|
| 1 | +[](https://github.com/sponsors/hyperpolymath) |
| 2 | + |
| 3 | +// SPDX-License-Identifier: MPL-2.0 |
| 4 | +// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> |
| 5 | += Atsiser |
| 6 | +Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> |
| 7 | +:toc: left |
| 8 | +:icons: font |
| 9 | + |
| 10 | +== What Is This? |
| 11 | + |
| 12 | +ATSiser analyses C source code, identifies memory-critical patterns (malloc/free |
| 13 | +pairs, buffer accesses, pointer arithmetic, struct ownership), and generates |
| 14 | +**ATS2 wrappers** with linear type annotations that enforce memory safety at |
| 15 | +compile time — then compiles those wrappers back to C with zero runtime overhead. |
| 16 | + |
| 17 | +https://www.cs.bu.edu/~hwxi/atslangweb/[ATS] (Applied Type System) by Hongwei Xi |
| 18 | +at Boston University provides linear types, dependent types, and theorem proving |
| 19 | +while compiling to C. ATSiser uses ATS2's `viewtype` and `dataviewtype` constructs |
| 20 | +to express pointer ownership, array bounds, and proof obligations over existing C |
| 21 | +interfaces — *without rewriting the original C code*. |
| 22 | + |
| 23 | +== How It Works |
| 24 | + |
| 25 | +Describe your C interface in `atsiser.toml`. ATSiser: |
| 26 | + |
| 27 | +1. **Parses C headers** — identifies allocation sites, pointer ownership patterns, |
| 28 | + buffer accesses, and struct field layouts |
| 29 | +2. **Generates ATS2 wrappers** — creates `viewtype` annotations for pointer |
| 30 | + ownership, `arrayview` proofs for buffer bounds, and `dataviewtype` encodings |
| 31 | + for resource lifecycles |
| 32 | +3. **Emits proof obligations** — generates ATS2 proof terms (`praxi`, `prfun`) |
| 33 | + that the ATS2 compiler checks at compile time |
| 34 | +4. **Compiles to C** — ATS2 erases all proofs during compilation, producing C |
| 35 | + code with identical performance to the original |
| 36 | +5. **Bridges via Zig FFI** — integration layer for non-C consumers |
| 37 | + |
| 38 | +=== Example Manifest |
| 39 | + |
| 40 | +[source,toml] |
| 41 | +---- |
| 42 | +[workload] |
| 43 | +name = "my-legacy-lib" |
| 44 | +description = "Harden libfoo with linear type safety" |
| 45 | + |
| 46 | +[source] |
| 47 | +headers = ["include/foo.h", "include/bar.h"] |
| 48 | +sources = ["src/*.c"] |
| 49 | + |
| 50 | +[analysis] |
| 51 | +track-allocations = true # Follow malloc/free pairs |
| 52 | +track-buffers = true # Bound-check array accesses |
| 53 | +track-ownership = true # Prove pointer ownership transfer |
| 54 | + |
| 55 | +[output] |
| 56 | +ats2-wrappers = "generated/ats2/" |
| 57 | +c-headers = "generated/abi/" |
| 58 | +proofs = "generated/proofs/" |
| 59 | +---- |
| 60 | + |
| 61 | +== Key Value |
| 62 | + |
| 63 | +* **Memory safety for legacy C** — no rewrites, no new runtime, no garbage collector |
| 64 | +* **Zero runtime overhead** — ATS2 proofs are erased at compile time; generated C |
| 65 | + is identical in performance to handwritten C |
| 66 | +* **Gradual adoption** — wrap critical functions first, expand coverage over time |
| 67 | +* **Formal guarantees** — no leaks, no use-after-free, no double-free, no |
| 68 | + out-of-bounds access — all proven at compile time via linear types |
| 69 | + |
| 70 | +== Architecture |
| 71 | + |
| 72 | +Follows the hyperpolymath -iser pattern: |
| 73 | + |
| 74 | +* **Manifest** (`atsiser.toml`) — describe WHAT C code you want hardened |
| 75 | +* **C Source Analysis** (`src/core/`) — parse headers, identify allocation patterns, |
| 76 | + track pointer ownership through call graphs |
| 77 | +* **Idris2 ABI** (`src/interface/abi/`) — formal proofs that the generated wrappers |
| 78 | + correctly model memory safety properties (ownership transfer, buffer bounds, |
| 79 | + allocation/deallocation pairing) |
| 80 | +* **Zig FFI** (`src/interface/ffi/`) — C-ABI bridge for integration with non-C consumers |
| 81 | +* **ATS2 Codegen** (`src/codegen/`) — generates ATS2 source with `viewtype`, |
| 82 | + `dataviewtype`, `praxi`, and `prfun` annotations |
| 83 | +* **Rust CLI** (`src/main.rs`) — orchestrates analysis, generation, and compilation |
| 84 | + |
| 85 | +User writes zero ATS2 code. ATSiser generates everything from the manifest and |
| 86 | +C source analysis. |
| 87 | + |
| 88 | +=== ATS2 Concepts Used |
| 89 | + |
| 90 | +* **viewtype** — linear types that track pointer ownership; consuming a `viewtype` |
| 91 | + value proves the pointer was freed exactly once |
| 92 | +* **dataviewtype** — algebraic data types with linear semantics for modelling |
| 93 | + resource states (allocated, borrowed, freed) |
| 94 | +* **arrayview** — dependent-type proofs that array accesses are within bounds |
| 95 | +* **praxi / prfun** — proof-level functions that establish safety invariants |
| 96 | + without generating any runtime code |
| 97 | + |
| 98 | +== CLI Commands |
| 99 | + |
| 100 | +[source,bash] |
| 101 | +---- |
| 102 | +# Initialise a new manifest |
| 103 | +atsiser init |
| 104 | + |
| 105 | +# Validate manifest and C sources |
| 106 | +atsiser validate -m atsiser.toml |
| 107 | + |
| 108 | +# Analyse C code and generate ATS2 wrappers |
| 109 | +atsiser generate -m atsiser.toml -o generated/atsiser |
| 110 | + |
| 111 | +# Build generated artifacts (ATS2 → C compilation) |
| 112 | +atsiser build -m atsiser.toml |
| 113 | + |
| 114 | +# Show analysis summary |
| 115 | +atsiser info -m atsiser.toml |
| 116 | +---- |
| 117 | + |
| 118 | +== Use Cases |
| 119 | + |
| 120 | +* **Legacy C library hardening** — wrap libc, OpenSSL, or custom C libraries with |
| 121 | + compile-time memory safety proofs |
| 122 | +* **Embedded systems safety** — add formal guarantees to resource-constrained C |
| 123 | + code without any runtime cost |
| 124 | +* **Gradual migration from C to safe C** — incrementally wrap functions, building |
| 125 | + a safety envelope around existing codebases |
| 126 | +* **Compliance** — generate machine-checkable proofs of memory safety for |
| 127 | + safety-critical or regulated codebases |
| 128 | + |
| 129 | +Part of the https://github.com/hyperpolymath/iseriser[-iser family] of |
| 130 | +acceleration frameworks. |
| 131 | + |
| 132 | +== Status |
| 133 | + |
| 134 | +**Codebase in progress.** Architecture defined, CLI scaffolded, codegen and |
| 135 | +C source analysis pending implementation. |
| 136 | + |
| 137 | +== License |
| 138 | + |
| 139 | +SPDX-License-Identifier: MPL-2.0 |
0 commit comments