From 3e8981eba2a76b36b4aafd18889b55c96229949b Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Thu, 4 Aug 2022 13:41:55 -0400 Subject: [PATCH 1/7] Undo syntax changes preventing VeriFast parsing --- FreeRTOS/Test/VeriFast/include/proof/list.h | 618 ++++++++------- FreeRTOS/Test/VeriFast/include/proof/queue.h | 706 +++++++++--------- .../VeriFast/include/proof/queuecontracts.h | 36 +- .../Test/VeriFast/list/listLIST_IS_EMPTY.c | 5 +- FreeRTOS/Test/VeriFast/list/uxListRemove.c | 402 +++++----- FreeRTOS/Test/VeriFast/list/vListInitialise.c | 26 +- FreeRTOS/Test/VeriFast/list/vListInsert.c | 430 ++++++----- FreeRTOS/Test/VeriFast/list/vListInsertEnd.c | 348 +++++---- FreeRTOS/Test/VeriFast/queue/create.c | 216 +++--- .../VeriFast/queue/prvCopyDataFromQueue.c | 53 +- .../Test/VeriFast/queue/prvCopyDataToQueue.c | 165 ++-- FreeRTOS/Test/VeriFast/queue/prvLockQueue.c | 15 +- FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c | 102 ++- .../VeriFast/queue/uxQueueMessagesWaiting.c | 10 +- .../VeriFast/queue/uxQueueSpacesAvailable.c | 10 +- FreeRTOS/Test/VeriFast/queue/vQueueDelete.c | 69 +- .../Test/VeriFast/queue/xQueueGenericSend.c | 217 +++--- .../VeriFast/queue/xQueueGenericSendFromISR.c | 181 +++-- .../queue/xQueueIsQueueEmptyFromISR.c | 13 +- .../VeriFast/queue/xQueueIsQueueFullFromISR.c | 13 +- FreeRTOS/Test/VeriFast/queue/xQueuePeek.c | 70 +- .../Test/VeriFast/queue/xQueuePeekFromISR.c | 23 +- FreeRTOS/Test/VeriFast/queue/xQueueReceive.c | 76 +- .../VeriFast/queue/xQueueReceiveFromISR.c | 25 +- 24 files changed, 1861 insertions(+), 1968 deletions(-) diff --git a/FreeRTOS/Test/VeriFast/include/proof/list.h b/FreeRTOS/Test/VeriFast/include/proof/list.h index 18f4be5abc..3800114434 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/list.h +++ b/FreeRTOS/Test/VeriFast/include/proof/list.h @@ -30,14 +30,14 @@ #define VERIFAST #include #include -/*@#include "common.gh" */ +//@#include "common.gh" -typedef size_t TickType_t; -typedef size_t UBaseType_t; -typedef ssize_t BaseType_t; +typedef size_t TickType_t; +typedef size_t UBaseType_t; +typedef ssize_t BaseType_t; -#define pdTRUE 1 -#define pdFALSE 0 +#define pdTRUE 1 +#define pdFALSE 0 /* Empty/no-op macros */ #define mtCOVERAGE_TEST_MARKER() @@ -50,327 +50,323 @@ typedef ssize_t BaseType_t; #define listSET_SECOND_LIST_ITEM_INTEGRITY_CHECK_VALUE( pxListItem ) /* Max value stored in sentinel xListEnd element */ -#define portMAX_DELAY UINT_MAX +#define portMAX_DELAY UINT_MAX struct xLIST; -struct xLIST_ITEM -{ - TickType_t xItemValue; - struct xLIST_ITEM * pxNext; - struct xLIST_ITEM * pxPrevious; - void * pvOwner; - struct xLIST * pxContainer; +struct xLIST_ITEM { + TickType_t xItemValue; + struct xLIST_ITEM * pxNext; + struct xLIST_ITEM * pxPrevious; + void * pvOwner; + struct xLIST *pxContainer; }; typedef struct xLIST_ITEM ListItem_t; -typedef struct xLIST -{ - UBaseType_t uxNumberOfItems; - struct xLIST_ITEM * pxIndex; - #ifdef VERIFAST /*< ***change MiniList_t to ListItem_t*** */ - struct xLIST_ITEM xListEnd; - #else - MiniListItem_t xListEnd; - #endif +typedef struct xLIST { + UBaseType_t uxNumberOfItems; + struct xLIST_ITEM *pxIndex; +#ifdef VERIFAST /*< ***change MiniList_t to ListItem_t*** */ + struct xLIST_ITEM xListEnd; +#else + MiniListItem_t xListEnd; +#endif } List_t; /*@ - * predicate xLIST_ITEM( - * struct xLIST_ITEM *n, - * TickType_t xItemValue, - * struct xLIST_ITEM *pxNext, - * struct xLIST_ITEM *pxPrevious, - * struct xLIST *pxContainer;) = - * n->xItemValue |-> xItemValue &*& - * n->pxNext |-> pxNext &*& - * n->pxPrevious |-> pxPrevious &*& - * n->pvOwner |-> _ &*& - * n->pxContainer |-> pxContainer; - * @*/ +predicate xLIST_ITEM( + struct xLIST_ITEM *n, + TickType_t xItemValue, + struct xLIST_ITEM *pxNext, + struct xLIST_ITEM *pxPrevious, + struct xLIST *pxContainer;) = + n->xItemValue |-> xItemValue &*& + n->pxNext |-> pxNext &*& + n->pxPrevious |-> pxPrevious &*& + n->pvOwner |-> _ &*& + n->pxContainer |-> pxContainer; +@*/ /* Ferreira et al. (STTT'14) doubly-linked list segment (DLS). */ - /*@ - * predicate DLS( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *nprev, - * struct xLIST_ITEM *mnext, - * struct xLIST_ITEM *m, - * list cells, - * list vals, - * struct xLIST *pxContainer) = - * n == m - * ? cells == cons(n, nil) &*& - * vals == cons(?v, nil) &*& - * xLIST_ITEM(n, v, mnext, nprev, pxContainer) - * : cells == cons(n, ?cells0) &*& - * vals == cons(?v, ?vals0) &*& - * xLIST_ITEM(n, v, ?o, nprev, pxContainer) &*& DLS(o, n, mnext, m, cells0, vals0, pxContainer); - * - * lemma void dls_star_item( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *m, - * struct xLIST_ITEM *o) - * requires DLS(n, ?nprev, ?mnext, m, ?cells, ?vals, ?l) &*& xLIST_ITEM(o, ?v, ?onext, ?oprev, ?l2); - * ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& xLIST_ITEM(o, v, onext, oprev, l2) &*& mem(o, cells) == false; - * { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * if (n == m) { - * assert xLIST_ITEM(n, _, _, _, _); - * open xLIST_ITEM(n, _, _, _, _); - * open xLIST_ITEM(o, _, _, _, _); - * assert n != o; - * close xLIST_ITEM(o, _, _, _, _); - * close xLIST_ITEM(n, _, _, _, _); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } - * else { - * assert DLS(?nnext, n, mnext, m, tail(cells), tail(vals), l); - * dls_star_item(nnext, m, o); - * open xLIST_ITEM(n, _, _, _, _); - * open xLIST_ITEM(o, _, _, _, _); - * assert n != o; - * close xLIST_ITEM(o, _, _, _, _); - * close xLIST_ITEM(n, _, _, _, _); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } - * } - * - * lemma void dls_distinct( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *nprev, - * struct xLIST_ITEM *mnext, - * struct xLIST_ITEM *m, - * list cells) - * requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); - * ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& distinct(cells) == true; - * { - * if (n == m) { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } else { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * assert DLS(?nnext, n, mnext, m, tail(cells), tail(vals), l); - * dls_distinct(nnext, n, mnext, m, tail(cells)); - * dls_star_item(nnext, m, n); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } - * } - * - * predicate xLIST( - * struct xLIST *l, - * int uxNumberOfItems, - * struct xLIST_ITEM *pxIndex, - * struct xLIST_ITEM *xListEnd, - * listcells, - * listvals) = - * l->uxNumberOfItems |-> uxNumberOfItems &*& - * l->pxIndex |-> pxIndex &*& - * mem(pxIndex, cells) == true &*& - * xListEnd == &(l->xListEnd) &*& - * xListEnd == head(cells) &*& - * portMAX_DELAY == head(vals) &*& - * struct_xLIST_ITEM_padding(&l->xListEnd) &*& - * length(cells) == length(vals) &*& - * uxNumberOfItems + 1 == length(cells) &*& - * DLS(xListEnd, ?endprev, xListEnd, endprev, cells, vals, l); - * - * lemma void xLIST_distinct_cells(struct xLIST *l) - * requires xLIST(l, ?n, ?idx, ?end, ?cells, ?vals); - * ensures xLIST(l, n, idx, end, cells, vals) &*& distinct(cells) == true; - * { - * open xLIST(l, n, idx, end, cells, vals); - * assert DLS(end, ?endprev, end, _, cells, vals, l); - * dls_distinct(end, endprev, end, endprev, cells); - * close xLIST(l, n, idx, end, cells, vals); - * } - * - * lemma void xLIST_star_item(struct xLIST *l, struct xLIST_ITEM *x) - * requires xLIST(l, ?n, ?idx, ?end, ?cells, ?vals) &*& xLIST_ITEM(x, ?v, ?xnext, ?xprev, ?l2); - * ensures xLIST(l, n, idx, end, cells, vals) &*& xLIST_ITEM(x, v, xnext, xprev, l2) &*& mem(x, cells) == false; - * { - * open xLIST(l, n, idx, end, cells, vals); - * assert DLS(end, ?endprev, end, _, cells, vals, l); - * dls_distinct(end, endprev, end, endprev, cells); - * dls_star_item(end, endprev, x); - * close xLIST(l, n, idx, end, cells, vals); - * } - * - * lemma void dls_first_mem( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *nprev, - * struct xLIST_ITEM *mnext, - * struct xLIST_ITEM *m, - * list cells) - * requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); - * ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& mem(n, cells) == true &*& index_of(n, cells) == 0; - * { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * if (n == m) { - * assert cells == cons(n, nil); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } else { - * assert cells == cons(n, ?tail); - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } - * } - * - * lemma void dls_not_empty( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *m, - * list cells, - * struct xLIST_ITEM *x) - * requires DLS(n, m, n, m, cells, ?vals, ?l) &*& mem(x, cells) == true &*& x != n; - * ensures DLS(n, m, n, m, cells, vals, l) &*& n != m; - * { - * open DLS(n, m, n, m, cells, vals, l); - * close DLS(n, m, n, m, cells, vals, l); - * } - * - * lemma void dls_last_mem( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *nprev, - * struct xLIST_ITEM *mnext, - * struct xLIST_ITEM *m, - * list cells) - * requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); - * ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& mem(m, cells) == true &*& index_of(m, cells) == length(cells) - 1; - * { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * if (n == m) { - * // trivial - * } else { - * open xLIST_ITEM(n, _, ?nnext, _, l); - * assert DLS(?o, n, mnext, m, tail(cells), tail(vals), l); - * dls_last_mem(o, n, mnext, m, tail(cells)); - * close xLIST_ITEM(n, _, nnext, _, l); - * } - * close DLS(n, nprev, mnext, m, cells, vals, l); - * } - * - * lemma void split( - * struct xLIST_ITEM *n, - * struct xLIST_ITEM *nprev, - * struct xLIST_ITEM *mnext, - * struct xLIST_ITEM *m, - * list cells, - * list vals, - * struct xLIST_ITEM *x, - * int i) - * requires DLS(n, nprev, mnext, m, cells, vals, ?l) &*& x != n &*& mem(x, cells) == true &*& index_of(x,cells) == i; - * ensures DLS(n, nprev, x, ?xprev, take(i, cells), take(i, vals), l) &*& DLS(x, xprev, mnext, m, drop(i, cells), drop(i, vals), l) &*& xprev == nth(i-1, cells); - * { - * open DLS(n, nprev, mnext, m, cells, vals, l); - * assert n != m; - * assert xLIST_ITEM(n, ?v, ?nnext, _, _); - * assert DLS(nnext, n, mnext, m, tail(cells), tail(vals), l); - * if (nnext == x) { - * close DLS(n, nprev, x, n, singleton(n), singleton(v), l); - * open DLS(x, n, mnext, m, tail(cells), tail(vals), l); - * open xLIST_ITEM(x, _, ?xnext, ?xprev, l); - * close xLIST_ITEM(x, _, xnext, xprev, l); - * close DLS(x, n, mnext, m, tail(cells), tail(vals), l); - * } else { - * assert nnext != x; - * split(nnext, n, mnext, m, tail(cells), tail(vals), x, i - 1); - * assert DLS(nnext, n, x, ?xprev, take(i-1, tail(cells)), take(i-1, tail(vals)), l); - * dls_distinct(nnext, n, x, xprev, take(i-1, tail(cells))); - * dls_star_item(nnext, xprev, n); - * dls_last_mem(nnext, n, x, xprev, take(i-1, tail(cells))); - * assert n != xprev; - * close DLS(n, nprev, x, xprev, take(i, cells), take(i, vals), l); - * } - * } - * - * lemma void join( - * struct xLIST_ITEM *n1, - * struct xLIST_ITEM *nprev1, - * struct xLIST_ITEM *mnext1, - * struct xLIST_ITEM *m1, - * list cells1, - * list vals1, - * struct xLIST_ITEM *n2, - * struct xLIST_ITEM *nprev2, - * struct xLIST_ITEM *mnext2, - * struct xLIST_ITEM *m2, - * list cells2, - * list vals2) - * requires - * DLS(n1, nprev1, mnext1, m1, cells1, vals1, ?l) &*& - * DLS(n2, nprev2, mnext2, m2, cells2, vals2, l) &*& - * mnext1 == n2 &*& m1 == nprev2; - * ensures DLS(n1, nprev1, mnext2, m2, append(cells1, cells2), append(vals1, vals2), l); - * { - * if (n1 == m1) { - * dls_first_mem(n1, nprev1, mnext1, m1, cells1); - * dls_last_mem(n2, nprev2, mnext2, m2, cells2); - * open DLS(n1, nprev1, mnext1, m1, cells1, vals1, l); - * dls_star_item(n2, m2, n1); - * close DLS(n1, nprev1, mnext2, m2, append(singleton(n1), cells2), append(vals1, vals2), l); - * } else { - * open DLS(n1, nprev1, mnext1, m1, cells1, vals1, l); - * assert DLS(?o, n1, mnext1, m1, ?cells1_tail, ?vals1_tail, l); - * join(o, n1, mnext1, m1, cells1_tail, vals1_tail, - * n2, nprev2, mnext2, m2, cells2, vals2); - * assert