Iosif Itkin, profile picture
Uploaded byIosif Itkin
PDF, PPTX1,293 views

TMPA-2017: Vellvm - Verifying the LLVM

The document presents the Vellvm project, which focuses on verifying LLVM intermediate representation (IR) through formal methods and its implementation in Coq. It discusses various techniques for enhancing software reliability, safety, and correctness, highlighting the success of the CompCert C compiler in producing reliable optimizations that resist common bugs found in other compilers. The presentation details LLVM’s operational semantics, the need for high assurance software, and the integration of verification into compiler infrastructure.

Embed presentation

Download as PDF, PPTX
Vellvm: Verifying the LLVM IR Steve Zdancewic University of Pennsylvania TMPA 2017
Collaborators •  Jianzhou Zhao •  Dmitri Garbuzov •  William Mansky •  ChrisGne Rizkallah •  Richard Zhang •  Milo M.K. MarGn •  Santosh NagarakaLe •  Gil Hur •  Jeehon Kang •  Viktor Vafeiadis
The Science of Deep SpecificaGon •  Andrew Appel (Princeton) •  Adam Chlipala (MIT) •  Zhong Shao (Yale) •  Benjamin Pierce (U. Penn.) •  Stephanie Weirich (U. Penn.)
The Need For High Assurance So[ware 4 heartbleed car hacking stuxnet buffer overflow aLacks
Deep SpecificaGons •  Rich – expressive descripGon •  Formal – mathemaGcal, machine-checked •  2-Sided – tested from both sides •  Live – connected to real, executable code Goal: Advance the reliability, safety, security, and cost-effecGveness of so[ware (and hardware).
The Coq InteracGve Theorem Prover •  Based on dependent type theory •  Pure funcGonal language + datatypes •  ConstrucGve proofs ⇒ executable code •  AutomaGon: tacGcs + inference ⇒ formalizaGon tool of choice for DeepSpec team [Developed at INRIA]
DeepSpec: InterconnecGons
DeepSpec: InterconnecGons
LLVM: Low-Level Virtual Machine
LLVM Compiler Infrastructure LLVM Front Ends Code Gen/Jit OpGmizaGons/ TransformaGons Typed SSA IR Analysis [LaLner et al. ]
MoGvaGon: So[Bound/CETS •  Buffer overflow vulnerabiliGes. •  Detect spaGal/temporal memory safety violaGons in legacy C code. •  Implemented as an LLVM pass. •  What about correctness? [NagarakaLe, et al. PLDI ’09, ISMM ‘10] hLp://www.cis.upenn.edu/acg/so[bound/
InspiraGon: CompCert 12 [Xavier Leroy INRIA Rocquencourt] OpGmizing C Compiler: proved correct end-to-end with machine-checked proof in Coq C language CompCert Compiler ISA rich, formal, 2-sided, live
Does Such VerificaGon Work? LLVM Csmith Tool Random test-case generaGon {8 other C compilers} + CompCert 79 bugs (25 criGcal) 202 bugs 325 bugs in total Source Programs [Yang et al. PLDI 2011]
YES! VerificaGon Works "The striking thing about our CompCert results is that the middle-end bugs we found in all other compilers are absent. As of early 2011, the under-development version of CompCert is the only compiler we have tested for which Csmith cannot find wrong-code errors. This is not for lack of trying: we have devoted about six CPU-years to the task. The apparent unbreakability of CompCert supports a strong argument that developing compiler opEmizaEons within a proof framework, where safety checks are explicit and machine-checked, has tangible benefits for compiler users." – Regehr et. al 2011
LLVM Compiler Infrastructure LLVM Front Ends Code Gen/Jit OpGmizaGons/ TransformaGons Typed SSA IR Analysis [LaLner et al. ]
LLVM Compiler Infrastructure LLVM Front Ends Code Gen/Jit OpGmizaGons/ TransformaGons Typed SSA IR Analysis [LaLner et al.]
The Vellvm Project OpGmizaGons/ TransformaGons Typed SSA IR Analysis •  Formal semanGcs •  FaciliGes for creaGng simulaGon proofs •  Implemented in Coq •  Extract passes for use with LLVM compiler •  Example: verified memory safety instrumentaGon [Zhao et al. POPL 2012, CPP 2012, PLDI 2013]
Vellvm Framework Transform C Source Code Other OpGmizaGons LLVM IR LLVM IR Target LLVM OCaml Bindings Printer Parser Coq Syntax OperaGonal SemanGcs Memory Model Type System and SSA Proof Techniques & Metatheory Extract
Vellvm Framework C Source Code Other OpGmizaGons LLVM IR LLVM IR Target LLVM OCaml Bindings Printer Parser Coq Syntax OperaGonal SemanGcs Memory Model Type System and SSA Proof Techniques & Metatheory Extract Verified Transform
