2014-07-28 01:59:57 +00:00
|
|
|
CapDL Refinement Proof
|
|
|
|
|
======================
|
2014-07-24 03:31:57 +00:00
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
This proof establishes that seL4's [abstract specification][aspec] is
|
|
|
|
|
a formal *refinement* (i.e. a correct implementation) of its [capDL
|
|
|
|
|
specification][capDL]. It is described as part of an ICFEM '13
|
|
|
|
|
[paper][paper].
|
2014-07-24 03:31:57 +00:00
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
[aspec]: ../../spec/abstract/
|
|
|
|
|
[capdl]: ../../spec/capDL/
|
|
|
|
|
[paper]: http://www.nicta.com.au/pub?id=7047 "Formally Verified System Initialisation"
|
|
|
|
|
|
|
|
|
|
Building
|
|
|
|
|
--------
|
2014-07-24 03:31:57 +00:00
|
|
|
|
|
|
|
|
To build from the `l4v/` directory, run:
|
|
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
./isabelle/bin/isabelle build -d . -v -b DRefine
|
2014-07-24 03:31:57 +00:00
|
|
|
|
2014-07-28 01:59:57 +00:00
|
|
|
Important Theories
|
|
|
|
|
------------------
|
2014-07-24 03:31:57 +00:00
|
|
|
|
|
|
|
|
The top-level theory where the refinement statement is established over
|
2014-07-28 01:59:57 +00:00
|
|
|
the entire kernel is [`Refine_D`](Refine_D.thy); the state-relation that
|
|
|
|
|
relates the state-spaces of the two specifications is defined in
|
|
|
|
|
[`StateTranslation_D`](StateTranslation_D.thy) and the basic
|
2014-07-24 03:31:57 +00:00
|
|
|
correspondence property proved over each kernel function is defined in
|
2014-07-28 01:59:57 +00:00
|
|
|
[`Corres_D`](Corres_D.thy).
|
2014-07-24 03:31:57 +00:00
|
|
|
|
