ABSTRACT
We propose a practical verification framework for preemptive OS kernels. The framework models the correctness of API implementations in OS kernels as contextual refinement of their abstract specifications. It provides a specification language for defining the high-level abstract model of OS kernels, a program logic for refinement verification of concurrent kernel code with multi-level hardware interrupts, and automated tactics for developing mechanized proofs. The whole framework is developed for a practical subset of the C language. We have successfully applied it to verify key modules of a commercial preemptive OS μC/OS-II, including the scheduler, interrupt handlers, message queues, and mutexes, etc. We also verify the priority-inversion-freedom (PIF) in μC/OS-II. All the proofs are mechanized in Coq. To our knowledge, our work is the first to verify the functional correctness of a practical preemptive OS kernel with machine-checkable proofs. More details about the project is available at <http://staff.ustc.edu.cn/~fuming/research/certiucos/>
- Fengwei Xu, Ming Fu, Xinyu Feng, Xiaoran Zhang, Hui Zhang, Zhaohui Li. A Practical Verification Framework for Preemptive OS Kernels. In: Proc. 28th International Conference on Computer Aided Verification (CAV’16), part II, pages 59--79, Toronto, Ontario, Canada. July 2016.Google Scholar
Index Terms
- Mechanized verification of preemptive OS kernels (invited talk)
Recommendations
Modular verification of preemptive OS kernels
ICFP '11: Proceedings of the 16th ACM SIGPLAN international conference on Functional programmingMost major OS kernels today run on multiprocessor systems and are preemptive: it is possible for a process running in the kernel mode to get descheduled. Existing modular techniques for verifying concurrent code are not directly applicable in this ...
Modular verification of preemptive OS kernels
ICFP '11Most major OS kernels today run on multiprocessor systems and are preemptive: it is possible for a process running in the kernel mode to get descheduled. Existing modular techniques for verifying concurrent code are not directly applicable in this ...
Toward compositional verification of interruptible OS kernels and device drivers
PLDI '16An operating system (OS) kernel forms the lowest level of any system software stack. The correctness of the OS kernel is the basis for the correctness of the entire system. Recent efforts have demonstrated the feasibility of building formally verified ...
Comments