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... Control-flow Graphs: + Labeled blocks exit: r7 = ... r8 = r1 x r2 r9 = r7 + r8 loop: r3 = ... r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... Control-flow Graphs: + Labeled blocks + Binary OperaGons exit: r7 = ... r8 = r1 x r2 r9 = r7 + r8 loop: r3 = ... r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... br r0 loop exit Control-flow Graphs: + Labeled blocks + Binary OperaGons + Branches/Return exit: r7 = ... r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = ... r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... br r0 loop exit Control-flow Graphs: + Labeled blocks + Binary OperaGons + Branches/Return + StaGc Single Assignment (each variable assigned only once, staGcally) exit: r7 = ... r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = ... r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... br r0 loop exit Control-flow Graphs: + Labeled blocks + Binary OperaGons + Branches/Return + StaGc Single Assignment + φ nodes exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit
LLVM IR by Example entry: r0 = ... r1 = ... r2 = ... br r0 loop exit Control-flow Graphs: + Labeled blocks + Binary OperaGons + Branches/Return + StaGc Single Assignment + φ nodes (choose values based on predecessor blocks) exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit
(UnopGmized) LLVM IR Code 27 example.c define i32 @factorial(i32 %n) nounwind uwtable ssp { entry: %1 = alloca i32, align 4 %acc = alloca i32, align 4 store i32 %n, i32* %1, align 4 store i32 1, i32* %acc, align 4 br label %start start: ; preds = %entry, %else %3 = load i32* %1, align 4 %4 = icmp ugt i32 %3, 0 br i1 %4, label %then, label %else then: ; preds = %start %6 = load i32* %acc, align 4 %7 = load i32* %1, align 4 %8 = mul i32 %6, %7 store i32 %8, i32* %acc, align 4 %9 = load i32* %1, align 4 %10 = sub i32 %9, 1 store i32 %10, i32* %1, align 4 br label %start else: ; preds = %start %12 = load i32* %acc, align 4 ret i32 %12 } example.ll unsigned factorial(unsigned n) { unsigned acc = 1; while (n > 0) { acc = acc * n; n = n -1; } return acc; }
Other Parts of the LLVM IR 28 op ::= %uid | constant | undef Operands bop ::= add | sub | mul | shl | … OperaEons cmpop ::= eq | ne | slt | sle | … Comparison insn ::= | %uid = alloca ty Stack AllocaEon | %uid = load ty op1 Load | store ty op1, op2 Store | %uid = getelementptr ty op1 … Address CalculaEon | %uid = call rt fun(…args…) FuncEon Calls | … phi ::= | φ[op1;lbl1]...[opn;lbln] terminator ::= | ret %ty op | br op label %lbl1, label %lbl2 | br label %lbl
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
LLVM IR SemanGcs SSA CFG ≈ funcGonal program + •  Types & Memory Layout –  structured, recursive types –  type-directed projecGon –  type casts •  Effects –  structured heap load/store –  system calls (I/O) –  nondeterminism [Appel 1998] We know how to model this and prove properGes about the models.
LLVM’s memory model •  Manipulate structured types. %ST = type {i10,[10 x i8*]} i10 i8* i8* i8* i8* i8* i8* i8* i8* i8* i8* High-level RepresentaGon %val = load %ST* %ptr … store %ST* %ptr, %new
LLVM’s memory model •  Manipulate structured types. •  SemanGcs is given in terms of byte-oriented low-level memory. –  padding & alignment –  physical subtyping %ST = type {i10,[10 x i8*]} b(10, 136) 0 b(10, 2) 1 uninit 2 uninit 3 ptr(Blk32,0,0) 4 ptr(Blk32,0,1) 5 ptr(Blk32,0,2) 6 ptr(Blk32,0,3) 7 ptr(Blk32,8,0) 8 ptr(Blk32,8,1) 9 ptr(Blk32,8,2) 10 ptr(Blk32,8,3) 11 … 12 … … i10 i8* i8* i8* i8* i8* i8* i8* i8* i8* i8* High-level RepresentaGon Low-level RepresentaGon %val = load %ST* %ptr … store %ST* %ptr, %new
Dynamic Physical Subtyping b(10, 136) 0 b(10, 2) 1 uninit 2 uninit 3 ptr(Blk32,0,0) 4 ptr(Blk32,0,1) 5 ptr(Blk32,0,2) 6 ptr(Blk32,0,3) 7 ptr(Blk32,8,0) 8 ptr(Blk32,8,1) 9 ptr(Blk32,8,2) 10 ptr(Blk32,8,3) 11 … 12 … … Blk0 Blk1 Blk32 b(16, 1) 0 b(16, 0) 1 uninit 2 uninit 3 uninit 4 uninit 5 uninit 6 uninit 7 ptr(Blk1,0,0) 8 ptr(Blk1,0,1) 9 ptr(Blk1,0,2) 10 ptr(Blk1,0,3) 11 … 12 … … i10 load i16*
 ⇒ 1 ✓ load i16*
 ⇒ undef ✗ [Nita, et al. POPL ’08]
Fatal Errors Target-dependent Results Sources of Undefined Behavior •  UniniGalized variables: •  UniniGalized memory: •  Ill-typed memory usage •  Out-of-bounds accesses •  Access dangling pointers •  Free invalid pointers •  Invalid indirect calls %v = add i32 %x, undef %ptr = alloca i32 %v = load (i32*) %ptr Nondeterminism Stuck States
Target-dependent Results Sources of Undefined Behavior •  UniniGalized variables: •  UniniGalized memory: •  Ill-typed memory usage %v = add i32 %x, undef %ptr = alloca i32 %v = load (i32*) %ptr Nondeterminism Stuck States Stuck(f, σ) = BadFree(f, σ) ˅ BadLoad(f, σ) ˅ BadStore(f, σ) ˅ … ˅ …0 Defined by a predicate on the program configuraGon.
undef •  What is the value of %y a[er running the following? •  One plausible answer: 0 •  Not LLVM’s semanGcs! (LLVM is more liberal to permit more aggressive opGmizaGons) %x = or i8 undef, 1 %y = xor i8 %x %x
undef •  ParGally defined values are interpreted nondeterminisEcally as sets of possible values: ⟦%x⟧ = {a or b | a∈⟦i8 undef⟧, b ∈⟦1⟧}
