Comprehensive formal verification of an OS microkernel

Abstract

We present an in-depth coverage of the comprehensive machine-checked formal verification of seL4, a general-purpose operating system microkernel. We discuss the kernel design we used to make its verification tractable. We then describe the functional correctness proof of the kernel's C implementation and we cover further steps that transform this result into a comprehensive formal verification of the kernel: a formally verified IPC fastpath, a proof that the binary code of the kernel correctly implements the C semantics, a proof of correct access-control enforcement, a proof of information-flow noninterference, a sound worst-case execution time analysis of the binary, and an automatic initialiser for user-level systems that connects kernel-level access-control enforcement with reasoning about system behaviour. We summarise these results and show how they integrate to form a coherent overall analysis, backed by machine-checked, end-to-end theorems. The seL4 microkernel is currently not just the only general-purpose operating system kernel that is fully formally verified to this degree. It is also the only example of formal proof of this scale that is kept current as the requirements, design and implementation of the system evolve over almost a decade. We report on our experience in maintaining this evolving formally verified code base.

Modelling and Verifying a Priority Scheduler for an SCJ Runtime Environment

“…A comprehensive verification of the seL4 microkernel is reported in [19]. This includes verification of the scheduler and other areas of the kernel, and a proof that the binary code of the kernel correctly implements the C source code.…”

“…It is also relevant to embedded systems where size and speed constraints necessitate tight coupling between operating system components. Indeed, Klein et al [19] note that the call graph of seL4 shows high levels of interdependency between components. Gotsman and Yang demonstrate their approach by verifying a scheduler based on the Linux 2.6.11 scheduler.…”

Progress in the Independent Certification of Mizar Mathematical Library in Isabelle

“…They are used to guarantee the correctness of compilers [1], operating systems [2], hardware [3], as well as to certify mathematical results that involve computation [4]. The Mizar system [5] is one of the oldest computer systems used to certify proofs.…”

Refinement-Based Verification of the FreeRTOS Scheduler in VCC

“…Thus, to verify that P [C] satisfies a certain property, it may be sufficient to check that P [A] satisfies the property. The latter check involves reasoning about a simpler component (namely A) and can reduce the work of a prover by an order of magnitude [22]. Finally, a refinement-based proof is more modular and transparent, since it breaks down the task of reasoning about a complex implementation into smaller tasks, each of which is more manageable for both a human and a prover.…”