2020-03-09 06:18:30 +00:00
|
|
|
<!--
|
|
|
|
Copyright 2020, Data61, CSIRO (ABN 41 687 119 230)
|
|
|
|
|
2020-03-14 12:13:16 +00:00
|
|
|
SPDX-License-Identifier: CC-BY-SA-4.0
|
2020-03-09 06:18:30 +00:00
|
|
|
-->
|
2020-03-02 08:20:30 +00:00
|
|
|
|
2018-03-01 05:56:29 +00:00
|
|
|
[![DOI][0]](http://dx.doi.org/10.5281/zenodo.591732)
|
2021-08-14 00:49:29 +00:00
|
|
|
[![CI](https://github.com/seL4/l4v/actions/workflows/push.yml/badge.svg)](https://github.com/seL4/l4v/actions/workflows/push.yml)
|
|
|
|
[![Proofs](https://github.com/seL4/l4v/actions/workflows/proof-deploy.yml/badge.svg)](https://github.com/seL4/l4v/actions/workflows/proof-deploy.yml)
|
|
|
|
[![Weekly Clean](https://github.com/seL4/l4v/actions/workflows/weekly-clean.yml/badge.svg)](https://github.com/seL4/l4v/actions/workflows/weekly-clean.yml)
|
|
|
|
[![External](https://github.com/seL4/l4v/actions/workflows/external.yml/badge.svg)](https://github.com/seL4/l4v/actions/workflows/external.yml)
|
|
|
|
|
|
|
|
MCS:\
|
|
|
|
[![CI](https://github.com/seL4/l4v/actions/workflows/push.yml/badge.svg?branch=rt)](https://github.com/seL4/l4v/actions/workflows/push.yml)
|
|
|
|
[![RT Proofs](https://github.com/seL4/l4v/actions/workflows/proof.yml/badge.svg?branch=rt)](https://github.com/seL4/l4v/actions/workflows/proof.yml)
|
2018-03-01 05:56:29 +00:00
|
|
|
|
|
|
|
[0]: https://zenodo.org/badge/doi/10.5281/zenodo.591732.svg
|
|
|
|
|
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
[The L4.verified Proofs][1]
|
|
|
|
===========================
|
2014-07-14 19:32:44 +00:00
|
|
|
|
2014-07-22 22:35:05 +00:00
|
|
|
This is the L4.verified git repository with formal specifications and
|
|
|
|
proofs for the seL4 microkernel.
|
|
|
|
|
|
|
|
Most proofs in this repository are conducted in the interactive proof
|
|
|
|
assistant [Isabelle/HOL][2]. For an introduction to Isabelle, see its
|
|
|
|
[official website][2] and [documentation][3].
|
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
[1]: https://github.com/seL4/l4v "L4.verified Repository"
|
|
|
|
[2]: http://isabelle.in.tum.de "Isabelle Website"
|
|
|
|
[3]: http://isabelle.in.tum.de/documentation.html "Isabelle Documentation"
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2019-04-19 08:12:58 +00:00
|
|
|
<a name="setup"></a>
|
|
|
|
Setup
|
|
|
|
-----
|
2014-07-28 01:59:57 +00:00
|
|
|
|
2023-03-30 01:32:52 +00:00
|
|
|
This repository is meant to be used as part of a Google [repo][5] setup. Instead
|
|
|
|
of cloning it directly, please follow the directions for software dependencies
|
|
|
|
and Isabelle installation in the [setup.md](docs/setup.md) file in the `docs`
|
|
|
|
directory.
|
2020-12-02 01:32:26 +00:00
|
|
|
|
2023-03-30 01:32:52 +00:00
|
|
|
[5]: https://gerrit.googlesource.com/git-repo/+/HEAD/README.md
|
2019-04-19 08:12:58 +00:00
|
|
|
|
2015-01-27 00:14:51 +00:00
|
|
|
Contributing
|
|
|
|
------------
|
|
|
|
|
|
|
|
Contributions to this repository are welcome.
|
|
|
|
Please read [`CONTRIBUTING.md`](CONTRIBUTING.md) for details.
|
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
Overview
|
|
|
|
--------
|
2014-07-22 22:35:05 +00:00
|
|
|
|
|
|
|
The repository is organised as follows.
|
|
|
|
|
2020-06-02 09:44:55 +00:00
|
|
|
* [`docs`](docs/): documentation on conventions, style, etc.