 = {1,3,5,…,255} ⟦%y⟧ = {a xor b | a∈⟦%x⟧, b∈⟦%x⟧} = {0,2,4,…,254} %x = or i8 undef, 1 %y = xor i8 %x %x ⟦i8 undef⟧ = {0,…,255} ⟦i8 1⟧ = {1}
LLVMND OperaGonal SemanGcs •  Define a transiGon relaGon: f ⊢ σ1 ⟼ σ2 –  f is the program –  σ is the program state: pc, locals(δ), stack, heap •  NondeterminisGc –  δ maps local %uids to sets. –  Step relaGon is nondeterminisGc •  Mostly straigh~orward (given the heap model) –  One wrinkle: phi-nodes exectuted atomically
OperaGonal SemanGcs Small Step Big Step NondeterminisGc DeterminisGc LLVMND
DeterminisGc Refinement Small Step Big Step NondeterminisGc DeterminisGc LLVMND LLVMD ∋︎ InstanGate ‘undef’ with default value (0 or null) ⇒ determinisGc.
Big-step DeterminisGc Refinements Small Step Big Step NondeterminisGc DeterminisGc LLVMND LLVMDLLVMInterp ≈︎ ∋︎ BisimulaGon up to “observable events”: •  external funcGon calls
Big-step DeterminisGc Refinements [Tristan, et al. POPL ’08, Tristan, et al. PLDI ’09] Small Step Big Step NondeterminisGc DeterminisGc LLVMND LLVMD LLVM* DFn LLVM* DBLLVMInterp ≈︎ ≿︎ ≿︎ ∋︎ SimulaGon up to “observable events”: •  useful for encapsulaGng behavior of funcGon calls •  large step evaluaGon of basic blocks
A Taste of Coq FormalizaGon …
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
Reasoning About LLVM Code How do we prove that a program transformaGon is correct with respect to the defined operaGonal semanGcs? •  Safety Invariants (preservaGon and progress) •  SimulaGon techniques
Key SSA Invariant entry: r0 = ... r1 = ... r2 = ... br r0 loop exit exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit DefiniGon of r2. Use of r2. Uses of r2.
Key SSA Invariant entry: r0 = ... r1 = ... r2 = ... br r0 loop exit exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit DefiniGon of r2. Use of r2. Uses of r2. The definiGon of a variable must dominate its uses.
Safety ProperGes •  A well-formed program never accesses undefined variables. •  Ini=aliza=on: •  Preserva=on: •  Progress: If ⊢ f and f ⊢ σ0 ⟼* σ then σ is not stuck. ⊢ f program f is well formed σ program state f ⊢ σ ⟼* σ evaluaGon of f If ⊢ f then wf(f, σ0). If ⊢ f and f ⊢ σ ⟼ σ’ and wf(f, σ) then wf(f, σ’) If ⊢ f and wf(f, σ) then f ⊢ σ ⟼ σ’
Safety ProperGes •  A well-formed program never accesses undefined variables. •  Ini=aliza=on: •  Preserva=on: •  Progress: If ⊢ f and f ⊢ σ0 ⟼* σ then σ is not stuck. ⊢ f program f is well formed σ program state f ⊢ σ ⟼* σ evaluaGon of f If ⊢ f then wf(f, σ0). If ⊢ f and f ⊢ σ ⟼ σ’ and wf(f, σ) then wf(f, σ’) If ⊢ f and wf(f, σ) then done(f,σ) or stuck(f,σ) or f ⊢ σ ⟼ σ’
Well-formed States entry: r0 = ... r1 = ... r2 = ... br r0 loop exit exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit pc State σ is: pc = program counter δ = local values
Well-formed States entry: r0 = ... r1 = ... r2 = ... br r0 loop exit exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit pc State σ is: pc = program counter δ = local values sdom(f,pc) = variable defns. that strictly dominate pc.
Well-formed States entry: r0 = ... r1 = ... r2 = ... br r0 loop exit exit: r7 = φ[0;entry][r5;loop] r8 = r1 x r2 r9 = r7 + r8 ret r9 loop: r3 = φ[0;entry][r5;loop] r4 = r1 x r2 r5 = r3 + r4 r6 = r5 ≥ 100 br r6 loop exit pc State σ contains: pc = program counter δ = local values sdom(f,pc) = variable defns. that strictly dominate pc. wf(f,σ) = ∀r∊sdom(f,pc). ∃v. δ(r) = ⎣v⎦ “All variables in scope are iniGalized.”
Generalizing Safety •  DefiniGon of wf: •  Generalize like this: •  Methodology: for a given P prove three theorems: IniEalizaEon(P) PreservaEon(P) Progress(P) wf(f,(pc, δ)) = ∀r∊sdom(f,pc). ∃v. δ(r) = ⎣v⎦ wf(f,(pc, δ)) = P f (δ|sdom(f,pc)) where P : Program ⟶ Locals ⟶ Prop Consider only variables in scope ⇒ P defined relaGve to the dominator tree of the CFG.
InstanGaGng •  For usual safety: •  For semanGc properGes: •  Useful for verifying correctness of: – code moGon, dead variable eliminaGon, common expression eliminaGon, etc. Psafety f δ = ∀r∊dom(δ). ∃v. δ(r) = ⎣v⎦ Psem f δ = ∀r. f[r] = ⎣rhs⎦ ⇒ δ(r) = ⟦rhs⟧δ
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
So[Bound So[Bound C Source Code Other OpGmizaGons LLVM IR LLVM IR Target •  Implemented as an LLVM pass. •  Detect spaGal/temporal memory safety violaGons in legacy C code. •  Good test case: –  Safety CriGcal ⇒ Proof cost warranted –  Non-trivial Memory transformaGon
So[Bound So[Bound C Source Code Other OpGmizaGons LLVM IR LLVM IR Target %p = call malloc [10 x i8] %q = gep %p, i32 0, i32 255 store i8 0, %q %p = call malloc [10 x i8] %p_base = gep %p, i32 0 %p_bound = gep %p, i32 0, i32 10 %q = gep %p, i32 0, i32 255 %q_base = %p_base %q_bound = %p_bound assert %q_base <= %q / %q+1 < %q_bound store i8 0, %q Maintain base and bound for all pointers Propagate metadata on assignment Check that a pointer is within its bounds when being accessed
