Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS L o L o g o g o Authors: Feng Zhang π , Yongwang Zhao β,π , Dianfu Ma π , Wensheng Niu π *. Corresponding Author 1. School of Computer Science and Engineering, Beihang Univerisity, China 2. Aeronautical Computing Technique Research Institute, Xiβan, China
Contents β’ 1. Introduction β’ 2. Buddy Memory Allocation Algorithm in Zephyr β’ 3. Fine-Grained Formal Specification in Isabell/HOL β’ 4. Formal Proof β’ 5. Results and Discussions β’ 6. Conclusions 1 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
1. Introduction - Abstract β’ Memory management (MM) is a critical component of OS β’ Bugs in MM may crash OS or the whole critical system β’ This paper presents a case study of formal verification on the buddy memory allocation component of the Zephyr RTOS: β’ Provide Fine-Grained formal specification in Isabelle/HOL β’ Conduct Formal proof using the interactive prover in Isabelle β’ Find two flaws in the C code when executing sequentially 2 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
1. Introduction β Research Status β’ Verification of the TLSF algorithm in Event-B: O nly verifies an abstract specification at the requirement level β’ β’ not check consistency between elements in the data structure β’ seL4 pushes the memory allocation outside of the kernel β’ Yu et al. introduce a low-level language CAP (certified assembly programming) in Coq β’ build certified programs β’ present a certified library for dynamic storage allocation β’ not a kernelβs component but a certified memory library β’ 75 lines C code 3 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
1. Introduction β summary β’ We create a fine-grained formal specification: β’ All the elements of the data structure β’ All the operations (initialization, allocation and release) β’ System clocks and simple kernel scheduling β’ The execution of memory allocation is preemptive β’ We concentrate in five types of critical properties: β’ Invariants β’ Correctness of doubly linked lists β’ Functional correctness of events β’ Conformity of event specifications to kernel requirements β’ Livelock-free of the system specification. 4 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
Contents β’ 1. Introduction β’ 2. Buddy Memory Allocation Algorithm in Zephyr β’ 3. Fine-Grained Formal Specification in Isabell/HOL β’ 4. Formal Proof β’ 5. Results and Discussions β’ 6. Conclusions 5 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
2.1 β Zephyr Project β’ Zephyr Project is a Linux Foundation Project β’ Be perfect for building simple connected sensors: β’ up to modems and small IoT wireless gateways β’ Built with safety and security in mind β’ Cross-architecture with growing developer tool support β’ Complete, fully integrated, highly configurable, modular for flexibility, better than roll-your-own β’ Product development ready β’ Permissively licensed 6 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
2.2 β Zephyr OS Kernel β’ Derived from Wind River βs commercial Microkernel Profile β’ Microkernel Profile has evolved over 20 years from DSP RTOS technology known as Virtuoso β’ Used in several commercial applications: β’ satellites, military command and control communications, radar, telecommunications and image processing β’ successful Philae Landing on Comet Churyumov β Gerasimenko and the accompanying Rosetta Orbiter 7 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
2.2 β Buddy Memory Allocation Algorithm in Zephyr Kernel β’ (1) Pool and block Initialization β’ only be defined and initialized at compile time β’ (2) Block Allocation β’ Quad-Partitioning: iteratively partitioning larger blocks into smaller quad- ones β’ (3)Block Release β’ Immediately, automatically, and recursively combining smaller blocks into bigger ones 8 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
2.2 β Buddy Memory Allocation Algorithm in Zephyr Kernel β’ (1) Pool and block Initialization β’ only be defined and initialized at compile time β’ (2) Block Allocation β’ Quad-Partitioning: iteratively partitioning larger blocks into smaller quad- ones β’ (3)Block Release β’ Immediately, automatically, and recursively combining smaller blocks into bigger ones 9 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
Contents β’ 1. Introduction β’ 2. Buddy Memory Allocation Algorithm β’ 3. Fine-Grained Formal Specification in Isabell/HOL β’ 4. Formal Proof β’ 5. Results and Discussions β’ 6. Conclusions 10 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ A. State Machine β’ The state is defined as a record StateD β’ the initial state π‘ 0 state-transition functions Ο β’ 11 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ B. Data Structure 12 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ B. Data Structure 13 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ C. Event Specification ο° system behaviors based on Zephyr characteristics β’ system clocks time_tick β’ the thread scheduling schedule ο° actions operated on memory pools and blocks β’ pool and block initializations β’ block allocations β’ block release 14 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ C. Event Specification ο° system behaviors based on Zephyr characteristics β’ system clocks time_tick β’ the thread scheduling schedule ο° actions operated on memory pools and blocks β’ pool and block initializations β’ block allocations β’ block release 15 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ C. Event Specification 16 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
3 β Fine-Grained Formal Specification β’ D. State Space 17 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
Contents β’ 1. Introduction β’ 2. Buddy Memory Allocation Algorithm in Zephyr β’ 3. Fine-Grained Formal Specification in Isabell/HOL β’ 4. Formal Proof β’ 5. Results and Discussions β’ 6. Conclusions 18 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
4 β Formal Proof β’ 4.1 Invariants - Consistency of Data Structure β’ bitMap_freelistS s specifies the consistency between bit_maps and free lists β’ bitMap_treeS s specifies the consistency between bit_maps and abstract trees. 19 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
4 β Formal Proof β’ 4.2 Correctness of Doubly Linked Lists β’ The pointer in C is specified as a ref in Isabelle β’ ref = (UNIV::nat set) β’ head_next :: βref => refβ β’ tail_prev :: "ref => ref" 20 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
4 β Formal Proof β’ 4.2 Correctness of Doubly Linked Lists β’ Length of a dilist β’ Validity of a node β’ Validity of a dlist β’ Validity of appending actions 21 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
4 β Formal Proof β’ 4.3 Functional Correctness of Events β’ {P} C {Q} β’ Our specifications are all total correctness specifications β’ terminations are ensured by using the primrec, fun, function and definition 22 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
4 β Formal Proof β’ 4.4 Conformity of Event Specifications to Kernel Requirements β’ determine whether event executions and their return values conform to the kernel requirements β’ 4.5 Livelock-free β’ Starvation β’ Execution loop β’ No further progress 23 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
Contents β’ 1. Introduction β’ 2. Buddy Memory Allocation Algorithm in Zephyr β’ 3. Fine-Grained Formal Specification in Isabell/HOL β’ 4. Formal Proof β’ 5. Results and Discussions β’ 6. Conclusions 24 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
5 β Results and Discussions β’ A. Evaluation β’ 600 lines C β’ 800 lines specification: 109 functions/definitions 12 primary events β’ 9400 lines proof: 338 lemmas 25 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
5 β Results and Discussions β’ B. Results of formal analysis: fine two flaws ο° Return code not conform to the kernel requirement ο° Application thread will fall into live lock. 26 Fine-Grained Formal Specification and Analysis of Buddy Memory Allocation in Zephyr RTOS
Recommend
More recommend
