Automating Formal Proofs for Reactive Systems Daniel Ricketts , - - PowerPoint PPT Presentation

▶
automating formal proofs for reactive systems
SMART_READER_LITE
LIVE PREVIEW

Automating Formal Proofs for Reactive Systems Daniel Ricketts , - - PowerPoint PPT Presentation

Feb 15, 2024 279 likes •1.93k views

Automating Formal Proofs for Reactive Systems Daniel Ricketts , Valentin Robert, Zachary Danger Tatlock Dongseok Jang, Sorin Lerner University of California, San Diego University of Washington Proof Assistant Based Verification Proof

slide-1
SLIDE 1

Automating Formal Proofs for Reactive Systems

Daniel Ricketts, Valentin Robert, Dongseok Jang, Sorin Lerner

University of California, San Diego University of Washington Zachary “Danger” Tatlock

slide-2
SLIDE 2

Proof Assistant Based Verification

slide-3
SLIDE 3

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-4
SLIDE 4

Compiler Bugs Found

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-5
SLIDE 5

Compiler Bugs Found GCC 122

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-6
SLIDE 6

Compiler Bugs Found GCC 122 Clang/LLVM 181

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-7
SLIDE 7

Compiler Bugs Found GCC 122 Clang/LLVM 181 CompCert ?

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-8
SLIDE 8

Compiler Bugs Found GCC 122 Clang/LLVM 181 CompCert

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

slide-9
SLIDE 9

Compiler Bugs Found GCC 122 Clang/LLVM 181 CompCert

Proof Assistant Based Verification

[Yang et al. PLDI 11]

Testing tool for C compilers

[Le et al. PLDI 14]

slide-10
SLIDE 10

Proof Assistant Based Verification

slide-11
SLIDE 11

Proof Assistant

Proof Assistant Based Verification

slide-12
SLIDE 12

Proof Assistant

Coq Theorem Prover

Proof Assistant Based Verification

slide-13
SLIDE 13

Code

Proof Assistant

Proof Assistant Based Verification

slide-14
SLIDE 14

Code

Proof Assistant

in language supporting reasoning

Proof Assistant Based Verification

slide-15
SLIDE 15

Code Spec

Proof Assistant

Proof Assistant Based Verification

slide-16
SLIDE 16

Code Spec

Proof Assistant

logical properties characterizing correctness

Proof Assistant Based Verification

slide-17
SLIDE 17

Code Spec

Proof Assistant Grads

Proof Assistant Based Verification

slide-18
SLIDE 18

Code Spec

Proof Assistant Grads

interactively show code satisfies specification

Proof Assistant Based Verification

slide-19
SLIDE 19

Code Spec

Proof Assistant Grads

ML x86

Proof Assistant Based Verification

slide-20
SLIDE 20

Code Spec

Proof Assistant Grads

ML x86 compile down to machine code

Proof Assistant Based Verification

slide-21
SLIDE 21

Code Spec

Proof Assistant

Extremely strong guarantees about actual system!

Grads

ML x86

Proof Assistant Based Verification

slide-22
SLIDE 22

Verified Compiler: CompCert

Proof Assistant Based Verification

[Leroy POPL 06]

slide-23
SLIDE 23

Verified Compiler: CompCert Verified OS micro-kernel: seL4

Proof Assistant Based Verification

[Leroy POPL 06] [Klein et al. SOSP 09]

slide-24
SLIDE 24

Verified Compiler: CompCert Verified OS micro-kernel: seL4 Verified Web browser: Quark

Proof Assistant Based Verification

[Leroy POPL 06] [Klein et al. SOSP 09] [Jang et al. Security 12]

slide-25
SLIDE 25

Manual Proof Burden

Code Spec Proof

slide-26
SLIDE 26

Manual Proof Burden

Code Spec Proof

Verified OS micro-kernel: seL4

slide-27
SLIDE 27

Manual Proof Burden

Code Spec Proof

Verified OS micro-kernel: seL4

9,000 lines of C code

slide-28
SLIDE 28

Manual Proof Burden

Code Spec Proof

Verified OS micro-kernel: seL4

9,000 lines of C code 20 person-years for verification

slide-29
SLIDE 29

Manual Proof Burden

Code Spec Proof

slide-30
SLIDE 30

Manual Proof Burden

Requires expertise in proof assistants Code Spec Proof

slide-31
SLIDE 31

Manual Proof Burden

Requires expertise in proof assistants Extremely brittle, maintenance burden Code Spec Proof

slide-32
SLIDE 32

Manual Proof Burden

Code Spec Proof

slide-33
SLIDE 33

Code Spec

Ideal

(no manual proofs)

