Roberto Guanciale Estonian Winter School Day 02 Formal verification of low-level execution platforms
Apps OS Hardware Host 1 Motivations
Apps Crypto Service OS Hypervisor/ Separation Kernel Hardware Host 1 Motivations
Separation Kernel / Hypervisor Hosting untrusted SW (hypervisors host operating systems) Hosting trusted critical SW Supporting CPU sharing Spatial isolation Context switch Communications
5 minute course on computer architecture (ARMv7) Registers (Program Counter) ● Flags ● Fetches instruction from memory ● Executes arithmetical instructions ● Loads/Stores data from/to memory ● Has several mode of operations (PL0/PL1) ● Multiplexed ●
5 minute course on computer architecture Contains instructions ● Contains data (heap/stack/etc) ● Is a big table from physical addresses ● to bytes Partitioned ●
5 minute course on computer architecture Load/Store Load/Store PA VA MMU Exceptions Page Tables Translates virtual addresses to ● physical addresses Configured via page tables (stored in ● memory) and coprocessors for every va • corresponding pa (if mapped) • access rights (rd/wt) • required mode • Enforce access policies ●
5 minute course on computer architecture Load/Store Load/Store PA VA MMU Exceptions Page Tables From PL1 to PL0 ● Special instruction • Jump to an arbitrary address • From PL0 to PL1 ● Exceptions / Instruction to raise a SW interrupt • jump to a fixed address (exception handler) •
ISA model ● ● ●
ISA model ● ● ● ● ● ●
Cooperative scheduling Static memory allocation Crypto OS Message passing Service Paravirtualization Hypervisor No preemption Hardware
Cooperative scheduling Static memory allocation Crypto OS Message passing Service Paravirtualization Hypervisor No preemption Hardware executed in PL1 ● invoked via SW interrupt ● supervises page tables ●
A trace of the system
A trace of the system Context switch: page tables are updated blue-registers are stored red-registers are loaded
Security property Non-interference ●
Security property Non-interference ●
Security property Non-interference ●
Security property Non-interference ●
Security property Non-interference ●
Security property Non-interference ● Does not work: the two partitions communicate!
Crypto Software Service Hardware Hardware Top Level Host 1 Host 2 Specification
Top level specification (ideal world) Two physically separated machine ● Only one machine active ● No PL1 computation ●
Top level specification (ideal world) Two physically separated machine ● Only one machine active ● No PL1 computation ● ?
Top level specification (ideal world) Two physically separated machine ● Only one machine active ● No PL1 computation ● Ideal Functionality
Top level specification (ideal world) Two physically separated machine ● Only one machine active ● No PL1 computation (replaced by atomic functionalities) ● Ideal Functionality
Top level specification (ideal world) Two physically machines (one active) ● and hypervisor data
Top level specification (ideal world) Two physically machines (one active) ● and hypervisor data Standard computations ● have standard effects
Top level specification (ideal world) Two physically machines (one active) ● and hypervisor data Standard computations ● have standard effects Exceptions activate the ● ideal functionalities
Verification Strategy Trace equivalence ● Unwinding condition based on bisimulation ●
Verification Strategy Bisimulation ●
Verification Strategy Bisimulation ● Weak transitions
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
OS2 OS1 OS1 OS2 Bisimulation Hypervisor Reg Reg Reg h
Exercise Assuming non-interference property of H: H only depends ● on the active machine • on the content of the memory of other machine at address • OUT2 (OUT1) Assuming non-interference property for guest 2: region of memory ● in MEM2 that includes OUT2 does not depend on the content of region K2
Proof Decomposition: PL0 transitions Non-interference for ARMv7 ● Non dependent by the kernel code ● Non dependent by the partition code ●
Proof Decomposition: PL1 transitions Functional correctness ● The handlers code respects the specification ●
PL0 proof Non dependent by the kernel code / guest code ● have to be done for every possible instruction • Strategy ● prove SW independent theorems assuming properties of the • system verify that our SW meets this assumptions •
PL0 proof: ISA integrity
PL0 proof: ISA integrity
PL0 proof: ISA integrity
PL0 proof: ISA integrity
Exercise When is an equivalence relation? ● Reflexive ● Symmetric ● Transitive ●
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
PL0 proof: ISA confidentiality
Proof obligation (O1): page tables
PL0 Proof: memory equality If machine 1 is active then machine 2 is unchanged ● from O1 and T1 we know that in the real machine the memory ● MEM2 is unchanged thus the equivalence between the real machine and machine 2 for ● MEM2 is preserved
PL0 Proof: memory equality from O1 and T2 we know that the behavior of both the real machine ● and machine 1 depends only on memory in MEM1 thus the equivalence between the real machine and machine 1 for ● MEM1 is preserved
Proof obligation (O2): page tables
PL0 Proof: invariants and hypervisor data-structures from definition of TLS we know that the hypervisor data can not be ● changed from O2 and T1 we know that in the real machine the memory that ● holds these structure can not be changed from O2 and T1 we know that the invariants are preserved ●
Exercise Extend the model and proofs to handle a Memory Mapped device ● (UART) Address DevOut can be used to write something • Address DevIn can be used to read something • Device fetches and writes into these addresses • Partition 2 should be in control of the device • Device transitions are interleaved with CPU transitions (assume • the device does not perform any action while the CPU is in PL1)
Exercise How should DMA devices be handled? ● Address DevOut can be used to write a pointer • Address DevIn can be used to write a pointer • Device fetches these pointers and writes/reads into the pointed • memory Partition 2 should be in control of the device •
Exercise Extend the toy CPU with a new instruction ●
Summary ISA model ● Verification Goal (via TLS) ● Proof decomposition ● Sketch of proof for PL0 ● Upcoming ● Verification for PL1 •
THANKS! Any questions? You can find me at robertog@kth.se http://prosper.sics.se/ References
Recommend
More recommend
