Advanced Development of Certified OS Kernels DARPA CRASH Site Visit PIs: Zhong Shao & Bryan Ford (Yale University) October 5th, Friday, 2012, Room 307 Watson 09:15 – 10:15 Session 1 Project overview (Zhong Shao) Kernel design & application (Bryan Ford) Kernel implementation (Liang Gu) Kernel “specification” (Haozhong Zhang) 10:15 – 10:30 Break 10:30 – 11:30 Session 2 Compositional verification & compilation (Tahina Ramananandro) Virtual memory management (Alex Vaynberg) Concurrent interrupt & thread management (Zhong Shao) 11:30 – 11:45 Break 11:45 – 12:45 Session 3 Declarative DIFC (David Costanzo) Proving lock-freedom (Jan Hoffmann) VeriML design & implementation (Jan Hoffmann)

Advanced Development of Certified OS Kernels Project Overview Zhong Shao Yale University October 5,

Team members Zhong Shao PI Bryan Ford Co-PI Tahina Ramananandro PostDoc Liang Gu PostDoc Jan Hoffmann PostDoc Bandan Das David Costanzo Antonis Stampoulis Alex Vaynberg Shu-Chun Weng Software Engineer PhD student PhD (10/2012) PhD (9/2012) PhD student Ronghui Gu Jinjiang Lei Michael Marmar Haozhong Zhang PhD Student PhD student (visiting) PhD student PhD student (visiting)

Application & other system SW Certified OS kernels Formal specs & proofs for resilience, extensibility, security? HW & Env Model Research tasks & key innovations: new OS kernels that can “crash-proof” the entire system & application SW new prog. languages & logics for writing certified kernel plug-ins new formal methods for automating proofs & specs

Main challenges OS kernel design & implementation – how to design a kernel that can crash-proof an entire system – clean-slate kernel vs. backward compatibility & tech-transfer path? OS kernel certification – a framework for certified linking of heterogeneous components – what to prove? safety, race-freedom, correctness, lock-freedom, …… – information flow control even under declassification (noninterference) Languages and logics for certified programming (over C & assembly) – Declarative IFC? what is virtualization? recursive virtualization? – non-blocking fine-grained concurrency & concurrent thread management – virtual memory manager & file systems & resource usages Automation support and formal methods – how to combine first-order provers with higher-order proof assistant? – support for writing large-scale proofs and proof scripts

Certified “hypervisor” kernel Problems w. existing platforms Attacks: Zero-Day Kernel Vulnerabilities (ZDKVs) & rogue driver certificates leads to rogue kernels leads to rogue WinCC/Step7 apps leads to rogue PLC firmeware firmware Rogue PC Rogue PLC WinCC & Step 7 rogue OS & its kernel Other Apps zero-day kernel vulnerabilities & fake/stolen driver certificates certified firmware Secure PC w. IFC labels Secure PLC WinCC & Step 7 certified kernel Other Apps COTS OS small mechanized proof checker New CRASH technologies A small certified “hypervisor” kernel provides a reliable ZDKV-free core to fall back on, even under attacks Information-Flow-Control to enforce security Mechanized proof certificates are unforgeable Protecting against Stuxnet attacks!

Expected deliverables Certified OS Kernels clean-slate design with end-to-end guarantees on extensibility, security, and resilience. No ZDKVs New PLs for writing certified C/assembly programs; OCAP w. certified linking; Domain-Specific Prog. Logics (DSPL) VeriML & Tools New formal methods for developing, checking, and automating specs/proofs. New language for certifying meta-programs based on PIOS explore different designs not certified initially new releases each year pick subset for certification based on VeriML [ICFP10] evolve its design & impl. scalable proof witnesses new releases each year automated prog. verifiers based on various CAPs need new OCAP/DSPLs initially done in Coq certified kernel modules transition to VeriML later

What we have done so far? (First two years of CRASH) A clean-slate CertiKOS hypervisor kernel –boot on stock AMD / Intel hardware –support multiple VM guests, hypercall, device pass-through A new compositional verification framework that extends OCAP with –cross-abstraction linking and certified separate compilation (compatible with CompCert) Compositional verification of virtual memory management –paper + PhD dissertation + Coq implementation (of certified VMM modules) New compositional program logics for certifying fine-grained concurrency –interrupt & thread management; trace-based CSL; proving lock freedom Declarative DIFC –rigorous definition & proof of “non-interference” even in the presence of declassification –new DIFC logics that work for low-level C-like languages (with mutable heaps / malloc / free) VeriML design & implementation & programming tool – papers + PhD dissertation + new VeriML compiler/interpreter

Kernel design & development Hardware Abstraction Layer (Device Drivers) SMP Management Physical Memory Allocator Page Map Interrupt Handle Virtualization Abstraction Process Management Spinlock Virtual Machine Management Master Master Syscall Slave Slave Syscall VMX Primitives VMX Primitives SVM Primitives SVM Primitives Virtual Devices Virtual Devices

compositional verification framework Kernel certification LnLn … L1L1 Mechanized meta-logic Formalized HW & env model … C1C1 CnCn C1C1 C1C1 CnCn … CertiKOS CnCn … C1C1 CnCn But this only addresses horizontal modularity!

Compositional co-development & verification & synthesis & linking Raw Machine / HW Spec kmod1.c CompCert abs-layer-1 spec kmod1.s high-level kernel spec abs-layer-k spec kmodk.s abs-layer-2 spec kmod2.s kmod2.c CompCert abs-layer-z spec kmodz.s kmodz.c CompCert ……………………… … abs-layer-x spec kmodx.s kmodx.c CompCert kmody.c CompCert kmody.s kmod3.c CompCert kmod3.s kmody.c CompCert kmody.s ……………………… … kinit.c Safety (never crash) Correctness Secure (no info leak) Liveness (resource usage)

Schedule 09:15 – 10:15 Session 1 Project overview (Zhong Shao) Kernel design & application (Bryan Ford) Kernel implementation (Liang Gu) Kernel “specification” (Haozhong Zhang) 10:15 – 10:30 Break 10:30 – 11:30 Session 2 Compositional verification & compilation (Tahina Ramananandro) Virtual memory management (Alex Vaynberg) Concurrent interrupt & thread management (Zhong Shao) 11:30 – 11:45 Break 11:45 – 12:45 Session 3 Declarative DIFC (David Costanzo) Proving lock-freedom (Jan Hoffmann) VeriML design & implementation (Jan Hoffmann)