## Formalizing and verifying semantic type soundness for a simple compiler (2007)

### Cached

### Download Links

Citations: | 12 - 4 self |

### BibTeX

@TECHREPORT{Benton07formalizingand,

author = {Nick Benton and Uri Zarfaty},

title = {Formalizing and verifying semantic type soundness for a simple compiler },

institution = {},

year = {2007}

}

### OpenURL

### Abstract

We describe a semantic type soundness result, formalized in the Coq proof assistant, for a compiler from a simple imperative language with heap-allocated data into an idealized assembly language. Types in the high-level language are interpreted as binary relations, built using both second-order quantification and a form of separation structure, over stores and code pointers in the low-level machine.

### Citations

1093 | Proof-carrying code
- Necula
- 1997
(Show Context)
Citation Context ...e has seen an explosion of research into type systems, formal verification and certification for low-level code, ignited by the original papers on typed assembly language [34] and proof-carrying code =-=[36]-=-, and fanned by the development of separation logic [42]. These developments have been driven partly by need (as well as the traditional arguments in favour of some level of formal verification as a w... |

705 | Separation logic: a logic for shared mutable data structures
- Reynolds
(Show Context)
Citation Context ...ormal verification and certification for low-level code, ignited by the original papers on typed assembly language [34] and proof-carrying code [36], and fanned by the development of separation logic =-=[42]-=-. These developments have been driven partly by need (as well as the traditional arguments in favour of some level of formal verification as a way to develop software that actually works, the internet... |

588 | From System F to Typed Assembly Language
- Morrisett, Walker, et al.
- 1999
(Show Context)
Citation Context ...1 Introduction The last decade has seen an explosion of research into type systems, formal verification and certification for low-level code, ignited by the original papers on typed assembly language =-=[34]-=- and proof-carrying code [36], and fanned by the development of separation logic [42]. These developments have been driven partly by need (as well as the traditional arguments in favour of some level ... |

563 |
Assigning meanings to programs
- Floyd
- 1967
(Show Context)
Citation Context ...se, one would ideally like both, and that is one subject of our current work.) Reasoning directly about unstructured low-level code also has a long history, going right back to Floyd’s original paper =-=[23]-=-. Once again, the Boyer-Moore prover was used in some notable early mechanization projects [20]. The idea of developing type systems for low-level programs, and preserving typing through compilation, ... |

539 | A Syntactic Approach to Type Soundness
- Wright, Felleisen
- 1994
(Show Context)
Citation Context ... to formalizing type soundness properties: syntactic and semantic. The difference between the two is not (merely) one of proof technique; they are different kinds of result. In the syntactic approach =-=[46]-=-, one typically defines a small-step operational semantics for the language that gets stuck (makes no transition) in configurations that are considered to be bad. One then shows ‘preservation and prog... |

364 |
Types, abstraction and parametric polymorphism
- Reynolds
- 1983
(Show Context)
Citation Context ...ng literal natural numbers with a modal operator [10], and it would be interesting to incorporate this into our formalization. 29sModelling types by partial equivalence relations goes back a long way =-=[41, 6, 22, 3, 21]-=- and, amongst many other things, parametric logical relations have recently been used by many authors in reasoning about program equivalences in the presence of higher order functions and encapsulated... |

268 | Local reasoning about programs that alter data structures
- O’Hearn, Reynolds, et al.
- 2001
(Show Context)
Citation Context ...lation then any modifications outside the support yield another pair of states in the relation. If R1 is supported by (L1, L ′ 1 ) and R2 by (L2, L ′ 2 ), then define a form of separating conjunction =-=[37]-=- by � def R1 ∩ R2 if L1 ∩ L2 = ∅ and L R1 ⊗ R2 = ′ 1 ∩ L′ 2 = ∅ ∅ otherwise So two states are in R1 ⊗R2 when they are in both R1 and R2 and the supports are disjoint. It is easy to see that R1 ⊗ R2 is... |

228 | Foundational proof-carrying code
- Appel
- 2001
(Show Context)
Citation Context ...ts of universal domains through to recent research on ideals and biorthogonality [45, 30]. Particularly relevent from the point of view of the present paper is the work of Appel and his collaborators =-=[8, 7, 9, 44, 4]-=- on Foundational Proof Carrying Code (FPCC). The idea of FPCC is to give a semantics to high-level types as low-level specifications expressed in some sufficiently powerful program logic. This low-lev... |

