Tweet
Tweet

Slide 1

Slide 1 text

An Axiomatic Basis for Computer Programming Jean Yang Papers We Love #10 / 11.18.14

Slide 2

Slide 2 text

An Axiomatic Basis for Computer Programming Jean Yang Ph.D. student, MIT CSAIL November 18, 2014

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Good thing there is such a thing as inspection!

Slide 8

Slide 8 text

But How Do We Measure Software?

Slide 9

Slide 9 text

Testing I looked in the mirror five times. I confirmed that I look good. I am Ryan Gosling. I am wearing a suit. Ryan Gosling looks good in a suit. Q.E.D. Logical reasoning vs.

Slide 10

Slide 10 text

Axioms. The set of facts we have to work with. Ingredients Theorems. Built from our axioms based on deduction rules.

Slide 11

Slide 11 text

Deductive Logic: Detachment → Am Ryan Gosling → Look good Am Ryan Gosling Look good

Slide 12

Slide 12 text

→ → Am Ryan Gosling → Great hair Great hair → Look good Am Ryan Gosling Look good Deductive Logic: Syllogism

Slide 13

Slide 13 text

Deductive Logic: Contrapositive → ¬ ¬ Am Ryan Gosling → Look good Do not look good Am not Ryan Gosling

Slide 14

Slide 14 text

But How to Apply to Programs?

Slide 15

Slide 15 text

Previous Work: Characterizing Program State = 3 > ( ≠ 0) ⇒ ( + = ) = ∈1… [] ∀ ∈ 1 … . > [ − 1] Slide borrowed from Jonathan Aldrich, who borrowed slides from Rustan Leino.

Slide 16

Slide 16 text

Characterizing Programs Using the Hoare Triple Precondition Program Postcondition

Slide 17

Slide 17 text

Example Hoare Triples ∶= 5 = 5 = { ∶= + 3} = + 3 > 0 { ∶= ∗ 2} > −2 = < 0 ℎ ∶= − = || { ∶= 3} = 8 {ℎ ≔ + 1} … Looks good Any program Looks good

Slide 18

Slide 18 text

Example: Assignment ? ≔ + 1 ≤ Assignment axiom schema 0 ≔ where is a variable identifier; is an expression; 0 is obtained from by substituting for all occurrences of .

Slide 19

Slide 19 text

Example: Assignment + 1 ≤ ≔ + 1 ≤ 0 ≔ where is a variable identifier; is an expression; 0 is obtained from by substituting for all occurrences of . Assignment axiom schema

Slide 20

Slide 20 text

Bringing This Back to Ryan Gosling + = ≔ + = ?

Slide 21

Slide 21 text

1 1 1 2 1 ; 2 Composition > 1 ≔ + 1 > 2 > 2 ≔ + 1 > 3 > 1 ≔ + 1; ≔ + 1 > 3 > 1 ≔ + 1 > 2 > 0 ≔ − < 0 > 1 ≔ + 1; ≔ − ?

Slide 22

Slide 22 text

→ → Consequence > 1 ≔ + 1 > 2 > 2 → > 0 > 0 ≔ − < 0 > 1 ≔ + 1; ≔ − < 0

Slide 23

Slide 23 text

Consequence with RG + = ≔ + = = ≔ + = = → + = →

Slide 24

Slide 24 text

Iteration ∧ conjunction ¬ negation ∧ < 10 ≔ + 1 < 10 ≔ + 1 ≥ 10 ∧ > 0 ∧ < 10 ≔ + 1 > 0 > 0 < 10 ≔ + 1 ≥ 10 ∧ > 0 ∧ ¬ ∧

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

Automated Tools Based on Hoare Logic

Slide 27

Slide 27 text

Verified Type-checked Verve, a Type-Safe OS Safe to the Last Instruction / Jean Yang • Verify partial correctness of low- level Nucleus using Hoare logic based on a hardware spec. • Verify an interface to typed assembly for end-to-end safety. Nucleus File System Drivers Applications Microkernel Hardware specification Interface specification 27 [Yang and Hawblitzel, PLDI 2010]

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

“Load” Specification procedure Load(ptr:int) returns (val:int); requires memAddr(ptr); requires Aligned(ptr); modifies Eip; ensures word(val); ensures val == Mem[ptr]; Safe to the Last Instruction / Jean Yang 29

Slide 30

Slide 30 text

Boogie to x86 implementation ReadKeyboard(){ call KeyboardStatusIn8(); call eax := And(eax, 1); if (eax != 0) { goto proc; } call eax := mov(256); return; proc: call KeyboardDataIn8(); call eax := And(eax, 255); return; } Safe to the Last Instruction / Jean Yang ReadKeyboard proc in al, 064h and eax, 1 cmp eax, 0 jne ReadKeyboard$proc mov eax, 256 ret ReadKeyboard$skip: in al, 060h and eax, 255 ret 30

Slide 31

Slide 31 text

The Verve Nucleus Safe to the Last Instruction / Jean Yang 31 Verified Type-checked Nucleus File System Driver s Applications Microkernel Hardware specification Interface specification Verified Interface specification x86 instructions Memory bounds Devices GC Heap Allocator and GC [POPL 2009] Stacks Interrupt table Interrupt/error handling Interface specification

Slide 32

Slide 32 text

Ideas to Take Home

Slide 33

Slide 33 text

Always think about correctness.

Slide 34

Slide 34 text

Choose a language that helps you reason.

Slide 35

Slide 35 text

Read Papers You Love!

Slide 36

Slide 36 text

Play with Research Tools Coq

Slide 37

Slide 37 text

M-MAYBE IT BECAME ILL AND COULDN’T PRINT AN OUTPUT ! Be Patient with Research

Slide 38

Slide 38 text

Pop Quiz! • What main issues did this paper address? • Why do we want to prove programs correct? • What were Hoare’s contributions to software verification? • What should we be doing when we leave here?

Slide 39

Slide 39 text

Hoare Logic, Since 1969 1. Define a way to characterize programs and properties. 2. Build tools to automatically check program properties. 3. Profit.