Solution approaches towards verifjed -Kernel Danny Ziesche August - PowerPoint PPT Presentation

Solution approaches towards verifjed µ-Kernel Danny Ziesche August 25, 2017 RheinMain University of Applied Sciences

Outline Motivation Methods Defjnitions Results Conclusions Open Questions 1

Motivation

Motivation • kernels should have a high reliability • in comparison to monolithic kernels small enough to make verifjcation process worthwhile • trusted codebase • security concerns 2

Methods

• research which parts are verifjed and why • how does the verifjcation process work • compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel 3

• how does the verifjcation process work • compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why 3

• compare verifjcations Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why • how does the verifjcation process work 3

Dig into the past • search for (partly) verifjed µ-Kernel • research which parts are verifjed and why • how does the verifjcation process work • compare verifjcations 3

• used methods by the µ-kernel? • do we benefjt from it? Learn about formal methods • fjrm understanding about the fundamentals 4

• do we benefjt from it? Learn about formal methods • fjrm understanding about the fundamentals • used methods by the µ-kernel? 4

Learn about formal methods • fjrm understanding about the fundamentals • used methods by the µ-kernel? • do we benefjt from it? 4

Defjnitions

• no automated process • human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs 5

• human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs • no automated process 5

• example theorem prover is isabelle with resolution based on higher-order unifjcation Theorem Prover • assist in formalising proofs • no automated process • human guidance and skill needed 5

Theorem Prover • assist in formalising proofs • no automated process • human guidance and skill needed • example theorem prover is isabelle with resolution based on higher-order unifjcation 5

• Always • Next • Eventually • derived from FOPL with new temporal operators: Linear Temporal Logic • temporal reasoning 6

• Always • Next • Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: 6

• Next • Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always 6

• Eventually Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always • � Next 6

Linear Temporal Logic • temporal reasoning • derived from FOPL with new temporal operators: • � Always • � Next • ♦ Eventually 6

• let f be a formula of temporal logic • fjnd all states s of M such that s f Model Checkers • let M be a state-transition graph 7

• fjnd all states s of M such that s f Model Checkers • let M be a state-transition graph • let f be a formula of temporal logic 7

Model Checkers • let M be a state-transition graph • let f be a formula of temporal logic • fjnd all states s of M such that s | = f 7

Results

RUBIS • verifjed only the IPC 8

RUBIS IPC Processor 1 Processor 2 Synchronous Task 2 Task 1 Synchronous Asynchronous Asynchronous Task 4 Task 3 Figure 1: RUBIS Mixed Synchronous and Asynchronous Communication 9

LTL Property Example � ( P ( 0 ) → Q ( 0 ) ∧ ( P ( 1 ) → Q ( 1 )) ∧ . . . ∧ ( P ( m ) → Q ( m ))) • ports need sound state before reusing • property expressed as LTL • P ( p ) = ( Port_State [ p ] = CREATED ) • Q ( p ) = ( empty ( Port [ p ] .messages )) • also expressed as promela defjnition 10

RUBIS Results • lots of errors related to return codes • memory management errors 11

• IPC is important and highly concurrent with a complex implementation • makes it worthy target for formal methods Fluke • verifjed only the IPC 12

• makes it worthy target for formal methods Fluke • verifjed only the IPC • IPC is important and highly concurrent with a complex implementation 12

Fluke • verifjed only the IPC • IPC is important and highly concurrent with a complex implementation • makes it worthy target for formal methods 12

Fluke Formal Methods • uses spin • uses subset of C 13

• found race condition • scaling problems • maintenance problems Fluke Results • found mutex bugs 14

• scaling problems • maintenance problems Fluke Results • found mutex bugs • found race condition 14

• maintenance problems Fluke Results • found mutex bugs • found race condition • scaling problems 14

Fluke Results • found mutex bugs • found race condition • scaling problems • maintenance problems 14

seL4 • interactive machine-assisted and machine-checked proof • proven over 150 invariants • discovered about 140 bugs • revealed 150 problems within the specifjcation • uses theorem prover isabelle/hol • tries to offmoad problematic code to userspace (memory management) • executable specifjcation in haskell subset • implementation in a C subset 15

Refjnement Layers Figure 2: Refjnement layers in the verifjcation of seL4 16

seL4 Results • claims to have no nullpointer access (the kernel itself) • functional correctness for the c kernel implementation • proof maintenance 17

Conclusions

• IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel 18

• agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation 18

• existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language 18

• model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker 18

• non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve 18

• in my estimation seL4 did the most and best job so far • seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover 18

• seems to be a general pattern to µ-kernel verifjcation Conclusions • IPC is obviously an important component for µ-kernel • IPC is a high candidate for verifjcation • agreement on a subset of standard language • existing code proven with model checker • model checker have a short learning curve • non-existing code proven with theorem prover • in my estimation seL4 did the most and best job so far 18