Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System Jean Yang MIT CSAIL Chris Hawblitzel Microsoft Research

Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System Jean Yang MIT CSAIL Chris Hawblitzel Microsoft Research

3Safe to the Last Instruction / Jean Yang

4

Memory Safety 5

Type Safety 6Safe to the Last Instruction / Jean Yang

Untyped Unsafe code (GC, stacks, drivers, …) Type-checked OS File System Drivers Applications Microkernel Hardware Previously: “Safe” Systems 7 What currently exists

Safe to the Last Instruction / Jean Yang Untyped Unsafe code (GC, stacks, drivers, …) Type-checked OS File System Drivers Applications Microkernel Hardware End-to-End Safe Systems 8 Verified code (GC, stacks, drivers, …) What we want

Verified Type-checked Verve, a Type-Safe OS Safe to the Last Instruction / Jean Yang Verify partial correctness of low- level Nucleus using Hoare logic based on a hardware spec. Verify an interface to typed assembly for end-to-end safety. Nucleus File System Drivers Applications Microkernel Hardware specification Interface specification 9

The Verve Nucleus Safe to the Last Instruction / Jean Yang10 Verified Type-checked Nucleus File System Drivers Applications Microkernel Hardware specification Interface specification Verified Interface specification x86 instructions Memory bounds Devices GC Heap Allocator and GC [POPL 2009] Stacks Interrupt table Interrupt/error handling Interface specification

Thread Context Invariant function StateInv (s:StackID, state:StackState, …) returns(bool) { (!IsEmpty(state)  … && (IsInterrupted(state)  … && (IsYielded(state)  … && state == StackYielded( StackEbp(s, tMems), StackEsp(s, tMems) + 4, StackRA(s, tMems, fMems)) && … } Safe to the Last Instruction / Jean Yang11

“Load” Specification procedure Load(ptr:int) returns (val:int); requires memAddr(ptr); requires Aligned(ptr); modifies Eip; ensures word(val); ensures val == Mem[ptr]; Safe to the Last Instruction / Jean Yang12

Assembling Verve Verified Safe to the Last Instruction / Jean Yang Boogie/Z3 Translator/ Assembler Source file Compilation tool Verification tool Nucleus.bpl (x86) 13

Boogie to x86 implementation ReadKeyboard(){ call KeyboardStatusIn8(); call eax := And(eax, 1); if (eax != 0) { goto proc; } call eax := mov(256); return; proc: call KeyboardDataIn8(); call eax := And(eax, 255); return; } Safe to the Last Instruction / Jean Yang ReadKeyboard proc in al, 064h and eax, 1 cmp eax, 0 jne ReadKeyboard$proc mov eax, 256 ret ReadKeyboard$skip: in al, 060h and eax, 255 ret 14

Building Verve Verified Safe to the Last Instruction / Jean Yang C# compiler Kernel.cs Boogie/Z3 Translator/ Assembler TAL checker Linker/ISO generator Verve.iso Source file Compilation tool Verification tool Nucleus.bpl (x86)Kernel.obj (x86) 15

Verve Performance Safe to the Last Instruction / Jean Yang Verve functionality Cycles Round-trip yield 98 Round-trip wait + signal ComparisonsCycles L4 (IPC)224 SeL4 (IPC)448 Singularity (yield)2156 Linux (yield)2390 Windows (yield)3554

Low Annotation Burden CopyingMark-sweep Specification Boogie lines1185 Verified Boogie lines Safe to the Last Instruction / Jean Yang x86 instructions person-months 3x code

Verve vs. SeL4? Safe to the Last Instruction / Jean Yang SeL4 Verified microkernel 8,700 lines of C File System Drivers Applications 200,000 lines of Isabelle ~600 lines ARM assembly person-months 18 20x code Verve Verified Nucleus ~1500 lines of x86 C# kernel

Contributions Safe to the Last Instruction / Jean Yang First automatically, mechanically verified OS for type safety. Real system running on x86 with efficient code. Approach for using automated techniques to verify safety. Verified Type-checked Verified nucleus File System Drivers Applications Microkernel Hardware specification Interface specification 19