Library mcertikos.proc.VVMXInit
Require Import Coqlib.
Require Import Maps.
Require Import ASTExtra.
Require Import Integers.
Require Import Floats.
Require Import Values.
Require Import Memory.
Require Import Events.
Require Import Stacklayout.
Require Import Globalenvs.
Require Import AsmX.
Require Import Smallstep.
Require Import AuxStateDataType.
Require Import Constant.
Require Import GlobIdent.
Require Import FlatMemory.
Require Import CommonTactic.
Require Import AuxLemma.
Require Import RealParams.
Require Import PrimSemantics.
Require Import LAsm.
Require Import XOmega.
Require Import liblayers.logic.PTreeModules.
Require Import liblayers.logic.LayerLogicImpl.
Require Import liblayers.compat.CompatLayers.
Require Import liblayers.compat.CompatGenSem.
Require Import CalRealPTPool.
Require Import CalRealPT.
Require Import CalRealIDPDE.
Require Import CalRealInitPTE.
Require Import CalRealSMSPool.
Require Import CalRealProcModule.
Require Import INVLemmaContainer.
Require Import INVLemmaMemory.
Require Import INVLemmaThread.
Require Import INVLemmaProc.
Require Import INVLemmaIntel.
Require Import AbstractDataType.
Require Export VVMXIntro.
Require Import LoadStoreSem3.
Section WITHMEM.
Local Open Scope Z_scope.
Context `{real_params: RealParams}.
Context `{multi_oracle_prop: MultiOracleProp}.
Context `{Hstencil: Stencil}.
Context `{Hmem: Mem.MemoryModelX}.
Context `{Hmwd: UseMemWithData mem}.
Local Open Scope Z_scope.
Context `{real_params: RealParams}.
Context `{multi_oracle_prop: MultiOracleProp}.
Context `{Hstencil: Stencil}.
Context `{Hmem: Mem.MemoryModelX}.
Context `{Hmwd: UseMemWithData mem}.
Section INV.
Section SET_REG.
Lemma vmx_set_reg_high_inv:
∀ d d´ i i0,
vmx_set_reg_spec i i0 d = Some d´→
high_level_invariant d →
high_level_invariant d´.
Proof.
intros. inv H0; functional inversion H; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_reg_low_inv:
∀ d d´ n i i0,
vmx_set_reg_spec i i0 d = Some d´→
low_level_invariant n d →
low_level_invariant n d´.
Proof.
intros. inv H0; functional inversion H; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
- unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; eapply VMX_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
- unfold VMCSPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; eapply VMCS_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
Qed.
Lemma vmx_set_reg_kernel_mode:
∀ d d´ i i0,
vmx_set_reg_spec i i0 d = Some d´→
kernel_mode d →
kernel_mode d´.
Proof.
intros. functional inversion H; subst; constructor; trivial.
Qed.
Global Instance vmx_set_reg_inv: PreservesInvariants vmx_set_reg_spec.
Proof.
preserves_invariants_simpl´.
- eapply vmx_set_reg_low_inv; eauto.
- eapply vmx_set_reg_high_inv; eauto.
- eapply vmx_set_reg_kernel_mode; eauto.
Qed.
End SET_REG.
Section SET_MMAP.
Lemma vmx_set_mmap_high_inv:
∀ d d´ i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
high_level_invariant d →
high_level_invariant d´.
Proof.
intros.
inv H0; functional inversion H; functional inversion H2; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_mmap_low_inv:
∀ d d´ n i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
low_level_invariant n d →
low_level_invariant n d´.
Proof.
intros.
inv H0; functional inversion H; functional inversion H2; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_mmap_kernel_mode:
∀ d d´ i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
kernel_mode d →
kernel_mode d´.
Proof.
intros; functional inversion H;
functional inversion H3; subst; constructor; trivial.
Qed.
Global Instance vmx_set_mmap_inv: PreservesInvariants vmx_set_mmap_spec.
Proof.
preserves_invariants_simpl´.
- eapply vmx_set_mmap_low_inv; eauto.
- eapply vmx_set_mmap_high_inv; eauto.
- eapply vmx_set_mmap_kernel_mode; eauto.
Qed.
End SET_MMAP.
Global Instance vmx_run_inv: VMXEnterInvariants vm_run_spec.
Proof.
constructor; intros;
unfold vm_run_spec in *;
subdestruct; inv H; simpl; auto.
-
inv H1. constructor; trivial; intros; simpl in ×.
+ unfold VMCSPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
× rewrite ZMap.gss.
eapply VMCS_inject_neutral_gss_Vint; eauto.
× rewrite ZMap.gso; eauto.
+ unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
× rewrite ZMap.gss.
eapply VMX_inject_neutral_gss_enter; eauto.
× rewrite ZMap.gso; eauto.
-
inv H0. constructor; simpl; eauto 2; try congruence; intros.
Qed.
Global Instance vmx_return_from_guest_inv: VMXReturnInvariants vmx_return_from_guest_spec.
Proof.
constructor; intros;
unfold vmx_return_from_guest_spec in *;
subdestruct; inv H; simpl; auto.
-
inv H0. constructor; trivial; intros; simpl in ×.
unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; repeat eapply VMX_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
-
inv H0. constructor; simpl; eauto 2; try congruence; intros.
Qed.
Global Instance vmx_init_inv: VMCSSetDefaultsInvariants vmx_init_spec.
Proof.
constructor; intros; functional inversion H; simpl; auto.
-
inv H6. constructor; trivial; intros; simpl in ×.
+ eapply real_vmcs_inject_neutral; eauto.
+ eapply real_vmx_inject_neutral; eauto.
-
inv H0. constructor; simpl; try congruence; intros; eauto.
Qed.
End INV.
Section SET_REG.
Lemma vmx_set_reg_high_inv:
∀ d d´ i i0,
vmx_set_reg_spec i i0 d = Some d´→
high_level_invariant d →
high_level_invariant d´.
Proof.
intros. inv H0; functional inversion H; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_reg_low_inv:
∀ d d´ n i i0,
vmx_set_reg_spec i i0 d = Some d´→
low_level_invariant n d →
low_level_invariant n d´.
Proof.
intros. inv H0; functional inversion H; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
- unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; eapply VMX_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
- unfold VMCSPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; eapply VMCS_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
Qed.
Lemma vmx_set_reg_kernel_mode:
∀ d d´ i i0,
vmx_set_reg_spec i i0 d = Some d´→
kernel_mode d →
kernel_mode d´.
Proof.
intros. functional inversion H; subst; constructor; trivial.
Qed.
Global Instance vmx_set_reg_inv: PreservesInvariants vmx_set_reg_spec.
Proof.
preserves_invariants_simpl´.
- eapply vmx_set_reg_low_inv; eauto.
- eapply vmx_set_reg_high_inv; eauto.
- eapply vmx_set_reg_kernel_mode; eauto.
Qed.
End SET_REG.
Section SET_MMAP.
Lemma vmx_set_mmap_high_inv:
∀ d d´ i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
high_level_invariant d →
high_level_invariant d´.
Proof.
intros.
inv H0; functional inversion H; functional inversion H2; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_mmap_low_inv:
∀ d d´ n i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
low_level_invariant n d →
low_level_invariant n d´.
Proof.
intros.
inv H0; functional inversion H; functional inversion H2; subst; simpl;
constructor; simpl; intros; try congruence; eauto 2.
Qed.
Lemma vmx_set_mmap_kernel_mode:
∀ d d´ i i0 i1 v,
vmx_set_mmap_spec i i0 i1 d = Some (d´, v)→
kernel_mode d →
kernel_mode d´.
Proof.
intros; functional inversion H;
functional inversion H3; subst; constructor; trivial.
Qed.
Global Instance vmx_set_mmap_inv: PreservesInvariants vmx_set_mmap_spec.
Proof.
preserves_invariants_simpl´.
- eapply vmx_set_mmap_low_inv; eauto.
- eapply vmx_set_mmap_high_inv; eauto.
- eapply vmx_set_mmap_kernel_mode; eauto.
Qed.
End SET_MMAP.
Global Instance vmx_run_inv: VMXEnterInvariants vm_run_spec.
Proof.
constructor; intros;
unfold vm_run_spec in *;
subdestruct; inv H; simpl; auto.
-
inv H1. constructor; trivial; intros; simpl in ×.
+ unfold VMCSPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
× rewrite ZMap.gss.
eapply VMCS_inject_neutral_gss_Vint; eauto.
× rewrite ZMap.gso; eauto.
+ unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
× rewrite ZMap.gss.
eapply VMX_inject_neutral_gss_enter; eauto.
× rewrite ZMap.gso; eauto.
-
inv H0. constructor; simpl; eauto 2; try congruence; intros.
Qed.
