Hardware Podcasts

Software Verificationpalooza

Oxide and Friends · 20 Jun 2023 · 1h 21m · Episode 17

What this episode covers

Greg Colombo and Rain Paharia from Oxide Computer Company discuss rigorous software verification methods, specifically TLA+ for model checking distributed systems and the proptest Rust crate for property-based testing. Greg explains how he used TLA+ to verify the orchestration of live VM migration, uncovering race conditions and bugs in the control plane that were difficult to reproduce with standard integration tests. Rain details his use of proptest to validate complex data structures like 'buff-list' and 'Guppy' by comparing them against oracles like the standard library and Cargo, finding numerous bugs in both his code and upstream dependencies. The episode highlights how formal methods and property-based testing serve as complementary tools for ensuring correctness in high-concurrency, distributed environments.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Oxide Computer Company
Products
buff-list, Guppy, Mononoke
Tools
TLA+, proptest, QuickCheck, Hypothesis, Cargo, Alloy
Also
Hillel Wayne

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Pragmatic Embedded Podcast · 48m

    Fuzzing and Dynamic Analysis for High-Integrity Software with Paul Butcher

    Paul Butcher, Unit Director of Dynamic Analysis at AdaCore, explains how dynamic analysis techniques like fuzzing find corner-case bugs that traditional unit testing misses in high-integrity software. He details the mechanics of fuzzing, including mutation engines and anomaly detection, and discusses challenges with timing and concurrency in embedded systems, citing success with the NH90 avionics MIL bus. Butcher also describes combining static analysis with targeted fuzzing to automatically triage false positives and generate reproducers, while touching on formal verification using SPARK for the London Underground's Victoria line and the cautious role of LLMs in verification workflows.

    Debugging & failure analysisEmbedded firmware
    8 chapters

  • Robot Talk · 24m

    Episode Thirty: Ana Cavalcanti

    Professor Ana Cavalcanti from the University of York and the RoboStar Centre of Excellence discusses the challenges of verifying software for autonomous mobile robots. She critiques the industry's reliance on code-centric development and simulation, arguing for model-based engineering to ensure safety and trustworthiness in service robots. Cavalcanti explains how her team uses mathematical foundations to verify system properties before coding begins, addressing the multidisciplinary nature of robotics.

    Embedded firmwareDebugging & failure analysis
    7 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

  • Embedded.fm · 57m

    109: Resurrection of Extreme Programming (Repeat)

    James Grenning, founder of Wingman Software and author of 'TDD for Embedded C', discusses the resurgence of Extreme Programming and Test-Driven Development (TDD) for embedded engineers. He explains how TDD prevents bugs and improves code quality, contrasting it with the micromanagement often associated with modern Scrum. Grenning also details his methods for teaching TDD, including the use of CyberDojo for remote training and 'Training from the Back of the Room' techniques to engage students.

    Embedded firmwareCareers & education
    8 chapters

  • IoT For All Podcast · 22m

    Mission Critical Devices and Formal Methods | Kry10's Boyd Multerer | Internet of Things Podcast

    Boyd Multerer, CEO of Kry10 and former Xbox lead, explains how lessons from game console security apply to mission-critical IoT devices, emphasizing the need for isolation and secure updates. He discusses the shift from monolithic kernels to microkernels verified by formal methods, citing the seL4 kernel and DARPA's HACMS program as proof that mathematically proven code can eliminate entire classes of attacks. Multerer warns that new regulations like the European Cyber Resilience Act are making software liability comparable to hardware liability, forcing companies to adopt zero-trust architectures and formal verification to mitigate risk.

    Security & privacyEmbedded firmware
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Oxide and Friends. The episode itself belongs to its publisher.