Solution approaches towards verifjed -Kernel Danny Ziesche August - - PowerPoint PPT Presentation

▶
solution approaches towards verifjed kernel
SMART_READER_LITE
LIVE PREVIEW

Solution approaches towards verifjed -Kernel Danny Ziesche August - - PowerPoint PPT Presentation

Feb 05, 2023 20 likes •564 views

Solution approaches towards verifjed -Kernel Danny Ziesche August 25, 2017 RheinMain University of Applied Sciences Outline Motivation Methods Defjnitions Results Conclusions Open Questions 1 Motivation Motivation kernels should

slide-1
SLIDE 1

Solution approaches towards verifjed µ-Kernel

Danny Ziesche August 25, 2017

RheinMain University of Applied Sciences

slide-2
SLIDE 2

Outline

Motivation Methods Defjnitions Results Conclusions Open Questions

1

slide-3
SLIDE 3

Motivation

slide-4
SLIDE 4

Motivation

  • kernels should have a high reliability
  • in comparison to monolithic kernels small enough to

make verifjcation process worthwhile

  • trusted codebase
  • security concerns

2

slide-5
SLIDE 5

Methods

slide-6
SLIDE 6

Dig into the past

  • search for (partly) verifjed µ-Kernel
  • research which parts are verifjed and why
  • how does the verifjcation process work
  • compare verifjcations

3

slide-7
SLIDE 7

Dig into the past

  • search for (partly) verifjed µ-Kernel
  • research which parts are verifjed and why
  • how does the verifjcation process work
  • compare verifjcations

3

slide-8
SLIDE 8

Dig into the past

  • search for (partly) verifjed µ-Kernel
  • research which parts are verifjed and why
  • how does the verifjcation process work
  • compare verifjcations

3

slide-9
SLIDE 9

Dig into the past

  • search for (partly) verifjed µ-Kernel
  • research which parts are verifjed and why
  • how does the verifjcation process work
  • compare verifjcations

3

slide-10
SLIDE 10

Learn about formal methods

  • fjrm understanding about the fundamentals
  • used methods by the µ-kernel?
  • do we benefjt from it?

4

slide-11
SLIDE 11

Learn about formal methods

  • fjrm understanding about the fundamentals
  • used methods by the µ-kernel?
  • do we benefjt from it?

4

slide-12
SLIDE 12

Learn about formal methods

  • fjrm understanding about the fundamentals
  • used methods by the µ-kernel?
  • do we benefjt from it?

4

slide-13
SLIDE 13

Defjnitions

slide-14
SLIDE 14

Theorem Prover

  • assist in formalising proofs
  • no automated process
  • human guidance and skill needed
  • example theorem prover is isabelle with resolution based
  • n higher-order unifjcation

5

slide-15
SLIDE 15

Theorem Prover

  • assist in formalising proofs
  • no automated process
  • human guidance and skill needed
  • example theorem prover is isabelle with resolution based
  • n higher-order unifjcation

5

slide-16
SLIDE 16

Theorem Prover

  • assist in formalising proofs
  • no automated process
  • human guidance and skill needed
  • example theorem prover is isabelle with resolution based
  • n higher-order unifjcation

5

slide-17
SLIDE 17

Theorem Prover

  • assist in formalising proofs
  • no automated process
  • human guidance and skill needed
  • example theorem prover is isabelle with resolution based
  • n higher-order unifjcation

5

slide-18
SLIDE 18

Linear Temporal Logic

  • temporal reasoning
  • derived from FOPL with new temporal operators:
  • Always
  • Next
  • Eventually

6

slide-19
SLIDE 19

Linear Temporal Logic

  • temporal reasoning
  • derived from FOPL with new temporal operators:
  • Always
  • Next
  • Eventually

6

slide-20
SLIDE 20

Linear Temporal Logic

  • temporal reasoning
  • derived from FOPL with new temporal operators:
  • Always
  • Next
  • Eventually

6

slide-21
SLIDE 21

Linear Temporal Logic

  • temporal reasoning
  • derived from FOPL with new temporal operators:
  • Always
  • Next
  • Eventually

6

slide-22
SLIDE 22

Linear Temporal Logic

  • temporal reasoning
  • derived from FOPL with new temporal operators:
  • Always
  • Next
  • ♦ Eventually