Global Instance vmx_return_from_guest_inv: VMXReturnInvariants vmx_return_from_guest_spec.
Proof.
constructor; intros;
unfold vmx_return_from_guest_spec in *;
subdestruct; inv H; simpl; auto.
-
inv H0. constructor; trivial; intros; simpl in ×.
unfold VMXPool_inject_neutral; intros.
case_eq (zeq vmid (CPU_ID d)); intros; subst.
+ rewrite ZMap.gss; repeat eapply VMX_inject_neutral_gss_Vint; eauto.
+ rewrite ZMap.gso; eauto.
-
inv H0. constructor; simpl; eauto 2; try congruence; intros.
Qed.
Global Instance vmx_init_inv: VMCSSetDefaultsInvariants vmx_init_spec.
Proof.
constructor; intros; functional inversion H; simpl; auto.
-
inv H6. constructor; trivial; intros; simpl in ×.
+ eapply real_vmcs_inject_neutral; eauto.
+ eapply real_vmx_inject_neutral; eauto.
-
inv H0. constructor; simpl; try congruence; intros; eauto.
Qed.
End INV.
These should be put into mcertikos.layerlib.GlobIdent
Definition vmxinit_fresh : compatlayer (cdata RData) :=
(vmx_get_reg ↦ gensem vmx_get_reg_spec
⊕ vmx_set_reg ↦ gensem vmx_set_reg_spec
⊕ vmx_get_next_eip ↦ gensem vmx_get_next_eip_spec
⊕ vmx_get_io_width ↦ gensem vmx_get_io_width_spec
⊕ vmx_get_io_write ↦ gensem vmx_get_io_write_spec
⊕ vmx_get_exit_qualification ↦ gensem vmx_get_exit_qualification_spec
⊕ vmx_get_exit_io_rep ↦ gensem vmx_get_exit_io_rep_spec
⊕ vmx_get_exit_io_str ↦ gensem vmx_get_exit_io_str_spec
⊕ vmx_get_exit_io_port ↦ gensem vmx_get_exit_io_port_spec
⊕ vmx_set_mmap ↦ gensem vmx_set_mmap_spec
⊕ vmx_init ↦ vmcs_set_defaults_compatsem vmx_init_spec)
⊕ (vmx_run_vm ↦ primcall_vmx_enter_compatsem vm_run_spec vmx_run_vm
⊕ vmx_return_from_guest ↦
primcall_vmx_return_compatsem vmx_return_from_guest_spec).
Definition vmxinit_passthrough : compatlayer (cdata RData) :=
fload ↦ gensem fload_spec
⊕ fstore ↦ gensem fstore_spec
⊕ vmxinfo_get ↦ gensem vmxinfo_get_spec
⊕ palloc ↦ gensem palloc_spec
⊕ set_pt ↦ gensem setPT_spec
⊕ pt_read ↦ gensem ptRead_spec
⊕ pt_resv ↦ gensem ptResv_spec
⊕ shared_mem_status ↦ gensem shared_mem_status_spec
⊕ offer_shared_mem ↦ gensem offer_shared_mem_spec
⊕ thread_wakeup ↦ gensem biglow_thread_wakeup_spec
⊕ thread_yield ↦ primcall_thread_schedule_compatsem biglow_thread_yield_spec (prim_ident:= thread_yield)
⊕ thread_sleep ↦ primcall_thread_transfer_compatsem biglow_thread_sleep_spec
⊕ sched_init ↦ gensem biglow_sched_init_spec
⊕ uctx_get ↦ gensem uctx_get_spec
⊕ uctx_set ↦ gensem uctx_set_spec
⊕ proc_create ↦ proc_create_compatsem biglow_proc_create_spec
⊕ container_get_nchildren ↦ gensem container_get_nchildren_spec
⊕ container_get_quota ↦ gensem container_get_quota_spec
⊕ container_get_usage ↦ gensem container_get_usage_spec
⊕ container_can_consume ↦ gensem container_can_consume_spec
⊕ get_CPU_ID ↦ gensem get_CPU_ID_spec
