63888fa98d
SELFOUR-444: AInvs proven for preemptible retype.
2016-11-02 11:19:08 +11:00
a3714e8190
SELFOUR-276: Finish proofs for maximum controlled priority (MCP)
...
To finish the proof of refinement to C, the specification for checkPrio
needed strengthening: the checkPrio spec now takes a machine word
argument. In the spec, priorities are still stored as 8-bit quantities,
however. Once the spec was strenthened, it was possible to remove some
redundant checks and mask operations from the C code.
A thread's maximum controlled priority (MCP) determines the maximum
thread priority or MCP it can assign to another thread (or itself).
2016-10-05 02:43:41 +11:00
20539620f9
SELFOUR-276: Add MCP to specs and invariants
...
A thread's maximum controlled priority (MCP) determines the maximum
thread priority or MCP it can assign to another thread (or itself).
2016-10-05 02:43:41 +11:00
8d4a8eb238
SELFOUR-421: fix coding style
2016-09-22 19:23:28 +10:00
113315d9a6
SELFOUR-421: merge and fix up to ArmConfidentiality proof
2016-09-22 19:21:56 +10:00
252ce8df4c
SELFOUR-421: infoflow and infoflow_c builds
2016-09-22 19:11:37 +10:00
328846ee1a
SELFOUR-421: crefine builds
2016-09-22 19:11:37 +10:00
7784e80940
SELFOUR-421: fix refine
2016-09-22 19:11:36 +10:00
c3be923ca0
SELFOUR-421: a defend version before wild changes
2016-09-22 19:11:36 +10:00
3c223b42fe
SELFOUR-421: AInvs done, no added invariants yet
2016-09-22 19:11:29 +10:00
1013e959c1
arch_split: give some vspace concepts more generic names
...
In particular rename "pd" to "vspace", when the pd represents
an address space.
2016-08-03 14:46:48 +10:00
f9f160ed14
arch_split: replace some fixed word sizes with type aliases
...
Changed some instances of word32 to machine_word, and "10 word" to irq.
Also introduce a type_synonym for "machine_word_len".
2016-08-03 14:46:23 +10:00
b9313f6d11
arch_split: invariants: tidied
2016-06-15 10:15:26 +10:00
aceb021f88
arch_split: invariants: split Retype_AI [VER-556]
2016-06-08 10:33:09 +10:00
9ceed1eb12
arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.
2016-05-04 15:14:41 +10:00
4e6369f86d
arch_split: invariants: Finalise_AI checking
2016-04-15 15:11:32 +10:00
d683425e0d
arch_split: invariants: fixup CSpaceInv_AI, working on Finalise_AI
2016-04-14 19:01:20 +10:00
04362dba27
arch_split: some quick and dirty arch_splitting by selectively interpreting the ARM locale (with FIXMEs)
2016-04-07 17:05:14 +10:00
ab09d49b59
arch_split: checkpoint. Checks up to ArchVSpace_AI with two sorries (MattB WIP)
2016-04-06 17:57:47 +10:00
69d7b50dae
arch_split: CSpaceInv_AI work-in-progress
2016-04-04 10:49:18 +10:00
f89279e381
arch_split: reworking predicates about arch objects and types
2016-03-24 17:24:14 +11:00
5e2f9a5e7c
arch_split: change caps_of_state to be explicit projection f caps_of_state
2016-03-04 19:03:45 +11:00
cdc0a840fe
arch_split: change aobj_at to definition instead of abbreviation
2016-03-02 13:15:15 +11:00
8cc95bfb8e
arch_split: merge master into arch_split
2016-03-01 11:30:47 +11:00
6f6c58168c
SELFOUR-56: Remove diminish rights from IPC
2016-02-24 13:24:10 +11:00
d107cb6758
arch_split: halfway into KHeap_AI
2016-02-22 17:48:52 +11:00
84d2889d45
Isabelle2016: merge master into 2016
2016-02-19 16:17:26 +11:00
df8261c121
arch_split: split up Invariants_AI
2016-02-17 16:36:29 +11:00
bc73b112bd
l4v-sabre: change type of irq to be 10 word
2016-02-17 11:18:02 +11:00
c65e290a8b
Isabelle2016: merge master into 2016
2016-02-16 12:52:24 +11:00
1018d01b6f
arch_split: More namespacing progress and invariant splitting. Checks halfway into Invariants_AI
2016-02-05 17:00:06 +11:00
9718f1bda2
arch_split: progress on namespacing abstract spec
2016-02-05 16:59:18 +11:00
ca808130e6
repair ARM proofs up to Refine after factoring out architecture
2016-01-13 12:02:12 +11:00
3be2eaa7b0
repairing AInvs: checks up to the middle of VSpace_AI
2016-01-12 18:10:36 +11:00
457a55a831
add arch_tcb object to C, rename aep -> ntfn
2015-11-20 16:02:13 +11:00
0fb88ea01c
Merge branch 'master' into aep-merge
...
This commit should at least remove merge conflict markers, and the idea
is that at least refine, crefine, drefine, and infoflow (with sorrys)
build. Subsequent commits may be required to fix build issues that I
have not picked up.
2015-09-10 17:06:45 +10:00
d88a931ec7
history squashed patch for aep-binding
2015-09-02 15:43:39 +10:00
12fa86863a
fewer warnings
2015-05-16 19:52:49 +10:00
17826f9b49
more Isabelle2015 update; AInvs up to (excluding) Syscall_AI
...
also includes some global replacements
2015-04-18 21:51:26 +01:00
7e7d39c24e
enable XN in abstract spec; update AInvs and Refine
2014-11-28 08:58:57 +11:00
fc6e57716a
Proof updates, working as far as AInvs.
2014-08-11 14:50:56 +10:00
1af1d2b67b
some of the global Isabelle2014 renames
...
option_case -> case_option
sum_case -> case_sum
prod_case -> case_prod
Option.set -> set_option
Option.map -> map_option
option_rel -> rel_option
list_all2_def -> list_all2_iff
map.simps -> list.map
tl.simps -> list.sel(2-3)
the.simps -> option.sel
2014-08-09 15:39:20 +10:00
50dda7708c
comment cleanup
2014-07-22 18:10:20 +02:00
84595f4233
release cleanup
2014-07-17 18:22:50 +02:00
2a03e81df4
Import release snapshot.
2014-07-14 21:32:44 +02:00
Thomas Sewell
Matthew Brecknell
Sophie Taylor
Xin,Gao
Joel Beeren
Matthew Brecknell
Daniel Matichuk
Miki Tanaka
Ramana Kumar
Gerwin Klein