#
c798c20d |
|
27-Mar-2020 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
access: Isabelle2020 update Signed-off-by: Gerwin Klein <gerwin.klein@data61.csiro.au>
|
#
a424d55e |
|
09-Mar-2020 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
licenses: convert license tags to SPDX
|
#
dd48e0d8 |
|
06-May-2019 |
Corey Lewis <corey.lewis@data61.csiro.au> |
proof: update for wp changes Updated 'wp_once' to 'wp (once)' and removed several stray uses of 'wp_trace'.
|
#
c34840d0 |
|
05-Jun-2019 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
global: isabelle update_cartouches
|
#
4463e975 |
|
12-Jun-2019 |
Michael McInerney <Michael.McInerney@data61.csiro.au> |
SELFOUR-1198: update proofs for correct restart PC Fixes a case where a thread can go from Running->Inactive->Restart and use a restart PC that is out of date. An out of date restart PC occurs when a thread was transitioned to running after being in a blocked state, but was never scheduled and so did not execute the traps code that updates the restart PC. This also renames relevant register names for consistency across architectures (FaultIP and NextIP).
|
#
bed48eba |
|
03-Apr-2019 |
Victor Phan <Victor.Phan@data61.csiro.au> |
access-control: update for new definition of set_object
|
#
86bbe323 |
|
22-May-2018 |
Thibaut Perami <thibaut.perami@data61.csiro.au> |
access: Fix for GrantReply (SELFOUR-6) Integrity and pasRefined are majorly changed The main repercussions are: - 3 new authorities in the policy: Call, Reply, and DeleteDerived - The cdt and the caps state are linked in pasRefined - CDT parentship no longer implies control in certain cases (is_transferable) - CDT parentship now implies DeleteDerived - Introduction of cdt_change_allowed that specifies which slot your are allowed to modify - Integrity for CDT and CDT list use cdt_changes_allowed - Integrity for objects in now expressed as a transitive closure of atomic transition rules
|
#
8173a37c |
|
13-Aug-2018 |
Mitchell Buckley <mitchell.buckley@data61.csiro.au> |
Updated specs and proofs for SELFOUR-1491: control IRQ triggering on ARM.
|
#
6b9d9d24 |
|
09-Jun-2018 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
Isabelle2018: new "op x" syntax; now is "(x)" (result of "isabelle update_op -m <dir>")
|
#
b5cdf470 |
|
13-Jun-2018 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
globally use session-qualified imports; add Lib session Session-qualified imports will be required for Isabelle2018 and help clarify the structure of sessions in the build tree. This commit mainly adds a new set of sessions for lib/, including a Lib session that includes most theories in lib/ and a few separate sessions for parts that have dependencies beyond CParser or are separate AFP sessions. The group "lib" collects all lib/ sessions. As a consequence, other theories should use lib/ theories by session name, not by path, which in turns means spec and proof sessions should also refer to each other by session name, not path, to avoid duplicate theory errors in theory merges later.
|
#
2d0baab4 |
|
13-Mar-2018 |
Corey Lewis <corey.lewis@data61.csiro.au> |
Proof update for crunch changes
|
#
84633ccb |
|
26-Feb-2018 |
Gerwin Klein <gerwin.klein@data61.csiro.au> |
ARM access: proof update for user_context refactor
|
#
4601f2a1 |
|
06-Feb-2018 |
Joel Beeren <joel.beeren@data61.csiro.au> |
Genericise deletion actions that occur after empty_slot This patch adds a generic "post_cap_deletion" step that is called by finalise_slot. Previous to this, the only caps which had actions required at this stage were IRQHandlerCaps -- it was required that the IRQ bitmap be updated after the cap itself was removed (as the invariants state that for any existing IRQHandlerCap, the corresponding bit in the IRQ bitmap must be set). By genericising this, we add the capacity for new, arch-specific post cap deletion actions to occur in the future.
