Remove or rework assumptions in queue proofs (#603)

This commit is paired with another to queue.c in the kernel.  To
accomodate changes in newer versions of CBMC, the
--pointer-overflow-check is removed.
This commit is contained in:
Dan Good
2021-06-04 15:42:14 -04:00
committed by GitHub
parent d9ddcc0134
commit b6624fa44d
33 changed files with 57 additions and 124 deletions

View File

@ -44,15 +44,6 @@ diff --git a/FreeRTOS/Source/tasks.c b/FreeRTOS/Source/tasks.c
index c7be57cb2..9f76465d5 100644 index c7be57cb2..9f76465d5 100644
--- a/FreeRTOS/Source/tasks.c --- a/FreeRTOS/Source/tasks.c
+++ b/FreeRTOS/Source/tasks.c +++ b/FreeRTOS/Source/tasks.c
@@ -296,7 +296,7 @@ typedef struct tskTaskControlBlock /* The old naming convention is used to
#if ( configUSE_NEWLIB_REENTRANT == 1 )
/* Allocate a Newlib reent structure that is specific to this task.
- * Note Newlib support has been included by popular demand, but is not
+ Note Newlib support has been included by popular demand, but is not
* used by the FreeRTOS maintainers themselves. FreeRTOS is not
* responsible for resulting newlib operation. User must be familiar with
* newlib and must provide system-wide implementations of the necessary
@@ -343,8 +343,8 @@ PRIVILEGED_DATA TCB_t * volatile pxCurrentTCB = NULL; @@ -343,8 +343,8 @@ PRIVILEGED_DATA TCB_t * volatile pxCurrentTCB = NULL;
PRIVILEGED_DATA static List_t pxReadyTasksLists[ configMAX_PRIORITIES ]; /*< Prioritised ready tasks. */ PRIVILEGED_DATA static List_t pxReadyTasksLists[ configMAX_PRIORITIES ]; /*< Prioritised ready tasks. */
PRIVILEGED_DATA static List_t xDelayedTaskList1; /*< Delayed tasks. */ PRIVILEGED_DATA static List_t xDelayedTaskList1; /*< Delayed tasks. */

View File

@ -1,13 +0,0 @@
diff --git a/FreeRTOS/Source/queue.c b/FreeRTOS/Source/queue.c
index b01dfd11f..b219b599a 100644
--- a/FreeRTOS/Source/queue.c
+++ b/FreeRTOS/Source/queue.c
@@ -395,7 +395,7 @@ BaseType_t xQueueGenericReset( QueueHandle_t xQueue,
xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */
/* Check for multiplication overflow. */
- configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );
+ /* configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) ); */
/* Check for addition overflow. */
configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) > xQueueSizeInBytes );

View File

@ -138,12 +138,11 @@ report: cbmc.txt property.xml coverage.xml
$(VIEWER) \ $(VIEWER) \
--goto $(ENTRY).goto \ --goto $(ENTRY).goto \
--srcdir $(FREERTOS) \ --srcdir $(FREERTOS) \
--blddir $(FREERTOS) \ --reportdir html \
--htmldir html \ --exclude "(.@FORWARD_SLASH@Demo)" \
--srcexclude "(.@FORWARD_SLASH@Demo)" \
--result cbmc.txt \ --result cbmc.txt \
--property property.xml \ --property property.xml \
--block coverage.xml --coverage coverage.xml
# This rule depends only on cbmc.txt and has no dependents, so it will # This rule depends only on cbmc.txt and has no dependents, so it will
# not block the report from being generated if it fails. This rule is # not block the report from being generated if it fails. This rule is

View File

@ -3,18 +3,20 @@
"PROOFS": [ "." ], "PROOFS": [ "." ],
"DEF ": [ "DEF ": [
"_DEBUG", "_DEBUG",
"__free_rtos__", "__free_rtos__",
"_CONSOLE", "_CONSOLE",
"_WIN32_WINNT=0x0500", "_WIN32_WINNT=0x0500",
"WINVER=0x400", "WINVER=0x400",
"_CRT_SECURE_NO_WARNINGS", "_CRT_SECURE_NO_WARNINGS",
"__PRETTY_FUNCTION__=__FUNCTION__", "__PRETTY_FUNCTION__=__FUNCTION__",
"CBMC", "CBMC",
"'configASSERT(X)=__CPROVER_assert(X,\"Assertion Error\")'", "'configASSERT(X)='",
"'configPRECONDITION(X)=__CPROVER_assume(X)'", "'configPRECONDITION(X)=__CPROVER_assume(X)'",
"'_static='", "'_static='",
"'_volatile='" "'_volatile='",
"QUEUE_LENGTH=15",
"QUEUE_ITEM_SIZE=990"
], ],
"INC ": [ "INC ": [
@ -31,10 +33,10 @@
], ],
"CBMCFLAGS ": [ "CBMCFLAGS ": [
"--object-bits 7", "--object-bits 7",
"--32", "--32",
"--bounds-check", "--bounds-check",
"--pointer-check" "--pointer-check"
], ],
"FORWARD_SLASH": ["/"], "FORWARD_SLASH": ["/"],

