Make proof generic over current seL4 RISC-V platforms by lsf37 · Pull Request #1024 · seL4/l4v

lsf37 · 2026-07-02T03:13:54Z

This PR mostly makes the treatment of maxIRQ generic in the proofs, which is the only not-yet-generic parameter that still varies between RISC-V platforms. This means, after this PR is merged, all seL4 RISC-V platforms are supported by the full RISC-V proof stack.

Part of this update is fixing the machine interface definition getActiveIRQ for RISC-V. It was suppressing IRQ 0xFF, which was an invalid IRQ for a previous architecture, not for RISC-V. There is no effect on the proof, since this is an assumption that was not made use of anywhere (invalidIRQ = 0 on RISC-V).

PR for verified configs here: seL4/seL4#1698. I'm planning to make a separate PR for adding some of these to CI one both PRs are merged.

Xaphiosis · 2026-07-02T05:52:19Z

Commits:

riscv aspec: adjustments for generic maxIRQ has the following in the comment:
- make sure we are referring to Kernel_Config.maxIRQ however the contents of the commit does not have anything related to Kernel_Config. Removing that reduces the bullet point list to one point, and so it can stop being a list.
riscv proofs: update for generic maxIRQ: the phrase which also simplifies most proofs that are involved. could use some clarification... do you maybe mean "proofs involving them" (where them = the properties?)

Useful for reducing proof effort in showing pspace_distinct' and other distinctness properties for concrete states. The auxiliary concept of aligned_offsets (an array of smaller objects making up a larger object) could be useful in the definitions of CNodes, page tables, etc in the design spec. Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>

- add machine declarations for maxIRQ - remove old manual maxIRQ definition - add interface lemmas for maxIRQ Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>

Change the definition of getActiveIRQ in RISCV64 to not suppress 0xFF, which was an invalid IRQ of some previous platform. Instead check for symbolic irqInvalid. From the proof perspective, even this check is not necessary, but it models actual hardware behaviour where irqInvalid (= irq 0) is reserved to mean "no IRQ". Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>

Increase alignment of IRQ node in example init state and add alignment check lemma (also used later in AInvs). We need to increase alignment, because some platforms have a much larger number of IRQs (>512). Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>

Use properties from Arch_Kernel_Config_Lemmas instead of unfolding, which also simplifies most proofs that used these Kernel_Config constants. Improve the pspace_distinct' proof in the infoflow refine state example by making use of the new Sorted_Addresses library. Signed-off-by: Gerwin Klein <gerwin.klein@proofcraft.systems>

lsf37 requested review from Xaphiosis and corlewis July 2, 2026 03:13

lsf37 mentioned this pull request Jul 2, 2026

configs: proofs now generic in RISC-V config; add stm32mp2 for AArch64 seL4/seL4#1698

Merged

lsf37 force-pushed the riscv-maxIRQ branch from 426836a to 1edc961 Compare July 2, 2026 03:20