A Formally Verified Interpreter for a Shell-like Programming Language

Transcription

1 A Formally Verified Interpreter for a Shell-like Programming Language Claude Marché Nicolas Jeannerod Ralf Treinen VSTTE, July 22, 2017 Nicolas Jeannerod VSTTE 17 July 22, / 36

2 General goal The CoLiS project. Correctness of Linux Scripts Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true ; then cmd = echo foo ; fi" ( cmd =" $cmd bar " ) exit 1 $cmd " $cmd " Nicolas Jeannerod VSTTE 17 July 22, / 36

3 General goal The CoLiS project. Correctness of Linux Scripts Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true ; then cmd = echo foo ; fi" ( cmd =" $cmd bar " ) exit 1 $cmd " $cmd " Nicolas Jeannerod VSTTE 17 July 22, / 36

4 General goal The CoLiS project. Correctness of Linux Scripts Goal: Apply verification techniques to shell scripts in the Debian packages set -e eval "if true ; then cmd = echo foo ; fi" ( cmd =" $cmd bar " ) exit 1 $cmd " $cmd " Nicolas Jeannerod VSTTE 17 July 22, / 36

5 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

6 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

7 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

8 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

9 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

10 Big picture Nicolas Jeannerod VSTTE 17 July 22, / 36

11 Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

12 Language CoLiS Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

13 Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE 17 July 22, / 36

14 Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE 17 July 22, / 36

15 Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE 17 July 22, / 36

16 Language CoLiS Requirements Intermediate language (not a replacement of Shell); Clean; With formal syntax and semantics; Statically typed: strings and lists; Variables and functions explicitely declared in a header; Dangerous structures made more explicit. However, automatic translation from reasonnable Shell must be possible. Nicolas Jeannerod VSTTE 17 July 22, / 36

17 Language CoLiS A glimpse of the language var fruits : list var fruit : string var line : string fruits =" banana apple.." { for fruit in $fruits do echo " $fruit " done } { while read line do echo "- $line " done } begin fruits ::= [ banana ; apple ;.. ] pipe for fruit in [ fruits ] do call [ echo ; { fruit } ] ; done into while call [ read ; line ] do call [ echo ; { -, line } ] ; end end Nicolas Jeannerod VSTTE 17 July 22, / 36

18 Language CoLiS A glimpse of the language var fruits : list var fruit : string var line : string fruits =" banana apple.." { for fruit in $fruits do echo " $fruit " done } { while read line do echo "- $line " done } begin fruits ::= [ banana ; apple ;.. ] pipe for fruit in [ fruits ] do call [ echo ; { fruit } ] ; done into while call [ read ; line ] do call [ echo ; { -, line } ] ; end end Nicolas Jeannerod VSTTE 17 July 22, / 36

19 Language CoLiS How behaviours are handled True False Fatal Return True Return False Exit True Exit False Pipe Normal Sequence Normal Exception Test Success Failure Exception Function call Success Failure Success Failure Exception Subprocess Success Failure Success Failure Success Failure Nicolas Jeannerod VSTTE 17 July 22, / 36

20 Language CoLiS Interactions between Do-While and Fatal DoWhile-Test-Fatal t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 Fatal /Γ2 do t 1 while t 2/Γ σ 1 σ 2 True /Γ2 DoWhile-Body-Fatal t 1/Γ σ 1 Fatal /Γ1 do t 1 while t 2/Γ σ 1 Fatal /Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

21 Language CoLiS Interactions between Do-While and Fatal DoWhile-Test-Fatal t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 Fatal /Γ2 do t 1 while t 2/Γ σ 1 σ 2 True /Γ2 DoWhile-Body-Fatal t 1/Γ σ 1 Fatal /Γ1 do t 1 while t 2/Γ σ 1 Fatal /Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

