History

Gerwin Klein e4b54fea78 capDL spec: fewer warnings		2015-05-09 13:05:01 +02:00
..
Asid_D.thy	fix DSpecProofs	2014-09-09 15:57:52 +10:00
CNode_D.thy	release cleanup	2014-07-17 18:22:50 +02:00
CSpace_D.thy	capDL spec: fewer warnings	2015-05-09 13:05:01 +02:00
Decode_D.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Endpoint_D.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Intents_D.thy	fix DSpecProofs	2014-09-09 15:57:52 +10:00
Interrupt_D.thy	ioapic: finished up to InfoFlowC	2014-08-28 15:56:26 +10:00
Invocations_D.thy	page_map_unmap_cancel : cdl spec changed and drefine fixed.	2014-09-05 14:48:22 +10:00
KHeap_D.thy	release cleanup	2014-07-17 18:22:50 +02:00
Monads_D.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
PageTableUnmap_D.thy	Merge branch 'master' into 'isabelle-2014'.	2014-09-23 14:31:33 +10:00
PageTable_D.thy	page_map_unmap_cancel : cdl spec changed and drefine fixed.	2014-09-05 14:48:22 +10:00
README.md	misc: Proofing and formatting of README.md files.	2014-07-28 13:15:48 +10:00
Schedule_D.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Syscall_D.thy	Import release snapshot.	2014-07-14 21:32:44 +02:00
Tcb_D.thy	Fix seL4_TCB_Resume	2014-09-12 15:28:47 +10:00
Types_D.thy	capDL spec: fewer warnings	2015-05-09 13:05:01 +02:00
Untyped_D.thy	release cleanup	2014-07-17 18:22:50 +02:00

README.md

The capDL Specification of seL4

l4v/spec/capDL/

This directory contains the Isabelle sources of the seL4 behaviour specification on the capDL abstraction level. The key features of this abstraction level are that it models the complete protection state of the kernel in terms of capabilities, and models, as far as possible, only the protection state of the kernel (no memory or other state). This means, the capDL specification contains a significantly higher degree of nondeterminism compared to the other seL4 specs.

This specification is useful for the user-level initialiser that brings the system from boot state into a defined protection state defined by a concrete capDL description.

There is a refinement proof between the abstract specification and the capDL specification in proof/drefine/. The capDL spec also forms the basis of the system initialiser proofs.

Top-Level Theory

The top-level theory file in the specification is Syscall_D, the top-level function in that theory is call_kernel.

Entry Points

A key theory in the capDL spec is Types_D which defines a new capability type that in addition to the seL4 capabilities contains 'virtual' capabilities which store protection state information. For instance, the state of MMU page tables is uniformly modelled as capabilities.

Building

The corresponding Isabelle session is DSpec. To build, run in directory l4v/spec:

make DSpec