226 | Formal certification of a compiler back-end or: programming a compiler with a proof assistant
- Leroy
- 2006
(Show Context)
Citation Context ...yer-Moore prover [31, 48] and the manual verification of the VLISP Scheme compiler [24]. More recent work includes that of Leroy on verifying compilation of a C-like language to PowerPC assembly code =-=[27]-=-. Full compiler correctness is a more ambitious goal than type safety, but these projects relate high-level to low-level without making explicit the kind of language-independent low-level contracts th... |

210 |
Data types as lattices
- SCOTT
- 1976
(Show Context)
Citation Context ...tion to the meaning Hoare triples in program logics should be apparent. Interpretations of types as predicates over some untyped model of computation have a long history, from the early work of Scott =-=[43]-=- and McCracken 2 This is, of course, not strictly true. Operating systems use memory management hardware to trap ‘illegal’ pointer dereferencing or jumps to addresses in pages marked as ‘no execute’, ... |

146 | A Linearly Typed Assembly Language
- Cheney, Morrisett
- 2003
(Show Context)
Citation Context ...he Boyer-Moore prover was used in some notable early mechanization projects [20]. The idea of developing type systems for low-level programs, and preserving typing through compilation, is more recent =-=[34, 33]-=- and has attracted much attention in the context of proof-carrying code [36], as well as in more traditional compiler certification. That low-level types might be given a semantic interpretation in te... |

135 | An indexed model of recursive types for foundational proof-carrying code
- Appel, McAllester
- 2001
(Show Context)
Citation Context ...ts of universal domains through to recent research on ideals and biorthogonality [45, 30]. Particularly relevent from the point of view of the present paper is the work of Appel and his collaborators =-=[8, 7, 9, 44, 4]-=- on Foundational Proof Carrying Code (FPCC). The idea of FPCC is to give a semantics to high-level types as low-level specifications expressed in some sufficiently powerful program logic. This low-lev... |

127 | A semantic model of types and machine instructions for proof-carrying code
- Appel, Felty
(Show Context)
Citation Context ...ts of universal domains through to recent research on ideals and biorthogonality [45, 30]. Particularly relevent from the point of view of the present paper is the work of Appel and his collaborators =-=[8, 7, 9, 44, 4]-=- on Foundational Proof Carrying Code (FPCC). The idea of FPCC is to give a semantics to high-level types as low-level specifications expressed in some sufficiently powerful program logic. This low-lev... |

124 | A logic for parametric polymorphism
- Plotkin, Abadi
- 1993
(Show Context)
Citation Context ...elations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types [5]. Relational program logics have been developed by several researchers =-=[2, 11, 47]-=-, though note that the current work does not make use of a specialized relational logic: we just work directly in CiC. The other main influence on this work is separation logic [37, 42], though we wor... |

110 | Operational reasoning in functions with local state
- Pitts, Stark
- 1998
(Show Context)
Citation Context ...gs, parametric logical relations have recently been used by many authors in reasoning about program equivalences in the presence of higher order functions and encapsulated dynamically allocated store =-=[38, 40, 15]-=-. Ahmed has used step-indexed relations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types [5]. Relational program logics have been de... |

84 | Correctness of a compiler for arithmetic expressions
- McCarthy, Painter
- 1967
(Show Context)
Citation Context ...o that we can reason about equations on low-level code. There is a great deal of related work, of which we can only mention a fraction. Compiler correctness has been studied for at least four decades =-=[28, 32]-=- with notable early examples including the work on Piton and Micro-Gypsy using the Boyer-Moore prover [31, 48] and the manual verification of the VLISP Scheme compiler [24]. More recent work includes ... |

81 | Simple relational correctness proofs for static analyses and program transformations
- BENTON
(Show Context)
Citation Context ...elations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types [5]. Relational program logics have been developed by several researchers =-=[2, 11, 47]-=-, though note that the current work does not make use of a specialized relational logic: we just work directly in CiC. The other main influence on this work is separation logic [37, 42], though we wor... |

