Trustworthy Systems

Two interfaces for seL4 kernel verification: Time protection and the kernel–userland gap (extended abstract)

Authors

Rob Sison

    School of Computer Science and Engineering
    UNSW,
    Sydney 2052, Australia

Abstract

This talk will present two case studies on verification interfaces at both ends of the seL4 operating system kernel's bulk of formal specifications in Isabelle/HOL. Reaching deep into the concrete depths, our efforts to prove that seL4 enforces time protection, the absence of timing leaks through microarchitectural state, rely entirely on a new hardware–software contract. Meanwhile, up where verified user-level programs would need to rely formally on a suitable abstraction of seL4's system call behaviour, there stands a long-unbridged kernel–userland gap: what developers would expect from reading seL4's reference manual is not quite yet what's been proved. We will examine how the urgent need to clarify both interfaces arose and what we are doing about it at UNSW, offered as data points for discussion on what it can take to provide a trustworthy body of software through formal methods and mechanised verification in Isabelle.

BibTeX Entry

  @article{Sison_26,
    author           = {Rob Sison},
    journal          = {Isabelle Workshop},
    month            = jul,
    numpages         = {6},
    paperurl         = {https://trustworthy.systems/publications/papers/Sison_26.pdf},
    title            = {Two interfaces for {seL4} kernel verification: Time Protection and the Kernel–Userland Gap (Extended
                        Abstract)},
    year             = {2026}
  }

Download