A method for formal verification of complex data structure of operating system kernel

Abstract

The application provides a kind of operating system kernel complex data structure formal verification method, first based on the definition of in-block existence operation, the operation of data structure in kernel source program is mapped to abstract memory, the type, byte size and other information contained in the data structure object of program level are carried to memory model, the corresponding property of abstract memory level is obtained;Then according to the reasoning rule based on memory state semantics, the assertion of different states in the process of memory operation is obtained;Combined with the processing of complex structure description semantic model defined for abstract program layer, the extended Hall logic is obtained, and the reasoning is carried out through symbolic program logic;Then the logic reasoning and memory state assertion are handed over to automatic prover for proof, whether the related properties of complex data structure meet the expectation is verified automatically.The application realizes efficient and accurate formal verification of operating system kernel complex data structure.

Description

Technical Field

[0001] This invention relates to the field of formal verification technology for data structures, and more specifically to a formal verification method for complex data structures in operating system kernels. Background Technology

[0002] Operating systems are crucial for computers. Their reliability and correctness are prerequisites for stable computer operation. However, due to the numerous functions, high development difficulty, complex parameters, and challenging debugging of operating systems, there may be problems that were not fully considered during the initial design phase or errors that went undetected during development. Real-time operating systems have high requirements for correctness and security, and the management of complex data structures within the kernel is a core function. Therefore, verifying the complex data structures within the kernel has always been of paramount importance.

[0003] Complex data structures are difficult to describe in a standardized way due to the combination and nesting of various data structures. Currently, most methods model the kernel requirements at a high level in the program abstraction layer. This method hides the program details and expresses the properties in an abstract way. Although the verification is relatively simple, it is somewhat insufficient for verifying the properties of many complex structures. There are also methods that use semantic decomposition and memory separation to formally describe and verify complex data structures in the operating system kernel. However, these methods do not involve the problem of proving and verifying the semantic consistency of the program before and after decomposition.

[0004] Therefore, under the existing technology, high-level abstract modeling and program structure decomposition are difficult to meet the verification requirements of specific programs that operate on complex data structures, resulting in problems of high abstraction level and low verification efficiency. Summary of the Invention

[0005] The purpose of this invention is to provide a formal verification method for complex data structures in operating system kernels, so as to overcome the shortcomings of existing technologies in verifying the security and reliability of operating system kernels.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A formal verification method for complex data structures in operating system kernels includes the following steps:

[0008] S1. Establish a memory model based on memory blocks: Define and describe the operations of complex data structures in the form of functions, so that the data and structure operations at the program level are mapped to abstract physical memory;

[0009] S2. Based on the memory model, formally define and describe the operational properties of memory objects, establish reasoning rules based on memory state semantics, and obtain assertions for different states during memory operations;

[0010] S3. Describe the state of abstract memory and memory blocks at the program level, and establish a semantic model by defining grammars and semantics that conform to the description of complex structures.

[0011] S4. Based on the semantic model, the extended Hall logic is obtained, and reasoning is performed through symbolic program logic to obtain the extended Hall logic reasoning;

[0012] S5. Establish a mapping from memory model to program semantics, apply the semantic model to inference rules based on memory operations, and establish a consistency relationship between the high-level program layer and the low-level abstract memory layer: map the high-level reasoning and proof about complex data structure operations to the low-level memory space operations, and establish a mapping relationship between the operations of data structure objects and specific memory objects.

[0013] S6. Combining the assertions of the abstract memory layer and the extended Hall logic reasoning, verify the operational properties of specific memory: Submit the memory state assertions and the extended Hall logic reasoning to the automatic theorem prover for proof, and verify whether the properties of the complex data structure meet the expectations.

[0014] Furthermore, the memory model is specifically established through the following methods:

[0015] S11. Determine memory blocks, divide memory into different blocks to describe memory objects and operations, and define basic data types for formal characterization and representation.

[0016] S12. Establish memory operations, map all data and structure operations in the program to abstract physical memory, and define and describe the basic operations on memory blocks in the form of uninterpreted functions, and identify the specific state of a memory block.

