Kit and the short stack

Bevier, William R.

doi:10.1007/bf00243135

Cited by 23 publications

(13 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Kit Project [8,9,36] can only be referred as groundbreaking to the area of pervasive operating-system verification. The main difference to more recent verification attempts of "real software" is that it relies on a LISP execution model that is nowadays considered fairly abstract.…”

Section: Related Workmentioning

confidence: 99%

Proving Fairness and Implementation Correctness of a Microkernel Scheduler

2009

View full text Add to dashboard Cite

We report on the formal proof of a microkernel's key property, namely that its multi-priority process scheduler guarantees progress, i. e., strong fairness. The proof architecture links a layer of behavioral reasoning over system-trace sets with a concrete, fairly realistic implementation written in C.Our microkernel provides an infrastructure for memory virtualization, for communication with hardware devices, for processes (represented as a sequence of assembly instructions, which are executed concurrently over an underlying, formally defined processor), and for inter-process communication (IPC) via synchronous message passing. The kernel establishes process switches according to IPCs and timer-events; the scheduling of process switches, however, follows a hierarchy of priorities, favoring, e. g., system processes over application processes over maintenance processes.Besides the quite substantial models developed in Isabelle/HOL and the formal clarification of their relationship, we provide a detailed analysis what formal requirements a microkernel imposes on the key ingredients (hardware, timers, machine-dependent code) in order to establish the correct operation of the overall system. On the methodological side, we show how early modeling with foresight to the later verification has substantially helped our project.

show abstract

Section: Related Workmentioning

confidence: 99%

Proving Fairness and Implementation Correctness of a Microkernel Scheduler

2009

View full text Add to dashboard Cite

show abstract

“…Working with the Boyer-Moore theorem prover [2] the researchers of the CLI stack project succeeded as early as 1989 to prove formally the correctness of a system which provided the following components: a non pipelined processor [3], an assembler [4], a compiler for a simple imperative language [5], a rudimentary operating system kernel [6] written in machine language. This kernel provided scheduling for a fixed number of processes; each process had the right to access a fixed interval of addresses in the processor's physical memory.…”

Section: The Challenge Of Verifying Entire Systemsmentioning

confidence: 99%

On the Verification of Memory Management Mechanisms

Dalinger

Hillebrand

Paul

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We report on the design and formal verification of a complex processor supporting address translation by means of a memory management unit (MMU). We give a paper and pencil proof that such a processor together with an appropriate page fault handler simulates virtual machines modeling user computation. These results are crucial steps towards the seamless verification of entire computer systems.

show abstract

“…2 These proofs were all constructed by the Boyer-Moore theorem prover. Complete descriptions of the relevant machines, implementations, MapUp functions, correctness theorems, and proofs are given in the accompanying papers in this collection [11,14,16].…”

Section: The Short Stackmentioning

confidence: 99%

“…The full specification of Kit, the correctness theorem, and its proof are described in [2]. While Kit is not big enough to be considered a kernel for a general purpose operating system, it does confront some important operating system phenomena.…”

Section: The Kit Operating Systemmentioning

confidence: 99%

“…These components consist of a code generator for a simple high-level language [16], an assembler and linking loader [14], a simple operating system kernel [2,1], and a microprocessor design [11]. Each of these is formally specified by an abstract finite state machine, and each is proved correct by showing that a lower level machine implements the abstract machine.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation