adbrucker
/
lh-l4v
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
lh-l4v/proof/crefine
History
Michael McInerney de871a7c64 arm_hyp ainvs+refine+crefine: update for change to associate_vcpu_tcb 
Signed-off-by: Michael McInerney <m.mcinerney@unsw.edu.au>
 		2022-03-08 21:49:10 +10:30
..
ARM spec+proof: use generated config constants 2021-12-23 14:54:13 +11:00
ARM_HYP arm_hyp ainvs+refine+crefine: update for change to associate_vcpu_tcb 2022-03-08 21:49:10 +10:30
RISCV64 spec+proof: use generated config constants 2021-12-23 14:54:13 +11:00
X64 spec+proof: use generated config constants 2021-12-23 14:54:13 +11:00
autocorres-test lib proof: reorder the assumptions of corres_split 2021-02-19 11:37:12 +11:00
base crefine: session structure update for Isabelle2020 2020-10-27 15:52:31 +10:00
intermediate crefine: enable intermediate CRefine session for Isabelle2020 2020-10-27 15:52:31 +10:00
lib isabelle-2021: ad-hoc adjustions to preview 2021-09-30 16:53:17 +10:00
Move_C.thy crefine: make proofs independent of number of domains 2021-12-22 23:50:22 +11:00
README.md READMEs: fix publication links 2021-08-25 11:22:05 +10:00

README.md

C Refinement Proof

This proof establishes that seL4's C code, once translated into Isabelle/HOL using Michael Norrish's C parser, is a formal refinement (i.e. a correct implementation) of its design specification and, transitively (using the results of the Design Spec Refinement Proof) seL4's C code is also a formal refinement of its abstract specification. In other words, this proof establishes that seL4's C code correctly implements its abstract specification.

The approach used for the proof is described in the TPHOLS '09 [paper][5].

Building

To build from the l4v/proof directory, run:

make CRefine

If you wish to build for a specific architecture other than the default, set your L4V_ARCH environment variable accordingly, as documented for the C code translation.

Important Theories

The top-level theory where the refinement statement is established over the entire kernel is Refine_C; the state-relation that relates the state-spaces of the two specifications is defined in StateRelation_C.

Note that this proof deals with two C-level semantics of seL4: one produced directly by the C parser from the kernel's C code, and another produced by the C spec's Substitute theory. These proofs largely operate on the latter, proving that it corresponds to the design spec. Refinement between the two C-level specs is proved in the CToCRefine theory. The top-level Refine_C theory quotes both refinement properties.