[PPT] - Provably Trustworthy Systems seL4 and beyond Gerwin Klein Royal PowerPoint Presentation

SLIDE 1

data61.csiro.au

Provably Trustworthy Systems

seL4 and beyond

Gerwin Klein Royal Society Meeting on Verified trustworthy software systems April 2016

SLIDE 2

Formal verification 

f real systems is happening!

SLIDE 3

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:

SLIDE 4

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

SLIDE 5

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

SLIDE 6

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

SLIDE 7

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML

SLIDE 8

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

SLIDE 9

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

PolarSSL

– verified SSL implementation

SLIDE 10

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

PolarSSL

– verified SSL implementation

CoCon

– verified conference system

SLIDE 11

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

PolarSSL

– verified SSL implementation

CoCon

– verified conference system

SLIDE 12

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

PolarSSL

– verified SSL implementation

CoCon

– verified conference system

OpenSSL HMAC

– verified crypto implementation

SLIDE 13

Proof Engineering | Gerwin Klein 3

Formal verification of real systems

Increasingly many examples:
seL4

– verified OS kernel implementation

CompCert

– verified compiler implementation

Ironfleet and Ironclad

– verified distributed system

CakeML
Candle

– verified interactive HOL theorem prover implementation

PolarSSL

– verified SSL implementation

CoCon

– verified conference system

OpenSSL HMAC

– verified crypto implementation

FSCQ

– verified crash resistance file system

SLIDE 14

But: Still far from mainstream

SLIDE 15

Proof Engineering | Gerwin Klein 5

Too Expensive

Such projects are still big research results
Often break new ground
Multiple person years or person decades
Real, binary-level results still rare
Hard to maintain over long periods

SLIDE 16

Proof Engineering | Gerwin Klein 5

Too Expensive

Such projects are still big research results
Often break new ground
Multiple person years or person decades
Real, binary-level results still rare
Hard to maintain over long periods
Still too expensive
But not that far off:

– cheaper than traditional high-assurance dev – factor 2-3 over high-quality traditional embedded systems dev

SLIDE 17

What can be done?

SLIDE 18

Proof Engineering | Gerwin Klein 7

Better, cheaper, faster.

Just needs to be cheaper:
economic pressure wins over time
everything else follows

SLIDE 19

Proof Engineering | Gerwin Klein 7

Better, cheaper, faster.

Just needs to be cheaper:
economic pressure wins over time
everything else follows
Proof Productivity:
Tools

– more automation, deeper automation, built for scale

Proof Engineering

– predictability, estimation, scale

Languages

– design for verification, increase verification productivity

…

SLIDE 20

Proof Engineering | Gerwin Klein 8

The rest of this talk

seL4
Scale
Proof Engineering
Proof Effort
Future

SLIDE 21

seL4

SLIDE 22

Proof Engineering | Gerwin Klein 10

seL4: Isolation

Trustworthy Computing Base

message passing
virtual memory
interrupt handling
access control

Applications

fault isolation
fault identification
IP protection
modularity

Trusted next to Untrusted

Hardware Linux Server

Legacy App. Legacy App.

Legacy Apps

Trusted Service Sensitive App

Trusted Untrusted

SLIDE 23

Proof Engineering | Gerwin Klein 10

seL4: Isolation

Trustworthy Computing Base

message passing
virtual memory
interrupt handling
access control

Applications

fault isolation
fault identification
IP protection
modularity

Trusted next to Untrusted

Hardware

seL4

Linux Server

Legacy App. Legacy App.

Legacy Apps

Trusted Service Sensitive App

Trusted Untrusted

SLIDE 24

Proof Engineering | Gerwin Klein

Specification Code

11

Functional Correctness

Proof

SLIDE 25

Proof Engineering | Gerwin Klein

Specification Code

11

Functional Correctness

What

Proof

definition schedule :: unit s_monad where schedule do threads ⇥ allActiveTCBs; thread ⇥ select threads; switch_to_thread thread

d

OR switch_to_idle_thread

SLIDE 26

Proof Engineering | Gerwin Klein

Specification Code

11

Functional Correctness

What How

Proof

definition schedule :: unit s_monad where schedule do threads ⇥ allActiveTCBs; thread ⇥ select threads; switch_to_thread thread

d

OR switch_to_idle_thread

SLIDE 27

Proof Engineering | Gerwin Klein 12

*conditions apply

Proof Specification Code

SLIDE 28

Proof Engineering | Gerwin Klein 12

*conditions apply

Proof Expectation Assumptions Specification Code

SLIDE 29

Proof Engineering | Gerwin Klein 12

*conditions apply

Proof Expectation Assumptions Specification Code

Assume correct:

compiler + linker (wrt. C op-sem)
assembly code (600 loc)
hardware (ARMv6)
cache and TLB management
boot code (1,200 loc)

