Skip to content

Commit c4cfd01

Browse files
palmskogpalmskog
committed
initial commit
0 parents  commit c4cfd01

File tree

76 files changed

+44408
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+44408
-0
lines changed

Diff for: ‎.gitignore

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
.HOLMK
2+
.hollogs
3+
*.uo
4+
*.ui
5+
*.dat
6+
*Theory.sig
7+
*Theory.sml

Diff for: ‎.holpath

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
MILDIR

Diff for: ‎LICENSE

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
MIL COPYRIGHT NOTICE, LICENSE AND DISCLAIMER.
2+
3+
Copyright 2022 by the MIL CONTRIBUTORS
4+
5+
Redistribution and use in source and binary forms, with or without
6+
modification, are permitted provided that the following conditions are
7+
met:
8+
9+
* Redistributions of source code must retain the above copyright
10+
notice, this list of conditions and the following disclaimer.
11+
12+
* Redistributions in binary form must reproduce the above copyright
13+
notice, this list of conditions and the following disclaimer in
14+
the documentation and/or other materials provided with the
15+
distribution.
16+
17+
* The names of the copyright holders and contributors may not be
18+
used to endorse or promote products derived from this software
19+
without specific prior written permission.
20+
21+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22+
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24+
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25+
HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26+
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27+
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
28+
OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
29+
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
30+
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
31+
USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
32+
DAMAGE.

Diff for: ‎Makefile

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
default: hol
2+
3+
hol:
4+
Holmake -r -I executable
5+
6+
examples:
7+
Holmake -r -I examples
8+
9+
cakeml:
10+
Holmake -r -I cakeml
11+
12+
bir:
13+
Holmake -r -I bir
14+
15+
clean:
16+
cd misc && Holmake clean
17+
cd semantics && Holmake clean
18+
cd executable && Holmake clean
19+
cd examples && Holmake clean
20+
cd bir && Holmake clean
21+
cd cakeml && Holmake clean
22+
23+
.PHONY: default clean hol examples cakeml bir

