Notes on Tornado Broadened Static Checking.


117 views
Uploaded on:
Category: Funny / Jokes
Description
Notes on Violent wind Augmented Static Checking. Greg Morrisett Harvard College. Static Amplified Checking: SEX-C. Comparable way to deal with ESC-M3/Java: Ascertain a first request predicate portraying the machine state at every system point.
Transcripts
Slide 1

Notes on Cyclone Extended Static Checking Greg Morrisett Harvard University

Slide 2

Static Extended Checking: SEX-C Similar way to deal with ESC-M3/Java: Calculate a first request predicate depicting the machine state at every project point. Create confirmation conditions (VCs) comparing to run-time checks. Sustain VCs to a hypothesis prover. Just embed check (and issue cautioning) if prover can\'t indicate VC is valid. Key objective: needs proportional well (like sort checking) so it can be utilized on each alter incorporate investigate cycle.

Slide 3

Example: strcpy strcpy(char ?d, singe ?s) { while (*s != 0) { *d = *s; s++; d++; } *d = 0; } Run-time checks are embedded to guarantee that s and d are not NULL and in limits. 6 words went in rather than 2.

Slide 4

Better strcpy(char ?d, burn ?s) { unsigned i, n = numelts(s); assert(n < numelts(d)); for (i=0; i < n && s[i] != 0; i++) d[i] = s[i]; d[i] = 0; } This should have no run-time checks past the declare.

Slide 5

Even Better: strncpy(char *d, scorch *s, uint n) @assert(n < numelts(d) && n <= numelts(s)) { unsigned i; for (i=0; i < n && s[i] != 0; i++) d[i] = s[i]; d[i] = 0; } No fat pointers or element checks. Be that as it may, guest must statically fulfill the pre-condition.

Slide 6

In Practice: strncpy(char *d, scorch *s, uint n) @checks(n < numelts(d) && n <= numelts(s)) { unsigned i; for (i=0; i < n && s[i] != 0; i++) d[i] = s[i]; d[i] = 0; } If guest can build up pre-condition, no check. Something else, an understood check is embedded. Obviously, checks are a constrained class of affirmations.

Slide 7

Results so far… For the 165 records (~78 Kloc) that make up the standard libraries and compiler: CLibs: stdio, string, … CycLib: rundown, cluster, spread, dict, set, bignum, … Compiler: lex, parse, writing, break down, xlate to C,… Eliminated 96% of the (static) looks at invalid : 33,121 of 34,437 (96%) limits: 13,402 out of 14,022 (95%) 225s for bootstrap contrasted with 221s with all verifies turned (2% slower) on this portable PC. Enhancement point of view: appears to be really great.

Slide 8

Scaling

Slide 9

Not all Rosy: Don\'t work out quite as well at exhibit escalated code. Case in point, on the AES reference: 75% of the checks (377 out of 504) 2% slower than all verifies turned. 24% slower than unique C code. (the vast majority of the overhead is fat pointers) The essential guilty party: we are extremely preservationist about number juggling. i.e., x[2*i+1] will divert us from unfailingly.

Slide 10

Challenges Assumed I could use off-the-rack innovation. In any case, kept running into a couple of issues: versatile VC era beforehand tackled issue (see ESC gentlemen.) however diverting to rediscover the arrangements. usable hypothesis provers until further notice, moved our own (not the genuine center.)

Slide 11

Verification-Condition Generation We began with course book most grounded post-conditions: SP[ x := e ] A = A [ a/x ]  x =e [ a/x ] ( a new) SP[ S 1 ; S 2 ] A = SP[ S 2 ] (SP[ S 1 ] A ) SP[ if (e) S 1 else S 2 ] A = SP[ S 1 ]( A  e  0 )  SP[ S 2 ]( A  e=0 )

Slide 12

Why SP rather than WP? SP[ if (c) skip else come up short ] A = A  c When A  c then we can dispense with the check. In any case, the post-condition is still A  c . WP[ if (c) skip else come up short ] A = ( c  A)  c For WP, this will be proliferated in reverse making it hard to figure out which some piece of the pre-condition relates to a specific check.

Slide 13

first Problem with Textbook SP SP[ x := e ] A = A [ a/x ]  x =e [ a/x ] What if e has impacts? Specifically, suppose it is possible that e is itself a task. Arrangement: utilize a monadic translation: SP : Exp  Assn  Term ï‚\' Assn

Slide 14

For Example: SP[ x ] A = ( x , A ) SP[ e 1 + e 2 ] A = let ( t 1 , A 1 ) = SP[ e 1 ] A ( t 2 , A 2 ) = SP[ e 2 ] A 1 in ( t 1 + t 2 , A 2 ) SP[ x := e ] A = let ( t , A 1 ) = SP[ e ] An in ( t [ a/x ], A 1 [ a/x ]  x == t [ a/x ])

Slide 15

Or as in Haskell SP[ x ] = return x SP[ e 1 + e 2 ] = do { t 1  SP[ e 1 ] ; t 2  SP[ e 2 ] ; return t 1 + t 2 } SP[ x := e ] = do { t  SP[ e ] ; supplant [ a/x ] ; and x == t [ a/x ] ; return t [ a/x ] }

Slide 16

One Issue obviously, this over sequentializes the code. C has exceptionally liberal request of assessment standards which are pitifully unusable for any stable investigation. So we compel the assessment to be left-to-right and match our sequentialization.

