Fast machine words in I = Andreas Lochbihler Digital - PowerPoint PPT Presentation

e H l O l L e b a ∀ s Fast machine words in I = α λ β → Andreas Lochbihler Digital Asset (Switzerland) GmbH

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML 2

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML proving evaluation 3

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML + ∗ & < < proving evaluation 4

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML Native + ∗ Word & < < proving evaluation 5

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML Native + ∗ Word & < < TCB proving evaluation 6

e H O l l L e b Code generation in a ∀ s I = α λ β → code executable generator definitions Haskell FFI SML Native + Requirements : ∗ • efficient Word & < < • support all target languages TCB proving • validated evaluation 7

e H O l l L e b Code generation in a ∀ s I = α λ β → Isabelle/CakeML code executable generator definitions Haskell FFI SML Native + Requirements : ∗ • efficient Word & < < • support all target languages TCB proving • validated evaluation 8

What is the result on 32-bit words? − 5 mod 3 = 9

What is the result on 32-bit words?  Isabelle 2  OCaml 1 − 5 mod 3 = Scala 1 Haskell 2  SML 2 10

What is the result on 32-bit words?  Isabelle 2  OCaml 1 − 5 mod 3 = Scala 1 Haskell 2  SML 2 < (2 31 + 1)= 1 < 11

What is the result on 32-bit words?  Isabelle 2  OCaml 1 − 5 mod 3 = Scala 1 Haskell 2  SML 2  Isabelle 0  < (2 31 + 1)= OCaml unspecified 1 < Scala 2 Haskell unspecified  SML implementation-defined 12

What is the result on 32-bit words?  Isabelle 2  OCaml 1 − 5 mod 3 = Scala 1 Haskell 2  SML 2  Isabelle 0  < (2 31 + 1)= OCaml unspecified 1 < Scala 2 � PolyML 32-bit Haskell unspecified 2  SML implementation-defined PolyML 64-bit 0 13

Available bit-widths bits PolyML SMLNJ mlton OCaml GHC Scala 32 64 32 64 √ √ √ √ √ √ 8 √ √ √ 16 √ √ √ √ √ √ √ √ 32 √ √ √ √ √ √ √ 64 default 31 63 31 32 31 63 ≥ 30 32 = signed operations only 14

Let’s abstract over these differences I Native Word uint8 uint16 uint32 HOL-Word (Dawson et al.) uint64 copy α word ≃ { 0 , . . . , 2 α − 1 } uint FFI Haskell lift operations operations SML transfer theorems proofs applications 15

Let’s abstract over these differences II Conventional approach 1. Identify subset of common behaviour definition divmod-abs x y = ( | x | div | y | , | x | mod | y | ) 2. Reduce to restricted behaviour lemma [ code ]: divmod x y = . . . if sgn x = sgn y then divmod-abs x y else . . . 3. Common FFI for all languages code-printing divmod-abs → ( Haskell ) divMod (abs ) ) (abs ( OCaml ) . . . ( Scala ) . . . ( SML ) . . . 16

Let’s abstract over these differences II Conventional approach 1. Identify subset of common behaviour definition divmod-abs x y = ( | x | div | y | , | x | mod | y | ) 2. Reduce to restricted behaviour lemma [ code ]: divmod x y = . . . if sgn x = sgn y then divmod-abs x y else . . . 2 case distinctions on the sign of each operand 3. Common FFI for all languages PolyML: 2X slowdown code-printing divmod-abs → ( Haskell ) divMod (abs ) ) (abs ( OCaml ) . . . ( Scala ) . . . ( SML ) . . . 17

Let’s abstract over these differences II Conventional approach Cascading 1. Identify subset of common behaviour 1. Model behaviours of target languages definition divmod-abs x y = definition uint32-div x y = . . . ( | x | div | y | , | x | mod | y | ) definition uint32-sdiv x y = . . . 2. Reduce to restricted behaviour 2. Build cascade of models lemma [ code ]: divmod x y = lemma [ code ]: . . . if sgn x = sgn y then divmod-abs x y div x y = . . . uint32-div . . . else . . . uint32-div x y = . . . uint32-sdiv . . . 3. Common FFI for all languages 3. One FFI for each language code-printing divmod-abs → code-printing uint32-div → ( Haskell ) divMod (abs ) ) (abs ( Haskell ) Prelude.div ( OCaml ) . . . code-printing uint32-sdiv → ( Scala ) . . . ( OCaml ) Int32.div ( SML ) . . . code-printing . . . → . . .