Manual Proof Burden

slide-34
SLIDE 34

Single application domain

slide-35
SLIDE 35

Single application domain

Code1 Spec1 Proof1

slide-36
SLIDE 36

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2

slide-37
SLIDE 37

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

slide-38
SLIDE 38

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties

slide-39
SLIDE 39

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties Similar architecture

slide-40
SLIDE 40

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties Similar architecture Similar reasoning

slide-41
SLIDE 41

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties

DSL for Specs

slide-42
SLIDE 42

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties

DSL for Specs

Similar architecture Similar reasoning

slide-43
SLIDE 43

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties Similar architecture

DSL for Specs DSL for Code

slide-44
SLIDE 44

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties Similar architecture

DSL for Specs DSL for Code

Similar reasoning

slide-45
SLIDE 45

Single application domain

Code1 Spec1 Proof1 Code2 Spec2 Proof2 Code3 Spec3 Proof3

Similar properties Similar architecture Similar reasoning

DSL for Specs DSL for Code Proof Automation

slide-46
SLIDE 46

DSL for Specs DSL for Code Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3

Single application domain

slide-47
SLIDE 47

DSL for Specs DSL for Code Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3

Single application domain

slide-48
SLIDE 48

DSL for Specs DSL for Code Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3

Single application domain

slide-49
SLIDE 49

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code

slide-50
SLIDE 50

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code

slide-51
SLIDE 51

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code REFLEX

slide-52
SLIDE 52

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code REFLEX

No manual proofs,

slide-53
SLIDE 53

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code REFLEX

No manual proofs, yet proof assistant guarantee.

slide-54
SLIDE 54

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code REFLEX

No manual proofs, yet proof assistant guarantee. Automation incomplete,

slide-55
SLIDE 55

Reactive systems

Proof Automation Code1 Spec1 Code2 Spec2 Code3 Spec3 Proof1 Proof2 Proof3 DSL for Specs DSL for Code REFLEX

No manual proofs, yet proof assistant guarantee. Automation incomplete, but verified browser, ssh, web server.

slide-56
SLIDE 56

Reactive systems

Reactive system

slide-57
SLIDE 57

Reactive systems

Reactive system

Continuously read messages from components and send messages to components

slide-58
SLIDE 58

Reactive systems

Reactive system

slide-59
SLIDE 59

Kernel

Example: Web browser kernel

slide-60
SLIDE 60

Example: Web browser kernel

Kernel Tab3

facebook

Tab2

gmail

Tab1

google

slide-61
SLIDE 61

Example: Web browser kernel

Kernel Tab3

facebook

Tab2

gmail

Tab1

google

Cookie Manager

google

Cookie Manager

facebook

slide-62
SLIDE 62

Example: Web browser kernel

Kernel Tab3

facebook

Tab2

gmail

Tab1

google

Cookie Manager

google

Cookie Manager

facebook

👥

slide-63
SLIDE 63

Example: Web browser kernel

Kernel Tab3

facebook

Tab2

gmail

Tab1

google

Cookie Manager

google

Cookie Manager

facebook

👥

(1) Tabs request resources (e.g. cookies)

slide-64
SLIDE 64

Example: Web browser kernel

Kernel Tab3

facebook

Tab2

gmail

Tab1

google

Cookie Manager

google

Cookie Manager

facebook

👥

(2) Kernel grants access subject to access controls (e.g. domain checks) (1) Tabs request resources (e.g. cookies)

slide-65
SLIDE 65

Example: Web browser kernel

slide-66
SLIDE 66

Example: Web browser kernel

Components = Tab | CookieMgr | ...

