From system F to typed assembly language

Morrisett, Greg; Walker, David; Crary, Karl; Glew, Neal

doi:10.1145/319301.319345

Cited by 452 publications

(257 citation statements)

References 21 publications

Supporting

Mentioning

256

Contrasting

Order By: Relevance

“…A type system for a first-order functional language defines when the reuse of heap cells due to such type annotations is guaranteed not to alter the behaviour of the program. Inspired by this work and by Typed Assembly Language of Morrisett et al [12], Aspinall and Campagnoni [1] have defined heap-bounded assembly language, a byte code language equipped with specific pseudo-instructions for passing information about the heap structure to the type system. The type system use linearity constraints to guarantee absence of aliasing.…”

Section: Related Workmentioning

confidence: 99%

Certified Memory Usage Analysis

Cachera

Jensen

Pichardie

et al. 2005

FM 2005: Formal Methods

View full text Add to dashboard Cite

Abstract. We present a certified algorithm for resource usage analysis, applicable to languages in the style of Java byte code. The algorithm verifies that a program executes in bounded memory. The algorithm is destined to be used in the development process of applets and for enhanced byte code verification on embedded devices. We have therefore aimed at a low-complexity algorithm derived from a loop detection algorithm for control flow graphs. The expression of the algorithm as a constraint-based static analysis of the program over simple lattices provides a link with abstract interpretation that allows to state and prove formally the correctness of the analysis with respect to an operational semantics of the program. The certification is based on an abstract interpretation framework implemented in the Coq proof assistant which has been used to provide a complete formalisation and formal verification of all correctness proofs.

show abstract

Section: Related Workmentioning

confidence: 99%

Certified Memory Usage Analysis

Cachera

Jensen

Pichardie

et al. 2005

FM 2005: Formal Methods

View full text Add to dashboard Cite

show abstract

“…The approaches taken in these projects range from statically identifying common programming errors, to statically ensuring type safety, to the run-time checking of certain security properties. The projects that are closest to ours are Proof-Carrying Code (PCC) [32], the Touchstone Certifying Compiler [31] and TypedAssembly Language (TAL) [25,26,28]. Proof-Carrying Code (PCC) has a code producer generate not only the code but also a proof that the code is safe.…”

Section: Related Workmentioning

confidence: 99%

“…Morrisett et al [25,26,28] introduced the notion of typed assembly language (TAL). In their approach, type information from a high-level program is incorporated into the representation of the program in a platform-independent typed intermediate form, and carried through a series of transformations down to the level of the target code.…”

Section: Related Workmentioning

confidence: 99%

“…In contrast to work that enforces safety by restricting the things that can be expressed in a source language (e.g., safe languages, certifying compilers [31], and typed-assembly languages [25,26,28]), we believe that safe code can be written in any source language and produced by any compiler, as long as nothing "unsafe" is expressed in the machine code. This philosophical difference has several implications.…”

Section: Introductionmentioning

confidence: 98%

See 1 more Smart Citation

Typestate Checking of Machine Code

Reps

Miller

2001

Programming Languages and Systems

View full text Add to dashboard Cite

We show how to determine statically whether it is safe for untrusted machine code to be loaded into a trusted host system.Our safety-checking technique operates directly on the untrusted machine-code program, requiring only that the initial inputs to the untrusted program be annotated with typestate information and linear constraints. This approach opens up the possibility of being able to certify code produced by any compiler from any source language, which gives the code producers more freedom in choosing the language in which they write their programs. It eliminates the dependence of safety on the correctness of the compiler because the final product of the compiler is checked. It leads to the decoupling of the safety policy from the language in which the untrusted code is written, and consequently, makes it possible for safety checking to be performed with respect to an extensible set of safety properties that are specified on the host side.We have implemented a prototype safety checker for SPARC machine-language programs, and applied the safety checker to several examples. The safety checker was able to either prove that an example met the necessary safety conditions, or identify the places where the safety conditions were violated. The checking times ranged from less than a second to 14 seconds on an UltraSPARC machine.

show abstract

“…[9] typically have problems with (1), (2), (3), and (5). Traditional program logics, including Hoare Logic [4] and Separation Logic [16] often fail on (4), as explained in [12].…”

Section: Introductionmentioning

confidence: 99%

Using XCAP to Certify Realistic Systems Code: Machine Context Management

Yu²,

Shao

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Formal, modular, and mechanized verification of realistic systems code is desirable but challenging. Verification of machine context management (a basis of multi-tasking) is one representative example. With context operations occurring hundreds to thousands of times per second on every computer, their correctness deserves careful examination. Given the small and stable code bases, it is a common misunderstanding that the context management code is suitable for informal scrutiny and testing. Unfortunately, after being extensively studied and used for decades, it still proves to be a common source of bugs and confusion. Yet its verification remains difficult due to the machine-level detail, irregular patterns of control flows, and rich application scenarios. This paper reports our experience applying XCAP-a recent theoretical verification framework-to certify a realistic x86 implementation of machine context management. XCAP supports expressive and modular logical specifications, but has only previously been applied on simple idealized machine and code. By applying the XCAP theory to an x86 machine model, building libraries of common proof tactics and lemmas, composing specifications for the context data structures and routines, and proving that the code behave accordingly, we achieved the first formal, modular, and mechanized verification of realistic x86 context management code. Our proofs are fully mechanized in the Coq proof assistant. Our certified library code runs on stock hardware and can be linked with other certified systems and application code. Our technique applies to other variants or extensions of context management (e.g., more complex context, different platforms), provides a solid basis for further verification of thread implementation and concurrent programs, and illustrates how to achieve formal, modular, and mechanized verification of realistic systems code.

show abstract

From system F to typed assembly language

Cited by 452 publications

References 21 publications

Certified Memory Usage Analysis

Certified Memory Usage Analysis

Typestate Checking of Machine Code

Using XCAP to Certify Realistic Systems Code: Machine Context Management

Contact Info

Product

Resources

About