Development of a Translator from LLVM to ACL2

Abstract

In our current work a library of formally verified software components is to be created, and assembled, using the Low-Level Virtual Machine (LLVM) intermediate form, into subsystems whose top-level assurance relies on the assurance of the individual components. We have thus undertaken a project to build a translator from LLVM to the applicative subset of Common Lisp accepted by the ACL2 theorem prover. Our translator produces executable ACL2 formal models, allowing us to both prove theorems about the translated models as well as validate those models by testing. The resulting models can be translated and certified without user intervention, even for code with loops, thanks to the use of the def::ung macro which allows us to defer the question of termination. Initial measurements of concrete execution for translated LLVM functions indicate that performance is nearly 2.4 million LLVM instructions per second on a typical laptop computer. In this paper we overview the translation process and illustrate the translator's capabilities by way of a concrete example, including both a functional correctness theorem as well as a validation test for that example.

Fix Your Types

“…Despite type hypotheses, macros like defstructure, defaggregate, and defdata are certainly very useful. Defstructure has long been used in ACL2 developments, including recent work such as the modeling by Hardin, et al [13] of the LLVM compiler project's intermediate form in ACL2, and the formalization by van Gastel and Schmaltz [9] of the xMAS language for communication networks on multi-core processors and systems-on-chip. For many years, we used defaggregate and other std/util macros at Centaur as the basis for our VL library, microcode model [7], and other internal applications.…”

Reasoning About LLVM Code Using Codewalker

“…LLVM code for this function is produced by invoking clang as follows: clang -O1 -S -emit-llvm occurrences.c. The generated LLVM code for clang version 6.1.0 (which supports LLVM 3.6.0) is excerpted in Figure 2; this is essentially the same code as reported in [9].…”

“…In previous work [9] [11], we built a translator from Low-Level Virtual Machine (LLVM) intermediate form [16] to the applicative subset of Common Lisp [15] accepted by the ACL2 theorem prover [12], and performed verification on the translated form using ACL2's automated reasoning capabilities.…”