SLIDE 30

Proof Engineering | Gerwin Klein

Isabelle

13

Proof Architecture Now

C Code Semantics Design Specification Binary Code Semantics Availability

Isabelle/SMT/HOL4 Isabelle Isabelle Isabelle

Confidentiality Integrity WCET Analysis Haskell Prototype Binary Code C Code

SLIDE 31

Proof Engineering | Gerwin Klein

Isabelle

13

Proof Architecture Now

C Code Semantics Design Specification Binary Code Semantics Availability

Isabelle/SMT/HOL4 Isabelle Isabelle Isabelle

Confidentiality Integrity WCET Analysis

High-level properties:

functional correctness
integrity
authority confinement
non-interference
termination
user-level system initialisation
verified component platform
worst-case execution time

(by static analysis) Roadmap:

verified x64 version
virtualisation extensions
mixed-criticality real-time
timing side-channel elimination

Haskell Prototype Binary Code C Code

SLIDE 32

Proof Engineering | Gerwin Klein

Isabelle

13

Proof Architecture Now

C Code Semantics Design Specification Binary Code Semantics Availability

Isabelle/SMT/HOL4 Isabelle Isabelle Isabelle

Confidentiality Integrity WCET Analysis

High-level properties:

functional correctness
integrity
authority confinement
non-interference
termination
user-level system initialisation
verified component platform
worst-case execution time

(by static analysis) Roadmap:

verified x64 version
virtualisation extensions
mixed-criticality real-time
timing side-channel elimination

Haskell Prototype Binary Code C Code

Open Source

http://seL4.systems https://github.com/seL4/

SLIDE 33

Proof Engineering | Gerwin Klein 14

Autonomous in

As Real as it Gets

SLIDE 34

Proof Engineering | Gerwin Klein 14

Autonomous in

As Real as it Gets

3, 2, 1..

SLIDE 35

Scale

SLIDE 36

Proof Engineering | Gerwin Klein 16

Scale

size of AFP entries by submission date

Archive of Formal Proofs

SLIDE 37

Proof Engineering | Gerwin Klein 17

Scale

size of AFP entries by submission date with Four-Colour theorem, Odd-Order theorem, Verisoft, seL4

SLIDE 38

Proof Engineering | Gerwin Klein 18

500 files
22,000 lemmas stated
95,000 lemmas proved

Proof Introspection

SLIDE 39

Proof Engineering | Gerwin Klein 18

500 files
22,000 lemmas stated
95,000 lemmas proved

Proof Introspection

Raf’s Observation

The introspection of proof and theories is an essential part of working on a large-scale verification development.

Learning Isabelle? Easy.
Learning microkernels? Not too bad.
Finding your way in the 500kloc proof jungle? Hard!

SLIDE 40

Proof Engineering

SLIDE 41

Proof Engineering | Gerwin Klein 20

Is Proof Engineering a thing?
Google Scholar:

– “software engineering” 1,430,000 results

Software vs Proof Engineering

SLIDE 42

Proof Engineering | Gerwin Klein 20

Is Proof Engineering a thing?
Google Scholar:

– “software engineering” 1,430,000 results

Software vs Proof Engineering

– “proof engineering” 564 results

SLIDE 43

Proof Engineering | Gerwin Klein 20

Is Proof Engineering a thing?
Google Scholar:

– “software engineering” 1,430,000 results

Software vs Proof Engineering

Includes ”The Fireproof Building” and “Influence of water permeation and analysis

f treatment for the Longmen Grottoes"