DLS(o, n1, mnext2, m2, append(cells1_tail, cells2), append(vals1_tail, vals2), l); - * dls_last_mem(o, n1, mnext2, m2, append(cells1_tail, cells2)); - * dls_star_item(o, m2, n1); - * close DLS(n1, nprev1, mnext2, m2, append(cells1, cells2), append(vals1, vals2), l); - * } - * } - * - * lemma void idx_remains_in_list( - * list cells, - * t idx, - * t x, - * int ix) - * requires - * idx != x &*& - * mem(idx, cells) == true &*& - * mem(x, cells) == true &*& - * index_of(x, cells) == ix; - * ensures mem(idx, remove_nth(ix, cells)) == true; - * { - * neq_mem_remove(idx, x, cells); - * remove_remove_nth(cells, x); - * } - * @*/ +predicate DLS( + struct xLIST_ITEM *n, + struct xLIST_ITEM *nprev, + struct xLIST_ITEM *mnext, + struct xLIST_ITEM *m, + list cells, + list vals, + struct xLIST *pxContainer) = + n == m + ? cells == cons(n, nil) &*& + vals == cons(?v, nil) &*& + xLIST_ITEM(n, v, mnext, nprev, pxContainer) + : cells == cons(n, ?cells0) &*& + vals == cons(?v, ?vals0) &*& + xLIST_ITEM(n, v, ?o, nprev, pxContainer) &*& DLS(o, n, mnext, m, cells0, vals0, pxContainer); -/* Following lemma from `verifast/examples/shared_boxes/concurrentqueue.c`. - * Used in the uxListRemove proof to show that the item to remove `x` must - * have value `nth(i, vals)` where `i == index_of(x, cells)`. */ +lemma void dls_star_item( + struct xLIST_ITEM *n, + struct xLIST_ITEM *m, + struct xLIST_ITEM *o) +requires DLS(n, ?nprev, ?mnext, m, ?cells, ?vals, ?l) &*& xLIST_ITEM(o, ?v, ?onext, ?oprev, ?l2); +ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& xLIST_ITEM(o, v, onext, oprev, l2) &*& mem(o, cells) == false; +{ + open DLS(n, nprev, mnext, m, cells, vals, l); + if (n == m) { + assert xLIST_ITEM(n, _, _, _, _); + open xLIST_ITEM(n, _, _, _, _); + open xLIST_ITEM(o, _, _, _, _); + assert n != o; + close xLIST_ITEM(o, _, _, _, _); + close xLIST_ITEM(n, _, _, _, _); + close DLS(n, nprev, mnext, m, cells, vals, l); + } + else { + assert DLS(?nnext, n, mnext, m, tail(cells), tail(vals), l); + dls_star_item(nnext, m, o); + open xLIST_ITEM(n, _, _, _, _); + open xLIST_ITEM(o, _, _, _, _); + assert n != o; + close xLIST_ITEM(o, _, _, _, _); + close xLIST_ITEM(n, _, _, _, _); + close DLS(n, nprev, mnext, m, cells, vals, l); + } +} + +lemma void dls_distinct( + struct xLIST_ITEM *n, + struct xLIST_ITEM *nprev, + struct xLIST_ITEM *mnext, + struct xLIST_ITEM *m, + list cells) +requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); +ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& distinct(cells) == true; +{ + if (n == m) { + open DLS(n, nprev, mnext, m, cells, vals, l); + close DLS(n, nprev, mnext, m, cells, vals, l); + } else { + open DLS(n, nprev, mnext, m, cells, vals, l); + assert DLS(?nnext, n, mnext, m, tail(cells), tail(vals), l); + dls_distinct(nnext, n, mnext, m, tail(cells)); + dls_star_item(nnext, m, n); + close DLS(n, nprev, mnext, m, cells, vals, l); + } +} + +predicate xLIST( + struct xLIST *l, + int uxNumberOfItems, + struct xLIST_ITEM *pxIndex, + struct xLIST_ITEM *xListEnd, + listcells, + listvals) = + l->uxNumberOfItems |-> uxNumberOfItems &*& + l->pxIndex |-> pxIndex &*& + mem(pxIndex, cells) == true &*& + xListEnd == &(l->xListEnd) &*& + xListEnd == head(cells) &*& + portMAX_DELAY == head(vals) &*& + struct_xLIST_ITEM_padding(&l->xListEnd) &*& + length(cells) == length(vals) &*& + uxNumberOfItems + 1 == length(cells) &*& + DLS(xListEnd, ?endprev, xListEnd, endprev, cells, vals, l); +lemma void xLIST_distinct_cells(struct xLIST *l) +requires xLIST(l, ?n, ?idx, ?end, ?cells, ?vals); +ensures xLIST(l, n, idx, end, cells, vals) &*& distinct(cells) == true; +{ + open xLIST(l, n, idx, end, cells, vals); + assert DLS(end, ?endprev, end, _, cells, vals, l); + dls_distinct(end, endprev, end, endprev, cells); + close xLIST(l, n, idx, end, cells, vals); +} + +lemma void xLIST_star_item(struct xLIST *l, struct xLIST_ITEM *x) +requires xLIST(l, ?n, ?idx, ?end, ?cells, ?vals) &*& xLIST_ITEM(x, ?v, ?xnext, ?xprev, ?l2); +ensures xLIST(l, n, idx, end, cells, vals) &*& xLIST_ITEM(x, v, xnext, xprev, l2) &*& mem(x, cells) == false; +{ + open xLIST(l, n, idx, end, cells, vals); + assert DLS(end, ?endprev, end, _, cells, vals, l); + dls_distinct(end, endprev, end, endprev, cells); + dls_star_item(end, endprev, x); + close xLIST(l, n, idx, end, cells, vals); +} + +lemma void dls_first_mem( + struct xLIST_ITEM *n, + struct xLIST_ITEM *nprev, + struct xLIST_ITEM *mnext, + struct xLIST_ITEM *m, + list cells) +requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); +ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& mem(n, cells) == true &*& index_of(n, cells) == 0; +{ + open DLS(n, nprev, mnext, m, cells, vals, l); + if (n == m) { + assert cells == cons(n, nil); + close DLS(n, nprev, mnext, m, cells, vals, l); + } else { + assert cells == cons(n, ?tail); + close DLS(n, nprev, mnext, m, cells, vals, l); + } +} + +lemma void dls_not_empty( + struct xLIST_ITEM *n, + struct xLIST_ITEM *m, + list cells, + struct xLIST_ITEM *x) +requires DLS(n, m, n, m, cells, ?vals, ?l) &*& mem(x, cells) == true &*& x != n; +ensures DLS(n, m, n, m, cells, vals, l) &*& n != m; +{ + open DLS(n, m, n, m, cells, vals, l); + close DLS(n, m, n, m, cells, vals, l); +} + +lemma void dls_last_mem( + struct xLIST_ITEM *n, + struct xLIST_ITEM *nprev, + struct xLIST_ITEM *mnext, + struct xLIST_ITEM *m, + list cells) +requires DLS(n, nprev, mnext, m, cells, ?vals, ?l); +ensures DLS(n, nprev, mnext, m, cells, vals, l) &*& mem(m, cells) == true &*& index_of(m, cells) == length(cells) - 1; +{ + open DLS(n, nprev, mnext, m, cells, vals, l); + if (n == m) { + // trivial + } else { + open xLIST_ITEM(n, _, ?nnext, _, l); + assert DLS(?o, n, mnext, m, tail(cells), tail(vals), l); + dls_last_mem(o, n, mnext, m, tail(cells)); + close xLIST_ITEM(n, _, nnext, _, l); + } + close DLS(n, nprev, mnext, m, cells, vals, l); +} + +lemma void split( + struct xLIST_ITEM *n, + struct xLIST_ITEM *nprev, + struct xLIST_ITEM *mnext, + struct xLIST_ITEM *m, + list cells, + list vals, + struct xLIST_ITEM *x, + int i) +requires DLS(n, nprev, mnext, m, cells, vals, ?l) &*& x != n &*& mem(x, cells) == true &*& index_of(x,cells) == i; +ensures DLS(n, nprev, x, ?xprev, take(i, cells), take(i, vals), l) &*& DLS(x, xprev, mnext, m, drop(i, cells), drop(i, vals), l) &*& xprev == nth(i-1, cells); +{ + open DLS(n, nprev, mnext, m, cells, vals, l); + assert n != m; + assert xLIST_ITEM(n, ?v, ?nnext, _, _); + assert DLS(nnext, n, mnext, m, tail(cells), tail(vals), l); + if (nnext == x) { + close DLS(n, nprev, x, n, singleton(n), singleton(v), l); + open DLS(x, n, mnext, m, tail(cells), tail(vals), l); + open xLIST_ITEM(x, _, ?xnext, ?xprev, l); + close xLIST_ITEM(x, _, xnext, xprev, l); + close DLS(x, n, mnext, m, tail(cells), tail(vals), l); + } else { + assert nnext != x; + split(nnext, n, mnext, m, tail(cells), tail(vals), x, i - 1); + assert DLS(nnext, n, x, ?xprev, take(i-1, tail(cells)), take(i-1, tail(vals)), l); + dls_distinct(nnext, n, x, xprev, take(i-1, tail(cells))); + dls_star_item(nnext, xprev, n); + dls_last_mem(nnext, n, x, xprev, take(i-1, tail(cells))); + assert n != xprev; + close DLS(n, nprev, x, xprev, take(i, cells), take(i, vals), l); + } +} + +lemma void join( + struct xLIST_ITEM *n1, + struct xLIST_ITEM *nprev1, + struct xLIST_ITEM *mnext1, + struct xLIST_ITEM *m1, + list cells1, + list vals1, + struct xLIST_ITEM *n2, + struct xLIST_ITEM *nprev2, + struct xLIST_ITEM *mnext2, + struct xLIST_ITEM *m2, + list cells2, + list vals2) +requires + DLS(n1, nprev1, mnext1, m1, cells1, vals1, ?l) &*& + DLS(n2, nprev2, mnext2, m2, cells2, vals2, l) &*& + mnext1 == n2 &*& m1 == nprev2; +ensures DLS(n1, nprev1, mnext2, m2, append(cells1, cells2), append(vals1, vals2), l); +{ + if (n1 == m1) { + dls_first_mem(n1, nprev1, mnext1, m1, cells1); + dls_last_mem(n2, nprev2, mnext2, m2, cells2); + open DLS(n1, nprev1, mnext1, m1, cells1, vals1, l); + dls_star_item(n2, m2, n1); + close DLS(n1, nprev1, mnext2, m2, append(singleton(n1), cells2), append(vals1, vals2), l); + } else { + open DLS(n1, nprev1, mnext1, m1, cells1, vals1, l); + assert DLS(?o, n1, mnext1, m1, ?cells1_tail, ?vals1_tail, l); + join(o, n1, mnext1, m1, cells1_tail, vals1_tail, + n2, nprev2, mnext2, m2, cells2, vals2); + assert DLS(o, n1, mnext2, m2, append(cells1_tail, cells2), append(vals1_tail, vals2), l); + dls_last_mem(o, n1, mnext2, m2, append(cells1_tail, cells2)); + dls_star_item(o, m2, n1); + close DLS(n1, nprev1, mnext2, m2, append(cells1, cells2), append(vals1, vals2), l); + } +} + +lemma void idx_remains_in_list( + list cells, + t idx, + t x, + int ix) +requires + idx != x &*& + mem(idx, cells) == true &*& + mem(x, cells) == true &*& + index_of(x, cells) == ix; +ensures mem(idx, remove_nth(ix, cells)) == true; +{ + neq_mem_remove(idx, x, cells); + remove_remove_nth(cells, x); +} +@*/ + +/* Following lemma from `verifast/examples/shared_boxes/concurrentqueue.c`. +Used in the uxListRemove proof to show that the item to remove `x` must +have value `nth(i, vals)` where `i == index_of(x, cells)`. */ /*@ - * lemma void drop_nth_index_of(list vs, int i) - * requires - * 0 <= i && i < length(vs); - * ensures - * head(drop(i , vs)) == nth(i, vs); - * { - * switch(vs) { - * case nil: - * case cons(h, t): - * if (i == 0) { - * // trivial - * } else { - * drop_nth_index_of(t, i - 1); - * } - * } - * } - * @*/ +lemma void drop_nth_index_of(list vs, int i) +requires + 0 <= i && i < length(vs); +ensures + head(drop(i , vs)) == nth(i, vs); +{ + switch(vs) { + case nil: + case cons(h, t): + if (i == 0) { + // trivial + } else { + drop_nth_index_of(t, i - 1); + } + } +} +@*/ /*@ - * lemma void remove_append(t x, list l1, list l2) - * requires mem(x, l1) == false; - * ensures remove(x, append(l1, l2)) == append(l1, remove(x, l2)); - * { - * switch(l1) { - * case nil: - * case cons(h1, t1): - * remove_append(x, t1, l2); - * } - * } - * @*/ +lemma void remove_append(t x, list l1, list l2) + requires mem(x, l1) == false; + ensures remove(x, append(l1, l2)) == append(l1, remove(x, l2)); +{ + switch(l1) { + case nil: + case cons(h1, t1): + remove_append(x, t1, l2); + } +} +@*/ #endif /* LIST_H */ diff --git a/FreeRTOS/Test/VeriFast/include/proof/queue.h b/FreeRTOS/Test/VeriFast/include/proof/queue.h index 7b5da2da21..df28e78624 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queue.