Formal verification of a realistic compiler Xavier Leroy CACM 2009 - - PowerPoint PPT Presentation

▶
formal verification of a realistic compiler
SMART_READER_LITE
LIVE PREVIEW

Formal verification of a realistic compiler Xavier Leroy CACM 2009 - - PowerPoint PPT Presentation

Dec 09, 2023 309 likes •1.01k views

Formal verification of a realistic compiler Xavier Leroy CACM 2009 CS 7194: Great Works in Programming Languages Presenter : Irene Yoon | Mentor : Ryan Doenges 1 Building robust compilers is Hard. 2 Bugs bugs 3 Bugs [Yang

slide-1
SLIDE 1

Formal verification of a realistic compiler

Xavier Leroy CACM 2009

CS 7194: Great Works in Programming Languages Presenter : Irene Yoon | Mentor : Ryan Doenges

  • 1
slide-2
SLIDE 2

Building robust compilers is Hard.

2

slide-3
SLIDE 3

Bugs

3

bugs

slide-4
SLIDE 4

Bugs

4

  • Random testing finds bugs in 11 C compilers
  • Hundreds of previously unknown bugs
  • LLVM has a large test suite, real compilers have bugs

[Yang et al 2011]

slide-5
SLIDE 5

Bugs

5

  • Random testing finds bugs in 11 C compilers
  • Hundreds of previously unknown bugs
  • LLVM has a large test suite

[Yang et al 2011]

slide-6
SLIDE 6

Bugs

6

  • Random testing finds bugs in 11 C compilers
  • Hundreds of previously unknown bugs
  • LLVM has a large test suite, real compilers have bugs

[Yang et al 2011]

slide-7
SLIDE 7

Bugs

7

  • Random testing finds bugs in 11 C compilers
  • Hundreds of previously unknown bugs
  • LLVM has a large test suite

[Yang et al 2011]

slide-8
SLIDE 8

✅ Building compilers is hard Testing sucks Formalisms are good

8

slide-9
SLIDE 9

✅ Building compilers is hard ✅ Testing sucks Formalisms are good

9

slide-10
SLIDE 10

✅ Building compilers is hard ✅ Testing sucks ✅ Formalisms are good

10

slide-11
SLIDE 11

✅ Building compilers is hard ✅ Testing sucks ✅ Formalisms are good

11

Formal verification of a compiler

slide-12
SLIDE 12

First Published Proof of Compiler Correctness

12

  • arithmetic expressions → stack machine code
  • prototype for proving usable compilers

[1967]

slide-13
SLIDE 13

First Mechanized Proof of Compiler Correctness

13

[1972]

  • ALGOL-like language → elementary assembly language
  • Stanford LCF
slide-14
SLIDE 14

Compiler Verification

14

  • 100+ papers on compiler verification since 1967
slide-15
SLIDE 15

Compiler Verification

15

  • 100+ papers on compiler verification since 1967
slide-16
SLIDE 16

Compiler Verification

16

  • 100+ papers on compiler verification since 1967
slide-17
SLIDE 17

Compiler Verification

17

  • 100+ papers on Compiler Verification since 1967

[2003]

slide-18
SLIDE 18

CompCert

18

slide-19
SLIDE 19

CompCert

“Develop and prove correct a realistic compiler, usable for critical embedded software.”

  • 42k Coq, 3 person years

Clight PowerPC ARM x86

source target CompCert [2009]

slide-20
SLIDE 20

CompCert

“Develop and prove correct a realistic compiler, usable for critical embedded software.”

  • 42k Coq, 3 person years

Clight PowerPC ARM x86

source target CompCert [2009]

slide-21
SLIDE 21

CompCert

“Develop and prove correct a realistic compiler, usable for critical embedded software.”

