Formal Verification of Asterinas OSTD with Verus

Note

This repository is currently in a transitional state: the components under ostd/src/sync and ostd/libs/id-alloc already track the upcoming Asterinas release v0.18.1, while every other OSTD component is still based on v0.16.0.

Overview

The vostd project provides a formally-verified version of OSTD, the (unofficial) standard library for OS development in safe Rust. OSTD encapsulates low-level hardware interactions—which require unsafe Rust—into a small set of high-level, safe abstractions, enabling complex, general-purpose OSes like Asterinas to be written entirely in safe Rust. By design, OSTD guarantees soundness: no undefined behavior is possible regardless of how its API is used. The goal of vostd is to bolster this soundness through formal verification with Verus.

This work is ongoing. Our current focus is OSTD's memory management and synchronization subsystems—core components directly tied to kernel memory safety—and we aim to extend verification to further parts of OSTD over time.

Publications

This project is tied to the following papers:

• 🏆 CortenMM — CortenMM: Efficient Memory Management with Strong Correctness Guarantees, SOSP 2025 (Best Paper Award). Concurrency proofs for OSTD memory management. [paper] [code]
• KVerus — KVerus: Scalable and Resilient Formal Verification Proof Generation for Rust Code, ASE 2026 (Industry Track). Retrieval-augmented, self-adaptive proof synthesis and repair for Verus. KVerus-generated proofs accepted upstream are tracked under the AI-assist label. [paper] [code]
• StarVerus - StarVerus: LLM-Powered Multi-Agent Collaboration for Industrial Rust Code Verification Automation, KDD 2026 (ADS Track). Multi-agent verification for industrial Rust. [paper]
• Beyond Benchmarks — Beyond Benchmarks: A Case Study of LLM-Generated Verus Specification Failures on Asterinas Vostd, ASE 2026 (Industry Track). [paper]

Bugs Found by Verification

Formal verification has surfaced real bugs in OSTD and the upstream Asterinas kernel, including undefined behavior, deadlocks, arithmetic overflows, and reachable panics. We track them in issue #645.

Project Structure

vostd/
├── dv/               # Build system
├── ostd/
│   ├── libs/         # Auxiliary libraries for OSTD
│   │   ├── align_ext/
│   │   ├── id-alloc/
│   │   └── ostd-pod/
│   ├── specs/        # Verus specifications
│   └── src/          # OSTD implementation and proofs
└── verified_libs/    # Auxiliary verified libraries
    ├── bitflags/
    └── vstd_extra/

Building

Prerequisites

• Install Rust.

• Initialize submodules (for our custom build tool):

  git submodule update --init --recursive

Build Verus

make verus      # or: cargo dv bootstrap

Verus is cloned and built under tools/verus. If the download fails, clone it manually into tools/verus and re-run cargo dv bootstrap.

Note

We use our own fork of Verus, kept in sync with upstream. To build against upstream Verus instead, use cargo dv bootstrap --upstream-verus (our CI tracks upstream; breaking changes are usually resolved within about a week).

Tip

If Verus is already installed elsewhere and you only want to reproduce a verification result (not the recommended way to set up the project), point CARGO_VERUS_PATH at the directory containing the cargo-verus binary (or add it to your PATH) and run cargo verus verify.

Verify

make                                                               # verify everything (or: cargo dv verify)
cargo dv focus --targets ostd                                      # ostd only, skip dependency proofs
cargo dv focus --targets ostd -- --verify-only-module sync::rwlock # verify one ostd module
cargo dv verify --targets vstd_extra                               # the verified dependency crate

Partial verification selectors such as --verify-only-module require the focus command.

Clean

make clean      # or: cargo dv clean          # remove build artifacts for a fresh build

Build & Docs

make build      # or: cargo dv build               # build the verification targets
make doc        # or: cargo dv doc --target ostd   # generate API docs at doc/index.html

The generated documentation can be found at doc/. An online version is also available.

IDE Support

• VSCode: verus-analyzer
• Emacs: verus-mode

Contributing

We welcome your contributions! Follow the VOSTD Verus Coding Guidelines for coding, specification, proof, naming, and organization conventions.

Before submitting:

• Run make verus-upgrade (cargo dv bootstrap --upgrade) to update the supported Verus toolchain.
• Run make fmt (cargo dv fmt) to format your changes; formatting is enforced.
• For changes to OSTD or verified libraries, run make to verify them.

For changes to Verus itself, prefer contributing to upstream Verus to minimize differences between upstream and our fork.