|
|
|
|
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`spec`](spec/): a number of different formal specifications of seL4
|
|
|
|
* [`abstract`](spec/abstract/): the functional abstract specification of seL4
|
2018-03-26 05:28:34 +00:00
|
|
|
* [`sep-abstract`](spec/sep-abstract/): an abstract specification for a reduced
|
|
|
|
version of seL4 that is configured as a separation kernel
|
2016-05-24 05:59:17 +00:00
|
|
|
* [`haskell`](spec/haskell/): Haskell model of the seL4 kernel, kept in sync
|
|
|
|
with the C code
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`machine`](spec/machine/): the machine interface of these two specifications
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`cspec`](spec/cspec/): the entry point for automatically translating the seL4 C code
|
2014-07-22 22:35:05 +00:00
|
|
|
into Isabelle
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`capDL`](spec/capDL/): a specification of seL4 that abstracts from memory content and
|
2014-07-22 22:35:05 +00:00
|
|
|
concrete execution behaviour, modelling the protection state of the
|
|
|
|
system in terms of capabilities. This specification corresponds to the
|
2014-07-24 00:49:32 +00:00
|
|
|
capability distribution language *capDL* that can be used to initialise
|
2014-07-22 22:35:05 +00:00
|
|
|
user-level systems on top of seL4.
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`take-grant`](spec/take-grant/): a formalisation of the classical take-grant security
|
2014-07-22 22:35:05 +00:00
|
|
|
model, applied to seL4, but not connected to the code of seL4.
|
|
|
|
|
2018-03-26 05:28:34 +00:00
|
|
|
* There are additional specifications that are not tracked in this repository,
|
|
|
|
but are generated from other files:
|
|
|
|
* [`design`](spec/design/): the design-level specification of seL4,
|
|
|
|
generated from the Haskell model.
|
|
|
|
* [`c`](spec/cspec/c/): the C code of the seL4 kernel, preprocessed into a form that
|
2020-08-08 13:00:53 +00:00
|
|
|
can be read into Isabelle. This is generated from the [seL4 repository](https://github.com/seL4/seL4).
|
2018-03-26 05:28:34 +00:00
|
|
|
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`proof`](proof/): the seL4 proofs
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`invariant-abstract`](proof/invariant-abstract/): invariants of the seL4 abstract specification
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`refine`](proof/refine/): refinement between abstract and design specifications
|
|
|
|
* [`crefine`](proof/crefine/): refinement between design specification and C semantics
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`access-control`](proof/access-control/): integrity and authority confinement proofs
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`infoflow`](proof/infoflow/): confidentiality and intransitive non-interference proofs
|
|
|
|
* [`asmrefine`](proof/asmrefine/): Isabelle/HOL part of the seL4 binary verification
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`drefine`](proof/drefine/): refinement between capDL and abstract specification
|
|
|
|
* [`sep-capDL`](proof/sep-capDL/): a separation logic instance on capDL
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`capDL-api`](proof/capDL-api/): separation logic specifications of selected seL4 APIs
|
|
|
|
|
|
|
|
* [`lib`](lib/): generic proof libraries, proof methods and tools. Among these,
|
2014-07-22 22:35:05 +00:00
|
|
|
further libraries for fixed-size machine words, a formalisation of state
|
|
|
|
monads with nondeterminism and exceptions, a generic verification condition
|
|
|
|
generator for monads, a recursive invariant prover for these (`crunch`), an
|
2014-08-11 05:41:39 +00:00
|
|
|
abstract separation logic formalisation, a prototype of the [Eisbach][6] proof
|
2014-07-22 22:35:05 +00:00
|
|
|
method language, a prototype `levity` refactoring tool, and others.
|
|
|
|
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`tools`](tools/): larger, self-contained proof tools
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`asmrefine`](tools/asmrefine/): the generic Isabelle/HOL part of the binary
|
|
|
|
verification tool
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`c-parser`](tools/c-parser/): a parser from C into the Simpl language in Isabelle/HOL.
|
2014-07-22 22:35:05 +00:00
|
|
|
Includes a C memory model.
|
2014-07-28 01:59:57 +00:00
|
|
|
* [`autocorres`](tools/autocorres/): an automated, proof-producing abstraction tool from
|
2014-07-22 22:35:05 +00:00
|
|
|
C into higher-level Isabelle/HOL functions, based on the C parser above
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`haskell-translator`](tools/haskell-translator/): a basic python script for converting the Haskell
|
2014-07-22 22:35:05 +00:00
|
|
|
prototype of seL4 into the executable design specification in
|
|
|
|
Isabelle/HOL.
|
|
|
|
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`misc`](misc/): miscellaneous scripts and build tools
|
2014-07-28 01:59:57 +00:00
|
|
|
|
|
|
|
* [`camkes`](camkes/): an initial formalisation of the CAmkES component platform
|
2014-07-22 22:35:05 +00:00
|
|
|
on seL4. Work in progress.
|
|
|
|
|
2014-07-24 00:49:32 +00:00
|
|
|
* [`sys-init`](sys-init/): specification of a capDL-based, user-level system initialiser
|
2014-07-22 22:35:05 +00:00
|
|
|
for seL4, with proof that the specification leads to correctly initialised
|
|
|
|
systems.
