RV-Match: Practical Semantics-Based Program Analysis

Abstract

We present RV-Match, a tool for checking C programs for undefined behavior and other common programmer mistakes. Our tool is extracted from the most complete formal semantics of the C11 language. Previous versions of this tool were used primarily for testing the correctness of the semantics, but we have improved it into a tool for doing practical analysis of real C programs. It beats many similar tools in its ability to catch a broad range of undesirable behaviors. We demonstrate this with comparisons based on a third-party benchmark.

Exploring C semantics and pointer provenance

“…This takes 0.15s for 1000 iterations, 1.27s for 10 000, and 12.7s for 100 000, apparently scaling linearly. Guth et al [2016] report a compile-and-run time of 13s (on an 2.4 GHz Intel Xeon) for 10 000 iterations. int ret = 0; for (int i = 0; i <= [...]; i++) { ret++; } More importantly, the time needed to run most of the above test suites is quite reasonable: 22.5s to run our pointer provenance tests and many others (189 in total); 3 minutes to run the GCC Torture tests; and 25 minutes for those Csmith tests.…”

“…We discuss much of this in detail in [Chisnall et al 2016, ğ10, p66ś83], and [Krebbers 2015, Ch.10] gives a useful survey. Work to formalise aspects of the standards includes Batty et al [2011]; Cook and Subramanian [1994]; Ellison and Roşu [2012]; Gurevich and Huggins [1993]; Guth et al [2016]; Hathhorn et al [2015]; Krebbers and Wiedijk [2012]; Krebbers [2013Krebbers [ , 2014Krebbers [ , 2015; Wiedijk [2013, 2015]; Norrish [1998Norrish [ , 1999; Papaspyrou [1998]. Memory object models include those for CompCert by Leroy et al [2012]; Leroy and Blazy [2008] and Besson et al [2014Besson et al [ , 2015, for CompCertTSO by Ševčík et al [2013], the model used for seL4 verification by Tuch et al [2007], and the model used for VCC by Cohen et al [2009].…”

“…The most closely related work to Cerberus as a whole is the KCC work of Ellison and Hathhorn, et al This has been developed into a commercial product, RV-Match [Guth et al 2016; Runtime Verification Inc. 2017], which claims to be a "complete formal ISO C11 semanticsž. RV-Match aims…”

“…Cerberus now also identifies many of the clauses of the ISO C standard text captured by its definitions of type-checking and elaboration, displaying these in the GUI. The project page includes data for various compilers and other tools for these tests: GCC 8.1, Clang 6.0, ICC 19, UBSAN, ASAN, MSAN, CompCert [Leroy 2009;Leroy et al 2018], RV-Match [Guth et al 2016], CH2O [Krebbers 2015], and CHERI Watson et al 2018Woodruff et al 2014]. We include extensive validation of the combination of Cerberus and our provenance semantics on various existing test suites (ğ9): the GCC torture tests [FSF 2018a], the ITC Toyota benchmark [Shiraishi et al 2015], the KCC example test suite [Hathhorn et al 2015;KCC 2018], and a family of Csmith tests [Regehr et al 2012].…”

Cerberus-BMC: A Principled Reference Semantics and Exploration Tool for Concurrent and Sequential C

“…We build here on Cerberus [28,29,31], a web-interface tool that computes the allowed behaviours (interactively or exhaustively) for moderate-sized tests in a substantial fragment of sequential C, incorporating various memory object models (an early version supported Nienhuis's operational model for C11 concurrency [33], but that is no longer integrated). KCC and RV-Match [19,21,22] provide a command-line semantics tool for a substantial fragment of C, again without concurrency. Krebbers gives a Coq semantics for a somewhat smaller fragment [24].…”