def spec_corollary_pgwalk(kernelstate):
pid = util.FreshBitVec('pid', dt.pid_t)
va = dt.FreshVA()
pml4 = kernelstate.procs[pid].page_table_root
# Abstract model of a page_walk starting from some root
page, writable, present = page_walk(kernelstate, pml4, *va)
# If a four level page-walk from some pid returns a page,
# that page must be exclusively owned by the pid.
# furthermore, if the page is writable,
# it has to be a frame.
isolation = util.Implies(
present, kernelstate.pages[page].owner == pid,
z3.Implies(
writable,
kernelstate.pages[page].type == dt.page_type.PAGE_TYPE_FRAME))
# valid(pid) & pid.state == active & valid(va) ==> page.owner == pid && page.type == FRAME (active is either EMBRYO, RUNNABLE or RUNNING)
return z3.ForAll([pid] + va,
z3.Implies(
z3.And(
is_pid_valid(pid),
is_status_live(kernelstate.procs[pid].state),
is_va_valid(va),
), isolation))
def spec_lemma_iommu_isolation(kernelstate):
conj = []
conj.append(spec_lemma_nr_pages_refcnt(kernelstate))
conj.append(spec_lemma_nr_devs_refcnt(kernelstate))
pn = util.FreshBitVec('pn', dt.pn_t)
idx = util.FreshBitVec('page_index', dt.size_t)
devid = util.FreshBitVec('devid', dt.devid_t)
# valid device can ensures valid device.owner, page table root's type must IOMMU_PML4
conj.append(
z3.ForAll(
[devid],
z3.Implies(
is_pn_valid(kernelstate.pci[devid].page_table_root),
z3.And(
is_pid_valid(kernelstate.pci[devid].owner),
kernelstate.pages[kernelstate.pci[devid].page_table_root].
type == dt.page_type.PAGE_TYPE_IOMMU_PML4,
kernelstate.pages[kernelstate.pci[devid].page_table_root].
owner == kernelstate.pci[devid].owner))))
conj.append(
z3.ForAll(
[pn, idx],
z3.Implies(
z3.And(
is_pn_valid(pn),
z3.ULT(idx, 512),
is_iommu_page_table_type(kernelstate.pages[pn].type),
dt.has_bit(kernelstate.pages[pn].data(idx), dt.PTE_P),
is_pid_valid(kernelstate.pages[pn].owner),
# If this proc has a device, nr_devs is non-zero.
# Devices can write regardless of proc status.
z3.Or(
is_status_live(kernelstate.procs[
kernelstate.pages[pn].owner].state),
kernelstate.procs[
kernelstate.pages[pn].owner].nr_devs() != 0),
),
z3.And(
# The iommu page table is highly-regular and there are basically
# two cases.
# The page table it self is made from pages in the `pages` array.
# And the last level are all dmapages from the `dmapages` array.
z3.Implies(
kernelstate.pages[pn].type !=
dt.page_type.PAGE_TYPE_IOMMU_PT,
z3.And(
kernelstate.pages[pn].data(idx) == (
kernelstate.pages_ptr_to_int +
kernelstate.pages[pn].pgtable_pn(idx) * 4096)
| kernelstate.pages[pn].pgtable_perm(idx),
is_pn_valid(kernelstate.pages[pn].pgtable_pn(idx)),
get_iommu_sub_type(
kernelstate.pages[pn].type) == kernelstate.
pages[kernelstate.pages[pn].pgtable_pn(idx)].type,
kernelstate.pages[kernelstate.pages[pn].pgtable_pn(
idx)].owner == kernelstate.pages[pn].owner,
)),
z3.Implies(
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_IOMMU_PT,
z3.And(
kernelstate.pages[pn].data(idx) == (
kernelstate.dmapages_ptr_to_int +
kernelstate.pages[pn].pgtable_pn(idx) * 4096)
| kernelstate.pages[pn].pgtable_perm(idx),
is_dmapn_valid(
kernelstate.pages[pn].pgtable_pn(idx)),
kernelstate.dmapages[
kernelstate.pages[pn].pgtable_pn(idx)].type ==
dt.page_type.PAGE_TYPE_IOMMU_FRAME,
kernelstate.dmapages[
kernelstate.pages[pn].pgtable_pn(
idx)].owner == kernelstate.pages[pn].owner,
)),
))))
return z3.And(*conj)
def spec_lemma_isolation(kernelstate):
conj = []
conj.append(spec_lemma_nr_pages_refcnt(kernelstate))
pn = util.FreshBitVec('pn', dt.pn_t)
idx = util.FreshBitVec('page_index', dt.size_t)