|
|
|
|
|
|
|
|
|
2021-08-25 00:50:38 +00:00
|
|
|
[6]: https://trustworthy.systems/publications/nictaabstracts/Matichuk_WM_14.abstract "An Isabelle Proof Method Language"
|
2014-07-28 01:59:57 +00:00
|
|
|
|
2014-07-28 19:27:46 +00:00
|
|
|
|
2019-04-19 08:12:58 +00:00
|
|
|
Hardware requirements
|
2020-12-02 01:32:26 +00:00
|
|
|
---------------------
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2015-04-21 14:55:43 +00:00
|
|
|
Almost all proofs in this repository should work within 4GB of RAM. Proofs
|
|
|
|
involving the C refinement, will usually need the 64bit mode of polyml and
|
2015-05-25 21:47:54 +00:00
|
|
|
about 16GB of RAM.
|
2015-04-21 14:55:43 +00:00
|
|
|
|
|
|
|
The proofs distribute reasonably well over multiple cores, up to about 8
|
2015-05-25 21:47:54 +00:00
|
|
|
cores are useful.
|
2015-04-21 14:55:43 +00:00
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
Running the Proofs
|
|
|
|
------------------
|
2014-07-22 22:35:05 +00:00
|
|
|
|
|
|
|
If Isabelle is set up correctly, a full test for the proofs in this repository
|
2023-03-01 05:53:37 +00:00
|
|
|
for seL4 on the `ARM` architecture can be run with the command
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
L4V_ARCH=ARM ./run_tests
|
2014-07-22 22:35:05 +00:00
|
|
|
|
|
|
|
from the directory `l4v/`.
|
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
Set the environment variable `L4V_ARCH` to one of `ARM`, `ARM_HYP`, `X64`,
|
|
|
|
`RISCV64`, or `AARCH64` to get the proofs for the respective architecture. `ARM`
|
|
|
|
has the most complete set of proofs, the other architectures tend to support
|
|
|
|
only a subset of the proof sessions defined for `ARM`.
|
2018-03-26 05:28:34 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
Not all of the proof sessions can be built directly with the `isabelle build`
|
|
|
|
command. The seL4 proofs depend on Isabelle specifications that are generated
|
|
|
|
from the C source code and Haskell model. Therefore, it is recommended to always
|
|
|
|
build using the `run_tests` command or the supplied Makefiles, which will ensure
|
|
|
|
that these generated specs are up to date.
|
2018-03-26 05:28:34 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
To do this, enter one level under the `l4v/` directory and run `make <session-name>`.
|
|
|
|
For example, to build the abstract specification, do
|
2018-03-26 05:28:34 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
export L4V_ARCH=ARM
|
2018-03-26 05:28:34 +00:00
|
|
|
cd l4v/spec
|
2023-03-01 05:53:37 +00:00
|
|
|
make ASpec
|
2018-03-26 05:28:34 +00:00
|
|
|
|
|
|
|
See the `HEAPS` variable in the corresponding `Makefile` for available targets.
|
2023-03-01 05:53:37 +00:00
|
|
|
The sessions that directly depend on generated sources are `ASpec`, `ExecSpec`,
|
|
|
|
and `CKernel`. These, and all sessions that depend on them, need to be run using
|
|
|
|
`run_tests` or `make`.
|
2018-03-26 05:28:34 +00:00
|
|
|
|
|
|
|
Proof sessions that do not depend on generated inputs can be built directly with
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
./isabelle/bin/isabelle build -d . -v -b <session name>
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
from the directory `l4v/`. For available sessions and their dependencies, see
|
|
|
|
the corresponding `ROOT` files in this repository. There is roughly one session
|
|
|
|
corresponding to each major directory in the repository.
|
2014-07-22 22:35:05 +00:00
|
|
|
|
|
|
|
For interactively exploring, say the invariant proof of the abstract
|
2023-03-01 05:53:37 +00:00
|
|
|
specification on `ARM`, note that in `proof/ROOT` the parent session for
|
|
|
|
`AInvs` is `ASpec` and therefore run:
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
export L4V_ARCH=ARM
|
|
|
|
./run_tests ASpec
|
2021-01-08 02:51:09 +00:00
|
|
|
./isabelle/bin/isabelle jedit -d . -R AInvs
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
or, if you prefer `make`:
|
|
|
|
|
|
|
|
export L4V_ARCH=ARM
|
|
|
|
cd spec; make ASpec
|
|
|
|
../isabelle/bin/isabelle jedit -d . -R AInvs
|
2014-07-22 22:35:05 +00:00
|
|
|
|
2023-03-01 05:53:37 +00:00
|
|
|
in `l4v/` and open one of the files in `proof/invariant-abstract`.
|