Diff for: ‎README.md

+174
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# MIL
2+
3+
A machine independent language for defining the semantics of microarchitectural
4+
features such as out-of-order and speculative execution.
5+
6+
## Building
7+
8+
Requirements:
9+
- [Poly/ML 5.8.1](https://github.com/polyml/polyml/releases/tag/v5.8.1) (or later)
10+
- [HOL4 kananaskis-14](https://github.com/HOL-Theorem-Prover/HOL/releases/tag/kananaskis-14)
11+
12+
The `hol` Makefile task, which assumes `Holmake` is available on the system, builds all core HOL4 theories (i.e., excluding examples and theories related to HolBA and CakeML):
13+
```shell
14+
make hol
15+
```
16+
This can take up to a few minutes on a modern machine.
17+
18+
## Files
19+
20+
- `misc`: miscellaneous utility definitions and results, not tied to MIL
21+
22+
- [`ottLib.sml`](misc/ottLib.sml): some general SML definitions
23+
- [`ottScript.sml`](misc/ottScript.sml): some general HOL4 definitions
24+
- [`milPermutationScript.sml`](misc/milPermutationScript.sml): definitions and theorems about permutations of lists under arbitrary equivalence relations
25+
- [`milUtilityScript.sml`](misc/milUtilityScript.sml): general definitions and theorems about lists, finite maps, and predicate sets
26+
27+
- `semantics`: core MIL definitions and metatheory
28+
29+
- [`milScript.sml`](semantics/milScript.sml): HOL4 definition of MIL syntax and IO and OoO semantics
30+
- [`milSyntax.sml`](semantics/milSyntax.sml): SML interface to the MIL syntax in HOL4
31+
- [`milTracesScript.sml`](semantics/milTracesScript.sml): definitions and theorems about traces following a labeled step relation, and related definitions for MIL
32+
- [`milSemanticsUtilityScript.sml`](semantics/milSemanticsUtilityScript.sml): utility definitions and results about MIL definitions
33+
- [`milMetaScript.sml`](semantics/milMetaScript.sml): definition of well-formedness, and general results about MIL's semantics
34+
- [`milInitializationScript.sml`](semantics/milInitializationScript.sml): initialization of MIL resources
35+
- [`milReorderScript.sml`](semantics/milReorderScript.sml): definitions and theorems about reordering of MIL traces, including a theorem on memory consistency for the OoO and IO semantics
36+
- [`milCompositionalScript.sml`](semantics/milCompositionalScript.sml): definitions and theorems on basic composition of MIL programs
37+
- [`milNoninterferenceScript.sml`](semantics/milNoninterferenceScript.sml): definitions and theorems related to conditional noninterference
38+
- [`milExampleBisimulationScript.sml`](semantics/milExampleBisimulationScript.sml): definitions and theorems related to bisimulations for MIL programs
39+
40+
- `executable`: executable functions related to MIL and their theory
41+
42+
- [`milExecutableUtilityScript.sml`](executable/milExecutableUtilityScript.sml): definitions and correctness proofs for executable versions of semantic functions
43+
- [`milExecutableTransitionScript.sml`](executable/milExecutableTransitionScript.sml): definitions and soundness proofs for executable step functions for the OoO and IO semantics
44+
- [`milExecutableCompletenessScript.sml`](executable/milExecutableCompletenessScript.sml): completeness for executable step functions
45+
- [`milExecutableInitializationScript.sml`](executable/milExecutableInitializationScript.sml): executable functions for initializing MIL resources
46+
- [`milExecutableIOScript.sml`](executable/milExecutableIOScript.sml): instruction-by-instruction generation of MIL executions
47+
- [`milExecutableIOTraceScript.sml`](executable/milExecutableIOTraceScript.sml): instruction-by-instruction generation of MIL traces
48+
- [`milExecutableIOCompletenessScript.sml`](executable/milExecutableIOCompletenessScript.sml): completeness for generation of execution and traces
49+
- [`milExecutableExamplesScript.sml`](executable/milExecutableExamplesScript.sml): definitions and results useful when executing MIL programs
50+
- [`milMaxExeTraceUtilityScript.sml`](executable/milMaxExeTraceUtilityScript.sml): definitions and results related to maximal terminating executions of MIL programs
51+
- [`milExecutableHelperScript.sml`](executable/milExecutableHelperScript.sml): examples of using execution generation on MIL programs
52+
- [`milExecutableCompositionalScript.sml`](Executable/milCompositionalScript.sml): definitions and theorems on basic composition of executable MIL programs
53+
- [`milBranchEqualScript.sml`](executable/milBranchEqualScript.sml): program that does branch on equal, and analysis of its traces by execution
54+
- [`milCopyEqualScript.sml`](executable/milBranchEqualScript.sml): program that does copy on equal, and analysis of its traces by execution
55+
56+
- `examples`: MIL program examples and related results
57+
58+
- [`milExampleMoveScript.sml`](examples/milExampleMoveScript.sml): example MIL program implementing a high-level move instruction
59+
- [`milMaxExeTraceExampleMoveScript.sml`](examples/milMaxExeTraceExampleMoveScript.sml): theorems for analysing the information leakage relation of ExampleMove by using the executable IO functions.
60+
- [`milExampleAssignmentScript.sml`](examples/milExampleAssignmentScript.sml): example MIL program implementing a high-level assignment
61+
- [`milMaxExeTraceExampleAssignmentScript.sml`](examples/milMaxExeTraceExampleAssignmentScript.sml): theorems for analysing the information leakage relation of ExampleAssignment by using the executable IO functions.
62+
- [`milExampleConditionalScript.sml`](examples/milExampleConditionalScript.sml): example MIL program implementing a high-level conditional
63+
- [`milMaxExeTraceExampleConditionalScript.sml`](examples/milMaxExeTraceExampleConditionalScript.sml): theorems for analysing the information leakage relation of ExampleConditional by using the executable IO functions.
64+
- [`milExampleSpectreOOOScript.sml`](examples/milExampleSpectreOOOScript.sml): example MIL program describing a Spectre-style out-of-order vulnerability
65+
- [`milMaxExeTraceExampleSpectreOOOScript.sml`](examples/milMaxExeTraceExampleSpectreOOOScript.sml): theorems for analysing the information leakage relation of ExampleSpectreOOO by using the executable IO functions.
66+
- [`milExampleLoopScript.sml`](examples/milExampleLoopScript.sml): example MIL program implementing a high-level loop
67+
68+
- `bir`: translation from BIR to MIL with examples
69+
70+
- [`bir_to_milLib.sml`](bir/bir_to_milLib.sml): translation SML library