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queue.h @@ -34,51 +34,51 @@ #include /*@#include "common.gh"@*/ -typedef size_t TickType_t; -typedef size_t UBaseType_t; -typedef ssize_t BaseType_t; +typedef size_t TickType_t; +typedef size_t UBaseType_t; +typedef ssize_t BaseType_t; /* Empty/no-op macros */ /* Tracing */ -#define traceBLOCKING_ON_QUEUE_PEEK( x ) -#define traceBLOCKING_ON_QUEUE_RECEIVE( x ) -#define traceBLOCKING_ON_QUEUE_SEND( x ) -#define traceQUEUE_CREATE( x ) -#define traceQUEUE_CREATE_FAILED( x ) -#define traceQUEUE_DELETE( x ) -#define traceQUEUE_PEEK( x ) -#define traceQUEUE_PEEK_FAILED( x ) -#define traceQUEUE_PEEK_FROM_ISR( x ) -#define traceQUEUE_PEEK_FROM_ISR_FAILED( x ) -#define traceQUEUE_RECEIVE( x ) -#define traceQUEUE_RECEIVE_FAILED( x ) -#define traceQUEUE_RECEIVE_FROM_ISR( x ) -#define traceQUEUE_RECEIVE_FROM_ISR_FAILED( x ) -#define traceQUEUE_SEND( x ) -#define traceQUEUE_SEND_FAILED( x ) -#define traceQUEUE_SEND_FROM_ISR( x ) -#define traceQUEUE_SEND_FROM_ISR_FAILED( x ) +#define traceBLOCKING_ON_QUEUE_PEEK(x) +#define traceBLOCKING_ON_QUEUE_RECEIVE(x) +#define traceBLOCKING_ON_QUEUE_SEND(x) +#define traceQUEUE_CREATE(x) +#define traceQUEUE_CREATE_FAILED(x) +#define traceQUEUE_DELETE(x) +#define traceQUEUE_PEEK(x) +#define traceQUEUE_PEEK_FAILED(x) +#define traceQUEUE_PEEK_FROM_ISR(x) +#define traceQUEUE_PEEK_FROM_ISR_FAILED(x) +#define traceQUEUE_RECEIVE(x) +#define traceQUEUE_RECEIVE_FAILED(x) +#define traceQUEUE_RECEIVE_FROM_ISR(x) +#define traceQUEUE_RECEIVE_FROM_ISR_FAILED(x) +#define traceQUEUE_SEND(x) +#define traceQUEUE_SEND_FAILED(x) +#define traceQUEUE_SEND_FROM_ISR(x) +#define traceQUEUE_SEND_FROM_ISR_FAILED(x) /* Coverage */ #define mtCOVERAGE_TEST_MARKER() /* Asserts */ -#define configASSERT( x ) +#define configASSERT(x) #define portASSERT_IF_INTERRUPT_PRIORITY_INVALID() /* Map portable memory management functions */ -#define pvPortMalloc malloc -#define vPortFree free +#define pvPortMalloc malloc +#define vPortFree free -#define queueSEND_TO_BACK ( ( BaseType_t ) 0 ) -#define queueSEND_TO_FRONT ( ( BaseType_t ) 1 ) -#define queueOVERWRITE ( ( BaseType_t ) 2 ) +#define queueSEND_TO_BACK ( ( BaseType_t ) 0 ) +#define queueSEND_TO_FRONT ( ( BaseType_t ) 1 ) +#define queueOVERWRITE ( ( BaseType_t ) 2 ) -#define pdTRUE 1 -#define pdFALSE 0 +#define pdTRUE 1 +#define pdFALSE 0 -#define pdPASS pdTRUE -#define pdFAIL pdFALSE -#define errQUEUE_FULL 0 -#define errQUEUE_EMPTY 0 +#define pdPASS pdTRUE +#define pdFAIL pdFALSE +#define errQUEUE_FULL 0 +#define errQUEUE_EMPTY 0 /* Constants used with the cRxLock and cTxLock structure members. */ #define queueUNLOCKED ( ( int8_t ) -1 ) @@ -93,28 +93,26 @@ typedef struct QueuePointers typedef struct SemaphoreData { - #ifdef VERIFAST /*< do not model xMutexHolder */ - void * xMutexHolder; - #else - TaskHandle_t xMutexHolder; /*< The handle of the task that holds the mutex. */ - #endif +#ifdef VERIFAST /*< do not model xMutexHolder */ + void *xMutexHolder; +#else + TaskHandle_t xMutexHolder; /*< The handle of the task that holds the mutex. */ +#endif UBaseType_t uxRecursiveCallCount; /*< Maintains a count of the number of times a recursive mutex has been recursively 'taken' when the structure is used as a mutex. */ } SemaphoreData_t; /* VeriFast does not support unions so we replace with a struct */ -struct fake_union_t -{ +struct fake_union_t { QueuePointers_t xQueue; SemaphoreData_t xSemaphore; }; -typedef struct xLIST -{ +typedef struct xLIST { UBaseType_t uxNumberOfItems; - #ifndef VERIFAST /*< do not model pxIndex and xListEnd of xLIST struct */ - struct xLIST_ITEM * pxIndex; - MiniListItem_t xListEnd; - #endif +#ifndef VERIFAST /*< do not model pxIndex and xListEnd of xLIST struct */ + struct xLIST_ITEM *pxIndex; + MiniListItem_t xListEnd; +#endif } List_t; typedef struct QueueDefinition /* The old naming convention is used to prevent breaking kernel aware debuggers. */ @@ -122,15 +120,15 @@ typedef struct QueueDefinition /* The old naming convention is used to prevent b int8_t * pcHead; /*< Points to the beginning of the queue storage area. */ int8_t * pcWriteTo; /*< Points to the free next place in the storage area. */ - #ifdef VERIFAST /*< VeriFast does not model unions */ - struct fake_union_t u; - #else - union - { - QueuePointers_t xQueue; /*< Data required exclusively when this structure is used as a queue. */ - SemaphoreData_t xSemaphore; /*< Data required exclusively when this structure is used as a semaphore. */ - } u; - #endif +#ifdef VERIFAST /*< VeriFast does not model unions */ + struct fake_union_t u; +#else + union + { + QueuePointers_t xQueue; /*< Data required exclusively when this structure is used as a queue. */ + SemaphoreData_t xSemaphore; /*< Data required exclusively when this structure is used as a semaphore. */ + } u; +#endif List_t xTasksWaitingToSend; /*< List of tasks that are blocked waiting to post onto this queue. Stored in priority order. */ List_t xTasksWaitingToReceive; /*< List of tasks that are blocked waiting to read from this queue. Stored in priority order. */ @@ -160,278 +158,271 @@ typedef struct QueueDefinition /* The old naming convention is used to prevent b /*@struct mutex *locked;@*/ /*< Ghost mutex simulates the effect of queue locking */ } xQUEUE; -typedef xQUEUE Queue_t; +typedef xQUEUE Queue_t; -typedef struct QueueDefinition * QueueHandle_t; +typedef struct QueueDefinition * QueueHandle_t; /*@ - #define QUEUE_SHAPE(q, Storage, N, M, K) \ - * malloc_block_QueueDefinition(q) &*& \ - * q->pcHead |-> Storage &*& \ - * q->pcWriteTo |-> ?WPtr &*& \ - * q->u.xQueue.pcTail |-> ?End &*& \ - * q->u.xQueue.pcReadFrom |-> ?RPtr &*& \ - * q->uxItemSize |-> M &*& \ - * q->uxLength |-> N &*& \ - * q->uxMessagesWaiting |-> K &*& \ - * q->cRxLock |-> ?rxLock &*& \ - * q->cTxLock |-> ?txLock &*& \ - * struct_QueuePointers_padding(&q->u.xQueue) &*& \ - * struct_SemaphoreData_padding(&q->u.xSemaphore) &*& \ - * struct_fake_union_t_padding(&q->u) &*& \ - * struct_xLIST_padding(&q->xTasksWaitingToSend) &*& \ - * struct_xLIST_padding(&q->xTasksWaitingToReceive) &*& \ - * q->u.xSemaphore.xMutexHolder |-> _ &*& \ - * q->u.xSemaphore.uxRecursiveCallCount |-> _ &*& \ - * true - * - * predicate queue(QueueHandle_t q, int8_t *Storage, size_t N, size_t M, size_t W, size_t R, size_t K, bool is_locked; list >abs) = - * QUEUE_SHAPE(q, Storage, N, M, K) &*& - * 0 < N &*& - * 0 < M &*& - * 0 <= W &*& W < N &*& - * 0 <= R &*& R < N &*& - * 0 <= K &*& K <= N &*& - * W == (R + 1 + K) % N &*& - * (-1) <= rxLock &*& - * (-1) <= txLock &*& - * (is_locked ? 0 <= rxLock : (-1) == rxLock) &*& - * (is_locked ? 0 <= txLock : (-1) == txLock) &*& - * WPtr == Storage + (W*M) &*& - * RPtr == Storage + (R*M) &*& - * End == Storage + (N*M) &*& - * buffer(Storage, N, M, ?contents) &*& - * length(contents) == N &*& - * abs == take(K, rotate_left((R+1)%N, contents)) &*& - * malloc_block(Storage, N*M) &*& - * true - * ; - * @*/ +#define QUEUE_SHAPE(q, Storage, N, M, K) \ + malloc_block_QueueDefinition(q) &*& \ + q->pcHead |-> Storage &*& \ + q->pcWriteTo |-> ?WPtr &*& \ + q->u.xQueue.pcTail |-> ?End &*& \ + q->u.xQueue.pcReadFrom |-> ?RPtr &*& \ + q->uxItemSize |-> M &*& \ + q->uxLength |-> N &*& \ + q->uxMessagesWaiting |-> K &*& \ + q->cRxLock |-> ?rxLock &*& \ + q->cTxLock |-> ?txLock &*& \ + struct_QueuePointers_padding(&q->u.xQueue) &*& \ + struct_SemaphoreData_padding(&q->u.xSemaphore) &*& \ + struct_fake_union_t_padding(&q->u) &*& \ + struct_xLIST_padding(&q->xTasksWaitingToSend) &*& \ + struct_xLIST_padding(&q->xTasksWaitingToReceive) &*& \ + q->u.xSemaphore.xMutexHolder |-> _ &*& \ + q->u.xSemaphore.uxRecursiveCallCount |-> _ &*& \ + true + +predicate queue(QueueHandle_t q, int8_t *Storage, size_t N, size_t M, size_t W, size_t R, size_t K, bool is_locked; list >abs) = + QUEUE_SHAPE(q, Storage, N, M, K) &*& + 0 < N &*& + 0 < M &*& + 0 <= W &*& W < N &*& + 0 <= R &*& R < N &*& + 0 <= K &*& K <= N &*& + W == (R + 1 + K) % N &*& + (-1) <= rxLock &*& + (-1) <= txLock &*& + (is_locked ? 0 <= rxLock : (-1) == rxLock) &*& + (is_locked ? 0 <= txLock : (-1) == txLock) &*& + WPtr == Storage + (W*M) &*& + RPtr == Storage + (R*M) &*& + End == Storage + (N*M) &*& + buffer(Storage, N, M, ?contents) &*& + length(contents) == N &*& + abs == take(K, rotate_left((R+1)%N, contents)) &*& + malloc_block(Storage, N*M) &*& + true + ; +@*/ /* A buffer allows us to interpret a flat character array of `N*M` bytes as a - * list of `N` elements where each element is `M` bytes */ - +list of `N` elements where each element is `M` bytes */ /*@ - * predicate buffer(char *buffer, size_t N, size_t M; list > elements) = - * N == 0 - * ? elements == nil - * : chars(buffer, M, ?x) &*& buffer(buffer + M, N - 1, M, ?xs) &*& elements == cons(x, xs); - * - * lemma void buffer_length(char *buffer, size_t N, size_t M) - * requires buffer(buffer, N, M, ?elements); - * ensures buffer(buffer, N, M, elements) &*& length(elements) == N; - * { - * if (N == 0) { - * open buffer(buffer, N, M, elements); - * close buffer(buffer, N, M, elements); - * } else { - * open buffer(buffer, N, M, elements); - * buffer_length(buffer+M, N-1, M); - * } - * } - * @*/ +predicate buffer(char *buffer, size_t N, size_t M; list > elements) = + N == 0 + ? elements == nil + : chars(buffer, M, ?x) &*& buffer(buffer + M, N - 1, M, ?xs) &*& elements == cons(x, xs); + +lemma void buffer_length(char *buffer, size_t N, size_t M) +requires buffer(buffer, N, M, ?elements); +ensures buffer(buffer, N, M, elements) &*& length(elements) == N; +{ + if (N == 0) { + open buffer(buffer, N, M, elements); + close buffer(buffer, N, M, elements); + } else { + open buffer(buffer, N, M, elements); + buffer_length(buffer+M, N-1, M); + } +} +@*/ /* - * There is no need in the queue proofs to preserve a relationship between `cs` - * and `elements` (i.e., `flatten(elements) == cs`) because we only move in one - * direction from `cs` to `elements` during queue creation when the contents is - * fresh from `malloc` (i.e., uninitialized). If we needed to do a roundtrip from - * elements back to cs then this would require a stronger lemma. - */ - +There is no need in the queue proofs to preserve a relationship between `cs` +and `elements` (i.e., `flatten(elements) == cs`) because we only move in one +direction from `cs` to `elements` during queue creation when the contents is +fresh from `malloc` (i.e., uninitialized). If we needed to do a roundtrip from +elements back to cs then this would require a stronger lemma. +*/ /*@ - * lemma void buffer_from_chars(char *buffer, size_t N, size_t M) - * requires chars(buffer, N*M, ?cs) &*& 0 <= N &*& 0 < M; - * ensures exists > >(?elements) &*& buffer(buffer, N, M, elements) &*& length(elements) == N; - * { - * if (N == 0) { - * close exists(nil); - * } else { - * int i = 0; - * while (i < N) - * invariant 0 <= i &*& i <= N &*& - * chars(buffer, (N-i)*M, ?xs) &*& xs == take((N-i)*M, cs) &*& - * buffer(buffer + (N-i)*M, i, M, ?ys); - * decreases N-i; - * { - * mul_mono_l(0, N-i-1, M); - * chars_split(buffer, (N-i-1)*M); - * mul_mono_l(i, N, M); - * mul_mono_l(N-i, N, M); - * take_take((N-i-1)*M, (N-i)*M, cs); - * i++; - * } - * close exists(ys); - * buffer_length(buffer, N, M); - * } - * } - * - * lemma void append_buffer(char *buffer, size_t N1, size_t N2, size_t M) - * requires - * buffer(buffer, N1, M, ?elements1) &*& - * buffer(buffer + N1 * M, N2, M, ?elements2) &*& - * 0 <= N1 &*& 0 <= N2; - * ensures buffer(buffer, N1+N2, M, append(elements1, elements2)); - * { - * if (N1 == 0) { - * open buffer(buffer, 0, M, _); - * } else if (N2 == 0) { - * open buffer(buffer + N1 * M, 0, M, _); - * } else { - * open buffer(buffer, N1, M, elements1); - * append_buffer(buffer + M, N1-1, N2, M); - * close buffer(buffer, N1+N2, M, cons(?x, append(xs, elements2))); - * } - * } - * - * lemma void split_element(char *buffer, size_t N, size_t M, size_t i) - * requires buffer(buffer, N, M, ?elements) &*& 0 <= i &*& i < N; - * ensures - * buffer(buffer, i, M, take(i, elements)) &*& - * chars(buffer + i * M, M, nth(i, elements)) &*& - * buffer(buffer + (i + 1) * M, (N-1-i), M, drop(i+1, elements)); - * { - * if (i == 0) { - * // straightforward - * } else { - * buffer_length(buffer, N, M); - * int j = 0; - * while (j < i) - * invariant 0 <= j &*& j <= i &*& - * buffer(buffer, j, M, take(j, elements)) &*& - * buffer(buffer + j * M, N-j, M, drop(j, elements)); - * decreases i-j; - * { - * drop_drop(1, j, elements); - * nth_drop2(elements, j); - * open buffer(buffer + j * M, N-j, M, drop(j, elements)); - * assert chars(buffer + j * M, M, ?x) &*& x == nth(j, elements); - * close buffer(buffer + j * M, 1, M, singleton(x)); - * append_buffer(buffer, j, 1, M); - * take_plus_one(j, elements); - * j++; - * } - * drop_drop(1, j, elements); - * nth_drop2(elements, i); - * } - * } - * - * lemma void join_element(char *buffer, size_t N, size_t M, size_t i) - * requires - * 0 <= i &*& i < N &*& - * buffer(buffer, i, M, ?prefix) &*& - * chars(buffer + i * M, M, ?element) &*& - * buffer(buffer + (i + 1) * M, (N-1-i), M, ?suffix); - * ensures buffer(buffer, N, M, append(prefix, cons(element, suffix))); - * { - * if (i == 0) { - * open buffer(buffer, i, M, prefix); - * assert prefix == nil; - * close buffer(buffer, N, M, cons(element, suffix)); - * } else { - * close buffer(buffer + i * M, N-i, M, cons(element, suffix)); - * append_buffer(buffer, i, N-i, M); - * } - * } - * - * predicate list(List_t *l;) = - * l->uxNumberOfItems |-> _; - * - * predicate queuelists(QueueHandle_t