uf: Minimizing the Coq Extraction TCB Eric Mullen , Stuart - PowerPoint PPT Presentation

Œuf: Minimizing the Coq Extraction TCB Eric Mullen , Stuart Pernsteiner, James Wilcox, Zachary Tatlock, Dan Grossman 1

Extraction 2

Extraction K coq 2

Extraction K coq 2

Extraction K coq Extraction 2

Extraction K coq Extraction K ocaml 2

Extraction ? K coq Extraction K ocaml 2

Extraction ? K coq Extraction K ocaml ocamlc 2

Extraction ? K coq Extraction K ocaml ocamlc K asm 2

Extraction ? ? K coq Extraction K ocaml ocamlc K asm 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: K coq 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: K coq 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq K Cminor 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq K Cminor 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq K Cminor CompCert 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq K Cminor CompCert K asm 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Œuf: Œuf K coq K Cminor CompCert K asm 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Shim Œuf: Œuf K coq K Cminor CompCert K asm 2

Extraction ? ? Current: K coq Extraction K ocaml ocamlc K asm Shim Œuf: Œuf K coq K Cminor CompCert K asm Shim 2

Extraction Œuf: Œuf K coq K Cminor CompCert K asm Shim 3

Extraction 1.Novel frontend guarantees correct input Œuf: Œuf K coq K Cminor CompCert K asm Shim 3

Extraction 1.Novel frontend guarantees correct input 2.Correctness theorem allows shim reasoning Œuf: Œuf K coq K Cminor CompCert K asm Shim 3

Related Work 4

Related Work • Built in HOL • Uses Di ff erent Frontend Technique 4

Related Work • Built in HOL • Uses Di ff erent Frontend Technique • Aims to compile all of Gallina • Doesn’t support shim reasoning • No frontend trust story 4

Related Work • Built in HOL • Uses Di ff erent CompCert Frontend Technique Provides the • Aims to compile all compiler of Gallina backend for • Doesn’t support Œuf (and shim reasoning CertiCoq) • No frontend trust story 4

Outline Architecture Guarantee Evaluation 5

Outline Architecture Guarantee Evaluation 6

7

Outline Architecture Guarantee Evaluation 8

Outline Architecture Guarantee Evaluation 9

Architecture Oeuf K coq K Cminor CompCert K asm Shim 10

Architecture K coq 10

Architecture K coq 11

Architecture Reflect K coq 11

Architecture Reflect K coq K AST 11

Architecture Reflect K coq K AST Denote 11

Architecture Reflect K coq K AST Serialize Denote 11

Architecture Reflect K coq K AST Serialize Denote 11

Architecture Reflect K coq K AST Serialize Deserialize Denote 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile K Cminor 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile K Cminor Shim 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile K Cminor CompCert Shim 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile K Cminor CompCert Shim S Cminor 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile Link K Cminor CompCert Shim S Cminor 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile Link K Cminor L Cminor CompCert Shim S Cminor 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile Link K Cminor L Cminor CompCert CompCert Shim S Cminor 11

Architecture Reflect Deserialize K AST K coq K AST Serialize Denote Compile Link K Cminor L Cminor CompCert L asm CompCert Shim S Cminor 11

Frontend Reflect K coq K AST Denote 12

Frontend Reflect e ::= K coq K AST | x (var) | e e (application) Denote | C e* (constructor) | E e* e (eliminator) | f e* (closure creation) 12

Frontend Reflect e ::= K’ coq K AST | x (var) | e e (application) Denote | C e* (constructor) | E e* e (eliminator) Remove Dep Types Pattern Matching -> Elims | f e* (closure creation) K coq 12

Frontend Reflect e ::= K’ coq K AST | x (var) | e e (application) Denote | C e* (constructor) | E e* e (eliminator) Remove Dep Types Pattern Matching -> Elims | f e* (closure creation) K coq Theorem: 12

Frontend Language Restrictions K coq K AST Denote 13

Frontend Language Restrictions K coq K AST Denote • No Fixpoints 13

Frontend Language Restrictions K coq K AST Denote • No Fixpoints • No Pattern Matching 13

Frontend Language Restrictions K coq K AST Denote • No Fixpoints • No Pattern Matching • No Dependent Types 13

Frontend Language Restrictions K coq K AST Denote • No Fixpoints • No Pattern Matching • No Dependent Types • All Types built into Œuf 13

Compiler Deserialize K AST Serialize Compile K Cminor 14

Compiler Deserialize K AST Serialize Compile K Cminor 45 verified compilation passes 14

Compiler Deserialize K AST Serialize Compile K Cminor 45 verified compilation passes 14

Compiler Deserialize K AST Serialize Compile K Cminor 45 verified compilation passes 14

Shim K Cminor Shim 15

Shim K Cminor CompCert Shim 15

Shim K Cminor CompCert Shim S Cminor 15

Shim Link K Cminor CompCert Shim S Cminor 15

Shim Link K Cminor L Cminor CompCert Shim S Cminor 15

Shim Link K Cminor L Cminor CompCert CompCert Shim S Cminor 15

Shim Link K Cminor L Cminor CompCert L asm CompCert Shim S Cminor 15

Shim Link K Cminor L Cminor CompCert L asm CompCert Shim S Cminor 15

Outline Architecture Guarantee Evaluation 16

Outline Architecture Guarantee Evaluation 17

Guarantee S Cminor 18

Guarantee S Coq S Cminor 18

Guarantee S Coq match S Cminor 18

Guarantee 1) evaluate S Coq match S Cminor 18

Guarantee 1) evaluate S Coq V Coq match S Cminor 18

Guarantee 1) evaluate S Coq V Coq match 2) match S Cminor 18

Guarantee 1) evaluate S Coq V Coq match 2) match S Cminor V Cminor 18

Guarantee 1) evaluate S Coq V Coq match 2) match S Cminor V Cminor 3) steps* 18

Guarantee 1) evaluate S Coq V Coq match 2) match S Cminor V Cminor 3) steps* *Cminor is Deterministic 18

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim Œuf coq 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim Extraction Œuf coq 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim Extraction Œuf coq Œuf ocaml 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim ? Extraction Œuf coq Œuf ocaml 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim ? Extraction Œuf coq Œuf ocaml Œuf Driver 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim ? Extraction Œuf coq Œuf ocaml ocamlc Œuf Driver 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim ? Extraction Œuf coq Œuf ocaml ocamlc Œuf asm Œuf Driver 19

TCB Œuf: Œuf K coq K Cminor CompCert K asm Shim ? ? Extraction Œuf coq Œuf ocaml ocamlc Œuf asm Œuf Driver 19

Outline Architecture Guarantee Evaluation 20

Outline Architecture Guarantee Evaluation 21

Evaluation • Eliminate trust in parser • Provide API for shim reasoning • Verify the compiler • Works on real code • Performance? 22

Evaluation • Eliminate trust in parser • Provide API for shim reasoning • Verify the compiler • Works on real code • Performance? 22

Evaluation • Eliminate trust in parser • Provide API for shim reasoning • Verify the compiler • Works on real code • Performance? 22

Evaluation • Eliminate trust in parser • Provide API for shim reasoning • Verify the compiler • Works on real code • Performance? 22