History

Matthew Brecknell b16496e7cf arch_split: InfoFlowC checking		2016-05-06 13:15:37 +10:00
..
ADT_H.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
ArchAcc_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
Arch_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
Bits_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
BuildRefineCache.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
CNodeInv_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
CSpace1_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
CSpace_I.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
CSpace_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
Cache.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Corres.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Detype_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
EmptyFail.thy	arch_split: replaced sublocale with global_naming	2016-04-27 14:32:38 +10:00
EmptyFail_H.thy	arch_split: InfoFlowC checking	2016-05-06 13:15:37 +10:00
Finalise_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
IncKernelInit.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Include.thy	repair ARM proofs up to Refine after factoring out architecture	2016-01-13 12:02:12 +11:00
InitLemmas.thy	2015 update for Refine	2015-05-12 17:17:31 +02:00
InterruptAcc_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
Interrupt_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
Invariants_H.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
Invocations_R.thy	arch_split: replaced sublocale with global_naming	2016-04-27 14:32:38 +10:00
IpcCancel_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
Ipc_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
KHeap_R.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
KernelInit_R.thy	abstract Haskell init parameters into constants	2014-11-06 18:48:36 +11:00
LevityCatch.thy	arch_split: replaced sublocale with global_naming	2016-04-27 14:32:38 +10:00
Machine_R.thy	arch_split: replaced sublocale with global_naming	2016-04-27 14:32:38 +10:00
Orphanage.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
PageTableDuplicates.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
RAB_FN.thy	Finally done with array assertions.	2015-12-02 09:08:27 +11:00
README.md	misc: Proofing and formatting of README.md files.	2014-07-28 13:15:48 +10:00
Refine.thy	arch_split: Refine checking, except Orphanage	2016-04-29 18:15:54 +10:00
Retype_R.thy	arch_split: CRefine: use requalify instead of shadow	2016-05-06 08:59:33 +10:00
Schedule_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
StateRelation.thy	arch_split: Refine checking up to end of Finalise_R	2016-04-28 17:16:49 +10:00
SubMonad_R.thy	arch_split: CRefine checking	2016-05-04 15:07:51 +10:00
Syscall_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
TcbAcc_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
Tcb_R.thy	arch_split: Refine: fixup some qualified references	2016-05-02 16:11:13 +10:00
Untyped_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00
VSpace_R.thy	arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.	2016-05-04 15:14:41 +10:00

README.md

Design Spec Refinement Proof

This proof establishes that seL4's design specification is a formal refinement (i.e. a correct implementation) of its abstract specification. This proof also interweaves the definition and proofs of the global invariant for the design specification, and builds on the Abstract Spec Invariant Proof. It is described in the TPHOLS '08 paper.

Building

To build from the l4v/ directory, run:

./isabelle/bin/isabelle build -d . -v -b Refine

Important Theories

The top-level theory where the refinement statement is established over the entire kernel is Refine; the state-relation that relates the state-spaces of the two specifications is defined in StateRelation and the basic correspondence property proved over each kernel function is defined in Corres.