Axiomatic Semantics: Verification Conditions. Review of Soundness and Completeness of Axiomatic Semantics. Announcements

Transcription

1 Axiomatic Semantics: Verification Conditions Meeting 12, CSCI 5535, Spring 2009 Announcements Homework 4 is due tonight Wed forum: papers on automated testing using symbolic execution 2 Questions? Review of Soundness and Completeness of Axiomatic Semantics 3 One-Slide Summary A system of axiomatic semantics is sound if everything we can prove is also true. if { A } c { B } then { A } c { B } We prove this by nested induction on the structure of the operational semantics derivation and the axiomatic semantics proof. A system of axiomatic semantics is complete if we can prove all true things. if { A } c { B } then { A } c { B } Our system is relatively complete (= just as complete as the underlying logic). We use weakest preconditions to reason about completeness. Verification conditions are preconditions that are easy to compute. 5 Where Do We Stand? We have a language for asserting properties of programs We know when such an assertion is true We also have a symbolic method for deriving assertions meaning A {A} c {B} soundness symbolic derivation (theorem proving) A { A} c {B} σ A {A} c {B} completeness 6 1

2 Completeness of Axiomatic Semantics If {A} c {B} can we always derive {A} c {B}? If so, axiomatic semantics is complete If not then there are valid properties of programs that we cannot verify with Hoare rules :-( Good news: for our language the Hoare triples are complete Bad news: only if the underlying logic is complete (whenever A we also have A) - this is called relative completeness 7 Proof Idea Dijkstra s idea: To verify that { A } c { B } a) Find out all predicates A such that { A } c { B } call this set Pre(c, B) (Pre = pre-conditions ) b) Verify for one A Pre(c, B) that A A Assertions can be ordered: false strong Pre(c, B) A weakest precondition: wp(c, B) true weak Thus: compute wp(c, B) and prove A wp(c, B) 8 Proof Idea Completeness of axiomatic semantics: If { A } c { B } then { A } c { B } Assuming that we can compute wp(c, B) with the following properties: wp is a precondition (according to the Hoare rules) { wp(c, B) } c { B } wp is (truly) the weakest precondition If { A } c { B } then A wp(c, B) A wp(c, B) {A} c {B} {wp(c, B)} c {B} We also need that whenever A then A! 9 Weakest Preconditions Define wp(c, B) inductively on c, following the Hoare rules: wp(c 1 ; c 2, B) = wp(c 1, wp(c 2, B)) wp(x := e, B) = [e/x]b {A} c 1 {C} {C} c 2 {B} { A } c 1 ; c 2 {B} { [e/x]b } x := E {B} {A 1 } c 1 {B} {A 2 } c 2 {B} { E A 1 Æ E A 2 } if E then c 1 else c 2 {B} wp(if E then c 1 else c 2, B) = E wp(c 1, B) Æ E wp(c 2, B) 10 Weakest Preconditions for while We start from the unwinding equivalence while b do c = if b then c; while b do c else skip Let w = while b do c and W = wp(w, B) We have that W = b wp(c, W) Æ b B But this is a recursive equation! We know how to solve these using domain theory But we need a domain for assertions 11 End of Review 2

