Formalizing the LLVM intermediate representation for verified program transformations

Abstract

This paper presents Vellvm (verified LLVM), a framework for reasoning about programs expressed in LLVM's intermediate representation and transformations that operate on it. Vellvm provides a mechanized formal semantics of LLVM's intermediate representation, its type system, and properties of its SSA form. The framework is built using the Coq interactive theorem prover. It includes multiple operational semantics and proves relations among them to facilitate different reasoning styles and proof techniques. To validate Vellvm's design, we extract an interpreter from the Coq formal semantics that can execute programs from LLVM test suite and thus be compared against LLVM reference implementations. To demonstrate Vellvm's practicality, we formalize and verify a previously proposed transformation that hardens C programs against spatial memory safety violations. Vellvm's tools allow us to extract a new, verified implementation of the transformation pass that plugs into the real LLVM infrastructure; its performance is competitive with the nonverified, ad-hoc original. Disciplines Computer SciencesComments Zhao, J., Nagarakatte, S., Martin, M., & Zdancewic, S., Formalizing the LLVM Intermediate Representation for Verified Program Transformations, 39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, Jan. 2012, doi: 10.1145/2103656.2103709 © 1994, 1995, 1998, 2002, 2009 by ACM, Inc. Permission to copy and distribute this document is hereby granted provided that this notice is retained on all copies, that copies are not altered, and that ACM is credited when the material is used to form other copyright policies. To validate Vellvm's design, we extract an interpreter from the Coq formal semantics that can execute programs from LLVM test suite and thus be compared against LLVM reference implementations. To demonstrate Vellvm's practicality, we formalize and verify a previously proposed transformation that hardens C programs against spatial memory safety violations. Vellvm's tools allow us to extract a new, verified implementation of the transformation pass that plugs into the real LLVM infrastructure; its performance is competitive with the non-verified, ad-hoc original.

A Formally Verified SSA-Based Middle-End

“…Eventually, it should be possible to shift all CompCert optimisations into the SSA middle-end. In the longer term, it would be appealing to apply our methods to LLVM, building on [23,21,26].…”

“…Moreover, it is not clear whether their semantics of SSA can be used to reason about optimizations. Zhao et al [26] formalize the LLVM intermediate representation in Coq. They define and relate several formal semantics of LLVM, including a static and dynamic semantics.…”

ZEUS: Analyzing Safety of Smart Contracts

“…Not only does this allow ZEUS to leverage an industry strength tool-chain for analysis, it enables ZEUS to plug in any verifier that operates upon the standardized (and formally verified [74]) LLVM bitcode. Use of LLVM bitcode also helps ZEUS to support verification of smart contracts for different blockchain platforms, including Ethereum [13] and Hyperledger Fabric [24] (or Fabric), written in diverse high-level languages, such as C#, GO and JAVA.…”

Validating Dominator Trees for a Fast, Verified Dominance Test

“…Zhao et al [20,18] formalize the LLVM SSA intermediate form and its generation algorithm in Coq. Their work follows closely the LLVM design and their verified transformation can be run inside the LLVM platform itself.…”