Re: [Ksummit-discuss] [TECH TOPIC] A Safety-critical Linux system architecture

[Linus Walleij <linus.walleij@linaro.org>]

On Wed, Sep 12, 2018 at 3:18 AM Tiejun Chen <tiejunc@vmware.com> wrote:

> software contexts need to be certified according to different specifications
> like ARINC 653, Automotive Safety Integrity Level, and so on. So we
> need to explore making Linux itself certified.

There is a bunch of these certifications and specifications. Many of them
include manual review of "all code on the system", which is why several
approaches to this includes stripping down the kernel source to only
the code (after removing all Kconfig buzz and ifdefs) that will compile
and run on the target.

This should of course be possible to integrate into the existing Linux
build system, like "make sources" that would create a reduced
kernel tree that will also compile (russian matroska dolls come to
mind). I think such projects exist in Japan but I haven't heard from
them recently.

My pet peeve is that the review process appears to be something
along the lines that a "certified person/consultant" who has training
in this standard is supposed to review all the code for safety, so
after reviewing IMO we should work on (A) making sure that these
reviews and comments and the exact lines of the kernel and which
version/commit ID of it it pertains to is made public and (B) that the
review persons statement be merged into the kernel git log as
some kind of annotation along the lines of:

Reviewed-for-ISO-26262-by: Linus Walleij <linus.walleij@linaro.org>

This way we can help the safety community by making the safety
critical review process more open and public, and also making these
reviewers put their personal names behind it.

If they also propose patches and follow up on them: even better.

The idea is not (as one could maybe think) that of public shaming
for all the stuff these people invariably are going to miss, but to
create a space where they can learn about the kernel and the
weaknesses pertaining to safety critical deployments and also
spread this knowledge to kernel maintainers instead of keeping
it all in their private safety engineering bubble.

Yours,
Linus Walleij