Formal Verication of a Framework for Microkernel Programmers

This thesis presents the formal verification of a framework for microkernel programmers called CVM (communicating virtual machines) [41]. CVM is a computational model for concurrent user processes interacting with a generic microkernel and devices. It is implemented in C0A, a restricted C-dialect with support of inline assembly, as a framework featuring virtual memory, demand paging, memory management, and low-level inter-process and devices communications. The framework can be linked on the source code level with an abstract kernel, an interface to users, in order to obtain a concrete kernel, a program that can be translated and run on a target machine. We use a formally verified microprocessor VAMP [20] as a platform to run the concrete kernel. The main result of this work is a mechanically checked formal proof that concurrent executions of user processes interacting with a kernel are simulated by executions of the VAMP instruction set architecture model interleaved with devices. In order to obtain this result a number of attendant formal theories have been developed, most notably, a theory of inline assembly verification. This work is a part of the Verisoft project [111], a large scale effort bringing together industrial and academic partners to push the state-of-the-art in formal verification for realistic computer systems comprising hardand software.