Search papers, labs, and topics across Lattice.
This paper introduces a build-authorized path-effect interface that establishes a fail-closed authorization boundary for compiler rewrites, ensuring that rewrite authority is strictly confined to accepted facts and specific runtime contexts. By leveraging a conservative LLVM consumer and a source-summary gate, the authors demonstrate how to enforce this boundary while maintaining the integrity of opaque calls and reducing load operations. The results show that the proposed method effectively retains authorized IR across various boundaries while rejecting cases that do not meet the closure criteria, thus enhancing the security and reliability of compiler optimizations.
A novel compiler boundary design ensures that only authorized rewrites are executed, significantly enhancing security in opaque call handling.
Detached semantic facts about opaque native providers do not by themselves justify compiler rewrites: rewrite authority must be confined to the accepted fact, selected provider and build, caller, callback environment, observation, and runtime target. We present a build-authorized path-effect interface that enforces this boundary through fail-closed authorization and link receipts. The design separates receipt closure, callback-environment closure, and projection identity, and passes accepted facts to LLVM through a narrow internal API. We use one-hop topology-load reuse as a minimal observable witness of authority, not as the optimization target. A conservative LLVM consumer reuses a pointer observation only from a noalias root or one constant nonzero projection. Rocq models prove conditional refinement and authority non-amplification under explicit effect, alias, compiler/ABI, and target-resolution premises. We instantiate checked production with Toka: a source-summary gate emits exact LLVM IR, a separate IR checker accepts only a bounded topology-preserving subset, and only accepted IR is compiled into the receipt-bound provider object. A bounded static Darwin/arm64 profile also checks the final direct branch target. Across issuer-declared readv, recvmsg, and Cairo boundaries, authorized IR retains each opaque call, reduces the relevant loads from two to one, and preserves observed results; mismatched providers, builds, callbacks, projections, and unsupported IR remain neutral. A libjpeg case is rejected because its callback environment is open, while a bound callback singleton demonstrates the supported closure rule. The contribution is a checked deployment-compiler boundary with an explicit trust and applicability frontier, not a uniquely expressive effect encoding or a new load-elimination algorithm.