conj.append(
z3.ForAll(
[pn, idx],
z3.Implies(
z3.And(
# Arguments are valid
is_pn_valid(pn),
z3.ULT(idx, 512),
# This is a page table and the idx entry does have the P bit set
is_page_table_type(kernelstate.pages[pn].type),
(kernelstate.pages[pn].data(idx) & dt.PTE_P) != 0,
# The owner of this page has a valid pid and is either EMBRYO, RUNNABLE or RUNNING
is_status_live(
kernelstate.procs[kernelstate.pages[pn].owner].state),
is_pid_valid(kernelstate.pages[pn].owner),
),
z3.And(
z3.ULT(kernelstate.pages[pn].pgtable_type(idx),
dt.PGTYPE_NONE),
# The contents of the shadow pgatble correspond to the *actual*
# contents of those pages according to our pn->pfn mapping fn.
kernelstate.pages[pn].data(idx) == pgentry2pfn(
kernelstate,
kernelstate.pages[pn].pgtable_pn(
idx
), # page numbers. represent counts not a number
kernelstate.pages[pn].pgtable_perm(idx), # permission
kernelstate.pages[pn].pgtable_type(idx)), # page type
z3.Extract(62, 12, kernelstate.pages[pn].pgtable_perm(idx))
== z3.BitVecVal(0, 51), # 62 - 12 must 0
# For the specification each entry in the pgtable has a type.
# For each of those type, we must specify how it can appear in a
# the page table.
# If the entry is a page
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_PAGE,
z3.And(
# The entry must be a valid pn
is_pn_valid(kernelstate.pages[pn].pgtable_pn(idx)),
# The pn must be owned by the owner of the pgtable
kernelstate.pages[
kernelstate.pages[pn].pgtable_pn(idx)
].owner == kernelstate.pages[pn].owner,
# Either the subtypes match (PML4 => PDPT, PDPT => PD, etc) and is a unique mapping.
# Or PML4 points to a *read_only* PML4 page.
z3.Or(
z3.And(
get_sub_type(kernelstate.pages[pn].type) ==
kernelstate.pages[kernelstate.pages[pn].
pgtable_pn(idx)].type,
# The mapping from a pgtable <pn, idx> to a page is unique
kernelstate.pages[
kernelstate.pages[pn].pgtable_pn(idx)
].pgtable_reverse_pn == pn,
kernelstate.pages[
kernelstate.pages[pn].pgtable_pn(
idx)].pgtable_reverse_idx == idx,
),
z3.And(
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PML4,
kernelstate.pages[kernelstate.pages[pn].
pgtable_pn(idx)].type ==
dt.page_type.PAGE_TYPE_X86_PML4,
kernelstate.pages[pn].pgtable_perm(idx)
& dt.PTE_W == 0)))),
# If the entry is a proc
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_PROC,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are 3 proc pages (PS:dt.NPAGES_PROC_TABLE = 6) use 6 page tables keep process information.
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NPAGES_PROC_TABLE),
# proc pages can not be mapped writable
kernelstate.pages[pn].pgtable_perm(idx)
& dt.PTE_W == 0)),
# If the entry is a page_desc
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_PAGE_DESC,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are 15 page desc pages (ps: dt.NPAGES_PAGE_DESC_TABLE = 60)
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NPAGES_PAGE_DESC_TABLE),
# page desc pages can not be mapped writable
kernelstate.pages[pn].pgtable_perm(idx)
& dt.PTE_W == 0)),
# If the entry is file table
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_FILE_TABLE,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are 2 page desc pages
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NPAGES_FILE_TABLE),
# file tables can not be mapped writable
kernelstate.pages[pn].pgtable_perm(idx)
& dt.PTE_W == 0)),
# If the entry is devices
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_DEVICES,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are 64 page desc pages
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NPAGES_DEVICES),
# page desc pages can not be mapped writable
kernelstate.pages[pn].pgtable_perm(idx)
& dt.PTE_W == 0)),
# If the entry is an IOMMU_FRAME
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_IOMMU_FRAME,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are NDMAPAGES many dma pages that can be mapped
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NDMAPAGE),
# must be an IOMMU_FRAME
kernelstate.dmapages[
kernelstate.pages[pn].pgtable_pn(idx)
].type == dt.page_type.PAGE_TYPE_IOMMU_FRAME,
# the dma page must belong to the owner of the pt page
kernelstate.dmapages[
kernelstate.pages[pn].pgtable_pn(idx)
].owner == kernelstate.pages[pn].owner)),
# If the entry is a pci page
z3.Implies(
kernelstate.pages[pn].pgtable_type(idx) ==
dt.PGTYPE_PCIPAGE,
z3.And(
# This must be at the PT level in the pgtable
kernelstate.pages[pn].type ==
dt.page_type.PAGE_TYPE_X86_PT,
# There are NPCIPAGE many pci pages that can be mapped
z3.ULT(kernelstate.pages[pn].pgtable_pn(idx),
dt.NPCIPAGE),
# the pci page must belong to a device owned by the
# proc that owns the pgtable page
kernelstate.pci[
kernelstate.pcipages[kernelstate.pages[pn].
