CompCertM: CompCert with C-assembly linking and lightweight modular verification

Abstract

Supporting multi-language linking such as linking C and handwritten assembly modules in the verified compiler CompCert requires a more compositional verification technique than that used in CompCert just supporting separate compilation. The two extensions, CompCertX and Compositional CompCert, supporting multi-language linking take different approaches. The former simplifies the problem by imposing restrictions that the source modules should have no mutual dependence and be verified against certain well-behaved specifications. On the other hand, the latter develops a new verification technique that directly solves the problem but at the expense of significantly increasing the verification cost.In this paper, we develop a novel lightweight verification technique, called RUSC (Refinement Under Self-related Contexts), and demonstrate how RUSC can solve the problem without any restrictions but still with low verification overhead. For this, we develop CompCertM, a full extension of the latest version of CompCert supporting multi-language linking. Moreover, we demonstrate the power of RUSC as a program verification technique by modularly verifying interesting programs consisting of C and handwritten assembly against their mathematical specifications.

Formally verified speculation and deoptimization in a JIT compiler

“…This raises the challenge of modular verification and CoreIR-assembly linking. A promising step toward this direction would be to study the RUSC refinement technique of CompCertM [Song et al 2019].…”

CompCertO: compiling certified open C components

“…As a result, common wisdom holds semantics preservation to be a lost cause for compositional compiler correctness [20]. Instead, research has focused on compositional reasoning methods based on contextual refinement, side-stepping the need for compositional semantics preservation [10,22].…”

“…Existing work attempts to recover this uniformity by using more general notions of correctness covering all passes [22,23] or by delaying pass composition so that it operates on closed semantics only [10,22]. Unfortunately, these techniques either conflict with our requirement #2, make proofs more complex, or cascade into subtle łimpedance mismatchž problems requiring their own solutions (see ğ6).…”

“…In combination, these two examples show how our framework handles ownership constraints using conditions like injp already present in CompCert. It does not require sophisticated permission maps as in other approaches [22,23].…”

“…As in our case, semantic linking is shown to preserve simulations (Thm. 3.4), however semantic linking is not related to syntactic linking of assembly programs, and this was later shown to present difficulties [22].…”