Formal Verification of Asterinas OSTD with Verus

Overview

The vostd project provides a formally-verified version of OSTD, the (unofficial) standard library for OS development in safe Rust. OSTD encapsulates low-level hardware interactions—which require unsafe Rust—into a small set of high-level, safe abstractions, enabling complex, general-purpose OSes like Asterinas to be written entirely in safe Rust. By design, OSTD guarantees soundness: no undefined behavior is possible regardless of how its API is used. The goal of vostd is to bolster this soundness through formal verification with Verus.

This work is ongoing. Our current focus is OSTD's memory management and synchronization subsystems—core components directly tied to kernel memory safety—and we aim to extend verification to further parts of OSTD over time.

Publications

This project is tied to the following papers:

• 🏆 CortenMM — CortenMM: Efficient Memory Management with Strong Correctness Guarantees, SOSP 2025 (Best Paper Award). Concurrency proofs for OSTD memory management. [paper] [code]
• KVerus — KVerus: Scalable and Resilient Formal Verification Proof Generation for Rust Code, ASE 2026 (Industry Track). Retrieval-augmented, self-adaptive proof synthesis and repair for Verus. Upstream-accepted proofs in OSTD AI-assist; see these PRs. [paper]
• Beyond Benchmarks — Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd, ASE 2026 (Industry Track). coming soon

Bugs Found by Verification

Formal verification has surfaced real bugs in OSTD and the upstream Asterinas kernel, including undefined behavior, deadlocks, arithmetic overflows, and reachable panics. We track them in issue #645.

Project Structure

vostd/
├── dv/               # Build system
├── ostd/
│   ├── specs/        # Verus specifications
│   └── src/          # OSTD implementation and proofs
└── verified_libs/    # Auxiliary verified libraries
    ├── bitflags/
    ├── ostd-pod/
    └── vstd_extra/

Building

Prerequisites

• Install Rust.

• Initialize submodules (for our custom build tool):

  git submodule update --init --recursive

Build Verus

make verus      # or: cargo dv bootstrap

Verus is cloned and built under tools/verus. If the download fails, clone it manually into tools/verus and re-run cargo dv bootstrap.

Note

We use our own fork of Verus, kept in sync with upstream. To build against upstream Verus instead, use cargo dv bootstrap --upstream-verus (our CI tracks upstream; breaking changes are usually resolved within about a week).

Tip

If Verus is already installed elsewhere and you only want to reproduce a verification result (not the recommended way to set up the project), point CARGO_VERUS_PATH at the directory containing the cargo-verus binary (or add it to your PATH) and run cargo verus verify.

Verify

make                                         # verify everything (or: cargo dv verify)
cargo dv verify -f --targets ostd            # ostd only, skip dependencies
cargo dv verify --targets vstd_extra         # the verified dependency crate

Clean

make clean      # or: cargo dv clean          # remove build artifacts for a fresh build

Build & Docs

make build      # or: cargo dv build               # build the verification targets
make doc        # or: cargo dv doc --target ostd   # generate API docs at doc/index.html

The generated documentation can be found at doc/. An online version is also available.

IDE Support

• VSCode: verus-analyzer
• Emacs: verus-mode

Contributing

We welcome your contributions! Conventions:

• Prefix axiom fn with axiom_, proof fn with lemma_, and proof helpers that manipulate tracked linear permission objects with tracked_.
• Prefer associated functions over isolated lemmas.
• Put specifications and lemmas in ostd/specs; general definitions and lemmas in verified_libs/vstd_extra.
• Before submitting: run make verus-upgrade (cargo dv bootstrap --upgrade) to follow the latest supported Verus, and make fmt (cargo dv fmt) to format (enforced).
• For Verus changes, prefer PRs to the upstream repo over our fork, since we aim to minimize differences between them.