Disjoint Metadata •  Maintain pointer bounds in a separate memory space. •  Key Invariant: Metadata cannot be corrupted by bounds violaGon. User memory Disjoint metadata %p %pbase %pbound %i1 %q %qbase %qbound %i6 %i3
Proving So[Bound Correct 1.  Define So[Bound(f,σ) = (fs,σs) –  TransformaGon pass implemented in Coq. 2.  Define predicate: MemoryViolaGon(f,σ) 3.  Construct a non-standard operaGonal semanGcs: –  Builds in safety invariants “by construcGon” 4.  Show that the instrumented code simulates the “correct” code: SB f ⊢ σ ⟼ σ’ SB f ⊢ σ ⟼* σ’ ⇒ ¬MemoryViolaGon(f,σ’) So[Bound(f,σ) = (fs,σs) ⇒ [f ⊢ σ ⟼* σ’] ≿ [fs ⊢ σs ⟼* σ’s] SB
Lessons About So[Bound •  Found several bugs in our C++ implementaGon – InteracGon of undef, ‘null’, and metadata iniGalizaGon. •  SimulaGon proofs suggested a redesign of So[Bound’s handling of stack pointers. – Use a “shadow stack” – Simplify the design/implementaGon – Significantly more robust (e.g. varargs)
0% 50% 100% 150% 200% 250% Run5me overhead Extracted Competitive Runtime Overhead The performance of extracted SoftBound is competitive with the non-verified original
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
mem2reg in LLVM Front-ends w/o SSA construcGon The LLVM IR w/o φ-nodes mem2reg •  Promote stack allocas to temporaries •  Insert minimal φ-nodes •  imperaGve variables stack allocas •  no φ-nodes •  trivially in SSA form Backends SSA-based opGmizaGons The LLVM IR in the minimal SSA form
mem2reg Example int x = 0; if (y > 0) 
 x = 1; return x; l1: %p = alloca i32 store 0, %p %b = %y > 0 br %b, %l2, %l3 l2: store 1, %p br %l3 l3: %x = load %p ret %x The LLVM IR in the trivial SSA form
mem2reg Example int x = 0; if (y > 0) 
 x = 1; return x; l1: %p = alloca i32 store 0, %p %b = %y > 0 br %b, %l2, %l3 l2: store 1, %p br %l3 l3: %x = load %p ret %x The LLVM IR in the trivial SSA form l1: %b = %y > 0 br %b, %l2, %l3 l2: br %l3 l3: %x = φ[ 1,%l2] [ 0,%l1] ret %x Minimal SSA a[er mem2reg mem2reg
mem2reg Algorithm •  Main operaGons – Phi placement (Lengauer-Tarjan algorithm) – Renaming of the variables – Removing loads/stores •  Intermediate stage breaks SSA invariant – Defining semanGcs & well formedness non-trivial
vmem2reg Algorithm •  Incremental algorithm •  Pipeline of "micro transformaGons" – Preserves SSA semanGcs – Preserves well-formedness See: [Aycock & Horspool 2002.] max φs LAS/ LAA DSE DAE elim φ Find alloca
How to Establish Correctness? max φs LAS/ LAA DSE DAE elim φ Find alloca 1.  Simple aliasing properGes (e.g. to determine promotability) 2.  InstanGate proof technique for –  SubsGtuGon –  Dead InstrucGon EliminaGon PDIE = … IniGalize(PDIE) PreservaGon(PDIE) Progress(PDIE) 4. Put it all together to prove composiGon of “pipeline” correct. Aliasing ProperGes subst DIE
vmem2reg is Correct Theorem: The vmem2reg algorithm preserves the semanGcs of the source program. Proof: ComposiGon of simulaGon relaGons from the “mini” transformaGons, each built using instances of the sdom proof technique. (See Coq Vellvm development.) □
RunGme overhead of verified mem2reg 0% 20% 40% 60% 80% 100% 120% 140% 160% 180% 200% sjeng go compress ijpeg gzip vpr mesa art ammp equake libquantum lbm milc bzip2 parser twolf mcf h264 Geo.mean Speedup Over LLVM-O0 LLVM's mem2reg Extracted mem2reg Vmem2reg: 77% LLVM’s mem2reg: 81% (LLVM’s mem2reg promotes allocas used by intrinsics)
Plan •  Tour of the LLVM IR •  Vellvm infrastructure – OperaGonal SemanGcs – SSA Metatheory + Proof Techniques •  Case studies: – So[Bound memory safety – mem2reg •  Conclusion
Ongoing Work •  Modular SemanGcs –  Factor out memory model [CAV 15] –  Linking/separate compilaGon •  For: –  more extensibility/robustness to changes –  verifying more analyses and opGmizaGons / program transformaGons –  support for (relaxed) concurrency –  beLer support for casts [PLDI 15] LLVM SSA core IR Memory Model / IO Concurrency
•  Deep SpecificaGons –  rich, formal, 2-sided, live •  Layers of abstracGon –  Layer Calculus in CerGKOS [Shao et al.] –  Good for proofs! –  Bad for performance? –  ImplicaGons for theory / proof engineering? •  ComposiGonal specificaGon –  ComposiGonal CompCert [Stewart, et al. PLDI 15] •  So[ware Engineering ⇒ Proof Engineering –  Coq development methodology [CPDT: Chlipala] What engineering principles enable large-scale deep specifications?
Conclusions •  Proof techniques for verifying LLVM transformaGons •  Verified: –  So[bound & vmem2reg –  Similar performance to naGve implementaGons •  Future: –  IntegraGon with other DeepSpec projects [hLp://www.cis.upenn.edu/~stevez/vellvm/]

