AI Post Transformers Visual Companion

seL4: Proving a Microkernel in C

seL4 matters because it shrinks privileged code until authority, allocation, and IPC become explicit objects the prover can track. The page below stays visual: flip the kernel split, inspect capabilities, then watch exactly where the theorem stops.

Proof Envelope

The kernel core can be proved much more tightly than the full deployed machine. That gap is the real story.

Measured figures below come from the 2009 SOSP paper; capability and coverage heatmaps are illustrative visual compressions of the design and follow-on proof lineage.

Privileged Core

Microkernel minimality is not just an aesthetic choice here. It is what keeps the privileged state small enough, explicit enough, and isolated enough for proof work to stay tractable.

Monolithic vs seL4 split

Toggle the architecture mode. The right-side meters track privileged footprint, proof tractability, and fault containment as a visual comparison rather than a benchmark.

Capability Mechanics

seL4 makes authority visible. Capabilities name objects and rights, CNodes store them, and untyped memory must be retyped into every concrete kernel object before anything can run or map.

Illustrative CSpace heatmap

lower authority active authority allocator / root power

Hover any slot. Rows are a synthetic but realistic CNode layout showing how rights intensity clusters around retype, mapping, endpoint, and scheduling control.

Untyped to IPC path

Untyped memory begins as raw authority, then becomes typed objects, mappings, and explicit reply paths.

Refinement Bridges

The proof chain does not say "the Haskell is truth" or "the C is secure." It builds bridges from an abstract contract to an executable design and then to the kernel body, while leaving assumptions outside the theorem.

Abstract spec to C, with the assumption strip below

The 2009 paper proves the kernel body against the specified behavior, but not the full deployment story.

Claim coverage heatmap

Blue means outside or weakly covered, orange means partial, red means strong evidence. The matrix compresses the 2009 paper plus later seL4 proof extensions into one visual boundary map.

Performance and Evidence

The sharp result in the 2009 paper is not "proof made it faster." It is that proof did not obviously destroy microkernel IPC performance, while the evidence burden exploded in person-years and proof script volume.

One-way IPC, hot cache, cycles

The 224-cycle optimized C IPC path was reported in the paper, but was not yet in the verified code base at that point.

Bugs surfaced by proof pressure

Formal verification found far more defects than pre-proof use and testing had already surfaced.

Lineage timeline

Hover nodes for the through-line from fast L4 design to later work on compiler output, time protection, and multicore reasoning.

Selected References