Formalising Executable Specifications of Low-Level Systems

Abstract

Formal models of low-level applications rely often on the distinction between executable layer and underlying hardware abstraction. This is also the case for the model of Pip, a separation kernel formalised and verified in Coq using a shallow embedding. DEC is a deeply embedded imperative typed language with primitive recursion and specified in terms of small-step semantics, which we developed in Coq as a reified counterpart of the shallow embedding used for Pip. In this paper, we introduce DEC and its semantics, we present its interpreter based on the type soundness proof and extracted to Haskell, we introduce a Hoare logic to reason about DEC code, and we use this logic to verify properties of Pip as a case study, comparing the new proofs with those based on the shallow embedding. Notably DEC can import shallow specifications as external functions, thus allowing for reuse of the abstract hardware model (DEC can be found at https://github.com/2xs/dec.git [1]).

A Appendix: Denotational Semantics

We can define a denotational semantics of IL relying on a monadic translation similar to the one in [16] based on a state monad M with fixed state type W. The semantics is defined by a translation of IL to the monadic metalanguage (4–7), for types ($\varTheta _{t}$), expressions ($\varTheta _{e}$), expression lists ($\varTheta _{es}$) and functions ($\varTheta _{f}$), using the auxiliary definitions here also included (1–3).

$$\begin{aligned} \begin{array}{lll} \mathsf {condM} &{} : \ M \ \mathsf {Bool} \rightarrow M \ t_1 \rightarrow M \ t_1 \rightarrow M \ t_1 \ := \\ &{} \lambda x_0 \ x_1 \ x_2. \ \mathsf {bind} \ x_0 \\ &{} (\lambda v_0. \ \mathsf {bind} \ x_1 \ (\lambda v_1. \ \mathsf {bind} \ x_2 \ (\lambda v_2. \ \mathsf {if\_then\_else} \ v_0 \ v_1 \ v_2))) \end{array} \end{aligned}$$

(1)

$$\begin{aligned} \begin{array}{lll} \mathsf {mapM} &{} : \ (\forall t. \ \mathsf {Exp} \ t \rightarrow M \ t) \rightarrow \mathsf {Exps} \ ts \ \rightarrow M \ \ ts \ := \\ &{} \lambda f \ es. \ \mathsf {match} \ es \ \mathsf {with} \ [] \ \Rightarrow \ [] \\ &{} \qquad \qquad \qquad \quad | \ e \,\,{:}{:}\,\, es' \Rightarrow \mathsf {bind} \ (f \ e) \ (\lambda x. \ (\mathsf {bind} \ (\mathsf {mapM} \ f \ es') \\ &{} \qquad \qquad \qquad \qquad \qquad \qquad \qquad \qquad \qquad \quad (\lambda xs. \ \mathsf {ret} \ (x \,\,{:}{:}\,\, xs )))) \end{array} \end{aligned}$$

(2)

$$\begin{aligned} \begin{array}{lll} \mathsf {iterateM} &{} ({ ts}: \mathsf {Typs}) \ (t : \mathsf {Typ}) \ (e_0 : \ { ts}\rightarrow M \ t) \\ &{} (e_1: \ ({ ts}\rightarrow M \ t) \rightarrow ({ ts}\rightarrow M \ t)) \\ &{} (n: \mathsf {Nat}) \ (xs: \ { ts}) : M \ t \ := \mathsf {match} \ n \ \mathsf {with} \\ &{} \quad 0 \ \Rightarrow \ e_0 \ xs \quad | \ S \ n' \ \Rightarrow \ e_1 \ (\mathsf {iterateM} \ { ts}\ t \ e_0 \ e_1 \ n') \ xs \end{array} \end{aligned}$$

(3)

$$\begin{aligned} \begin{array}{lll} \varTheta _{t} \ (\mathsf {Exp} \ t) \ &{} := \ M \ t \\ \varTheta _{t} \ (\mathsf {Exps} \ { ts}) \ &{} := \ M \ { ts}\\ \varTheta _{t} \ (\mathsf {Fun} \ t \ { ts}) \ &{} := \ { ts}\rightarrow M \ t \\ \varTheta _{t} \ (\mathsf {Act} \ t \ { ts}) \ &{} := \ { ts}\rightarrow M \ t \end{array} \end{aligned}$$

(4)

$$\begin{aligned} \begin{array}{lll} \varTheta _e \ : \ \forall t. \ \mathsf {Exp} \ t \rightarrow M \ t \\ \varTheta _e \ (\mathsf {val} \ x) &{} = \ \mathsf {ret} \ x \\ \varTheta _e \ (\mathsf {binds} \ e_1 \ (\lambda x: t. \ e_2)) &{} = \ \mathsf {bind} \ (\varTheta _e \ e_1) \ (\lambda x: t. \ \varTheta _e \ e_2) \\ \varTheta _e \ (\mathsf {cond} \ e_1 \ e_2 \ e_3) &{} = \ \mathsf {condM} \ (\varTheta _{e} \ e_1) \ (\varTheta _{e} \ e_2) \ (\varTheta _{e} \ e_3) \\ \varTheta _e \ (\mathsf {call} \ { fc}\ { es}) &{} = \ \mathsf {bind} \ (\varTheta _{es} \ { es}) \ (\varTheta _{f} \ { fc}) \\ \varTheta _e \ (\mathsf {xcall} \ a \ { es}) &{} = \ \mathsf {bind} \ (\varTheta _{es} \ { es}) \ a \end{array} \end{aligned}$$

(5)

$$\begin{aligned} \begin{array}{lll} \varTheta _{es} \ : &{} \mathsf {Exps} \ { ts}\rightarrow M \ { ts}\\ \varTheta _{es} \ es &{} = \ \mathsf {mapM} \ \varTheta _e \ es \end{array} \end{aligned}$$

(6)

$$\begin{aligned} \begin{array}{lll} \varTheta _{f} &{} : \ \mathsf {Fun} \ t \ { ts}\rightarrow { ts}\rightarrow M \ t \\ \varTheta _{f} &{} (\mathsf {fun} \ (\lambda \ x: \ { ts}. \ e_0) \ (\lambda \ (r: \ { ts}\rightarrow \mathsf {Exp} \ t) \ (x: \ { ts}). \ e_1) \ \ n) \ = \\ &{} \quad \mathsf {iterateM} \ { ts}\ t \ (\lambda \ x: \ { ts}. \ \varTheta _e \ e_0) \\ &{} \qquad \qquad \qquad \ (\lambda \ (r: \ { ts}\rightarrow M \ t) \ (x: \ { ts}). \ \varTheta _e \ e_1)) \ \ n \end{array} \end{aligned}$$

(7)