⊕ get_curid ↦ gensem get_curid_spec
⊕ acquire_lock_CHAN ↦ gensem acquire_lock_SC_spec
⊕ release_lock_CHAN ↦ gensem release_lock_SC_spec
⊕ get_sync_chan_busy ↦ gensem get_sync_chan_busy_spec
⊕ set_sync_chan_busy ↦ gensem set_sync_chan_busy_spec
⊕ ipc_send_body ↦ gensem ipc_send_body_spec
⊕ ipc_receive_body ↦ gensem ipc_receive_body_spec
⊕ rdmsr ↦ gensem rdmsr_spec
⊕ wrmsr ↦ gensem wrmsr_spec
⊕ vmx_set_intercept_intwin ↦ gensem vmx_set_intercept_intwin_spec
⊕ vmx_set_desc1 ↦ gensem vmx_set_desc1_spec
⊕ vmx_set_desc2 ↦ gensem vmx_set_desc2_spec
⊕ vmx_inject_event ↦ gensem vmx_inject_event_spec
⊕ vmx_set_tsc_offset ↦ gensem vmx_set_tsc_offset_spec
⊕ vmx_get_tsc_offset ↦ gensem vmx_get_tsc_offset_spec
⊕ vmx_get_exit_reason ↦ gensem vmx_get_exit_reason_spec
⊕ vmx_get_exit_fault_addr ↦ gensem vmx_get_exit_fault_addr_spec
⊕ vmx_check_pending_event ↦ gensem vmx_check_pending_event_spec
⊕ vmx_check_int_shadow ↦ gensem vmx_check_int_shadow_spec
⊕ cli ↦ gensem cli_spec
⊕ sti ↦ gensem sti_spec
⊕ serial_intr_disable ↦ gensem serial_intr_disable_spec
⊕ serial_intr_enable ↦ gensem serial_intr_enable_spec
⊕ serial_putc ↦ gensem serial_putc_spec
⊕ cons_buf_read ↦ gensem cons_buf_read_spec
⊕ host_in ↦ primcall_general_compatsem hostin_spec
⊕ host_out ↦ primcall_general_compatsem hostout_spec
⊕ proc_create_postinit ↦ gensem proc_create_postinit_spec
⊕ trap_get ↦ primcall_trap_info_get_compatsem trap_info_get_spec
⊕ trap_set ↦ primcall_trap_info_ret_compatsem trap_info_ret_spec
⊕ proc_start_user ↦ primcall_start_user_compatsem proc_start_user_spec
⊕ proc_exit_user ↦ primcall_exit_user_compatsem proc_exit_user_spec
⊕ proc_start_user2 ↦ primcall_start_user_compatsem2 proc_start_user_spec
⊕ proc_exit_user2 ↦ primcall_exit_user_compatsem2 proc_exit_user_spec
⊕ accessors ↦ {| exec_load := (@exec_loadex _ _ _ _ _ _ _ _ _ _ _ _ _ _ Hmwd);
exec_store := (@exec_storeex _ _ _ _ _ _ _ _ _ _ _ _ _ _ Hmwd) |}.
Definition vmxinit : compatlayer (cdata RData) := vmxinit_fresh ⊕ vmxinit_passthrough.
End WITHMEM.
(vmx_get_reg ↦ gensem vmx_get_reg_spec
⊕ vmx_set_reg ↦ gensem vmx_set_reg_spec
⊕ vmx_get_next_eip ↦ gensem vmx_get_next_eip_spec
⊕ vmx_get_io_width ↦ gensem vmx_get_io_width_spec
⊕ vmx_get_io_write ↦ gensem vmx_get_io_write_spec
⊕ vmx_get_exit_qualification ↦ gensem vmx_get_exit_qualification_spec
⊕ vmx_get_exit_io_rep ↦ gensem vmx_get_exit_io_rep_spec
⊕ vmx_get_exit_io_str ↦ gensem vmx_get_exit_io_str_spec
⊕ vmx_get_exit_io_port ↦ gensem vmx_get_exit_io_port_spec
⊕ vmx_set_mmap ↦ gensem vmx_set_mmap_spec
⊕ vmx_init ↦ vmcs_set_defaults_compatsem vmx_init_spec)
⊕ (vmx_run_vm ↦ primcall_vmx_enter_compatsem vm_run_spec vmx_run_vm
⊕ vmx_return_from_guest ↦
primcall_vmx_return_compatsem vmx_return_from_guest_spec).
