ogent C : Certified Compilation for a Functional Systems Language LiamO’Connor,ChristineRizkallah,ZilinChen,SidneyAmani,JaphethLim,YutakaNagashima, ThomasSewell,AlexHixon,GabrieleKeller,TobyMurray,GerwinKlein NICTA,Sydney,Australia UniversityofNewSouthWales,Australia first.last@nicta.com.au 6 1 0 2 Abstract tion[Sewelletal.2013],Cisnowalanguagewithwellunderstood We present a self-certifying compiler for the Cogent systems semanticsandexistingformalverificationinfrastructure. n language. Cogent is a restricted, polymorphic, higher-order, and If C is so great, why not verify C systems code directly? Af- a terall,thereisanevergrowinglistofsuccesses[Kleinetal.2009, J purelyfunctionallanguagewithlineartypesandwithouttheneed foratrustedruntimeorgarbagecollector.ItcompilestoefficientC 2014;Guetal.2015;Beringeretal.2015]inthisspace.Thereason 1 issimple:verificationofmanuallywrittenCprogramsremainsex- codethatisdesignedtointeroperatewithexistingCfunctions.The 2 pensive.Justashigh-levellanguagesincreaseprogrammerproduc- languageissuitedforlayeredsystemscodewithminimalsharing tivity,theyshouldalsoincreaseverificationproductivity.Certifying suchasfilesystemsornetworkprotocolcontrolcode. L] For a well-typed Cogent program, the compiler produces C ckoeymsptielaptiionnacohfiaevlainngguthaigsegwoaitlhfovrerCifiocgaetniot.n-friendlysemanticsisa code, a high-level shallow embedding of its semantics in Is- P abelle/HOL,andaproofthattheCcodecorrectlyimplementsthis Thestateoftheartforcertifiedcompilationofafullfeatured . functionallanguageisCakeML[Kumaretal.2014],whichcovers s embedding.Theaimisforproofengineerstoreasonaboutthefull c semantics of real-world systems code productively and equation- anentireMLdialect.Cogentistargetedatasubstantiallydifferent [ ally,whileretainingtheinteroperabilityandleannessofC. pointinthedesignspace.CakeMLincludesaverifiedruntimeand garbagecollector,whileCogentworkshardtoavoidthesesoitcan We describe the formal verification stages of the compiler, 1 beapplicabletolow-levelembeddedsystemscode.CakeMLcovers whichincludeautomatedformalrefinementcalculi,aswitchfrom v fullturing-completeMLwithcomplexsemanticsthatworkswell imperativeupdatesemanticstofunctionalvaluesemanticsformally 0 forcodewrittenintheoremprovers.Cogentisarestrictedlanguage justifiedbythelineartypesystem,andanumberofstandardcom- 2 oftotalfunctionswithintentionallysimplesemanticsthatareeasy piler phases such as type checking and monomorphisation. The 5 toreasonaboutequationally.CakeMLisgreatforapplicationcode; compiler certificate is a series of language-level meta proofs and 5 Cogentisgreatforsystemscode,especiallylayeredsystemscode per-program translation validation phases, combined into one co- 0 herenttop-leveltheoreminIsabelle/HOL. with minimal sharing such as the control code of file systems or . networkprotocolstacks.Cogentisnotdesignedforsystemscode 1 CategoriesandSubjectDescriptors F.3.2[LogicsandMeanings withclosely-coupled,cross-cuttingsharing,suchasmicrokernels. 0 ofPrograms]:SemanticsofProgrammingLanguages Cogent’smainrestrictionsarethe(purposeful)lackofrecursion 6 anditerationanditslineartypesystem.Theformerensurestotality, 1 Keywords verification,semantics,lineartypes whichisimportantforbothsystemscodecorrectnessaswellasfor : v asimpleshallowrepresentationinhigher-orderlogic.Thelatteris i 1. Introduction importantformemorymanagementandformakingthetransition X Imaginewritinglow-levelsystemscodeinapurelyfunctionallan- fromimperativeCsemanticstofunctionalvaluesemantics.Even r guageandthenreasoningaboutthiscodeequationallyandproduc- in the restricted target domains of Cogent, real programs will of a tively in an interactive theorem prover. Imagine