More Related Content

PPTX
ERG HAZMAT.pptx
byMohd Fazill
 
PPTX
Balsenes ļaundabīgi auzdēji
byЭммочка Соколова
 
PPTX
Self-Change Project
byEricaSGoderwis
 
PDF
Améliorer la performance par l'analyse de données de qualité
byXL Groupe
 
PDF
TMPA-2017: Unity Application Testing Automation with Appium and Image Recogni...
byIosif Itkin
 
PDF
TMPA-2017: Compositional Process Model Synthesis based on Interface Patterns
byIosif Itkin
 
PDF
TMPA-2017: Conference Opening
byIosif Itkin
 
PDF
TMPA-2017: Distributed Analysis of the BMC Kind: Making It Fit the Tornado Su...
byIosif Itkin
 
ERG HAZMAT.pptx
byMohd Fazill
 
Balsenes ļaundabīgi auzdēji
byЭммочка Соколова
 
Self-Change Project
byEricaSGoderwis
 
Améliorer la performance par l'analyse de données de qualité
byXL Groupe
 
TMPA-2017: Unity Application Testing Automation with Appium and Image Recogni...
byIosif Itkin
 
TMPA-2017: Compositional Process Model Synthesis based on Interface Patterns
byIosif Itkin
 
TMPA-2017: Conference Opening
byIosif Itkin
 
TMPA-2017: Distributed Analysis of the BMC Kind: Making It Fit the Tornado Su...
byIosif Itkin
 

Viewers also liked

PDF
TMPA-2017: Static Checking of Array Objects in JavaScript
byIosif Itkin
 
PDF
TMPA-2017: Live testing distributed system fault tolerance with fault injecti...
byIosif Itkin
 
PDF
TMPA-2017: Generating Cost Aware Covering Arrays For Free
byIosif Itkin
 
PDF
TMPA-2017: 5W+1H Static Analysis Report Quality Measure
byIosif Itkin
 
PDF
TMPA-2017: Defect Report Classification in Accordance with Areas of Testing
byIosif Itkin
 
PDF
TMPA-2017: Using Functional Directives to Analyze Code Complexity and Communi...
byIosif Itkin
 
PDF
TMPA-2017: Technology and Tools for Developing Industrial Software Test Suite...
byIosif Itkin
 
PDF
TMPA-2017: Predicate Abstraction Based Configurable Method for Data Race Dete...
byIosif Itkin
 
