Length argument for these functions was previously unsigned int, which
was fine for AArch32, but an implicit downcast on AArch64. Changing it
to word_t makes it unsigned long, thus requiring signature update in
ccorres proofs.
Signed-off-by: Rafal Kolanski <rafal.kolanski@proofcraft.systems>
Refine for AArch64 is now completed and doesn't need quick_and_dirty
any more. CRefine is now in development mode.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The old version of dom_ucast_eq in AInvs is not useful, because the
necessary constants are not available yet in AInvs.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Collect all operator lifting lemmas in one place under
hoare_vcg_op_lift. (Moved from Refine)
Move the lifting lemmas that were still in AInvs up to lib.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
With adjustment of ARMMMU_improve_cases, the decode functions can all
be done in a single crunch invocation.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
These have either already been resolved, are trivial moves within one
theory, or they are questions that the rest of the proof has now
answered.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The user_vtop check in decode_fr_inv_map_wf can be relaxed from >= to >
as done in Haskell and C.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Main progress is in VSpace_R, with some fallout in ArchAcc_R, ADT_R, and
Schedule_R for invariant and spec changes.
General obj_at preservation for setVMRoot does not hold and is relegated
to something more specific in Schedule_R
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Refine needs slightly stricter information about asid maps, in
particular we need to know explicitly that asid 0 never maps to
a VSpace. This is the reverse of valid_vmid_table, but unfortunately
does not fully follow from valid_vmid_table, because there can
be VSpaces mapped without an assigned VMID.
We shift the test for 0 < asid from entry_for_asid to vspace_for_asid
so we can use entry_for_asid in the formulation of the invariant.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
The vmid_table never maps ASID 0. We managed to get through AInvs
without this property, but Refine does need it later.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
This concept no longer makes sense on AARCH64, we will either need to
know that certain addresses are in user_region (which implies
canonical_user, which is more strict than canonical), or we will need
to know they are in the kernel_window, which is also more strict than
canonical. We'll only find out for sure in CRefine.
Both cases are liftable from valid_vspace_uses and
pspace_in_kernel_window from AInvs, so instead of a new invariant, the
plan is to use Haskell assertions to transport the relevant info to
CRefine when needed.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
Trying to figure this out was very educational, since ccorres_abstract
was used without intending to abstract a variable, the xf' and lambda
name were both red herrings (in fact, this proof only worked if xf' was
instantiated with an *irrelevant* C local var name), and the body was
not transformed.
Signed-off-by: Rafal Kolanski <rafal.kolanski@proofcraft.systems>
The (no_asm) for corres goals is now properly enforced, which means
it is now really necessary to provide terminal corres rules in their
proper form.
Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>
