Formalizing the LLVM Intermediate Representation for Verified Program Transformations

This paper presents Vellvm (verified LLVM), a framework for reasoning about programs expressed in LLVM\u27s intermediate representation and transformations that operate on it. Vellvm provides a mechanized formal semantics of LLVM\u27s intermediate representation, its type system, and properties of its SSA form. The framework is built using the Coq interactive theorem prover. It includes multiple operational semantics and proves relations among them to facilitate different reasoning styles and proof techniques. To validate Vellvm\u27s design, we extract an interpreter from the Coq formal semantics that can execute programs from LLVM test suite and thus be compared against LLVM reference implementations. To demonstrate Vellvm\u27s practicality, we formalize and verify a previously proposed transformation that hardens C programs against spatial memory safety violations. Vellvm\u27s tools allow us to extract a new, verified implementation of the transformation pass that plugs into the real LLVM infrastructure; its performance is competitive with the non-verified, ad-hoc original