doing this with- course contain some amount of iteration. This is where Cogent’s out the need for a trusted compiler, runtime or garbage collector integrated foreign function interface comes in: the engineer pro- andlettingthiscodeinteroperatewithnativeCpartsofthesystem, videsherownverifieddatatypesanditeratorinterfacesinCand includingyourownefficientlyimplementedandformallyverified usesthemseamlesslyinCogent,includinginformalreasoning. additionaldatatypesandoperations. Cogentisrestricted,butitisnotatoylanguage.Wehaveusedit Cogentachievesthisgoalbycertifiedcompilationfromahigh- toimplementtwoefficientfull-scaleLinuxfilesystems—acustom level, pure, polymorphic, functional language with linear types, Flash file system and an implementation of standard Linux ext2. specifically designed for certain classes of systems code. For a Weplantoreportontheexperiencewiththeseimplementationsin given well-typed Cogent program, the compiler will produce a separatework.Thefocusofthispaperiswhatcanbelearnedfrom high-level shallow embedding of the program’s semantics in Is- Cogentabouttheformalverificationofcertifyingcompilation. abelle/HOL [Nipkow and Klein 2014], and a theorem that con- In particular, this paper discusses in detail the following con- nectsthisshallowembeddingtotheCcodethatthecompilerpro- tributions: a) the self-certifying Cogent compiler and language; duces:anypropertyprovedoftheshallowembeddingisguaranteed b) the formal semantics of the Cogent language and the switch toholdforthegeneratedC. from imperative update semantics to functional value semantics The compilation target is C, because C is the language most formally justified by the linear type system (§3); c) the top-level existingsystemscodeiswrittenin,andbecausewiththeadventof compilercertificate(§4.1),whichisaseriesoflanguage-levelmeta toolslikeCompCert[Leroy2006,2009]andgcctranslationvalida- proofsandper-programtranslationvalidationphases;d)theverifi- cationstagesthatmakeupthecorrectnesstheorem(§4),including Cogentinputofthecompiler.Mostofthetheoremsassumethatthe automatedrefinementcalculi,formallyverifiedtypechecking,A- Cogentprogramiswell-typed,whichisdischargedautomatically normalisation, and monomorphisation; and e) the lessons learned inIsabellewithtypeinferenceinformationfromthecompiler. inthisprojectonfunctionallanguageformalisationandcompiler Thesolidarrowsontheright-handsideofthefigurerepresent correctnessproofs(§5). refinementproofsandthelabelsonthesearrowscorrespondtothe numbers in the following description. The only arrow that is not 2. Overview formallyverifiedistheonecrossingfromCcodeintoIsabelle/HOL atthebottomofFig.1—thisistheC-to-Isabelleparser[Tuchetal. Our aim in this paper is to build a self-certifying compiler from 2007],whichisamatureverificationtoolusedinanumberoflarge- CogenttoefficientCcode,suchthataproofengineercanreason scaleverifications.Asmentioned,itcouldadditionallybechecked equationally about its semantics in Isabelle/HOL and apply the by translation validation. We briefly describe each intermediate compilertheoremtoderivepropertiesaboutthegeneratedCcode. theorem,startingwiththeSimplcodeatthebottomofthefigure. Formally,thecertificatetheoremisarefinementstatementbetween Forwell-typedCogentprograms,weautomaticallyprove: theshallowembeddingandtheCcode.ThisgeneratedCcodecan becompiledbyCompCert.Italsofallsintothesubsetofthegcc 1. Theorem: The Simpl code produced by the C parser corre- translationvalidationtoolbySewelletal.