An Abstract Stack Based Approach to Verified Compositional - - PowerPoint PPT Presentation

▶
an abstract stack based approach to verified
SMART_READER_LITE
LIVE PREVIEW

An Abstract Stack Based Approach to Verified Compositional - - PowerPoint PPT Presentation

Jan 27, 2023 41 likes •259 views

An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code Yuting Wang 1 , Pierre Wilke 1 , 2 , Zhong Shao 1 Yale University 1 , CentraleSuplec 2 19 January 18 th , 2019 POPL Yuting Wang, Pierre Wilke , Zhong

slide-1
SLIDE 1

An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code

Yuting Wang1, Pierre Wilke1,2, Zhong Shao1

Yale University1, CentraleSupélec2

POPL ’19 – January 18th, 2019

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 1 / 16

slide-2
SLIDE 2

Verified compilation

CompCert : verified C compiler (Leroy et al., first released in 2008) C Clight Cshm Cminor CminorSel RTL LTL Linear Mach Asm Used as a basis for a large number of extensions:

  • alternate semantics: CompCertTSO (weak memory model, Sevcík et al., JACM’13), CompCertS

(undefined pointer arithmetic, Besson et al., ITP’17)

  • a more concrete view of the stack: Quantitative CompCert (merge the stack blocks into a single

stack region, Carbonneaux et al., PLDI’14)

  • compositional compilation: Compositional CompCert (Stewart et al., POPL

’15), compositional semantics (Ramananandro et al., CPP’15), SepCompCert (Kang et al., POPL ’16) Open problems:

  • verified compilation to machine code
  • port all compiler passes of CompCert, including challenging inlining and tailcall recognition
  • verified compilation of heterogeneous modules (mix C and Asm modules)

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 2 / 16

slide-3
SLIDE 3

Contribution: Stack-Aware CompCert

A version of CompCert with:

1 compilation to machine code

  • merge the stack blocks into a unique stack region
  • eliminate CompCert’s pseudo-instructions
  • generate machine code

2 complete extension: we support all CompCert passes

  • including challenging optimizations (function inlining, tailcall elimination)

3 compositional compilation

  • stack access policy
  • mix C and Asm programs

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 3 / 16

slide-4
SLIDE 4

CompCert: memory model and values

void swap(int * p1, int * p2){ int tmp = *p1;

*p1 = *p2; *p2 = tmp; }

int main(){ int i = 3, j = 9; int * x = &i; int * y = &j;

swap(x,y);

return 0;

}

3 bi 9 bj (bi,0) bx (bj,0) by (bi,0) bp1 (bj,0) bp2 3 btmp

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 4 / 16

slide-5
SLIDE 5

CompCert: compilation and memory model

The memory model stays the same throughout compilation, but the memory blocks change shapes.

bi bj bx by bp1 bp2 btmp main swap bi bj /

Asm Cminor Clight C The stack frames in Asm are in distinct blocks!

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 5 / 16

slide-6
SLIDE 6

The abstract stack

We maintain an abstract stack in memory states, that reflects the structure of the concrete stack. Abstract stack: a list of abstract frames. An abstract frame records useful information about a concrete stack frame:

  • the size of this stack frame at the assembly level;
  • which blocks are part of that stack frame;
  • which locations of these blocks are public or private

bi bj bx by

32

bmain

32

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 6 / 16

slide-7
SLIDE 7

Abstract stack: example

bi bj bx by bp1 bp2 btmp main swap bi bj / bmain bswap

Asm Cminor Clight C 32 16 The abstract stack at the C level is:

bp1 bp2 btmp bi bj bx by

16 32

;

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 7 / 16

slide-8
SLIDE 8

Abstract stack: example

bi bj bx by bp1 bp2 btmp main swap bi bj / bmain bswap

Asm Cminor Clight C 32 16 The abstract stack at the Asm level is:

bswap bmain

16 32

;

Stack-access policy: we may write to

  • all of bswap
  • public locations in bmain

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 7 / 16

slide-9
SLIDE 9

Abstract stack primitives

Semantics of all intermediate languages instrumented with push_frame and pop_frame

bmain

32

bmain

32

bswap

16

bmain

32

at function call push_frame at function return pop_frame Key argument for merging stack blocks : The push_frame primitive only succeeds if the sum of the frames’ sizes is lower than MAX_STACK.

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 8 / 16

slide-10
SLIDE 10

Preservation of stack usage with compilation

Since the semantics include stack consumption, it must be preserved by compilation Property to ensure: at each program point, the size of source stack should be larger than (or equal to) the size of target stack. f g f g Source Target Regular case The sizes of the source and target stacks are equal.

|f|+|g| = |f|+|g|

Recall |f| is the size of f ’s stack frame at the Asm level!

