Building certified concurrent OS kernels

Abstract

Operating system (OS) kernels form the backbone of system software. They can have a significant impact on the resilience and security of today's computers. Recent efforts have demonstrated the feasibility of formally verifying simple general-purpose kernels, but they have ignored the important issues of concurrency, which include not just user and I/O concurrency on a single core, but also multicore parallelism with fine-grained locking. In this work, we present CertiKOS, a novel compositional framework for building verified concurrent OS kernels. Concurrency allows interleaved execution of programs belonging to different abstraction layers and running on different CPUs/ threads. Each such layer can have a different set of observable events. In CertiKOS, these layers and their observable events can be formally specified, and each module can then be verified at the abstraction level it belongs to. To link all the verified pieces together, CertiKOS enforces a so-called contextual refinement property for every such piece, which states that the implementation will behave like its specification under any concurrent context with any valid interleaving. Using CertiKOS, we have successfully developed a practical concurrent OS kernel, called mC2, and built the formal proofs of its correctness in Coq. The mC2 kernel is written in 6500 lines of C and x86 assembly and runs on stock x86 multicore machines. To our knowledge, this is the first correctness proof of a general-purpose concurrent OS kernel with fine-grained locking.

Verified Software Units

“…Related and future work Certified Abstraction Layers (CAL, [24,26]) are used in the CertiKOS project [25] to verify feature-rich operating system kernels and hypervisors in Coq. CAL permits horizontal and vertical composition of components, and establishes full abstraction between the imports and exports.…”

VIP: verifying real-world C idioms with integer-pointer casts

“…In particular, the verification of an OCaml-style garbage collector by Wang et al [2019a] extends CompCert with external functions specific for pointer-tagging. The verification of OS kernels and hypervisors by Gu et al [2019] and Li et al [2021] sidesteps integer-pointer casts altogether by using array indexing into a global array in which the kernel's allocatable data structures are stored. In contrast, with RefinedC-VIP, we have aimed to develop a verification tool that accounts for the integer-pointer cast idioms found in the wild, while also being sound under a realistic semantics.…”

“…It is possible to work around this limitation by restricting to certain coding patterns. For example, CertiKOS [Gu et al 2015[Gu et al , 2018[Gu et al , 2019 and SeKVM [Li et al 2021] model all allocatable data structures as a large array (sharing a single allocation identifier), and can thus replace some operations that usually require integer-pointer casts by simple pointer arithmetic, and Wang et al [2019a] use hardwired support for tag bits. However, in this paper, we target real-world code that does not generally adhere to such coding patterns.…”

Dijkstra monads forever: termination-sensitive specifications for interaction trees

“…There is also a vast body of prior work on Coq-based Proof Frameworks for program correctness. Systems like YNot [Malecha et al 2011], based on Hoare Type Theory, Iris [Jung et al 2016], VST [Appel 2014], and FCSL [Sergey et al 2015], all based on concurrent separation logic, and CertiKOS [Gu et al 2016] [Gu et al 2019], which uses certified abstraction layers, have had major success in the field of large scale program verification. Those models typically rely on smallstep, relationally-specified operational semantics, and are especially useful for reasoning about concurrent programsÐa domain that is still being explored for ITrees.…”