|
| 1 | +<!-- |
| 2 | +SPDX-License-Identifier: CC-BY-SA-4.0 |
| 3 | +SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> |
| 4 | +--> |
| 5 | + |
| 6 | +[](https://github.com/sponsors/hyperpolymath) |
| 7 | + |
| 8 | +# What Is This? |
| 9 | + |
| 10 | +ATSiser analyses C source code, identifies memory-critical patterns |
| 11 | +(malloc/free pairs, buffer accesses, pointer arithmetic, struct |
| 12 | +ownership), and generates **ATS2 wrappers** with linear type annotations |
| 13 | +that enforce memory safety at compile time — then compiles those |
| 14 | +wrappers back to C with zero runtime overhead. |
| 15 | + |
| 16 | +[ATS](https://www.cs.bu.edu/~hwxi/atslangweb/) (Applied Type System) by |
| 17 | +Hongwei Xi at Boston University provides linear types, dependent types, |
| 18 | +and theorem proving while compiling to C. ATSiser uses ATS2’s `viewtype` |
| 19 | +and `dataviewtype` constructs to express pointer ownership, array |
| 20 | +bounds, and proof obligations over existing C interfaces — **without |
| 21 | +rewriting the original C code**. |
| 22 | + |
| 23 | +# How It Works |
| 24 | + |
| 25 | +Describe your C interface in `atsiser.toml`. ATSiser: |
| 26 | + |
| 27 | +1. **Parses C headers** — identifies allocation sites, pointer |
| 28 | + ownership patterns, buffer accesses, and struct field layouts |
| 29 | + |
| 30 | +2. **Generates ATS2 wrappers** — creates `viewtype` annotations for |
| 31 | + pointer ownership, `arrayview` proofs for buffer bounds, and |
| 32 | + `dataviewtype` encodings for resource lifecycles |
| 33 | + |
| 34 | +3. **Emits proof obligations** — generates ATS2 proof terms (`praxi`, |
| 35 | + `prfun`) that the ATS2 compiler checks at compile time |
| 36 | + |
| 37 | +4. **Compiles to C** — ATS2 erases all proofs during compilation, |
| 38 | + producing C code with identical performance to the original |
| 39 | + |
| 40 | +5. **Bridges via Zig FFI** — integration layer for non-C consumers |
| 41 | + |
| 42 | +## Example Manifest |
| 43 | + |
| 44 | +```toml |
| 45 | +[workload] |
| 46 | +name = "my-legacy-lib" |
| 47 | +description = "Harden libfoo with linear type safety" |
| 48 | + |
| 49 | +[source] |
| 50 | +headers = ["include/foo.h", "include/bar.h"] |
| 51 | +sources = ["src/*.c"] |
| 52 | + |
| 53 | +[analysis] |
| 54 | +track-allocations = true # Follow malloc/free pairs |
| 55 | +track-buffers = true # Bound-check array accesses |
| 56 | +track-ownership = true # Prove pointer ownership transfer |
| 57 | + |
| 58 | +[output] |
| 59 | +ats2-wrappers = "generated/ats2/" |
| 60 | +c-headers = "generated/abi/" |
| 61 | +proofs = "generated/proofs/" |
| 62 | +``` |
| 63 | + |
| 64 | +# Key Value |
| 65 | + |
| 66 | +- **Memory safety for legacy C** — no rewrites, no new runtime, no |
| 67 | + garbage collector |
| 68 | + |
| 69 | +- **Zero runtime overhead** — ATS2 proofs are erased at compile time; |
| 70 | + generated C is identical in performance to handwritten C |
| 71 | + |
| 72 | +- **Gradual adoption** — wrap critical functions first, expand coverage |
| 73 | + over time |
| 74 | + |
| 75 | +- **Formal guarantees** — no leaks, no use-after-free, no double-free, |
| 76 | + no out-of-bounds access — all proven at compile time via linear types |
| 77 | + |
| 78 | +# Architecture |
| 79 | + |
