Completing the Automated Verification of a Small Hypervisor – Assembler Code Verification

Certified Programs and Proofs

2013

Abstract. In this paper, we formally verify security properties of the ARMv7 Instruction Set Architecture (ISA) for user mode executions. To obtain guarantees that arbitrary (and unknown) user processes are able to run isolated from privileged software and other user processes, instruction level noninterference and integrity properties are provided, along with proofs that transitions to privileged modes can only occur in a controlled manner. This work establishes a main requirement for operating system and hypervisor veri cation, as demonstrated for the PROSPER separation kernel. The proof is performed in the HOL4 theorem prover, taking the Cambridge model of ARM as basis. To this end, a proof tool has been developed, which assists the veri cation of relational state predicates semi-automatically.

Section: Related Workmentioning

confidence: 99%

Machine Assisted Proof of ARMv7 Instruction Level Isolation Properties

Khakpour

Schwarz

Certified Programs and Proofs

2013

“…The main precursor work on formally verified MMU virtualization uses the simulationbased approach of Paul et al [5,41,4]. In [5,41] shadow page tables are used to provide full virtualization, including virtual memory, for "baby VAMP", a simplified MIPS, using VCC.…”

Section: Discussionmentioning

confidence: 99%

“…The Hyper-V hypervisor which uses shadow pages on x86, has been formally verified using the semi automated VCC tool [34]. Related work [5,41] uses shadow page tables to provide full virtualization, including virtual memory, for "baby VAMP", a simplified MIPS, using VCC. This work, along with later work [4] on TLB virtualization for an abstract mode of x64, has been verified using Wolfgang Paul's VCC-based simulation framework [13].…”

Section: Related Workmentioning

confidence: 99%

Provably secure memory isolation for Linux on ARM

Guanciale

Nemati

et al. 2016

JCS

The isolation of security critical components from an untrusted OS allows to both protect applications and to harden the OS itself. Virtualization of the memory subsystem is a key component to provide such isolation. We present the design, implementation and verification of a memory virtualization platform for ARMv7-A processors. The design is based on direct paging, an MMU virtualization mechanism previously introduced by Xen. It is shown that this mechanism can be implemented using a compact design, suitable for formal verification down to a low level of abstraction, without penalizing system performance. The verification is performed using the HOL4 theorem prover and uses a detailed model of the processor. We prove memory isolation along with information flow security for an abstract top-level model of the virtualization mechanism. The abstract model is refined down to a transition system closely resembling a C implementation. Additionally, it is demonstrated how the gap between the low-level abstraction and the binary level-can be filled, using tools that check Hoare contracts. The virtualization mechanism is demonstrated on real hardware via a hypervisor hosting Linux and supporting a tamper-proof run-time monitor that provably prevents code injection in the Linux guest.

QC 20161212

PROSPER, CERCE

“…However, little detailed information about the Hyper-V internal structure or the Hyper-V verification exercise is publicly available. As part of the Hyper-V verification project, a hypervisor for a simplified, MIPS-like architecture including memory virtualization is described in [3,21]. However, the relation of the simplified hypervisor to Hyper-V itself is not clear.…”

Section: Discussionmentioning

confidence: 99%

“…The Hyper-V hypervisor, which uses shadow pages on x86, has been formally verified using the semi automated VCC tool [17]. Related work [3,21] uses shadow page tables to provide full virtualization, including virtual memory, for "baby VAMP", a simplified MIPS, using VCC. This work, along with later work on TLB virtualization for an abstract mode of x64 [2], has been verified using Wolfgang Paul's VCC-based simulation framework.…”

Section: Related Workmentioning

confidence: 99%

Trustworthy Memory Isolation of Linux on Embedded Devices

Nemati

Trust and Trustworthy Computing

Guanciale

et al. 2015

Abstract. The isolation of security critical components from an untrusted OS allows to both protect applications and to harden the OS itself, for instance by run-time monitoring. Virtualization of the memory subsystem is a key component to provide such isolation. We present the design, implementation and verification of a virtualization platform for the ARMv7-A processor family. Our design is based on direct paging, an MMU virtualization mechanism previously introduced by Xen for the x86 architecture, and used later with minor variants by the Secure Virtual Architecture, SVA. We show that the direct paging mechanism can be implemented using a compact design, suitable for formal verification down to a low level of abstraction, without penalizing system performance. The verification is performed using the HOL4 theorem prover and uses a detailed model of the ARMv7-A ISA, including the MMU. We prove memory isolation of the hosted components along with information flow security for an abstract top level model of the virtualization mechanism. The abstract model is refined down to a HOL4 transition system closely resembling a C implementation. The virtualization mechanism is demonstrated on real hardware via a hypervisor capable of hosting Linux as an untrusted guest. 1