adbrucker
/
lh-l4v
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
lh-l4v/proof/drefine/Refine_D.thy

70 lines
2.5 KiB
Plaintext
Raw Normal View History

Import release snapshot.
2014-07-14 19:32:44 +00:00
(*
* Copyright 2014, NICTA
*
* This software may be distributed and modified according to the terms of
* the GNU General Public License version 2. Note that NO WARRANTY is provided.
* See "LICENSE_GPLv2.txt" for details.
*
* @TAG(NICTA_GPL)
*)
(*
* Toplevel capDL refinement theorem.
*)
theory Refine_D
imports Syscall_DR
begin
arch_split: DRefine checking
2016-05-01 00:09:19 +00:00
context begin interpretation Arch . (*FIXME: arch_split*)
Import release snapshot.
2014-07-14 19:32:44 +00:00
text {*
Removes all trailing whitespaces
2017-07-12 05:13:51 +00:00
Toplevel @{text dcorres} theorem.
Import release snapshot.
2014-07-14 19:32:44 +00:00
*}
reduce DRefine dependencies from Refine to AInvs This needs (and includes) some deduplication and moving of lemmas formerly in refine.
2018-10-13 01:28:22 +00:00
lemma valid_etcbs_sched: "valid_sched s \<longrightarrow> valid_etcbs s" by (fastforce simp: valid_sched_def)
Import release snapshot.
2014-07-14 19:32:44 +00:00
lemma handle_event_invs_and_valid_sched:
ADT: add kernel entry/exit constraints on domain time left These changes to the automatons are required by: SELFOUR-242: invert bitfield scheduler and optimise fast path Details: When we enter the kernel, the domain time left (ksDomainTime) is never zero. If we entered on a timer interrupt, we may decrement it to zero before the scheduler runs. If we do so, we set the scheduler state to choose_new_thread. When choosing a new thread, the scheduler switches to a new domain if the present one is required, and sets the new domain time left from domain_list (ksDomSchedule). When entering the kernel on a non-interrupt event, we never touch the domain time left, which trivially preserves the new constraints. To prove these, we had to ban a transition from kernel entry to kernel being preempted when handling an interrupt event in InfoFlow. This is fine, as by design handling interrupts is not meant to be preempted by interrupts.
2016-11-10 05:39:38 +00:00
"\<lbrace>invs and valid_sched and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_active s)
and (\<lambda>s. scheduler_action s = resume_cur_thread)\<rbrace> Syscall_A.handle_event e
Import release snapshot.
2014-07-14 19:32:44 +00:00
\<lbrace>\<lambda>rv. invs and valid_sched\<rbrace>"
Initial proof updates for combinator changes.
2018-03-15 03:45:48 +00:00
by ((wp he_invs handle_event_valid_sched), clarsimp)
Import release snapshot.
2014-07-14 19:32:44 +00:00
lemma dcorres_call_kernel:
"dcorres dc \<top>
ADT: add kernel entry/exit constraints on domain time left These changes to the automatons are required by: SELFOUR-242: invert bitfield scheduler and optimise fast path Details: When we enter the kernel, the domain time left (ksDomainTime) is never zero. If we entered on a timer interrupt, we may decrement it to zero before the scheduler runs. If we do so, we set the scheduler state to choose_new_thread. When choosing a new thread, the scheduler switches to a new domain if the present one is required, and sets the new domain time left from domain_list (ksDomSchedule). When entering the kernel on a non-interrupt event, we never touch the domain time left, which trivially preserves the new constraints. To prove these, we had to ban a transition from kernel entry to kernel being preempted when handling an interrupt event in InfoFlow. This is fine, as by design handling interrupts is not meant to be preempted by interrupts.
2016-11-10 05:39:38 +00:00
(invs and valid_sched and valid_pdpt_objs
and (\<lambda>s. e \<noteq> Interrupt \<longrightarrow> ct_running s)
Import release snapshot.
2014-07-14 19:32:44 +00:00
and (\<lambda>s. scheduler_action s = resume_cur_thread))
(Syscall_D.call_kernel e) (Syscall_A.call_kernel e)"
apply (simp_all add: Syscall_D.call_kernel_def Syscall_A.call_kernel_def)
apply (rule corres_guard_imp)
apply (rule corres_split)
prefer 2
apply (rule corres_split_handle [OF _ handle_event_corres])
prefer 4
apply (subst bind_return[symmetric])
apply (rule corres_split)
apply (rule activate_thread_corres[unfolded fun_app_def])
apply simp
apply (rule schedule_dcorres)
apply (wp schedule_valid_sched | strengthen valid_etcbs_sched)+
apply (simp add: handle_pending_interrupts_def)
apply (rule corres_split [OF _ get_active_irq_corres])
apply (clarsimp simp: when_def split: option.splits)
apply (rule handle_interrupt_corres)
apply ((wp | simp)+)[3]
apply (rule hoare_post_imp_dc2E, rule handle_event_invs_and_valid_sched)
apply (clarsimp simp: invs_def valid_state_def)
arm DRefine: updates for backports from arm-hyp
2017-05-31 06:29:12 +00:00
apply (simp add: conj_comms if_apply_def2 non_kernel_IRQs_def
ADT: add kernel entry/exit constraints on domain time left These changes to the automatons are required by: SELFOUR-242: invert bitfield scheduler and optimise fast path Details: When we enter the kernel, the domain time left (ksDomainTime) is never zero. If we entered on a timer interrupt, we may decrement it to zero before the scheduler runs. If we do so, we set the scheduler state to choose_new_thread. When choosing a new thread, the scheduler switches to a new domain if the present one is required, and sets the new domain time left from domain_list (ksDomSchedule). When entering the kernel on a non-interrupt event, we never touch the domain time left, which trivially preserves the new constraints. To prove these, we had to ban a transition from kernel entry to kernel being preempted when handling an interrupt event in InfoFlow. This is fine, as by design handling interrupts is not meant to be preempted by interrupts.
2016-11-10 05:39:38 +00:00
| wp | strengthen valid_etcbs_sched valid_idle_invs_strg)+
Some more cleanup of drefine.
2014-07-23 04:30:30 +00:00
apply (rule valid_validE2)
Import release snapshot.
2014-07-14 19:32:44 +00:00
apply (rule hoare_vcg_conj_lift)
apply (rule he_invs)
apply (rule handle_event_valid_sched)
reduce DRefine dependencies from Refine to AInvs This needs (and includes) some deduplication and moving of lemmas formerly in refine.
2018-10-13 01:28:22 +00:00
apply (fastforce intro: active_from_running simp: valid_sched_def)+
Proof update for crunch changes
2018-03-14 00:48:48 +00:00
done
Import release snapshot.
2014-07-14 19:32:44 +00:00
page_map_unmap_cancel : cdl spec changed and drefine fixed.
2014-09-05 04:48:22 +00:00
end
arch_split: DRefine checking
2016-05-01 00:09:19 +00:00
end