Virtual timeline: a formal abstraction for verifying preemptive schedulers with temporal isolation

Abstract

The reliability and security of safety-critical real-time systems are of utmost importance because the failure of these systems could incur severe consequences (e.g., loss of lives or failure of a mission). Such properties require strong isolation between components and they rely on enforcement mechanisms provided by the underlying operating system (OS) kernel. In addition to spatial isolation which is commonly provided by OS kernels to various extents, it also requires temporal isolation, that is, properties on the schedule of one component (e.g., schedulability) are independent of behaviors of other components. The strict isolation between components relies critically on algorithmic properties of the concrete implementation of the scheduler, such as timely provision of time slots, obliviousness to preemption, etc. However, existing work either only reasons about an abstract model of the scheduler, or proves properties of the scheduler implementation that are not rich enough to establish the isolation between different components. In this paper, we present a novel compositional framework for reasoning about algorithmic properties of the concrete implementation of preemptive schedulers. In particular, we use virtual timeline, a variant of the supply bound function used in real-time scheduling analysis, to specify and reason about the scheduling of each component in isolation. We show that the properties proved on this abstraction carry down to the generated assembly code of the OS kernel. Using this framework, we successfully verify a real-time OS kernel, which extends mCertiKOS, a single-processor non-preemptive kernel, with user-level preemption, a verified timer interrupt handler, and a verified real-time scheduler. We prove that in the absence of microarchitectural-level timing channels, this new kernel enjoys temporal and spatial isolation on top of the functional correctness guarantee. All the proofs are implemented in the Coq proof assistant.

Layered and object-based game semantics

“…The initial sequential CertiKOS kernel [Gu et al 2015] was decomposed into 37 certified layers consisting of C and assembly modules such as physical and virtual memory managers, context-switch libraries, thread and process managers, virtual machine managers, and page fault and trap handlers. Later versions of CertiKOS Gu et al , 2018Liu et al 2019] showed how to extend certified layers to support multicore and multithreaded concurrency, fine-grained locking, device drivers, and real-time scheduling; they have also been extended to verify not only the total functional correctness but also information-flow security properties Liu et al 2019].…”

Verification of Operating Systems for Internet of Things in Smart Cities From the Assembly Perspective Using Isabelle/HOL

“…The Yale FLINT Group aimed to develop a novel and practical programming architecture to build large-scale verified system software. The members of the group have made substantial contributions in the field of formal verification, such as presenting a new framework for certified binaries [9], verifying the concurrent OS kernel [10], abstracting preemptive schedulers [11], presenting a language for certified software [12], and verifying distributed systems [13].…”

Formal design and verification of system task in intelligent transportation systems based on micro-kernel architecture

“…Flint used separation logic to verify the accuracy of memory sharing and data abstraction (Koenig and Shao 2018;Gu et al 2015). Meanwhile, virtual timeline was used to specify and reason for preemptive scheduling, and a novel compositional framework is proposed for reasoning Liu et al (2020). For distributed systems, a system called WormSpace was design and verified to supply an address space of the Write-Once Register Shin et al (2019).…”