  We present a formal verification of the functional correctness of the Muen
Separation Kernel. Muen is representative of the class of modern separation
kernels that leverage hardware virtualization support, and are generative in
nature in that they generate a specialized kernel for each system
configuration. These features pose substantial challenges to existing
verification techniques. We propose a verification framework called conditional
parametric refinement which allows us to formally reason about generative
systems. We use this framework to carry out a conditional refinement-based
proof of correctness of the Muen kernel generator. Our analysis of several
system configurations shows that our technique is effective in producing
mechanized proofs of correctness, and also in identifying issues that may
compromise the separation property.
