Joel Beeren
3c223b42fe
SELFOUR-421: AInvs done, no added invariants yet
2016-09-22 19:11:29 +10:00
Thomas Sewell
9a1ec71a2d
Refactor of crunch.
...
Substantial adjustments to crunch. Main user changes are:
- 'lift' and 'unfold' mechanisms replaced by more general 'rule'.
- some more 'ignores' standardised.
- crunch has a more principled overall design:
+ discover crunch rule
* provided or by definition extraction
+ recurse according to rule
+ prove goal based on rule, recursive discoveries, standard tactic
* wp/simp adjustments tweak tactic
2016-08-24 15:53:53 +10:00
Matthew Brecknell
1013e959c1
arch_split: give some vspace concepts more generic names
...
In particular rename "pd" to "vspace", when the pd represents
an address space.
2016-08-03 14:46:48 +10:00
Miki Tanaka
eb7f7b1564
arch-split: Tcb_AI.thy done
2016-07-07 13:57:16 +10:00
Matthew Brecknell
b9313f6d11
arch_split: invariants: tidied
2016-06-15 10:15:26 +10:00
Japheth Lim
26a7907c95
Merge pull request #43 in SEL4/l4v from ~JALIM/l4v:autocorres-seL4 to master
...
* commit 'ecbb860532b4c576fc4726a805802f16bcf5302c': (29 commits)
autocorres-crefine: specialise corres_no_failI for compatibility with Refine
Add license tags for autocorres-crefine files
crefine: refactor AutoCorresTest a bit
autocorres-crefine: remove local debugging imports
Fix InfoFlowC to accommodate corres_underlying changes.
Fix DRefine to accommodate corres_underlying changes.
autocorres-crefine: experiment with manually translating a function (clzl).
autocorres-crefine: experiment with translating bitfield_gen specs.
autocorres-crefine: start a test case for function calls.
autocorres-crefine: update example proofs to work with no_c_termination, which does not require proving termination for the C spec.
autocorres: add user option "no_c_termination" for previous patch.
Making termination proof optional for AutoCorres.
WIP: autocorres: hacky proof of concept for incremental translation.
autocorres: add some missing WordAbstract rules.
autocorres-crefine: fix some comments in work theory.
autocorres-crefine: prove modifies and (simple) terminates specs.
autocorres-crefine: experiment with generating modifies proofs
autocorres-crefine: run autocorres in kernel_all_substitute locale
autocorres-crefine: update another corres_UL that snuck in before rebasing.
autocorres-crefine: working ccorres for handleYield (modulo some white lies).
...
2016-05-19 01:19:58 +00:00
Japheth Lim
ecbb860532
autocorres-crefine: specialise corres_no_failI for compatibility with Refine
...
The generic rule is now named corres_no_failI_base.
2016-05-18 15:28:43 +10:00
Gerwin Klein
322f1023f5
word_lib: adjust theory dependencies
2016-05-16 21:11:40 +10:00
Gerwin Klein
445efb7c29
lib: closure for Word_Lib and own session
2016-05-16 21:11:40 +10:00
Gerwin Klein
f0faa90f8a
lib/spec/proof/tools: fix word change fallout
2016-05-16 21:11:40 +10:00
Japheth Lim
0f0f731ab7
Merge branch 'master' of ssh://bitbucket.keg.ertos.in.nicta.com.au:7999/SEL4/l4v into autocorres-seL4
...
This is to prepare for merging back into master.
Conflicts:
proof/crefine/Refine_C.thy
2016-05-11 15:08:22 +10:00
Matthew Brecknell
60afdc1288
trivial: fixups including some licence headers
2016-05-09 13:27:15 +10:00
Matthew Brecknell
b16496e7cf
arch_split: InfoFlowC checking
2016-05-06 13:15:37 +10:00
Matthew Brecknell
56b226a608
arch_split: CRefine: use requalify instead of shadow
2016-05-06 08:59:33 +10:00
Daniel Matichuk
9ceed1eb12
arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.
