End-to-End Mechanized Proof of an eBPF Virtual Machine for Micro-controllers

Abstract

RIOT is a micro-kernel dedicated to IoT applications that adopts eBPF (extended Berkeley Packet Filters) to implement so-called femto-containers. As micro-controllers rarely feature hardware memory protection, the isolation of eBPF virtual machines (VM) is critical to ensure system integrity against potentially malicious programs. This paper shows how to directly derive, within the Coq proof assistant, the verified C implementation of an eBPF virtual machine from a Gallina specification. Leveraging the formal semantics of the CompCert C compiler, we obtain an end-to-end theorem stating that the C code of our VM inherits the safety and security properties of the Gallina specification. Our refinement methodology ensures that the isolation property of the specification holds in the verified C implementation. Preliminary experiments demonstrate satisfying performance.

Femto-containers

“…The most closely related work was published in [39] and in [38]. In [39], authors provide rBPF, a port of the eBPF instruction set in order to host a (single) VM on a microcontroller.…”

“…In contrast, we extend rBPF's instruction set architecture and VM core with an adequate embedded loading and execution environment, which caters for well-defined, event-driven, short lived and isolated (concurrent) execution of (multiple) functions to be deployed on-the-fly on a networked microcontroller. On the other hand, while [38], concerns formal verification of the sole rBPF instruction interpreter, here we also verify the pre-flight instruction checker and we integrate both in our femto-container implementation -the performance of which we thoroughly evaluate on various microcontrollers. Our design and implementation are so small (a few hundreds lines of code) that formal verification was indeed realistic.…”

“…Formal verification details. The Coq models and proofs used to obtain CertFC are presented in [38] and available from [1].…”

Automatic Bit- and Memory-Precise Verification of eBPF Code

“…Then, they are compiled to eBPF with LLVM. For a variant of eBPF for embedded systems, CertrBPF [63] provides a formally verified compiler. All extra memory, i.e.…”