A Verification Infrastructure for Permission-Based Reasoning Viper A Verification Infrastructure for Permission-Based Reasoning Quantified Permissions Dynamic-Frames-Style Specifications in Permission Logics Malte Schwerhoff 3rd November 2016, Bad Herrenalb

Frame Problem { P } C { Q } { P R } C { Q R } ∧

Framing Methodologies { P } C { Q } { P R } C { Q R } ∧ ∧ Dynamic Frames (no permissions) { P } C { Q } modifies(C) ∩ reads(R) = ∅ { P R } C { Q R } ∧ ∧

Framing Methodologies { P } C { Q } { P R } C { Q R } ∧ ∧ Dynamic Frames (no permissions) Separation Logic (permissions) { P } C { Q } modifies(C) ∩ reads(R) = ∅ { P } C { Q } { P R } C { Q R } { P R } C { Q R } ∧ ∧ ∗ ∗

Permissions method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } X x.val Y y.val

Permissions { P } C { Q } { P  R } C { Q  R } ∗ ∗ method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } X x.val Y y.val { P } C { Q } { P  R } C { Q  R } ∗ ∗

Permissions { P } C { Q } { P  R } C { Q  R } ∗ ∗ method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } X x.val Y y.val { P } C { Q } { P  R } C { Q  R } ∗ ∗

Permissions { P } C { Q } { P  R } C { Q  R } ∗ ∗ method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } ? x.val Y y.val { P } C { Q } { P  R } C { Q  R } ∗ ∗

Permissions { P } C { Q } { P  R } C { Q  R } ∗ ∗ method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } ? x.val Y y.val { P } C { Q } { P  R } C { Q  R } ∗ ∗

Permissions { P } C { Q } { P  R } C { Q  R } ∗ ∗ method mutate() requires acc(this.val) ensures acc(this.val) method client(x, y) requires acc(x.val) ∗ acc(y.val) { var tmp := y.val x.mutate() assert tmp == y.val } ? x.val Y y.val { P } C { Q } { P  R } C { Q  R } ∗ ∗

Common Tool Infrastructures No Permissions Prog. language, spec. language and methodology Front end Intermediate verification language Verification condition generator SMT solver

Common Tool Infrastructures No Permissions Prog. language, spec. language and methodology Front end Intermediate verification language Verification condition generator SMT solver

Common Tool Infrastructures No Permissions Permissions Prog. language, spec. language and methodology Prog. language, spec. language and methodology Front end Custom verifier Intermediate verification language Intermediate verification language Verification condition generator SMT solver SMT solver

Common Tool Infrastructures No Permissions Permissions Prog. language, spec. language and methodology Prog. language, spec. language and methodology Front end Custom verifier Custom verifier Custom verifier Intermediate verification language Intermediate verification language Verification condition generator SMT solver SMT solver

Common Tool Infrastructures No Permissions Permissions Prog. language, spec. language and methodology Prog. language, spec. language and methodology repeat abstraction gap Front end Custom verifier Custom verifier Custom verifier Intermediate verification language Intermediate verification language Verification condition generator reuse SMT solver SMT solver

Insufficient Tool Support for Permission Logics Prog. language, spec. language and methodology Custom verifier SMT solver Verification efforts do not benefit fully from advances in theory Theory does not receive feedback from applications Toolbox image: http://www.freeiconspng.com/free-images/toolbox-icon-32381

Facilitate the 1. development of tools 2. prototyping of encodings for permission-based verification

Intermediate verification language Viper Front end Front end Front end Intermediate verification language Back-end tools Viper SMT solver Icons: http://www.iconarchive.com/show/vista-people-icons-by-icons-land.html http://www.icons-land.com/

{ P } C { Q } { P  R } C { Q  R } Permission Transfer callee caller ∗ ∗ caller

Viper Features: Inhale and Exhale { P } C { Q } callee { P  R } C { Q  R } ∗ ∗ caller exhale P assert value constraints check and remove permissions havoc newly-inaccessible locations inhale Q obtain permissions assume value constraints

Demo

Recursive Predicates v predicate list(this: Ref) { this != null ==> acc(this.data) && acc(this.next) && list(this.next) } v unfold list(this) // access this.data // and this.next fold list(this)

Recursive Predicates: Limitations Extending

Recursive Predicates: Limitations Extending

Recursive Predicates: Limitations Extending Sharing w

Recursive Predicates: Limitations Extending Sharing w

Recursive Predicates: Limitations Extending Sharing Traversing w

Unbounded Data Structures Unidirectional Multidirectional Random Access Unstructured recursive predicates are often a suitable specification mechanism 28