2016-05-04 15:14:41 +10:00
Matthew Brecknell
ec399ad38e
arch_split: CRefine checking
2016-05-04 15:07:51 +10:00
Matthew Brecknell
33b4848061
arch_split: Refine: fixup some qualified references
2016-05-02 16:11:13 +10:00
Matthew Brecknell
a2135ca8ce
arch_split: Refine checking, including Orphanage
2016-04-30 16:25:20 +10:00
Matthew Brecknell
e8c5b916ef
arch_split: Refine checking, except Orphanage
2016-04-29 18:15:54 +10:00
Matthew Brecknell
e0ecdf2281
arch_split: Refine checking up to ADT_H
2016-04-29 15:06:32 +10:00
Matthew Brecknell
18b77d4bdf
arch_split: Refine checking up to CNodeInv_R
2016-04-29 09:47:59 +10:00
Daniel Matichuk
94f7004f07
arch_split: Refine checking up to end of Finalise_R
2016-04-28 17:16:49 +10:00
Matthew Brecknell
0c3a12771d
arch_split: merge master
2016-04-28 14:36:43 +10:00
Daniel Matichuk
1d20b393c0
arch_split: replaced sublocale with global_naming
2016-04-27 14:32:38 +10:00
Matthew Brecknell
4e6369f86d
arch_split: invariants: Finalise_AI checking
2016-04-15 15:11:32 +10:00
Japheth Lim
bb83b53b15
Merge branch 'master' into autocorres-seL4
...
This updates autocorres-seL4 to Isabelle2016.
Conflicts:
proof/crefine/Refine_C.thy
2016-03-29 14:07:54 +11:00
Sophie Taylor
d7fd88727a
SELFOUR-420: Verification of maxIRQ check in handle_interrupt.
2016-03-17 11:20:52 +11:00
Miki Tanaka
6f6c58168c
SELFOUR-56: Remove diminish rights from IPC
2016-02-24 13:24:10 +11:00
Matthew Brecknell
4f7ac1a975
trivial: remove some comments and debug trace
2016-02-22 10:55:21 +11:00
Matthew Brecknell
84d2889d45
Isabelle2016: merge master into 2016
2016-02-19 16:17:26 +11:00
Xin,Gao
1aed16085f
l4v-sabre: move a few word lemmas to WordLemmaBucket and fix styles of some proofs
2016-02-17 11:18:03 +11:00
Gao Xin
0d260252ff
l4v-sabre: rebase and fix proofs to infoflow
2016-02-17 11:18:02 +11:00
Gao Xin
bc73b112bd
l4v-sabre: change type of irq to be 10 word
2016-02-17 11:18:02 +11:00
Gao Xin
50fa257113
rebase and fix problems caused by new machine constants
2016-02-17 11:18:02 +11:00
Gao Xin
c45f88745c
l4v-sabre: minor fix on dmo_ackInterrupt and foldME
2016-02-17 11:18:02 +11:00
Gao Xin
bee4ba0052
l4v-sabre: fix refine
2016-02-17 11:18:02 +11:00
Matthew Brecknell
c65e290a8b
Isabelle2016: merge master into 2016
2016-02-16 12:52:24 +11:00
Joel Beeren
1d0366ac5e
msi: Restructure IOAPIC, MSI interrupts for x86, fix up ARM proofs for new API
2016-02-02 15:57:28 +11:00
Japheth Lim
b9c23eaa74
autocorres-crefine: update another corres_UL that snuck in before rebasing.
2016-01-28 14:30:54 +11:00
Miki Tanaka
d11f24a3a1
Refine finished for RC1
2016-01-23 22:51:48 +11:00
Miki Tanaka
674d476d83
option name changed from RC0
2016-01-23 00:34:41 +11:00
Miki Tanaka
b43f41abfd
A few more changes.
...
inj_on_image_set_diff: resolved the injection map lemma application issue in CSpace1_R.thy, CSpace_R.thy
Pair_fst_snd_eq chaged to prod_eq_iff in TcbAcc_R.thy, Schedule_R.thy, Retype_R.thy
TrueI removed in Schedule_R.thy
not_leE changed to not_le_imp_less in Retype_R.thy
2016-01-22 15:10:42 +11:00
Miki Tanaka
83574af10e
Invariants_H.thy: inductive definition needs explicit declaration to make xxx_def available
...
CSpace_I.thy: locale qualifier default changed
2016-01-22 15:10:42 +11:00
Japheth Lim
1b14082291
autocorres-crefine: add pre-no-fail flag to corres. Updated AI+Refine.