22 Language Mechanised version Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

23 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

24 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

25 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

26 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

27 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

28 Language Mechanised version Why3 Deductive verification platform; WhyML: language for both specification and programming; Standard library: integer arithmetic, boolean operations, maps, etc.; Native support of imperative features: references, exceptions, while and for loops; Proof obligations are given to external theorem provers; Possibility to extract WhyML code to OCaml. Nicolas Jeannerod VSTTE 17 July 22, / 36

29 Language Mechanised version Syntax type term = TTrue TFalse TFatal TReturn term TExit term TAsString svar sexpr TAsList lvar lexpr TSeq term term TIf term term term TFor svar lexpr term TDoWhile term term TProcess term TCall lexpr TShift TPipe term term with sexpr = list sfrag with sfrag = SLiteral string SVar svar SArg int SProcess term with lexpr = list lfrag with lfrag = LSingleton sexpr LSplit sexpr LVar lvar Nicolas Jeannerod VSTTE 17 July 22, / 36

30 Language Mechanised version Semantic judgments (excerpt) inductive eval_ term term context string behaviour context EvalT_DoWhile_False : forall t 1 Γ σ 1 b 1 Γ 1 t 3 σ 3 b 3 Γ 3 t 2. eval_term t 1 Γ σ 1 ( BNormal b 1) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> ( match b 2 with BNormal False BFatal -> true _ -> false end eval_term ( TDoWhile t 1 t 2) Γ ( concat σ 1 σ 2) ( BNormal b 1) Γ 2 EvalT_DoWhile_Exn_Body : forall t 1 Γ σ 1 b 1 Γ 1 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal _ -> false _ -> true end ) -> eval_term ( TDoWhile t 1 t 2) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

31 Sound and complete interpreter Let us see some code Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

32 Sound and complete interpreter Let us see some code Interpreter (excerpt) let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) = match t with TDoWhile t 1 t 2 -> let (b 1, Γ 1) = interp_term t 1 Γ stdout in let (b 2, Γ 2) = try interp_term t 2 Γ 1 stdout with EFatal Γ 2 -> ( false, Γ 2) end in if b 2 then interp_term t Γ 2 stdout else (b 1, Γ 2) Nicolas Jeannerod VSTTE 17 July 22, / 36

33 Sound and complete interpreter Soundness Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

34 Sound and complete interpreter Soundness Soundness of the interpreter Theorem (Soundness of the interpreter) For all t, Γ, σ, b and Γ : if t /Γ σ b /Γ then t /Γ σ b /Γ Nicolas Jeannerod VSTTE 17 July 22, / 36

35 Sound and complete interpreter Soundness Contract (excerpt) let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) diverges returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ } raises { EReturn (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BReturn b) Γ } Nicolas Jeannerod VSTTE 17 July 22, / 36

36 Sound and complete interpreter Soundness Contract (excerpt) let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) diverges returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ } raises { EReturn (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BReturn b) Γ } Nicolas Jeannerod VSTTE 17 July 22, / 36

37 Sound and complete interpreter Soundness Why it is non trivial stdout is a reference: exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ Usual fix: provide a witness as a ghost return value: May only be used for specification, Must not affect the semantics of the program. Does not fit with exceptions; Forces us to use superposition provers. Nicolas Jeannerod VSTTE 17 July 22, / 36

38 Sound and complete interpreter Soundness Why it is non trivial stdout is a reference: exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ Usual fix: provide a witness as a ghost return value: May only be used for specification, Must not affect the semantics of the program. Does not fit with exceptions; Forces us to use superposition provers. Nicolas Jeannerod VSTTE 17 July 22, / 36

39 Sound and complete interpreter Soundness Why it is non trivial stdout is a reference: exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ Usual fix: provide a witness as a ghost return value: May only be used for specification, Must not affect the semantics of the program. Does not fit with exceptions; Forces us to use superposition provers. Nicolas Jeannerod VSTTE 17 July 22, / 36

40 Sound and complete interpreter Soundness Why it is non trivial stdout is a reference: exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ Usual fix: provide a witness as a ghost return value: May only be used for specification, Must not affect the semantics of the program. Does not fit with exceptions; Forces us to use superposition provers. Nicolas Jeannerod VSTTE 17 July 22, / 36