78 | Protection in Programming-Language Translations
- Abadi
- 1999
(Show Context)
Citation Context ...ble at the low-level. This would mean we had captured a sense in which our compilation scheme is fully abstract. Even quite small abstraction failures in compilation can easily lead to security holes =-=[1, 26]-=- so it seems natural to try to achieve full abstraction. One way to do that would be to take the interpretation of a type A to be (roughly) the set of code fragments that might be emitted by a fixed c... |

72 | Step-indexed syntactic logical relations for recursive and quantified types
- Ahmed
- 2006
(Show Context)
Citation Context ...ed dynamically allocated store [38, 40, 15]. Ahmed has used step-indexed relations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types =-=[5]-=-. Relational program logics have been developed by several researchers [2, 11, 47], though note that the current work does not make use of a specialized relational logic: we just work directly in CiC.... |

63 | A semantic basis for Quest
- Cardelli, Longo
- 1991
(Show Context)
Citation Context ...ng literal natural numbers with a modal operator [10], and it would be interesting to incorporate this into our formalization. 29sModelling types by partial equivalence relations goes back a long way =-=[41, 6, 22, 3, 21]-=- and, amongst many other things, parametric logical relations have recently been used by many authors in reasoning about program equivalences in the presence of higher order functions and encapsulated... |

62 | A per model of polymorphism and recursive types
- Abadi, Plotkin
- 1990
(Show Context)
Citation Context ...ng literal natural numbers with a modal operator [10], and it would be interesting to incorporate this into our formalization. 29sModelling types by partial equivalence relations goes back a long way =-=[41, 6, 22, 3, 21]-=- and, amongst many other things, parametric logical relations have recently been used by many authors in reasoning about program equivalences in the presence of higher order functions and encapsulated... |

57 | Relational reasoning in a nominal semantics for storage
- Benton, Leperchley
- 2005
(Show Context)
Citation Context ... constant; they depend on the contents of those stores. So we have to replace sets of locations L ⊆ N with functions A : state → P(N). We restrict attention to accessibility maps (first introduced in =-=[15]-=-), those A for which ∀ s s ′ , s ∼ A(s) s ′ ⇒ As = As ′ The accessibility map condition intuitively says that A ‘supports itself’, and has the effect of making the relation ∼A, defined by s ∼A s ′ ⇔ s... |

55 | Semantics of Types for Mutable State
- Ahmed
- 2004
(Show Context)
Citation Context |

53 | Metatheory and reflection in theorem proving: A survey and critique
- Harrison
- 1995
(Show Context)
Citation Context ...(l = 0) ∨ (l ≥ s’ 0 ∧ l < n + s’ 0)) 6 These are really defined as notation for operations on an inductive type of relationdenoting expressions that we use in doing proofs by computational reflection =-=[25, 19]-=-, but we gloss over that technicality here. 20s. . . Defined. and ). Definition R al (Ra:Accrel) n (Rc:Accrel) := ! ((0 |-> !(R aret n # T rel (1 to 4) (1 to 4) # Rc # Ra # E)) # (1 |-> (Natrel lift (... |

49 | A Mechanically Verified Language Implementation
- Moore
- 1989
(Show Context)
Citation Context ... only mention a fraction. Compiler correctness has been studied for at least four decades [28, 32] with notable early examples including the work on Piton and Micro-Gypsy using the Boyer-Moore prover =-=[31, 48]-=- and the manual verification of the VLISP Scheme compiler [24]. More recent work includes that of Leroy on verifying compilation of a C-like language to PowerPC assembly code [27]. Full compiler corre... |

48 |
Recursion over realizability structures
- Amadio
- 1991
(Show Context)
Citation Context |

45 | Using reflection to build efficient and certified decision procedures
- Boutin
- 1997
(Show Context)
Citation Context ...(l = 0) ∨ (l ≥ s’ 0 ∧ l < n + s’ 0)) 6 These are really defined as notation for operations on an inductive type of relationdenoting expressions that we use in doing proofs by computational reflection =-=[25, 19]-=-, but we gloss over that technicality here. 20s. . . Defined. and ). Definition R al (Ra:Accrel) n (Rc:Accrel) := ! ((0 |-> !(R aret n # T rel (1 to 4) (1 to 4) # Rc # Ra # E)) # (1 |-> (Natrel lift (... |