71+
- [`bir_to_mil_test_basicScript.sml`](bir/bir_to_mil_test_basicScript.sml): translation test
72+
- [`bir_to_mil_test_castScript.sml`](bir/bir_to_mil_test_castScript.sml): translation test
73+
- [`bir_to_mil_test_cjmpScript.sml`](bir/bir_to_mil_test_cjmpScript.sml): translation test
74+
- [`bir_to_mil_test_execScript.sml`](bir/bir_to_mil_test_execScript.sml): translation test
75+
- [`bir_to_mil_test_nzcvScript.sml`](bir/bir_to_mil_test_nzcvScript.sml): translation test
76+
- [`bir_to_mil_test_obsScript.sml`](bir/bir_to_mil_test_obsScript.sml): translation test
77+
- [`bir_to_mil_test_execScript.sml`](bir/bir_to_mil_test_execScript.sml): translation test
78+
- [`bir_to_mil_test_storeScript.sml`](bir/bir_to_mil_test_storeScript.sml): translation test
79+
- [`milScamvExperiment0Script.sml`](bir/milScamvExperiment0Script.sml`): translation test
80+
81+
- `cakeml`: proven refinement of executable functions to CakeML, and utility code
82+
83+
- [`milCakeScript.sml`](cakeml/milCakeScript.sml): CakeML friendly definitions of MIL executable functions
84+
- [`milCakeProofScript.sml`](cakeml/milCakeProofScript.sml): proofs that CakeML friendly functions refine the original MIL executable functions
85+
- [`milProgScript.sml`](cakeml/milProgScript.sml): proof-producing translation of CakeML friendly definitions to CakeML
86+
- [`mil_to_MilprintLib.sml`)(cakeml/mil_to_MilprintLib.sml): direct pretty-printing of MIL abstract syntax to CakeML concrete syntax, for when the CakeML translator is too slow
87+
88+
## Key definitions and results
89+
90+
- `semantics`
91+
92+
- `milScript.sml`: datatypes `res`, `e`, `i`, `act`, `obs`, `l`, `State`; functions `sem_expr`, `translate_val`, `Completed`, `addr_of`, `str_may`, `str_act`, `sem_instr`; relations `out_of_order_step`, `in_order_step`
93+
- `milTracesScript.sml`: relation `step_execution`; functions `trace`, `commits`, `step_invariant`
94+
- `milMetaScript.sml`: function `well_formed_state`; theorems `well_formed_OoO_transition_well_formed`, `OoO_transition_deterministic`, `OoO_transitions_can_be_applied`, `OoO_transitions_exist`
95+
- `milMetaIOScript.sml`: theorem `IO_transition_deterministic`
96+
- `milReorderScript.sml`: theorems `OoO_IO_well_formed_memory_consistent`, `IO_OoO_memory_consistent`
97+
98+
- `executable`
99+
- `milExecutableIOScript.sml`: function `IO_bounded_execution`; theorems `IO_bounded_execution_out_of_order_step_sound`, `IO_bounded_execution_in_order_step_sound`
100+
- `milExecutableIOTraceScript.sml`: function `IO_bounded_trace`; theorems `IO_bounded_trace_out_of_order_step_list_sound`, `IO_bounded_trace_in_order_step_list_sound`
101+
- `milBranchEqualScript.sml`: functions `example_beq`, `example_beq_t`, `initialize_example_beq`; theorems `initialize_example_beq_reg_not_1_execution_exists_OoO_trace`, `initialize_example_beq_reg_1_execution_exists_OoO_trace`
102+
- `milCopyEqualScript.sml`: functions `example_ceq`, `example_ceq_t`, `initialize_example_ceq`; theorems `initialize_example_ceq_list_1_z_not_1_execution_exists_OoO_trace`, `initialize_example_ceq_list_2_z_not_1_execution_exists_OoO_trace`, `initialize_example_ceq_list_3_z_not_1_execution_exists_OoO_trace`, `initialize_example_ceq_list_4_z_not_1_execution_exists_OoO_trace`, `initialize_example_ceq_list_1_z_1_execution_exists_OoO_trace`
103+
104+
- `cakeml`
105+
106+
- `milCakeScript.sml`: functions `IO_bounded_execution_cake`, `IO_bounded_trace_cake`
107+
- `milCakeProofScript.sml`: theorems `IO_bounded_execution_eq_cake`, `IO_bounded_trace_eq_cake`
108+
109+
## Analyzed MIL Programs
110+
111+
The directory `examples` contains definitions of MIL programs and corresponding information flow analysis theorems in HOL4. The theory for each example program has two parts:
112+
- `milExample<Program>Script.sml`: definition of the example and bisimulation proof
113+
- `milMaxExeTraceExample<Program>Script.sml`: generation of the information leakage relation for the example using the IO executor
114+
115+
To build all example theories, run the following command:
116+
```shell
117+
make examples
118+
```
119+
120+
This can take around 15 minutes on a modern machine.
121+
122+
## BIR-to-MIL Translator
123+
124+
The directory `bir` contains an (unverified) SML function that translates a BIR program to a MIL program, and some examples of using this function.
125+
126+
To build the translator, [HolBA](https://github.com/kth-step/HolBA) with the tag `mil` must be present in a sibling directory named `HolBA`:
127+
```shell
128+
git clone https://github.com/kth-step/HolBA.git
129+
cd HolBA
130+
git checkout mil
131+
```
132+
133+
With the `HolBA` directory available as a sibling, the translator can be built by running:
134+
```shell
135+
make bir
136+
```
137+
138+
This can take a few minutes on a modern machine (due to BIR and some long-running examples).
139+
140+
## CakeML Library for MIL
141+
142+
The directory `cakeml` contains definitions and scripts for generating a (verified) CakeML library that can process MIL data and programs.
143+
144+
To build the library, [CakeML](https://github.com/CakeML/cakeml) with the tag `v1469` must be present in a sibling directory named `cakeml`:
145+
```shell
146+
git clone https://github.com/CakeML/cakeml.git
147+
cd cakeml
148+
git checkout v1469
149+
```
150+
151+
With the `cakeml` directory available as a sibling along with `HolBA` as above, the library can be built by running:
152+
```shell
153+
make cakeml
154+
```
155+
156+
This can take more than an hour on a modern machine, due to that some key CakeML theories must be built.
157+
158+
## Running code compiled by CakeML
159+
160+
For convenience, we pretty-printed the MIL CakeML code along with an example for trace generation in the file `mil_reg_translate.cml` in the `cakeml` directory. This file can be compiled and run as follows, on an x86-64 machine:
161+
```shell
162+
wget https://github.com/CakeML/cakeml/releases/download/v1469/cake-x64-64.tar.gz
163+
tar xzvf cake-x64-64.tar.gz
164+
cd cake-x64-64
165+
cp path/to/MIL/cakeml/mil_reg_translate.cml .
166+
make mil_reg_translate.cake
167+
./mil_reg_translate.cake
168+
```
169+
On a modern machine, compilation can take a few minutes, but running the program should take
170+
only a few milliseconds to output a MIL trace.
171+
172+
In comparison, the HOL4 `EVAL_TAC` call that proves the equivalent theorem
173+
`ex_bir_prog_IO_bounded_trace_long` in `bir/bir_to_mil_test_basicScript.sml`
174+
can take up to a minute.

