The Compcert verified compiler

Commented Coq development

Version 1.8.2, 2011-05-24

Introduction

Compcert is a compiler that generates PowerPC, ARM and x86 assembly code from Compcert C, a large subset of the C programming language. The particularity of this compiler is that it is written mostly within the specification language of the Coq proof assistant, and its correctness --- the fact that the generated assembly code is semantically equivalent to its source program --- was entirely proved within the Coq proof assistant.

High-level descriptions of the Compcert compiler and its proof of correctness can be found in the following papers (in increasing order of technical details):

Xavier Leroy, Formal verification of a realistic compiler. Communications of the ACM 52(7), July 2009.
Sandrine Blazy, Zaynah Dargaye and Xavier Leroy, Formal verification of a C compiler front-end. Proceedings of Formal Methods 2006, LNCS 4085.
Xavier Leroy, A formally verified compiler back-end. Journal of Automated Reasoning 43(4):363-446, 2009.

This Web site gives a commented listing of the underlying Coq specifications and proofs. Proof scripts are folded by default, but can be viewed by clicking on "Proof". Some modules (written in italics below) differ between the three supported target architectures. The PowerPC versions of these modules are shown below; the ARM and x86 versions can be found in the source distribution.

This development is a work in progress; some parts have substantially changed since the overview papers above were written.

The complete sources for Compcert can be downloaded from the Compcert Web site.

This document and the Compcert sources are copyright 2005, 2006, 2007, 2008, 2009, 2010, 2011 Institut National de Recherche en Informatique et en Automatique (INRIA) and distributed under the terms of the following license.

General-purpose libraries, data structures and algorithms

Coqlib: addendum to the Coq standard library.
Maps: finite maps.
Integers: machine integers.
Floats: machine floating-point numbers.
Iteration: various forms of "while" loops.
Ordered: construction of ordered types.
Lattice: construction of semi-lattices.
Kildall: resolution of dataflow inequations by fixpoint iteration.
Parmov: compilation of parallel assignments.
UnionFind: a persistent union-find data structure.

Definitions and theorems used in many parts of the development

Errors: the Error monad.
AST: identifiers, whole programs and other common elements of abstract syntaxes.
Values: run-time values.
Events: observable events and traces.
Memtype: memory model (interface).
See also: Memory (implementation of the memory model).
See also: Memdata (in-memory representation of data).
Globalenvs: global execution environments.
Smallstep: tools for small-step semantics.
Determinism: determinism properties of small-step semantics.
Op: operators, addressing modes and their semantics.

Source, intermediate and target languages: syntax and semantics

The Compcert C source language: syntax and semantics and determinized semantics.
Clight: a simpler version of Cmedium where expressions contain no side-effects.
Csharpminor: low-level structured language.
Cminor: low-level structured language, with explicit stack allocation of certain local variables.
CminorSel: like Cminor, with machine-specific operators and addressing modes.
RTL: register transfer language (3-address code, control-flow graph, infinitely many pseudo-registers).
See also: Registers (representation of pseudo-registers).
LTL: location transfer language (3-address code, control-flow graph, finitely many physical registers, infinitely many stack slots).
See also: Locations (representation of locations) and Machregs (description of processor registers).
LTLin: like LTL, but the CFG is replaced by a linear list of instructions with explicit branches and labels.
Linear: like LTLin, with explicit spilling, reloading and enforcement of calling conventions.
Mach: like Linear, with a more concrete view of the activation record.
See also: Machsem operational semantics for Mach.
Asm: abstract syntax for PowerPC assembly code.

Compiler passes

Pass	Source & target	Compiler code	Correctness proof
Pulling side-effects out of expressions; fixing an evaluation order	Compcert C to Clight	SimplExpr	SimplExprspec SimplExprproof
Simplification of control structures; explication of type-dependent computations	Clight to Csharpminor	Cshmgen	Cshmgenproof
Stack allocation of local variables whose address is taken; simplification of switch statements	Csharpminor to Cminor	Cminorgen	Cminorgenproof
Recognition of operators and addressing modes	Cminor to CminorSel	Selection SelectOp	Selectionproof SelectOpproof
Construction of the CFG, 3-address code generation	CminorSel to RTL	RTLgen	RTLgenspec RTLgenproof
Recognition of tail calls	RTL to RTL	Tailcall	Tailcallproof
Constant propagation	RTL to RTL	Constprop ConstpropOp	Constpropproof ConstproppOproof
Common subexpression elimination	RTL to RTL	CSE	CSEproof
Elimination of redundant casts	RTL to RTL	CastOptim	CastOptimproof
Register allocation by coloring of an interference graph	RTL to LTL	InterfGraph Coloring Allocation	Coloringproof Allocproof
Branch tunneling	LTL to LTL	Tunneling	Tunnelingproof
Linearization of the CFG	LTL to LTLin	Linearize	Linearizeproof
Removal of unreferenced labels	LTLin to LTLin	CleanupLabels	CleanupLabelsproof
Spilling, reloading, calling conventions	LTLin to Linear	Reload Conventions Conventions1	Parallelmove Reloadproof
Laying out the activation records	Linear to Mach	Stacking Bounds Stacklayout	Stackingproof Asmgenretaddr
Emission of assembly code	Mach to Asm	Asmgen	Asmgenproof1 Asmgenproof

Type systems

Trivial type systems are used to statically capture well-formedness conditions on the source and intermediate languages.

RTLtyping: typing for RTL + type reconstruction.
LTLtyping: typing for LTL.
LTLintyping: typing for LTLin.
Lineartyping: typing for Linear.
Machtyping: typing for Mach.

Proofs that compiler passes are type-preserving:

Alloctyping (register allocation).
Tunnelingtyping (branch tunneling).
Linearizetyping (code linearization).
CleanupLabelstyping (removal of unreferenced labels).
Reloadtyping (spilling and reloading).
Stackingtyping (layout of activation records).

All together

Compiler: composing the passes together; whole-compiler semantic preservation theorems.
Complements: interesting consequences of the semantic preservation theorems.

Xavier.Leroy@inria.fr