41 Sound and complete interpreter Soundness Why it is non trivial stdout is a reference: exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ Usual fix: provide a witness as a ghost return value: May only be used for specification, Must not affect the semantics of the program. Does not fit with exceptions; Forces us to use superposition provers. Nicolas Jeannerod VSTTE 17 July 22, / 36

42 Sound and complete interpreter Completeness Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

43 Sound and complete interpreter Completeness Completeness of the interpreter Theorem (Completeness of the interpreter) For all t, Γ, σ, b and Γ : if t /Γ σ b /Γ then t /Γ σ b /Γ Nicolas Jeannerod VSTTE 17 July 22, / 36

44 Sound and complete interpreter Completeness Proofs dependencies Nicolas Jeannerod VSTTE 17 July 22, / 36

45 Sound and complete interpreter Completeness Why If: t /Γ σ b /Γ then the interpreter terminates: t /Γ σ 1 b 1/Γ1 then (Soundness): t /Γ σ 1 b 1/Γ1 then (Functionality): σ = σ 1 b = b 1 Γ = Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

46 Sound and complete interpreter Completeness Why If: t /Γ σ b /Γ then the interpreter terminates: t /Γ σ 1 b 1/Γ1 then (Soundness): t /Γ σ 1 b 1/Γ1 then (Functionality): σ = σ 1 b = b 1 Γ = Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

47 Sound and complete interpreter Completeness Why If: t /Γ σ b /Γ then the interpreter terminates: t /Γ σ 1 b 1/Γ1 then (Soundness): t /Γ σ 1 b 1/Γ1 then (Functionality): σ = σ 1 b = b 1 Γ = Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

48 Sound and complete interpreter Completeness Why If: t /Γ σ b /Γ then the interpreter terminates: t /Γ σ 1 b 1/Γ1 then (Soundness): t /Γ σ 1 b 1/Γ1 then (Functionality): σ = σ 1 b = b 1 Γ = Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

49 Sound and complete interpreter Completeness Proofs dependencies Nicolas Jeannerod VSTTE 17 July 22, / 36

50 Sound and complete interpreter Completeness Why do we need all this? Case of the sequence: TSeq t 1 t 2 -> let (_, Γ 1) = interp_term t 1 Γ stdout in interp_term t 2 Γ 1 stdout By hypothesis / pre-condition, there is σ, b and Γ such that: (t 1 ; t 2 ) /Γ σ b /Γ By structure of the predicate, there is σ, b, and Γ such that: t 1/Γ σ b /Γ t 2/Γ σ b /Γ By soundness and functionality, Γ = Γ 1. Nicolas Jeannerod VSTTE 17 July 22, / 36

51 Sound and complete interpreter Completeness Why do we need all this? Case of the sequence: TSeq t 1 t 2 -> let (_, Γ 1) = interp_term t 1 Γ stdout in interp_term t 2 Γ 1 stdout By hypothesis / pre-condition, there is σ, b and Γ such that: (t 1 ; t 2 ) /Γ σ b /Γ By structure of the predicate, there is σ, b, and Γ such that: t 1/Γ σ b /Γ t 2/Γ σ b /Γ By soundness and functionality, Γ = Γ 1. Nicolas Jeannerod VSTTE 17 July 22, / 36

52 Sound and complete interpreter Completeness Why do we need all this? Case of the sequence: TSeq t 1 t 2 -> let (_, Γ 1) = interp_term t 1 Γ stdout in interp_term t 2 Γ 1 stdout By hypothesis / pre-condition, there is σ, b and Γ such that: (t 1 ; t 2 ) /Γ σ b /Γ By structure of the predicate, there is σ, b, and Γ such that: t 1/Γ σ b /Γ t 2/Γ σ b /Γ By soundness and functionality, Γ = Γ 1. Nicolas Jeannerod VSTTE 17 July 22, / 36

