Our great sponsors
seL4 | l4v | |
---|---|---|
60 | 15 | |
4,538 | 489 | |
1.7% | 1.6% | |
9.0 | 9.6 | |
5 days ago | 3 days ago | |
C | Isabelle | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
seL4
-
From L3 to seL4 what have we learnt in 20 years of L4 microkernels? [video]
> People like to snob Unix but the fact is: the world runs on Unix.
The world you are aware of runs on it.
> Can we really do that much better or is it just hubris?
Yes. Have a look at seL4[1] and Barrelfish too[2], even though that's no longer active. seL4 in particular is powering a lot of highly secure computing systems. There is a surprisingly large sphere outside of Unix/POSIX.
[1] https://sel4.systems/
[2] https://barrelfish.org/
-
On the Costs of Syscalls
There are also RTOS-capable microkernels such as seL4[0], with few but extremely fast syscalls[1]. Note times are in cycles, not usec.
0. https://sel4.systems/
1. https://sel4.systems/About/Performance/
-
Can the language of proof assistants be used for general purpose programming?
https://sel4.systems
Working on a number of platforms, verified on some. Multicore support is an ongoing effort afaict.
On OS built on this kernel is still subject to some assumptions (like, hardware working correctly, bootloader doing its job, etc). But mostly those assumptions are less of a problem / easier to prove than the properties of a complex software system.
As I understand it, guarantees that seL4 does provide, go well beyond anything else currently out there.
-
How to write TEE/Trusted OS for ARM microcontrollers?
Take a look at this: https://sel4.systems/
- Simulation: KI-Drohne der US Air Force eliminiert Operator für Punktemaximierung
-
Paragon Graphite is a Pegasus spyware clone used in the US
It's probably have to be seL4 (https://sel4.systems), running on some fully OSS hardware.
There are question marks over much of available RISC-V chips due to chinese producers, so maybe OpenPower based hardware?
Plus, the entire system (motherboard, etc) would need to be manufactured using a good supply chain.
Hmmm, this has probably all been thought through in depth before by others. :)
-
Basic SAT model of x86 instructions using Z3, autogenerated from Intel docs
You can use it to (mostly) validate small snippets are the same. See Alive2 for the application of Z3/formalization of programs as SMT for that [1]. As far as I'm aware there are some problems scaling up to arbitrarily sized programs due to a lack of formalization in higher level languages in addition to computational constraints. With a lot of time and effort it can be done though [2].
1. https://github.com/AliveToolkit/alive2
2. https://sel4.systems/
-
What are the current hot topics in type theory and static analysis?
Formal methods. This is not in most general-purpose programming languages and probably never will be (maybe we'll see formal methods to verify unsafe code in Rust...) because it's a ton of boilerplate (you have to help the compiler type-check your code) and also extremely complicated. However, formal methods is very important for proving code secure, such as sel4 (microkernel formally verified to not have bugs or be exploitable) which has just received the ACM Software Systems Award 3 days ago.
- Rust Now Available for Real-Time Operating System and Hypervisor PikeOS
-
Amiga and AmigaOS should move to ARM.
Today we'd look at seL4.
l4v
-
Rewrite the VP9 codec library in Rust
> C/C++ can be made memory safe
.. but it's much harder to prove your work is memory safe. sel4 is memory safe C, for example. The safety is achieved by a large external theorem prover and a synced copy written in Haskell. https://github.com/seL4/l4v
Typechecks are form of proof. It's easier to write provably safe Rust than provably safe C because the proofs and checker are integrated.
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
You can't really retrofit safety to C. The best that can be achieved is sel4, which while it is written in C has a separate proof of its correctness: https://github.com/seL4/l4v
The proof is much, much more work than the microkernel itself. A proof for something as large as webP might take decades.
- SeL4 Specification and Proofs
-
What in the name of all that's holy is going on with software ?
When something like the seL4 microkernel is formally verified, the remaining bugs should only be bugs in the specification, not the implementation.
-
Elimination of programmers
seL4 specifications and proofs are not a programming language.
-
Google Announces KataOS and Sparrow
Yes, especially 'logically impossible' when you dig into the details. From the blogpost:
> and the kernel modifications to seL4 that can reclaim the memory used by the rootserver.
MMMMMMMMMMMkkkkkk. So you then have to ask: were these changes also formally verified? There's a metric ton of kernel changes here: https://github.com/AmbiML/sparrow-kernel/commits/sparrow but I don't see a fork of https://github.com/seL4/l4v anywhere inside AmbiML.
I mean, it does also claim to be "almost entirely written in Rust", which is true if you ignore almost the entire OS part of the OS (the kernel and the minimal seL4 runtime).
-
A 24-year-old bug in the Linux Kernel (2021)
Probably the only way to prevent this type of issue in an automated fashion is to change your perspective from proving that a bug exists, to proving that it doesn't exist. That is, you define some properties that your program must satisfy to be considered correct. Then, when you make optimizations such as bulk receiver fast-path, you must prove (to the static analysis tool) that your optimizations to not break any of the required properties. You also need to properly specify the required properties in a way that they are actually useful for what people want the code to do.
All of this is incredibly difficult, and an open area of research. Probably the biggest example of this approach is the Sel4 microkernel. To put the difficulty in perspective, I checkout out some of the sel4 repositories did a quick line count.
The repository for the microkernel itself [0] has 276,541
The testsuite [1] has 26,397
The formal verification repo [2] has 1,583,410, over 5 times as much as the source code.
That is not to say that formal verification takes 5x the work. You also have to write your source-code in such a way that it is ammenable to being formally verified, which makes it more difficult to write, and limits what you can reasonably do.
Having said that, this approach can be done in a less severe way. For instance, type systems are essentially a simple form of formal verification. There are entire classes of bugs that are simply impossible in a properly typed programs; and more advanced type systems can eliminate a larger class of bugs. Although, to get the full benefit, you still need to go out of your way to encode some invariant into the type system. You also find that mainstream languages that try to go in this direction always contain some sort of escape hatch to let the programmer assert a portion of code is correct without needing to convince the verifier.
[0] https://github.com/seL4/seL4
[1] https://github.com/seL4/sel4test
[2] https://github.com/seL4/l4v
-
Formally Proven Binary Format Parsers
I mean, just look at the commits with "fix" in the specs folder: https://github.com/seL4/l4v/commits/master?after=4f0bbd4fcbc...
- Proofs and specifications
What are some alternatives?
fprime - F´ - A flight software and embedded systems framework
hubris - A lightweight, memory-protected, message-passing kernel for deeply embedded systems.
nomicon - The Dark Arts of Advanced and Unsafe Rust Programming
agda-stdlib - The Agda standard library
CompCert - The CompCert formally-verified C compiler
creusot - Creusot helps you prove your code is correct in an automated fashion. [Moved to: https://github.com/creusot-rs/creusot]
InitWare - The InitWare Suite of Middleware allows you to manage services and system resources as logical entities called units. Its main component is a service management ("init") system.
cryptography - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
4.4BSD-Lite2 - 4.4BSD Lite Release 2: last Unix operating system from Berkeley
codeball-action - 🔮 Codeball – AI Code Review that finds bugs and fast-tracks your code
openc910 - OpenXuantie - OpenC910 Core
cross - “Zero setup” cross compilation and “cross testing” of Rust crates