PDF
TMPA-2017: A Survey on Model-Based Testing Tools for Test Case Generation
byIosif Itkin
 
PDF
TMPA-2017: Regression Testing with Semiautomatic Test Selection for Auditing ...
byIosif Itkin
 
PDF
TMPA-2017: Evolutionary Algorithms in Test Generation for digital systems
byIosif Itkin
 
PDF
TMPA-2017: Functional Parser of Markdown Language Based on Monad Combining an...
byIosif Itkin
 
PDF
TMPA-2017: The Quest for Average Response Time
byIosif Itkin
 
PDF
TMPA-2017: A Survey of High-Performance Computing for Software Verification
byIosif Itkin
 
PDF
TMPA-2017: Modeling of PLC-programs by High-level Coloured Petri Nets
byIosif Itkin
 
PDF
TMPA-2017: Stemming Architectural Decay in Software Systems
byIosif Itkin
 
PDF
TMPA-2017: Layered Layouts for Software Systems Visualization
byIosif Itkin
 
PDF
TMPA-2017: Dl-Check: Dynamic Potential Deadlock Detection Tool for Java Programs
byIosif Itkin
 
PDF
TMPA-2017: Extended Context-Free Grammars Parsing with Generalized LL
byIosif Itkin
 
PDF
TMPA-2017: Simple Type Based Alias Analysis for a VLIW Processor
byIosif Itkin
 
TMPA-2017: Static Checking of Array Objects in JavaScript
byIosif Itkin
 
TMPA-2017: Live testing distributed system fault tolerance with fault injecti...
byIosif Itkin
 
TMPA-2017: Generating Cost Aware Covering Arrays For Free
byIosif Itkin
 
TMPA-2017: 5W+1H Static Analysis Report Quality Measure
byIosif Itkin
 
TMPA-2017: Defect Report Classification in Accordance with Areas of Testing
byIosif Itkin
 
TMPA-2017: Using Functional Directives to Analyze Code Complexity and Communi...
byIosif Itkin
 
TMPA-2017: Technology and Tools for Developing Industrial Software Test Suite...
byIosif Itkin
 
TMPA-2017: Predicate Abstraction Based Configurable Method for Data Race Dete...
byIosif Itkin
 
TMPA-2017: A Survey on Model-Based Testing Tools for Test Case Generation
byIosif Itkin
 
TMPA-2017: Regression Testing with Semiautomatic Test Selection for Auditing ...
byIosif Itkin
 
TMPA-2017: Evolutionary Algorithms in Test Generation for digital systems
byIosif Itkin
 
TMPA-2017: Functional Parser of Markdown Language Based on Monad Combining an...
byIosif Itkin
 
TMPA-2017: The Quest for Average Response Time
byIosif Itkin
 
TMPA-2017: A Survey of High-Performance Computing for Software Verification
byIosif Itkin
 
TMPA-2017: Modeling of PLC-programs by High-level Coloured Petri Nets
byIosif Itkin
 
TMPA-2017: Stemming Architectural Decay in Software Systems
byIosif Itkin
 
TMPA-2017: Layered Layouts for Software Systems Visualization
byIosif Itkin
 
TMPA-2017: Dl-Check: Dynamic Potential Deadlock Detection Tool for Java Programs
byIosif Itkin
 
TMPA-2017: Extended Context-Free Grammars Parsing with Generalized LL
byIosif Itkin
 
TMPA-2017: Simple Type Based Alias Analysis for a VLIW Processor
byIosif Itkin
 

Similar to TMPA-2017: Vellvm - Verifying the LLVM

PPT
Introduction to llvm
byTao He
 
PPTX
07 140430-ipp-languages used in llvm during compilation
byAdam Husár
 
PPT
LLVM
byguest3e5046
 
PPTX
Как работает LLVM бэкенд в C#. Егор Богатов ➠ CoreHard Autumn 2019
bycorehard_by
 
PDF
Smalltalk JIT Compilation: LLVM Experimentation
byESUG
 
PDF
Part II: LLVM Intermediate Representation
byWei-Ren Chen
 
PDF
Appsec obfuscator reloaded
byCyber Security Alliance
 
PDF
LAS16-501: Introduction to LLVM - Projects, Components, Integration, Internals
byLinaro
 
PDF
20140531 serebryany lecture01_fantastic_cpp_bugs
byComputer Science Club
 
PDF
20140531 serebryany lecture01_fantastic_cpp_bugs
byComputer Science Club
 
PDF
BUD17-302: LLVM Internals #2
byLinaro
 
PDF
Haskell Symposium 2010: An LLVM backend for GHC
bydterei
 
PDF
LCU14 209- LLVM Linux
byLinaro
 
PDF
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
bymmisono
 
PDF
Introduction to Compiler Development
byLogan Chien
 
PPTX
Update on C++ Core Guidelines Lifetime Analysis. Gábor Horváth. CoreHard Spri...
bycorehard_by
 
PDF
Compiler2016 by abcdabcd987
by乐群 陈
 
PDF
Developments in LLVM-based toolchains and tooling for RISC-V
byIgalia
 
PDF
Finding bugs in the code of LLVM project with the help of PVS-Studio
byPVS-Studio
 