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -32,13 +32,10 @@
#include "cbmc.h" #include "cbmc.h"
void harness(){ void harness()
{
UBaseType_t uxMaxCount; UBaseType_t uxMaxCount;
UBaseType_t uxInitialCount; UBaseType_t uxInitialCount;
__CPROVER_assume(uxMaxCount != 0);
__CPROVER_assume(uxInitialCount <= uxMaxCount);
xQueueCreateCountingSemaphore( uxMaxCount, uxInitialCount ); xQueueCreateCountingSemaphore( uxMaxCount, uxInitialCount );
} }

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,15 +31,12 @@
#include "cbmc.h" #include "cbmc.h"
void harness(){ void harness()
{
UBaseType_t uxMaxCount; UBaseType_t uxMaxCount;
UBaseType_t uxInitialCount; UBaseType_t uxInitialCount;
StaticQueue_t * pxStaticQueue = ( StaticQueue_t * ) pvPortMalloc( sizeof( StaticQueue_t ) );
//xStaticQueue is required to be not null
StaticQueue_t xStaticQueue;
//Checked invariant xQueueCreateCountingSemaphoreStatic( uxMaxCount, uxInitialCount, pxStaticQueue );
__CPROVER_assume(uxMaxCount != 0);
__CPROVER_assume(uxInitialCount <= uxMaxCount);
xQueueCreateCountingSemaphoreStatic( uxMaxCount, uxInitialCount, &xStaticQueue );
} }

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,11 +31,10 @@
#include "cbmc.h" #include "cbmc.h"
void harness(){ void harness()
{
uint8_t ucQueueType; uint8_t ucQueueType;
StaticQueue_t * pxStaticQueue = ( StaticQueue_t * ) pvPortMalloc( sizeof( StaticQueue_t ) );
//The mutex storage is assumed to be not null. xQueueCreateMutexStatic( ucQueueType, pxStaticQueue );
StaticQueue_t xStaticQueue;
xQueueCreateMutexStatic( ucQueueType, &xStaticQueue );
} }

View File

@ -38,7 +38,6 @@
[ [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],

View File

@ -32,19 +32,14 @@
#include "cbmc.h" #include "cbmc.h"
void harness(){ void harness()
UBaseType_t uxQueueLength; {
UBaseType_t uxItemSize; UBaseType_t uxQueueLength;
uint8_t ucQueueType; UBaseType_t uxItemSize;
uint8_t ucQueueType;
size_t uxQueueStorageSize; /* Allow CBMC to run in a reasonable amount of time. */
__CPROVER_assume(uxQueueStorageSize < (UINT32_MAX>>8)); __CPROVER_assume( ( uxQueueLength == QUEUE_LENGTH ) || ( uxItemSize == QUEUE_ITEM_SIZE ) );
// QueueGenericCreate does not check for multiplication overflow xQueueGenericCreate( uxQueueLength, uxItemSize, ucQueueType );
__CPROVER_assume(uxItemSize < uxQueueStorageSize/uxQueueLength);
// QueueGenericCreate asserts positive queue length
__CPROVER_assume(uxQueueLength > ( UBaseType_t ) 0);
xQueueGenericCreate( uxQueueLength, uxItemSize, ucQueueType );
} }

View File

@ -37,7 +37,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [
@ -48,8 +47,8 @@
"DEF": [ "DEF": [
{ {
"QeueuGenericCreateStatic_DynamicAllocation": [ "QeueuGenericCreateStatic_DynamicAllocation": [
"CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}", "CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}",
"CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}", "CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}",
"configUSE_TRACE_FACILITY=0", "configUSE_TRACE_FACILITY=0",
"configGENERATE_RUN_TIME_STATS=0", "configGENERATE_RUN_TIME_STATS=0",
"configSUPPORT_STATIC_ALLOCATION=1", "configSUPPORT_STATIC_ALLOCATION=1",
@ -58,8 +57,8 @@
}, },
{ {
"QeueuGenericCreateStatic_NoDynamicAllocation": [ "QeueuGenericCreateStatic_NoDynamicAllocation": [
"CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}", "CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}",
"CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}", "CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}",
"configUSE_TRACE_FACILITY=0", "configUSE_TRACE_FACILITY=0",
"configGENERATE_RUN_TIME_STATS=0", "configGENERATE_RUN_TIME_STATS=0",
"configSUPPORT_STATIC_ALLOCATION=1", "configSUPPORT_STATIC_ALLOCATION=1",