| 80 | +Follows the hyperpolymath -iser pattern: |
| 81 | + |
| 82 | +- **Manifest** (`atsiser.toml`) — describe WHAT C code you want hardened |
| 83 | + |
| 84 | +- **C Source Analysis** (`src/core/`) — parse headers, identify |
| 85 | + allocation patterns, track pointer ownership through call graphs |
| 86 | + |
| 87 | +- **Idris2 ABI** (`src/interface/abi/`) — formal proofs that the |
| 88 | + generated wrappers correctly model memory safety properties (ownership |
| 89 | + transfer, buffer bounds, allocation/deallocation pairing) |
| 90 | + |
| 91 | +- **Zig FFI** (`src/interface/ffi/`) — C-ABI bridge for integration with |
| 92 | + non-C consumers |
| 93 | + |
| 94 | +- **ATS2 Codegen** (`src/codegen/`) — generates ATS2 source with |
| 95 | + `viewtype`, `dataviewtype`, `praxi`, and `prfun` annotations |
| 96 | + |
| 97 | +- **Rust CLI** (`src/main.rs`) — orchestrates analysis, generation, and |
| 98 | + compilation |
| 99 | + |
| 100 | +User writes zero ATS2 code. ATSiser generates everything from the |
| 101 | +manifest and C source analysis. |
| 102 | + |
| 103 | +## ATS2 Concepts Used |
| 104 | + |
| 105 | +- **viewtype** — linear types that track pointer ownership; consuming a |
| 106 | + `viewtype` value proves the pointer was freed exactly once |
| 107 | + |
| 108 | +- **dataviewtype** — algebraic data types with linear semantics for |
| 109 | + modelling resource states (allocated, borrowed, freed) |
| 110 | + |
| 111 | +- **arrayview** — dependent-type proofs that array accesses are within |
| 112 | + bounds |
| 113 | + |
| 114 | +- **praxi / prfun** — proof-level functions that establish safety |
| 115 | + invariants without generating any runtime code |
| 116 | + |
| 117 | +# CLI Commands |
| 118 | + |
| 119 | +```bash |
| 120 | +# Initialise a new manifest |
| 121 | +atsiser init |
| 122 | + |
| 123 | +# Validate manifest and C sources |
| 124 | +atsiser validate -m atsiser.toml |
| 125 | + |
| 126 | +# Analyse C code and generate ATS2 wrappers |
| 127 | +atsiser generate -m atsiser.toml -o generated/atsiser |
| 128 | + |
| 129 | +# Build generated artifacts (ATS2 → C compilation) |
| 130 | +atsiser build -m atsiser.toml |
| 131 | + |
| 132 | +# Show analysis summary |
| 133 | +atsiser info -m atsiser.toml |
| 134 | +``` |
| 135 | + |
| 136 | +# Use Cases |
| 137 | + |
| 138 | +- **Legacy C library hardening** — wrap libc, OpenSSL, or custom C |
| 139 | + libraries with compile-time memory safety proofs |
| 140 | + |
| 141 | +- **Embedded systems safety** — add formal guarantees to |
| 142 | + resource-constrained C code without any runtime cost |
| 143 | + |
| 144 | +- **Gradual migration from C to safe C** — incrementally wrap functions, |
| 145 | + building a safety envelope around existing codebases |
| 146 | + |
| 147 | +- **Compliance** — generate machine-checkable proofs of memory safety |
| 148 | + for safety-critical or regulated codebases |
| 149 | + |
| 150 | +Part of the [-iser family](https://github.com/hyperpolymath/iseriser) of |
| 151 | +acceleration frameworks. |
| 152 | + |
| 153 | +# Status |
| 154 | + |
| 155 | +**Codebase in progress.** Architecture defined, CLI scaffolded, codegen |
| 156 | +and C source analysis pending implementation. |
| 157 | + |
| 158 | +# License |
| 159 | + |
| 160 | +SPDX-License-Identifier: CC-BY-SA-4.0 |
0 commit comments