PDF
LLVM Register Allocation
byWang Hsiangkai
 
Introduction to llvm
byTao He
 
07 140430-ipp-languages used in llvm during compilation
byAdam Husár
 
LLVM
byguest3e5046
 
Как работает LLVM бэкенд в C#. Егор Богатов ➠ CoreHard Autumn 2019
bycorehard_by
 
Smalltalk JIT Compilation: LLVM Experimentation
byESUG
 
Part II: LLVM Intermediate Representation
byWei-Ren Chen
 
Appsec obfuscator reloaded
byCyber Security Alliance
 
LAS16-501: Introduction to LLVM - Projects, Components, Integration, Internals
byLinaro
 
20140531 serebryany lecture01_fantastic_cpp_bugs
byComputer Science Club
 
20140531 serebryany lecture01_fantastic_cpp_bugs
byComputer Science Club
 
BUD17-302: LLVM Internals #2
byLinaro
 
Haskell Symposium 2010: An LLVM backend for GHC
bydterei
 
LCU14 209- LLVM Linux
byLinaro
 
論文紹介 Hyperkernel: Push-Button Verification of an OS Kernel (SOSP’17)
bymmisono
 
Introduction to Compiler Development
byLogan Chien
 
Update on C++ Core Guidelines Lifetime Analysis. Gábor Horváth. CoreHard Spri...
bycorehard_by
 
Compiler2016 by abcdabcd987
by乐群 陈
 
Developments in LLVM-based toolchains and tooling for RISC-V
byIgalia
 
Finding bugs in the code of LLVM project with the help of PVS-Studio
byPVS-Studio
 
LLVM Register Allocation
byWang Hsiangkai
 

More from Iosif Itkin

PDF
Foundations of Software Testing Lecture 4
byIosif Itkin
 
PPTX
QA Financial Forum London 2021 - Automation in Software Testing. Humans and C...
byIosif Itkin
 
PDF
Exactpro FinTech Webinar - Global Exchanges Test Oracles
byIosif Itkin
 
PDF
Exactpro FinTech Webinar - Global Exchanges FIX Protocol
byIosif Itkin
 
PDF
Operational Resilience in Financial Market Infrastructures
byIosif Itkin
 
PDF
20 Simple Questions from Exactpro for Your Enjoyment This Holiday Season
byIosif Itkin
 
PDF
Testing the Intelligence of your AI
byIosif Itkin
 
PDF
EXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
byIosif Itkin
 
PDF
ClearTH Test Automation Framework: Case Study in IRS & CDS Swaps Lifecycle Mo...
byIosif Itkin
 
PPTX
EXTENT Talks 2019 Tbilisi: Failover and Recovery Test Automation - Ivan Shamrai
byIosif Itkin
 
PDF
EXTENT Talks QA Community Tbilisi 20 April 2019 - Conference Open
byIosif Itkin
 
PDF
User-Assisted Log Analysis for Quality Control of Distributed Fintech Applica...
byIosif Itkin
 
PPTX
QAFF Chicago 2019 - Complex Post-Trade Systems, Requirements Traceability and...
byIosif Itkin
 
PDF
QA Community Saratov: Past, Present, Future (2019-02-08)
byIosif Itkin
 
PDF
Machine Learning and RoboCop Testing
byIosif Itkin
 
PDF
Behaviour Driven Development: Oltre i limiti del possibile
byIosif Itkin
 
PDF
2018 - Exactpro Year in Review
byIosif Itkin
 
PPTX
Exactpro Discussion about Joy and Strategy
byIosif Itkin
 
PPTX
FIX EMEA Conference 2018 - Post Trade Software Testing Challenges
byIosif Itkin
 
PDF
BDD. The Outer Limits. Iosif Itkin at Youcon (in Russian)
byIosif Itkin
 
Foundations of Software Testing Lecture 4
byIosif Itkin
 
QA Financial Forum London 2021 - Automation in Software Testing. Humans and C...
byIosif Itkin
 
Exactpro FinTech Webinar - Global Exchanges Test Oracles
byIosif Itkin
 
Exactpro FinTech Webinar - Global Exchanges FIX Protocol
byIosif Itkin
 
Operational Resilience in Financial Market Infrastructures
byIosif Itkin
 
20 Simple Questions from Exactpro for Your Enjoyment This Holiday Season
byIosif Itkin
 
Testing the Intelligence of your AI
byIosif Itkin
 
EXTENT 2019: Exactpro Quality Assurance for Financial Market Infrastructures
byIosif Itkin
 
ClearTH Test Automation Framework: Case Study in IRS & CDS Swaps Lifecycle Mo...
byIosif Itkin
 
EXTENT Talks 2019 Tbilisi: Failover and Recovery Test Automation - Ivan Shamrai
byIosif Itkin
 
EXTENT Talks QA Community Tbilisi 20 April 2019 - Conference Open
byIosif Itkin
 
User-Assisted Log Analysis for Quality Control of Distributed Fintech Applica...
byIosif Itkin
 
QAFF Chicago 2019 - Complex Post-Trade Systems, Requirements Traceability and...
byIosif Itkin
 
