Physical Addressing on Real Hardware in Isabelle/HOL

Achermann, Reto; Humbel, Lukas; Cock, David; Roscoe, Timothy

doi:10.1007/978-3-319-94821-8_1

Cited by 8 publications

(8 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Decoding nets can accurately capture memory topologies of real hardware [3]. Here we show that our Sockeye-generated page tables and memory maps suffice to boot an OS kernel on real hardware.…”

Section: Real Platformsmentioning

confidence: 78%

See 1 more Smart Citation

Generating correct initial page tables from formal hardware descriptions

Achermann

Cock

Haecki

et al. 2021

Proceedings of the 11th Workshop on Programming Languages and Operating Systems

Self Cite

View full text Add to dashboard Cite

Modern hardware platforms are increasingly complex and heterogeneous. System software uses a hodgepodge of different mechanisms and representations to express the memory topology of the target platform. Considerable maintenance effort is required to keep them in sync while often sharing is impossible due to hard-coded values. Incorrect platformspecific values in the hardware initialization sequence can lead to security critical and hard-to-find bugs because of misconfigured translation hardware, inaccessible devices, or the use of bad pointers.We present a better way for system software to express and initialize memory hardware. We adopt an existing, powerful hardware description language, and efficiently compile it to generate correct initial page tables and memory maps for OS kernels and firmware from a single system description. We evaluate our system on multiple architectures and platforms, and demonstrate that we can use the generated data structures to successfully initialize translation hardware, devices, memory maps, and allocators enabling easy support of new hardware platforms.

show abstract

Section: Real Platformsmentioning

confidence: 78%

“…We begin with our formally specified model, the decoding net [2,3]. We have shown it captures the memory topology of a broad variety of hardware platforms in a rigorous and welldefined way.…”

Section: Decoding Netsmentioning

confidence: 99%

Generating correct initial page tables from formal hardware descriptions

Achermann

Cock

Haecki

et al. 2021

Proceedings of the 11th Workshop on Programming Languages and Operating Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…Our new model builds on the existing decoding net model of Achermann et al [1,2], which has been shown to provide a precise formal model of many of the sorts of systems we consider in this work: Multi-socket NUMA systems, ARM SoCs, plug-in accelerators, etc.…”

Section: Methodsmentioning

confidence: 99%

A Least-Privilege Memory Protection Model for Modern Hardware

Achermann,

Hossle,

Humbel

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

We present a new least-privilege-based model of addressing on which to base memory management functionality in an OS for modern computers like phones or server-based accelerators. Existing software assumptions do not account for heterogeneous cores with different views of the address space, leading to the related problems of numerous security bugs in memory management code (for example programming IOMMUs), and an inability of mainstream OSes to securely manage the complete set of hardware resources on, say, a phone System-on-Chip.Our new work is based on a recent formal model of address translation hardware which views the machine as a configurable network of address spaces. We refine this to capture existing address translation hardware from modern SoCs and accelerators at a sufficiently fine granularity to model minimal rights both to access memory and configure translation hardware. We then build an executable specification in Haskell, which expresses the model and metadata structures in terms of partitioned capabilities. Finally, we show a fully functional implementation of the model in C created by extending the capability system of the Barrelfish research OS.Our evaluation shows that our unoptimized implementation has comparable (and in some cases) better performance than the Linux virtual memory system, despite both capturing all the functionality of modern hardware addressing and enabling least-privilege, decentralized authority to access physical memory and devices.

show abstract

“…We leverage our recent work on representing complex addressing in a modern SoC as a decoding net [2]. In our work, an address space or AS is simply a function from "virtual" addresses to either physical resources or another address space, and the system is represented by a directed graph whose nodes are ASes and whose arcs are mappings to other ASes.…”

Section: The Mmapx Programming Modelmentioning

confidence: 99%

mmapx

Achermann

Cock

Haecki

et al. 2021

Proceedings of the Workshop on Hot Topics in Operating Systems

Self Cite

View full text Add to dashboard Cite

Modern Systems-on-Chip (SoCs) are networks of heterogeneous cores, intelligent devices, and memory, connected through multiple configurable address translation and protection units like IOMMUs and System MMUs.Modern OS kernels like Linux are based on traditional MMUs and have no clear abstractions to represent this complexity, mostly leaving IOMMU configuration to device drivers. This has led to a recent spate of serious bugs, and increasing concern over "cross-SoC" attacks on memory security.To address this, we propose a new kernel primitive, mmapx, based on a decoding net a rich and detailed representation of the memory addressing semantics of a complex SoC from the recent formal methods literature. mmapx provides a uniform facility for securely configuring all the address translation facilities in a system. mmapx leverages existing Unix facilities wherever possible: the file system for naming, discovery, and coarse-grained access control, and file descriptors for fine-grained authorization. We show how mmapx can eliminate bugs caused by device drivers programming IOMMUs directly, but also the detail captured by the underlying model has further benefits while incurring minimal overhead.

show abstract

Physical Addressing on Real Hardware in Isabelle/HOL

Cited by 8 publications

References 9 publications

Generating correct initial page tables from formal hardware descriptions

Generating correct initial page tables from formal hardware descriptions

A Least-Privilege Memory Protection Model for Modern Hardware

mmapx

Contact Info

Product

Resources

About