Diff for: ‎bir/Holmakefile

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# tested with: https://github.com/kth-step/HolBA/releases/tag/mil
2+
HOLBADIR = ../../HolBA
3+
INCLUDES = $(MILDIR)/misc \
4+
$(MILDIR)/semantics \
5+
$(MILDIR)/executable \
6+
$(HOLBADIR)/src/theory/bir \
7+
$(HOLBADIR)/src/theory/bir-support \
8+
$(HOLBADIR)/src/tools/exec \
9+
$(HOLBADIR)/src/tools/scamv/obsmodel
10+
11+
all: $(DEFAULT_TARGETS)
12+
.PHONY: all

Diff for: ‎bir/bir_to_milLib.sig

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
signature bir_to_milLib =
2+
sig
3+
include Abbrev
4+
5+
(* convert BIR program term to MIL Normal Form (MNF) *)
6+
val bir_prog_to_mnf : term -> term
7+
8+
(* set translate function for BIR program term in MNF *)
9+
val bir_prog_to_mil_iset : term -> string -> thm
10+
11+
(* list translate function for BIR program term in MNF *)
12+
val bir_prog_to_mil_ilist : term -> string -> thm
13+
14+
(* get term for BIR memory bounds from hex strings *)
15+
val mem_bounds_from_hex : string -> string -> term
16+
end

0 commit comments

Comments
 (0)