Towards an Axiomatic Basis for C++ Gregory Malecha, Abhishek Anand, - PowerPoint PPT Presentation

Towards an Axiomatic Basis for C++ Gregory Malecha, Abhishek Anand, Gordon Stewart BedRock Systems

BedRock Systems Formally verifjed, deep specifjcations. Unbreakable Foundation for the Software Defjned World Enable everyone to write and share verifjed code! The future is built on BedRock.

Verifjcation target Guest Guest VMM ... vUART vETH VMM ... Mux Switch Zeta Userspace NOVA (microhypervisor) The future is built on BedRock.

Verifjcation target Guest Guest Deep correctness Deep correctness VMM ... vUART vETH properties of highly properties of highly VMM ... Mux Switch concurrent, low-level code. concurrent, low-level code. C++ Code C++ Code Zeta Userspace NOVA (microhypervisor) The future is built on BedRock.

Working with C++ The future is built on BedRock.

The verifjcation toolchain From source to proof? a.cpp a_cpp_proof.v The future is built on BedRock.

The verifjcation toolchain a.cpp syntax.v a_cpp_proof.v logic.v The future is built on BedRock.

The verifjcation toolchain a.cpp a_cpp.v cpp2v syntax.v a_cpp_proof.v logic.v The future is built on BedRock.

The verifjcation toolchain a.cpp a_cpp.v a_cpp_spec.v cpp2v syntax.v a_cpp_proof.v logic.v The future is built on BedRock.

The verifjcation toolchain a.cpp a_cpp.v a_cpp_spec.v cpp2v syntax.v a_cpp_proof.v logic.v The future is built on BedRock.

The verifjcation toolchain a.cpp a_cpp.v a_cpp_spec.v cpp2v syntax.v a_cpp_proof.v auto.v logic.v The future is built on BedRock.

The verifjcation toolchain a.cpp a_cpp.v a_cpp_spec.v cpp2v syntax.v a_cpp_proof.v auto.v logic.v The future is built on BedRock.

Building on previous work C Imp (CompCert,VST) Iris separation logic library The future is built on BedRock.

Building on previous work C++ C C++ Imp (.., 14, 17, ...) (.., 14, 17, ...) (CompCert,VST) Iris separation logic library The future is built on BedRock.

Features of C++ Surface Complexities Semantic Challenges Classes + Objects ● ● ● Parsing Value categories Constructors ● ● ● Type checking Side-effects Destructors ● ● ● Overload resolution Modularity Inheritance ● Syntactic sugar The future is built on BedRock.

Features of C++ Surface Complexities Semantic Challenges Classes + Objects ● ● ● Parsing Value categories Constructors ● ● ● Type checking Side-effects Destructors ● ● ● Overload resolution Modularity Inheritance ● Syntactic sugar Hooking into existing tooling The future is built on BedRock.

cpp2v Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types cpp2v a.cpp a_cpp.v The future is built on BedRock.

cpp2v Uses clang to build C++ ASTs from source fjles. ► First-order AST, ► embedded types cpp2v a.cpp a_cpp.v cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- threadsafe-statics -fno-builtin -I./include -I./include/aarch64 Standard clang compiler options. Also runnable as a clang plugin. The future is built on BedRock.

cpp2v Compatible with C Minimal pre-processing Uses clang to build C++ ASTs (close to C++ standard). from source fjles. ► First-order AST, ► embedded types cpp2v a.cpp a_cpp.v cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- threadsafe-statics -fno-builtin -I./include -I./include/aarch64 Standard clang compiler options. Also runnable as a clang plugin. The future is built on BedRock.

cpp2v Compatible with C Minimal pre-processing Uses clang to build C++ ASTs (close to C++ standard). from source fjles. ► First-order AST, ► embedded types cpp2v a.cpp a_cpp.v Include extra information to ease consumption: ► value categories, ► types, ► implicit initializers, cpp2v -o a_cpp.v src/a.cpp -- --target=aarch64-none-elf - ► overload resolution, std=gnu++17 -O2 -fno-exceptions -fno-rtti -fno- ► some desugaring, threadsafe-statics -fno-builtin -I./include ► etc. -I./include/aarch64 Standard clang compiler options. Also runnable as a clang plugin. The future is built on BedRock.

