Structuring the verification of heap-manipulating programs

Transcription

1 Structuring the verification of heap-manipulating programs Aleksandar Nanevski (IMDEA Madrid) Viktor Vafeiadis (MSR / Univ. of Cambridge) Josh Berdine (MSR Cambridge)

2 Hoare/Separation Logic Hoare logic precondition { p } C { q } program postcondition In separation logic, p, q : Heap Prop where heap is finite map from Loc to Val

3 Separation logic rules syntax directed rules {emp} move x v {x = v emp} {x } store x v {x v} {x v} load y x {x v y = v} {emp} alloc y v {y v} {x } dealloc x {emp} {p} e 1 {q} {q} e 2 {r} [seq] {p} e 1 ; e 2 {r} structural rules p p {p} e {q} {p r} e {q r} [frame] {p } e {q } q q {p} e {q} [consequence] {p} e {q 1 } {p} e {q 2 } {p} e {q 1 q 2 } [ ] {p} e {q} x FV(e, p) {p} e { x. q} [ ] {p 1 } e {q} {p 2 } e {q} {p 1 p 2 } e {q} [ ] {p x} e {q} x FV(e, q) { x. p} e {q} [ ]

4 Dependent types expression Dependent types: e : τ type Σ-types: even { x : int. k. x = 2 * k} Π-types: twice : Πx : int. 2 * x - add : Πx : int. Πy : int. { z : int. z = x + y } - enable abstraction & proof reuse

5 Hoare Type Theory Hoare types expression... a monad e : STsep τ (p, q) precondition return type postcondition pre post initial p : Heap Prop q : τ Heap Heap Prop res initial final

6 Deep & shallow embedding deep embedding: syntax of inner logic as an object of the outer logic shallow embedding: inner logic shorthand for its semantics Usually HTT Programs deep shallow Assertions shallow* shallow * Deep embedding for completess results

7 Return (~ move) takes v as an argument return : Πv:A. STsep A (emp, fun y i m. y = v emp m) : Πx: v:a. pre: initial heap is empty post: return value = v post: final heap is empty

8 Store := : Πx:loc v:a. STsep unit (x, fun y i m. (x v) m y = ( )) : Πx:. A (x, y i m. v. (x v) i pre: initial heap is [(x,_)] post: final heap is [(x,v)] post: return value = ()

9 pre: initial heap is [(x,_)] Load for whatever value v such that the initial heap is [(x, v)]! : Πx:loc. STsep A (x, fun y i m. v. (x v) i (x v) m y = v) : Πv:A. (, y i m. (y v) m) post: final heap is [(x, v)] post: return value = v

10 Alloc & dealloc pre: initial heap is empty pre: initial heap is [(x,_)] post: final heap is [(return_value, v)] alloc : Πv:A. STsep loc (emp, fun y i m. (y v) m) dealloc : Πx:loc. STsep unit (x, fun y i m. emp m y = ( )) post: final heap is empty (x deallocated) post: return value = ()

11 Bind (~ seq. composition) NB: e2 spec may depend on e1 return value bind : Πe 1 :STsep A 1 s 1. Πe 2 :(Πx:A 1. STsep A 2 (s 2 x)). STsep A 2 (bind s s 1 s 2 ), where bind s s 1 s 2 is proof obligation: post s1 implies pre s2 (fun i. pre s 1 i x h. post s 1 x i h pre (s 2 x) h, fun y i m. x h. post s 1 x i h post (s 2 x) y h m). exists intermediate value x and interm. heap h...

