Towards an Axiomatic Basis for C++ Gregory Malecha, Abhishek Anand, - - PowerPoint PPT Presentation
Towards an Axiomatic Basis for C++ Gregory Malecha, Abhishek Anand, Gordon Stewart BedRock Systems BedRock Systems Formally verifjed, deep specifjcations. Unbreakable Foundation for the Software Defjned World Enable everyone to write and
BedRock Systems
The future is built on BedRock.
Enable everyone to write and share verifjed code! Formally verifjed, deep specifjcations.
The future is built on BedRock.
...
NOVA (microhypervisor) Zeta Userspace vETH Switch vUART Mux ... VMM Guest VMM Guest
The future is built on BedRock.
...
NOVA (microhypervisor) Zeta Userspace vETH Switch vUART Mux ... VMM Guest VMM Guest
Deep correctness properties of highly concurrent, low-level code. Deep correctness properties of highly concurrent, low-level code.
The future is built on BedRock.
The future is built on BedRock.
a.cpp a_cpp_proof.v From source to proof?
The future is built on BedRock.
a.cpp a_cpp_proof.v syntax.v logic.v
The future is built on BedRock.
a.cpp a_cpp.v a_cpp_proof.v cpp2v syntax.v logic.v
The future is built on BedRock.
a.cpp a_cpp.v a_cpp_spec.v a_cpp_proof.v cpp2v syntax.v logic.v
The future is built on BedRock.
a.cpp a_cpp.v a_cpp_spec.v a_cpp_proof.v cpp2v syntax.v logic.v
The future is built on BedRock.
a.cpp a_cpp.v a_cpp_spec.v a_cpp_proof.v cpp2v auto.v syntax.v logic.v
The future is built on BedRock.
a.cpp a_cpp.v a_cpp_spec.v a_cpp_proof.v cpp2v auto.v syntax.v logic.v
The future is built on BedRock.
(CompCert,VST)
Iris separation logic library
The future is built on BedRock.
(.., 14, 17, ...)
(.., 14, 17, ...)
(CompCert,VST)
Iris separation logic library
The future is built on BedRock.
Semantic Challenges
Classes + Objects
Surface Complexities
The future is built on BedRock.
Semantic Challenges
Classes + Objects
Surface Complexities
Hooking into existing tooling
The future is built on BedRock.
Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types
a.cpp a_cpp.v cpp2v
The future is built on BedRock.
Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types
a.cpp a_cpp.v cpp2v cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- threadsafe-statics -fno-builtin -I./include
Standard clang compiler options.
Also runnable as a clang plugin.
The future is built on BedRock.
Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types
a.cpp a_cpp.v cpp2v Minimal pre-processing (close to C++ standard). cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- threadsafe-statics -fno-builtin -I./include
Standard clang compiler options.
Compatible with C
Also runnable as a clang plugin.
The future is built on BedRock.
Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types
a.cpp a_cpp.v cpp2v Minimal pre-processing (close to C++ standard). cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- threadsafe-statics -fno-builtin -I./include
Standard clang compiler options.
Compatible with C
Also runnable as a clang plugin. Include extra information to ease consumption: ► value categories, ► types, ► implicit initializers, ► overload resolution, ► some desugaring, ► etc.
The future is built on BedRock.
Semantic Challenges
Weakest precondition semantics in Iris Classes + Objects
Surface Complexities
Hooking into existing tooling
The future is built on BedRock.
These are values, e.g. integers
And for other value categories & language constructs: wp_lval, wp_xval
The future is built on BedRock.
These are values, e.g. integers Locals “Thread identifier” Temporaries to destroy Iris mask Declarations
And for other value categories & language constructs: wp_lval, wp_xval
The future is built on BedRock.
All program state is represented uniformly as resources ►Simple representation
structs ►More uniform representation predicates
Mapping from names to location Location of x is a (persistent) All locations are accessed uniformly.
The future is built on BedRock.
○ Verifjcation after macro expansion ○ C++ is moving away from macros towards language- based features, e.g. constexpr
lib.cpp #include “lib.hpp” struct F { … }; int main() { … } lib.hpp int foo(int) { … } extern int bar(); main.cpp #include “lib.hpp” struct B { … }; int main() { … } Verify once!
The future is built on BedRock.
○ Verifjcation after macro expansion ○ C++ is moving away from macros towards language- based features, e.g. constexpr
lib.cpp #include “lib.hpp” struct F { … }; int main() { … } lib.hpp int foo(int) { … } extern int bar(); main.cpp #include “lib.hpp” struct B { … }; int main() { … } Preservation under compatible extension
The future is built on BedRock.
Semantic Challenges
Weakest precondition semantics in Iris Classes + Objects
Describe the object system in separation logic. Surface Complexities
Hooking into existing tooling
The future is built on BedRock.
Classes are a pervasive addition in C++ ►Constructors ►Destructors ►Member functions ►Virtual functions
Fairly easy due to information in the AST, e.g. explicit cast nodes, etc.
The future is built on BedRock.
Classes are a pervasive addition in C++ ►Constructors ►Destructors ►Member functions ►Virtual functions Object identity is intricate ►Track it using language- specifjc ghost state
Fairly easy due to information in the AST, e.g. explicit cast nodes, etc.
The future is built on BedRock.
Classes are a pervasive addition in C++ ►Constructors ►Destructors ►Member functions ►Virtual functions Object identity is intricate ►Track it using language- specifjc ghost state
Still looking for a good abstraction for reasoning. (Do you have ideas?) Fairly easy due to information in the AST, e.g. explicit cast nodes, etc.
The future is built on BedRock.
Semantic Challenges
Weakest precondition semantics in Iris Classes + Objects
Describe the object system in separation logic. Surface Complexities
Hooking into existing tooling Unsupported Features
The future is built on BedRock.
The future is built on BedRock.
🙷Every engineer uses some form of “verification" in their head ..., formal verification simply helps putting that on paper precisely.🙸 ~Systems Engineer
Separation logic is central to this.
The future is built on BedRock.
○ Very helpful to tie verifjcation to a language they already know. ○ Systems engineers able to write fjrst-order specifjcations. ○ Seems to be some cognitive benefjt to classes.
🙷Every engineer uses some form of “verification" in their head ..., formal verification simply helps putting that on paper precisely.🙸 ~Systems Engineer
Separation logic is central to this.
The future is built on BedRock.
► cpp2v is a tool for importing C++ code in Coq ► Built on top of the clang toolchain ► Axiomatic semantics of (much of) C++ ► Some interesting challenges in C++
https://github.com/bedrocksystems/cpp2v
Contributions, collaborations, and users welcome