6

slide-23
SLIDE 23

Model Checkers

  • let M be a state-transition graph
  • let f be a formula of temporal logic
  • fjnd all states s of M such that s

f

7

slide-24
SLIDE 24

Model Checkers

  • let M be a state-transition graph
  • let f be a formula of temporal logic
  • fjnd all states s of M such that s

f

7

slide-25
SLIDE 25

Model Checkers

  • let M be a state-transition graph
  • let f be a formula of temporal logic
  • fjnd all states s of M such that s |

= f

7

slide-26
SLIDE 26

Results

slide-27
SLIDE 27

RUBIS

  • verifjed only the IPC

8

slide-28
SLIDE 28

RUBIS IPC

Task 1 Task 2 Task 4 Task 3 Asynchronous Asynchronous Synchronous Synchronous Processor 1 Processor 2 Figure 1: RUBIS Mixed Synchronous and Asynchronous Communication

9

slide-29
SLIDE 29

LTL Property Example

(P(0) → Q(0) ∧ (P(1) → Q(1)) ∧ . . . ∧ (P(m) → Q(m)))

  • ports need sound state before reusing
  • property expressed as LTL
  • P(p) = (Port_State[p] = CREATED)
  • Q(p) = (empty(Port[p].messages))
  • also expressed as promela defjnition

10

slide-30
SLIDE 30

RUBIS Results

  • lots of errors related to return codes
  • memory management errors

11

slide-31
SLIDE 31

Fluke

  • verifjed only the IPC
  • IPC is important and highly concurrent with a complex

implementation

  • makes it worthy target for formal methods

12

slide-32
SLIDE 32

Fluke

  • verifjed only the IPC
  • IPC is important and highly concurrent with a complex

implementation

  • makes it worthy target for formal methods

12

slide-33
SLIDE 33

Fluke

  • verifjed only the IPC
  • IPC is important and highly concurrent with a complex

implementation

  • makes it worthy target for formal methods

12

slide-34
SLIDE 34

Fluke Formal Methods

  • uses spin
  • uses subset of C

13

slide-35
SLIDE 35

Fluke Results

  • found mutex bugs
  • found race condition
  • scaling problems
  • maintenance problems

14

slide-36
SLIDE 36

Fluke Results

  • found mutex bugs
  • found race condition
  • scaling problems
  • maintenance problems

14

slide-37
SLIDE 37

Fluke Results

  • found mutex bugs
  • found race condition
  • scaling problems
  • maintenance problems

14

slide-38
SLIDE 38

Fluke Results

  • found mutex bugs
  • found race condition
  • scaling problems
  • maintenance problems

14

slide-39
SLIDE 39

seL4

  • interactive machine-assisted and machine-checked proof
  • proven over 150 invariants
  • discovered about 140 bugs
  • revealed 150 problems within the specifjcation
  • uses theorem prover isabelle/hol
  • tries to offmoad problematic code to userspace (memory

management)

  • executable specifjcation in haskell subset
  • implementation in a C subset

15

slide-40
SLIDE 40

Refjnement Layers

Figure 2: Refjnement layers in the verifjcation of seL4

16

slide-41
SLIDE 41

seL4 Results

  • claims to have no nullpointer access (the kernel itself)
  • functional correctness for the c kernel implementation
  • proof maintenance

17

slide-42
SLIDE 42

Conclusions

slide-43
SLIDE 43

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-44
SLIDE 44

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-45
SLIDE 45

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-46
SLIDE 46

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-47
SLIDE 47

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-48
SLIDE 48

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-49
SLIDE 49

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • seems to be a general pattern to µ-kernel verifjcation

18

slide-50
SLIDE 50

Conclusions

  • IPC is obviously an important component for µ-kernel
  • IPC is a high candidate for verifjcation
  • agreement on a subset of standard language
  • existing code proven with model checker
  • model checker have a short learning curve
  • non-existing code proven with theorem prover
  • in my estimation seL4 did the most and best job so far
  • ⇒ seems to be a general pattern to µ-kernel verifjcation

18

slide-51
SLIDE 51

Open Questions

slide-52
SLIDE 52

Languages

  • languages with built-in mechanisms for formal verifjcation
  • languages which are designed to make verifjcation easier
  • verifjcation of compilers

19

slide-53
SLIDE 53

Famous Quote ”Beware of bugs in the above code; I have only proved it correct, not tried it.“

— Donald E. Knuth

20

slide-54
SLIDE 54

Questions?

20