Citation Context

...the same overall relation R. For each refinement layer in Fig. 2, we have strengthened and varied this proof technique slightly, but the general idea remains the same. Details are published elsewhere =-=[14,70]-=-. We now describe the instantiation of this framework to the seL4 kernel. We have the following types of transition in our state machines: kernel transitions, user transitions, user events, idle trans...

Citation Context

...security property proven in L4.verified states that the kernel can effectively isolate subsystems and can enforce flexible global security policies. All specifications in Fig. 10 have been completed (=-=Cock et al., 2008-=-). The security specification is ca 300 loc, the high-level design 3,000 loc, the low-level design 7,500 loc, and the C codeAccess-Control Model Security Property Isabelle/HOL High-Level Design Low-L...

Citation Context

...tional proof calculus [36], similar in style to the seminal work of Benton [10] and other reasoning systems for confidentiality properties [4], [5], with an automated verification condition generator =-=[14]-=-. We prove Property 1 for each of the small transitions of Figure 4(a) to conclude it holds for the coalesced transitions of Figure 4(b). Case 2 — part s � p: In this case, we consider two sub-cases....

Citation Context

...nechecked in the theorem prover Isabelle/HOL [15]. This paper is one of the steps towards our longer-term goal of full operating systems verification. We aim to formally connect the security proof presented here with the actual kernel implementation in C. All of the seL4 operations map to one or more of the operations presented in this paper. Many of them, e.g. basic thread mananagement, translate to no-op, but the authority-relevant operations have a direct representation in the model presented here. We have so far connected an abstract operational model of seL4 with a precise executable one [3]. We are concurrently working on a formal refinement proof between the security model of this paper and this abstract model and also on the refinement proof between the executable model and the C implementation [7,8]. The security specification is ca. 300loc, the abstract one about 3kloc, the executable one 7kloc, the C code 10kloc, and the refinement proof between abstract and executable specification 100kloc. In this paper, we focus on the tip of this iceberg: the high-level aspects of seL4 security. 2 The seL4 Microkernel The seL4 (secure embedded L4 ) kernel is an evolution of the L4 micro...

Citation Context

...ould be invariants of the system, which can be demonstrated using Hoare triples in a framework for reasoning about state monads in Isabelle/HOL. We have previously reported on this framework in depth =-=[5]-=-. In summary, the precondition of a Hoare triple in this framework is a predicate on the pre-state, the post condition is a predicate on the return value of the function and the post-state. In the cas...

Citation Context

...name the first and second halves of this tuple results and failed respectively. A full description of the motivation for and formalisation of this monad with VCG support are presented in earlier work =-=[3]-=-. Fig 3 lists the monadic commands used in this paper and their Simpl equivalents where applicable. Monadic commands are suffixed with the character E to indicate they operate on the exception monad. ...

Citation Context

...fly summarise relevant details of our earlier typical kernel function. We Fig. then1. explain Refinement how the components steps of the in verification L4.verified. three layers by formal proof work =-=[5]-=- inon Is- the monadic, executable specification and on our precise, foundational framework fit together and briefly summarise relevant details of our earlier C semantics and memory model [28,25,26]. I...

Citation Context

...oit the desires of systems programmers to ease program verification. The motivation for this work was the C implementation of the seL4 microkernel, and the needs of the associated L4.verified project =-=[8, 3]-=-. The seL4 microkernel [5, 7] is an evolution of the L4 family [17] for secure, embedded devices. The L4.verified project aims to prove its functional correctness. The need to produce code that can be...

Citation Context

... expected for many other embedded systems. However, the FM team managed to design refinement calculi for each of the major proof steps that allowed the work to be divided up among members of the team =-=[27]-=-, [28]. Especially in the code-level proof, individual lemmas proving the correctness of separate functions in the kernel implementation could be proved independently. In the designlevel proof, the sa...