Towards high-assurance multiprocessor virtualisation

Authors

Michael von Tessin

NICTA, Sydney, Australia
UNSW, Australia

Abstract

Virtualisation is increasingly being used in security-critical systems to provide isolation between system components. Being the foundation of any virtualised system, hypervisors need to provide a high degree of assurance with regards to correctness and isolation. Microkernels, such as seL4, can be used as hypervisors. Functional correctness of seL4's uniprocessor C implementation has been formally verified. The framework employed to verify seL4 is tailored to facilitate reasoning about sequential programs. However, we want to be able to use the full power of multiprocessor/multicore systems, and at the same time, leverage the high assurance seL4 already gives us for uniprocessors.

This work-in-progress paper explores possible multiprocessor designs of seL4 and their amenability to verification. For the chosen design, it contributes a formal multiprocessor execution model to lift seL4's uniprocessor model and proofs into a multiprocessor context using only minor modifications. The theorems proving the validity of the lift operation are machine-checked in Isabelle/HOL and walked-through in the paper.

BibTeX Entry

  @inproceedings{vonTessin_10,
    publisher        = {EasyChair},
    author           = {von Tessin, Michael},
    series           = {EasyChair Proceedings in Computing},
    issn             = {2040-557X},
    month            = {jul},
    volume           = {3},
    editor           = {Markus Aderhold and Serge Autexier and Heiko Mantel},
    year             = {2010},
    title            = {Towards High-Assurance Multiprocessor Virtualisation},
    booktitle        = {Proceedings of the 6th International Verification Workshop},
    pages            = {110--125},
    address          = {Edinburgh, UK}
  }

Download

Served by Apache on Linux on seL4