Low-Level Program Verification. Components of a Certifying Framework certified code (machine code + proof) specifications: program safety/security/correctness.

Slides:



Advertisements
Similar presentations
A Translation from Typed Assembly Language to Certified Assembly Programming Zhong Shao Yale University Joint work with Zhaozhong Ni Paper URL:
Advertisements

1 Lecture 3: MIPS Instruction Set Today’s topic:  More MIPS instructions  Procedure call/return Reminder: Assignment 1 is on the class web-page (due.
The University of Adelaide, School of Computer Science
1 Procedure Calls, Linking & Launching Applications Lecture 15 Digital Design and Computer Architecture Harris & Harris Morgan Kaufmann / Elsevier, 2007.
10/6: Lecture Topics Procedure call Calling conventions The stack
1 Lecture 4: Procedure Calls Today’s topics:  Procedure calls  Large constants  The compilation process Reminder: Assignment 1 is due on Thursday.
MIPS Calling Convention Chapter 2.7 Appendix A.6.
Lecture 6: MIPS Instruction Set Today’s topic –Control instructions –Procedure call/return 1.
Computer Architecture CSCE 350
CPS3340 COMPUTER ARCHITECTURE Fall Semester, /17/2013 Lecture 12: Procedures Instructor: Ashraf Yaseen DEPARTMENT OF MATH & COMPUTER SCIENCE CENTRAL.
Ch. 8 Functions.
Procedures II (1) Fall 2005 Lecture 07: Procedure Calls (Part 2)
Apr. 12, 2000Systems Architecture I1 Systems Architecture I (CS ) Lecture 6: Branching and Procedures in MIPS* Jeremy R. Johnson Wed. Apr. 12, 2000.
The University of Adelaide, School of Computer Science
Procedure call frame: Hold values passed to a procedure as arguments
Lecture 8: MIPS Instruction Set
 Procedures (subroutines) allow the programmer to structure programs making them : › easier to understand and debug and › allowing code to be reused.
Advanced Development of Certified OS Kernels Zhong Shao Bryan Ford Yale University November Focus Areas: Operating Systems,
Modular Verification of Concurrent Assembly Code with Dynamic Thread Creation and Termination Xinyu Feng Yale University Joint work with Zhong Shao.
Typed Assembly Languages COS 441, Fall 2004 Frances Spalding Based on slides from Dave Walker and Greg Morrisett.
An Open Framework for Certified System Software Xinyu Feng Yale University.
Certifying Low-Level Programs with Hardware Interrupts and Preemptive Threads Xinyu Feng Toyota Technological Institute at Chicago Joint work with Zhong.
ENEE350 Spring07 1 Ankur Srivastava University of Maryland, College Park Adapted from Computer Organization and Design, Patterson & Hennessy, © 2005.”
Lecture 6: Procedures (cont.). Procedures Review Called with a jal instruction, returns with a jr $ra Accepts up to 4 arguments in $a0, $a1, $a2 and $a3.
10/19/2007TTI-C PL-Lunch Certified Concurrent Code with Interrupts Xinyu Feng Joint work with Zhong Shao (Yale University) and Yuan Dong (Tsinghua University)
An Open Framework for Foundational Proof-Carrying Code Xinyu Feng Yale University Joint work with Zhaozhong Ni (Yale, now at MSR), Zhong Shao (Yale) and.
Intro to Computer Architecture
Modular Verification of Assembly Code with Stack-Based Control Abstractions Xinyu Feng Yale University Joint work with Zhong Shao, Alexander Vaynberg,
S. Barua – CPSC 440 CHAPTER 2 INSTRUCTIONS: LANGUAGE OF THE COMPUTER Goals – To get familiar with.
Extensible Untrusted Code Verification Robert Schneck with George Necula and Bor-Yuh Evan Chang May 14, 2003 OSQ Retreat.
CHAPTER 2 ISA Instructions (logical + procedure call)
Memory/Storage Architecture Lab Computer Architecture MIPS Instruction Set Architecture ( Supporting Procedures )
MIPS function continued. Recursive functions So far, we have seen how to write – A simple function – A simple function that have to use the stack to save.
Axiomatic Methods for Software Verification Hongseok Yang.
Report on Project CComp Zhaopeng Li Joint work with Prof. Yiyun Chen, Zhong Zhuang, Simin Yang, Dawei Fan, Zhenting Zhang Software Security Lab., USTC,
Adapted from Computer Organization and Design, Patterson & Hennessy, UCB ECE232: Hardware Organization and Design Part 7: MIPS Instructions III
Lecture 19: 11/7/2002CS170 Fall CS170 Computer Organization and Architecture I Ayman Abdel-Hamid Department of Computer Science Old Dominion University.
Lecture 4: MIPS Instruction Set
Certifying Intermediate Programming Zhaopeng Li
Computer Architecture CSE 3322 Lecture 4 crystal.uta.edu/~jpatters/cse3322 Assignments due 9/15: 3.7, 3.9, 3.11.
Computer Architecture CSE 3322 Lecture 4 Assignment: 2.4.1, 2.4.4, 2.6.1, , Due 2/10/09
MIPS Subroutines Subroutine Call – jal subname Saves RA in $31 and jumps to subroutine entry label subname Subroutine Return – jr $31 Loads PC with return.
Function Calling. Mips Assembly Call and Return Steps for procedure calling –Save the return address –Jump to the procedure (function) –Execute the procedure.
CMPUT Computer Organization and Architecture I1 CMPUT229 - Fall 2003 Topic4: Procedures José Nelson Amaral.
Overview of Back-end for CComp Zhaopeng Li Software Security Lab. June 8, 2009.
DR. SIMING LIU SPRING 2016 COMPUTER SCIENCE AND ENGINEERING UNIVERSITY OF NEVADA, RENO Session 12 Procedure Calling.
Ichiro Hasuo University of Tokyo Kohei Suenaga JSPS Research Fellow (PD) Kyoto University Programming with Infinitesimals A WHILE-Language for Hybrid System.
MIPS Functions and the Runtime Stack
Mostly-Automated Verification of Low-Level Programs in Computational Separation Logic Adam Chlipala Harvard University PLDI 2011.
Computer Architecture & Operations I
Lecture 5: Procedure Calls
Low-Level Program Verification
Computer skills CPU Jakub Yaghob.
RISC Concepts, MIPS ISA Logic Design Tutorial 8.
Assembly Programming using MIPS R3000 CPU
An Overview to Compiler Design
What's wrong with this procedure?
Lecture 5 Floyd-Hoare Style Verification
The University of Adelaide, School of Computer Science
Lecture 5: Procedure Calls
Logical and Decision Operations
Separation Logic and Concurrency Verification
Lecture 6: Assembly Programs
Systems Architecture I
Assembly Programming using MIPS R3000 CPU
Computer Architecture
Compilers Jakub Yaghob
MIPS R3000 Subroutine Calls and Stack
Topic 2b ISA Support for High-Level Languages
Presentation transcript:

Low-Level Program Verification

Components of a Certifying Framework certified code (machine code + proof) specifications: program safety/security/correctness + machine model automated proof checker need not trust the correctness of proofs Proof Checker Yes CPU Specifications Proof machine code No

Low-Level Machine Code Verification Machine code is the executable form of programs Why verify machine code Bugs in compilers may produce buggy machine code, even if source code is correct There are manually written assembly code in OS kernels

The Machine I1I1 f1:f1: I2I2 f2:f2: I3I3 f3:f3: … (code heap) C 0 r1r1 12… r2r2 r3r3 …rnrn (data heap) H (register file) R (state) S addu … lw … sw … … j f (instr. seq.) I (program) P::=(C,S,I) ::=(H,R) ::={f  I} * pc

Operational semantics

Program Specifications I1I1 f1:f1: I2I2 f2:f2: I3I3 f3:f3: … (code heap) C 0 r1r1 12… r2r2 r3r3 …rnrn (data heap) H (register file) R (state) S addu … lw … sw … … j f (instr. seq.) I (program) P::=(C,S,I) ::=(H,R) ::={f  I} * pc a1a1 a2a2 a3a3 (spec)  ::= {f  a} * a

The CAP Logic Certified Assembly Programming Judgments [Yu et al. ESOP 2003]

State assertions - Examples a  S. S.H(100) > 0  S.R(r1) = 17  S. a S  a' S a'  S. odd(S.R(r1) )

Inference Rules Well-formed program: Well-formed code heap:

Inference Rules (2)

Inference Rules (3)  means logical implication

Verification of malloc/free

Verification of malloc/free (2)

Soundness Lemma (Preservation). If and, then there exists an assertion a’ such that. Lemma (Progress). If, then there exists a program such that

Soundness (2) Theorem (Soundness). If, then for all natural number n, there exists a program such that, and then and then

Program Specifications I1I1 f1:f1: I2I2 f2:f2: I3I3 f3:f3: … (code heap) C 0 r1r1 12… r2r2 r3r3 …rnrn (data heap) H (register file) R (state) S addu … lw … sw … … j f (instr. seq.) I (program) P::=(C,S,I) ::=(H,R) ::={f  I} * pc a1a1 a2a2 a3a3 (spec)  ::= {f  a} * a

Invariant-Based Verification Initial condition: Inv  (P 0 ) P0P0 c1c1 P1P1 c2c2 P2P2 c3c3 … cncn PnPn Progress: if Inv  (P), then  P’. P  c P’. Preservation: if Inv  (P) and P  c P’, then Inv  (P’).

f:... sw $ra, -4($fp) h: jal h ;; $ra contains ct ct: lw $ra, -4($fp) jr $ra... jr $ra fp stack ?? ct How to verify function call? void f(){ void h(){ h(); return; return; } } Does f use the right return addr.? pc ra R

void cmp1(int x,jmp_buf env){ if (x == 0) longjmp(env, 1); else return; } setjmp/longjmp int rev(int x){ if (setjmp(env) == 0){ cmp0(x, env); return 0; }else{ return 1; } void cmp0(int x,jmp_buf env){ cmp1(x, env); } jmp_buf env = …; pc f0f0 … sp env f0f0 pc env cannot outlive the stack frame of rev ! … …