[0017] Furthermore, the assertions for different states during the memory operation are obtained through the following methods:

[0018] S21. Define the semantics of the memory model, describe the properties related to the semantics, thereby obtaining the reasoning rules for different memory operations, define the preconditions and postconditions of memory operations, and characterize the state changes of memory due to operations.

[0019] S22. Establish memory state transitions caused by operations. Based on the preconditions and postconditions of memory operations, model and describe the memory state transitions to obtain assertions on the correctness and safety of different memory operations.

[0020] Furthermore, the semantic model is established in the following ways:

[0021] S31. At the program level, describe the state of abstract memory and memory blocks, and abstract the specific memory state as: State = M * B, where M represents the abstract memory state of the program and B represents the value in the memory block under the current memory state.

[0022] S32. Describe the continuous abstract domains of the program and use list operators to illustrate the form of more general complex data structures: describe the mapping of concrete domains to memory space and their linked list form, define the syntax rules at the program level, and transform function calls into operations on abstract memory states.

[0023] Furthermore, establishing a consistency relationship between the high-level program layer and the low-level abstract memory layer specifically includes the following steps:

[0024] S51. Define the semantics of the abstract program of abstract memory, and describe the memory state that satisfies the given abstract program.

[0025] S52. Based on the program syntax and the definition and description of the memory model, define and logically reason about the program semantics; map specific program grammars to their respective specific memory spaces for evaluation, and then form axiomatic reasoning rules about the abstract memory space.

[0026] S53. Based on the specific semantics of the memory model, define and explain the logic-based reasoning rules of the program at the abstract memory layer;

[0027] S54. Extend the definition of basic Hall-like logical reasoning to obtain a formalized inference based on the program described by the memory model.

[0028] Furthermore, the operation verification specifically includes the following steps:

[0029] S61. Submit the obtained memory state assertions and extended Hall logic reasoning to the theorem solver in the form of a script;

[0030] S62. If the output is "sat", it means that the relevant properties of this part of the data structure meet the expectations; if the output is "unsat", it means that the relevant properties of this part of the data structure do not meet the expectations.

[0031] As can be seen from the above technical solutions, this invention establishes a memory model based on memory blocks, defining and describing the operations of complex data structures in functional form, and incorporating information such as type and byte size into the operation definitions, thus more accurately describing the operational properties of data structure objects. Simultaneously, for the abstract program layer, a grammar and semantics conforming to the description of complex structures are defined, along with consistency relationships based on memory object operations, establishing a mapping relationship between data structure objects and operations on concrete memory objects. Furthermore, reasoning is performed through symbolic program logic, describing and inferring at the abstract memory layer, and formally verifying operations on concrete memory. At the same time, static analysis methods are used to automatically verify the operation-based properties of complex data structures, improving the accuracy and precision of the verification. This achieves efficient and accurate formal verification of complex data structures in the operating system kernel. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the steps of the formal verification method of the present invention;

[0033] Figure 2 This is a flowchart illustrating the verification and testing process of this invention applied to an embedded operating system kernel.

[0034] Figure 3 This is a schematic diagram illustrating the verification and testing of the present invention applied to an embedded operating system kernel. Detailed Implementation

[0035] A preferred embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

[0036] like Figure 1 The formal verification method for complex data structures in the operating system kernel, as shown, includes the following steps:

[0037] S1. Establish a memory model based on memory blocks: Define and describe the operations of complex data structures in the form of functions, so that the data and structure operations at the program level are mapped to abstract physical memory.

[0038] The memory model described in this preferred embodiment is based on memory blocks, so the memory blocks need to be determined first. Specifically, memory objects and operations are described by dividing memory into different blocks, and basic data types, such as data type and byte size, are defined to achieve formal characterization and representation. Then, memory operations are established, including allocation, reading, writing, and deallocation. All data and structure operations in the program are mapped to abstract physical memory, and basic operations on memory blocks are defined and described in the form of uninterpreted functions, identifying the specific state of a memory block. Specifically, for each memory operation, its behavior and semantics are defined, such as how the value of the memory block changes with a "write" operation.

