Runtime Verification of C Programs with Inspiration from AOP Klaus Havelund Jet Propulsion Laboratory Pasadena, USA

Aspect Oriented Programming and Runtime Verification Aspect Oriented Programming (AOP): Pointcut : predicate on program statements. Advice : pointcut + code (execute code each time statement satisfying pointcut is reached). Runtime Verification (RV = State-full AOP ): Tracecut : predicate on execution traces. Advice : tracecut + code (execute code each time trace predicate is violated - or satisfied, depending on the default). one possible view

RCAT tool: Developed by Margaret Smith/JPL

Overview of the RMOR System C program RMOR connection fail = call(F29) void F29(int m){ … } … F29(2); … instrumented C program monitor void F29(int m){ … } … submit(fail); F29(2); … void submit(int event){ switch state of{ … case S3: if(event == fail){ state = S4; } … } specification state S3{ when fail -> s4; … } RCAT

C program RMOR connection fail = call(F29) void F29(int m){ … } … F29(2); … instrumented C program monitor void F29(int m){ … } … submit(fail); F29(2); … void submit(int event){ switch state of{ … case S3: if(event == fail){ state = S4; } … } specification state S3{ when fail -> s4; … }

C program RMOR connection fail = call(F29) void F29(int m){ … } … F29(2); … instrumented C program monitor void F29(int m){ … } … submit(fail); F29(2); … void submit(int event){ switch state of{ … case S3: if(event == fail){ state = S4; } … } specification state S3{ when fail -> s4; … }

C program RMOR connection fail = call(F29) void F29(int m){ … } … F29(2); … instrumented C program monitor void F29(int m){ … } … submit(fail); F29(2); … void submit(int event){ switch state of{ … case S3: if(event == fail){ state = S4; } … } specification state S3{ when fail -> s4; … }

C program RMOR connection fail = call(F29) void F29(int m){ … } … F29(2); … instrumented C program monitor void F29(int m){ … } … submit(fail); F29(2); … void submit(int event){ switch state of{ … case S3: if(event == fail){ state = S4; } … } specification state S3{ when fail -> s4; … }

The pointcut language for specifying program points is inspired from aspect oriented programming. ::= 'call' '(' idpat1:idpat2 ')' | 'set' '(' idpat1:idpat2 ')' | 'withincode' '(' idpat1:idpat2 ')' | 'within' '(' idpat1 ')' | | && | || | '!' | '(' ')'

A specifiation can state many properties, each represented by a monitor.

Event/pointcut parameterization: properties parameterized with symbols/events and/or pointcuts Future Extension

Data parameterization: properties parameterized with data values

The RMOR Grammar ::= * ::= 'handled'? 'monitor' '{' * '}' ::= | ::= 'import' ';' ::= pointcut '=' ';' ::= 'symbol' '=' ('before' | 'after') ';' | 'symbol' (',' )* ';' ::= 'machine' '{' * '}' ::= * 'state' '{' * '}' | 'super' '[' (',' )* ']' '{' ('while' ';')? * '}' ::= 'initial' | 'anytime' | 'once' | 'safe' | 'live' | 'next' ::= 'ANY' | | '&&' | '||' | '!' | '(' ')' ::= 'when' ('->'|'=>') ';' ::= 'call' '(' idpat1:idpat2 ')' | 'set' '(' idpat1:idpat2 ')' | 'withincode' '(' idpat1:idpat2 ')' | 'within' '(' idpat1 ')' | | && | || | '!' | '(' ')'

CIL: C Intermediate Language A C Program Analysis and Transformation Tool … while(x>0){ f(x); x--; }; … results: … while(x>0){ M_submit(42); f(x); x--; }; … void M_submit(int e){ switch(state){ case S7: … } transformation normalize AST normalized AST CIL specification Monitor syntesizer + events