pgtable_pn(idx)].owner
].owner == kernelstate.pages[pn].owner)),
))))
return z3.And(*conj)
def spec_invariants(kernelstate):
conj = []
pid = util.FreshBitVec('pid', dt.pid_t)
pn = util.FreshBitVec('pn', dt.pn_t)
#
# procs' page table, hvm and stack are
#
# 1) valid
conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
z3.And(
is_pn_valid(kernelstate.procs[pid].page_table_root),
is_pn_valid(kernelstate.procs[pid].hvm),
is_pn_valid(kernelstate.procs[pid].stack)))))
# 2) owned by that proc
conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
z3.Implies(
is_status_live(kernelstate.procs[pid].state),
z3.And(
kernelstate.pages[kernelstate.procs[pid].page_table_root].owner == pid,
kernelstate.pages[kernelstate.procs[pid].hvm].owner == pid,
kernelstate.pages[kernelstate.procs[pid].stack].owner == pid)))))
# 3) have the correct type
conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
z3.Implies(
is_status_live(kernelstate.procs[pid].state),
z3.And(
kernelstate.pages[kernelstate.procs[pid].page_table_root].type == dt.page_type.PAGE_TYPE_X86_PML4,
kernelstate.pages[kernelstate.procs[pid].hvm].type == dt.page_type.PAGE_TYPE_PROC_DATA,
kernelstate.pages[kernelstate.procs[pid].stack].type == dt.page_type.PAGE_TYPE_PROC_DATA)))))
##
# Sleeping PROC's ipc_page is a frame owned by that pid
conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
z3.Implies(
kernelstate.procs[pid].state == dt.proc_state.PROC_SLEEPING,
z3.And(
is_pn_valid(kernelstate.procs[pid].ipc_page),
kernelstate.pages[kernelstate.procs[pid]
.ipc_page].type == dt.page_type.PAGE_TYPE_FRAME,
kernelstate.pages[kernelstate.procs[pid].ipc_page].owner == pid)))))
## Non-zombie procs with use_io_bitmaps own their (valid) bitmap pages
conj.append(z3.ForAll([pid],
z3.Implies(
z3.And(
is_pid_valid(pid),
kernelstate.procs[pid].use_io_bitmap,
kernelstate.procs[pid].state != dt.proc_state.PROC_ZOMBIE),
z3.And(
is_pn_valid(kernelstate.procs[pid].io_bitmap_a),
is_pn_valid(kernelstate.procs[pid].io_bitmap_b),
kernelstate.pages[kernelstate.procs[pid].io_bitmap_a].owner == pid,
kernelstate.pages[kernelstate.procs[pid].io_bitmap_b].owner == pid,
kernelstate.pages[kernelstate.procs[pid].io_bitmap_a].type == dt.page_type.PAGE_TYPE_PROC_DATA,
kernelstate.pages[kernelstate.procs[pid].io_bitmap_b].type == dt.page_type.PAGE_TYPE_PROC_DATA))))
# page has an owner <=> page is not free
conj.append(z3.ForAll([pn], z3.Implies(is_pn_valid(pn),
is_pid_valid(kernelstate.pages[pn].owner) == (kernelstate.pages[pn].type != dt.page_type.PAGE_TYPE_FREE))))
conj.append(z3.ForAll([pn], z3.Implies(is_pn_valid(pn),
z3.Implies(kernelstate.pages[pn].type == dt.page_type.PAGE_TYPE_FREE,
z3.Not(is_pid_valid(kernelstate.pages[pn].owner))))))
# a sleeping proc's ipc_fd is either invalid or empty
conj.append(z3.ForAll([pid], z3.Implies(z3.And(
is_pid_valid(pid),
kernelstate.procs[pid].state == dt.proc_state.PROC_SLEEPING),
z3.Or(z3.Not(is_fd_valid(kernelstate.procs[pid].ipc_fd)),
z3.Not(is_fn_valid(kernelstate.procs[pid].ofile(kernelstate.procs[pid].ipc_fd)))))))
##############