Let’s abstract over these differences II Conventional approach Cascading div uint32 1. Identify subset of common behaviour 1. Model behaviours of target languages SML definition divmod-abs x y = definition uint32-div x y = . . . ( | x | div | y | , | x | mod | y | ) definition uint32-sdiv x y = . . . Haskell uint32-div 2. Reduce to restricted behaviour 2. Build cascade of models lemma [ code ]: divmod x y = lemma [ code ]: . . . if sgn x = sgn y then divmod-abs x y uint32-sdiv div x y = . . . uint32-div . . . else . . . uint32-div x y = . . . uint32-sdiv . . . 3. Common FFI for all languages 3. One FFI for each language div 32 word code-printing divmod-abs → code-printing uint32-div → ( Haskell ) divMod (abs ) ) (abs ( Haskell ) Prelude.div ( OCaml ) . . . code-printing uint32-sdiv → ( Scala ) . . . . ( OCaml ) Int32.div . . ( SML ) . . . code-printing . . . → . . . 19

What about unspecified behaviour? Underspecification in OCaml Underspecification in HOL code-printing x << n is undefined definition uint32-shiftl x n = if n > 32 if n ≤ 32 then x < < n else undefined ( < < ) x n lemma [ code ]: x < < n = if n ≤ 32 then uint32-shiftl x n else 0 20

Underspecification leads to refinement HOL axioms definitions Correctness w/o underspecification: If code c terminates with result r, then we can derive c = r.

Underspecification leads to refinement HOL axioms definitions Correctness with underspecification: Correctness w/o underspecification: If code c terminates with result r, Every derivable property of the code c applies to the result r. then we can derive c = r. 22

Underspecification leads to refinement c = 23 c = 42 c = 17 ( ε x . x > 0) = 1 ( ε x . x > 0) = 2 ( ε x . x > 0) = 3 HOL axioms definitions Correctness with underspecification: Correctness w/o underspecification: If code c terminates with result r, Every derivable property of the code c applies to the result r. then we can derive c = r. 23

Underspecification leads to refinement Haskell c = 23 c = 42 c = 17 ( ε x . x > 0) = 1 ( ε x . x > 0) = 2 ( ε x . x > 0) = 3 Running underspecified functions HOL axioms introduces refinement! definitions Correctness with underspecification: Correctness w/o underspecification: If code c terminates with result r, Every derivable property of the code c applies to the result r. then we can derive c = r. 24

Underspecification leads to refinement Haskell c = 23 c = 42 c = 17 ( ε x . x > 0) = 1 ( ε x . x > 0) = 2 ( ε x . x > 0) = 3 Forbid underspecification Running underspecified functions HOL axioms for proofs! introduces refinement! definitions Correctness with underspecification: Correctness w/o underspecification: If code c terminates with result r, Every derivable property of the code c applies to the result r. then we can derive c = r. 25

Default word size with underspecified bit width bits PolyML SMLNJ mlton OCaml GHC Scala 32 64 32 64 √ √ √ √ √ √ 8 √ √ √ 16 √ √ √ √ √ √ √ √ 32 √ √ √ √ √ √ √ 64 default 31 63 31 32 31 63 > 30 32 26

Default word size with underspecified bit width bits PolyML SMLNJ mlton OCaml GHC Scala 32 64 32 64 √ √ √ √ √ √ 8 √ √ √ 16 √ √ √ √ √ √ √ √ 32 √ √ √ √ √ √ √ 64 uint default 31 63 31 32 31 63 > 30 32 Unspecified bit size 27

Default word size with underspecified bit width bits PolyML SMLNJ mlton OCaml GHC Scala 32 64 32 64 √ √ √ √ √ √ 8 √ √ √ 16 √ √ √ √ √ √ √ √ 32 √ √ √ √ √ √ √ 64 uint default 31 63 31 32 31 63 > 30 32 Unspecified bit size ◮ hashing ◮ bit vectors ◮ dynamic implementation choices based on input size 28

Validation ◮ Framework to run test cases from within Isabelle/HOL 251 div 3 = 83 test-code in Scala 29

Validation ◮ Framework to run test cases from within Isabelle/HOL 251 div 3 = 83 test-code in Scala SMLNJ MLton GHC PolyML ◮ Test cases for all operations on uint ∗ 30

Validation ◮ Framework to run test cases from within Isabelle/HOL 251 div 3 = 83 test-code in Scala SMLNJ MLton GHC PolyML ◮ Test cases for all operations on uint ∗ ◮ Revealed many errors in the FFI mapping – now fixed ◮ Found one error in PolyML 5.6 in 64-bit mode – fixed in 5.7 18446744073709551611 div 3 evaluates to 1431655763 31