Features of C++ Surface Complexities Semantic Challenges Classes + Objects ● ● ● Parsing Value categories Constructors ● ● ● Type checking Side-effects Destructors ● ● ● Overload resolution Modularity Inheritance ● Syntactic sugar Hooking into existing Weakest precondition tooling semantics in Iris The future is built on BedRock.

The program logic for C++ These are values, e.g. integers And for other value categories & language constructs: wp_lval, wp_xval The future is built on BedRock.

The program logic for C++ These are values, e.g. integers Declarations “Thread identifier” Iris mask Locals Temporaries to destroy And for other value categories & language constructs: wp_lval, wp_xval The future is built on BedRock.

Variables & Location of x is a Regions (persistent) All program state is represented uniformly as resources ► Simple representation Mapping from of stack-allocated names to location structs ► More uniform representation predicates All locations are accessed uniformly. The future is built on BedRock.

File-modular Verifjcation Verify once! lib.hpp ● #include & macros int foo(int) { … } ○ Verifjcation after macro extern int bar(); expansion ○ C++ is moving away from macros towards language- based features, e.g. constexpr lib.cpp main.cpp #include “lib.hpp” #include “lib.hpp” ● Lots of code in header fjles. struct F { … }; struct B { … }; int main() { … } int main() { … } The future is built on BedRock.

File-modular Verifjcation lib.hpp ● #include & macros int foo(int) { … } ○ Verifjcation after macro extern int bar(); expansion Preservation under ○ C++ is moving away from compatible extension macros towards language- based features, e.g. constexpr lib.cpp main.cpp #include “lib.hpp” #include “lib.hpp” ● Lots of code in header fjles. struct F { … }; struct B { … }; int main() { … } int main() { … } The future is built on BedRock.

Features of C++ Surface Complexities Semantic Challenges Classes + Objects ● ● ● Parsing Value categories Constructors ● ● ● Type checking Side-effects Destructors ● ● ● Overload resolution Modularity Inheritance ● Syntactic sugar Hooking into existing Weakest precondition Describe the object system tooling semantics in Iris in separation logic. The future is built on BedRock.

Supporting Classes + Objects Classes are a pervasive addition in C++ ► Constructors ► Destructors Fairly easy due to information in the ► Member functions AST, e.g. explicit cast nodes, etc. ► Virtual functions The future is built on BedRock.

Supporting Classes + Objects Classes are a pervasive addition in C++ ► Constructors ► Destructors Fairly easy due to information in the ► Member functions AST, e.g. explicit cast nodes, etc. ► Virtual functions Object identity is intricate ► Track it using language- specifjc ghost state The future is built on BedRock.

Supporting Classes + Objects Classes are a pervasive addition in C++ ► Constructors ► Destructors Fairly easy due to information in the ► Member functions AST, e.g. explicit cast nodes, etc. ► Virtual functions Object identity is intricate ► Track it using language- specifjc ghost state Still looking for a good abstraction for reasoning. (Do you have ideas?) The future is built on BedRock.

Features of C++ Surface Complexities Semantic Challenges Classes + Objects ● ● ● Parsing Value categories Constructors ● ● ● Type checking Side-effects Destructors ● ● ● Overload resolution Modularity Inheritance ● Syntactic sugar Hooking into existing Weakest precondition Describe the object system Unsupported Features tooling semantics in Iris in separation logic. Uninstantiated templates ● Lambda expressions ● virtual inheritance ● Exceptions ● ● Weak memory The future is built on BedRock.

Verifjcation for Everyone The future is built on BedRock.

It helps! Separation logic is central to this. 🙷 Every engineer uses some form of “verification" in their head ..., formal verification simply helps putting that on paper precisely. 🙸 ~ Systems Engineer The future is built on BedRock.

It helps! Separation logic is central to this. 🙷 Every engineer uses some form of “verification" in their head ..., formal verification simply helps putting that on paper precisely. 🙸 ~ Systems Engineer ● Teaching everyone to specify their code ○ Very helpful to tie verifjcation to a language they already know. ○ Systems engineers able to write fjrst-order specifjcations. ○ Seems to be some cognitive benefjt to classes. The future is built on BedRock.

Summary ► cpp2v is a tool for importing C++ code in Coq ► Built on top of the clang toolchain ► Axiomatic semantics of (much of) C++ ► Some interesting challenges in C++ Contributions, collaborations, and users welcome cpp2v https://github.com/bedrocksystems/cpp2v The future is built on BedRock.