12 Consequence do : STsep A s 1 ( i. pre s 2 i verify i s 1 (fun y m. post s 2 y i m)) STsep A s 2 where verify i s q = pre s i y m. post s y i m q y m. Example: dependent if-then-else: If : Πb:bool. STsep A s 1 STsep A s 2 STsep A (if b then s 1 else s 2 ) = fun b e 1 e 2. if b then (do e 1 ) else (do e 2 )

13 Other structural rules are just lemmas about verify... conj : verify i s q 1 verify i s q 2 verify i s (fun y h. q 1 y h q 2 y h) all : ( x:b. verify i s (q x)) B verify i s (fun y m. x:b. q x y m) disj : (p 1 i verify i s q) (p 2 i verify i s q) p 1 i p 2 i verify i s q exist : ( x. p x verify i s q) ( x. p x) verify i s q frame : verify i s (fun y m. def (m h) q y (m h)) def (i h) verify (i h) s q. many more structural rules / lemmas

14 type constructor Arrays (indexed by any finite type) Module Array array : fintype Type Type type of indexes type of contents predicate describing shape : array I T (I T ) Prop array contents logical contents of array read : Πa:array I T. Πk:I. STsep T (fun i. f. shape a f i, fun y i m. f. shape a f i y = f k i = m)

15 Arrays (continued) take a, k, x as arguments write : Πa:array I T. Πk:I. Πx:T. STsep unit (fun i. f. shape a f i, fun y i m. f. shape a f i shape a f[k x] m) for whatever initial contents f of the array pre: initial heap contains the array its final contents are f [k v]

16 How not to represent heaps (1) combine : Heap Heap Heap Prop Cannnot rewrite => proofs too long

17 How not to represent heaps (2) shows up when one considers heap union. 8 < h 2 x if h 1 x = None h 1 h 2 = fun x. Some v if h 1 x = Some v and h 2 x = None : None if h 1 x = Some v and h 2 x = Some w commute : h 1 h 2 = h 2 h 1 assoc : disjoint h 1 h 2 disjoint h 2 h 3 disjoint h 3 h 1 h 1 (h 2 h 3 ) = (h 1 h 2 ) h 3 Annoying sidecondition

18 Possibly defined heaps heap = Undef Def of {l : list (loc dynamic), : sorted l} empty = Def (nil, sorted nil) [x v] = if x == null then Undef else Def ((x, v)::nil, sorted cons x v) h 1 h 2 = if (h 1, h 2 ) is (Def (l 1, ), Def (l 2, )) then if disj l 1 l 2 then Def (sort (l 1 ++ l 2 ), sorted cat l 1 l 2 ) else Undef else Undef def h = if h is Undef then false else true

19 Lemmas unc : h 1 h 2 = h 2 h 1 unca : h 1 (h 2 h 3 ) = h 2 (h 1 h 3 ) unac : (h 1 h 2 ) h 3 = (h 1 h 3 ) h 2 una : (h 1 h 2 ) h 3 = h 1 (h 2 h 3 ) un0h : empty h = h unh0 : h empty = h Coq equalities, can rewrite No sideconditions!

20 Case study Verified the fast congruence closure algorithm (Nieuwenhuis & Oliveras, 2007) state-of-the-art algorithm used in Barcelogic SMT solver uses several imperative data structures: arrays, hash tables, (imperative) linked lists

21 Congruence exp = const of symb app of exp exp. R is a congruence iff monotone: R(a, b) R(c, d) R(a.c, b.d) reflexive : R(a, a) transitive : R(a, b) R(b, c) R(a, c)

22 Congruence closure Two operations: merge add an equality to R check check whether an equality is in the congruence closure Accept only equations of the form: a=b and a = b.c, where a,b,c symbols. break complex terms to many equations.

23 Data structures array of representatives array of class lists (symbols in same equiv. class) data = {rep : symb symb; class : symb list symb; use : symb list (symb symb symb); lookup : symb symb option (symb symb symb); pending : list (symb symb))} use lists (eqs using symb) lookup table (rep. for compound terms) pending equations