|
#
2a1beffa |
|
26-Nov-2017 |
Miki Tanaka <miki.tanaka@nicta.com.au> |
arm: update for simple_ko getter/setter
|
#
3a22487c |
|
24-Nov-2017 |
Rafal Kolanski <rafal.kolanski@nicta.com.au> |
arm: revise scheduler / fastpath / scheduler bitmaps (SELFOUR-242) Colloquially known as "invert-fastpath". Update verification efforts on ARM for the following seL4 changes: - scheduling decisions done in possibleSwitchTo are moved to the scheduler - possibleSwitchTo only checks whether the candidate is valid for a fast switch, not its priority, accepting possible candidates immmediately as a switch-to scheduler action - the scheduler checks the candidate against the current thread and against the bitmaps before making a decision - attemptSwitchTo and switchIfRequiredTo are gone - scheduler is now more complicated, and numerous proofs related to it are rewritten from scratch - fast path now checks ready queues via the scheduler bitmaps - L2 scheduler bitmap order reversed for better cache locality Many iterations between the kernel and verification teams were needed to get this right.
|
#
796887d9 |
|
11-Jul-2017 |
Alejandro Gomez-Londono <alejandro.gomez@nicta.com.au> |
Removes all trailing whitespaces
|
#
41fe1a08 |
|
04-Jun-2016 |
Miki Tanaka <miki.tanaka@nicta.com.au> |
update proofs for SELFOUR-30/291 "Reschedule on self-modification" - SELFOUR-30 Reschedule when changing own IPC buffer Previously if you invoked the TCB of the current thread and changed the IPC buffer frame this would not immediately take affect, as the kernels view of the current IPC buffer is updated in Arch_switchToThread. This change forces Arch_switchToThread to get called, even if we would switch back to the original thread. - SELFOUR-291 Reschedule when changing own registers Previously if you wrote to TCB of the current thread and changed the TLS_BASE this would not immediately take affect, as the kernel only updates this register in Arch_switchToThread. This change forces Arch_switchToThread to get called, even if we would switch back to the original thread.
|
#
b2f2034b |
|
21-Feb-2017 |
Miki Tanaka <miki.tanaka@nicta.com.au> |
Bisim / Access / InfoFlow: updates for Hypervisor stub
|
#
47119bf4 |
|
13-Jan-2017 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
wp_cleanup: update proofs for new wp behaviour The things that usually go wrong: - wp fall through: add +, e.g. apply (wp select_wp) -> apply (wp select_wp)+ - precondition: you can remove most hoare_pre, but wpc still needs it, and sometimes the wp instance relies on being able to fit a rule to the current non-schematic precondition. In that case, use "including no_pre" to switch off the automatic hoare_pre application. - very rarely there is a schematic postcondition that interferes with the new trivial cleanup rules, because the rest of the script assumes some specific state afterwards (shouldn't happen in a reasonable proof, but not all proofs are reasonable..). In that case, (wp_once ...)+ should emulate the old behaviour precisely.
|
#
511c6b2d |
|
03-Nov-2016 |
Matthew Brecknell <Matthew.Brecknell@data61.csiro.au> |
Isabelle2016-1: rename free variables to avoid capture
|
#
41d4aa4f |
|
25-Oct-2016 |
Matthew Brecknell <Matthew.Brecknell@data61.csiro.au> |
Isabelle2016-1: update references to renamed constants and facts
|
#
1289f7bc |
|
09-Nov-2016 |
Alejandro Gomez-Londono <alejandro.gomez@nicta.com.au> |
Updating remaining proofs for tcb_arch reserved_irq and arch_fault changes * tcb_context rephrasing to (tcb_context o tcb_arch) and respectively for set operations * unfolding of reserved_irq for trivially solving most lemmas * Changes to the inductive definition of integrity_obj to account for tcb_arch and tcb_context new location * Changes to the tcb examples in ExampleSystem to include tcb_arch * Rephrasing of domain_sep_inv to accommodate the ReservedIRQ case * Mostly rephrasing of tcb_context to (some form of) (tcb_context o tcb_arch) * Trivial unfolding of handle_reserved_irq for hoare rules * Examples in Example_Valid_State.thy were updated * Nothing remarkable, mostly rephrasing of tcb_context and ReservedIRQ handling * Fun fact, some proofs are now shorter tags: [VER-623][SELFOUR-413]
|
#
2553371a |
|
06-Nov-2016 |
Joel Beeren <joel.beeren@nicta.com.au> |
SELFOUR-64: Remove general Recycle operation This removes the RecycleCap CNodeInvocation, whilst retaining recycle behaviour for Endpoints -- now renamed CNodeCancelBadgedSends.
