samples: all these pre-cond are weakest { y = 10 } x := 10 { y = x } { Q } skip { Q } { Q[e/x] } x := e { Q }

• Two properties of wp– Reachability: from any s |= W, after execution of c,the new

state s' |= Q – Maximality: if after execution of c, the new state s' |= Q,

then the formal state s |= W.

wp for SPL

wp(skip, Q) = Q wp((x := e),Q) = Q[e/x] wp((c1; c2), Q) = wp(c1, (wp(c2, Q))) wp((if g then c1 else c2), Q) = g ∧ wp(c1, Q) ∨ g ∧ wp(c2, Q) ...

Same as inference rule, determined by syntax and semantic

Proof via wp

• Wp calculation is fully syntax driven– No human intelligence needed – Can be automated

• Works, as long as we can calculate "wp"-not always possible

Possible solutions: • use necessary(not sufficient) pre-cond; • synthesis several candidate pre-conds for proc;• desugar into simpler IR(easy to model and anslysis) ...

Besides:• FOL may not be expressive enough to express wp over

arbitrary domains of computation.

Beyond pre/post condition

• When specifying the order of certain actions within a program is important:– E.g CSP

• When sequences of observable states through out the execution have to satisfy certain property– E.g. Temporal Logic(ITL, CTL..)

• When the environment cannot be fully trusted:– Logic of belief

Correct,sound and compelte

• Correctness: {P}c{Q} Part, c may not terminate Toal = Part + termination

• Soundness: Every provable formula is true. |- {P}c{Q} => |= {P}c{Q}• Completness: |= {P}c{Q} => |- {P}c{Q}

Usually rely on FOL, but may not be sound and complete.

Intro to SepLogic

{ y != z } C { *y != *z }

{ *x == 3 ∧ y != z } C {*y != *z ∧ *x == 3 }

• Framing problem.

• What are the conditions on aliasing btwn x, y, z ?

Let C be: *y = 1, *z = 2, and suppose x is alias of y.

Then the above assertion is wrong.

Framing problem

• What are the conditions on C and R?– in presence of aliasing and heap

• Separation logic introduces new connective ∗

{ P } C {Q}

{ R ∧ P } C { Q ∧ R }

{ P } C {Q}

{ R ∗ P } C { Q ∗ R }

Syntax Assertion Name

false Logical false

P ∧ Q Classical conjunction

P ∨ Q Classical disjunction

P ⇒ Q Classical implication

P ∗ Q Separating conjunction

P −∗ Q Separating implication

E -> E Points to

emp Empty heap

∃x. P Existential quantifier

E = E Expression value equality

Semantics: notions

• Assertions are evaluated w.r.t. a state

• State is store and heap

– S : Var ⇀ Int

– H : Loc ⇀ Int where Loc ⊆ Int

• Notations

– disjoint domains: dom(H1) dom(H2) – composition: H = H1 ◦ H2

– evaluation: ßEàS Int– update: S[x:i]

• S,H |= P, the state satisfies spec P

Semantics

Relation Definition

S,H |= false Never satisfied

S,H |= P ∧ Q S,H |= P ∧ S,H |= Q

S,H |= P ∨ Q S,H |= P ∨ S,H |= Q

S,H |= P ⇒ Q S,H |= P ⇒ S,H |= Q

S,H |= P ∗ Q ∃H1,H2.dom(H1) dom(H2) ∧ H1 ◦ H2 = H ∧ S,H1 |= P ∧ S,H2 |= Q

S,H |= P −∗ Q ∀H′. (dom(H) dom(H’) ∧ S,H′ |= P) ⇒ S,H◦H′ |= Q

S,H |= E1 -> E2 dom(H) = {ßE1àS} ∧ H( ßE1àS )= ßE2àS

S,H |= emp H = {}

S,H |= ∃x.P i Int . S[x:i],H |= P

S,H |= E1 = E2 ßE1àS = ßE2àS

what's newS,H |= E1 -> E2S,H |= emp

S,H |= P ∗ Q the heap H can be divided in two so that P is trueof one partition and Q of the other

S,H |= P −∗ Q asserts that extending H with a disjoint part H' that satisfieds P results in a new heap satisfying Q

P * Q expressing separation nicely P -* Q structural assume/guarantee

Note: in program analysis/verification, usually use proof system without -*.

• E -> E1,E2,..,En E -> E1 ∗ E+1 -> E2 ∗ ... ∗ E+(n-1) -> En

• E -> _ ∃x. E -> x

Shorthands

10 11

43

12

7 x ->3,4,7 S = [x:10]H = [10:3,11:4,12:7]

|=

x

Examples

x -> 4,3

x -> 4,3 * true

x -> 4,3 ∗ y -> 4,3

x -> 4,3 ∧ y -> 4,3

34

x

34

y

34

xy

Inductive Definitions• Describe invariants of recursive data-structure

– Trees– List Segments– Doubly-linked list segments– Cyclic lists– List of cyclic doubly linked lists– ...