2016-01-22 15:08:14 +11:00
Daniel Matichuk
c282969c54
Merge remote-tracking branch 'verification/master' into arch_split
2016-01-21 10:22:48 +11:00
Daniel Matichuk
a34de66b9f
arch_split: fix crefine up to Interrupt_C
2016-01-20 14:42:36 +11:00
Daniel Matichuk
a8b7ee4ffe
repairing refine (simplified attribute now solves True)
2016-01-18 16:09:30 +11:00
Miki Tanaka
b7376a56e2
Isabelle 2016 update: minor fixes
2016-01-15 16:03:30 +11:00
Joel Beeren
efb4c61816
archirq: Remove redundant invocation, renamed
...
arch_decode_interrupt_control.
2016-01-14 17:50:33 +11:00
Daniel Matichuk
ca808130e6
repair ARM proofs up to Refine after factoring out architecture
2016-01-13 12:02:12 +11:00
Thomas Sewell
043a69c81b
Fix Orphanage from array changes, refactor.
...
Some generalisation is done in finaliseSlot_invs'' to avoid
duplicating it in Orphanage and PageTableDuplicates.
Finally cleanup in haskell translation.
2015-12-02 09:15:32 +11:00
Thomas Sewell
860f8f2225
Fixes for merge/rebase with mainline.
2015-12-02 09:15:26 +11:00
Thomas Sewell
375b526b0c
Finally done with array assertions.
2015-12-02 09:08:27 +11:00
Thomas Sewell
7e40646c48
Proof up to Fastpath_C.
...
The very last twist of this: the proof that resolveAddressBits can
be seen as functional needs to change, a lot, because it's now
sensitive to gsCNodes. Still working on that.
2015-12-02 09:07:49 +11:00
Thomas Sewell
4fd43512bb
WIP on handling array assertions. Up to Retype_C.
...
This is quite a lot of work in the end. I've had to gut most of
Retype_C along the way. Nearly done there.
2015-12-02 09:06:06 +11:00
Gerwin Klein
7bc4236077
remove accidentally committed file
2015-11-25 09:54:30 +13:00
Gerwin Klein
ac632c5aaa
Wait -> Recv: update proofs
2015-11-20 16:02:14 +11:00
Joel Beeren
457a55a831
add arch_tcb object to C, rename aep -> ntfn
2015-11-20 16:02:13 +11:00
Thomas Sewell
7c3a06a8d7
Minor adjustments caused by Strengthen changes.
2015-10-29 11:27:54 +11:00
Rafal Kolanski
d51402a5a2
Merge remote-tracking branch 'verification/master' into priority-bitmap
...
(seL4_NBWait)
2015-10-21 16:23:01 +11:00
Joel Beeren
e403eb8f0a
poll: added non blocking sync wait
2015-10-21 14:24:49 +11:00
Joel Beeren
d6f7579be7
poll: Added new syscall for polling async endpoints (non-blocking wait)
2015-10-21 14:24:49 +11:00
Rafal Kolanski
6f8cdae201
priority-bitmap: clean up Refine (i.e. "FIXME RAF")
2015-10-21 13:38:29 +11:00
Rafal Kolanski
c1eb235105
Merge 'verification/master' into priority-bitmap
...
Green build except for:
CParserTest (WTF Duplicate fact declaration "dc_20081211.dc_20081211.test_modifies")
AutoCorresSEL4 (waiting on result)
There is still a carefully managed sorry in Schedule_R, waiting on the C
parser FNSPEC+DONT_TRANSLATE fix.
2015-10-21 06:19:20 +11:00
Rafal Kolanski
930a2ff179
priority-bitmap: Update Haskell->C refinement
...
(modulo clz_spec locale problem)
2015-10-20 23:52:07 +11:00
Rafal Kolanski
7860bd4351
priority-bitmap: move word_log2/clz to WordLemmaBucket
...
Resolves some FIXMEs in Schedule_R.
2015-10-20 23:50:37 +11:00
Rafal Kolanski
2a9d3022f2
priority-bitmap: Update abstract->Haskell refinement
...
Added word_log2 and word_clz (inline for now, will migrate them out to
lib later).
Proved most important properties of word_log2 and some basic
count leading zeros properties (word_clz). The former were painful.
Thanks to Thomas, we have a nice tactic for dealing with complicated
obj_at' predicates in conclusion: normalise_obj_at'
2015-10-20 23:40:44 +11:00
Joel Beeren
038891ac7b
aep-binding: more cleanup
2015-10-07 14:57:55 +11:00
Joel Beeren
f117c99903
aep-binding: updated AInvs, Access, Refine for new decodeBindAEP
2015-09-15 16:31:14 +10:00
Ramana Kumar
0fb88ea01c
Merge branch 'master' into aep-merge
...