53 Sound and complete interpreter Completeness Why do we need all this? Case of the sequence: TSeq t 1 t 2 -> let (_, Γ 1) = interp_term t 1 Γ stdout in interp_term t 2 Γ 1 stdout By hypothesis / pre-condition, there is σ, b and Γ such that: (t 1 ; t 2 ) /Γ σ b /Γ By structure of the predicate, there is σ, b, and Γ such that: t 1/Γ σ b /Γ t 2/Γ σ b /Γ By soundness and functionality, Γ = Γ 1. Nicolas Jeannerod VSTTE 17 July 22, / 36

54 Sound and complete interpreter Completeness Why do we need all this? Case of the sequence: TSeq t 1 t 2 -> let (_, Γ 1) = interp_term t 1 Γ stdout in interp_term t 2 Γ 1 stdout By hypothesis / pre-condition, there is σ, b and Γ such that: (t 1 ; t 2 ) /Γ σ b /Γ By structure of the predicate, there is σ, b, and Γ such that: t 1/Γ σ b /Γ t 2/Γ σ b /Γ By soundness and functionality, Γ = Γ 1. Nicolas Jeannerod VSTTE 17 July 22, / 36

55 Sound and complete interpreter Completeness Termination of the interpreter, in Why3 let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) requires { exists σ b Γ. eval_ term t Γ σ b Γ } returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ } variant {... } Nicolas Jeannerod VSTTE 17 July 22, / 36

56 Sound and complete interpreter Completeness Termination of the interpreter, in Why3 let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) requires { exists σ b Γ. eval_ term t Γ σ b Γ } returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ } variant {... } Nicolas Jeannerod VSTTE 17 July 22, / 36

57 Sound and complete interpreter Completeness Termination of the interpreter, in Why3 let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) : ( bool, context ) requires { exists σ b Γ. eval_ term t Γ σ b Γ } returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ } variant {... } Nicolas Jeannerod VSTTE 17 July 22, / 36

58 Sound and complete interpreter Looking for a variant... Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

59 Sound and complete interpreter Looking for a variant... Let us find a variant CoLiS programs are structurally decreasing? Wrong. DoWhile-True t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 True /Γ2 do t 1 while t 2/Γ2 σ 3 b 3/Γ3 do t 1 while t 2/Γ σ 1 σ 2 σ 3 b 3/Γ3 Derivation trees of the semantics are structurally decreasing? True, but we cannot manipulate them in Why3. Can we use the height or the size of the proof tree? Nicolas Jeannerod VSTTE 17 July 22, / 36

60 Sound and complete interpreter Looking for a variant... Let us find a variant CoLiS programs are structurally decreasing? Wrong. DoWhile-True t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 True /Γ2 do t 1 while t 2/Γ2 σ 3 b 3/Γ3 do t 1 while t 2/Γ σ 1 σ 2 σ 3 b 3/Γ3 Derivation trees of the semantics are structurally decreasing? True, but we cannot manipulate them in Why3. Can we use the height or the size of the proof tree? Nicolas Jeannerod VSTTE 17 July 22, / 36

61 Sound and complete interpreter Looking for a variant... Let us find a variant CoLiS programs are structurally decreasing? Wrong. DoWhile-True t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 True /Γ2 do t 1 while t 2/Γ2 σ 3 b 3/Γ3 do t 1 while t 2/Γ σ 1 σ 2 σ 3 b 3/Γ3 Derivation trees of the semantics are structurally decreasing? True, but we cannot manipulate them in Why3. Can we use the height or the size of the proof tree? Nicolas Jeannerod VSTTE 17 July 22, / 36

62 Sound and complete interpreter Looking for a variant... Let us find a variant CoLiS programs are structurally decreasing? Wrong. DoWhile-True t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 True /Γ2 do t 1 while t 2/Γ2 σ 3 b 3/Γ3 do t 1 while t 2/Γ σ 1 σ 2 σ 3 b 3/Γ3 Derivation trees of the semantics are structurally decreasing? True, but we cannot manipulate them in Why3. Can we use the height or the size of the proof tree? Nicolas Jeannerod VSTTE 17 July 22, / 36