SCAP specifications: (p, g) –p: State  Prop –g: State  State  Prop Specifications f:... sw $ra, -4($fp) jal h ct: lw $ra, -4($fp)... jr $ra {(p 0, g 0 )} {(p 1, g 1 )} g0g0 g1g1 g 0 S S’  S’.$ra = S.$ra … Challenges –f uses the “right” return addr.? –Hoare triple {p} f {q}? In different basic blocks! {$ra = n …}

Program Spec. and Code Pointers jal f jal h jr $ra g0g0 g4g4 p0p0 p4p4 g1g1 p1p1 g2g2 p2p2 g3g3 p3p3 … Program Specification  ::= {f 1  (p 1,g 1 ), …,f n  (p n,g n )} “safe” to return ( jr $ra ): –$ra  dom(  )   ($ra)=(p,g) –p holds at the time of return

SCAP : Stack Invariant p0p0 g0g0 p1p1 g1g1 p2p2 g2g2 p3p3 g3g3 g 0 S 0 S 1  S 1.$ra     (S 1.$ra))=(p 1, g 1 )  p 1 S 1 g 0 S 0 S 1  g 1 S 1 S 2  S 2.$ra     (S 2.$ra)=(p 2, g 2 )  p 2 S 2 g 0 S 0 S 1  g 1 S 1 S 2  g 2 S 2 S 3  S 3.$ra     (S 3.$ra)=(p 3, g 3 )  p 3 S 3 jr $ra Logical control stack Always safe to return? S0S0 S1S1 S2S2 S3S3 …

SCAP : Stack Invariant WFST(n, g 0, S 0,  )   S 1. g 0 S 0 S 1   p 1,g 1.  (S 1.$ra)=(p 1, g 1 )  p 1 S 1  WFST(n-1, g 1, S 1,  ) WFST(0, g 0, S 0,  )    S 1. g 0 S 0 S 1 Invariant: p S   n.WFST(n, g, S,  ) p0p0 g0g0 p1p1 g1g1 p2p2 g2g2 p3p3 g3g3 jr $ra Logical control stack S0S0 S1S1 S2S2 S3S3

SCAP : Invariant Preservation Inv(S): p S   n.WFST(n, g, S,  ) c S’ p S   n.WFST(n,g,S,  ) S p’ S’   n.WFST(n,g’,S’,  )  p’,g’

SCAP: call p0p0 g0g0 p1p1 g1g1 jr $ra p0p0 g0g0 p g jal f p S  WFST(n, g, S,  )p 0 S 0  WFST(n+1, g 0, S 0,  ) S S0S0 n+1 n … p S  p 0 S 0 p1p1 g1g1 n … p S  g 0 S 0 S 1  p 1 S 1 p S  g 0 S 0 S 1  g 1 S 1 S 2  g S S 2 g 0 S 0 S 1  S 0.$ra = S 1.$ra S1S1 S1S1 S2S2 S2S2

SCAP: the call rule  |- {(p,g)} jal f fret  H,R. p (H,R)  p 0 (H,R{ra  fret})  H,R,S 1. p (H,R)  g 0 (H,R{ra  fret}) S 1  p 1 S 1  (  S 2. g 1 S 1 S 2  g S S 2 )  S 0,S 1. g 0 S 0 S 1  S 0.$ra = S 1.$ra (p 0, g 0 ) =  (f) (p 1, g 1 ) =  (fret)

SCAP: ret p g p1p1 g1g1 p1p1 g1g1 jr $ra p S  WFST(n, g S,  )p 1 S 1  WFST(n-1, g 1 S 1,  ) n n-1 … … p S  g S S 1 S S1S1

SCAP: return rule  |- {(p,g)} jr $ra  S. p S  g S S

SCAP: direct jump (or tail call) p0p0 g0g0 jr $ra p g S n … j f p0p0 g0g0 jr $ra S0S0 n … p S  WFST(n, g S,  )p 0 S 0  WFST(n, g 0 S 0,  ) p S  p 0 S 0 p S  g 0 S 0 S 1  g S S 1 S1S1 S1S1

SCAP: sequential  |- {(p,g)} c;I  S. p S  p’(AuxStep(c,S))  |- {(p’,g’)} I  S,S’. p S  g’(AuxStep(c,S)) S’  g S S’

Other control flows Stack unwinding Stack cutting setjmp/longjmp in C

Call with Multiple Return Addr. p1p1 g1g1 jr ra p g Multi-ret

Call with Multiple Ret. or Tail Call

Generalization: Stack unwinding/cutting g1g1 p1p1 jr ra p g + p1p1 g1g1 p g Multi-ret p1p1 g1g1 jr ra p g Tail-call

Change of Invariant

void cmp1(int x,jmp_buf env){ if (x == 0) longjmp(env, 1); else return; } setjmp/longjmp int rev(int x){ if (setjmp(env) == 0){ cmp0(x, env); return 0; }else{ return 1; } void cmp0(int x,jmp_buf env){ cmp1(x, env); } jmp_buf env = …; pc f0f0 … sp env f0f0 pc env cannot outlive the stack frame of rev ! … …

Read the paper at: