Formal Verification of a C Value Analysis Based on Abstract Interpretation

Abstract

Abstract. Static analyzers based on abstract interpretation are complex pieces of software implementing delicate algorithms. Even if static analysis techniques are well understood, their implementation on real languages is still error-prone. This paper presents a formal verification using the Coq proof assistant: a formalization of a value analysis (based on abstract interpretation), and a soundness proof of the value analysis. The formalization relies on generic interfaces. The mechanized proof is facilitated by a translation validation of a Bourdoncle fixpoint iterator. The work has been integrated into the CompCert verified C-compiler. Our verified analysis directly operates over an intermediate language of the compiler having the same expressiveness as C. The automatic extraction of our value analysis into OCaml yields a program with competitive results, obtained from experiments on a number of benchmarks and comparisons with the Frama-C tool.

Formal Verification of Loop Bound Estimation for WCET Analysis

“…A value analysis is usually based on abstract interpretation and uses widening and narrowing operators to speed up fixpoint resolution. The formal verification of a value analysis based on abstract interpretation and operating over a real-world language raises many challenging verification problems that are detailed in [7].…”

“…the estimated values (represented by an interval) of the program variables. Thus, given a program P and a vertex l, value(P )(l) yields a map such that for any variable x, value(P )(l)(x) is an interval Our formally verified value analysis is detailed in [7].…”

Verified Abstract Interpretation Techniques for Disassembling Low-level Self-modifying Code

“…An abstract memory domain is a carrier type along with some primitive operators whose signatures are given in Figure 4. The ab_num type refers to a numeric abstract domain, as described in [3]: we only require that this type is equipped with a concretization to sets of machine integers and abstract transformers corresponding to arithmetic operations.…”

“…In a previous work [3], we formally verified a value analysis for an intermediate language of the Compcert C compiler toolchain. The current work shares the same notion of abstract numerical domain but develops its own notion of memory abstraction, dynamic control-flow graph reconstruction and trace partitioning.…”

“…Indeed a prerequisite in such semantics is the isolation and the non-modification of code in memory. Turning to verified static analyses, they operate over toy languages [5,16] or more recently over realistic C-like languages [18,3], but they assume that the control-flow graph is extracted by a preliminary step, and thus they do not encompass techniques devoted to self-modifying code.…”