44 | eds.): VLISP: A Verified Implementation of Scheme
- Guttman, Wand
- 1995
(Show Context)
Citation Context ...r at least four decades [28, 32] with notable early examples including the work on Piton and Micro-Gypsy using the Boyer-Moore prover [31, 48] and the manual verification of the VLISP Scheme compiler =-=[24]-=-. More recent work includes that of Leroy on verifying compilation of a C-like language to PowerPC assembly code [27]. Full compiler correctness is a more ambitious goal than type safety, but these pr... |

43 | Abstract Predicates and Mutable ADTs in Hoare Type Theory - Nanevski, Ahmed, et al. - 2007 |

39 |
L.: Advice on Structuring Compilers and proving Them Correct
- Morris
- 1973
(Show Context)
Citation Context ...o that we can reason about equations on low-level code. There is a great deal of related work, of which we can only mention a fraction. Compiler correctness has been studied for at least four decades =-=[28, 32]-=- with notable early examples including the work on Piton and Micro-Gypsy using the Boyer-Moore prover [31, 48] and the manual verification of the VLISP Scheme compiler [24]. More recent work includes ... |

37 |
A very modal model of a modern, major, general type system
- Appel, Mellies, et al.
- 2007
(Show Context)
Citation Context ...ave already mentioned that the step-indexing idea we use here originated in the FPCC project; the technique has recently been refined somewhat, replacing literal natural numbers with a modal operator =-=[10]-=-, and it would be interesting to incorporate this into our formalization. 29sModelling types by partial equivalence relations goes back a long way [41, 6, 22, 3, 21] and, amongst many other things, pa... |

35 |
Relational semantics for recursive types and bounded quantification
- Cardone
- 1989
(Show Context)
Citation Context |

32 | Automated correctness proofs of machine code programs for a commercial microprocessor
- Boyer, Yu
- 1992
(Show Context)
Citation Context ...ly about unstructured low-level code also has a long history, going right back to Floyd’s original paper [23]. Once again, the Boyer-Moore prover was used in some notable early mechanization projects =-=[20]-=-. The idea of developing type systems for low-level programs, and preserving typing through compilation, is more recent [34, 33] and has attracted much attention in the context of proof-carrying code ... |

30 | A mechanically verified code generator
- Young
- 1989
(Show Context)
Citation Context ... only mention a fraction. Compiler correctness has been studied for at least four decades [28, 32] with notable early examples including the work on Piton and Micro-Gypsy using the Boyer-Moore prover =-=[31, 48]-=- and the manual verification of the VLISP Scheme compiler [24]. More recent work includes that of Leroy on verifying compilation of a C-like language to PowerPC assembly code [27]. Full compiler corre... |

29 | Relational parametricity and separation logic
- Birkedal, Yang
- 2007
(Show Context)
Citation Context ...-order parameterization over frames in place of the more usual ‘tight’ interpretation. Recent work on separation logic typing with higher order frame rules [17] and and extensions with quantification =-=[16, 18]-=- are technically very close to the present work, though working on paper and with slightly higher-level languages. Hoare type theory (HTT) is a related mixture of polymorphism, dependent type theory a... |

26 |
An Investigation of a Programming Language with a Polymorphic Type Structure
- McCracken
- 1979
(Show Context)
Citation Context ...’ position of Church, which regards types as coming before terms, rather than after. Even if our source types are prescriptive, we are firmly in the Curry camp regarding their interpretations here. 2s=-=[29]-=- using retracts of universal domains through to recent research on ideals and biorthogonality [45, 30]. Particularly relevent from the point of view of the present paper is the work of Appel and his c... |

25 | Relational separation logic
- Yang
- 2007
(Show Context)
Citation Context ...elations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types [5]. Relational program logics have been developed by several researchers =-=[2, 11, 47]-=-, though note that the current work does not make use of a specialized relational logic: we just work directly in CiC. The other main influence on this work is separation logic [37, 42], though we wor... |

23 | Semantic types: A fresh look at the ideal model for types
- Vouillon, Melliès
(Show Context)
Citation Context ...ource types are prescriptive, we are firmly in the Curry camp regarding their interpretations here. 2s[29] using retracts of universal domains through to recent research on ideals and biorthogonality =-=[45, 30]-=-. Particularly relevent from the point of view of the present paper is the work of Appel and his collaborators [8, 7, 9, 44, 4] on Foundational Proof Carrying Code (FPCC). The idea of FPCC is to give ... |

