Verification of Hypervisor Subroutines written in Assembler

We present a methodology for the specification and verification of functional specifications of programs written in Assembler. We have evaluated the methodology in an industrial setting, the verification of the Microsoft Hypervisor. Many industrial software projects are written in a high-level language like C. For performance reasons or for direct hardware access, some of the routines are implemented in Assembler. Our goal is the automatic modular verification of functional specifications for C programs with subroutines in Assembler. This goal entails the need for checking an Assembler procedure against its functional specification. The specification of the Assembler program is used also in the specification of the C code that calls the Assembler program as a subroutine. Therefore, we need to translate back and forth between specifications for C code and specifications for Assembler code. The particular context of our work is the verification of the Microsoft Hypervisor where the static checker VCC is used to verify the part of the code written in C. VCC uses modular reasoning and comes with its own annotation language for functional specifications for C programs. The functional specifications for the Assembler routines in the Microsoft Hypervisor are given in the form of specifications for the C routines that call them. In this thesis, we introduce the tool Vx86 and the corresponding methodology to verify Assembler code against functional specifications of the form described above. In our approach, we use Vx86 to translate the Assembler code into C code. We give the translation of each Assembler instruction into a short piece of C code. Some instructions of x86 are complex in that their behavior depends on the internal processor state such as flag or control registers. The high-level semantics of C does not, however, foresee such low-level featuers. In order to account for the processor state in the high-level semantics, we introduce a C structure that contains the complete processor state. The modification of this C structure during the execution of the C code simulates the modification of the internal processor state during the execution of the Assembler instructions. Since we can refer to this C structure in the annotation language, we can specify the functional correctness of Assembler routines also if the functional correctness refers to the hardware directly. Our tool Vx86, integrated with VCC, leads to a methodology for the verification of functional specifications of programs written in Assembler and, thus, the pervasive verification of mixed programs such as the Microsoft Hypervisor which are written in C and Assembler. In this methodology, the program has to be annotated manually with modular specifications, e.g., preand postconditions and loop invariants. The verification of the code against these specifications is then fully automatic. We have used the methodology and the tool Vx86 in order to verify all subroutines of the Microsoft Hypervisor which are written in Assembler.