Verifying efficient function calls in CakeML

Abstract

We have designed an intermediate language (IL) for the CakeML compiler that supports the veriied, eicient compilation of functions and calls. Veriied compilation steps include batching of multiple curried arguments, detecting calls to statically known functions, and specialising calls to known functions with no free variables. Finally, we verify the translation to a lower-level IL that only supports closed, irst-order functions.These compilation steps resemble those found in other compilers (especially OCaml). Our contribution here is the design of the semantics of the IL, and the demonstration that our veriication techniques over this semantics work well in practice at this scale. The entire development was carried out in the HOL4 theorem prover.

Formal verification of a constant-time preserving C compiler

“…Until recently, building formally verified compilers for realistic languages was seen as a grand challenge. However, the advent of the CompCert [Kästner et al 2018;Leroy 2006Leroy , 2009aLeroy et al 2016], Vellvm [Zhao et al 2012[Zhao et al , 2013, Crellvm [Kang et al 2018], and CakeML [Kumar et al 2014;Lööw et al 2019;Owens et al 2017;Tan et al 2016] verified compilers show that they are now well within reachÐalthough admittedly, every formally verified compiler for a realistic language remains a feat.…”

The verified CakeML compiler backend

“…For example, the register allocator may face less register pressure around call sites after multi- argument functions get introduced. In Owens et al (2017), we also observed that the multiargument introduction optimisation provided the most significant improvements over the other CLOSLANG optimisations. The BVL optimisations and register allocator provide slightly more modest improvements, but they also clearly have important roles to play.…”

“…This language is the last language with explicit closure values, and is designed as a place where functionalprogramming specific optimisations (e.g., lambda lifting) can prepare the input programs for closure conversion. We give a brief overview of CLOSLANG and its optimisations here, and refer readers to Owens et al (2017) for a complete discussion, including the in-depth details of the techniques used to verify its various optimisations.…”

“…An alternative strategy is to use logical relations to relate the values via the semantics: two values are related if they are semantically equivalent. We use an untyped logical relation for CLOSLANG in some proofs (e.g., multi-argument introduction and dead-code elimination), see Owens et al (2017) for more details.…”

“…In particular, the semantics deals with the case where the argument numbers do not match. Owens et al (2017) explain our compilation strategy for and verification of multi-argument function compilation; here we give an overview.…”