diff options
Diffstat (limited to 'FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic')
3 files changed, 152 insertions, 0 deletions
diff --git a/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/Configurations.json b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/Configurations.json new file mode 100644 index 000000000..0acbc976e --- /dev/null +++ b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/Configurations.json @@ -0,0 +1,74 @@ +# +# FreeRTOS memory safety proofs with CBMC. +# Copyright (C) 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. +# +# Permission is hereby granted, free of charge, to any person +# obtaining a copy of this software and associated documentation +# files (the "Software"), to deal in the Software without +# restriction, including without limitation the rights to use, copy, +# modify, merge, publish, distribute, sublicense, and/or sell copies +# of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be +# included in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS +# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN +# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +# SOFTWARE. +# +# http://aws.amazon.com/freertos +# http://www.FreeRTOS.org +# + +{ + "ENTRY": "QueueGenericCreateStatic", + + # A CBMC pointer is an object id followed by an offset into the object. + # The size of the offset is limited by the size of the object id. + "CBMC_OBJECT_BITS": "7", + "CBMC_OBJECT_MAX_SIZE": "\"((UINT32_MAX>>(CBMC_OBJECT_BITS+1))\"", + + "CBMCFLAGS": [ + "--unwind 1", + "--signed-overflow-check", + "--pointer-overflow-check", + "--unsigned-overflow-check" + ], + "OBJS": [ + "$(ENTRY)_harness.goto", + "$(FREERTOS)/Source/queue.goto", + "$(FREERTOS)/Source/list.goto" + ], + "DEF": [ + { + "QeueuGenericCreateStatic_DynamicAllocation": [ + "CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}", + "CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}", + "configUSE_TRACE_FACILITY=0", + "configGENERATE_RUN_TIME_STATS=0", + "configSUPPORT_STATIC_ALLOCATION=1", + "configSUPPORT_DYNAMIC_ALLOCATION=1" + ] + }, + { + "QeueuGenericCreateStatic_NoDynamicAllocation": [ + "CBMC_OBJECT_BITS={CBMC_OBJECT_BITS}", + "CBMC_OBJECT_MAX_SIZE={CBMC_OBJECT_MAX_SIZE}", + "configUSE_TRACE_FACILITY=0", + "configGENERATE_RUN_TIME_STATS=0", + "configSUPPORT_STATIC_ALLOCATION=1", + "configSUPPORT_DYNAMIC_ALLOCATION=0" + ] + } + ], + "GENERATE_HEADER": [ + "queue_datastructure.h" + ] +} + diff --git a/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/QueueGenericCreateStatic_harness.c b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/QueueGenericCreateStatic_harness.c new file mode 100644 index 000000000..553661cb2 --- /dev/null +++ b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/QueueGenericCreateStatic_harness.c @@ -0,0 +1,62 @@ +/* + * FreeRTOS memory safety proofs with CBMC. + * Copyright (C) 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Permission is hereby granted, free of charge, to any person + * obtaining a copy of this software and associated documentation + * files (the "Software"), to deal in the Software without + * restriction, including without limitation the rights to use, copy, + * modify, merge, publish, distribute, sublicense, and/or sell copies + * of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + * + * http://aws.amazon.com/freertos + * http://www.FreeRTOS.org + */ + +#include "FreeRTOS.h" +#include "queue.h" +#include "queue_datastructure.h" +#include "cbmc.h" + +void harness(){ + UBaseType_t uxQueueLength; + UBaseType_t uxItemSize; + + size_t uxQueueStorageSize; + uint8_t *pucQueueStorage = (uint8_t *) pvPortMalloc(uxQueueStorageSize); + + StaticQueue_t *pxStaticQueue = + (StaticQueue_t *) pvPortMalloc(sizeof(StaticQueue_t)); + + uint8_t ucQueueType; + + __CPROVER_assume(uxQueueStorageSize < (UINT32_MAX>>8)); + + // QueueGenericReset does not check for multiplication overflow + __CPROVER_assume(uxItemSize < uxQueueStorageSize/uxQueueLength); + + // QueueGenericCreateStatic asserts positive queue length + __CPROVER_assume(uxQueueLength > ( UBaseType_t ) 0); + + // QueueGenericCreateStatic asserts the following equivalence + __CPROVER_assume( ( pucQueueStorage && uxItemSize ) || + ( !pucQueueStorage && !uxItemSize ) ); + + // QueueGenericCreateStatic asserts nonnull pointer + __CPROVER_assume(pxStaticQueue); + + xQueueGenericCreateStatic( uxQueueLength, uxItemSize, pucQueueStorage, pxStaticQueue, ucQueueType ); +} diff --git a/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/README.md b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/README.md new file mode 100644 index 000000000..fb1466647 --- /dev/null +++ b/FreeRTOS/Test/CBMC/proofs/Queue/QueueGenericCreateStatic/README.md @@ -0,0 +1,16 @@ +The harness proves memory safety of +QueueGenericCreateStatic under the assumption made in the harness. + +The principal assumption is that (uxItemSize * uxQueueLength) + sizeof(Queue_t) +does not overflow. Further, ucQueueStorage must only be null iff uxItemSize is null. +In addition, the passed queue storage is assumed to be allocated to the right size. + +The configurations for configSUPPORT_DYNAMIC_ALLOCATION set to 0 and 1 are checked. + +This proof is a work-in-progress. Proof assumptions are described in +the harness. The proof also assumes the following functions are +memory safe and have no side effects relevant to the memory safety of +this function: + +* vPortEnterCritical +* vPortExitCritical |