Types of components

slide-67
SLIDE 67

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ...

Types of messages

slide-68
SLIDE 68

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers:

How the kernel responds to messages from components

slide-69
SLIDE 69

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c):

When tab t sends the kernel a CookieSet message with payload c

slide-70
SLIDE 70

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain)

Get existing cookie manager with domain of t or spawn a new one

slide-71
SLIDE 71

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Send the cookie c to the found cookie manager

slide-72
SLIDE 72

Example: Web browser kernel

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

More handlers

slide-73
SLIDE 73

Properties

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

slide-74
SLIDE 74

Properties

Specify allowed behaviors

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

slide-75
SLIDE 75

Properties

Specify allowed behaviors wrt sequence of system calls

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

slide-76
SLIDE 76

Properties

Specify allowed behaviors wrt sequence of system calls

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ... When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

slide-77
SLIDE 77

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

slide-78
SLIDE 78

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

Time

slide-79
SLIDE 79

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

…

Time

slide-80
SLIDE 80

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

…

Time

slide-81
SLIDE 81

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

[Tab t] sends CookieSet(c)

…

Time

slide-82
SLIDE 82

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Time

…

slide-83
SLIDE 83

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c))

Time

…

slide-84
SLIDE 84

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c)) cp <- find CookieMgr(t.domain)

Time

…

slide-85
SLIDE 85

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c))

Time

…

slide-86
SLIDE 86

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c)) Spawn CookieMgr(t.domain)

Time

…

slide-87
SLIDE 87

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c)) Spawn CookieMgr(t.domain) send(cp, CookieSet(c))

Time

…

slide-88
SLIDE 88

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c)) Spawn CookieMgr(t.domain)

Time

…

slide-89
SLIDE 89

Properties

When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Specify allowed behaviors wrt sequence of system calls

The system calls so far

Recv(Tab, CookieSet(c)) Spawn CookieMgr(t.domain) Send(cp, CookieSet(c))

Time

…

slide-90
SLIDE 90

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ... When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c))

Example: Web browser kernel

slide-91
SLIDE 91

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

slide-92
SLIDE 92

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

Specify cookie integrity

slide-93
SLIDE 93

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

slide-94
SLIDE 94

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c,

For any domain d and cookie c

slide-95
SLIDE 95

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Send(CookieMgr(d), CookieSet(c))]

The kernel sends the cookie manager for domain d a cookie c

slide-96
SLIDE 96

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, Enables [Send(CookieMgr(d), CookieSet(c))]

Only if

slide-97
SLIDE 97

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

The kernel already received a cookie c from a tab of domain d

slide-98
SLIDE 98

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))] A Enables B

iff every sys call B is preceded by sys call A

slide-99
SLIDE 99

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

slide-100
SLIDE 100

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

slide-101
SLIDE 101

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

REFLEX Benefits:

slide-102
SLIDE 102

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

REFLEX Benefits: Proofs fully automated

slide-103
SLIDE 103

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

REFLEX Benefits: Proofs fully automated No lemmas

slide-104
SLIDE 104

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

REFLEX Benefits: Proofs fully automated No lemmas No invariants

slide-105
SLIDE 105

Components = Tab | CookieMgr | ... Messages = CookieSet | CookieGet | ... Handlers: When [Tab t] sends CookieSet(c): cp <- find CookieMgr(t.domain) send(cp, CookieSet(c)) When [Tab t] sends CookieGet(c): ...