Definition vmxinit_passthrough : compatlayer (cdata RData) :=
fload ↦ gensem fload_spec
⊕ fstore ↦ gensem fstore_spec
⊕ vmxinfo_get ↦ gensem vmxinfo_get_spec
⊕ palloc ↦ gensem palloc_spec
⊕ set_pt ↦ gensem setPT_spec
⊕ pt_read ↦ gensem ptRead_spec
⊕ pt_resv ↦ gensem ptResv_spec
⊕ shared_mem_status ↦ gensem shared_mem_status_spec
⊕ offer_shared_mem ↦ gensem offer_shared_mem_spec
⊕ thread_wakeup ↦ gensem biglow_thread_wakeup_spec
⊕ thread_yield ↦ primcall_thread_schedule_compatsem biglow_thread_yield_spec (prim_ident:= thread_yield)
⊕ thread_sleep ↦ primcall_thread_transfer_compatsem biglow_thread_sleep_spec
⊕ sched_init ↦ gensem biglow_sched_init_spec
⊕ uctx_get ↦ gensem uctx_get_spec
⊕ uctx_set ↦ gensem uctx_set_spec
⊕ proc_create ↦ proc_create_compatsem biglow_proc_create_spec
⊕ container_get_nchildren ↦ gensem container_get_nchildren_spec
⊕ container_get_quota ↦ gensem container_get_quota_spec
⊕ container_get_usage ↦ gensem container_get_usage_spec
⊕ container_can_consume ↦ gensem container_can_consume_spec
⊕ get_CPU_ID ↦ gensem get_CPU_ID_spec
⊕ get_curid ↦ gensem get_curid_spec
⊕ acquire_lock_CHAN ↦ gensem acquire_lock_SC_spec
⊕ release_lock_CHAN ↦ gensem release_lock_SC_spec
⊕ get_sync_chan_busy ↦ gensem get_sync_chan_busy_spec
⊕ set_sync_chan_busy ↦ gensem set_sync_chan_busy_spec
⊕ ipc_send_body ↦ gensem ipc_send_body_spec
⊕ ipc_receive_body ↦ gensem ipc_receive_body_spec
⊕ rdmsr ↦ gensem rdmsr_spec
⊕ wrmsr ↦ gensem wrmsr_spec
⊕ vmx_set_intercept_intwin ↦ gensem vmx_set_intercept_intwin_spec
⊕ vmx_set_desc1 ↦ gensem vmx_set_desc1_spec
⊕ vmx_set_desc2 ↦ gensem vmx_set_desc2_spec
⊕ vmx_inject_event ↦ gensem vmx_inject_event_spec
⊕ vmx_set_tsc_offset ↦ gensem vmx_set_tsc_offset_spec
⊕ vmx_get_tsc_offset ↦ gensem vmx_get_tsc_offset_spec
⊕ vmx_get_exit_reason ↦ gensem vmx_get_exit_reason_spec
⊕ vmx_get_exit_fault_addr ↦ gensem vmx_get_exit_fault_addr_spec
⊕ vmx_check_pending_event ↦ gensem vmx_check_pending_event_spec
⊕ vmx_check_int_shadow ↦ gensem vmx_check_int_shadow_spec
⊕ cli ↦ gensem cli_spec
⊕ sti ↦ gensem sti_spec
⊕ serial_intr_disable ↦ gensem serial_intr_disable_spec
⊕ serial_intr_enable ↦ gensem serial_intr_enable_spec
⊕ serial_putc ↦ gensem serial_putc_spec
⊕ cons_buf_read ↦ gensem cons_buf_read_spec
⊕ host_in ↦ primcall_general_compatsem hostin_spec
⊕ host_out ↦ primcall_general_compatsem hostout_spec
⊕ proc_create_postinit ↦ gensem proc_create_postinit_spec
⊕ trap_get ↦ primcall_trap_info_get_compatsem trap_info_get_spec
⊕ trap_set ↦ primcall_trap_info_ret_compatsem trap_info_ret_spec
⊕ proc_start_user ↦ primcall_start_user_compatsem proc_start_user_spec
⊕ proc_exit_user ↦ primcall_exit_user_compatsem proc_exit_user_spec
⊕ proc_start_user2 ↦ primcall_start_user_compatsem2 proc_start_user_spec
⊕ proc_exit_user2 ↦ primcall_exit_user_compatsem2 proc_exit_user_spec
⊕ accessors ↦ {| exec_load := (@exec_loadex _ _ _ _ _ _ _ _ _ _ _ _ _ _ Hmwd);
exec_store := (@exec_storeex _ _ _ _ _ _ _ _ _ _ _ _ _ _ Hmwd) |}.
Definition vmxinit : compatlayer (cdata RData) := vmxinit_fresh ⊕ vmxinit_passthrough.
End WITHMEM.