This commit should at least remove merge conflict markers, and the idea
is that at least refine, crefine, drefine, and infoflow (with sorrys)
build. Subsequent commits may be required to fix build issues that I
have not picked up.
2015-09-10 17:06:45 +10:00
Ramana Kumar
d88a931ec7
history squashed patch for aep-binding
2015-09-02 15:43:39 +10:00
Joel Beeren
3372cd32a8
SELFOUR-220: When calling handleWait, only delete the
...
TCB's ReplyCap when actually waiting on a synchronous
endpoint.
2015-07-23 14:45:17 +10:00
Thomas Sewell
b5f796184a
Repair spec/refine, I think.
2015-07-15 17:25:47 +10:00
Thomas Sewell
e9180d5cb5
Repair refine/crefine for WCET annotations.
2015-07-14 14:23:29 +10:00
Thomas Sewell
ca4391881c
WIP on WCET annotations.
2015-07-14 14:23:29 +10:00
Gerwin Klein
cfec9ea0db
Merge branch 'master' into 2015
2015-05-28 11:45:13 +10:00
Joel Beeren
002cf370bb
Updated proof with new fastpath changes removing setCurrentASID and armv_contextSwitch_fp
2015-05-28 11:30:22 +10:00
Gerwin Klein
12fa86863a
fewer warnings
2015-05-16 19:52:49 +10:00
Gerwin Klein
0c67e0bfa1
2015 update for Refine
2015-05-12 17:17:31 +02:00
Gerwin Klein
7e7d39c24e
enable XN in abstract spec; update AInvs and Refine
2014-11-28 08:58:57 +11:00
Gerwin Klein
dfa9c09892
abstract Haskell init parameters into constants
2014-11-06 18:48:36 +11:00
David Greenaway
cf0d1abce6
Merge 'master' into 'isabelle-2014'.
...
Conflicts:
proof/crefine/Fastpath_C.thy
proof/drefine/KHeap_DR.thy
proof/infoflow/Noninterference.thy
spec/design/version
sys-init/DuplicateCaps_SI.thy
sys-init/InitTCB_SI.thy
sys-init/Proof_SI.thy
tools/asmrefine/SimplExport.thy
tools/autocorres/tests/examples/SchorrWaite.thy
2014-09-17 14:21:13 +10:00
Joel Beeren
b3e2eb1f9d
ioapic: finished up to InfoFlowC
2014-08-28 15:56:26 +10:00
Thomas Sewell
9b01fada15
Refine working.
2014-08-11 18:51:04 +10:00
Thomas Sewell
fc6e57716a
Proof updates, working as far as AInvs.
2014-08-11 14:50:56 +10:00
Gerwin Klein
ded3a4a86f
option_map_def -> map_option_case for 2014-RC0
2014-08-09 21:09:37 +10:00
Gerwin Klein
1af1d2b67b
some of the global Isabelle2014 renames
...
option_case -> case_option
sum_case -> case_sum
prod_case -> case_prod
Option.set -> set_option
Option.map -> map_option
option_rel -> rel_option
list_all2_def -> list_all2_iff
map.simps -> list.map
tl.simps -> list.sel(2-3)
the.simps -> option.sel
2014-08-09 15:39:20 +10:00
David Greenaway
0fb7a8084d
misc: Proofing and formatting of README.md files.
...
Attempt to improve readability of the files when viewed as plain ASCII;
proof-read and fix minor issues.
2014-07-28 13:15:48 +10:00
Toby Murray
93375ba96d
Initial README.md files for proof/
2014-07-24 13:31:57 +10:00
Gerwin Klein
154da63715
remove old levity and taint-mode comments
2014-07-22 18:10:28 +02:00
Gerwin Klein
50dda7708c
comment cleanup
2014-07-22 18:10:20 +02:00
Gerwin Klein
9d9a325032
Updates for getpaddr system call (by Joel Beeren)
2014-07-18 17:21:34 +02:00
Gerwin Klein
84595f4233
release cleanup
2014-07-17 18:22:50 +02:00
Gerwin Klein
2a03e81df4
Import release snapshot.
2014-07-14 21:32:44 +02:00