1. Introduction to Our Research on Certifying Compiler Zhaopeng Li (In Chinese: 李兆鹏 ) Email: zpli@mail.ustc.edu.cn Certifying Compiler Group USTC-Yale Joint Research Center September 4, 2009

2. Outline

3. Goal of Our Center Building Certified System Software Verification Framework Language: x86/MIPS assembly Lang. Logic: domain-specific logics Proof: developed in Coq manually Verification Framework Language: x86/MIPS assembly Lang. Logic: domain-specific logics Proof: developed in Coq manually Methodology! Shortcoming: Development under this framework is costly.

4. Motivation Lift the verification framework to source-level. ★ productivity ★ user-friendly Generate proof by automated theorem prover. ★ automation ★ support proof-carrying code

5. Motivation (cont.) Compcert [Xavier Leroy et al.] ★ a Certified C Compiler ★ Realistic (Optimization) Compcert [Xavier Leroy et al.] ★ a Certified C Compiler ★ Realistic (Optimization) Compcert C Code Assembly Code Proof Difference from a certified compiler? Difference from a certified compiler? Specifications

6. Previous Work Pointer Logic Certifying Compiler Pointer Logic Certifying Compiler Annotated C Code Annotated C Code Annotated x86 Assembly Code Proof Front-end VCGen Proof assistant Coq Proof-Gen Back-end VC Proof Pointer Logic Certifying Compiler Lang.:Subset of C Logic : Pointer Logic Manual Proof in Coq

7. Previous Work (cont.) Prototype I : a Certifying Compiler Language: PointerC (subset of C) Logic: Pointer Logic (long access path, alias inference) Supported data structures (circular) singly-linked list (circular) doubly-linked list tree

8. On-going Work /*n>0 | emp*/ struct list* list_create(int n) { … while(n>0) /*n>=0 | list(p)*/ {… } return p; } /* true | list(res)*/ /*n>0 | emp*/ struct list* list_create(int n) { … while(n>0) /*n>=0 | list(p)*/ {… } return p; } /* true | list(res)*/ C-like language + Separation Logic Lemma wf_L0: … Lemma wf_L1: … Lemma … List_create: push ebp mov esp, ebp sub esp, 8 jmp L0 L0 : … L1 : SCAP Framework overview CComp Compiler CComp Compiler

9. On-going Work (cont.) Prototype II : CComp Language: C-like(subset of C) Logic: Separation Logic (fragment) Build-in automated theorem provers Support data structures: list/tree

10. On-going Work (cont.) CComp Certifying Compiler CComp Certifying Compiler Annotated C Code Annotated C Code Annotated x86 Assembly Code Proof Front-end VCGen Proof-Gen Back-end VC Proof Lang.:Subset of C Logic : Separation Logic Build-in Automated Theorem Prover ATP

11. Automated Theorem Prover Linear integer Arithmetic Prover Formulas Prover for fragment of Separation Logic Other Domain-Specific Provers (list, and etc.) Automated Theorem Prover Proof TreeProof Output Proof (Proof Term Checkable by Coq) Fragment of Separation Logic : separation star / emp / p|->_ Build-in Predicates : list/lseg/dlist/dlseg/tree…

12. Automated Theorem Prover (cont.) Prover for linear integer arithmetic Based on Simplex decision procedure Output coq-compatible proof term Build using coq libraries (ZArith … ) Check using coqc Provide interfaces to VCGen & other provers

13. Automated Theorem Prover (cont.) Prover for separation logic Support a fragment (star/ |->/list/lseg/dlist/dlseg/tree) Using linear integer arithmetic prover to prove equality Output coq-compatible proof term (on-going work) More powerful than Smallfoot

14. Demonstration Simin Yang Automated linear integer arithmetic prover Test cases on integer arithmetic Zhong Zhuang Automated prover for fragment of separation logic Test cases manipulating on linked list

15. Thanks!