Balancing the Load

Abstract

We have developed a stack of semantics for a high-level C-like language and low-level assembly code, which has been carefully crafted to support the pervasive verification of system software. It can handle mixed-language implementations and concurrently operating devices, and permits the transferral of properties to the target architecture while obeying its resource restrictions. We demonstrate the applicability of our framework by proving the correct virtualization of user memory in our microkernel, which implements demand paging. This verification target is of particular interest because it has a relatively simple top-level specification and it exercises all parts of our semantics stack. At the bottom level a disk driver written 390 E. Alkassar et al.in assembly implements page transfers via a swap disk. A page-fault handler written in C uses the driver to implement the paging algorithm. It guarantees that a step of the currently executing user can be simulated at the architecture level. Besides the mere theoretical and technical difficulties the project also bore the social challenge to manage the large verification effort, spread over many sites and people, concurrently contributing to and maintaining a common theory corpus. We share our experiences and elaborate on lessons learned.

Formal Verification of Integrity-Preserving Countermeasures Against Cache Storage Side-Channels

“…The result of this analysis are theorems in Sect. 4.3. They demonstrate that a software satisfying a set of proof obligations (i.e., correctly implementing the countermeasure) is not vulnerable because of cache storage channels.…”

“…Recent works on kernel and hypervisor verification [8,10,[17][18][19]21,24,25,33,34] all assume a sequential memory model and leave cache issues to be managed by model external means, while the CVM framework [4] treats caches only in the context of device management [23]. In [21], a cacheless model was used to prove security of the hypervisor used here as a case study.…”

“…Formal verification of low-level software such as microkernels, hypervisors, and drivers has made big strides in recent years [3,4,17,21,22,33,37,38]. We appear to be approaching the point where the promise of provably secure, practical system software is becoming a reality.…”

Cache Storage Channels: Alias-Driven Attacks and Verified Countermeasures

“…The attacker uses the algorithm presented in Figure 2, however several considerations must be taken into account to make the attack practical. The attacker repeats the filling and probing phases for each possible line index (128) and way (4) of the data-cache. In practice, since the cache eviction strategy is pseudo random, the filling phase is also repeated several times, until the L1 cache is completely filled with the probing data (i.e.…”

“…The verification of both seL4 [29] and the Prosper kernels [18], [33] assume that caches are invisible and ignore timing channels. The CVM framework from the Verisoft project [4] treats caches only in the context of device management [24]. For the verification of user processes and the remaining part of the kernel, caches are invisible.…”