@bwh @liw Oh, this is well into "open research question" territory, so that's the smallest of the big Ifs, honestly. Formal methods are of course only as good as the models driving them. But we write drivers based on incomplete information all the time, and this imaginary tooling wouldn't change that. We'd be writing down our beliefs about how the hardware works, rather than describing objective reality.
But I still believe that would be a huge improvement, because then we could talk about those beliefs in a common framework, without OS details getting in the way. And when somebody identifies a correction to some model, every driver using that model could be mechanically re-verified.
If you want to list the bigger challenges to my thought experiment, there are plenty. Like how hard it is to devise a modeling framework that allows us to express the wide variety of things hardware can do, while still being restricted enough that it's possible to mechanically prove that a driver is correct with respect to its model. Or how much trouble it is to do anything mechanically with C source code; my old C-to-Rust translator, Corrode, suffered from that problem too.
Nobody yet knows how to build what I'm describing. I just think it's a vision worth investigating, especially as an alternative to trying to make driver source code for one OS build on another.