Formalizing the LLVM intermediate representation for verified program transformations

Abstract

This paper presents Vellvm (verified LLVM), a framework for reasoning about programs expressed in LLVM's intermediate representation and transformations that operate on it. Vellvm provides a mechanized formal semantics of LLVM's intermediate representation, its type system, and properties of its SSA form. The framework is built using the Coq interactive theorem prover. It includes multiple operational semantics and proves relations among them to facilitate different reasoning styles and proof techniques. To validate Vellvm's design, we extract an interpreter from the Coq formal semantics that can execute programs from LLVM test suite and thus be compared against LLVM reference implementations. To demonstrate Vellvm's practicality, we formalize and verify a previously proposed transformation that hardens C programs against spatial memory safety violations. Vellvm's tools allow us to extract a new, verified implementation of the transformation pass that plugs into the real LLVM infrastructure; its performance is competitive with the nonverified, ad-hoc original. Disciplines Computer SciencesComments Zhao, J., Nagarakatte, S., Martin, M., & Zdancewic, S., Formalizing the LLVM Intermediate Representation for Verified Program Transformations, 39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, Jan. 2012, doi: 10.1145/2103656.2103709 © 1994, 1995, 1998, 2002, 2009 by ACM, Inc. Permission to copy and distribute this document is hereby granted provided that this notice is retained on all copies, that copies are not altered, and that ACM is credited when the material is used to form other copyright policies. To validate Vellvm's design, we extract an interpreter from the Coq formal semantics that can execute programs from LLVM test suite and thus be compared against LLVM reference implementations. To demonstrate Vellvm's practicality, we formalize and verify a previously proposed transformation that hardens C programs against spatial memory safety violations. Vellvm's tools allow us to extract a new, verified implementation of the transformation pass that plugs into the real LLVM infrastructure; its performance is competitive with the non-verified, ad-hoc original.

QED at Large: A Survey of Engineering of Formally Verified Software

“…The Standard ML language variant CakeML (Kumar et al, 2014) has a verified compiler in HOL4 with a certified machine-code implementation produced by bootstrapping (applying the compiler to itself). Using the Vellvm (Zhao et al, 2012) framework in Coq, proof engineers can reason about transformations on the LLVM intermediate language representation.…”

Introducing Certified Compilation in Education by a Functional Language Approach

“…In the first lecture we cover course texts (Compilers: principles, techniques and tools [1]) and Real World OCaml [6]), an overview of Compiler Technology (introducing concepts of lexing, parsing into AST representation, desugaring, semantic analysis, linearisation to SSA, high level optimization, RTL level optimization, and ABI conformance). A special focus was given to miscompilation and correctness (GNU C lexing [4], LLVM SSA optimizations [9]), and the CompCert C certified compiler [8]). The use of compilation techniques outside compilers were covered, such as the general use of parsers, transformations and optimizations.…”

“…8 Variables are of unbound integer type, Booleans are constants (and cannot be assigned/stored for sake of simplicity). 9 For any terminating program there exists a fueling parameter rendering a correct final configuration (as the "imp" language at hand does not model execution errors).…”

Verified low-level programming embedded in F*

“…We conjecture that our reinterpretation techniques can be generalized to most passes of CompCert down to assembly. While we leave such generalization as future work, some guarantees from C to assembly can be derived by instrumenting CompCert [Barthe et al 2014] and LLVM [Almeida et al 2016b;Zhao et al 2012Zhao et al , 2013 and turning them into certifying (rather than certified) compilers where security guarantees are statically rechecked on the compiled code through translation validation, thus re-establishing them independently of source-level security proofs. In this case, rather than being fully preserved down to the compiled code, Low * -level proofs are still useful to practically reduce the risk of failures in translation validation.…”