Example: Web browser kernel

forall d c, [Recv(Tab(d), CookieSet(c))] Enables [Send(CookieMgr(d), CookieSet(c))]

REFLEX Benefits: Proofs fully automated No lemmas No invariants No manual proofs

slide-106
SLIDE 106

Proof Automation

slide-107
SLIDE 107

Proof Automation

Prove kernel code satisfies properties

slide-108
SLIDE 108

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

slide-109
SLIDE 109

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

slide-110
SLIDE 110

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

{

Handler

slide-111
SLIDE 111

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

{

Handler

{

Handler

slide-112
SLIDE 112

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

{

Handler

{

Handler

{

Handler

slide-113
SLIDE 113

Proof Automation

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

{

Handler

{

Handler

{

Handler Handlers create structure for induction

slide-114
SLIDE 114

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

Proof Automation

slide-115
SLIDE 115

✔

Induction hypothesis: property holds up to this point

Prove kernel code satisfies properties

by induction on sys call sequences kernel can produce

Proof Automation

slide-116
SLIDE 116

✔

{

Run a single handler

Prove kernel code satisfies properties

Induction hypothesis: property holds up to this point

by induction on sys call sequences kernel can produce

Proof Automation

slide-117
SLIDE 117

✔

{

Proof obligation: does property still hold?

?

Prove kernel code satisfies properties

Induction hypothesis: property holds up to this point

by induction on sys call sequences kernel can produce

Proof Automation

slide-118
SLIDE 118

✔

{?

Prove kernel code satisfies properties

Induction hypothesis: property holds up to this point Proof obligation: does property still hold?

by induction on sys call sequences kernel can produce

Proof Automation

Case analysis on handler

slide-119
SLIDE 119

✔

{?

Prove kernel code satisfies properties

Induction hypothesis: property holds up to this point Proof obligation: does property still hold?

by induction on sys call sequences kernel can produce

Proof Automation

Case analysis on handler Symbolically run all paths

slide-120
SLIDE 120

✔

{?

Case analysis on handler Symbolically run all paths Prove automatically

Prove kernel code satisfies properties

Induction hypothesis: property holds up to this point Proof obligation: does property still hold?

by induction on sys call sequences kernel can produce

Proof Automation

slide-121
SLIDE 121

Proof Automation

slide-122
SLIDE 122

Single domain insights:

Proof Automation

slide-123
SLIDE 123

Single domain insights:

Small number of carefully designed property primitives

Proof Automation

slide-124
SLIDE 124

Single domain insights:

Small number of carefully designed property primitives Loop free handlers allowed symbolic eval of all paths

Proof Automation

slide-125
SLIDE 125

Single domain insights:

Small number of carefully designed property primitives Loop free handlers allowed symbolic eval of all paths Domain-specific heuristics for non-local reasoning

Proof Automation

slide-126
SLIDE 126

Evaluation

slide-127
SLIDE 127

Evaluation

Web browser SSH server Web server

slide-128
SLIDE 128

Evaluation

Web browser SSH server Web server

Auto verified 33 properties (80% in < 2 minutes)

slide-129
SLIDE 129

Evaluation

Web browser SSH server Web server Domains do not interfere, Cookie integrity, … No PTY access before authentication, At most 3 authentication attempts, … Clients only spawned after successful login, File requests guarded by access control, …

Auto verified 33 properties (80% in < 2 minutes)

slide-130
SLIDE 130

Evaluation

Web browser SSH server Web server Domains do not interfere, Cookie integrity, … No PTY access before authentication, At most 3 authentication attempts, … Clients only spawned after successful login, File requests guarded by access control, …

Auto verified 33 properties (80% in < 2 minutes) Able to automate proofs of non- interference

slide-131
SLIDE 131

Evaluation

Web browser SSH server Web server Domains do not interfere, Cookie integrity, … No PTY access before authentication, At most 3 authentication attempts, … Clients only spawned after successful login, File requests guarded by access control, …

Auto verified 33 properties (80% in < 2 minutes)

slide-132
SLIDE 132

Evaluation

Web browser SSH server Web server Domains do not interfere, Cookie integrity, … No PTY access before authentication, At most 3 authentication attempts, … Clients only spawned after successful login, File requests guarded by access control, …

Auto verified 33 properties (80% in < 2 minutes) Able to automate proofs of non-local properties

slide-133
SLIDE 133

Development Effort: Framework

slide-134
SLIDE 134

Development Effort: Framework

Reflex :

7500 lines of Coq

slide-135
SLIDE 135

Development Effort: Framework

Reflex :

7500 lines of Coq

Web browser SSH server Web server

slide-136
SLIDE 136

Development Effort: Framework

Reflex :