# Unused procs's refcount is all zero
# conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
# z3.Implies(kernelstate.procs[pid].state == dt.proc_state.PROC_UNUSED,
# z3.And(
# kernelstate.procs[pid].nr_pages(dt.NPAGE - 1) == z3.BitVecVal(0, dt.size_t))))))
# kernelstate.procs[pid].nr_children(dt.NPROC - 1) == z3.BitVecVal(0, dt.size_t),
# kernelstate.procs[pid].nr_fds(dt.NOFILE - 1) == z3.BitVecVal(0, dt.size_t),
# kernelstate.procs[pid].nr_devs(dt.NPCIDEV - 1) == z3.BitVecVal(0, dt.size_t))))))
# # unused procs don't have a parent
# conj.append(z3.ForAll([pid], z3.Implies(
# z3.And(
# is_pid_valid(pid),
# kernelstate.procs[pid].state == dt.proc_state.PROC_UNUSED),
# kernelstate.procs[pid].ppid == z3.BitVecVal(0, dt.pid_t))))
# # unused procs don't have fds
# conj.append(z3.ForAll([pid, fd], z3.Implies(
# z3.And(
# is_pid_valid(pid),
# kernelstate.procs[pid].state == dt.proc_state.PROC_UNUSED),
# z3.Not(is_fn_valid(kernelstate.procs[pid].ofile(fd))))))
# unused fn has refcount == 0
# conj.append(z3.ForAll([fn], z3.Implies(is_fn_valid(fn),
# z3.Implies(kernelstate.files[fn].type == dt.file_type.FD_NONE,
# kernelstate.files[fn].refcnt(
# z3.Concat(
# z3.BitVecVal(dt.NPROC - 1, dt.pid_t),
# z3.BitVecVal(dt.NOFILE - 1, dt.fd_t))) == z3.BitVecVal(0, dt.size_t)))))
##############
# disjointed-ness of memory regions
conj.append(z3.And(
z3.Extract(63, 40, z3.UDiv(kernelstate.pages_ptr_to_int, util.i64(4096)) + dt.NPAGES_PAGES) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.proc_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_PROC_TABLE) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.page_desc_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_PAGE_DESC_TABLE) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.file_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_FILE_TABLE) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.devices_ptr_to_int,util.i64(4096)) + dt.NPAGES_DEVICES) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.dmapages_ptr_to_int,util.i64(4096)) + dt.NDMAPAGE) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.pages_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.proc_table_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.page_desc_table_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.file_table_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.devices_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.Extract(63, 40, z3.UDiv(kernelstate.dmapages_ptr_to_int, util.i64(4096))) == z3.BitVecVal(0, 24),
z3.ULT(z3.UDiv(kernelstate.pages_ptr_to_int, util.i64(4096)) + dt.NPAGES_PAGES, z3.UDiv(kernelstate.proc_table_ptr_to_int, util.i64(4096))),
z3.ULT(z3.UDiv(kernelstate.proc_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_PROC_TABLE, z3.UDiv(kernelstate.page_desc_table_ptr_to_int, util.i64(4096))),
z3.ULT(z3.UDiv(kernelstate.page_desc_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_PAGE_DESC_TABLE, z3.UDiv(kernelstate.file_table_ptr_to_int, util.i64(4096))),
z3.ULT(z3.UDiv(kernelstate.file_table_ptr_to_int, util.i64(4096)) + dt.NPAGES_FILE_TABLE, z3.UDiv(kernelstate.devices_ptr_to_int, util.i64(4096))),
z3.ULT(z3.UDiv(kernelstate.devices_ptr_to_int, util.i64(4096)) + dt.NPCIDEV, z3.UDiv(kernelstate.dmapages_ptr_to_int, util.i64(4096))),
z3.ULT(z3.UDiv(kernelstate.dmapages_ptr_to_int, util.i64(4096)) + dt.NDMAPAGE, z3.UDiv(dt.PCI_START, util.i64(4096))),
))
# Current is a valid pid
conj.append(is_pid_valid(kernelstate.current))
# Current is always running
conj.append(kernelstate.procs[kernelstate.current].state == dt.proc_state.PROC_RUNNING),
# A running proc must be current
conj.append(z3.ForAll([pid], z3.Implies(is_pid_valid(pid),
z3.Implies(kernelstate.procs[pid].state == dt.proc_state.PROC_RUNNING,
pid == kernelstate.current))))
return z3.And(*conj)