63 Sound and complete interpreter Looking for a variant... Let us find a variant CoLiS programs are structurally decreasing? Wrong. DoWhile-True t 1/Γ σ 1 True /Γ1 t 2/Γ1 σ 2 True /Γ2 do t 1 while t 2/Γ2 σ 3 b 3/Γ3 do t 1 while t 2/Γ σ 1 σ 2 σ 3 b 3/Γ3 Derivation trees of the semantics are structurally decreasing? True, but we cannot manipulate them in Why3. Can we use the height or the size of the proof tree? Nicolas Jeannerod VSTTE 17 July 22, / 36

64 Sound and complete interpreter Looking for a variant... Why it does not work Superposition provers are bad with arithmetic. SMT solvers are bad with existential quantifications. We cannot deduce from the height of a derivation tree the heights of the premises. We cannot deduce from the size of a derivation tree the sizes of the premises. Nicolas Jeannerod VSTTE 17 July 22, / 36

65 Sound and complete interpreter Looking for a variant... Why it does not work Superposition provers are bad with arithmetic. SMT solvers are bad with existential quantifications. We cannot deduce from the height of a derivation tree the heights of the premises. We cannot deduce from the size of a derivation tree the sizes of the premises. Nicolas Jeannerod VSTTE 17 July 22, / 36

66 Sound and complete interpreter Looking for a variant... Why it does not work Superposition provers are bad with arithmetic. SMT solvers are bad with existential quantifications. We cannot deduce from the height of a derivation tree the heights of the premises. We cannot deduce from the size of a derivation tree the sizes of the premises. Nicolas Jeannerod VSTTE 17 July 22, / 36

67 Sound and complete interpreter Skeletons Table of Contents 1. Language CoLiS Mechanised version 2. Sound and complete interpreter Let us see some code Soundness Completeness Looking for a variant... Skeletons Nicolas Jeannerod VSTTE 17 July 22, / 36

68 Sound and complete interpreter Skeletons Back to square one We still want to say that proofs are structurally decreasing. We add a skeleton type: type skeleton = S0 S1 skeleton S2 skeleton skeleton S3 skeleton skeleton skeleton It represents the shape of the proof. Nicolas Jeannerod VSTTE 17 July 22, / 36

69 Sound and complete interpreter Skeletons Back to square one We still want to say that proofs are structurally decreasing. We add a skeleton type: type skeleton = S0 S1 skeleton S2 skeleton skeleton S3 skeleton skeleton skeleton It represents the shape of the proof. Nicolas Jeannerod VSTTE 17 July 22, / 36

70 Sound and complete interpreter Skeletons Back to square one We still want to say that proofs are structurally decreasing. We add a skeleton type: type skeleton = S0 S1 skeleton S2 skeleton skeleton S3 skeleton skeleton skeleton It represents the shape of the proof. Nicolas Jeannerod VSTTE 17 July 22, / 36

71 Sound and complete interpreter Skeletons Put them everywhere In the predicate inductive eval_ term term context string behaviour context skeleton = EvalT_DoWhile_True : forall t 1 Γ σ 1 b 1 Γ 1 t 2 σ 2 b 2 Γ 2 t 3 sk1 sk2 sk3. eval_term t 1 Γ σ 1 ( BNormal b 1) Γ 1 sk1 -> eval_term t 2 Γ 1 σ 2 ( BNormal True ) Γ 2 sk2 -> eval_term ( TDoWhile t 1 t 2) Γ 2 σ 3 b 3 Γ 3 sk3 -> eval_term ( TDoWhile t 1 t 2) Γ ( concat ( concat σ 1 σ 2) σ 3) b 3 Γ 3 (S3 sk1 sk2 sk3 ) EvalT_DoWhile_False : forall t 1 Γ σ 1 b 1 Γ 1 t 3 σ 3 b 3 Γ 3 t 2 sk1 sk2. eval_term t 1 Γ σ 1 ( BNormal b 1) Γ 1 sk1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 sk2 -> ( match b 2 with BNormal False BFatal -> true _ -> false end eval_term ( TDoWhile t 1 t 2) Γ ( concat σ 1 σ 2) ( BNormal b 1) Γ 2 (S2 sk1 sk2 ) Nicolas Jeannerod VSTTE 17 July 22, / 36