• Reasoning about mutable objects

Additional Rules for SepLogic

• Frame Rule

• Pointer Assign

{e -> x} [e] := f {e -> f}

• Dispose

{e -> x} dispose e {emp}

• Alloc

{e = v'∧emp} e := new(v) {e -> v}

• deref(fetch)

{e = v'∧f -> v} e := [f] {e = v∧f -> v}

Note: in order distinguish with *, we do not use C-style "*" or "@"..

The Frame Rule

• Side condition: no variable modified by c appears free in R

• Enalbes local reasoning: programs that

execute correctly in a small state (|= P) also

execute correctly in a bigger state (|= R * P)

{ P } c {Q}

{ R ∗ P } c { Q ∗ R }c

P

Q

R

R

On the complexity of SL

• Full SL with FO quantification is undecidable– even without * and -* [calcagno et al, FSTTCS 01]

– even with a unique selector[Brochenin et al, CSL 08]

• Model-checking, satisfiability and validity for SL are PSPACE-complete

– PSPACE-hardness from[CYOH, FSTTCS 01]

– Upper bound without arithmetics can be also obtained by translation into a “separation-free” version [Lozes, PhD 04]

Applications

Program Analysis Verified SoftwareAxiomatic Semantic ...

Program Analysis

• Smallfoot(London)

• Space Invader(London)

• Slayer(Microsoft)

• Hip + Sleek(Singapore)

• JStar(Cambridge)

• SmallfootRG(Cambridge)

• Thor(CMU)

Case Study: Infer

• Heap-Hop(Paris, London)

• HTT + Ynot(Harvard)

• Holfoot(Cambridge)

• Verifier(Tokyo)

• ...

Infer

Name Lines Time

Infer

warning/error

InferFindbugs

junit 26463 5m9s 2m5s 16 221

Findbugs

jieba 1012 1m5s 52s 0 18

pysonar2 9311 2m38s 4m45s 12 302

Infer：Linux3.19.0-25-generic#26-UbuntuSMPLinux

CPUMhZ:2094.702Memtotal:1716644Kb

History

• Local Reasoning about Programs that Alter Data Structures, CSL 01

• Smallfoot: Modular Automatic Assertion Checking with Separation Logic, FMCO 05

• Symbolic Execution with Separation Logic, APLAS 05• Footprint analysis: A shape analysis that

discovers preconditions, SAS 07(intraproc..)• A local shape analysis based on separation logic,

CAV 08(Spaceinvader)• Compositional Shape Analysis by Means of Bi-

Abduction, POPL 09(Spaceinvader-Abductor)• Moving Fast with Software Verification(Infer)

Step I: Smallfoot v0.1

• Based on SL and symbolic execution

• A decidable proof theory for symbolic heaps

• Hard-coded inductive predicates for C-like toy language

• Implementation: about 4k lines of Ocaml

http://www.dcs.qmul.ac.uk/research/logic/theory/projects/smallfoot

Automatic Reasoning with Hoare Logic

• User provides annotations(formulae) for pre- and post- conditions of procedure and loop invariants

• Verification condition generator

• Validity checker(for weakest precondition)

Example

• Formulae or constraint: {P}c{Q}

• Verification condition: P => wp(c, Q)

• Check: s,h.s,h |= P => wp(c, Q)

How to check?

Tool• Interactive theorem prover(Coq, Isabelle..)?• Complete automatic decision procedure?• ...

Goal• Safety properties(pointer errors, memory leaks,

etc) • Full functional correctness

Theory• Use decidable fragement(Full SL is undecidable)

– Decidable Logic

Automatic

Expressive

Decidable Logics:Strand, LISBQ, CSL, etc.

Expressive Logics:Separation logics, HOL,

Matching logic, etc.

Back to the Future: revisiting...using SMT Solvers.

The Fragment of Assertion

Assertions A of symbolic heaps(pure parts and heap parts).

A ::= (P ∧ ... ∧ P) ; (S ∗ ... ∗ S)

E ::= x | nil | E ∧ E

P ::= E=E | E ES ::= E -> E1...En | tree(E) | ls(E, E) | ...

ls(E,F) <=> if E=F then emp else x. E->x * ls(x, F)

tree(E) <=> if E=nil then emp else x,y. E->x,y * tree(x) * tree(y)

Constraints Geneartion

From S1 *...* Sn to constraints of form:

(E1F1∧...∧EkFk) => P

E.g, from ls(x,y) * ls(z,w) generate:

x y => x nil z w => z nil (x y ∧ z w) => x z

Entailments Between Symbolic Heaps

Terminating proof theory for entailments A |- A'

Normalization Rules

• recognize inconsistency

• get rid of equalities via substitution

• Perform case analysis using a form of excluded middle

• ...

