TY - GEN
T1 - SeL4
T2 - 22nd ACM SIGOPS Symposium on Operating Systems Principles, SOSP'09
AU - Klein, Gerwin
AU - Elphinstone, Kevin
AU - Heiser, Gernot
AU - Andronick, June
AU - Cock, David
AU - Derrin, Philip
AU - Elkaduwe, Dhammika
AU - Engelhardt, Kai
AU - Kolanski, Rafal
AU - Norrish, Michael
AU - Sewell, Thomas
AU - Tuch, Harvey
AU - Winwood, Simon
PY - 2009
Y1 - 2009
N2 - Complete formal verification is the only known way to guarantee that a system is free of programming errors. We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correctness means here that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation. seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.
AB - Complete formal verification is the only known way to guarantee that a system is free of programming errors. We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correctness means here that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation. seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.
KW - Isabelle/HOL
KW - L4
KW - Microkernel
KW - seL4
UR - http://www.scopus.com/inward/record.url?scp=72249120603&partnerID=8YFLogxK
U2 - 10.1145/1629575.1629596
DO - 10.1145/1629575.1629596
M3 - Conference contribution
SN - 9781605587523
T3 - SOSP'09 - Proceedings of the 22nd ACM SIGOPS Symposium on Operating Systems Principles
SP - 207
EP - 220
BT - SOSP'09 - Proceedings of the 22nd ACM SIGOPS Symposium on Operating Systems Principles
Y2 - 11 October 2009 through 14 October 2009
ER -