72 Sound and complete interpreter Skeletons Put them everywhere In the contract let rec interp_ term ( t: term ) (Γ: context ) ( stdout : ref string ) ( ghost sk: skeleton ) : (bool, context ) requires { exists s b g. eval_ term t g s b g sk } returns { (b, Γ ) -> exists σ.! stdout = concat ( old! stdout ) σ /\ eval_ term t Γ σ ( BNormal b) Γ sk } variant { sk } Nicolas Jeannerod VSTTE 17 July 22, / 36

73 Sound and complete interpreter Skeletons Put them everywhere In the code TDoWhile t 1 t 2 -> let ghost sk1 = get_ skeleton123 sk in let (b 1, Γ 1) = interp_term t 1 Γ stdout sk1 in let (b 2, Γ 2) = try let ghost (_, sk2 ) = get_ skeleton23 sk in interp_term t 2 Γ 1 stdout sk2 with EFatal Γ 2 -> ( false, Γ 2) end in if b 2 then let ghost (_, _, sk3 ) = get_ skeleton3 sk in interp_term t Γ 2 stdout else (b 1, Γ 2) Nicolas Jeannerod VSTTE 17 July 22, / 36

74 Sound and complete interpreter Skeletons And it works! Soundness proof: 120 proof obligations; 190 seconds (i7 processor, no parallelisation); Uses Alt-Ergo, Z3 and E (crucially); Entirely automatic. Termination proof: 230 proof obligations; 510 seconds; Uses Alt-Ergo, Z3 and E; Still entirely automatic. Nicolas Jeannerod VSTTE 17 July 22, / 36

75 Conclusion CoLiS is an abstraction of a subset of Shell; Its syntax and semantics are formalised in Why3; The reference interpreter is proven sound and complete w.r.t. the semantics; This proof uses SMT solvers, superposition provers and proof trees as first class values. Thank you for your attention! Questions? Comments? Suggestions? Nicolas Jeannerod VSTTE 17 July 22, / 36

76 Conclusion CoLiS is an abstraction of a subset of Shell; Its syntax and semantics are formalised in Why3; The reference interpreter is proven sound and complete w.r.t. the semantics; This proof uses SMT solvers, superposition provers and proof trees as first class values. Thank you for your attention! Questions? Comments? Suggestions? Nicolas Jeannerod VSTTE 17 July 22, / 36

77 Shell exemple f () { echo $1 $a; } a= foo a= bar f $a ## echoes " foo bar " echo $a ## echoes " bar " Nicolas Jeannerod VSTTE 17 July 22, / 36

78 Shell exemple f () { echo $1 $a; } a= foo a= bar f $a ## echoes " foo bar " echo $a ## echoes " bar " Nicolas Jeannerod VSTTE 17 July 22, / 36

79 Syntax 1 String variables x s SVar List variables x l LVar Procedures names c F Programs p ::= vdecl pdecl program t Variables decl. vdecl ::= varstring x s varlist x l Procedures decl. pdecl ::= proc c is t Nicolas Jeannerod VSTTE 17 July 22, / 36

80 Syntax 2 Terms t ::= true false fatal return t exit t x s := s x l := l t ; t if t then t else t for x s in l do t while t do t process t pipe t into t call l shift Nicolas Jeannerod VSTTE 17 July 22, / 36

