1. Checking the Hardware- Software Interface in Spec# Kevin Bierhoff (CMU) Chris Hawblitzel (Microsoft Research)

2. Safe OS code, statically typed (?) kernel TCP/IP web server web plug-in single hardware address space Singularity OSTypedUntyped Safe Unsafe ML Java LISP Cassembler network driver... uint mode = csr6.Read32(); mode &= ~(CSR6.SR | CSR6.ST); csr6.Write32(mode); rxRing.Reset(); csr3.Write32(rxRing.BaseAddress.ToUInt32()); txRing.Reset(); csr4.Write32(txRing.BaseAddress.ToUInt32());...

3. Tulip Network Adaptor host memory csr3 Tulip device entry RX ring ownflags size1size2 buffer1 address buffer2 address entry csr4 csr6

4. Safe Hardware Interaction Layer... internal void StartRxTxMiiSym() requires RxConfigured && TxConfigured; modifies this.rxStarted, this.txStarted; ensures RxConfigured && TxConfigured && RxStarted && TxStarted; { csr6.Write32( CSR6.MBO | CSR6.HBD | CSR6.PS | (3u << CSR6.TR_ROLL) | CSR6.ST | CSR6.SR ); rxStarted = txStarted = true; }... device csr6 network driver safe code (Spec#) SHIL(Spec#) Spec# = C# + logical annotations

5. Bug: SHIL pre-condition violated internal void ConfigureHostBus( uint cacheMask, uint busMask, uint cacheAlignment, uint burstLength) requires (RxStarted == false) && (TxStarted == false); requires (cacheMask & ~(CSR0.WIE | CSR0.RLE | CSR0.RME)) == 0; requires busMask == 0 || busMask == CSR0.BAR; requires cacheAlignment >= 0 && cacheAlignment <= 3; requires burstLength == 0 || burstLength == 1 || burstLength == 2 || burstLength == 4 || burstLength == 8 || burstLength == 16 || burstLength == 32; ensures (RxStarted == false) && (TxStarted == false); { csr0.Write32(cacheMask | busMask | (cacheAlignment << CSR0.CAL_ROLL) | (burstLength << CSR0.PBL_ROLL)); } Was violated in original implementation and is now fixed

6. Buffer ownership kernel network driver TCP/IP web server web plug-in single hardware address space ownflags size1size2 buffer1 address buffer2 address buffer class TulipRxDescriptor {... internal void Buffer1Claim(Packet! packet) requires packet.Full; requires !Buffer1Set; ensures packet.Empty; ensures Buffer1Set {...}... } class TulipRxRing {... internal void GiveToDevice( TulipRxDescriptor! descriptor) requires !descriptor.OwnedByDevice; requires descriptor.Buffer1Set && descriptor.Buffer2Set; ensures descriptor.OwnedByDevice;... {...}... }

7. Driver, SHIL code size device (200- page doc) csr6 network driver driver code device (200- page doc) csr6 network driver safe code SHIL 1800 lines original coderevised code (5 person-weeks) 1800 lines 1400 lines

8. Conclusions Static verification tools have improved –automation –data structures, aliasing, objects, concurrency... –(run-time checking also possible) Properties are interconnected –memory safety relies on state Hardware is diverse (and complicated) –packet fragments Incremental approach on existing code Future work: declarative SHIL language ML,Java Spec# LISP Cassembler