1. 8/14/03ALADDIN REU Symposium 20031 Implementing TALT William Lovas with Karl Crary

2. 8/14/03ALADDIN REU Symposium 20032 Grid Computing Low-cost supercomputing using idle cycles of Internet-connected PCs Cray X1 supercomputer: $8.4 million Pentium 4, 2.2 GHz: $699 (with rebate!) Getting everyone else’s PCs to do your work for you: priceless

3. 8/14/03ALADDIN REU Symposium 20033 Grid Computing Developer PCs on The Internet

4. 8/14/03ALADDIN REU Symposium 20034 Grid Computing SETI@Home project at Berkeley  scanning radio signals for signs of intelligence Folding@Home project at Stanford  studying diseases related to protein folding distributed.net  cracking encryption algorithms since 1997

5. 8/14/03ALADDIN REU Symposium 20035 Grid Computing Very powerful: distributed.net, 22 hours to brute force 1 DES key out of 2 56 (= over 72 quadrillion!) distributed.net equivalent to 160,000 Pentium II 266 MHz PCs

6. 8/14/03ALADDIN REU Symposium 20036 Grid Computing Few examples, because grid computing depends on users’ trust in the code they run ConCert Project: to develop a framework for trustless grid computing

7. 8/14/03ALADDIN REU Symposium 20037 Roadmap Motivation: check! Methodology of TALT: the “how” and “why” A taste of TALT: to whet your appetite My work on TALT: what I accomplished, what I learned

8. 8/14/03ALADDIN REU Symposium 20038 Establishing Safety How can we verify that code is safe? High-level languages use type systems… Why can’t low-level languages, too?

9. 8/14/03ALADDIN REU Symposium 20039 Typed Assembly Language Formalizes a subset of x86 instruction set Adds a type system that demonstrates safety Idea: employ powerful tools from type theory to tame the assembly language beast!  subtyping, polymorphism

10. 8/14/03ALADDIN REU Symposium 200310 TALT -- TAL Two Refines and extends the ideas from TAL Establishes a framework for future type systems  One type system won’t meet everyone’s needs “Two type systems good => Four type systems better!” -- Benjamin C. Pierce

11. 8/14/03ALADDIN REU Symposium 200311 How TALT works Trusted  Twelf proof checker … and meta- theorem prover  Safety policy ( SP ) safe machine states, safe transitions  Runtime Untrusted  Code  Type system ( TS )  Safety proof ( TS(p) => SP(p)) Machine-checkable, via Twelf

12. 8/14/03ALADDIN REU Symposium 200312 How TALT works code type system safety proof safety policy Twelftype system code runtime

13. 8/14/03ALADDIN REU Symposium 200313 A taste of TALT Many interesting ideas, let’s talk about 3:  Register file subtyping  Universal polymorphism  Sized kinds white lies ahead!

14. 8/14/03ALADDIN REU Symposium 200314 A taste of TALT Register file subtyping

15. 8/14/03ALADDIN REU Symposium 200315 A taste of TALT Register file type looks like  { r0: t0, r1: t1, … rn: tn } Suppose a code-block expects:  { eax: int, ebx: int } Okay if register file actually has type:  { eax: int, ebx: int, ecx: int } Because of register file subtyping!

16. 8/14/03ALADDIN REU Symposium 200316 A taste of TALT Universal polymorphism

17. 8/14/03ALADDIN REU Symposium 200317 A taste of TALT Suppose a function f leaves the stack unchanged  Stack pointer stored in register esp How does a calling function know? f has a type polymorphic in esp ! Just like SML: - fun id x = x; val id = fn : 'a -> 'a

18. 8/14/03ALADDIN REU Symposium 200318 A taste of TALT Sized kinds

19. 8/14/03ALADDIN REU Symposium 200319 A taste of TALT Kinds: the “types of types” In TALT, the kind of a type specifies the size of that type’s values  A 4-byte word has type B4, which has kind T4  Pair of words has type B4*B4, which has kind T8 Typing rules know the sizes of operands Essential for complex addressing modes

20. 8/14/03ALADDIN REU Symposium 200320 My work on TALT Implementation of infrastructure  Runtime  Certificate generator  “Assembler” Creation of new code as well as simplification/extension of existing code

21. 8/14/03ALADDIN REU Symposium 200321 Runtime implementation Runtime provides primitive operations, like malloc, exit, return Works directly with machine code, so written in C, with some x86 assembly Great care taken to adhere to specification: runtime is trusted!

22. 8/14/03ALADDIN REU Symposium 200322 Certificate Generation TALT binary looks like this: code magic number machine code certificate

23. 8/14/03ALADDIN REU Symposium 200323 Certificate Generation Certificate generator generates: code magic number machine code certificate

24. 8/14/03ALADDIN REU Symposium 200324 Certificate Generation When I arrived…  Certificate was a typing derivation in the TALT type system  Partially implemented and buggy derivation generator  Discovery: typing derivation too big to use as a practical certificate

25. 8/14/03ALADDIN REU Symposium 200325 Certificate Generation And now…  Certificate is an XTALT program, in a notation that Twelf understands  Certificate generator is 97% complete (and hopefully not buggy!)  Code is much simpler  Type system is a little simpler, too

26. 8/14/03ALADDIN REU Symposium 200326 “Assembler” Next step: translate XTALT programs into straight x86 assembly Assembly can be run through a standard assembler to produce machine code

27. 8/14/03ALADDIN REU Symposium 200327 “Assembler” Now we also have: code magic number machine code certificate

28. 8/14/03ALADDIN REU Symposium 200328 “Assembler” Then, only have to put the pieces together to produce TALT binaries!

29. 8/14/03ALADDIN REU Symposium 200329 Summary Implemented TALT runtime in C, assembly Implemented certificate generator in SML  Simplified typing rules  Simplified code Hope to implement “assembler” by next week Very close to a working system!

30. 8/14/03ALADDIN REU Symposium 200330 Summary Didn’t “discover” anything new, but … Learned a lot about type theory, and … Hacked on some interesting code! Questions?