Semi-automated Reasoning About Non-determinism in C Expressions

Abstract

Research into C verification often ignores that the C standard leaves the evaluation order of expressions unspecified, and assigns undefined behavior to write-write or read-write conflicts in subexpressionsso called "sequence point violations". These aspects should be accounted for in verification because C compilers exploit them.We present a verification condition generator (vcgen) that enables one to semi-automatically prove the absence of undefined behavior in a given C program for any evaluation order. The key novelty of our approach is a symbolic execution algorithm that computes a frame at the same time as a postcondition. The frame is used to automatically determine how resources should be distributed among subexpressions.We prove correctness of our vcgen with respect to a new monadic definitional semantics of a subset of C. This semantics is modular and gives a concise account of non-determinism in C.We have implemented our vcgen as a tactic in the Coq interactive theorem prover, and have proved correctness of it using a separation logic for the new monadic definitional semantics of a subset of C.

The Right Kind of Non-Determinism: Using Concurrency to Verify C Programs with Underspecified Semantics

“…They either fix an evaluation order and can (wrongly) prove a stronger result, i.e., that the result is always the nth Fibonacci number (Frama-C, RV-match), do not support specification of global invariants of ACSL (Frama-C) or do not support verification at all(Cerberus). We do not compare our approach explicitly with the theory presented by Frumin et al [17], which does treat underspecification correctly, but not for C and requires manual translation and manual specification of the translated program in the target formalism and an interactive proof.…”

“…Cerberus [4,33] is an analysis tool for undefined and underspecified behavior; however, it cannot utilize any specifications and its treatment of unspecified evaluation order of side effects does not match the C standard, as demonstrated in [37]. The separation logic system of Frumin et al [17], based on small-step semantics in Coq [30] correctly treats underspecification. They give a formal system to verify a program in their toy language λ MC and check effects of underspecified behavior with a modified separation logic.…”

Deductive Verification of Programs with Underspecified Semantics by Model Extraction

“…Cerberus [4,35] is an analysis tool for undefined and underspecified behavior; however, it cannot utilize any specifications and its treatment of unspecified evaluation order of side effects does not match the C standard, as demonstrated in [39]. The separation logic system of Frumin et al [20], based on small-step semantics in Coq [33] correctly treats underspecification. They give a formal system to verify a program in their toy language λMC and check effects of underspecified behavior with a modified separation logic.…”