Abstract

Virtualization provides unique challenges to verification. While the specification of a virtualization stack is relatively straightforward – behave like “bare metal”, BedRock’s bare metal property™ – virtualization systems in practice are large, concurrent, and performance sensitive. In this talk, I discuss BedRock Systems’ approach to verifying the bare metal property™ of the BedRock Hypervisor™, a microkernel-based virtualization. These challenges stem from applying formal methods to an industrial, systems-level code base following microkernel best practices. BedRock uses concurrent separation logic to build highly-concurrent specifications and proofs directly on source code. BHV ™ is implemented in modern C++, is relatively large, highly concurrent, and is built modularly from multiple, coordinating applications.