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 9 / 16

slide-11
SLIDE 11

Preservation of stack usage with compilation

Since the semantics include stack consumption, it must be preserved by compilation Property to ensure: at each program point, the size of source stack should be larger than (or equal to) the size of target stack. f g f Source Target Function inlining Source

void g(){ ⇒

G; }

void f(){

g(); } Target

void g(){

G; }

void f(){ ⇒

G; } The sizes of the source stack is larger than the target stack.

|f|+|g| ≥ |f|

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 9 / 16

slide-12
SLIDE 12

Preservation of stack usage with compilation

Since the semantics include stack consumption, it must be preserved by compilation Property to ensure: at each program point, the size of source stack should be larger than (or equal to) the size of target stack. f f Source Target Tailcall inlining Source

void g(){

G; }

void f(){

F;

⇒

tail g(); } Target

void g(){

G; }

void f(){ ⇒

F; G; } The sizes of the source stack is larger than the target stack.

|f| ≥ |f|

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 9 / 16

slide-13
SLIDE 13

Preservation of stack usage with compilation

Since the semantics include stack consumption, it must be preserved by compilation Property to ensure: at each program point, the size of source stack should be larger than (or equal to) the size of target stack. g f Source Target Tailcall inlining Source

void g(){ ⇒

G; }

void f(){

F; tail g(); } Target

void g(){

G; }

void f(){

F;

⇒

G; } Problem: How to compare the sizes of the source and target stacks

|g|

?

≥ |f|

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 9 / 16

slide-14
SLIDE 14

Preservation of stack usage with compilation

Since the semantics include stack consumption, it must be preserved by compilation Property to ensure: at each program point, the size of source stack should be larger than (or equal to) the size of target stack. f g f Source Target Tailcall inlining Source

void g(){ ⇒

G; }

void f(){

F; tail g(); } Target

void g(){

G; }

void f(){

F;

⇒

G; } We keep the history of tailcalled functions:

max(|f|,|g|) ≥ |f|

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 9 / 16

slide-15
SLIDE 15

The structure of the abstract stack

The abstract stack is actually a list of list of abstract frames. abstract frame stage of abstract frames

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 10 / 16

slide-16
SLIDE 16

From CompCert Assembly to Machine Code

code glob stack CompCert Asm code glob stack “Single-Stack” Asm code glob stack “Flat” Asm mem Plain Memory merging stack blocks pseudo-instructions elimination flat memory layout instruction encoding (RockSalt: Morrisett et al., PLDI’12)

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 11 / 16

slide-17
SLIDE 17

Eliminating pseudo-instructions

  • s1
  • s′

1

  • s2
  • s′

2

  • s3
  • s′

3

Single-Stack Asm Real Asm call RA ← next(PC) allocframe RSP ← RSP - sz; store RA call RSP ← RSP - 8; store (next(PC)) allocframe RSP ← RSP - (sz - 8) Caller Callee Mismatch between CompCert semantics and expected semantics We get rid of the pseudo-register RA and can do away with pseudo-instructions (simple pointer arithmetic)

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 12 / 16

slide-18
SLIDE 18

Stack access policy

Accessible locations are either top-frame locations or public locations.

bmain

32

bmain

32

bswap

16

bmain

32

at function call push_frame at function return pop_frame

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 13 / 16

slide-19
SLIDE 19

Contextual compilation

f g

ret data callee-save link args

When a function f calls a function g, the private regions of f’s stack frame should not be altered. Programs compiled from C comply with that policy. Characterization of acceptable Asm functions. We apply this principle to CompCertX (Gu et al., POPL ’15)

  • contextual compiler developed for CertiKOS
  • ability to mix C and Asm functions

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 14 / 16

slide-20
SLIDE 20

Comparison with existing work

Target Completeness Compositionality Time LOC CompCert(3.0.1) CompCert Asm complete separate

  • 135k

Stack-Aware CompCert Machine Code complete contextual 10.5 +48k Quantitative CompCert SingleStack Asm w.o. some opts. N/A

  • 100k

Compositional CompCert CompCert Asm w.o. some opts. general 10 200k SepCompCert CompCert Asm complete separate 2 +3k CompCertX CompCert Asm no s.a. data contextual

  • +8k

CompCert-TSO x86-TSO w.o. some opts. concurrency 45 85k CompCertS CompCert Asm w.o. some opts. N/A 25 220k

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 15 / 16

slide-21
SLIDE 21

Conclusion

We develop Stack-Aware CompCert, with three distinguishing features:

1 compilation to machine code

  • finite-size stack
  • more concrete memory layout for Asm
  • closer to actual machine code: reduction of unverified part of the compiler

2 complete extension of CompCert

  • function inlining and tailcall elimination

3 compositional compilation

  • extension of CompCertX
  • stack access policy

Further work and perspectives:

  • port to other backends: ARM, RISC-V, x86-64
  • main challenge: encoding and decoding of instructions
  • define a stack analysis / verification framework to reason about the stack usage of programs and

prove they run in bounded stack

Yuting Wang, Pierre Wilke, Zhong Shao An Abstract Stack Based Approach to Verified Compositional Compilation to Machine Code 16 / 16