View File

@ -31,32 +31,22 @@
#include "queue_datastructure.h" #include "queue_datastructure.h"
#include "cbmc.h" #include "cbmc.h"
void harness(){ void harness()
{
UBaseType_t uxQueueLength; UBaseType_t uxQueueLength;
UBaseType_t uxItemSize; UBaseType_t uxItemSize;
size_t uxQueueStorageSize;
uint8_t *pucQueueStorage = (uint8_t *) pvPortMalloc(uxQueueStorageSize);
StaticQueue_t *pxStaticQueue =
(StaticQueue_t *) pvPortMalloc(sizeof(StaticQueue_t));
uint8_t ucQueueType; uint8_t ucQueueType;
size_t storageSize;
__CPROVER_assume(uxQueueStorageSize < (UINT32_MAX>>8)); /* Allow CBMC to run in a reasonable amount of time. */
__CPROVER_assume( ( uxQueueLength == QUEUE_LENGTH ) || ( uxItemSize == QUEUE_ITEM_SIZE ) );
// QueueGenericReset does not check for multiplication overflow /* Prevent overflow in this harness. */
__CPROVER_assume(uxItemSize < uxQueueStorageSize/uxQueueLength); __CPROVER_assume( ( uxQueueLength > 0 ) && ( ( storageSize / uxQueueLength ) == uxItemSize ) );
// QueueGenericCreateStatic asserts positive queue length uint8_t * pucQueueStorage = ( uint8_t * ) pvPortMalloc( storageSize );
__CPROVER_assume(uxQueueLength > ( UBaseType_t ) 0);
// QueueGenericCreateStatic asserts the following equivalence StaticQueue_t * pxStaticQueue = ( StaticQueue_t * ) pvPortMalloc( sizeof( StaticQueue_t ) );
__CPROVER_assume( ( pucQueueStorage && uxItemSize ) ||
( !pucQueueStorage && !uxItemSize ) );
// QueueGenericCreateStatic asserts nonnull pointer
__CPROVER_assume(pxStaticQueue);
xQueueGenericCreateStatic( uxQueueLength, uxItemSize, pucQueueStorage, pxStaticQueue, ucQueueType ); xQueueGenericCreateStatic( uxQueueLength, uxItemSize, pucQueueStorage, pxStaticQueue, ucQueueType );
} }

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -34,12 +34,11 @@
struct QueueDefinition; struct QueueDefinition;
void harness() { void harness()
BaseType_t xNewQueue; {
BaseType_t xNewQueue;
QueueHandle_t xQueue = xUnconstrainedQueue(); QueueHandle_t xQueue = xUnconstrainedQueue();
if(xQueue != NULL)
{ xQueueGenericReset( xQueue, xNewQueue );
xQueueGenericReset(xQueue, xNewQueue);
}
} }

View File

@ -33,7 +33,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--unwindset xQueueGenericSend.0:{QUEUE_SEND_BOUND},prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}", "--unwindset xQueueGenericSend.0:{QUEUE_SEND_BOUND},prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}",
"--nondet-static" "--nondet-static"

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--nondet-static" "--nondet-static"
], ],

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--nondet-static" "--nondet-static"
], ],

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -33,7 +33,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND},xQueuePeek.0:{QUEUE_PEEK_BOUND}", "--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND},xQueuePeek.0:{QUEUE_PEEK_BOUND}",
"--nondet-static" "--nondet-static"

View File

@ -33,7 +33,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--unwindset xQueueReceive.0:{QUEUE_RECEIVE_BOUND},prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}", "--unwindset xQueueReceive.0:{QUEUE_RECEIVE_BOUND},prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}",
"--nondet-static" "--nondet-static"

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -35,7 +35,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 2", "--unwind 2",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--nondet-static", "--nondet-static",
"--unwindset prvUnlockQueue.0:{QUEUE_BOUND},prvUnlockQueue.1:{QUEUE_BOUND},xQueueSemaphoreTake.0:3" "--unwindset prvUnlockQueue.0:{QUEUE_BOUND},prvUnlockQueue.1:{QUEUE_BOUND},xQueueSemaphoreTake.0:3"

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -38,7 +38,6 @@
"--unwind {QueueSemaphoreTake_BOUND}", "--unwind {QueueSemaphoreTake_BOUND}",
"--unwindset prvUnlockQueue.0:{PRV_UNLOCK_UNWINDING_BOUND},prvUnlockQueue.1:{PRV_UNLOCK_UNWINDING_BOUND}", "--unwindset prvUnlockQueue.0:{PRV_UNLOCK_UNWINDING_BOUND},prvUnlockQueue.1:{PRV_UNLOCK_UNWINDING_BOUND}",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -31,7 +31,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check" "--unsigned-overflow-check"
], ],
"OBJS": [ "OBJS": [

View File

@ -32,7 +32,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}" "--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}"
], ],

View File

@ -32,7 +32,6 @@
"CBMCFLAGS": [ "CBMCFLAGS": [
"--unwind 1", "--unwind 1",
"--signed-overflow-check", "--signed-overflow-check",
"--pointer-overflow-check",
"--unsigned-overflow-check", "--unsigned-overflow-check",
"--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}" "--unwindset prvUnlockQueue.0:{LOCK_BOUND},prvUnlockQueue.1:{LOCK_BOUND}"
], ],