24 The source code where merge merge (eq : Eq) : STsep unit (fun i. R. shape p R i, fun y i m. R. shape p R i shape p (closure (R rel of eq)) m) = match eq with simp a b do (q!p; x insert q (a, b); p := x; hpropagate) comp c c 1 c 2 do (c 1 Array.read r c 1; c 2 Array.read r c 2; v Hashtab.lookup htab (c 1, c 2 ); match v with None Hashtab.insert htab (c 1, c 2 ) (c, c 1, c 2 ); u 1 Array.read ulist c 1 ; x insert u 1 (c, c 1, c 2 ); Array.write ulist c 1 x; u 2 Array.read ulist c 2 ; x insert u 2 (c, c 1, c 2 ); Array.write ulist c 2 x Some (b, b 1, b 2 ) q!p; x insert q (c, b); p := x; hpropagate end) end check check (t 1 t 2 : exp) : STsep bool (fun i. R. shape p R i, fun y i m. R. shape p R i shape p R m y = true R (t 1, t 2 )) = do (u 1 hnorm t 1 ; u 2 hnorm t 2 ; return (u 1 == u 2 )) rel of (eq : Eq) : exp exp Prop := match eq with simp a b fun t. t.1 = const a t.2 = const b comp c c 1 c 2 fun t. t.1 = const c t.2 = app (const c 1 ) (const c 2 ) end norm hnorm (t : exp) = fix (fun hnorm (t:exp). do (match t with const a a Array.read r a; return (const a ) app t 1 t 2 u 1 hnorm t 1 ; u 2 hnorm t 2 ; match u 1, u 2 with const w 1, const w 2 v Hashtab.lookup htab (w 1, w 2 ); match v with None return (app u 1 u 2 ) Some (b,, ) b Array.read r b; return (const b ) end, return (app u 1 u 2 ) end end)) t propagate hpropagate = fix (fun loop (x:unit). do (q!p; if q == null then return ( ) else eq!q; next!(q + 1); p := next; dealloc q; dealloc (q + 1); a Array.read r (eq.1); b Array.read r (eq.2); if a == b then loop ( ) else hjoin class a b ; hjoin use a b ; loop ( ))) ( ) hjoin class (a b : symb) = fix (fun loop (x : unit). do (ua Array.read clist a ; ub Array.read clist b ; if ua == null then return( ) else s!ua; next!(ua + 1); ua + 1 := ub; Array.write clist b ua; Array.write clist a next; Array.write r s b ; loop ( ))) ( ) join_class join_use hjoin use (a b : symb) = fix (fun loop (x:unit). do (ua Array.read ulist a ; if ua == null then return ( ) else eqc!ua; next!(ua + 1); Array.write ulist a next; c 2 Array.read r eqc.2 c 3 Array.read r eqc.3 v Hashtab.lookup htab (c 2, c 3 ); match v with None Hashtab.insert htab (c 2, c 3 ) eqc; ub Array.read ulist b ; ua + 1 := ub; Array.write ulist b ua; loop ( ) Some eqd dealloc ua; dealloc (ua + 1); p!p; q insert p (eqc.1, eqd.1); p := q; loop ( ) end)) ( ))

25 Proof strategy 120 lines Easy 80 lines Easy 280 lines OK 630 lines Difficult 650 lines Imperative source code Define functional versions of the helper functions (norm, propagate, join_class, join_use) Specify & verify the imperative helper functions in terms of the respective functional ones. Formalize congruence closure & prove basic lemmas Verify the functional helper functions

26 Proof strategy 120 lines Easy 80 lines Easy 280 lines OK 630 lines Difficult 650 lines Imperative source code Define functional versions of the helper functions (norm, propagate, join_class, join_use) Specify & verify the imperative helper functions in terms of the respective functional ones. Formalize congruence closure & prove basic lemmas Verify the functional helper functions Actually, this part was very difficult: one loop invariant is 120 lines long (spent several weeks to find it!)

27 More about the proof Use SSReflect extensions to Coq Gives much better language for writing proofs Explicit proofs (almost) no tactics! A lot of rewriting (equational reasoning) Decidable types wherever possible (e.g. disjoint composition of heaps)

28 Conclusion Hoare types Case study: fast congruence closure