Beneath the surface, software usually depends on complex linker behaviour to work as intended. Even linking hello_world.c is surprisingly involved, and systems software such as libc and operating system kernels rely on a host of linker features. But linking is poorly understood by working programmers and has largely been neglected by language researchers.
In this paper we survey the many use-cases that linkers support and the poorly specified linker-speak by which they are controlled: metadata in object files, command-line options, and linker-script language. We provide the first validated formalisation of a realistic executable and linkable format (ELF), and capture aspects of the Application Binary Interfaces for four mainstream platforms (AArch64, AMD64, Power64, and IA32). Using these, we develop an executable specification of static linking, covering (among other things) enough to link small C programs (we use the example of bzip2) into a correctly running executable. We provide our specification in Lem and Isabelle/HOL forms. This is the first formal specification of mainstream linking. We have used the Isabelle/HOL version to prove a sample correctness property for one case of AMD64 ABI relocation, demonstrating that the specification supports formal proof, and as a first step towards the much more ambitious goal of verified linking.
Our work should enable several novel strands of research, including linker-aware verified compilation and program analysis, and better languages for controlling linking.
Conference DayThu 3 NovDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
13:30 - 15:10
|Semantic Subtyping for Imperative Object-Oriented Languages|
|Parsing with First-Class Derivatives|
Jonathan Immanuel BrachthäuserUniversity of Tübingen, Germany, Tillmann RendelUniversity of Tübingen, Germany, Klaus OstermannUniversity of Tübingen, GermanyDOI
|The Missing Link: Explaining ELF Static Linking, Semantically|
Stephen KellUniversity of Cambridge, Dominic P. MulliganUniversity of Cambridge, Peter SewellUniversity of CambridgeDOI
|Type Soundness for Dependent Object Types (DOT)|