QA Community Saratov: Past, Present, Future (2019-02-08)
byIosif Itkin
 
Machine Learning and RoboCop Testing
byIosif Itkin
 
Behaviour Driven Development: Oltre i limiti del possibile
byIosif Itkin
 
2018 - Exactpro Year in Review
byIosif Itkin
 
Exactpro Discussion about Joy and Strategy
byIosif Itkin
 
FIX EMEA Conference 2018 - Post Trade Software Testing Challenges
byIosif Itkin
 
BDD. The Outer Limits. Iosif Itkin at Youcon (in Russian)
byIosif Itkin
 

Recently uploaded

PPTX
On-Device AI with Gemma 3n and PaliGemma 2 Session Slides - GDG VESIT
bygdgcodecellcmpn
 
PDF
Master the FME Connector for ArcGIS: Streamlined Data Management & Robust Met...
bySafe Software
 
PDF
6 Insights from the Patron Saint of AI Failure
byScott M. Graffius
 
PPTX
Building Real-Time Voice AI — Udaiappa Ramachandran
byUdaiappa Ramachandran
 
PPTX
UNIT 1- Introduction to Basic of Computer Fundamentals
bypawarbhaktiit
 
PDF
DataLiva-LivaGRC- Business Software for Governance, Risk, and Compliance
byMustafa Kuğu
 
PPTX
Design Flaws and Known Attacks in Agentic AI - ITI Business Session
byInformation Technology Institute
 
PDF
A "Kill Switch" (Emergency Off Switch) for AI?
byScott M. Graffius
 
PDF
SAP WalkMe Overview.pdf SAP WalkMe Overview.pdf
byMurniatiSimbolon2
 
PDF
Best Bank Statement Converter Software - A Documentation-Based Meta-Analysis ...
bylewisconrada
 
PDF
Building Software in the AI Era: Spec-Driven Development with Kiro IDE
byHaim Michael
 
PPTX
How Blockchain Application Development Enables Trustless Digital Ecosystems.pptx
byLisa ward
 
PDF
Best-Travel-Portal-Development-Solutions-for-Online-Growth
bykashishnagarrajput
 
PDF
Using Change Data Capture (CDC) to Ingest Data into Apache Kafka
byGiovanni Marigi
 
PDF
Governing Agentic Enterprise - From Shadow AI to Autonomous Security.pdf
bysajjasridhar1990
 
PDF
Top 10 Dedicated Server Providers in Stockholm (Updated Edition).pdf
byAtal Networks
 
PDF
Intro to CrafterQ - AI Agent Platform for the Enterprise.pdf
byCrafterQ
 
PDF
Louisville User Group: Transforming Technical Debt into Technical Wealth
byLynda Kane
 
PPTX
Lecture 04. about Black heads and Hackerss.pptx
byvinocol222
 
PPTX
IBM_NEXA_DAC2021 NEXA, a cloud-native platform for collaborative hardware log...
byArun Joseph
 
On-Device AI with Gemma 3n and PaliGemma 2 Session Slides - GDG VESIT
bygdgcodecellcmpn
 
Master the FME Connector for ArcGIS: Streamlined Data Management & Robust Met...
bySafe Software
 
6 Insights from the Patron Saint of AI Failure
byScott M. Graffius
 
Building Real-Time Voice AI — Udaiappa Ramachandran
byUdaiappa Ramachandran
 
UNIT 1- Introduction to Basic of Computer Fundamentals
bypawarbhaktiit
 
DataLiva-LivaGRC- Business Software for Governance, Risk, and Compliance
byMustafa Kuğu
 
Design Flaws and Known Attacks in Agentic AI - ITI Business Session
byInformation Technology Institute
 
A "Kill Switch" (Emergency Off Switch) for AI?
byScott M. Graffius
 
SAP WalkMe Overview.pdf SAP WalkMe Overview.pdf
byMurniatiSimbolon2
 
Best Bank Statement Converter Software - A Documentation-Based Meta-Analysis ...
bylewisconrada
 
Building Software in the AI Era: Spec-Driven Development with Kiro IDE
byHaim Michael
 
How Blockchain Application Development Enables Trustless Digital Ecosystems.pptx
byLisa ward
 
Best-Travel-Portal-Development-Solutions-for-Online-Growth
bykashishnagarrajput
 
Using Change Data Capture (CDC) to Ingest Data into Apache Kafka
byGiovanni Marigi
 
Governing Agentic Enterprise - From Shadow AI to Autonomous Security.pdf
bysajjasridhar1990
 
Top 10 Dedicated Server Providers in Stockholm (Updated Edition).pdf
byAtal Networks
 
Intro to CrafterQ - AI Agent Platform for the Enterprise.pdf
byCrafterQ
 
Louisville User Group: Transforming Technical Debt into Technical Wealth
byLynda Kane
 
Lecture 04. about Black heads and Hackerss.pptx
byvinocol222
 
IBM_NEXA_DAC2021 NEXA, a cloud-native platform for collaborative hardware log...
byArun Joseph
 

TMPA-2017: Vellvm - Verifying the LLVM