Step II: SpaceInvader v1.1

• Compositional shape analysis via Bi-Abduction

• Implementation: ~3.9w lines

Bi-Abductive Resource Invariant Synthesis, APLAS 09

Compositional Shape Analysis by means of BI-Abduction, POPL 09

..

http://www0.cs.ucl.ac.uk/staff/p.ohearn/Invader/Invader/Invader_Home.html

Overview

• Frame Inference: A |- B * F, allows an analyzer to use small specs

• Abduction Inference: A * M |- B, helps to synthesize small specs

• Bi-abduction: A * M |- B * F In interprocedural analysis, usually: A is an assertion at the call site, and B is a precondition from callee’s spec

Frame Inference

{list(l1) * list(l2)} Dispose(l1); Dispose(l2);

• To use the Frame Rule we must first compute R• Frame Inference: give A and B, compute X such that A |- B*X

Example: list(l1)*list(l2) |- list(l1)*list(l2)

{ P } c {Q}

{ R ∗ P } c { Q ∗ R }

Abduction Inference

lst_nd* p(lst_nd *y) { //1: suppose SH is emp lst_nd * x;

x = malloc(sizeof(lst_nd)); x -> tail = 0;

merge(x, y);

return(x);

}

void merge(lst_nd *x, lst_nd *y) {

//Given Pre: list(x) * list(y)

} //Given Post: list(x)

Abduction Inference

lst_nd* p(lst_nd *y) { lst_nd * x;

x = malloc(sizeof(lst_nd)); x -> tail = 0;

// 2.after above, we get A = x->0

merge(x, y);

return(x);

}

void merge(lst_nd *x, lst_nd *y) {

//Given Pre: list(x) * list(y)

} //Given Post: list(x)

Abduction Inference

lst_nd* p(lst_nd *y) { lst_nd * x; x = malloc(sizeof(lst_nd)); x -> tail = 0; merge(x, y); return(x); } void merge(lst_nd *x, lst_nd *y) { //Given Pre: list(x) * list(y) } //Given Post: list(x) Assertion at call site: x->0 Pre from callee’s spec: list(x) * list(y) Then we infer list(y) is missing. We should start with list(y) rather then emp!

Proof Rules for Abduction Inference

Bi-Abduction Inference

BiAbd(A, B) = M := Abduce(A, B*true); F := Frame(A*M, B); return (M, F)

Abduce() is given by abduction inference rules.

BiAbd(A, B) = (M, F) ⇒ A * M |- B * F

Compostional Shape Analysis

Construct spec table for every proc.

Suppose the procs return a single value and do not access global variables

(later to discuss missing part b and A..

Semantic of function call• H is current heap(and assertion at call site)

• Callee's spec will not change(generate new set R)

Shape analysis

Analyze level by level:

if f is in Proc_i and f calls g

then g belongs to Proc_j for some j <= i

Two abstract runs(InferPre, InferSpec)

InferPre• To infer the precondition of f in Proc_k

• T_in: computed spec(from lower level of Proc)

InferSpec

• Calculate post-cond calculation from give pre-cond, and filter unsafe pre-cond

Underlying Shape Analysis

The "missing parts"

The semantic of commands: using 3 functions

Rearr, Exec, Abs

Rearrangement: put e in the proper form for an rule to fire

Execution: symbolically executes the atomic command in the rearranged heap Abstraction

Note: more about rearr, exec, abs, refer to:A local shape analysis based on separation logic, TACAS 06

The abstract transfer function

Verified Software

• A formal-verified C static analyzer, POPL 15

• Compositional CompCert, POPL 15

• Verified Correctness and Security of OpenSSL HMAC, USENIX Security 15.

• Mostly-automated verification of low-level programs in computational separation logic, PLDI 11

• ...

Case study: the verified C static analyzer

http://compcert.inria.fr/verasco/

The Verasco Project

• Develop and verify in Coq a realistic static analyzer by abstract interpretation

• Integration with CompCert

Modular architecture

Future Extension

• Numerical abstract domains

• Better handling of control-flow(e.g. support recursion..)

• Memory absbract domains

(e.g. C union, dynamic allocation, shape analysis..)

To be continued ...

Axiomatic semantic for PL To handler diferrent programming languages features:

• Separation logic and abstraction Parkinson and Bierman. POPL’05

• Separation Logic, Abstraction, and Inheritance Parkinson, Bierman. POPL'08

• Towards a program logic for JavaScript. Gardner, Maffeis, and Smith. POPL'12• ...

SL for OO language; Coucurrent SL; Higher order Store for SL; ...

Concurrent SL(CSL) [O'hearn 04]

• Key Ideas:

Threads can only access disjoint resources at the same time.

SL for Object-Orientation

• OO languages are popular and widely used

• Reasoning about OO programs is challengin – shared mutable state

– inheritance(i.e subtyping and method overriding..

Extend the memory model

s, h, d |= P• s: Variable -> ObjectID ∪ Integer

• h: ObjectID × FieldName -> ObjectID ∪ Integer

• d: ObjectID -> ClassNames

To be continued...

Higher Order Store

Stores that may contain procedures.

An observationally complete program logic for imperative higher-order functions, LICS 05

A Simple Model of Separation Logic for Higher-order Store,ICALP 08

Nested Hoare triples and frame rules for higher-order store, CSL 09 ...

Future workRelationship between SL and higher order type system(e.g. dependent type, HoTT..?)

Relationship between SL and traditional alias analysis?

Distributed compositional shape analysis?..

....