Correctness of an Operating System Microkernel
We outline the paper and pencil correctness proof for an operating system microkernel written in C.
The key ingredients of the proof are
1) a simulation of virtual machines by physical processors with swap memory.
Here physical memory serves as a cache for virtual memory.