|
Verve is a research operating system developed by Microsoft Research. Verve is verified end-to-end for type safety and memory safety. Because of their complexity, a holy grail of software verification has been to verify properties of operating systems. Operating systems are usually written in low-level languages, such as C, that provide very few guarantees. The (Singularity project ) took the approach of writing an operating system in C#, a type-safe, memory-safe language. A weakness of this approach is that operating systems necessarily need to call lower-level code to, for instance, move the stack pointer. Verve addresses this problem by partitioning the operating system into verified assembly that is required to be low-level and a trusted interface to rest of the operating system, written in C#. There is a trusted specification that guarantees the low-level assembly code does not mess with the heap and that the high-level C# code does not mess with the stacks. Verve consists of a small ''Nucleus'', which acts as a minimal hardware abstraction layer, and a ''Kernel'', which uses primitives provided by the Nucleus to expose a more traditional interface to applications. All components of the system other than the Nucleus are written in managed C# and compiled by Bartok (originally developed for the Singularity project) into typed assembly language, which is verified by a TAL checker. The Nucleus implements a memory allocator and garbage collection, support for stack switching, and managing interrupt handlers. It is written in BoogiePL, which serves as input to MSR's Boogie verifier, which proves the Nucleus correct using the Z3 SMT solver. The Nucleus relies on the Kernel to implement threads, scheduling, synchronization, and to provide most interrupt handlers. Even though the Kernel is not formally verified, so, for example, a bug in scheduling could cause the system to hang, it cannot violate type or memory safety, and thus cannot directly cause undefined behavior. If it attempts to make invalid requests to the Nucleus, formal verification guarantees that the Nucleus handles the situation in a controlled manner. Verve's trusted computing base is limited to: Boogie/Z3 for verifying the Nucleus's correctness; BoogieASM for translating it into x86 assembly; the BoogiePL specification of how the Nucleus should behave; the TAL verifier; the assembler and linker; and the bootloader. Notably, neither the C# compiler/runtime nor the Bartok compiler are part of the TCB. == References == * (Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System ), Jean Yang and Chris Hawblitzel. ''Programming Language Design and Implementation'', 2010. * (Safe to the Last Instruction: Automated Verification of a Type-Safe Operating System ), Jean Yang and Chris Hawblitzel. CACM Research Highlight. ''Communications of the ACM'', September 2010. * (Technical Perspective: Safety First! ) * (Verve: A Type Safe Operating System ). Interview with Chris Hawblitzel. * (Verve: A Type Safe Operating System ). ''OSnews''. * (Announcing Verve – A Type-Safe Operating System ). ''InfoQ''. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Verve (operating system)」の詳細全文を読む スポンサード リンク
|