Unbounded Data Structures Unidirectional Multidirectional Random Access Unstructured need for an alternative specification mechanism 29

Quantified Permissions Multidirectional forall n in nodes :: acc(n.next) && acc(n.prev) Random Access Unstructured 30

Quantified Permissions Multidirectional forall n in nodes :: acc(n.next) && acc(n.prev) Random Access forall i in [0..5] :: acc(arr[i]) Unstructured 31

Quantified Permissions Multidirectional forall n in nodes :: acc(n.next) && acc(n.prev) Random Access forall i in [0..5] :: acc(arr[i]) forall i in [0..5] :: i % 2 == 1 ==> acc(arr[i]) Unstructured 32

Quantified Permissions Multidirectional forall n in nodes :: acc(n.next) && acc(n.prev) Random Access forall i in [0..5] :: acc(arr[i]) forall i in [0..5] :: i % 2 == 1 ==> acc(arr[i]) Unstructured forall n in nodes :: acc(n.succs) && acc(n.marked) 33

Quantified Permissions Multidirectional forall n in nodes :: acc(n.next) && acc(n.prev) Random Access forall i in [0..5] :: acc(arr[i]) forall i in [0..5] :: i % 2 == 1 ==> acc(arr[i]) Unstructured forall n in nodes :: acc(n.succs) && acc(n.marked) && (n.marked ==> forall m in n.succs :: m.marked) 34

List Tail Sharing Revisited predicate list(nodes: Set[Ref]) { forall n  nodes :: acc(n.data) && acc(n.next) && (n.next != null ==> n.next  nodes) } v w list(nodes) && v  nodes && w.next  nodes

General Receiver Expressions inhale ∀ x ∈ S :: acc(e(x).f) exhale ∀ y ∈ R :: acc(y.f) 36

General Receiver Expressions: Challenge inhale ∀ x ∈ S :: acc(e(x).f) {x1, x2, x3, x4, ..., xn} e(x).f {y1, y2, y3, ..., ym} acc(y.f)? exhale ∀ y ∈ R :: acc(y.f) 37

General Receiver Expressions: Challenge inhale ∀ x ∈ S :: acc(e(x).f) {x1, x2, x3, x4, ..., xn} e(x).f ∃ x ϵ S :: e(x) = y? {y1, y2, y3, ..., ym} exhale ∀ y ∈ R :: acc(y.f) 38

General Receiver Expressions: Injectivity inhale ∀ x ∈ S :: acc(e(x).f) 1. Require e(x) to be injective (naturally satisfied by e.g. arrays and graphs) {x1, x2, x3, x4, ..., xn} e(x).f {y1, y2, y3, ..., ym} exhale ∀ y ∈ R :: acc(y.f) 39

General Receiver Expressions: Inverse Functions inhale ∀ x ∈ S :: acc(e(x).f) 1. Require e(x) to be injective 2. Axiomatise inverse function e-1(x) to SMT solver {x1, x2, x3, x4, ..., xn} e(x).f {y1, y2, y3, ..., ym} exhale ∀ y ∈ R :: acc(y.f) 40

General Receiver Expressions: Challenge inhale ∀ x ∈ S :: acc(e(x).f) {x1, x2, x3, x4, ..., xn} e-1(y) ϵ S? e(x).f y.f ϵ L? {y1, y2, y3, ..., ym} acc(y.f)? exhale ∀ y ∈ R :: acc(y.f) 41

Demo

Dynamic Frames vs. Permissions Permission Logics: disjointness per default poorly supported in tools Arbitrary data structures Concurrency Dynamic Frames: sharing per default

Dynamic Frames vs. Permissions Permission Logics: disjointness per default Viper’s quantified permissions Arbitrary data structures Concurrency ? specify and maintain disjointness explicitly Dynamic Frames: sharing per default

Viper: Currently Viper Chalice Java OpenCL Python Intermediate verification language Verification condition generator (verifier) Symbolic execution (verifier) Abstract interpretation (inference) Viper Boogie SMT solver

Viper: Next Viper Fine-Grained Concurrency Chalice Java OpenCL Python Intermediate verification language Verification condition generator (verifier) Symbolic execution (verifier) Abstract interpretation (inference) Viper Boogie SMT solver

+ C1 || C2 http://viper.ethz.ch Viper SMT solver Intermediate verification language Viper Abstract interpretation (inference) Boogie Verification condition generator (verifier) Symbolic execution (verifier) Java Chalice OpenCL Python http://viper.ethz.ch C1 || C2 +