[0039] S2. Based on the memory model, formally define and describe the operational properties of memory objects, establish reasoning rules based on memory state semantics, and obtain assertions for different states during memory operations.

[0040] This preferred embodiment defines the semantics of the memory model and describes the properties related to the semantics, thereby obtaining the reasoning rules for different memory operations. It defines the preconditions and postconditions of memory operations and describes the changes in memory state due to operations. Then, it establishes the state transition of memory caused by operations. Based on the preconditions and postconditions of memory operations, it models and describes the transition of memory state through memory model expansion, and obtains the correctness and security assertions of different memory operations.

[0041] S3. At the program level, describe the state of abstract memory and memory blocks, and establish a semantic model by defining grammars and semantics that conform to the description of complex structures.

[0042] Specifically, the semantic model is established by abstracting the concrete memory state as: State = M * B, where M represents the abstract memory state of the program, and B represents the value in the memory block under the current memory state. For the description of continuous abstract domains of the program, list operators are used to illustrate the form of more general and complex data structures. This includes describing the mapping from concrete domains to memory space and their linked list form, defining the syntax rules at the program level, and transforming function calls into operations on the abstract memory state.

[0043] S4. Based on the semantic model, the extended Hall logic is obtained, and reasoning is performed through symbolic program logic to obtain the extended Hall logic reasoning.

[0044] S5. Establish a mapping from the memory model to the program semantics, apply the semantic model to the inference rules based on memory operations, and establish a consistency relationship between the high-level program layer and the low-level abstract memory layer: map the high-level reasoning and proof about complex data structure operations to the low-level memory space operations, and establish a mapping relationship between the operations of data structure objects and specific memory objects.

[0045] Specifically, establishing consistency between high-level and low-level operations first requires defining the semantics of the abstract program of abstract memory, indicating that a specific memory state satisfies a given abstract program. Then, based on the program syntax and the definition and description of the memory model, the program semantics are defined and logically reasoned. Next, specific program grammars are mapped to their respective specific memory spaces for evaluation, forming axiomatic reasoning rules about the abstract memory space. Based on the specific semantics of the memory model, logical reasoning rules for the program are defined and explained at the abstract memory layer. Furthermore, in order to perform formal inference on programs described based on the memory model, the basic Hall effect logical reasoning needs to be extended and defined.

[0046] S6. Combining the assertions of the abstract memory layer and the extended Hall logic reasoning, verification is performed on the operational properties of specific memory: The memory state assertions and extended Hall logic reasoning are submitted to an automatic theorem prover for proof, verifying whether the properties of complex data structures meet expectations. In the specific verification operation, the obtained memory state assertions and extended Hall logic reasoning are submitted to the automatic theorem solver in the form of a script for solution; if the output is "sat", it means that the relevant properties of that part of the data structure meet expectations; if the output is "unsat", it means that the relevant properties of that part of the data structure do not meet expectations. The results of the verification of data structure properties can directly reflect the security and reliability of the operating system kernel.

[0047] Specific implementation examples: such as Figure 2 The diagram shows the verification and testing flowchart of the technical solution of this invention applied in the embedded operating system kernel, which is implemented through the following steps:

[0048] Step 1: Based on the complex data structures in embedded operating systems, the kernel definition mainly involves complex data structures such as ready lists, suspended lists, event flags, messages, message pools, message queues, mutex semaphores, task control blocks, and clock lists. In the memory model, each data structure is mapped to a memory block to facilitate the definition and description of operations. Furthermore, to conform to the description of complex data structures, some special memory block structures need to be defined, such as linked list nodes.

[0049] The data structures and operation types existing in the kernel are extracted to prepare for building the memory model. In addition, based on the scheduling algorithm and resource management method adopted by the kernel, the task control block structure based on the time-slice scheduling strategy is defined, including all member variables of the structure, and the types and memory sizes of these variables are clearly defined in the definition.