q;) = - * list(&q->xTasksWaitingToSend) &*& - * list(&q->xTasksWaitingToReceive); - * @*/ +lemma void buffer_from_chars(char *buffer, size_t N, size_t M) +requires chars(buffer, N*M, ?cs) &*& 0 <= N &*& 0 < M; +ensures exists > >(?elements) &*& buffer(buffer, N, M, elements) &*& length(elements) == N; +{ + if (N == 0) { + close exists(nil); + } else { + int i = 0; + while (i < N) + invariant 0 <= i &*& i <= N &*& + chars(buffer, (N-i)*M, ?xs) &*& xs == take((N-i)*M, cs) &*& + buffer(buffer + (N-i)*M, i, M, ?ys); + decreases N-i; + { + mul_mono_l(0, N-i-1, M); + chars_split(buffer, (N-i-1)*M); + mul_mono_l(i, N, M); + mul_mono_l(N-i, N, M); + take_take((N-i-1)*M, (N-i)*M, cs); + i++; + } + close exists(ys); + buffer_length(buffer, N, M); + } +} -/* Because prvCopyDataFromQueue does *not* decrement uxMessagesWaiting (K) the - * queue predicate above does not hold as a postcondition. If the caller - * subsequently decrements K then the queue predicate can be reinstated. */ +lemma void append_buffer(char *buffer, size_t N1, size_t N2, size_t M) +requires + buffer(buffer, N1, M, ?elements1) &*& + buffer(buffer + N1 * M, N2, M, ?elements2) &*& + 0 <= N1 &*& 0 <= N2; +ensures buffer(buffer, N1+N2, M, append(elements1, elements2)); +{ + if (N1 == 0) { + open buffer(buffer, 0, M, _); + } else if (N2 == 0) { + open buffer(buffer + N1 * M, 0, M, _); + } else { + open buffer(buffer, N1, M, elements1); + append_buffer(buffer + M, N1-1, N2, M); + close buffer(buffer, N1+N2, M, cons(?x, append(xs, elements2))); + } +} + +lemma void split_element(char *buffer, size_t N, size_t M, size_t i) +requires buffer(buffer, N, M, ?elements) &*& 0 <= i &*& i < N; +ensures + buffer(buffer, i, M, take(i, elements)) &*& + chars(buffer + i * M, M, nth(i, elements)) &*& + buffer(buffer + (i + 1) * M, (N-1-i), M, drop(i+1, elements)); +{ + if (i == 0) { + // straightforward + } else { + buffer_length(buffer, N, M); + int j = 0; + while (j < i) + invariant 0 <= j &*& j <= i &*& + buffer(buffer, j, M, take(j, elements)) &*& + buffer(buffer + j * M, N-j, M, drop(j, elements)); + decreases i-j; + { + drop_drop(1, j, elements); + nth_drop2(elements, j); + open buffer(buffer + j * M, N-j, M, drop(j, elements)); + assert chars(buffer + j * M, M, ?x) &*& x == nth(j, elements); + close buffer(buffer + j * M, 1, M, singleton(x)); + append_buffer(buffer, j, 1, M); + take_plus_one(j, elements); + j++; + } + drop_drop(1, j, elements); + nth_drop2(elements, i); + } +} +lemma void join_element(char *buffer, size_t N, size_t M, size_t i) +requires + 0 <= i &*& i < N &*& + buffer(buffer, i, M, ?prefix) &*& + chars(buffer + i * M, M, ?element) &*& + buffer(buffer + (i + 1) * M, (N-1-i), M, ?suffix); +ensures buffer(buffer, N, M, append(prefix, cons(element, suffix))); +{ + if (i == 0) { + open buffer(buffer, i, M, prefix); + assert prefix == nil; + close buffer(buffer, N, M, cons(element, suffix)); + } else { + close buffer(buffer + i * M, N-i, M, cons(element, suffix)); + append_buffer(buffer, i, N-i, M); + } +} + +predicate list(List_t *l;) = + l->uxNumberOfItems |-> _; + +predicate queuelists(QueueHandle_t q;) = + list(&q->xTasksWaitingToSend) &*& + list(&q->xTasksWaitingToReceive); +@*/ + +/* Because prvCopyDataFromQueue does *not* decrement uxMessagesWaiting (K) the +queue predicate above does not hold as a postcondition. If the caller +subsequently decrements K then the queue predicate can be reinstated. */ /*@ - * predicate queue_after_prvCopyDataFromQueue(QueueHandle_t q, int8_t *Storage, size_t N, size_t M, size_t W, size_t R, size_t K, bool is_locked; list >abs) = - * QUEUE_SHAPE(q, Storage, N, M, K) &*& - * 0 < N &*& - * 0 < M &*& - * 0 <= W &*& W < N &*& - * 0 <= R &*& R < N &*& - * 0 <= K &*& K <= N &*& - * W == (R + K) % N &*& //< Differs from queue predicate - * (-1) <= rxLock &*& - * (-1) <= txLock &*& - * (is_locked ? 0 <= rxLock : (-1) == rxLock) &*& - * (is_locked ? 0 <= txLock : (-1) == txLock) &*& - * WPtr == Storage + (W*M) &*& - * RPtr == Storage + (R*M) &*& - * End == Storage + (N*M) &*& - * buffer(Storage, N, M, ?contents) &*& - * length(contents) == N &*& - * abs == take(K, rotate_left(R, contents)) &*& //< Differs from queue predicate - * malloc_block(Storage, N*M) &*& - * true - * ; - * @*/ +predicate queue_after_prvCopyDataFromQueue(QueueHandle_t q, int8_t *Storage, size_t N, size_t M, size_t W, size_t R, size_t K, bool is_locked; list >abs) = + QUEUE_SHAPE(q, Storage, N, M, K) &*& + 0 < N &*& + 0 < M &*& + 0 <= W &*& W < N &*& + 0 <= R &*& R < N &*& + 0 <= K &*& K <= N &*& + W == (R + K) % N &*& //< Differs from queue predicate + (-1) <= rxLock &*& + (-1) <= txLock &*& + (is_locked ? 0 <= rxLock : (-1) == rxLock) &*& + (is_locked ? 0 <= txLock : (-1) == txLock) &*& + WPtr == Storage + (W*M) &*& + RPtr == Storage + (R*M) &*& + End == Storage + (N*M) &*& + buffer(Storage, N, M, ?contents) &*& + length(contents) == N &*& + abs == take(K, rotate_left(R, contents)) &*& //< Differs from queue predicate + malloc_block(Storage, N*M) &*& + true + ; +@*/ /* Can't be called `mutex` as this clashes with VeriFast's predicate */ - /*@ - * predicate freertos_mutex(QueueHandle_t q, int8_t *Storage, size_t N, size_t K;) = - * QUEUE_SHAPE(q, Storage, N, 0, K) &*& - * queuelists(q) &*& - * 0 < N &*& - * 0 <= K &*& K <= N &*& - * (-1) <= rxLock &*& - * (-1) <= txLock &*& - * WPtr == Storage &*& - * RPtr == Storage &*& - * End == Storage &*& - * malloc_block(Storage, 0) &*& - * chars(Storage, 0, _) &*& - * true - * ; - * @*/ +predicate freertos_mutex(QueueHandle_t q, int8_t *Storage, size_t N, size_t K;) = + QUEUE_SHAPE(q, Storage, N, 0, K) &*& + queuelists(q) &*& + 0 < N &*& + 0 <= K &*& K <= N &*& + (-1) <= rxLock &*& + (-1) <= txLock &*& + WPtr == Storage &*& + RPtr == Storage &*& + End == Storage &*& + malloc_block(Storage, 0) &*& + chars(Storage, 0, _) &*& + true + ; +@*/ /* A queuehandle can be shared between tasks and ISRs. Acquiring the ghost - * `irqMask` gives access to the core queue resources. The permissions granted - * after masking interrupts depends on the caller: - * - A task has access to the queue and the queuelists - * - An ISR has access to the queue and, if the queue is unlocked, the queuelists */ - +`irqMask` gives access to the core queue resources. The permissions granted +after masking interrupts depends on the caller: +- A task has access to the queue and the queuelists +- An ISR has access to the queue and, if the queue is unlocked, the queuelists */ /*@ - * predicate queuehandle(QueueHandle_t q, size_t N, size_t M, bool is_isr;) = - * q->irqMask |-> ?m &*& mutex(m, irqs_masked_invariant(q, N, M, is_isr)); - * - * predicate_ctor irqs_masked_invariant(QueueHandle_t queue, size_t N, size_t M, bool is_isr)() = - * queue(queue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * (is_isr && is_locked ? true : queuelists(queue)); - * @*/ +predicate queuehandle(QueueHandle_t q, size_t N, size_t M, bool is_isr;) = + q->irqMask |-> ?m &*& mutex(m, irqs_masked_invariant(q, N, M, is_isr)); -/* A queuesuspend can be shared between tasks. Acquiring the ghost `schedulerSuspend` gives access to the `locked` mutex. */ +predicate_ctor irqs_masked_invariant(QueueHandle_t queue, size_t N, size_t M, bool is_isr)() = + queue(queue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& + (is_isr && is_locked ? true : queuelists(queue)); +@*/ +/* A queuesuspend can be shared between tasks. Acquiring the ghost `schedulerSuspend` gives access to the `locked` mutex. */ /*@ - * predicate_ctor scheduler_suspended_invariant(QueueHandle_t queue)() = - * queue->locked |-> ?m &*& - * mutex(m, queue_locked_invariant(queue)); - * - * predicate queuesuspend(QueueHandle_t q;) = - * q->schedulerSuspend |-> ?m &*& - * mutex(m, scheduler_suspended_invariant(q)); - * @*/ +predicate_ctor scheduler_suspended_invariant(QueueHandle_t queue)() = + queue->locked |-> ?m &*& + mutex(m, queue_locked_invariant(queue)); -/* A queuelock is exclusively acquired by a task. Acquiring the ghost `queuelock` gives access to the queue list resources. */ +predicate queuesuspend(QueueHandle_t q;) = + q->schedulerSuspend |-> ?m &*& + mutex(m, scheduler_suspended_invariant(q)); +@*/ +/* A queuelock is exclusively acquired by a task. Acquiring the ghost `queuelock` gives access to the queue list resources. */ /*@ - * predicate queuelock(QueueHandle_t q;) = - * q->locked |-> ?m &*& - * mutex(m, queue_locked_invariant(q)); - * - * predicate_ctor queue_locked_invariant(QueueHandle_t queue)() = - * queuelists(queue); - * @*/ +predicate queuelock(QueueHandle_t q;) = + q->locked |-> ?m &*& + mutex(m, queue_locked_invariant(q)); + +predicate_ctor queue_locked_invariant(QueueHandle_t queue)() = + queuelists(queue); +@*/ -BaseType_t vListInitialise( List_t * list ); +BaseType_t vListInitialise(List_t *list); /*@requires list(list);@*/ /*@ensures list(list);@*/ -BaseType_t listLIST_IS_EMPTY( List_t * list ); +BaseType_t listLIST_IS_EMPTY(List_t *list); /*@requires list->uxNumberOfItems |-> ?len;@*/ /*@ensures list->uxNumberOfItems |-> len &*& result == (len == 0 ? pdTRUE : pdFALSE);@*/ @@ -442,27 +433,25 @@ typedef struct xTIME_OUT } TimeOut_t; /*@ - * predicate xTIME_OUT(struct xTIME_OUT *to;) = - * to->xOverflowCount |-> _ &*& - * to->xTimeOnEntering |-> _ &*& - * struct_xTIME_OUT_padding(to); - * @*/ +predicate xTIME_OUT(struct xTIME_OUT *to;) = + to->xOverflowCount |-> _ &*& + to->xTimeOnEntering |-> _ &*& + struct_xTIME_OUT_padding(to); +@*/ -void vTaskInternalSetTimeOutState( TimeOut_t * x ); +void vTaskInternalSetTimeOutState( TimeOut_t * x); /*@requires xTIME_OUT(x);@*/ /*@ensures xTIME_OUT(x);@*/ -BaseType_t xTaskCheckForTimeOut( TimeOut_t * const pxTimeOut, - TickType_t * const pxTicksToWait ); +BaseType_t xTaskCheckForTimeOut( TimeOut_t * const pxTimeOut, TickType_t * const pxTicksToWait ); /*@requires xTIME_OUT(pxTimeOut) &*& u_integer(pxTicksToWait, _);@*/ /*@ensures xTIME_OUT(pxTimeOut) &*& u_integer(pxTicksToWait, _);@*/ -BaseType_t xTaskRemoveFromEventList( List_t * list ); +BaseType_t xTaskRemoveFromEventList(List_t *list); /*@requires list(list);@*/ /*@ensures list(list);@*/ -void vTaskPlaceOnEventList( List_t * const pxEventList, - const TickType_t xTicksToWait ); +void vTaskPlaceOnEventList( List_t * const pxEventList, const TickType_t xTicksToWait ); /*@requires list(pxEventList);@*/ /*@ensures list(pxEventList);@*/ @@ -471,107 +460,94 @@ void vTaskMissedYield(); /*@ensures true;@*/ void vTaskSuspendAll(); - /*@requires exists(?xQueue) &*& - * [1/2]xQueue->schedulerSuspend |-> ?m &*& - * [1/2]mutex(m, scheduler_suspended_invariant(xQueue));@*/ - + [1/2]xQueue->schedulerSuspend |-> ?m &*& + [1/2]mutex(m, scheduler_suspended_invariant(xQueue));@*/ /*@ensures [1/2]xQueue->schedulerSuspend |-> m &*& - * mutex_held(m, scheduler_suspended_invariant(xQueue), currentThread, 1/2) &*& - * xQueue->locked |-> ?m2 &*& - * mutex(m2, queue_locked_invariant(xQueue));@*/ + mutex_held(m, scheduler_suspended_invariant(xQueue), currentThread, 1/2) &*& + xQueue->locked |-> ?m2 &*& + mutex(m2, queue_locked_invariant(xQueue));@*/ BaseType_t xTaskResumeAll( void ); - /*@requires exists(?xQueue) &*& - * [1/2]xQueue->schedulerSuspend |-> ?m &*& - * mutex_held(m, scheduler_suspended_invariant(xQueue), currentThread, 1/2) &*& - * xQueue->locked |-> ?m2 &*& - * mutex(m2, queue_locked_invariant(xQueue));@*/ - + [1/2]xQueue->schedulerSuspend |-> ?m &*& + mutex_held(m, scheduler_suspended_invariant(xQueue), currentThread, 1/2) &*& + xQueue->locked |-> ?m2 &*& + mutex(m2, queue_locked_invariant(xQueue));@*/ /*@ensures [1/2]xQueue->schedulerSuspend |-> m &*& - * [1/2]mutex(m, scheduler_suspended_invariant(xQueue));@*/ + [1/2]mutex(m, scheduler_suspended_invariant(xQueue));@*/ void prvLockQueue( QueueHandle_t xQueue ); - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]queuelock(xQueue); @*/ - + [1/2]queuelock(xQueue); @*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]xQueue->locked |-> ?m &*& - * mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& - * queue_locked_invariant(xQueue)();@*/ + [1/2]xQueue->locked |-> ?m &*& + mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& + queue_locked_invariant(xQueue)();@*/ void prvUnlockQueue( QueueHandle_t xQueue ); - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]xQueue->locked |-> ?m &*& - * mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& - * queue_locked_invariant(xQueue)();@*/ - + [1/2]xQueue->locked |-> ?m &*& + mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& + queue_locked_invariant(xQueue)();@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuelock(xQueue);@*/ + [1/2]queuelock(xQueue);@*/ -void setInterruptMask( QueueHandle_t xQueue ) +void setInterruptMask(QueueHandle_t xQueue) /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false;@*/ - /*@ensures [1/2]xQueue->irqMask |-> ?m &*& - * mutex_held(m, irqs_masked_invariant(xQueue, N, M, is_isr), currentThread, 1/2) &*& - * queue(xQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * queuelists(xQueue);@*/ + mutex_held(m, irqs_masked_invariant(xQueue, N, M, is_isr), currentThread, 1/2) &*& + queue(xQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& + queuelists(xQueue);@*/ { /*@open queuehandle(xQueue, N, M, is_isr);@*/ - mutex_acquire( xQueue->irqMask ); + mutex_acquire(xQueue->irqMask); /*@open irqs_masked_invariant(xQueue, N, M, is_isr)();@*/ } -void clearInterruptMask( QueueHandle_t xQueue ) - +void clearInterruptMask(QueueHandle_t xQueue) /*@requires queue(xQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * [1/2]xQueue->irqMask |-> ?m &*& - * mutex_held(m, irqs_masked_invariant(xQueue, N, M, false), currentThread, 1/2) &*& - * queuelists(xQueue);@*/ + [1/2]xQueue->irqMask |-> ?m &*& + mutex_held(m, irqs_masked_invariant(xQueue, N, M, false), currentThread, 1/2) &*& + queuelists(xQueue);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, false);@*/ { /*@close irqs_masked_invariant(xQueue, N, M, false)();@*/ - mutex_release( xQueue->irqMask ); + mutex_release(xQueue->irqMask); /*@close [1/2]queuehandle(xQueue, N, M, false);@*/ } -#define taskENTER_CRITICAL() setInterruptMask( xQueue ) -#define taskEXIT_CRITICAL() clearInterruptMask( xQueue ) +#define taskENTER_CRITICAL() setInterruptMask(xQueue) +#define taskEXIT_CRITICAL() clearInterruptMask(xQueue) #define portYIELD_WITHIN_API() #define queueYIELD_IF_USING_PREEMPTION() -UBaseType_t setInterruptMaskFromISR( QueueHandle_t xQueue ) +UBaseType_t setInterruptMaskFromISR(QueueHandle_t xQueue) /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == true;@*/ - /*@ensures [1/2]xQueue->irqMask |-> ?m &*& - * mutex_held(m, irqs_masked_invariant(xQueue, N, M, is_isr), currentThread, 1/2) &*& - * queue(xQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * (is_locked ? true : queuelists(xQueue));@*/ + mutex_held(m, irqs_masked_invariant(xQueue, N, M, is_isr), currentThread, 1/2) &*& + queue(xQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs) &*& + (is_locked ? true : queuelists(xQueue));@*/ { /*@open queuehandle(xQueue, N, M, is_isr);@*/ - mutex_acquire( xQueue->irqMask ); + mutex_acquire(xQueue->irqMask); /*@open irqs_masked_invariant(xQueue, N, M, is_isr)();@*/ return 0; } -void clearInterruptMaskFromISR( QueueHandle_t xQueue, - UBaseType_t uxSavedInterruptStatus ) - +void clearInterruptMaskFromISR(QueueHandle_t xQueue, UBaseType_t uxSavedInterruptStatus) /*@requires queue(xQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * [1/2]xQueue->irqMask |-> ?m &*& - * mutex_held(m, irqs_masked_invariant(xQueue, N, M, true), currentThread, 1/2) &*& - * (is_locked ? true : queuelists(xQueue));@*/ + [1/2]xQueue->irqMask |-> ?m &*& + mutex_held(m, irqs_masked_invariant(xQueue, N, M, true), currentThread, 1/2) &*& + (is_locked ? true : queuelists(xQueue));@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, true);@*/ { /*@close irqs_masked_invariant(xQueue, N, M, true)();@*/ - mutex_release( xQueue->irqMask ); + mutex_release(xQueue->irqMask); /*@close [1/2]queuehandle(xQueue, N, M, true);@*/ } -#define portSET_INTERRUPT_MASK_FROM_ISR() setInterruptMaskFromISR( xQueue ) -#define portCLEAR_INTERRUPT_MASK_FROM_ISR( uxSavedInterruptStatus ) clearInterruptMaskFromISR( xQueue, uxSavedInterruptStatus ) +#define portSET_INTERRUPT_MASK_FROM_ISR() setInterruptMaskFromISR(xQueue) +#define portCLEAR_INTERRUPT_MASK_FROM_ISR(uxSavedInterruptStatus) clearInterruptMaskFromISR(xQueue, uxSavedInterruptStatus) #endif /* QUEUE_H */ diff --git a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h index 7f2e3dd218..1c1282831a 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h @@ -29,32 +29,26 @@ #include "queue.h" -void prvCopyDataFromQueue( Queue_t * const pxQueue, - void * const pvBuffer ); +void prvCopyDataFromQueue( Queue_t * const pxQueue, void * const pvBuffer ); /*@requires queue(pxQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& 0 < K &*& chars(pvBuffer, M, _);@*/ - /*@ensures queue_after_prvCopyDataFromQueue(pxQueue, Storage, N, M, W, (R+1)%N, K, is_locked, abs) &*& - * chars(pvBuffer, M, head(abs));@*/ - -BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, - const void * pvItemToQueue, - const BaseType_t xPosition ); + chars(pvBuffer, M, head(abs));@*/ +BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, const void *pvItemToQueue, const BaseType_t xPosition ); /*@requires queue(pxQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * (K < N || xPosition == queueOVERWRITE) &*& - * chars(pvItemToQueue, M, ?x) &*& - * (xPosition == queueSEND_TO_BACK || xPosition == queueSEND_TO_FRONT || (xPosition == queueOVERWRITE && N == 1));@*/ - + (K < N || xPosition == queueOVERWRITE) &*& + chars(pvItemToQueue, M, ?x) &*& + (xPosition == queueSEND_TO_BACK || xPosition == queueSEND_TO_FRONT || (xPosition == queueOVERWRITE && N == 1));@*/ /*@ensures - * (xPosition == queueSEND_TO_BACK - * ? queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))) - * : (xPosition == queueSEND_TO_FRONT - * ? (R == 0 - * ? queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)) - * : queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs))) - * : xPosition == queueOVERWRITE &*& queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x))) - * ) &*& - * chars(pvItemToQueue, M, x);@*/ + (xPosition == queueSEND_TO_BACK + ? queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))) + : (xPosition == queueSEND_TO_FRONT + ? (R == 0 + ? queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)) + : queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs))) + : xPosition == queueOVERWRITE &*& queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x))) + ) &*& + chars(pvItemToQueue, M, x);@*/ BaseType_t prvIsQueueEmpty( Queue_t * pxQueue ); /*@requires [1/2]queuehandle(pxQueue, ?N, ?M, ?is_isr) &*& is_isr == false;@*/ diff --git a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c index f9e4a6e353..6003bdcbea 100644 --- a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c +++ b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c @@ -27,13 +27,12 @@ #include "proof/list.h" /* Wrap the macro in a function call so we can give a function contract */ -#define listLIST_IS_EMPTY( pxList ) ( ( ( pxList )->uxNumberOfItems == ( UBaseType_t ) 0 ) ? pdTRUE : pdFALSE ) +#define listLIST_IS_EMPTY( pxList ) ( ( ( pxList )->uxNumberOfItems == ( UBaseType_t ) 0 ) ? pdTRUE : pdFALSE ) BaseType_t wrapper_listLIST_IS_EMPTY( List_t * pxList ) /*@requires xLIST(pxList, ?len, ?idx, ?end, ?cells, ?vals);@*/ - /*@ensures xLIST(pxList, len, idx, end, cells, vals) &*& - * result == ((len == 0) ? pdTRUE : pdFALSE); @*/ + result == ((len == 0) ? pdTRUE : pdFALSE); @*/ { /*@open xLIST(pxList, len, _, _, _, _);@*/ return listLIST_IS_EMPTY( pxList ); diff --git a/FreeRTOS/Test/VeriFast/list/uxListRemove.c b/FreeRTOS/Test/VeriFast/list/uxListRemove.c index 90da8ff473..2fc1af6223 100644 --- a/FreeRTOS/Test/VeriFast/list/uxListRemove.c +++ b/FreeRTOS/Test/VeriFast/list/uxListRemove.c @@ -27,18 +27,16 @@ #include "proof/list.h" UBaseType_t uxListRemove( ListItem_t * const pxItemToRemove ) - /*@requires - * exists(?l) &*& - * xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& - * end != pxItemToRemove &*& - * mem(pxItemToRemove, cells) == true;@*/ - + exists(?l) &*& + xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& + end != pxItemToRemove &*& + mem(pxItemToRemove, cells) == true;@*/ /*@ensures - * result == len-1 &*& - * xLIST_ITEM(pxItemToRemove, nth(index_of(pxItemToRemove, cells), vals), _, ?pxItemToRemovePrevious, NULL) &*& - * pxItemToRemovePrevious == nth(index_of(pxItemToRemove, cells)-1, cells) &*& - * xLIST(l, result, idx == pxItemToRemove ? pxItemToRemovePrevious : idx, end, remove(pxItemToRemove, cells), remove_nth(index_of(pxItemToRemove, cells), vals));@*/ + result == len-1 &*& + xLIST_ITEM(pxItemToRemove, nth(index_of(pxItemToRemove, cells), vals), _, ?pxItemToRemovePrevious, NULL) &*& + pxItemToRemovePrevious == nth(index_of(pxItemToRemove, cells)-1, cells) &*& + xLIST(l, result, idx == pxItemToRemove ? pxItemToRemovePrevious : idx, end, remove(pxItemToRemove, cells), remove_nth(index_of(pxItemToRemove, cells), vals));@*/ { /* For brevity we alias x to pxItemToRemove */ /*@struct xLIST_ITEM *x = pxItemToRemove;@*/ @@ -50,7 +48,7 @@ UBaseType_t uxListRemove( ListItem_t * const pxItemToRemove ) /*@dls_not_empty(end, endprev, cells, x);@*/ /* We know the xLIST is a DLS: end...endprev - * Split this into DLS1:end...xprev and DLS2:x...endprev */ + Split this into DLS1:end...xprev and DLS2:x...endprev */ /*@int i = index_of(x, cells);@*/ /*@split(end, endprev, end, endprev, cells, vals, x, i);@*/ /*@list ys = take(i, cells);@*/ @@ -63,107 +61,106 @@ UBaseType_t uxListRemove( ListItem_t * const pxItemToRemove ) /*@assert DLS(x, xprev, end, endprev, zs, ws, l);@*/ /*< DLS2 (zs, ws) */ /* Now case split to open DLS1 and DLS2 appropriately */ - /*@ - * if (end == xprev) - * { - * if (x == endprev) - * { - * //Case A - * //DLS1: extract end=prev=next - * open DLS(end, endprev, x, xprev, ys, vs, l); - * open xLIST_ITEM(end, portMAX_DELAY, x, endprev, l); - * //DLS2: extract x - * open DLS(x, xprev, end, endprev, zs, ws, l); - * //Lengths - * assert length(ys) == 1; - * assert length(zs) == 1; - * } - * else - * { - * //Case B - * //DLS1: extract end=prev - * open DLS(end, endprev, x, xprev, ys, vs, l); - * open xLIST_ITEM(end, portMAX_DELAY, x, endprev, l); - * //DLS2: extract next and x - * open DLS(x, end, end, endprev, zs, ws, l); - * assert DLS(?xnext, x, end, endprev, tail(zs), tail(ws), l); - * open DLS(xnext, x, end, endprev, tail(zs), tail(ws), l); - * open xLIST_ITEM(xnext, _, _, x, l); - * //Lengths - * assert length(ys) == 1; - * } - * } - * else - * { - * if (x == endprev) - * { - * //Case C - * //DLS1: extract end=next and prev - * dls_last_mem(end, endprev, x, xprev, ys); - * assert mem(xprev, ys) == true; - * open DLS(end, endprev, x, xprev, ys, vs, l); - * open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, l); - * if (endnext == xprev) - * { - * open DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); - * open xLIST_ITEM(xprev, _, x, _, l); - * } - * else - * { - * assert DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); - * int k = index_of(xprev, tail(ys)); - * dls_last_mem(endnext, end, x, xprev, tail(ys)); - * split(endnext, end, x, xprev, tail(ys), tail(vs), xprev, k); - * open DLS(xprev, _, x, xprev, _, _, l); - * open xLIST_ITEM(xprev, _, x, _, l); - * } - * //DLS2: extract x - * open DLS(x, xprev, end, endprev, zs, ws, l); - * //Lengths - * assert length(zs) == 1; - * } - * else - * { - * //Case D - * //DLS1: extract prev - * dls_last_mem(end, endprev, x, xprev, ys); - * int j = index_of(xprev, ys); - * open DLS(end, endprev, x, xprev, ys, vs, l); - * open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, l); - * if (endnext == xprev) - * { - * open DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); - * assert tail(ys) == singleton(xprev); - * open