Clean-Slate Development of Certified OS Kernels

The CertiKOS project at Yale aims to develop new language-based technologies for building large-scale certified system software. Initially, we thought that verifying an OS kernel would require new program logics and powerful proof automation tools, but it should not be much different from standard Hoare-style program verification. After several years of trials and errors, we have decided to take a different path from the one we originally planned. We now believe that building large-scale certified system software requires a fundamental shift in the way we design the underlying programming languages, program logics, and proof assistants. In this talk, I outline our new clean-slate approach, explain its rationale, and describe various lessons and insights based on our experience with the development of several new certified OS kernels.

耶鲁大学的Certikos项目旨在开发用于构建大规模认证系统软件的新技术。最初，我们认为验证OS内核需要新的程序逻辑和强大的证明自动化工具，但与标准Hoare风格的程序验证没有太大不同。经过数年的试验和错误，我们决定采取与最初计划的途径不同的途径。我们现在认为，建立大规模认证的系统软件需要我们设计基础编程语言，程序逻辑和证明助理的方式进行基本转变。在这次演讲中，我概述了我们的新清洁方法，解释其理由，并根据我们在开发几个新认证的OS内核的经验中描述各种经验教训和见解。