[2013],whosetheorem sponds to a monadic representation of the C code. The proof wouldcomposedirectlywithourcompilercertificate.1 isgeneratedusinganadjustedversionoftheAutoCorrestool. Shallow embeddings are nice for the human user, but they do 2. Theorem:Themonadicprogramterminatesandisarefinement notprovidemuchsyntacticstructureforconstructingthecompiler ofthemonomorphicCogentdeepembeddingundertheupdate theorem.Therefore,thecompileralsogeneratesadeepembedding semantics. foreachCogentprogramtouseintheinternalproofchain.There 3. Theorem: If a Cogent deep embedding evaluates in the up- aretwosemanticsforthisdeepembedding.(1)aformalfunctional datesemanticsthenitevaluatestothesameresultinthevalue valuesemanticswhereprogramsevaluatetovaluesand(2)afor- semantics. This is a known consequence of linear type sys- malimperativeupdatesemanticswhereprogramsmanipulateref- tems[Hofmann2000],buttoourknowledgeitisthefirstmech- erencestomutableglobalstate. anisedproofofsuchaproperty,esp.forafull-scalelanguage. 4. Theorem:IfamonomorphicCogentdeepembeddingevaluates Isabelle/HOL in the value semantics then the polymorphic deep embedding ADTs ADT verification evaluatesequivalentlyinthevaluesemantics. Cogent Well-typedness cHoirgrehc-tlenveesls 5. Theorem:IfthepolymorphicCogentdeepembeddingevaluates Program in the value semantics then the Cogent shallow embedding Neat Shallow Embedding is HOL 7 evaluatestoacorrespondingshallowIsabelle/HOLvalue. 6 6. Theorem:TheA-normalshallowembeddingis(extensionally) Shallow Embedding is HOL equal in Isabelle/HOL to a syntactically neater shallow embedding,whichismoreconvenientforhumanreasoning.This 5 human-friendlyshallowembeddingcorrespondstotheCogent CCoomgpeinlet r generates Polymorphic Deep Embedding has Value Semantics codebeforethecompiler’sA-normalisationphase. 4 has Value Semantics Arrow7indicatesverificationofuser-suppliedabstractdatatypes Monomorphic Deep Embedding has 3 (ADTs)implementedinCandfurthermanualhigh-levelproofson Update Semantics topofthehuman-friendlyshallowembedding.Theseareenabled 2 generates has bytheprevioussteps,butarenotpartofthispaper. AutoCorres Monadic Code Monadic Semantics In§4wedefineinmoredetailtherelationsthatformallylinkthe 1 values(andstates,whenapplicable)thattheseprogramsevaluate Simpl Code has Simpl Semantics to.Steps(3)and(4)aregeneralpropertiesaboutthelanguageand C Parser generates wethereforeprovethemmanuallyonceandforall.Steps(1),(2), (5),and(6)aregeneratedbythecompilerforeveryprogram.The C proofforstep(1)isgeneratedbyAutoCorres.Forsteps(2)and(5) we define compositional refinement calculi that ease the automa- tionoftheseproofs.Step(6),thecorrectnessofA-normalisation, Figure1:Adetailedoverviewoftheverificationchain. is straightforward to prove via rewriting because at this stage we canalreadyuseequationalreasoning. Fig.1showsanoverviewoftheprogramrepresentationsgenerated by the compiler and the break-down of the automatic refinement 3. Language proofthatmakesupthecompilercertificate.Theprogramrepresen- tationsare,fromthebottomofFig.1:theCcode,thesemanticsof InthissectionweformallydefineCogent,includingitslineartype theCcodeexpressedinIsabelle/Simpl[Schirmer2006],thesame system, its two dynamic semantics — update and value — men- expressedasamonadicfunctionalprogram[Greenawayetal.2012, tionedearlierin§2,andtherefinementtheorembetweenthem.We 2014], a monomorphic A-normal deep embedding of the Cogent beginthesectionbywalkingthroughanexampleCogentprograms. program, a polymorphic A-normal deep embedding of the same, 3.1 Example anA-normalshallowembedding,andfinallya‘neat’shallowem- bedding of the Cogent program that is syntactically close to the Fig.2showsanexcerptofourCogentext2implementation.The exampleusesnotall,butmanyfeaturesofthelanguage. 1Atthetimeofwriting,Cogent’soccasionallylargerstackframesleadto ThefirstlineinFig.2showstheCogentsideoftheforeignfunc- gcc emitting memcpy() calls that, while conceptually straightforward to tioninterface.ItdeclaresanabstractCogentdatatypeExSt,im- handle,thetranslationvalidatordoesnotyetcover. plementedinC.Line2showsaparametricabstracttype,andline9 2 2016/1/22 1 type ExSt prim.types t (cid:70) U8 | U16 | U32 | U64 | Bool 23 ttyyppee OUpAtrraay=a types τ,ρ (cid:70) α | α! | () 4 type Node = #{mbuf:Opt Buf, ptr:U32, fr:U32, to:U32} | t | Tτm | τ→ρ 5 type Acc = (ExSt, FsSt, VfsInode) 6 type Cnt = (UArray Node, | (cid:104)Cτ(cid:105) | {f ::τ?}m 7 (U32, Node, Acc, U32, UArray Node) -> (Node, Acc)) fieldtypes τ? (cid:70) τ | τ 8 9 uarray_create: all (a :< E). (ExSt, U32) permissions P = {D,S,E} 10 -> kinds κ ⊆ P 11 12 ext2_free_branch: (U32, Node, Acc, U32) polytypes π ::= ∀(α::Kκ).τ 13 -> (Node, Acc, modes m (cid:70) Read-only | Writable | Unboxed 14 ext2_free_branch (depth,nd,(ex,fs,inode),mdep) = 15 if depth + 1 < mdep typevariables (cid:51) α,β 16 then abs.typenames (cid:51) T,U 17 uarray_create[Node] (ex,nd.to-nd.fr) !nd 18 | Success (ex, children) => kindcontext ∆ (cid:70) α:Kκ 19 let nd_t { mbuf } = nd typecontext Γ (cid:70) x:τ 20 and (children, (ex, inode, _, mbuf)) = 21 uarray_map_no_break #{ 222423 faarcrc === (ceehxxitl,2d_rfiernnoede,e_b,rannocdhe__etn.tfrry,,mbuf), ∆(cid:96)Γ1w(cid:123)eakΓ2 for∆ea(cid:96)cxhi::τ∆,(cid:96)Γτw(cid:123)iea:KkΓ{D} 25 ... } !nd_t i i 2276 iannd(nndd,=(enxd_,tfs{,mbiunfode}), ∆(cid:96)Γ1(cid:123)Γ2(cid:1)Γ3 foreachi:∆(cid:96)τi:K{S} 28 Expd (children, ext2_free_branch_cleanup)) ∆(cid:96)x :τ,Γ ,Γ (cid:123)x :τ,Γ (cid:1)x :τ,Γ 29 | Err ex -> (nd, (ex,fs,inode), Iter ()) i i 1 2 i i 1 i i 2 30 else ... (overbarindicateslists,i.e.zeroormore) Figure2:Cogentexample Figure3:TypeStructureofCogent&structuralcontextoperations socannotbeaccessedagain.Thustheprogrammerissafetobind showsacorrespondingabstractfunctionuarray create(),also anewobjecttothesamenamend(online26)withoutworrying implementedinC.Notethatthisabstractfunctionispolymorphic, aboutnameshadowing.Line26showssurfacesyntaxforput,the withakindconstraintE(see§3.2)ontypeargumenta. dualtotake,whichre-establishesthembuffieldsintheexample. TheintegrationofsuchforeignfunctionsisseamlessontheCo- gentside,butnaturallyhasrequirementsonthecorrespondingC 3.2 TypesandKinding code.TheCsidemustrespecttheCogenttypesystem,and,forexample,keepallsharedstateinternaltotheabstracttypetocomply Wadler[1990]firstnotedthatlineartypescanbeusedasawayto with linearity constraints. It must also be terminating and imple- safelymodelmutablestateandsimilareffectswhilemaintaininga menttheuser-suppliedsemanticsthatappearinthecorresponding purelyfunctionalsemantics.Hofmann[2000]laterprovedWadler’s shallowembeddingoftheCogentprograminIsabelle/HOL—ide- intuitionbyshowingthat,foralinearlanguage,imperativeCcode allytheusershouldprovideaformalprooftodischargethecorre- canimplementasimpleset-theoreticsemantics.Weuselineartypes spondingassumptionofthecompilercertificatetheorem. fortworeasons:toensuresafehandlingofheap-allocatedobjects, Abstractfunctionscanbehigher-orderandprovidetheiteration withouttheneedforruntimesupport,andtoallowustoassignto constructs that are intentionally left out from core Cogent. E.g. Cogentprogramsasimple,equational,purelyfunctionalsemantics line 21, uarray map no break() implements a map iterator for implementedviamutablestateandimperativeeffects. arrays.Inourfilesystemapplicationswehavefounditsufficientto ThetypestructureandassociatedsyntaxofCogentispresented provideasmalllibraryofiteratorsfortypessuchasarrays.Wealso in Fig. 3. Our type system is loosely based on the polymorphic interfacedtoanexistingmaturered-blacktreeimplementation. λURALofAhmedetal.[2005].Werestrictthispolymorphismtobe ReturningtotheexampleinFig.2,lines3–7showbasictype rank-1 and predicative, in the style of ML, to permit easy imple- constructorsanddeclarationsofvariants,recordsandtuplesusing mentationbyspecialisationwithminimalperformancepenalty. typevariablesandtheprimitivetypeU32.Forinstance,typeCnt Toeaseimplementation,andtoeliminateanydirectdependency isdefinedasapairofUArray Nodeandafunctiontype.Typesin onaheapallocator,werequirethatallfunctionsbedefinedonthe Cogent are structural [Pierce 2002], i.e. two types with the same top-level. This eliminates the need for linear function types: any structurebutdifferentnamesareintensionallyequal. top-levelfunctioncanbesharedfreelybecausetheycannotcapture Moreover, line 17 calls the abstract polymorphic function anylocalvariables,letalonelinearones. uarray create(), instantiated with type argument Node. The We include a set of primitive integer types (U8, U16 etc.). !ndnotationtemporarilyturnsalinearobjectoftypeNodeintoa Records{f ::τ?}mcomprise(1)asequenceoffields f ::τ?,where read-onlyone(see§3.3.1).Thetwobasic,non-linearfieldstoand τisthetypeonaninaccessiblefield,and(2)amodem(see§3.3.3 frintypeNodecandirectlybeaccessedread-onlyusingprojec- and§3.2.1foramoredetaileddescription).Wealsohavepolymor- tionfunctions.Line18and29arepatternmatchesontheresultof phicvariants(cid:104)Cτ(cid:105),ageneralisedsumtypeinthestyleofOCaml, thefunctioninvocation.Line19showssurfacesyntaxforCogent’s the mechanics of which are briefly described in §3.3.2. Abstract lineartakeconstruct(see§3.3.3),accessingandbindingthembuf typesTτmarealsoparametrisedbymodes.Weomitproducttypes field of nd to the name mbuf (punning as in Haskell), as well as fromthispresentation;theyaredesugaredintounboxedrecords. bindingtherestoftherecordtothenamend t. Themostobvioussimilaritytoλ isouruseofkindstode- URAL The linear type system tracks that the field mbuf is logically termineifatypemaybefreelysharedordiscarded,asopposedto absent in nd t. It also tracks that nd on line 19 has been used, earlier linear type systems, such as that of Wadler [1990], where 3 2016/1/22 ∆(cid:96)τ: κ wouldbeanacceptableinstantiationofatypevariableofkind∅, K aswearefreetowaivepermissionsthatareincludedinakind.We ∆(cid:96)(): κKUnit ∆(cid:96)t: κKPrim ∆(cid:96)τ→ρ: κKFun canproveformallybystraightforwardruleinduction: K K K (α:K∆κ(cid:48))(cid:96)∈α∆: κκ⊆κ(cid:48)KVar (α:Kκ(cid:48))∆∈(cid:96)∆α!κ:⊆κbang(κ(cid:48))KVar! L∆e(cid:96)mτm:Kaκ1(cid:48).(Waiving rights). If ∆ (cid:96) τ :K κ and κ(cid:48) ⊆ κ, then K K Thisresultallowsforasimplekind-checkingalgorithm,notimme- foreachi:∆(cid:96)τ : κ i K KVariant diatelyapparentfromtherules.Forexample,themaximalkindof ∆(cid:96)(cid:104)C τ(cid:105): κ anunboxedstructurewithtwofieldsoftypeτ andτ respectively i i K 1 2 m: κ(cid:48) κ⊆κ(cid:48) m: κ(cid:48) κ⊆κ(cid:48) canbecomputedbytakingtheintersectionofthecomputedmaxi- foreaKchi:∆(cid:96)τ : κ foreachτKnottaken:∆(cid:96)τ : κ malkindsofτ1 andτ2.Thisresultensuresthatthisintersectionis ∆(cid:96)Tτim:KiκK KAbs ∆(cid:96)i{fi ::τ?i}m:Kκ i K KRec alsoavalidkindforτ1andτ2. 3.2.1 KindingforRecordsandAbstractTypes m:Kκ Recall that Cogent may be extended with abstract types, imple- Read-only:K{D,S} Writable:K{E} Unboxed:K{D,S,E} mentedinC,whichwewriteasTτiminourformalisation.Weal- lowabstracttypestotakeanynumberoftypeparametersτ,where i bang(·):τ→τ eachspecificinstancecorrespondstoadistinctCtype.Forexam- ple,aListabstracttype,parameterisedbyitselementtype,would bang(α) = α! correspondtoafamilyofCListtypes,eachonespecialisedtoa bang(α!) = α! particularconcreteelementtype.Becausetheimplementationsof bang(()) = () thesetypesareusersupplied,theuserisfreetospecialiseimple- bang(t) = t mentationsbasedonthesetypeparameters,forexamplerepresent- bang(Tτ m) = Tbang(τ)bang(m) ing an array of boolean values as a bitstring, so long as they can bang(τ→i ρ) = τ→ρ i showthateverydifferentoperationimplementationisarefinement ofthesameuser-suppliedCDSLsemanticsforthatoperation. bang((cid:104)C τ(cid:105)) = (cid:104)C bang(τ)(cid:105) i i i i Values of abstract types may be represented by references to bang({fi ::τ?i}m) = {fi ::bang(τ?i)}bang(m) heap data structures. Specifically, an abstract type or structure is stored on the heap when its associated storage mode m is not bang(·):κ→κ “Unboxed”.Forboxedrecordsandabstracttypes,thestoragemode (cid:40) distinguishes between those that are “Writable” vs. “Read-only”. κ if{D,S}⊆κ bang(κ) = The same is true for record types, written {f ::τ?} m, which are {D,S} otherwise discussedinmoredetailin§3.3.3. bang(·):m→m The storage mode m affects the maximal kind that can be as- signed to the type. For example, an unboxed structure with two bang(Read-only) = Read-only components of type U8 is freely shareable, but if the structure is bang(Writable) = Read-only insteadstoredontheheap,thenawritablereferencetothatstruc- bang(Unboxed) = Unboxed turemustbelinear.Thus,thetypegiventosuchreferenceshasthe “Writable”mode,whosekindis{E},therebypreventingsucharef- Figure4:KindingrulesforCogenttypesandthebang(·)operator erencefrombeingassignedanonlinearkindsuchas{D,S}. 3.2.2 Kindingandbang LikeWadler[1990],weallowlinearvaluestobesharedread-only a type’s linearity is encoded directly into its syntactic structure. KindsinCogentaresetsofpermissions,denotingwhetheravari- in a limited scope. This is useful for practical programming in a languagewithlineartypes,asitmakesourtypesmoreinformative. ableofthattypemaybediscardedwithoutbeingused(D),shared Forexample,towriteafunctiontodeterminethesizeofa(linear) freelyandusedmultipletimes(S),orsafelyboundinalet!expres- bufferobject,anaiveapproachwouldbetowriteafunction: sion(E).Alineartype,valuesofwhichmustbeusedexactlyonce, hasakindthatexcludesDandS,andsoforbidsitbeingdiscarded size:Buf→U32×Buf orshared.Wediscusslet!expressionsin§3.2.2. Another similarity to λ is that we explicitly represent the This function has a cumbersome additional return value just so URAL that the linear argument is not discarded. Further, the type above context operations of weakening and contraction, normally rele- gatedtostructuralrules,asexplicitjudgements:∆ (cid:96) Γ w(cid:123)eak Γ(cid:48) for doesnotexpressthefactthattheinputbufferandoutputbufferare identical—thiswouldneedtobeestablishedbyadditionalproof. weakening (discarding assumptions) and ∆ (cid:96) Γ (cid:123) Γ1 (cid:1)Γ2 for Toaddressthisproblem,weincludeatypeoperatorbang(·),inthe contraction(duplicatingthem).Therulesforthesejudgementsare styleofWadler’s!operator,whichchangesallwritablemodesina presented in Fig. 3. For a typing assumption to be discarded (re- typetoread-onlyones.Thefulldefinitionofbang(·)isinFig.4. spectivelyduplicated),thetypemusthavekind{D}(resp.{S}). Wecanthereforewritethetypeofourfunctionas: ThefullkindingrulesforthetypesofCogentaregiveninFig.4. Basictypessuchas()orU8,aswellasfunctions,aresimplypassed size:bang(Buf)→U32 byvalueanddonotcontainanyheapreferences,sotheymaybe Foranyvalidtypeτ,thekindofbang(τ)willbenonlinear,which given any kind. Kinding for structures and abstract functions is meansthatoursizefunctionnolongerneedstobeencumberedby discussedshortlyin§3.2.1. theextrareturnvalue.Thiskindingresultisformallystatedas: Atypemayhavemultiplekinds,asanonlineartypeassumption may be used linearly, never being shared and being used exactly Lemma2(Kindingforbang(·)). Foranytypeτ,if∆(cid:96)τ: κthen K once. Therefore, a type with a permissive kind, such as {D,S}, ∆(cid:96)bang(τ): bang(κ). K 4 2016/1/22 let!(b) b(cid:48) = b in copy(b,b(cid:48)) would violate the invariants of the primops o ∈ {+,*,/,<=,==,||,<<,...} lineartypesystem,andruinthepurelyfunctionalabstractionthat literals (cid:96) ∈ {123,True,’a’,...} lineartypesallow,asbothbandb(cid:48)wouldrefertothesameobject, expressions e (cid:70) x | () | f[τ] | o(e) | e e andadestructiveupdatetobwouldchangetheshareableb(cid:48). 1 2 We are able to use the existing kind system to handle these | letx=e ine 1 2 safetycheckswiththeinclusionoftheEpermission,forEscapable, | let!(y)x=e1ine2 whichindicatesthatthetypemaybesafelyreturnedfromwithina | ife thene elsee let!. We ensure, via the typing rules of Fig. 6, that the left hand 1 2 3 | (cid:96) | castte | promote(cid:104)Cτ(cid:105)e sideofthebinding(okintheexample)hastheEpermission,which excludestemporarilynonlinearreferencesviabang(·)(seeFig.4). | casee ofCx→e elsey→e 1 2 3 OursolutionisaspowerfulasOdersky’s,butweencodetherestric- | esace | Ce tionsinthekindsystemdirectly,notasside-conditionconstraints | {f =e} | e.f | pute .f(cid:66)e thatrecursivelydescendintothestructureofthebinding’stype. 1 2 | takex{f =y}=e ine 1 2 3.3.2 TypingforVariants functiondef. d (cid:70) (cid:104)f ::π,f x=e(cid:105) | (cid:104)f ::π,(cid:4)(cid:105) programs P (cid:70) d Avarianttype(cid:104)Ciτi(cid:105)isageneralisedsumtype,whereeachalterna- tiveisdistinguishedbyauniquedataconstructorC.Theorderin functionnames (cid:51) f,g i whichtheconstructorsappearinthetypeisnotimportant.Onecan variables (cid:51) x,y create a variant type with a single alternative simply by invoking constructors (cid:51) A,B,C aconstructor,e.g.Some255mightbegiventhetype(cid:104)SomeU8(cid:105). recordfields (cid:51) f,g Theoriginalvalueof255canberetrievedusingtheesacconstruct. The set of alternatives is enlarged by using promote expressions primopType(·) : o→t×t (primoptypes) that are automatically inserted by the type-checker of the surface funDef(·) : f →d (definitionenvironment) language,whichusessubtypingtoinferthetypeofagivenvariant. |·| : t→N (maximumvalue) Asimilartrickisusedfornumericliteralsandcast. Inordertopatternmatchonavariant,weprovideacasecon- Figure5:SyntaxofCogentprograms(afterdesugaring) struct that attempts to match against one constructor. If the constructor does not match, it is removed from the type and the re- ducedtypeisprovidedtotheelsebranch.Inthisway,atraditional Tointegratethistypeoperatorwithparametricpolymorphism,we multi-waypatternmatchcanbedesugaredbynesting: borrowatrickfromOdersky’sObservertypes[Odersky1992],and casexof tagtypevariablesthathavebeenmadereadonly,usingthesyntax casexof Aa→e α!.Wheneveravariableαisinstantiatedtosomeconcretetypeτ, Aa→ea becomes elsex(cid:48)→a casex(cid:48)of wealsoreplaceα!withbang(τ).Thelemmaaboveensuresthatour Bb→eb Bb→e kindingruleforsuchtaggedvariablesissound,andenablesusto Cc→ec elsex(cid:48)(cid:48)→b letc=esacx(cid:48)(cid:48)ine c provethefollowing: Notethatbecausethetypingruleforesaconlyapplieswhenonly Lemma 3 (Type instantiation preserves kinds). For any type τ, onealternativeremains,ourpatternmatchingisnecessarilytotal. α : κ (cid:96) τ : κ implies ∆ (cid:96) τ[ρ/α] : κ when, for each i, i K i K i i K ∆(cid:96)ρ : κ. 3.3.3 TypingforRecords i K i Some care is needed to reconcile record types and linear types. 3.3 ExpressionsandTyping Assume that Object is a type synonym for an (unboxed) record While Cogent features a rich surface syntax, due to space con- typecontaininganintegerandtwo(linear)buffers. straints, we only document the (full) core language in Fig. 5 to Object={size::U32,b ::Buf,b ::Buf}Unboxed whichthesurfacesyntaxisdesugared. 1 2 Fig.6showsthetypingrulesforCogentexpressions.Manyof Letussaywewanttoextractthefieldb fromanObject.Ifweex- 1 thesearestandardforanylineartypesystem.Wewilldiscusshere tractjustasingleBuf,wehaveimplicitlydiscardedtheotherbuffer therulesforlet!,wherewehavetakenaslightlydifferentapproach b .But,wecan’treturntheentireObjectalongwiththeBuf,as 2 to established literature, and the rules for the extensions we have thiswouldintroducealiasing.Oursolutionistoreturnalongwith madetothetypesystem,suchasvariantsandrecordtypes. the Buf an Object where the field b cannot be extracted again, 1 andreflectthisinthefield’stype,writtenasb :: Buf.Thisfield 1 3.3.1 Typingforlet! extractor,whosegeneralformistakex{f =y}=e ine ,operates 1 2 Ontheexpressionlevel,theprogrammercanuselet!expressions, asfollows:givenarecorde1,itbindsthefield f ofe1 tothevari- in the style of Wadler [1990], to temporarily convert variables of abley,andthenewrecordtothevariable xine2.Unlessthetype linear types to their read-only equivalents, allowing them to be ofthefield f haskind{S},thatfieldwillbemarkedasunavailable, freely shared. In this example, we wish to copy a buffer b onto ortaken,inthetypeofthenewrecordx. 2 abufferb onlywhenb willfitinsideb . Conversely,wealsointroduceaputoperation,which,givena 1 2 1 recordwithatakenfield,allowsanewvaluetobesuppliedinits let!(b1,b2)ok=(size(b2)>=,forsequencingcomputations. Proving that the AutoCorres-generated monadic embedding Observe that the rule Corres-Let is compositional: to prove neverfailsimpliesthattheCcodeistype-andmemory-safe,and that let x = a in b corresponds to a(cid:48) >>= b(cid:48) the rule involves isfreeofundefinedbehaviour[Greenawayetal.2014].Weprove proving that (1) a corresponds to a(cid:48) and (2) that b corresponds non-failureasaside-conditionoftherefinementstatementfromthe tob(cid:48)wheneachareexecutedovercorrespondingresultsv andv u m AutoCorresshallowembeddingtotheCogentmonomorphicdeep (e.g. as yielded by a and a(cid:48) respectively). This compositionality embeddinginitsupdatesemantics,essentiallyusingCogent’stype significantlysimplifiestheautomationofthecorrespondenceproof. systemtoguaranteeCmemorysafetyduringexecution. ThetypingassumptionsofCorres-Letaredischargedbyappealing This refinement proof is the third step in Fig. 1. To phrase tothetypetheoremtreegeneratedbythecompiler(see§4.2). the refinement statement we first define how deeply-embedded The rules for some of the other constructs, such as take, put, Cogent values and types relate to their corresponding monadic and case, contain non-trivial assumptions about R and about the shallowly-embeddedCvalues.Thevalue-mappingiscapturedby typesusedintheprogram.OnceaprogramanditsRarefixed,a thevaluerelationval-rel,definedinIsabelle/HOLautomaticallyby setofsimplerrulesisautomaticallygeneratedbyspecialisingthe the Cogent compiler using ad hoc overloading. val-rel is defined genericcorresrulesforeachoftheseconstructstotheparticularR separatelyforeachCogentprogrambecausethetypesusedinthe andtypesusedintheinputprogram.Thisineffectdischargesthe shallowCembeddingdependonthoseusedintheCprogramas, non-trivial assumptions of these rules once-and-for-all, allowing e.g.,CstructsarerepresenteddirectlyasIsabelle/HOLrecords. theautomatedproofofcorrespondencetoproceedefficiently. The type relation type-rel is used to determine, for a Cogent Conceptually,therefinementproofproceedsbottom-up,starting value v of type τ, which typed heap in the state of the monadic withtheleaffunctionsoftheprogramandendingwiththetop-level 10 2016/1/22

COGENT: Certified Compilation for a Functional Systems Language

Similar COGENT: Certified Compilation for a Functional Systems Language