22 | A typed, compositional logic for a stack-based abstract machine
- Benton
- 2005
(Show Context)
Citation Context ...s. The way we deal with this is to work with relations that are the limit of a sequence of k-indexed approximants, where the natural number k represents a number of steps in the operational semantics =-=[9, 4, 12]-=-. In other words, our notions of ‘equivalent’ are expressed as the limit of ‘indistinguishable for up to k steps’ as k goes to ω. As more steps allow more distinctions to be made, it is natural to wor... |

22 | Recursive polymorphic types and parametricity in an operational framework
- Melliès, Vouillon
- 2005
(Show Context)
Citation Context ...ource types are prescriptive, we are firmly in the Curry camp regarding their interpretations here. 2s[29] using retracts of universal domains through to recent research on ideals and biorthogonality =-=[45, 30]-=-. Particularly relevent from the point of view of the present paper is the work of Appel and his collaborators [8, 7, 9, 44, 4] on Foundational Proof Carrying Code (FPCC). The idea of FPCC is to give ... |

22 |
Lambda definability and logical relations
- Plotkin
(Show Context)
Citation Context ...ular type is given by the diagonal part of the associated relation, so f has type A → B just when f is related to itself by the interpretation of A → B; this is the usual notion of ‘logical’ relation =-=[39]-=-. Since equality should be an equivalence relation, the natural notion for interpreting a type is a set of values and an equivalence relation on that set, which is easily seen to be the same thing as ... |

22 | Correctness of data representations involving heap data structures
- Reddy, Yang
- 2003
(Show Context)
Citation Context ...gs, parametric logical relations have recently been used by many authors in reasoning about program equivalences in the presence of higher order functions and encapsulated dynamically allocated store =-=[38, 40, 15]-=-. Ahmed has used step-indexed relations to give a complete characterization of contextual equivalence in a pure language with recursive and quantified types [5]. Relational program logics have been de... |

18 | Abstracting Allocation: The New new thing
- Benton
- 2006
(Show Context)
Citation Context ... form of the result and the methodology used for showing it. This paper describes work in progress, building on our earlier work on modular specification and verification of a simple memory allocator =-=[13]-=-. The results have been formalized and checked in the Coq proof assistant and most of the formal parts of the present paper are presented as extracts from the proof script, using Coq syntax. 2 Low-Lev... |

17 |
Securing the .NET programming model
- Kennedy
(Show Context)
Citation Context ...ble at the low-level. This would mean we had captured a sense in which our compilation scheme is fully abstract. Even quite small abstraction failures in compilation can easily lead to security holes =-=[1, 26]-=- so it seems natural to try to achieve full abstraction. One way to do that would be to take the interpretation of a type A to be (roughly) the set of code fragments that might be emitted by a fixed c... |

14 | Construction of a semantic model for a typed assembly language
- Tan, Appel, et al.
- 2004
(Show Context)
Citation Context |

13 |
writing and relations: Towards extensional semantics for effect analyses
- Reading
- 2006
(Show Context)
Citation Context ...estores them before exit meets the specification, as does code that builds literally different, but equivalent according to the types, heap structures according to the contents of unowned memory. See =-=[14]-=- for more on how preservation of sets of relations can express not only complete independence, but also read-only and write-only effects on particular storage locations. The theorem for expressions is... |

4 |
Higher-Order Separation Logic
- Varming, Birkedal
(Show Context)
Citation Context ...-order parameterization over frames in place of the more usual ‘tight’ interpretation. Recent work on separation logic typing with higher order frame rules [17] and and extensions with quantification =-=[16, 18]-=- are technically very close to the present work, though working on paper and with slightly higher-level languages. Hoare type theory (HTT) is a related mixture of polymorphism, dependent type theory a... |

2 |
Semantics of separation logic typing and higher-order frame rules
- Birkedal, Torp-Smith, et al.
- 2005
(Show Context)
Citation Context ...her than predicates, and use explicit higher-order parameterization over frames in place of the more usual ‘tight’ interpretation. Recent work on separation logic typing with higher order frame rules =-=[17]-=- and and extensions with quantification [16, 18] are technically very close to the present work, though working on paper and with slightly higher-level languages. Hoare type theory (HTT) is a related ... |