Slide 17

Next Problem: Diamonds SP[ if (e 1 ) S 11 else S 12 ; if (e 2 ) S 21 else S 22 ; ... in the event that (e n ) S n1 else S n2 ] A Textbook methodology blasts ways into a tree. SP[ if (e) S 1 else S 2 ] A = SP[ S 1 ]( A  e  0 )  SP[ S 2 ]( A  e=0 ) This essentially doesn\'t scale. e.g., one system had assn with ~1.5B hubs. WP has same issue. (see Flanagan & Leino)

Slide 18

Hmmm…a part like naã¯ve CPS Duplicate consequence of first restrictive which copies the first statement. SP[ if (e 1 ) S 11 else S 12 ; if (e 2 ) S 21 else S 22 ] A = SP[ S 21 ] (( SP[ S 11 ]( A  e 1  0 )  SP[ S 12 ]( A  e 1 =0 )  e 2  0)  SP[ S 22 ] (( SP[ S 11 ]( A  e 1  0 )  SP[ S 12 ]( A  e 1 =0 )  e 2 =0)

Slide 19

Aha! We require a "let": SP[ if (e) S 1 else S 2 ] A = let X= An in (e  0  SP[S 1 ] X )  (e=0  SP[S 2 ] X ) Alternatively, verify we physically share A. Oh no: SP[ x := e ] X = X [ a/x ]  x =e [ a/x ] This would oblige adding express substitutions to the statement dialect to abstain from breaking the sharing.

Slide 20

Handling Updates (Necula) Factor out a nearby domain : A = { x =e 1  y =e 2  … }  B where neither B nor e i contains program variables (i.e., x, y,… ) Only the earth needs to change on redesign: SP[ x := 3 ] { x =e 1  y =e 2  … }  B = { x = 3  y =e 2  … }  B So the vast majority of the statement (B) stays unaltered and can be shared.

Slide 21

So Now: SP : Exp  (Env ï‚\' Assn)  ( Term ï‚\' Env ï‚\' Assn) SP[ x ] (E, A ) = (E( x ), (E, A )) SP[ e 1 + e 2 ] (E, A ) = let ( t 1 ,E 1 , A 1 ) = SP[ e 1 ] (E, A ) ( t 2 ,E 2 , A 2 ) = SP[ e 2 ] (E, A 1 ) in ( t 1 + t 2 , E 2 , A 2 ) SP[ x := e ] (E, A ) = let ( t ,E 1 , A 1 ) = SP[ e ] (E, A ) in ( t , E 1 [ x := t ], A 1 )

Slide 22

Or as in Haskell: SP[ x ] = lookup x SP[ e 1 + e 2 ] = do { t 1  SP[ e 1 ] ; t 2  SP[ e 2 ] ; return t 1 + t 2 } SP[ x := e ] = do { t  SP[ e ] ; set x t ; return t }

Slide 23

Note: Monadic embodiment pivotal from a product building perspective: really have numerous out-set stream edges because of special cases, return, and so forth (see Tan & Appel, VMCAI\'06) so the monad really amasses ( Term ï‚\' Env ï‚\' Assn) values for every edge. in any case, regardless it looks as lovely as the past slide. (modulo the way that it\'s composed in Cyclone.)

Slide 24

Diamond Problem Revisited: SP[ if (e) S 1 else S 2 ] { x =e 1  y =e 2  … }  B = ( SP[ S 1 ] { x =e 1  y =e 2  … }  B  e  0)  ( SP[ S 2 ] { x =e 1  y =e 2  … }  B  e = 0) = ( { x =t 1  y =t 2  … }  B 1 )  ( { x =u 1  y =u 2  … }  B 2 ) = { x = a x  y = a y  … }  (( a x = t 1  a y = t 2  …  B 1 )  ( a x = u 1  a y = u 2  …  B 2 ))

Slide 25

How does the earth help? SP[ if ( a ) x :=3 else x := y ; if ( b ) x :=5 else skip; ] { x =e 1  y =e 2 }  B  { x =v  y =e 2 }   b = 0  v =t b  0  v =5   a  0  t =3 B a = 0  t = e 2

Slide 26

Tah-Dah! I\'ve rediscovered SSA. monadic interpretation sequentializes and names middle of the road results. just need to include new variables when two ways register diverse qualities for a variable. so the added comparisons for conditionals relate to  - hubs. Like SSA, most pessimistic scenario O(n 2 ) yet by and by O(n). Best part: the greater part of the VCs for a given methodology have the same statement DAG.

Slide 27

Space Scaling

Slide 28

So far so great: obviously, I\'ve sparkled over the hard bits: circles memory strategies Let\'s discussion about circles first…

Slide 29

Widening: Given A  B, figure some C such that A  C and B  C and |C| < |A|, |B|. At that point we can figure an altered point for circle invariants iteratively: begin with pre-condition P procedure circle test & body to get P\' check whether P\'  P. Assuming this is the case, we\'re finished. if not, extend P  P\' and emphasize. (gleaming over variable degree issues.)

Slide 30

Our Widening: Conceptually, to extend A  B Calculate the DNF Factor out grammatically regular primitive relations: by and by, we d

Recommended
View more...