  • 42k Coq, 3 person years

Clight PowerPC ARM x86

source target CompCert [2009]

slide-22
SLIDE 22

Verified, Validated, Certifying

22

slide-23
SLIDE 23

Verified, Validated, Certifying

  • 1. Verified transformation [Compiler Correctness]

23

COMPILER

source target

slide-24
SLIDE 24

Verified, Validated, Certifying

2 . Translation validation [Translation Verification]

24

COMPILER

source

VALIDATOR

target

slide-25
SLIDE 25

Verified, Validated, Certifying

  • 3. Certifying compiler [Proof-carrying Code]

25

PROOF CHECKER CERTIFYING COMPILER

source target code + certificate

slide-26
SLIDE 26

26

slide-27
SLIDE 27

27

[Leroy `06]

slide-28
SLIDE 28

28

=> External solver with verified validation

slide-29
SLIDE 29

29

[Tristan and Leroy `10]

=> External solver with verified validation

slide-30
SLIDE 30

CompCert

30

slide-31
SLIDE 31

CompCert

31

formal specification

slide-32
SLIDE 32

CompCert

32

→ semantic analysis tools [Appel ’11]

formal specification

slide-33
SLIDE 33

CompCert

33

semantic preservation*

slide-34
SLIDE 34

CompCert

34

slide-35
SLIDE 35

Semantic Preservation

  • Spec(B) : functional specification of observable behavior
  • B: observable behavior (trace properties of I/O)
  • “going wrong” (run-time error), termination, divergence
  • C ㅑ Spec if
  • A. C cannot go wrong
  • B. All behaviors B satisfy Spec

35

slide-36
SLIDE 36

Semantic Preservation

  • Spec(B) : functional specification of observable behavior
  • B: observable behavior (trace properties of I/O)
  • “going wrong” (run-time error), termination, divergence
  • C ㅑ Spec if
  • A. C cannot go wrong
  • B. All behaviors B satisfy Spec

36

slide-37
SLIDE 37

Semantic Preservation

  • Spec(B) : functional specification of observable behavior
  • B: observable behavior (trace properties of I/O)
  • “going wrong” (run-time error), termination, divergence
  • C ㅑ Spec if
  • A. C cannot go wrong
  • B. All behaviors B satisfy Spec

37

slide-38
SLIDE 38

Correctness Property

Compiled code C preserves the fact that the source code S satisfies the specification.

38

slide-39
SLIDE 39

Proving Semantic Preservation

39

slide-40
SLIDE 40

Proving Semantic Preservation

40

*

slide-41
SLIDE 41

Safety Precondition

  • Compilation result will match the semantics of the input if

if program is “safe” (no runtime errors)

  • Need to prove that input program is safe

41

slide-42
SLIDE 42

Safety Precondition

  • Compilation result will match the semantics of the input if

if program is “safe” (no runtime errors)

  • Need to prove that input program is safe

42

slide-43
SLIDE 43

Correctness Weakness

43

slide-44
SLIDE 44

Correctness Weakness

44

slide-45
SLIDE 45

CompCert

45

slide-46
SLIDE 46

CompCert

46

slide-47
SLIDE 47

Correctness Weakness

  • Only runs after the preprocessing step
  • Astrèe [Cousot et al ’05], Verasco [Jourdan et al ’15])
  • Reliant on less verifiable assumptions
  • Coq’s correctness [Anand et al ’17]
  • Formal specification of C & PowerPC assembly

47

slide-48
SLIDE 48

Correctness Weakness

  • Only runs after the preprocessing step
  • Astrèe [Cousot et al ’05], Verasco [Jourdan et al ’15]
  • Reliant on less verifiable assumptions
  • Coq’s correctness [Anand et al ’17]
  • Formal specification of C & PowerPC assembly

48

slide-49
SLIDE 49

Correctness Weakness

  • Only runs after the preprocessing step
  • Astrèe [Cousot et al ’05], Verasco [Jourdan et al ’15])
  • Reliant on less verifiable assumptions
  • Coq’s correctness [Anand et al ’17]
  • Formal specification of C & PowerPC assembly

49

slide-50
SLIDE 50

Correctness Weakness

  • Only runs after the preprocessing step
  • Astrèe [Cousot et al ’05], Verasco [Jourdan et al ’15])
  • Reliant on less verifiable assumptions
  • Coq’s correctness (CertiCoq [Anand et al ’17])
  • Formal specification of C & PowerPC assembly

50

slide-51
SLIDE 51

Correctness Weakness

  • Only runs after the preprocessing step
  • Astrèe [Cousot et al ’05], Verasco [Jourdan et al ’15])
  • Reliant on less verifiable assumptions
  • Coq’s correctness (CertiCoq [Anand et al ’17])
  • Formal specification of C & PowerPC assembly

51

slide-52
SLIDE 52

Performance

52

slide-53
SLIDE 53

Performance

competitive with gcc -01

53

slide-54
SLIDE 54

Bugs, revisited.