|
#
411af12e |
|
23-May-2016 |
Thomas Sewell <Thomas.Sewell@nicta.com.au> |
SELFOUR-444: Logic generalised; Access finished. Tweak AInvs proof for Untyped to be more reusable, finish integrity proofs.
|
#
a3714e81 |
|
03-Oct-2016 |
Matthew Brecknell <Matthew.Brecknell@data61.csiro.au> |
SELFOUR-276: Finish proofs for maximum controlled priority (MCP) To finish the proof of refinement to C, the specification for checkPrio needed strengthening: the checkPrio spec now takes a machine word argument. In the spec, priorities are still stored as 8-bit quantities, however. Once the spec was strenthened, it was possible to remove some redundant checks and mask operations from the C code. A thread's maximum controlled priority (MCP) determines the maximum thread priority or MCP it can assign to another thread (or itself).
|
#
252ce8df |
|
09-Aug-2016 |
Xin,Gao <xin.gao@nicta.com.au> |
SELFOUR-421: infoflow and infoflow_c builds
|
#
eb7f7b15 |
|
29-Jun-2016 |
Miki Tanaka <miki.tanaka@nicta.com.au> |
arch-split: Tcb_AI.thy done
|
#
322f1023 |
|
18-Apr-2016 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
word_lib: adjust theory dependencies
|
#
9ceed1eb |
|
03-May-2016 |
Daniel Matichuk <daniel.matichuk@nicta.com.au> |
arch_split: fix proofs after removing shadow and unqualify commands and adding fix for crunch. Checks up to DPolicy.
|
#
0e5ffd1e |
|
27-Apr-2016 |
Matthew Brecknell <Matthew.Brecknell@nicta.com.au> |
arch_split: requalify abstract theories
|
#
14f75701 |
|
21-Apr-2016 |
Matthew Brecknell <Matthew.Brecknell@nicta.com.au> |
arch_split: Access checking
|
#
6f6c5816 |
|
09-Feb-2016 |
Miki Tanaka <miki.tanaka@nicta.com.au> |
SELFOUR-56: Remove diminish rights from IPC
|
#
ac632c5a |
|
10-Nov-2015 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
Wait -> Recv: update proofs
|
#
457a55a8 |
|
01-Nov-2015 |
Joel Beeren <joel.beeren@nicta.com.au> |
add arch_tcb object to C, rename aep -> ntfn
|
#
7c3a06a8 |
|
28-Oct-2015 |
Thomas Sewell <Thomas.Sewell@nicta.com.au> |
Minor adjustments caused by Strengthen changes.
|
#
e403eb8f |
|
20-Oct-2015 |
Joel Beeren <joel.beeren@nicta.com.au> |
poll: added non blocking sync wait
|
#
d6f7579b |
|
15-Oct-2015 |
Joel Beeren <joel.beeren@nicta.com.au> |
poll: Added new syscall for polling async endpoints (non-blocking wait)
|
#
d88a931e |
|
01-Sep-2015 |
Ramana Kumar <Ramana.Kumar@nicta.com.au> |
history squashed patch for aep-binding
|
#
3372cd32 |
|
15-Jul-2015 |
Joel Beeren <joel.beeren@nicta.com.au> |
SELFOUR-220: When calling handleWait, only delete the TCB's ReplyCap when actually waiting on a synchronous endpoint.
|
#
12fa8686 |
|
16-May-2015 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
fewer warnings
|
#
177e5bf1 |
|
06-May-2015 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
2015 update for access
|
#
9d9a3250 |
|
18-Jul-2014 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
Updates for getpaddr system call (by Joel Beeren)
|
#
84595f42 |
|
17-Jul-2014 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
release cleanup
|
#
2a03e81d |
|
14-Jul-2014 |
Gerwin Klein <gerwin.klein@nicta.com.au> |
Import release snapshot.
|