7500 lines of Coq

Quark Web browser :

5500 lines of Coq

Web browser SSH server Web server

slide-137
SLIDE 137

Development Effort: Framework

Reflex :

7500 lines of Coq

Quark Web browser :

5500 lines of Coq

Single reactive system

Web browser SSH server Web server

slide-138
SLIDE 138

Development Effort: Framework

Reflex :

7500 lines of Coq

Quark Web browser :

5500 lines of Coq

Single reactive system Many reactive systems

Web browser SSH server Web server

slide-139
SLIDE 139

Development Effort: Systems

slide-140
SLIDE 140

Development Effort: Systems

Benchmark Language Lines of Code/Spec Browser REFLEX 81 37 C++, Python 970,240

  • SSH server

REFLEX 64 22 C, Python 89,567

  • Web server

REFLEX 56 29 Python 386

slide-141
SLIDE 141

Development Effort: Systems

Benchmark Language Lines of Code/Spec Browser REFLEX 81 37 C++, Python 970,240

  • SSH server

REFLEX 64 22 C, Python 89,567

  • Web server

REFLEX 56 29 Python 386

  • Webkit
slide-142
SLIDE 142

Development Effort: Systems

Benchmark Language Lines of Code/Spec Browser REFLEX 81 37 C++, Python 970,240

  • SSH server

REFLEX 64 22 C, Python 89,567

  • Web server

REFLEX 56 29 Python 386

  • Webkit

OpenSSH

slide-143
SLIDE 143

Limitations

slide-144
SLIDE 144

Limitations

Expressiveness: Incompleteness:

slide-145
SLIDE 145

Limitations

Expressiveness:

Strict subset of temporal logic + non-interference

Incompleteness:

slide-146
SLIDE 146

Limitations

Expressiveness:

Strict subset of temporal logic + non-interference Loop free handlers

Incompleteness:

slide-147
SLIDE 147

Limitations

Expressiveness:

Strict subset of temporal logic + non-interference Loop free handlers No user-defined unbounded data structures

Incompleteness:

slide-148
SLIDE 148

Limitations

Expressiveness:

Strict subset of temporal logic + non-interference Loop free handlers No user-defined unbounded data structures

Incompleteness:

Unable to infer some inductive invariants

slide-149
SLIDE 149

Limitations

Expressiveness:

Strict subset of temporal logic + non-interference Loop free handlers No user-defined unbounded data structures

Incompleteness:

Unable to infer some inductive invariants Low level incompleteness in automation tactics

slide-150
SLIDE 150

SSH Server Kernel in REFLEX

slide-151
SLIDE 151

SSH Server Kernel in REFLEX

slide-152
SLIDE 152

Web Browser Kernel in REFLEX

TODO: Browser/SSH video

slide-153
SLIDE 153

Web Browser Kernel in REFLEX

TODO: Browser/SSH video

slide-154
SLIDE 154

Conclusion

Automation Expressiveness

Proof assistant based verification

slide-155
SLIDE 155

Conclusion

Automation Expressiveness Coq

Proof assistant based verification

slide-156
SLIDE 156

Conclusion

Automation Expressiveness Ynot Coq

Proof assistant based verification

slide-157
SLIDE 157

Conclusion

Automation Expressiveness Bedrock Ynot Coq

Proof assistant based verification

slide-158
SLIDE 158

Conclusion

Automation Expressiveness Bedrock Ynot Coq Reflex

Proof assistant based verification

slide-159
SLIDE 159

Conclusion

Reflex

slide-160
SLIDE 160

Conclusion

Reflex

DSL expressive enough for entire domain

slide-161
SLIDE 161

Conclusion

Reflex

DSL expressive enough for entire domain Automation eliminates manual proof burden

slide-162
SLIDE 162

Conclusion

Reflex

DSL expressive enough for entire domain Automation eliminates manual proof burden http://goto.ucsd.edu/reflex/

slide-163
SLIDE 163

Reflex

DSL expressive enough for entire domain Automation eliminates manual proof burden http://goto.ucsd.edu/reflex/

Thank You!