54

[Yang et al 2011]

  • CompCert: errors only found in unverified parts (parser

and model of machine)

  • Other compilers: errors everywhere

“The striking thing about our CompCert results is that the middle-end bugs we found in all other compilers are absent”

slide-55
SLIDE 55

Bugs, revisited.

55

[Yang et al 2011]

  • CompCert: errors only found in unverified parts (parser

and model of machine)

  • Other compilers: errors everywhere

“The striking thing about our CompCert results is that the middle-end bugs we found in all other compilers are absent”

slide-56
SLIDE 56

Bugs, revisited.

56

[Yang et al 2011]

  • CompCert: errors only found in unverified parts (parser

and model of machine)

  • Other compilers: errors everywhere

“The striking thing about our CompCert results is that the middle-end bugs we found in all other compilers are absent”

slide-57
SLIDE 57

Bugs, revisited.

57

[Yang et al 2011]

  • CompCert: errors only found in unverified parts (parser

and model of machine)

  • Other compilers: errors everywhere

“The striking thing about our CompCert results is that the middle-end bugs we found in all other compilers are absent”

slide-58
SLIDE 58

Critical Use Cases

  • AirBus
  • MTU Friedrichshafen (nuclear energy)
  • High-Assurance Cyber Military Systems (HACMS) [Fisher

et al, ’17]

  • PhD Theses

58

slide-59
SLIDE 59

Critical Use Cases

  • AirBus
  • MTU Friedrichshafen (nuclear energy)
  • High-Assurance Cyber Military Systems (HACMS) [Fisher

et al, ’17]

  • PhD Theses

59

slide-60
SLIDE 60

Critical Use Cases

  • AirBus
  • MTU Friedrichshafen (nuclear energy)
  • High-Assurance Cyber Military Systems (HACMS) [Fisher

et al, ’17]

  • PhD Theses

60

slide-61
SLIDE 61

Critical Use Cases

  • AirBus
  • MTU Friedrichshafen (nuclear energy)
  • High-Assurance Cyber Military Systems (HACMS) [Fisher

et al, ’17]

  • PhD Theses

61

slide-62
SLIDE 62

Critical Use Cases

  • AirBus
  • MTU Friedrichshafen (nuclear energy)
  • High-Assurance Cyber Military Systems (HACMS) [Fisher

et al, ’17]

  • PhD Theses

62

“a realistic compiler”

slide-63
SLIDE 63

Concluding Remarks

63

. . .

  • Still some correctness and safety weaknesses
  • Useful for safety critical code (that doesn’t have to run fast)
  • Future work -
slide-64
SLIDE 64

Concluding Remarks

64

. . .

  • Still some correctness and safety weaknesses
  • Useful for safety critical code (that doesn’t have to run fast)
  • Future work -

. . .

slide-65
SLIDE 65

Concluding Remarks

  • Still some correctness and safety weaknesses
  • Useful for safety critical code (that doesn’t have to run fast)
  • Future work -

65

. . .

slide-66
SLIDE 66

Concluding Remarks

  • Still some correctness and safety weaknesses
  • Useful for safety critical code (that doesn’t have to run fast)
  • Future work -

66

. . .

Type Preserving Compilation

. . .

slide-67
SLIDE 67

. . .

Concluding Remarks

  • Still some correctness and safety weaknesses
  • Useful for safety critical code (that doesn’t have to run fast)
  • Future work -

67

Type Preserving Compilation

slide-68
SLIDE 68

Thanks!

68