[0050] In addition, to describe the operational properties of memory objects, this invention also defines memory operation types in the memory model. Memory operation types include read, write, allocate, and release operations, each corresponding to a specific behavior of a memory block or memory space. By defining these operation types, the access methods and constraints of memory objects can be described.

[0051] Step Two: Combining the operating system implementation language, use an extended C-like memory model to describe the data and operations in the program, provide a semantic description of the memory model based on C code, and obtain assertion expressions for each program point based on memory semantics. Since theoretical and empirical problems are built on an abstract foundation, they do not distinguish between the physical runtime environment of the operating system kernel.

[0052] Specifically, based on the defined semantics of the memory model, including descriptions of semantically related properties such as type and size definitions, and memory block access rules, inference rules for different memory operations are derived. Preconditions and postconditions for memory operations are defined, characterizing the state changes of memory due to operations. State transitions of memory caused by operations are established, and through modeling and analysis of memory states, assertions on the correctness and safety of different memory operations are obtained. Based on the state and state transitions of memory objects, operation-based memory state assertions are derived.

[0053] Step 3: At the program level, starting from the properties of complex structures and the functions involved in their operations, and using functions as the granularity during program execution, characterize the descriptive grammar and semantics of the operations on various data structures and structs during execution. For each function in the program, define its formal semantics, and establish the descriptive grammar and semantics of the operations on various data structures and structs during function execution. Based on this, establish a semantic model based on abstract memory operations, and obtain the Hall effect logical reasoning during the operation process.

[0054] Operations on the structure are performed within a specific context; that is, the parts above the function body do not actually modify the structure, but rather change the values ​​of some members within the structure. Preconditions and postconditions are defined for each function to characterize the state changes that occur due to the operation. Based on these conditions, state transitions to memory caused by the function are established. Through modeling and analyzing the memory state, assertions on the correctness and safety of different function operations are obtained.

[0055] Step 4: Extend the definition of basic Hall-form logical reasoning to enable formal inference of programs described by memory models.

[0056] Define the semantics of the abstract program in abstract memory. By defining memory states using data types and data structures in the programming language, and defining the operation functions for each data type and data structure, it can be stated that a specific memory state satisfies a given abstract program. Define the mapping rules between the memory model and program semantics, establish a consistency relationship between the high-level program layer and the low-level abstract memory layer, and ensure that the program's behavior is correctly implemented in memory. Based on the inference rules of memory operations, apply the semantic model to the verification and inference of the program.

[0057] like Figure 3 As shown, by mapping high-level reasoning and proofs regarding complex data structure operations to low-level memory space operations, a mapping relationship is established between data structure objects and concrete memory objects, thereby enabling efficient operation and management of data structure objects. For different types of data structure objects and memory objects, different mapping rules and operation methods need to be established, specifying the transition methods and basis for states at the abstract program level. Using the strongest post-conditional inference method for logical reasoning and judgment of the program allows formal assertions to contain more useful information about the program, enabling the expression and proof of the properties inherent in the specific program.

[0058] Step 5: Define the semantics of specific programs involving complex data structures and map them to an abstract memory layer. For the data structures that need to be verified, establish abstract memory state assertions to describe the properties that the memory state must satisfy. Based on the program syntax and memory model definition, formally model the data structure operations and type operations to form axiomatic reasoning rules about the abstract memory state. These rules can be used to verify the type compatibility, security, and consistency properties of the data structures.

[0059] The verification method described in this preferred embodiment starts from the specific program operating on complex structures, modeling and verifying data operations and type operations, without involving the decomposition and verification of complex structures. Among the main complex structures involved in the operation-ready task list program, the properties to be verified mainly fall into three categories: type compatibility, security, and consistency.

