A complete formal semantics of x86-64 user-level instruction set architecture

Dasgupta, Sandeep; Park, Daejun; Kasampalis, Theodoros; Adve, Vikram; Roşu, Grigore

doi:10.1145/3314221.3314601

Cited by 37 publications

(29 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The resulting IRs are then symbolically executed to generate symbolic summaries for comparison using an SMT solver. First, we formally validate the translation of an instruction, using a thoroughly-tested semantics [86], as opposed to comparing the translation to other potentially incorrect translations. Second, the IRs they support are simpler than LLVM and so it is unclear whether the approach would be effective if LLVM had to be translated to the unified representation.…”

Section: Formal Methods Based Approachesmentioning

confidence: 99%

“…Interestingly, the MeanDiff paper [101] says that one motivation for relying on differential testing was that no formal specification of x86-64 ISA was available at the time. We do not have that limitation because we have developed a formal and thoroughly tested x86-64 ISA specification [86,117], and made it publicly available.…”

Section: Formal Methods Based Approachesmentioning

confidence: 99%

“…• The informal specifications provided by the hardware manufacturers run into thousands of pages [84,85] and have ambiguities, missing specifications, or even bugs [86]. This forces the developers of the binary lifter to consult with an actual processor implementation to clarify such details.…”

Section: Correctness Challenges For Binary Liftersmentioning

confidence: 99%

“…• Once such a lifter is developed, the developers then run into the problem of not having a way to test their implementation thoroughly as generally, there are no formal, machine-readable semantics available for automated testing. For example, despite several explicit attempts [87,88,89] and other related systems [90,49,91,92,93], there does not exist any complete formal semantics of x86-64 up until we define a fully executable formal semantics of x86-64 [86].…”

Section: Correctness Challenges For Binary Liftersmentioning

confidence: 99%

See 3 more Smart Citations

Scalable validation of binary lifters

Dasgupta

Dinesh

Venkatesh

et al. 2020

Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation

Self Cite

View full text Add to dashboard Cite

The ability to directly reason about binary machine code is desirable, not only because it allows analyzing binaries even when the source code is not available (e.g., legacy code, closed-source software, or malware), but also avoids the need to trust the correctness of compilers. Binary analysis is generally performed by existing decompiler projects by (1) converting raw bytes from the binary into a stream of assembly instructions through disassembly, (2) translating machine code to an intermediate representation (IR) using a binary lifter, and (3) performing various analysis and transformations on the IR pertaining to the specific goals of the decompiler. Many binary analysis frameworks published in academia or as open-source code, use such a lifter as the first step in their pipeline. Validating the correctness of binary lifters is pivotal to gain trust in binary analysis, especially when used in scenarios where correctness is essential. Unfortunately, existing approaches focus on validating the correctness of lifting a single instruction and do not scale to full programs. I believe an effort in the direction would enable both the developers of binary translators, to validate their implementation, and the clients of those translators, to gain trust in their analysis results. The overall goal of my work is to develop formal and informal techniques to achieve high confidence in the correctness of binary lifting by leveraging the semantics of the languages involved (e.g., Intel's x86-64 and LLVM IR). Towards that goal, I made two broad contributions. First, I defined the most complete and thoroughly tested formal semantics of x86-64 to date. The semantics faithfully formalizes all the non-deprecated, sequential user-level instructions of the x86-64 Haswell instruction set architecture. The formal specification covers 3155 instruction variants, corresponding to 774 mnemonics. The semantics is fully executable and has been tested against the GCC C-torture test suite. Moreover, each instruction is individually tested against more than 7,000 instruction-level test cases. This extensive testing paid off, revealing bugs in both the x86-64 reference manual and other existing semantics, which are all acknowledged, and some are fixed. Also, I illustrated potential applications of the semantics in different formal analyses, and discuss how it can be useful for processor verification. Second, I show that formal translation validation of single instructions for a complex ISA like x86-64 is not only practical but can be used as a building block for scalable full-program validation. My work is the first to do translation validation of single instructions on an Coming up to this point is one of the biggest challenges I have ever pursued in my life. This thesis would not have been possible if I did not have the support of the following people. I owe my deepest gratitude to my adviser, Professor Vikram Adve, whose guidance, patience, and encouragement have been pivotal in the successful completion of this thesis. He is one of the ...

show abstract

Section: Formal Methods Based Approachesmentioning

confidence: 99%

Section: Formal Methods Based Approachesmentioning

confidence: 99%

Section: Correctness Challenges For Binary Liftersmentioning

confidence: 99%

Section: Correctness Challenges For Binary Liftersmentioning

confidence: 99%

See 2 more Smart Citations

Scalable validation of binary lifters

Dasgupta

Dinesh

Venkatesh

et al. 2020

Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation

Self Cite

View full text Add to dashboard Cite

show abstract

“…Finally, we conclude the paper with future work in Sections 10-11. This paper marks an important step towards formalizing the logical foundation of the K semantic framework (http://kframework.org), which has been used to define complete formal semantics of several real-world languages [Bogdănaş and Roşu 2015;Dasgupta et al 2019;Hathhorn et al 2015;Hildenbrandt et al 2018;Park et al 2015]. Prior attempts have been made to propose a logical foundation of K using formalisms like rewriting logic [Meseguer and Roşu 2013;Roşu and Şerbănuţă 2010] and graph rewriting [Şerbănuţă and Roşu 2012], but none of them were satisfactory.…”

Section: Introductionmentioning

confidence: 99%

A general approach to define binders using matching logic

Chen

Roşu

2020

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

We propose a novel definition of binders using matching logic, where the binding behavior of object-level binders is directly inherited from the built-in ∃ binder of matching logic. We show that the behavior of binders in various logical systems such as-calculus, System F,-calculus, pure type systems, can be axiomatically defined in matching logic as notations and logical theories. We show the correctness of our definitions by proving conservative extension theorems, which state that a sequent/judgment is provable in the original system if and only if it is provable in matching logic, in the corresponding theory. Our matching logic definition of binders also yields models to all binders, which are deductively complete with respect to formal reasoning in the original systems. For-calculus, we further show that the yielded models are representationally complete, a desired property that is not enjoyed by many existing-calculus semantics. This work is part of a larger effort to develop a logical foundation for the programming language semantics framework K (http://kframework.org).

show abstract

Formal Semantics Extraction from Natural Language Specifications for ARM

Ogawa

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

A complete formal semantics of x86-64 user-level instruction set architecture

Cited by 37 publications

References 27 publications

Scalable validation of binary lifters

Scalable validation of binary lifters

A general approach to define binders using matching logic

Formal Semantics Extraction from Natural Language Specifications for ARM

Contact Info

Product

Resources

About