81 Syntax 3 String expressions s ::= nil s f s :: s String fragments f s ::= σ x s n t List expressions l ::= nil l f l :: l List fragments f l ::= s split s x l Nicolas Jeannerod VSTTE 17 July 22, / 36

82 Semantics First definitions Behaviours: terms b {True, False, Fatal, Return True Return False, Exit True, Exit False} Behaviours: expressions β {True, Fatal, None} Environments: strings Environments: lists SEnv [SVar String] LEnv [LVar StringList] Contexts Γ F S String StringList SEnv LEnv In a context: file system, standard input, arguments line, string environment, list environment. Nicolas Jeannerod VSTTE 17 July 22, / 36

83 Semantics First definitions Behaviours: terms b {True, False, Fatal, Return True Return False, Exit True, Exit False} Behaviours: expressions β {True, Fatal, None} Environments: strings Environments: lists SEnv [SVar String] LEnv [LVar StringList] Contexts Γ F S String StringList SEnv LEnv In a context: file system, standard input, arguments line, string environment, list environment. Nicolas Jeannerod VSTTE 17 July 22, / 36

84 Semantic judgments Judgments: terms t /Γ σ b /Γ Judgments: string fragment f s /Γ sf σ β /Γ Judgments: string expression s /Γ s σ β /Γ Judgments: list fragment f l /Γ lf λ β /Γ Judgments: list expression l /Γ l λ β /Γ Nicolas Jeannerod VSTTE 17 July 22, / 36

85 A few rules Sequence Sequence-Normal t 1/Γ σ 1 b 1/Γ1 b 1 {True, False} t 2/Γ1 σ 2 b 2/Γ2 (t 1 ; t 2 ) /Γ σ 1 σ 2 b 2/Γ2 Sequence-Exception t 1/Γ σ 1 b 1/Γ1 b 1 {Fatal, Return, Exit } (t 1 ; t 2 ) /Γ σ 1 b 1/Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

86 A few rules Sequence Sequence-Normal t 1/Γ σ 1 b 1/Γ1 b 1 {True, False} t 2/Γ1 σ 2 b 2/Γ2 (t 1 ; t 2 ) /Γ σ 1 σ 2 b 2/Γ2 Sequence-Exception t 1/Γ σ 1 b 1/Γ1 b 1 {Fatal, Return, Exit } (t 1 ; t 2 ) /Γ σ 1 b 1/Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

87 A few rules Branching Branching-True t 1/Γ σ 1 b 1/Γ1 b 1 = True t 2/Γ2 σ 2 b 2/Γ2 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 2 b 2/Γ2 Branching-False t 1/Γ σ 1 b 1/Γ1 b 1 {False, Fatal} t 3/Γ3 σ 3 b 3/Γ3 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 3 b 3/Γ3 Branching-Exception t 1/Γ σ 1 b 1/Γ1 b 1 {Return, Exit } (if t 1 then t 2 else t 3 ) /Γ σ 1 b 1/Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

88 A few rules Branching Branching-True t 1/Γ σ 1 b 1/Γ1 b 1 = True t 2/Γ2 σ 2 b 2/Γ2 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 2 b 2/Γ2 Branching-False t 1/Γ σ 1 b 1/Γ1 b 1 {False, Fatal} t 3/Γ3 σ 3 b 3/Γ3 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 3 b 3/Γ3 Branching-Exception t 1/Γ σ 1 b 1/Γ1 b 1 {Return, Exit } (if t 1 then t 2 else t 3 ) /Γ σ 1 b 1/Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

89 A few rules Branching Branching-True t 1/Γ σ 1 b 1/Γ1 b 1 = True t 2/Γ2 σ 2 b 2/Γ2 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 2 b 2/Γ2 Branching-False t 1/Γ σ 1 b 1/Γ1 b 1 {False, Fatal} t 3/Γ3 σ 3 b 3/Γ3 (if t 1 then t 2 else t 3 ) /Γ σ 1 σ 3 b 3/Γ3 Branching-Exception t 1/Γ σ 1 b 1/Γ1 b 1 {Return, Exit } (if t 1 then t 2 else t 3 ) /Γ σ 1 b 1/Γ1 Nicolas Jeannerod VSTTE 17 July 22, / 36

