Crellvm: Verified Credible Compilation for LLVM Seoul National - PowerPoint PPT Presentation

Crellvm: Verified Credible Compilation for LLVM Seoul National University (Korea) Jeehoon Kang* Yoonseung Kim * Youngju Song* Juneyoung Lee Sanghoon Park Mark Dongyeon Shin Yonghyun Kim Sungkeun Cho Joonwon Choi (MIT) Chung-Kil Hur Kwangkeun Yi * The first three authors are listed alphabetically.

Reliability of Production Compilers  Stable in most common cases  Unstable in corner cases • Csmith: 79 from GCC / 202 from LLVM • EMI: 79 from GCC / 68 from LLVM  Problematic in practice • Low-level systems code 2

Reliability of Production Compilers  Stable in most common cases  Unstable in corner cases • Csmith: 79 from GCC / 202 from LLVM • EMI: 79 from GCC / 68 from LLVM  Problematic in practice • Low-level systems code  Goal: Improving reliability in corner cases 2

Approaches to Improving Reliability src Compiler tgt 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability Compiler ✔ Test tgt 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability Verified ✔  Compiler Verification Compiler • Too expensive to apply to tgt major optimizations of LLVM 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability  Compiler Verification Compiler • Too expensive to apply to ✔ Verified tgt major optimizations of LLVM  Translation Validation • High reliability but not too expensive 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability  Compiler Verification Proof Compiler Checker ProofGen • Too expensive to apply to tgt major optimizations of LLVM Yes / No  Translation Validation • High reliability but not too expensive • Credible Compilation [Rinard & Marinov 1999] 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability  Compiler Verification Proof Compiler Checker ProofGen • Too expensive to apply to tgt major optimizations of LLVM Yes / No  Translation Validation fails with • High reliability but not too expensive logical reason • Credible Compilation [Rinard & Marinov 1999] 3

Approaches to Improving Reliability  (Random) Testing src • Cannot guarantee high reliability Verified ✔  Compiler Verification Proof Compiler Checker ProofGen • Too expensive to apply to tgt major optimizations of LLVM Yes / No  Translation Validation fails with • High reliability but not too expensive logical reason • Verified Credible Compilation • Credible Compilation [Rinard & Marinov 1999] 3

Our Work: Crellvm  Crellvm • Developed a verified credible compilation framework for LLVM • Designed a logic specialized for translation validation • Verified its proof checker in Coq  Case studies • 3 major optimizations: mem2reg, gvn, licm • >100 peephole optimizations: instcombine  Result • Found 4 long-standing miscompilation bugs (all confirmed, 3 fixed) 4

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { undef r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { undef undef r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { undef undef r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { r := *p foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { r := *p 42 foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg  Credible compilation may detect bugs that testing misses.  Simplified code from SPEC Benchmark: p := alloca() ⇒ loop { loop { undef r := *p 42 foo(r) foo(undef) *p := 42 } } 5

Example: A Bug We Found in mem2reg Why testing missed this bug?  Credible compilation may detect bugs that testing misses. Because foo ignores r: foo(r):  Simplified code from SPEC Benchmark: ... s = r & 0x0 ... p := alloca() ⇒ loop { loop { undef r := *p 42 foo(r) foo(undef) *p := 42 } } 5

Crellvm framework 6 / 22

Crellvm Framework Compilation Validation src.ll Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll llvm-diff Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

Crellvm Framework Compilation Validation src.ll Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll llvm-diff Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

Crellvm Framework Compilation Validation src.ll Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll llvm-diff Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

Crellvm Framework Compilation Validation src.ll Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll α -equivalence llvm-diff checking Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

Crellvm Framework Compilation Validation src.ll Verified ✔ Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll α -equivalence llvm-diff checking Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

Crellvm Framework Compilation Validation src.ll Verified ✔ Optimizer Optimizer Proof ProofGen Proof Checker Yes / No tgt.ll tgt'.ll Based on a logic for Based on a logic for Based on a logic for α -equivalence llvm-diff optimization validation optimization validation optimization validation checking Yes (same) / No (not same) Validation succeeds if both are “Yes” 7

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : foo(y) foo(y) 21 : 8 / 22

Extensible ERHL: A Logic for Optimization Validation Relational Hoare  Assoc-add optimization in instcombine Logic x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : foo(y) foo(y) 21 : 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : foo(y) foo(y) 21 : 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : foo(y) foo(y) 21 : 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : foo(y) foo(y) 21 : 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine x := add a 1 x := add a 1 10 : ⁞ ⁞ y := add x 2 y := add a 3 20 : Optimized foo(y) foo(y) 21 : 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine MD = ∅ { } x := add a 1 x := add a 1 10 : { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } Relational ⁞ ⁞ assertions { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } y := add x 2 y := add a 3 20 : { MD = ∅ } foo(y) foo(y) 21 : MD = ∅ { } 8 / 22

ERHL: A Logic for Optimization Validation  Assoc-add optimization in instcombine MD = ∅ { } x := add a 1 x := add a 1 10 : { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } ⁞ ⁞ { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } Pre- assertion y := add x 2 y := add a 3 20 : { MD = ∅ } Post- assertion foo(y) foo(y) 21 : MD = ∅ { } 8 / 22

ERHL: A Logic for Optimization Validation (Relational Property)  Assoc-add optimization in instcombine All registers contain same value MD = ∅ { } in SRC & TGT x := add a 1 x := add a 1 10 : { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } ⁞ ⁞ { x 𝒕𝒔𝒅 = add a 𝒕𝒔𝒅 𝟐 MD = ∅ } y := add x 2 y := add a 3 20 : { MD = ∅ } foo(y) foo(y) 21 : MD = ∅ { } 8 / 22