– “proof engineering” 564 results

SLIDE 44

Proof Engineering | Gerwin Klein 21

Same kind of artefacts:
lemmas are functions, modules are modules
code gets big too
version control, regressions,

refactoring and IDEs apply

Proof Engineering is The Same

SLIDE 45

Proof Engineering | Gerwin Klein 21

Same kind of artefacts:
lemmas are functions, modules are modules
code gets big too
version control, regressions,

refactoring and IDEs apply

Same kind of problems
managing a large proof base over time
deliver a proof on time within budget
dependencies, interfaces, abstraction, etc

Proof Engineering is The Same

SLIDE 46

Proof Engineering | Gerwin Klein 22

But: New Properties and Problems
Results are checkable
You know when you are done!
No testing
95% proof: no such thing
More dead ends and iteration
2nd order artefact
Performance less critical
Quality less critical
Proof Irrelevance
More semantic context
Much more scope for automation

Proof Engineering is Different

SLIDE 47

Proof Engineering | Gerwin Klein 23

Proof development

– decomposition of proofs over people, – custom proof calculus, – automating mechanical tasks, custom tactics – proof craft

Proof Development

SLIDE 48

Proof Engineering | Gerwin Klein 23

Proof development

– decomposition of proofs over people, – custom proof calculus, – automating mechanical tasks, custom tactics – proof craft

Proof Development

Tim’s Statement

Automating “donkey work” allows attention and effort to be focussed where most needed – but it must be done judiciously.

SLIDE 49

Proof Engineering | Gerwin Klein 23

Proof development

– decomposition of proofs over people, – custom proof calculus, – automating mechanical tasks, custom tactics – proof craft

Challenges

– non-local change, – speculative change, – distributed development

Proof Development

Tim’s Statement

Automating “donkey work” allows attention and effort to be focussed where most needed – but it must be done judiciously.

SLIDE 50

Proof Engineering | Gerwin Klein 23

Proof development

– decomposition of proofs over people, – custom proof calculus, – automating mechanical tasks, custom tactics – proof craft

Challenges

– non-local change, – speculative change, – distributed development

Proof Development

Matthias’ Conjecture

Over the years, I must have waited weeks for

Isabelle. Productivity hinges on a short edit-

check cycle; for that, I am even willing to (temporarily) sacrifice soundness.

Tim’s Statement

Automating “donkey work” allows attention and effort to be focussed where most needed – but it must be done judiciously.

SLIDE 51

Proof Engineering | Gerwin Klein 24

Proof maintenance

– changes, updates, new proofs, new features – automated regression, keep code in sync – refactoring – simplification

Original proof: 2005-2009
Maintenance: 2009-2016 and counting

Problems of Scale

SLIDE 52

Proof Engineering | Gerwin Klein 24

Proof maintenance

– changes, updates, new proofs, new features – automated regression, keep code in sync – refactoring – simplification

Original proof: 2005-2009
Maintenance: 2009-2016 and counting

Problems of Scale

Dan’s Conclusion

Verification is fast, maintenance is forever.

SLIDE 53

Proof Engineering | Gerwin Klein 25

User Interface
could proof IDEs be more

powerful than code IDEs?

more semantic information
proof completion and suggestion?

Proof Engineering Tools

SLIDE 54

Proof Engineering | Gerwin Klein 25

User Interface
could proof IDEs be more

powerful than code IDEs?

more semantic information
proof completion and suggestion?
Refactoring
less constrained,

new kinds of refactoring possible, e.g.

– move to best position in library – generalise lemma – recognise proof patterns

Proof Engineering Tools

SLIDE 55

Proof Engineering | Gerwin Klein 26

Large-scale Libraries
architecture:

– layers, modules, components,   abstractions, genericity

proof interfaces
proof patterns

Proof Patterns

SLIDE 56

Proof Engineering | Gerwin Klein 26

Large-scale Libraries
architecture:

– layers, modules, components,   abstractions, genericity

proof interfaces
proof patterns
Technical Debt
what does a clean, maintainable proof look like?
which techniques will make future change easier?
readability important? is documentation?

Proof Patterns

SLIDE 57

Proof Effort

SLIDE 58

Proof Engineering | Gerwin Klein 28

Predictions

Can we predict for proofs:

how large will it be?
how long will it take?
how much will it cost?

SLIDE 59

Proof Engineering | Gerwin Klein 28

Predictions

Can we predict for proofs:

how large will it be?
how long will it take?
how much will it cost?

Of course not. Many hard problems look deceptively easy.

SLIDE 60

Proof Engineering | Gerwin Klein 28

Predictions

Can we predict for proofs:

how large will it be?
how long will it take?
how much will it cost?

Of course not. Many hard problems look deceptively easy. But maybe for program verification? At least statistically, some of the time?

SLIDE 61

Proof Engineering | Gerwin Klein 28

Predictions

Can we predict for proofs:

how large will it be?
how long will it take?
how much will it cost?

Of course not. Many hard problems look deceptively easy. But maybe for program verification? At least statistically, some of the time? We have large proofs. Let’s crunch some data!

SLIDE 62

Proof Engineering | Gerwin Klein 29

Some Hope

Code Size is correlated with Spec Size

SLIDE 63

Proof Engineering | Gerwin Klein 29

Some Hope

●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
● ●
●
● ●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
● ●
●
200

400 600 800 1000 1200 5000 10000 15000 20000 25000 30000

AInvs Idealised Statement Size vs. Proof Size Idealised Statement Size Proof Size

R 2 = 0.937

Spec Size is correlated with Proof Size Code Size is correlated with Spec Size

SLIDE 64

Proof Engineering | Gerwin Klein 29

Some Hope

●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
● ●
●
● ●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
● ●
●
200

400 600 800 1000 1200 5000 10000 15000 20000 25000 30000

AInvs Idealised Statement Size vs. Proof Size Idealised Statement Size Proof Size

R 2 = 0.937

Spec Size is correlated with Proof Size Code Size is correlated with Spec Size Proof Size is correlated with Effort

SLIDE 65

Proof Engineering | Gerwin Klein 29

Some Hope

●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
●
●
● ●
●
●
●
●
●●
●●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●
●●
●
●
●
●
● ●
●
● ●
●
●
● ●
●
●
●
●
●
●
●
●
●
●
●
● ●
●
●
●
● ●
●
200

400 600 800 1000 1200 5000 10000 15000 20000 25000 30000

AInvs Idealised Statement Size vs. Proof Size Idealised Statement Size Proof Size

R 2 = 0.937

Spec Size is correlated with Proof Size Code Size is correlated with Spec Size Proof Size is correlated with Effort There may be hope for a prediction model. Probably applies to verification of non-modular code. Unlikely to work for other kinds of proofs, but likely  to transfer to other interactive provers.

SLIDE 66

The Future

SLIDE 67

Proof Engineering | Gerwin Klein 31

The Future: Integration

Hardware

No method fits all
Use seL4 isolation!
don’t verify all components
mix verification approaches

SLIDE 68

Proof Engineering | Gerwin Klein 31

The Future: Integration

Hardware

seL4

Unverified Linux Server Legacy App

Cogent File System Guardol Network Filter Ivory Driver Synthesised Driver CakeML native Application CakeML extracted Application Cryptol Crypto Library

No method fits all
Use seL4 isolation!
don’t verify all components
mix verification approaches

SLIDE 69

Proof Engineering | Gerwin Klein 31

The Future: Integration

Hardware

seL4

Unverified Linux Server Legacy App

Cogent File System Guardol Network Filter Ivory Driver Synthesised Driver CakeML native Application CakeML extracted Application Cryptol Crypto Library

No method fits all
Use seL4 isolation!
don’t verify all components
mix verification approaches

Will need formal interfaces

SLIDE 70

Proof Engineering | Gerwin Klein 32

Summary

Verification of real systems is happening

SLIDE 71

Proof Engineering | Gerwin Klein 32

Summary

Verification of real systems is happening
It’s still too expensive

SLIDE 72

Proof Engineering | Gerwin Klein 32

Summary

Verification of real systems is happening
It’s still too expensive
There is hope

SLIDE 73

Proof Engineering | Gerwin Klein 32

Summary

Verification of real systems is happening
It’s still too expensive
There is hope
Ongoing work on
Proof Engineering
Languages for verification productivity
Increased Automation

SLIDE 74

Proof Engineering | Gerwin Klein 32

Summary

Verification of real systems is happening
It’s still too expensive
There is hope
Ongoing work on
Proof Engineering
Languages for verification productivity
Increased Automation
Integration will be key

SLIDE 75

data61.csiro.au

Thank You

Trustworthy Systems Gerwin Klein  t +61 2 8306 0578 e gerwin.klein@nicta.com.au w http://trustworthy.systems