[0060] This invention uses an automatic theorem prover to verify the properties related to the data structure, based on program-level extended Hall logic reasoning and memory state assertions at the abstract memory level. The prover can automatically reason and verify the properties satisfied by the memory state and output the verification results. The security and reliability of the operating system kernel can be determined from the prover's output. If the verification is successful, it indicates that the data structure satisfies the properties, and the operating system kernel is secure and reliable. If the verification fails, further analysis and correction are required. This verifies the security and reliability of the operating system kernel.

[0061] The above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A formal verification method for complex data structures in an operating system kernel, characterized in that, Includes the following steps: S1. Establish a memory model based on memory blocks: Define and describe the operations of complex data structures in the form of functions, so that the data and structure operations at the program level are mapped to abstract physical memory; The memory model is specifically established using the following methods: S11. Determine memory blocks, divide memory into different blocks to describe memory objects and operations, and define basic data types for formal characterization and representation. S12. Establish memory operations, map all data and structure operations in the program to abstract physical memory, and define and describe the basic operations on the memory block in the form of uninterpreted functions, and identify the specific state of a memory block. S2. Based on the memory model, formally define and describe the operational properties of memory objects, establish reasoning rules based on memory state semantics, and obtain assertions for different states during memory operations; S3. Describe the state of abstract memory and memory blocks at the program level, and establish a semantic model by defining grammars and semantics that conform to the description of complex structures. S4. Based on the semantic model, the extended Hall logic is obtained, and reasoning is performed through symbolic program logic to obtain the extended Hall logic reasoning; S5. Establish a mapping from memory model to program semantics, apply the semantic model to inference rules based on memory operations, and establish a consistency relationship between the high-level program layer and the low-level abstract memory layer: map the high-level reasoning and proof about complex data structure operations to the low-level memory space operations, and establish a mapping relationship between the operations of data structure objects and specific memory objects. Establishing a consistency relationship between the high-level program layer and the low-level abstract memory layer specifically includes the following steps: S51. Define the semantics of an abstract program for abstract memory, and describe the memory state that satisfies a given abstract program; S52. Based on the program syntax and the definition and description of the memory model, define and logically reason about the program semantics; map specific program grammars to their respective specific memory spaces for evaluation, and then form axiomatic reasoning rules about the abstract memory space. S53. Based on the specific semantics of the memory model, define and explain the logic-based reasoning rules of the program at the abstract memory layer; S54. Extend the definition of basic Hall-like logical reasoning to obtain a formalized inference based on the program described by the memory model; S6. Combining the assertions of the abstract memory layer and the extended Hall logic reasoning, verify the operational properties of specific memory: Submit the memory state assertions and the extended Hall logic reasoning to the automatic theorem prover for proof, and verify whether the properties of the complex data structure meet the expectations.

2. The formal verification method for complex data structures in operating system kernels according to claim 1, characterized in that, The assertions for different states during the memory operation are obtained through the following methods: S21. Define the semantics of the memory model, describe the properties related to the semantics, thereby obtaining the reasoning rules for different memory operations, define the preconditions and postconditions of memory operations, and characterize the state changes of memory due to operations. S22. Establish memory state transitions caused by operations. Based on the preconditions and postconditions of memory operations, model and describe the memory state transitions to obtain assertions on the correctness and safety of different memory operations.

3. The formal verification method for complex data structures in operating system kernels according to claim 1, characterized in that, The semantic model is established in the following ways: S31. Describe the state of abstract memory and memory blocks at the program level, and abstract the specific memory state as follows: ,in This represents the abstract memory state of the program. This represents the value in the memory block in the current memory state; S32. Describe the continuous abstract domains of the program and use list operators to illustrate the form of more general complex data structures: describe the mapping of concrete domains to memory space and their linked list form, define the syntax rules at the program level, and transform function calls into operations on abstract memory states.

4. The formal verification method for complex data structures in operating system kernels according to claim 1, characterized in that, The verification specifically includes the following steps: S61. Submit the obtained memory state assertions and extended Hall logic reasoning to the theorem solver in the form of a script; S62. If the output is "sat", it means that the relevant properties of the data structure meet the expectations; if the output is "unsat", it means that the relevant properties of the data structure do not meet the expectations.

Images