xLIST_ITEM(xprev, _, x, _, l); - * } - * else - * { - * assert DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); - * int k = index_of(xprev, tail(ys)); - * dls_last_mem(endnext, end, x, xprev, tail(ys)); - * split(endnext, end, x, xprev, tail(ys), tail(vs), xprev, k); - * open DLS(xprev, _, x, xprev, _, _, l); - * open xLIST_ITEM(xprev, _, x, _, l); - * } - * //DLS2: extract next and x - * open DLS(x, xprev, end, endprev, zs, ws, l); - * assert xLIST_ITEM(x, _, ?xnext, _, l); - * open DLS(xnext, x, end, endprev, tail(zs), tail(ws), l); - * open xLIST_ITEM(xnext, _, _, x, l); - * } - * } - * @*/ + if (end == xprev) + { + if (x == endprev) + { + //Case A + //DLS1: extract end=prev=next + open DLS(end, endprev, x, xprev, ys, vs, l); + open xLIST_ITEM(end, portMAX_DELAY, x, endprev, l); + //DLS2: extract x + open DLS(x, xprev, end, endprev, zs, ws, l); + //Lengths + assert length(ys) == 1; + assert length(zs) == 1; + } + else + { + //Case B + //DLS1: extract end=prev + open DLS(end, endprev, x, xprev, ys, vs, l); + open xLIST_ITEM(end, portMAX_DELAY, x, endprev, l); + //DLS2: extract next and x + open DLS(x, end, end, endprev, zs, ws, l); + assert DLS(?xnext, x, end, endprev, tail(zs), tail(ws), l); + open DLS(xnext, x, end, endprev, tail(zs), tail(ws), l); + open xLIST_ITEM(xnext, _, _, x, l); + //Lengths + assert length(ys) == 1; + } + } + else + { + if (x == endprev) + { + //Case C + //DLS1: extract end=next and prev + dls_last_mem(end, endprev, x, xprev, ys); + assert mem(xprev, ys) == true; + open DLS(end, endprev, x, xprev, ys, vs, l); + open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, l); + if (endnext == xprev) + { + open DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); + open xLIST_ITEM(xprev, _, x, _, l); + } + else + { + assert DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); + int k = index_of(xprev, tail(ys)); + dls_last_mem(endnext, end, x, xprev, tail(ys)); + split(endnext, end, x, xprev, tail(ys), tail(vs), xprev, k); + open DLS(xprev, _, x, xprev, _, _, l); + open xLIST_ITEM(xprev, _, x, _, l); + } + //DLS2: extract x + open DLS(x, xprev, end, endprev, zs, ws, l); + //Lengths + assert length(zs) == 1; + } + else + { + //Case D + //DLS1: extract prev + dls_last_mem(end, endprev, x, xprev, ys); + int j = index_of(xprev, ys); + open DLS(end, endprev, x, xprev, ys, vs, l); + open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, l); + if (endnext == xprev) + { + open DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); + assert tail(ys) == singleton(xprev); + open xLIST_ITEM(xprev, _, x, _, l); + } + else + { + assert DLS(endnext, end, x, xprev, tail(ys), tail(vs), l); + int k = index_of(xprev, tail(ys)); + dls_last_mem(endnext, end, x, xprev, tail(ys)); + split(endnext, end, x, xprev, tail(ys), tail(vs), xprev, k); + open DLS(xprev, _, x, xprev, _, _, l); + open xLIST_ITEM(xprev, _, x, _, l); + } + //DLS2: extract next and x + open DLS(x, xprev, end, endprev, zs, ws, l); + assert xLIST_ITEM(x, _, ?xnext, _, l); + open DLS(xnext, x, end, endprev, tail(zs), tail(ws), l); + open xLIST_ITEM(xnext, _, _, x, l); + } + } + @*/ /*@drop_nth_index_of(vals, i);@*/ /*@open xLIST_ITEM(x, nth(i, vals), ?xnext, xprev, l);@*/ /* The list item knows which list it is in. Obtain the list from the list * item. */ - #ifdef VERIFAST /*< const pointer declaration */ - List_t * pxList = pxItemToRemove->pxContainer; - #else - List_t * const pxList = pxItemToRemove->pxContainer; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + List_t * pxList = pxItemToRemove->pxContainer; +#else + List_t * const pxList = pxItemToRemove->pxContainer; +#endif pxItemToRemove->pxNext->pxPrevious = pxItemToRemove->pxPrevious; pxItemToRemove->pxPrevious->pxNext = pxItemToRemove->pxNext; @@ -187,105 +184,101 @@ UBaseType_t uxListRemove( ListItem_t * const pxItemToRemove ) return pxList->uxNumberOfItems; /*@ - * // Reassemble DLS1 and a modified DLS2, which no longer includes x - * if (end == xprev) - * { - * if (x == endprev) - * { - * //Case A - * close xLIST_ITEM(end, portMAX_DELAY, _, _, _); - * close DLS(end, end, end, end, singleton(end), singleton(portMAX_DELAY), l); - * } - * else - * { - * //Case B - * close xLIST_ITEM(xprev, _, xnext, endprev, l); - * close DLS(end, endprev, xnext, xprev, singleton(end), singleton(portMAX_DELAY), l); - * close xLIST_ITEM(xnext, _, _, xprev, l); - * close DLS(xnext, xprev, end, endprev, tail(zs), tail(ws), l); - * join(end, endprev, xnext, xprev, singleton(end), singleton(portMAX_DELAY), - * xnext, xprev, end, endprev, tail(zs), tail(ws)); - * } - * } - * else - * { - * if (x == endprev) - * { - * //Case C - * close xLIST_ITEM(end, _, ?endnext, xprev, l); - * close xLIST_ITEM(xprev, ?xprev_val, end, _, l); - * if (endnext == xprev) - * { - * close DLS(xprev, end, end, xprev, singleton(xprev), singleton(xprev_val), l); - * close DLS(end, xprev, end, xprev, cons(end, singleton(xprev)), cons(portMAX_DELAY, singleton(xprev_val)), l); - * } - * else - * { - * close DLS(xprev, ?xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val), l); - * assert DLS(endnext, end, xprev, xprevprev, ?cells_endnext_to_xprevprev, ?vals_endnext_to_xprevprev, l); - * join(endnext, end, xprev, xprevprev, cells_endnext_to_xprevprev, vals_endnext_to_xprevprev, - * xprev, xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val)); - * close DLS(end, xprev, end, xprev, ys, vs, l); - * } - * } - * else - * { - * //Case D - * close xLIST_ITEM(xnext, _, ?xnextnext, xprev, l); - * close DLS(xnext, xprev, end, endprev, tail(zs), tail(ws), l); - * close xLIST_ITEM(end, _, ?endnext, endprev, l); - * close xLIST_ITEM(xprev, ?xprev_val, xnext, _, l); - * if (endnext == xprev) - * { - * close DLS(xprev, _, xnext, xprev, singleton(xprev), singleton(xprev_val), l); - * close DLS(end, endprev, xnext, xprev, ys, vs, l); - * join(end, endprev, xnext, xprev, ys, vs, - * xnext, xprev, end, endprev, tail(zs), tail(ws)); - * } - * else - * { - * close DLS(xprev, ?xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val), l); - * assert DLS(endnext, end, xprev, xprevprev, ?cells_endnext_to_xprevprev, ?vals_endnext_to_xprevprev, l); - * join(endnext, end, xprev, xprevprev, cells_endnext_to_xprevprev, vals_endnext_to_xprevprev, - * xprev, xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val)); - * close DLS(end, endprev, xnext, xprev, ys, vs, l); - * join(end, endprev, xnext, xprev, ys, vs, - * xnext, xprev, end, endprev, tail(zs), tail(ws)); - * } - * } - * } - * @*/ + // Reassemble DLS1 and a modified DLS2, which no longer includes x + if (end == xprev) + { + if (x == endprev) + { + //Case A + close xLIST_ITEM(end, portMAX_DELAY, _, _, _); + close DLS(end, end, end, end, singleton(end), singleton(portMAX_DELAY), l); + } + else + { + //Case B + close xLIST_ITEM(xprev, _, xnext, endprev, l); + close DLS(end, endprev, xnext, xprev, singleton(end), singleton(portMAX_DELAY), l); + close xLIST_ITEM(xnext, _, _, xprev, l); + close DLS(xnext, xprev, end, endprev, tail(zs), tail(ws), l); + join(end, endprev, xnext, xprev, singleton(end), singleton(portMAX_DELAY), + xnext, xprev, end, endprev, tail(zs), tail(ws)); + } + } + else + { + if (x == endprev) + { + //Case C + close xLIST_ITEM(end, _, ?endnext, xprev, l); + close xLIST_ITEM(xprev, ?xprev_val, end, _, l); + if (endnext == xprev) + { + close DLS(xprev, end, end, xprev, singleton(xprev), singleton(xprev_val), l); + close DLS(end, xprev, end, xprev, cons(end, singleton(xprev)), cons(portMAX_DELAY, singleton(xprev_val)), l); + } + else + { + close DLS(xprev, ?xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val), l); + assert DLS(endnext, end, xprev, xprevprev, ?cells_endnext_to_xprevprev, ?vals_endnext_to_xprevprev, l); + join(endnext, end, xprev, xprevprev, cells_endnext_to_xprevprev, vals_endnext_to_xprevprev, + xprev, xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val)); + close DLS(end, xprev, end, xprev, ys, vs, l); + } + } + else + { + //Case D + close xLIST_ITEM(xnext, _, ?xnextnext, xprev, l); + close DLS(xnext, xprev, end, endprev, tail(zs), tail(ws), l); + close xLIST_ITEM(end, _, ?endnext, endprev, l); + close xLIST_ITEM(xprev, ?xprev_val, xnext, _, l); + if (endnext == xprev) + { + close DLS(xprev, _, xnext, xprev, singleton(xprev), singleton(xprev_val), l); + close DLS(end, endprev, xnext, xprev, ys, vs, l); + join(end, endprev, xnext, xprev, ys, vs, + xnext, xprev, end, endprev, tail(zs), tail(ws)); + } + else + { + close DLS(xprev, ?xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val), l); + assert DLS(endnext, end, xprev, xprevprev, ?cells_endnext_to_xprevprev, ?vals_endnext_to_xprevprev, l); + join(endnext, end, xprev, xprevprev, cells_endnext_to_xprevprev, vals_endnext_to_xprevprev, + xprev, xprevprev, xnext, xprev, singleton(xprev), singleton(xprev_val)); + close DLS(end, endprev, xnext, xprev, ys, vs, l); + join(end, endprev, xnext, xprev, ys, vs, + xnext, xprev, end, endprev, tail(zs), tail(ws)); + } + } + } + @*/ /*@remove_remove_nth(cells, x);@*/ - /*@ - * if (idx == x) - * { - * close xLIST(l, len-1, xprev, end, append(ys, tail(zs)), append(vs, tail(ws))); - * } - * else - * { - * idx_remains_in_list(cells, idx, x, i); - * close xLIST(l, len-1, idx, end, append(ys, tail(zs)), append(vs, tail(ws))); - * } - * @*/ + if (idx == x) + { + close xLIST(l, len-1, xprev, end, append(ys, tail(zs)), append(vs, tail(ws))); + } + else + { + idx_remains_in_list(cells, idx, x, i); + close xLIST(l, len-1, idx, end, append(ys, tail(zs)), append(vs, tail(ws))); + } + @*/ /*@close xLIST_ITEM(x, nth(i, vals), xnext, xprev, NULL);@*/ } ListItem_t * client_example( List_t * l ) - /*@requires - * xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& - * idx != end &*& - * cells == cons(end, cons(idx, ?cells_tl)) &*& - * vals == cons(portMAX_DELAY, cons(42, ?vals_tl));@*/ - + xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& + idx != end &*& + cells == cons(end, cons(idx, ?cells_tl)) &*& + vals == cons(portMAX_DELAY, cons(42, ?vals_tl));@*/ /*@ensures - * xLIST(l, len - 1, _, end, cons(end, cells_tl), cons(portMAX_DELAY, vals_tl)) &*& - * xLIST_ITEM(result, 42, _, _, NULL);@*/ + xLIST(l, len - 1, _, end, cons(end, cells_tl), cons(portMAX_DELAY, vals_tl)) &*& + xLIST_ITEM(result, 42, _, _, NULL);@*/ { /*@open xLIST(l, len, idx, end, cells, vals);@*/ - ListItem_t * index = l->pxIndex; - + ListItem_t *index = l->pxIndex; /*@close xLIST(l, len, idx, end, cells, vals);@*/ /*@close exists(l);@*/ uxListRemove( index ); @@ -293,22 +286,19 @@ ListItem_t * client_example( List_t * l ) } void client_example2( List_t * l ) - /*@requires - * xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& - * cells == cons(end, cons(?x1, cons(?x2, ?cells_tl))) &*& - * idx == x2 &*& - * vals == cons(portMAX_DELAY, cons(1, cons(2, ?vals_tl)));@*/ - + xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& + cells == cons(end, cons(?x1, cons(?x2, ?cells_tl))) &*& + idx == x2 &*& + vals == cons(portMAX_DELAY, cons(1, cons(2, ?vals_tl)));@*/ /*@ensures - * xLIST(l, len-2, end, end, cons(end, cells_tl), cons(portMAX_DELAY, vals_tl)) &*& - * xLIST_ITEM(_, 1, _, _, NULL) &*& - * xLIST_ITEM(_, 2, _, _, NULL);@*/ + xLIST(l, len-2, end, end, cons(end, cells_tl), cons(portMAX_DELAY, vals_tl)) &*& + xLIST_ITEM(_, 1, _, _, NULL) &*& + xLIST_ITEM(_, 2, _, _, NULL);@*/ { /*@xLIST_distinct_cells(l);@*/ /*@open xLIST(l, len, idx, end, cells, vals);@*/ - ListItem_t * index = l->pxIndex; - + ListItem_t *index = l->pxIndex; /*@close xLIST(l, len, idx, end, cells, vals);@*/ /*@close exists(l);@*/ uxListRemove( index ); diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialise.c b/FreeRTOS/Test/VeriFast/list/vListInitialise.c index 9510e357db..4da7bd356d 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialise.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialise.c @@ -27,16 +27,16 @@ #include "proof/list.h" /*@ - * predicate xLIST_uninitialised(struct xLIST *l) = - * l->uxNumberOfItems |-> _ &*& - * l->pxIndex |-> _ &*& - * l->xListEnd.xItemValue |-> _ &*& - * l->xListEnd.pxNext |-> _ &*& - * l->xListEnd.pxPrevious |-> _ &*& - * l->xListEnd.pvOwner |-> _ &*& - * l->xListEnd.pxContainer |-> _ &*& - * struct_xLIST_ITEM_padding(&l->xListEnd); - * @*/ +predicate xLIST_uninitialised(struct xLIST *l) = + l->uxNumberOfItems |-> _ &*& + l->pxIndex |-> _ &*& + l->xListEnd.xItemValue |-> _ &*& + l->xListEnd.pxNext |-> _ &*& + l->xListEnd.pxPrevious |-> _ &*& + l->xListEnd.pvOwner |-> _ &*& + l->xListEnd.pxContainer |-> _ &*& + struct_xLIST_ITEM_padding(&l->xListEnd); +@*/ void vListInitialise( List_t * const pxList ) /*@requires xLIST_uninitialised(pxList);@*/ @@ -65,9 +65,9 @@ void vListInitialise( List_t * const pxList ) listSET_LIST_INTEGRITY_CHECK_1_VALUE( pxList ); listSET_LIST_INTEGRITY_CHECK_2_VALUE( pxList ); - #ifdef VERIFAST /*< ***change MiniList_t to ListItem_t*** */ - pxList->xListEnd.pxContainer = pxList; - #endif +#ifdef VERIFAST /*< ***change MiniList_t to ListItem_t*** */ + pxList->xListEnd.pxContainer = pxList; +#endif /*@ListItem_t *end = &(pxList->xListEnd);@*/ /*@close xLIST_ITEM(end, portMAX_DELAY, _, _, pxList);@*/ /*@close DLS(end, end, end, end, singleton(end), singleton(portMAX_DELAY), pxList);@*/ diff --git a/FreeRTOS/Test/VeriFast/list/vListInsert.c b/FreeRTOS/Test/VeriFast/list/vListInsert.c index 8e88865231..367161a34a 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsert.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsert.c @@ -27,21 +27,18 @@ #include "proof/list.h" -ListItem_t * choose( List_t * list ); +ListItem_t * choose(List_t * list); /*@ requires DLS(&(list->xListEnd), ?endprev, &(list->xListEnd), endprev, ?cells, ?vals, ?container);@*/ - /*@ ensures DLS(&(list->xListEnd), endprev, &(list->xListEnd), endprev, cells, vals, container) &*& - * mem(result, cells) == true;@*/ + mem(result, cells) == true;@*/ void vListInsert( List_t * const pxList, ListItem_t * const pxNewListItem ) - /*@requires xLIST(pxList, ?len, ?idx, ?end, ?cells, ?vals) &*& - * xLIST_ITEM(pxNewListItem, ?val, _, _, _);@*/ - + xLIST_ITEM(pxNewListItem, ?val, _, _, _);@*/ /*@ensures xLIST(pxList, len+1, idx, end, ?new_cells, ?new_vals) &*& - * remove(pxNewListItem, new_cells) == cells - * ;@*/ + remove(pxNewListItem, new_cells) == cells +;@*/ { /*@xLIST_star_item(pxList, pxNewListItem);@*/ /*@open xLIST_ITEM(pxNewListItem, _, _, _, _);@*/ @@ -68,24 +65,23 @@ void vListInsert( List_t * const pxList, { /*@open DLS(end, endprev, end, endprev, cells, vals, pxList);@*/ /*@open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, pxList);@*/ - /*@ - * if (end != endprev) - * { - * assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); - * if (endnext == endprev) - * { - * // done - * } - * else - * { - * dls_last_mem(endnext, end, end, endprev, tail(cells)); - * split(endnext, end, end, endprev, tail(cells), tail(vals), endprev, index_of(endprev, tail(cells))); - * } - * open DLS(endprev, _, _, _, _, _, _); - * open xLIST_ITEM(endprev, _, _, _, _); - * } - * @*/ + if (end != endprev) + { + assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); + if (endnext == endprev) + { + // done + } + else + { + dls_last_mem(endnext, end, end, endprev, tail(cells)); + split(endnext, end, end, endprev, tail(cells), tail(vals), endprev, index_of(endprev, tail(cells))); + } + open DLS(endprev, _, _, _, _, _, _); + open xLIST_ITEM(endprev, _, _, _, _); + } + @*/ pxIterator = pxList->xListEnd.pxPrevious; } else @@ -112,53 +108,52 @@ void vListInsert( List_t * const pxList, * before vTaskStartScheduler() has been called?). **********************************************************************/ - #ifdef VERIFAST /*< ***over-approximate list insert loop*** */ - pxIterator = choose( pxList ); - #else - for( pxIterator = ( ListItem_t * ) &( pxList->xListEnd ); pxIterator->pxNext->xItemValue <= xValueOfInsertion; pxIterator = pxIterator->pxNext ) /*lint !e826 !e740 !e9087 The mini list structure is used as the list end to save RAM. This is checked and valid. *//*lint !e440 The iterator moves to a different value, not xValueOfInsertion. */ - { - /* There is nothing to do here, just iterating to the wanted - * insertion position. */ - } - #endif +#ifdef VERIFAST /*< ***over-approximate list insert loop*** */ + pxIterator = choose(pxList); +#else + for( pxIterator = ( ListItem_t * ) &( pxList->xListEnd ); pxIterator->pxNext->xItemValue <= xValueOfInsertion; pxIterator = pxIterator->pxNext ) /*lint !e826 !e740 !e9087 The mini list structure is used as the list end to save RAM. This is checked and valid. *//*lint !e440 The iterator moves to a different value, not xValueOfInsertion. */ + { + /* There is nothing to do here, just iterating to the wanted + * insertion position. */ + } +#endif /*@int i = index_of(pxIterator, cells);@*/ - /*@ - * if (pxIterator == end) - * { - * open DLS(end, endprev, end, endprev, cells, vals, pxList); - * open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, pxList); - * if (end != endprev) - * { - * assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); - * open DLS(endnext, _, _, _, _, _, _); - * open xLIST_ITEM(endnext, _, _, _, _); - * } - * } - * else - * { - * assert DLS(end, endprev, end, endprev, cells, vals, pxList); - * dls_first_mem(end, endprev, end, endprev, cells); - * assert pxIterator != end; - * assert index_of(end, cells) == 0; - * split(end, endprev, end, endprev, cells, vals, pxIterator, i); - * assert DLS(end, endprev, pxIterator, ?iterprev, take(i, cells), take(i, vals), pxList); - * assert DLS(pxIterator, iterprev, end, endprev, drop(i, cells), drop(i, vals), pxList); - * open DLS(pxIterator, iterprev, end, endprev, drop(i, cells), drop(i, vals), pxList); - * open xLIST_ITEM(pxIterator, _, ?iternext, iterprev, pxList); - * if (pxIterator == endprev) - * { - * open DLS(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); - * take_take(1, i, vals); - * assert xLIST_ITEM(end, portMAX_DELAY, _, _, _); - * open xLIST_ITEM(iternext, _, _, pxIterator, _); - * } - * else - * { - * open DLS(iternext, pxIterator, end, endprev, _, _, _); - * open xLIST_ITEM(iternext, _, _, pxIterator, _); - * } - * }@*/ + if (pxIterator == end) + { + open DLS(end, endprev, end, endprev, cells, vals, pxList); + open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, pxList); + if (end != endprev) + { + assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); + open DLS(endnext, _, _, _, _, _, _); + open xLIST_ITEM(endnext, _, _, _, _); + } + } + else + { + assert DLS(end, endprev, end, endprev, cells, vals, pxList); + dls_first_mem(end, endprev, end, endprev, cells); + assert pxIterator != end; + assert index_of(end, cells) == 0; + split(end, endprev, end, endprev, cells, vals, pxIterator, i); + assert DLS(end, endprev, pxIterator, ?iterprev, take(i, cells), take(i, vals), pxList); + assert DLS(pxIterator, iterprev, end, endprev, drop(i, cells), drop(i, vals), pxList); + open DLS(pxIterator, iterprev, end, endprev, drop(i, cells), drop(i, vals), pxList); + open xLIST_ITEM(pxIterator, _, ?iternext, iterprev, pxList); + if (pxIterator == endprev) + { + open DLS(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); + take_take(1, i, vals); + assert xLIST_ITEM(end, portMAX_DELAY, _, _, _); + open xLIST_ITEM(iternext, _, _, pxIterator, _); + } + else + { + open DLS(iternext, pxIterator, end, endprev, _, _, _); + open xLIST_ITEM(iternext, _, _, pxIterator, _); + } + }@*/ } pxNewListItem->pxNext = pxIterator->pxNext; @@ -174,153 +169,152 @@ void vListInsert( List_t * const pxList, /*@close xLIST_ITEM(pxNewListItem, val, ?iternext, pxIterator, pxList);@*/ /*@close xLIST_ITEM(pxIterator, ?iterval, pxNewListItem, ?iterprev, pxList);@*/ - /*@ - * if( xValueOfInsertion == portMAX_DELAY ) - * { - * assert iternext == end; - * assert pxIterator == endprev; - * if (end == endprev) - * { - * close DLS(end, pxNewListItem, pxNewListItem, end, cells, vals, pxList); - * close DLS(pxNewListItem, end, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); - * join(end, pxNewListItem, pxNewListItem, end, cells, vals, - * pxNewListItem, end, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * else - * { - * close xLIST_ITEM(end, portMAX_DELAY, ?endnext, pxNewListItem, pxList); - * close DLS(pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); - * if (endnext == endprev) - * { - * assert xLIST_ITEM(endnext, ?endnextval, pxNewListItem, end, pxList); - * close DLS(end, pxNewListItem, endnext, end, singleton(end), singleton(portMAX_DELAY), pxList); - * close DLS(endnext, end, pxNewListItem, endnext, singleton(endnext), singleton(endnextval), pxList); - * join(end, pxNewListItem, endnext, end, singleton(end), singleton(portMAX_DELAY), - * endnext, end, pxNewListItem, endnext, singleton(endnext), singleton(endnextval)); - * assert DLS(end, pxNewListItem, pxNewListItem, endnext, cells, vals, pxList); - * } - * else - * { - * assert DLS(endnext, end, endprev, ?endprevprev, ?cells_endnext_to_endprevprev, ?vals_endnext_to_endprevprev, pxList); - * assert cells_endnext_to_endprevprev == take(index_of(endprev, tail(cells)), tail(cells)); - * assert index_of(endprev, tail(cells)) == length(tail(cells)) - 1; - * assert cells_endnext_to_endprevprev == take(length(tail(cells)) - 1, tail(cells)); - * assert xLIST_ITEM(endprev, ?endprevval, pxNewListItem, endprevprev, pxList); - * close DLS(endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); - * dls_last_mem(endnext, end, endprev, endprevprev, cells_endnext_to_endprevprev); - * dls_star_item(endnext, endprevprev, end); - * close DLS(end, pxNewListItem, endprev, endprevprev, cons(end, cells_endnext_to_endprevprev), cons(portMAX_DELAY, vals_endnext_to_endprevprev), pxList); - * join(end, pxNewListItem, endprev, endprevprev, cons(end, cells_endnext_to_endprevprev), cons(portMAX_DELAY, vals_endnext_to_endprevprev), - * endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval)); - * assert DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); - * - * } - * join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, - * pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * remove_append(pxNewListItem, cells, singleton(pxNewListItem)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * } - * else - * { - * if (pxIterator == end) - * { - * if (iternext == end) - * { - * close DLS(end, pxNewListItem, pxNewListItem, end, cells, vals, pxList); - * close DLS(pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); - * join(end, pxNewListItem, pxNewListItem, end, cells, vals, - * pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * else - * { - * close xLIST_ITEM(iternext, ?iternextval, _, pxNewListItem, pxList); - * if (iternext == endprev) - * { - * close DLS(iternext, pxNewListItem, end, endprev, singleton(iternext), singleton(iternextval), pxList); - * dls_last_mem(iternext, pxNewListItem, end, endprev, singleton(iternext)); - * } - * else - * { - * assert DLS(?iternextnext, iternext, end, endprev, ?cells_iternextnext_to_endprev, ?vals_iternextnext_to_endprev, pxList); - * close DLS(iternext, pxNewListItem, end, endprev, cons(iternext, cells_iternextnext_to_endprev), cons(iternextval, vals_iternextnext_to_endprev), pxList); - * dls_last_mem(iternext, pxNewListItem, end, endprev, cons(iternext, cells_iternextnext_to_endprev)); - * } - * close DLS(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), pxList); - * assert DLS(iternext, pxNewListItem, end, endprev, ?cells_iternext_to_endprev, ?vals_iternext_to_endprev, pxList); - * dls_star_item(iternext, endprev, pxNewListItem); - * close DLS(pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, cells_iternext_to_endprev), cons(val, vals_iternext_to_endprev), pxList); - * join(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), - * pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, cells_iternext_to_endprev), cons(val, vals_iternext_to_endprev)); - * close