Types, bytes, and separation logic

Abstract

We present a formal model of memory that both captures the lowlevel features of C's pointers and memory, and that forms the basis for an expressive implementation of separation logic. At the low level, we do not commit common oversimplifications, but correctly deal with C's model of programming language values and the heap. At the level of separation logic, we are still able to reason abstractly and efficiently. We implement this framework in the theorem prover Isabelle/HOL and demonstrate it on two case studies. We show that the divide between detailed and abstract does not impose undue verification overhead, and that simple programs remain easy to verify. We also show that the framework is applicable to real, security-and safety-critical code by formally verifying the memory allocator of the L4 microkernel.

Deductive software verification

“…Examples of such systems successfully used in software verification include Coq [50], PVS [43], Isabelle [44], and ACL2 [31]. This approach has obvious benefits.…”

Refinement in the Formal Verification of the seL4 Microkernel

“…This allows, for example, the C function memset, which sets each byte in a region of the heap to a given value. We generally use a more abstract interface to this heap: we use additional typing information to lift the heap into functions from typed pointers to Isabelle terms; see Tuch et al [21,20] for more detail.…”

Formal Memory Models for the Verification of Low-Level Operating-System Code

“…In [30], Tuch and Klein impose a typed heap abstraction on this untyped, byte-oriented memory to simplify reasoning about type-correct programs. Tuch et al [28,29,31] later combined this typed view with separation logic to address the problem of aliasing between variables of the same type. The problem of virtualmemory aliases, however, has been considered in the context of the L4.verified project only recently.…”