90 A few rules Sequence EvalT_Seq_Normal : forall t 1 Γ σ 1 b 1 Γ 1 t 2 σ 2 b 2 Γ 2. eval_term t 1 Γ σ 1 ( BNormal b 1) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> eval_term ( TSeq t 1 t 2) Γ ( concat σ 1 σ 2) b 2 Γ 2 EvalT_Seq_Error : forall t 1 Γ σ 1 b 1 Γ 1 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal _ -> false _ -> true end ) -> eval_term ( TSeq t 1 t 2) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

91 A few rules Sequence EvalT_Seq_Normal : forall t 1 Γ σ 1 b 1 Γ 1 t 2 σ 2 b 2 Γ 2. eval_term t 1 Γ σ 1 ( BNormal b 1) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> eval_term ( TSeq t 1 t 2) Γ ( concat σ 1 σ 2) b 2 Γ 2 EvalT_Seq_Error : forall t 1 Γ σ 1 b 1 Γ 1 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal _ -> false _ -> true end ) -> eval_term ( TSeq t 1 t 2) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

92 A few rules Branching EvalT_If_True : forall t 1 Γ σ 1 Γ 1 t 2 σ 2 b 2 Γ 2 t 3. eval_term t 1 Γ σ 1 ( BNormal True ) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 2) b 2 Γ 2 EvalT_If_False : forall t 1 Γ σ 1 b 1 Γ 1 t 3 σ 3 b 3 Γ 3 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal False BFatal -> true _ -> false end eval_term t 3 Γ 1 σ 3 b 3 Γ 3 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 3) b 3 Γ 3 EvalT_If_Transmit : forall t 1 Γ σ 1 b 1 Γ 1 t 2 t 3. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BReturn _ BExit _ -> true _ -> false end ) - eval_term ( TIf t 1 t 2 t 3) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

93 A few rules Branching EvalT_If_True : forall t 1 Γ σ 1 Γ 1 t 2 σ 2 b 2 Γ 2 t 3. eval_term t 1 Γ σ 1 ( BNormal True ) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 2) b 2 Γ 2 EvalT_If_False : forall t 1 Γ σ 1 b 1 Γ 1 t 3 σ 3 b 3 Γ 3 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal False BFatal -> true _ -> false end eval_term t 3 Γ 1 σ 3 b 3 Γ 3 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 3) b 3 Γ 3 EvalT_If_Transmit : forall t 1 Γ σ 1 b 1 Γ 1 t 2 t 3. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BReturn _ BExit _ -> true _ -> false end ) - eval_term ( TIf t 1 t 2 t 3) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36

94 A few rules Branching EvalT_If_True : forall t 1 Γ σ 1 Γ 1 t 2 σ 2 b 2 Γ 2 t 3. eval_term t 1 Γ σ 1 ( BNormal True ) Γ 1 -> eval_term t 2 Γ 1 σ 2 b 2 Γ 2 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 2) b 2 Γ 2 EvalT_If_False : forall t 1 Γ σ 1 b 1 Γ 1 t 3 σ 3 b 3 Γ 3 t 2. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BNormal False BFatal -> true _ -> false end eval_term t 3 Γ 1 σ 3 b 3 Γ 3 -> eval_term ( TIf t 1 t 2 t 3) Γ ( concat σ 1 σ 3) b 3 Γ 3 EvalT_If_Transmit : forall t 1 Γ σ 1 b 1 Γ 1 t 2 t 3. eval_term t 1 Γ σ 1 b 1 Γ 1 -> ( match b 1 with BReturn _ BExit _ -> true _ -> false end ) - eval_term ( TIf t 1 t 2 t 3) Γ σ 1 b 1 Γ 1 Nicolas Jeannerod VSTTE 17 July 22, / 36