VirtualCert is a machine-checked model of virtualization that can be#R##N#used to reason about isolation between operating systems in presence#R##N#of cache-based side-channels. In contrast to most prominent projects#R##N#on operating systems verification, where such guarantees are proved#R##N#directly on concrete implementations of hypervisors, VirtualCert#R##N#abstracts away most implementations issues and specifies the effects#R##N#of hypervisor actions axiomatically, in terms of preconditions and#R##N#postconditions. Unfortunately, seemingly innocuous implementation#R##N#issues are often relevant for security. Incorporating the treatment of#R##N#errors into VirtualCert is therefore an important step towards#R##N#strengthening the isolation theorems proved in earlier work. In this#R##N#paper, we extend our earlier model with errors, and prove that#R##N#isolation theorems still apply. In addition, we provide an executable specification of the hypervisor, and prove that it correctly implements the axiomatic model. The executable specification constitutes a first step towards a more realistic implementation of a hypervisor, and provides a useful tool for validating the axiomatic semantics developed in previous work.
['Gilles Barthe', 'Gustavo Betarte', 'Juan Diego Campo', 'Jesús Mauricio Chimento', 'Carlos Luna']
Formally Verified Implementation of an Idealized Model of Virtualization