3 A Partial-Order for Assertions Which assertion contains the least information? true does not say anything about the state What is an appropriate information ordering? A A iff A A Is this partial order complete? Take a chain A 1 A 2 Let ÆA i be the infinite conjunction of A i σ ÆA i iff for all i we have that σ A i I assert that ÆA i is the least upper bound Can ÆA i be expressed in our language of assertions? Often yes (see Winskel), we ll assume yes for now 13 Weakest Precondition for while Use the fixed-point theorem F(A) = b wp(c, A) Æ b B (Where did this come from? Three slides back!) I assert that F is both monotonic and continuous The least-fixed point (= the weakest fixed point) is wp(w, B) = ÆF i (true) 14 Weakest Preconditions Define a family of wp s wp k (while e do c, B) = weakest precondition on which the loop terminates in B if it terminates in k or fewer iterations wp 0 = E B wp 1 = E wp(c, wp 0 ) Æ E B wp(while e do c, B) = Æ k 0 wp k = lub {wp k k 0} Verification Condition Generation See notes on the web page for the proof of completeness with weakest preconditions Weakest preconditions are Impossible to compute (in general) Can we find something easier to compute yet sufficient? 15 Not Quite Weakest Preconditions Recall what we are trying to do: false Pre(s, B) strong weakest A precondition: WP(c, B) verification condition: VC(c, B) true weak We shall construct a verification condition: VC(c, B) The loops are annotated with loop invariants! VC is guaranteed stronger than WP But hopefully still weaker than A: A VC(c, B) WP(c, B) CS Groundwork Factor out the hard work Loop invariants Function specifications (pre- and post-conditions) Assume programs are annotated with such specs Good software engineering practice anyway Requiring annotations = Kiss of Death? New form of while that includes a loop invariant: while Inv b do c Invariant formula Inv must hold every time before b is evaluated A process for computing VC(annotated_command, post_condition) is called VCGen CS

4 Verification Condition Generation Mostly follows the definition of the wp function: VC(skip, B) = B VC(c 1 ; c 2, B) = VC(c 1, VC(c 2, B)) VC(if b then c 1 else c 2, B) = b VC(c 1, B) Æ b VC(c 2, B) VC(x := e, B) = [e/x] B VC(let x = e in c, B) = [e/x] VC(c, B) VC(while Inv b do c, B) =? 19 VCGen for while VC(while Inv e do c, B) = Inv Æ ( x 1 x n. Inv (e VC(c, Inv) Æ e B) ) Inv holds on entry Inv is preserved in an arbitrary iteration B holds when the loop terminates in an arbitrary iteration Inv is the loop invariant (provided externally) x 1,, x n are all the variables modified in c The is similar to the in mathematical induction: P(0) Æ n N. P(n) P(n+1) 20 Example VCGen Problem Let s compute the VC of this program with respect to post-condition x 0 x = 0; y = 2; while x+y=2 y > 0 do y := y - 1; x := x + 1 First, what do we expect? What pre-condition do we need to ensure x 0 after this? 21 Example of VCGen By the sequencing rule, first we do the while loop (call it w): while x+y=2 y > 0 do y := y - 1; x := x + 1 VCGen(w, x 0) = x+y=2 Æ Preserve loop invariant Ensure post on exit x,y. x+y=2 (y>0 VC(c, x+y=2) Æ y 0 x 0) VCGen(y:=y-1 ; x:=x+1, x+y=2) = (x+1) + (y-1) = 2 w Result: x+y=2 Æ x,y. x+y=2 (y>0 (x+1)+(y-1)=2 Æ y 0 x 0) 22 Example of VCGen VC(w, x 0) = x+y=2 Æ x,y. x+y=2 (y>0 (x+1)+(y-1)=2 Æ y 0 x 0) VC(x := 0; y := 2 ; w, x 0) = 0+2=2 Æ x,y. x+y=2 (y>0 (x+1)+(y-1)=2 Æ y 0 x 0) So now we ask an automated theorem prover to prove it. 23 Prove it! $./Simplify > (AND (EQ (+ 0 2) 2) (FORALL ( x y ) (IMPLIES (EQ (+ x y) 2) (AND (IMPLIES (> y 0) (EQ (+ (+ x 1)(- y 1)) 2)) (IMPLIES (<= y 0) (NEQ x 0)))))) 1: Valid. Great! Simplify is a non-trivial five megabytes 24 4

