Extending concurrent separation logic to the hardware level to verify the xv6 OS kernel on RISC-V with AI agents

2026-09-03

AI Summary

该研究使用基于Iris的并发分离逻辑和AI代理，开发了MachCSL框架来验证RISC-V架构上xv6操作系统内核的硬件级细节。

Abstract

MachCSL is a framework for verifying systems software, such as an OS kernel, on top of low-level semantics of a RISC-V computer, based on the Sail RISC-V semantics. The key idea behind MachCSL is to adapt concurrent separation logic, based on Iris, to reasoning about low-level hardware execution at the sub-instruction level: page-table translation, TLB, privilege levels, configuration registers, instruction fetch/decode/execute, traps and interrupts, DMA, shared memory, power failures, etc. Reasoning at this level of detail ensures that the system software correctly manages all of the hardware details. Verifying software at this low level of abstraction is tedious, but LLM-based agents are capable of reasoning about such low-level details. As a case study, we verify the xv6 OS kernel (6,593 lines of C and assembly code), which provides a traditional Unix system call interface (processes, file system, file descriptors, and preemptive scheduling) and has substantial internal concurrency (multi-core support with fine-grained locking, shared memory, interrupts, DMA, etc.). In the verification process, we uncovered nine bugs in the xv6 implementation, as well as one bug in the Sail RISC-V semantics. The verification effort took us 77 days, including the time to develop the MachCSL framework.

Problem

• concurrent separation logic
• RISC-V
• xv6 OS kernel
• low-level hardware execution
• LLM-based agents

Innovation

• concurrent separation logic
• hardware level verification
• LLM-based agents
• RISC-V