Solution approaches towards verifjed µ-Kernel Danny Ziesche August 25, 2017 RheinMain University of Applied Sciences
Outline Motivation Methods Defjnitions Results Conclusions Open Questions 1
Motivation
Motivation • kernels should have a high reliability • in comparison to monolithic kernels small enough to make verifjcation process worthwhile • trusted codebase • security concerns 2
Methods
• research which parts are verifjed and why • how does the verifjcation process work • compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel 3
• how does the verifjcation process work • compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why 3
• compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why • how does the verifjcation process work 3
Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why • how does the verifjcation process work • compare verifjcations 3
• used methods by the µ-kernel? • do we benefjt from it? Learn about formal methods • fjrm understanding about the fundamentals 4
• do we benefjt from it? Learn about formal methods • fjrm understanding about the fundamentals • used methods by the µ-kernel? 4
Learn about formal methods • fjrm understanding about the fundamentals • used methods by the µ-kernel? • do we benefjt from it? 4
Defjnitions
• no automated process • human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs 5
• human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs • no automated process 5
• example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs • no automated process • human guidance and skill needed 5
Theorem Prover • assist in formalising proofs • no automated process • human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation 5
• Always • Next • Eventually • derived from FOPL with new temporal operators: Linear Temporal Logic • temporal reasoning 6
• Always • Next • Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: 6
• Next • Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always 6
• Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always • � Next 6
Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always • � Next • ♦ Eventually 6
• let f be a formula of temporal logic • fjnd all states s of M such that s f Model Checkers • let M be a state-transition graph 7
• fjnd all states s of M such that s f Model Checkers • let M be a state-transition graph • let f be a formula of temporal logic 7
Model Checkers • let M be a state-transition graph • let f be a formula of temporal logic • fjnd all states s of M such that s | = f 7
Results
RUBIS • verifjed only the IPC 8
RUBIS IPC Processor 1 Processor 2 Synchronous Task 2 Task 1 Synchronous Asynchronous Asynchronous Task 4 Task 3 Figure 1: RUBIS Mixed Synchronous and Asynchronous Communication 9
LTL Property Example � ( P ( 0 ) → Q ( 0 ) ∧ ( P ( 1 ) → Q ( 1 )) ∧ . . . ∧ ( P ( m ) → Q ( m ))) • ports need sound state before reusing • property expressed as LTL • P ( p ) = ( Port_State [ p ] = CREATED ) • Q ( p ) = ( empty ( Port [ p ] .messages )) • also expressed as promela defjnition 10
RUBIS Results • lots of errors related to return codes • memory management errors 11
• IPC is important and highly concurrent with a complex implementation • makes it worthy target for formal methods Fluke • verifjed only the IPC 12
• makes it worthy target for formal methods Fluke • verifjed only the IPC • IPC is important and highly concurrent with a complex implementation 12
Fluke • verifjed only the IPC • IPC is important and highly concurrent with a complex implementation • makes it worthy target for formal methods 12
Fluke Formal Methods • uses spin • uses subset of C 13
• found race condition • scaling problems • maintenance problems Fluke Results • found mutex bugs 14
• scaling problems • maintenance problems Fluke Results • found mutex bugs • found race condition 14
• maintenance problems Fluke Results • found mutex bugs • found race condition • scaling problems 14
Fluke Results • found mutex bugs • found race condition • scaling problems • maintenance problems 14
seL4 • interactive machine-assisted and machine-checked proof • proven over 150 invariants • discovered about 140 bugs • revealed 150 problems within the specifjcation • uses theorem prover isabelle/hol • tries to offmoad problematic code to userspace (memory management) • executable specifjcation in haskell subset • implementation in a C subset 15
Refjnement Layers Figure 2: Refjnement layers in the verifjcation of seL4 16
seL4 Results • claims to have no nullpointer access (the kernel itself) • functional correctness for the c kernel implementation • proof maintenance 17
Conclusions
• IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel 18
• agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation 18
• existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language 18
• model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker 18
• non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve 18
• in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover 18
• seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far 18
Recommend
More recommend