5 Can We Mess Up VCGen? Prove it! The invariant is from the user (= the adversary, the untrusted code base) Let s use a loop invariant that is false, like x 0. VC = 0 0 Æ x,y. x 0 (y>0 x+1 0 Æ y 0 x 0) Let s use a loop invariant that is too weak, like true. VC = true Æ x,y. true (y>0 true Æ y 0 x 0) 25 $./Simplify > (AND TRUE (FORALL ( x y ) (IMPLIES TRUE (AND (IMPLIES (> y 0) TRUE) (IMPLIES (<= y 0) (NEQ x 0)))))) Counterexample: context: (AND (EQ x 0) (<= y 0) ) 1: Invalid. OK, so we won t be fooled. 26 Soundness of VCGen Simple form Or equivalently that { VC(c,B) } c { B } VC(c, B) wp(c, B) Proof is by induction on the structure of c Try it! Soundness holds for any choice of the invariant! Next: properties and extensions of VCs 27 Applying Verification Condition Generation One-Slide Summary Verification conditions make axiomatic semantics practical. We can compute verification conditions forward for use on unstructured code (= assembly language). This is sometimes called symbolic execution. We can add extra invariants or drop paths (dropping is unsound) to help verification condition generation scale. We can model exceptions, memory operations and data structures using verification condition generation. Where Are We? Axiomatic semantics: The meaning of a program is what is true after it executes Hoare triples: {A} c {B} Weakest Precondition: {wp(c,b)} c {B} Verification Condition: A VC(c,B) wp(c,b) Requires Loop Invariants Backward VC works for structured programs

6 Plan for Applying VCGen Symbolic Execution and Forward VCGen Handling Exponential Blowup Invariants Dropping Paths VCGen For Exceptions (double trouble) VCGen For Memory (McCarthyism) VCGen For Structures (have a field day) VCGen For Semantic Checksum 31 VC and Invariants Consider the Hoare triple: {x 0} while I(x) x 5 do x := x + 1 {x = 6} The VC for this is: x 0 I(x) x. (I(x) (x > 5 x = 6 x 5 I(x+1) )) Requirements on the invariant: Holds on entry x. x 0 I(x) Preserved by the body x. I(x) x 5 I(x+1) Useful x. I(x) x > 5 x = 6 Check that I(x) = x 6 satisfies all constraints 32 Forward VCGen Traditionally the VC is computed backwards That s how we ve been doing it in class It works well for structured code But it can also be computed forward Works even for unstructured languages (e.g., assembly language) Uses symbolic execution, a technique that has broad applications in program analysis e.g., the PREfix tool (Intrinsa, Microsoft) works this way 33 Forward VC Gen Intuition Consider the sequence of assignments x 1 := e 1 ; x 2 := e 2 The VC(c, B) = [e 1 /x 1 ]([e 2 /x 2 ]B) = [e 1 /x 1, [e 1 /x 1 ]e 2 /x 2 ] B We can compute the substitution in a forward way using symbolic execution (aka symbolic evaluation) Keep a symbolic state that maps variables to expressions Initially, Σ 0 = { } After x 1 := e 1, Σ 1 = { x 1 e 1 } After x 2 := e 2, Σ 2 = {x 1 e 1, x 2 [e 1 /x 1 ]e 2 } Note that we have applied Σ 1 as a substitution to right-hand side of assignment x 2 := e 2 34 Simple Assembly Language Consider the language of instructions: I ::= x := e f() if e goto L goto L L: return inv e The inv e instruction is an annotation Says that boolean expression e holds at that point Each function f() comes with Pre f and Post f annotations (pre- and postconditions) New Notation (yay!): I k is the instruction at address k 36 6

7 Symbolic Execution Symbolic State We set up a symbolic execution state: Σ : Var SymbolicExpressions Σ(x) = the symbolic value of x in state Σ Σ[x:=e] = a new state where x s value is e We use states as substitutions: Σ(e) = e where x replaced by Σ(x) So far, much like operational semantics 37 Symbolic Execution Invariant State The symbolic executor keeps track of the encountered invariants A new part of symex state: Inv {1 n} If k Inv then I k is an invariant instr. that we have already executed Basic idea: execute an inv instruction only twice: The first time it is encountered Once more time around an arbitrary iteration 38 7