Compositional Verifiers for Mobile Code Safety Bor-Yuh Evan Chang Adam Chlipala George C. Necula May 12, 2005 OSQ Retreat Santa Cruz, California

2 5/12/2005Compositional Verifiers for Mobile Code Safety OR code type checker Type Safety as an Assurance Mechanism Type checking is a well-accepted safety assurance mechanism Most checkers today: –source-level (e.g. ML, C#, Java) –bytecode-level (e.g. CLI, JVML) –not assembly-level … pushl %ebp movl %esp, %ebp subl $8, %esp movl 12(%ebp), %eax subl $8, %esp movl (%eax), %edx addl $28, %edx pushl $3 pushl %eax movl (%edx), %eax call *%eax … pushl %ebp movl %esp, %ebp subl $8, %esp movl 12(%ebp), %eax subl $8, %esp movl (%eax), %edx addl $28, %edx pushl $3 pushl %eax movl (%edx), %eax call *%eax … Want: a straightforward extension to assembly-level checking

3 5/12/2005Compositional Verifiers for Mobile Code Safety Problem Verifiers for lower-level code are more difficult and tedious to build Observation 1:Observation 1: Many verification tasks are common to large classes of verifiers –stack overflow checks, adherence to the calling convention (almost all) –dynamic dispatch (object-oriented languages) Observation 2:Observation 2: Various intermediate-level languages abstract various details

4 5/12/2005Compositional Verifiers for Mobile Code Safety Basic Idea Stack verifierCall verifierType verifier call func(6) mem[sp] := 6 sp := sp – 4 jump func push 6 jump func

5 5/12/2005Compositional Verifiers for Mobile Code Safety jump func state Verifier Construction Verifiers are typically phrased as abstract interpreters or data- flow analyses Call verifier

6 5/12/2005Compositional Verifiers for Mobile Code Safety state call func(6) state Verifier Construction Call verifierType verifier

7 5/12/2005Compositional Verifiers for Mobile Code Safety state call func(6) jump func state call func(6) state Composing Flow Functions state Call verifierType verifier Decompile state Step call func(6) Decompile state Step

8 5/12/2005Compositional Verifiers for Mobile Code Safety Summary Intermediate languages seem useful for interfacing between abstract interpreters –Re-use of existing higher-level verifiers (e.g. JBV) Decomposed abstract transition into –a decompilation phase –a transition phase to expose the abstraction to higher-level verifiers Local decomposition of abstract transition hopefully makes soundness proofs of a composed verifier compositional