1. Compositional Verifiers for Mobile Code Safety Bor-Yuh Evan Chang Adam Chlipala George C. Necula May 12, 2005 OSQ Retreat Santa Cruz, California

2. 2 5/12/2005Compositional Verifiers for Mobile Code Safety OR code type checker Type Safety as an Assurance Mechanism Type checking is a well-accepted safety assurance mechanism Most checkers today: –source-level (e.g. ML, C#, Java) –bytecode-level (e.g. CLI, JVML) –not assembly-level … pushl %ebp movl %esp, %ebp subl $8, %esp movl 12(%ebp), %eax subl $8, %esp movl (%eax), %edx addl $28, %edx pushl $3 pushl %eax movl (%edx), %eax call *%eax … pushl %ebp movl %esp, %ebp subl $8, %esp movl 12(%ebp), %eax subl $8, %esp movl (%eax), %edx addl $28, %edx pushl $3 pushl %eax movl (%edx), %eax call *%eax … Want: a straightforward extension to assembly-level checking

3. 3 5/12/2005Compositional Verifiers for Mobile Code Safety Problem Verifiers for lower-level code are more difficult and tedious to build Observation 1:Observation 1: Many verification tasks are common to large classes of verifiers –stack overflow checks, adherence to the calling convention (almost all) –dynamic dispatch (object-oriented languages) Observation 2:Observation 2: Various intermediate-level languages abstract various details

4. 4 5/12/2005Compositional Verifiers for Mobile Code Safety Basic Idea Stack verifierCall verifierType verifier call func(6) mem[sp] := 6 sp := sp – 4 jump func push 6 jump func

5. 5 5/12/2005Compositional Verifiers for Mobile Code Safety jump func state Verifier Construction Verifiers are typically phrased as abstract interpreters or data- flow analyses Call verifier

6. 6 5/12/2005Compositional Verifiers for Mobile Code Safety state call func(6) state Verifier Construction Call verifierType verifier

7. 7 5/12/2005Compositional Verifiers for Mobile Code Safety state call func(6) jump func state call func(6) state Composing Flow Functions state Call verifierType verifier Decompile state Step call func(6) Decompile state Step

8. 8 5/12/2005Compositional Verifiers for Mobile Code Safety Summary Intermediate languages seem useful for interfacing between abstract interpreters –Re-use of existing higher-level verifiers (e.g. JBV) Decomposed abstract transition into –a decompilation phase –a transition phase to expose the abstraction to higher-level verifiers Local decomposition of abstract transition hopefully makes soundness proofs of a composed verifier compositional