diff --git a/proof/invariant-abstract/ARM/ArchInterruptAcc_AI.thy b/proof/invariant-abstract/ARM/ArchInterruptAcc_AI.thy new file mode 100644 index 000000000..438dad27f --- /dev/null +++ b/proof/invariant-abstract/ARM/ArchInterruptAcc_AI.thy @@ -0,0 +1,40 @@ +(* + * Copyright 2014, General Dynamics C4 Systems + * + * This software may be distributed and modified according to the terms of + * the GNU General Public License version 2. Note that NO WARRANTY is provided. + * See "LICENSE_GPLv2.txt" for details. + * + * @TAG(GD_GPL) + *) + +(* + Arch-specific retype invariants +*) + +theory ArchInterruptAcc_AI +imports "../InterruptAcc_AI" +begin + +context Arch begin global_naming ARM + +named_theorems InterruptAcc_AI_assms + +lemma dmo_maskInterrupt_invs [InterruptAcc_AI_assms]: + "\all_invs_but_valid_irq_states_for irq and (\s. state = interrupt_states s irq)\ + do_machine_op (maskInterrupt (state = IRQInactive) irq) + \\rv. invs\" + apply (simp add: do_machine_op_def split_def maskInterrupt_def) + apply wp + apply (clarsimp simp: in_monad invs_def valid_state_def all_invs_but_valid_irq_states_for_def valid_irq_states_but_def valid_irq_masks_but_def valid_machine_state_def cur_tcb_def valid_irq_states_def valid_irq_masks_def) + done + +end + +global_interpretation InterruptAcc_AI?: InterruptAcc_AI + proof goal_cases + interpret Arch . + case 1 show ?case by (unfold_locales; fact InterruptAcc_AI_assms) + qed + +end diff --git a/proof/invariant-abstract/ARM/ArchVSpace_AI.thy b/proof/invariant-abstract/ARM/ArchVSpace_AI.thy index f55fc3a78..9397eb107 100644 --- a/proof/invariant-abstract/ARM/ArchVSpace_AI.thy +++ b/proof/invariant-abstract/ARM/ArchVSpace_AI.thy @@ -5033,4 +5033,4 @@ lemma invs_aligned_pdD: done end -end \ No newline at end of file +end diff --git a/proof/invariant-abstract/Finalise_AI.thy b/proof/invariant-abstract/Finalise_AI.thy index 7a081e270..37633d93c 100644 --- a/proof/invariant-abstract/Finalise_AI.thy +++ b/proof/invariant-abstract/Finalise_AI.thy @@ -11,7 +11,7 @@ theory Finalise_AI imports "./$L4V_ARCH/ArchIpcCancel_AI" - InterruptAcc_AI + "./$L4V_ARCH/ArchInterruptAcc_AI" "./$L4V_ARCH/ArchRetype_AI" begin diff --git a/proof/invariant-abstract/InterruptAcc_AI.thy b/proof/invariant-abstract/InterruptAcc_AI.thy index f372e7e2a..d06cbf181 100644 --- a/proof/invariant-abstract/InterruptAcc_AI.thy +++ b/proof/invariant-abstract/InterruptAcc_AI.thy @@ -58,21 +58,23 @@ definition all_invs_but_valid_irq_states_for where pspace_in_kernel_window and cap_refs_in_kernel_window and cur_tcb" -context begin interpretation Arch . (*FIXME: arch_split*) -lemma dmo_maskInterrupt_invs: - "\all_invs_but_valid_irq_states_for irq and (\s. state = interrupt_states s irq)\ - do_machine_op (maskInterrupt (state = IRQInactive) irq) - \\rv. invs\" - apply (simp add: do_machine_op_def split_def maskInterrupt_def) - apply wp - apply (clarsimp simp: in_monad invs_def valid_state_def all_invs_but_valid_irq_states_for_def valid_irq_states_but_def valid_irq_masks_but_def valid_machine_state_def cur_tcb_def valid_irq_states_def valid_irq_masks_def) - done -end + +locale InterruptAcc_AI = + fixes state_ext_t :: "'state_ext::state_ext itself" + assumes dmo_maskInterrupt_invs: + "\irq state. + \all_invs_but_valid_irq_states_for irq and (\s. state = interrupt_states s irq)\ + do_machine_op (maskInterrupt (state = IRQInactive) irq) + \\rv. invs :: 'state_ext state \ bool\" + +context InterruptAcc_AI begin lemma set_irq_state_invs[wp]: - "\\s. invs s \ (state \ irq_state.IRQSignal \ cap.IRQHandlerCap irq \ ran (caps_of_state s))\ + "\state irq. + \\s::'state_ext state. invs s + \ (state \ irq_state.IRQSignal \ cap.IRQHandlerCap irq \ ran (caps_of_state s))\ set_irq_state state irq - \\rv. invs\" + \\rv. invs\" apply (simp add: set_irq_state_def) apply (wp dmo_maskInterrupt_invs) apply (clarsimp simp: invs_def valid_state_def cur_tcb_def valid_mdb_def all_invs_but_valid_irq_states_for_def) @@ -84,6 +86,8 @@ lemma set_irq_state_invs[wp]: apply(clarsimp simp: valid_machine_state_def valid_irq_states_but_def valid_irq_masks_but_def, blast elim: valid_irq_statesE) done +end + lemmas ucast_ucast_mask8 = ucast_ucast_mask[where 'a=8, simplified, symmetric] end diff --git a/proof/invariant-abstract/Retype_AI.thy b/proof/invariant-abstract/Retype_AI.thy index efdf97487..0d6ca16d4 100644 --- a/proof/invariant-abstract/Retype_AI.thy +++ b/proof/invariant-abstract/Retype_AI.thy @@ -2474,11 +2474,11 @@ lemma pspace_no_overlap_typ_at_lift: apply (clarsimp simp: pspace_no_overlap_typ_at_def) apply (wp hoare_vcg_all_lift f) done -context begin interpretation Arch . (*FIXME: arch_split*) + + lemma swp_clearMemoryVM [simp]: "swp clearMemoryVM x = (\_. return ())" by (rule ext,simp) -end (* FIXME: move *) diff --git a/proof/invariant-abstract/VSpacePre_AI.thy b/proof/invariant-abstract/VSpacePre_AI.thy index 1bfcc306c..de79f3a13 100644 --- a/proof/invariant-abstract/VSpacePre_AI.thy +++ b/proof/invariant-abstract/VSpacePre_AI.thy @@ -247,7 +247,4 @@ lemma set_mrs_ntfn_at[wp]: "\ ntfn_at p \ set_mrs receiver recv_buf mrs \\rv. ntfn_at p \" by (simp add: ntfn_at_typ, wp) - - - -end \ No newline at end of file +end