SeL4: Formal verification of an OS kernel

Gerwin Klein*, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, Thomas Sewell, Harvey Tuch, Simon Winwood

*Corresponding author for this work

    Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

    1232 Citations (Scopus)

    Abstract

    Complete formal verification is the only known way to guarantee that a system is free of programming errors. We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correctness means here that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation. seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.

    Original languageEnglish
    Title of host publicationSOSP'09 - Proceedings of the 22nd ACM SIGOPS Symposium on Operating Systems Principles
    Pages207-220
    Number of pages14
    DOIs
    Publication statusPublished - 2009
    Event22nd ACM SIGOPS Symposium on Operating Systems Principles, SOSP'09 - Big Sky, MT, United States
    Duration: 11 Oct 200914 Oct 2009

    Publication series

    NameSOSP'09 - Proceedings of the 22nd ACM SIGOPS Symposium on Operating Systems Principles

    Conference

    Conference22nd ACM SIGOPS Symposium on Operating Systems Principles, SOSP'09
    Country/TerritoryUnited States
    CityBig Sky, MT
    Period11/10/0914/10/09

    Fingerprint

    Dive into the research topics of 'SeL4: Formal verification of an OS kernel'. Together they form a unique fingerprint.

    Cite this