xLIST(pxList, len+1, idx, end, cons(end, cons(pxNewListItem, cells_iternext_to_endprev)), cons(portMAX_DELAY, cons(val, vals_iternext_to_endprev))); - * } - * } - * else - * { - * close xLIST_ITEM(iternext, ?iternextval, _, pxNewListItem, pxList); - * if (pxIterator == endprev) - * { - * if (iterprev == end) - * { - * close DLS(end, pxNewListItem, pxIterator, end, singleton(end), singleton(portMAX_DELAY), pxList); - * } - * else - * { - * assert DLS(_, iternext, pxIterator, iterprev, ?cells1, ?vals1, _); - * close DLS(end, pxNewListItem, pxIterator, iterprev, cons(end, cells1), cons(portMAX_DELAY, vals1), pxList); - * } - * int i = index_of(pxIterator, cells); - * assert DLS(end, pxNewListItem, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); - * close DLS(pxIterator, iterprev, pxNewListItem, pxIterator, drop(i, cells), drop(i, vals), pxList); - * close DLS(pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); - * join(end, pxNewListItem, pxIterator, iterprev, take(i, cells), take(i, vals), - * pxIterator, iterprev, pxNewListItem, pxIterator, drop(i, cells), drop(i, vals)); - * join(end, pxNewListItem, pxNewListItem, pxIterator, cells, vals, - * pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * remove_append(pxNewListItem, cells, singleton(pxNewListItem)); - * } - * else - * { - * int i = index_of(pxIterator, cells); - * if (iternext == endprev) - * { - * close DLS(iternext, pxNewListItem, end, endprev, singleton(iternext), singleton(iternextval), pxList); - * } - * else - * { - * assert DLS(_, iternext, end, endprev, ?cells0, ?vals0, pxList); - * dls_star_item(end, iterprev, iternext); - * close DLS(iternext, pxNewListItem, end, endprev, tail(drop(i, cells)), tail(drop(i, vals)), pxList); - * } - * drop_drop(1, i, cells); - * drop_drop(1, i, vals); - * assert DLS(iternext, pxNewListItem, end, endprev, drop(i+1, cells), drop(i+1, vals), pxList); - * assert DLS(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); - * dls_star_item(iternext, endprev, pxNewListItem); - * dls_last_mem(iternext, pxNewListItem, end, endprev, drop(i+1, cells)); - * close DLS(pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, drop(i+1, cells)), cons(val, drop(i+1, vals)), pxList); - * close DLS(pxIterator, iterprev, end, endprev, cons(pxIterator, cons(pxNewListItem, drop(i+1, cells))), cons(iterval, cons(val, drop(i+1, vals))), pxList); - * join(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), - * pxIterator, iterprev, end, endprev, cons(pxIterator, cons(pxNewListItem, drop(i+1, cells))), cons(iterval, cons(val, drop(i+1, vals)))); - * listnew_cells = append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); - * listnew_vals = append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals)))); - * head_append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); - * take_head(take(i, cells)); - * take_take(1, i, cells); - * assert( end == head(new_cells) ); - * head_append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals)))); - * take_head(take(i, vals)); - * take_take(1, i, vals); - * assert( portMAX_DELAY == head(new_vals) ); - * append_take_drop_n(cells, index_of(pxIterator, cells)); - * close xLIST(pxList, len+1, idx, end, append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))), append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals))))); - * mem_take_false(pxNewListItem, i, cells); - * remove_append(pxNewListItem, take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); - * } - * } - * }@*/ + if( xValueOfInsertion == portMAX_DELAY ) + { + assert iternext == end; + assert pxIterator == endprev; + if (end == endprev) + { + close DLS(end, pxNewListItem, pxNewListItem, end, cells, vals, pxList); + close DLS(pxNewListItem, end, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); + join(end, pxNewListItem, pxNewListItem, end, cells, vals, + pxNewListItem, end, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + else + { + close xLIST_ITEM(end, portMAX_DELAY, ?endnext, pxNewListItem, pxList); + close DLS(pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); + if (endnext == endprev) + { + assert xLIST_ITEM(endnext, ?endnextval, pxNewListItem, end, pxList); + close DLS(end, pxNewListItem, endnext, end, singleton(end), singleton(portMAX_DELAY), pxList); + close DLS(endnext, end, pxNewListItem, endnext, singleton(endnext), singleton(endnextval), pxList); + join(end, pxNewListItem, endnext, end, singleton(end), singleton(portMAX_DELAY), + endnext, end, pxNewListItem, endnext, singleton(endnext), singleton(endnextval)); + assert DLS(end, pxNewListItem, pxNewListItem, endnext, cells, vals, pxList); + } + else + { + assert DLS(endnext, end, endprev, ?endprevprev, ?cells_endnext_to_endprevprev, ?vals_endnext_to_endprevprev, pxList); + assert cells_endnext_to_endprevprev == take(index_of(endprev, tail(cells)), tail(cells)); + assert index_of(endprev, tail(cells)) == length(tail(cells)) - 1; + assert cells_endnext_to_endprevprev == take(length(tail(cells)) - 1, tail(cells)); + assert xLIST_ITEM(endprev, ?endprevval, pxNewListItem, endprevprev, pxList); + close DLS(endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); + dls_last_mem(endnext, end, endprev, endprevprev, cells_endnext_to_endprevprev); + dls_star_item(endnext, endprevprev, end); + close DLS(end, pxNewListItem, endprev, endprevprev, cons(end, cells_endnext_to_endprevprev), cons(portMAX_DELAY, vals_endnext_to_endprevprev), pxList); + join(end, pxNewListItem, endprev, endprevprev, cons(end, cells_endnext_to_endprevprev), cons(portMAX_DELAY, vals_endnext_to_endprevprev), + endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval)); + assert DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); + + } + join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, + pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + remove_append(pxNewListItem, cells, singleton(pxNewListItem)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + } + else + { + if (pxIterator == end) + { + if (iternext == end) + { + close DLS(end, pxNewListItem, pxNewListItem, end, cells, vals, pxList); + close DLS(pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); + join(end, pxNewListItem, pxNewListItem, end, cells, vals, + pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + else + { + close xLIST_ITEM(iternext, ?iternextval, _, pxNewListItem, pxList); + if (iternext == endprev) + { + close DLS(iternext, pxNewListItem, end, endprev, singleton(iternext), singleton(iternextval), pxList); + dls_last_mem(iternext, pxNewListItem, end, endprev, singleton(iternext)); + } + else + { + assert DLS(?iternextnext, iternext, end, endprev, ?cells_iternextnext_to_endprev, ?vals_iternextnext_to_endprev, pxList); + close DLS(iternext, pxNewListItem, end, endprev, cons(iternext, cells_iternextnext_to_endprev), cons(iternextval, vals_iternextnext_to_endprev), pxList); + dls_last_mem(iternext, pxNewListItem, end, endprev, cons(iternext, cells_iternextnext_to_endprev)); + } + close DLS(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), pxList); + assert DLS(iternext, pxNewListItem, end, endprev, ?cells_iternext_to_endprev, ?vals_iternext_to_endprev, pxList); + dls_star_item(iternext, endprev, pxNewListItem); + close DLS(pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, cells_iternext_to_endprev), cons(val, vals_iternext_to_endprev), pxList); + join(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), + pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, cells_iternext_to_endprev), cons(val, vals_iternext_to_endprev)); + close xLIST(pxList, len+1, idx, end, cons(end, cons(pxNewListItem, cells_iternext_to_endprev)), cons(portMAX_DELAY, cons(val, vals_iternext_to_endprev))); + } + } + else + { + close xLIST_ITEM(iternext, ?iternextval, _, pxNewListItem, pxList); + if (pxIterator == endprev) + { + if (iterprev == end) + { + close DLS(end, pxNewListItem, pxIterator, end, singleton(end), singleton(portMAX_DELAY), pxList); + } + else + { + assert DLS(_, iternext, pxIterator, iterprev, ?cells1, ?vals1, _); + close DLS(end, pxNewListItem, pxIterator, iterprev, cons(end, cells1), cons(portMAX_DELAY, vals1), pxList); + } + int i = index_of(pxIterator, cells); + assert DLS(end, pxNewListItem, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); + close DLS(pxIterator, iterprev, pxNewListItem, pxIterator, drop(i, cells), drop(i, vals), pxList); + close DLS(pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); + join(end, pxNewListItem, pxIterator, iterprev, take(i, cells), take(i, vals), + pxIterator, iterprev, pxNewListItem, pxIterator, drop(i, cells), drop(i, vals)); + join(end, pxNewListItem, pxNewListItem, pxIterator, cells, vals, + pxNewListItem, pxIterator, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + remove_append(pxNewListItem, cells, singleton(pxNewListItem)); + } + else + { + int i = index_of(pxIterator, cells); + if (iternext == endprev) + { + close DLS(iternext, pxNewListItem, end, endprev, singleton(iternext), singleton(iternextval), pxList); + } + else + { + assert DLS(_, iternext, end, endprev, ?cells0, ?vals0, pxList); + dls_star_item(end, iterprev, iternext); + close DLS(iternext, pxNewListItem, end, endprev, tail(drop(i, cells)), tail(drop(i, vals)), pxList); + } + drop_drop(1, i, cells); + drop_drop(1, i, vals); + assert DLS(iternext, pxNewListItem, end, endprev, drop(i+1, cells), drop(i+1, vals), pxList); + assert DLS(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), pxList); + dls_star_item(iternext, endprev, pxNewListItem); + dls_last_mem(iternext, pxNewListItem, end, endprev, drop(i+1, cells)); + close DLS(pxNewListItem, pxIterator, end, endprev, cons(pxNewListItem, drop(i+1, cells)), cons(val, drop(i+1, vals)), pxList); + close DLS(pxIterator, iterprev, end, endprev, cons(pxIterator, cons(pxNewListItem, drop(i+1, cells))), cons(iterval, cons(val, drop(i+1, vals))), pxList); + join(end, endprev, pxIterator, iterprev, take(i, cells), take(i, vals), + pxIterator, iterprev, end, endprev, cons(pxIterator, cons(pxNewListItem, drop(i+1, cells))), cons(iterval, cons(val, drop(i+1, vals)))); + listnew_cells = append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); + listnew_vals = append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals)))); + head_append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); + take_head(take(i, cells)); + take_take(1, i, cells); + assert( end == head(new_cells) ); + head_append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals)))); + take_head(take(i, vals)); + take_take(1, i, vals); + assert( portMAX_DELAY == head(new_vals) ); + append_take_drop_n(cells, index_of(pxIterator, cells)); + close xLIST(pxList, len+1, idx, end, append(take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))), append(take(i, vals), cons(iterval, cons(val, drop(i+1, vals))))); + mem_take_false(pxNewListItem, i, cells); + remove_append(pxNewListItem, take(i, cells), cons(pxIterator, cons(pxNewListItem, drop(i+1, cells)))); + } + } + }@*/ } diff --git a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c index 77e74bea24..e7d327f3a6 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c @@ -28,93 +28,90 @@ void vListInsertEnd( List_t * const pxList, ListItem_t * const pxNewListItem ) - /*@requires xLIST(pxList, ?len, ?idx, ?end, ?cells, ?vals) &*& - * xLIST_ITEM(pxNewListItem, ?val, _, _, _);@*/ - + xLIST_ITEM(pxNewListItem, ?val, _, _, _);@*/ /*@ensures xLIST(pxList, len+1, idx, end, ?new_cells, ?new_vals) &*& - * idx == end - * ? (new_cells == append(cells, singleton(pxNewListItem)) &*& - * new_vals == append(vals, singleton(val))) - * : (new_cells == append(take(index_of(idx, cells), cells), append(singleton(pxNewListItem), drop(index_of(idx, cells), cells))) &*& - * new_vals == append(take(index_of(idx, cells), vals), append(singleton(val), drop(index_of(idx, cells), vals))));@*/ + idx == end + ? (new_cells == append(cells, singleton(pxNewListItem)) &*& + new_vals == append(vals, singleton(val))) + : (new_cells == append(take(index_of(idx, cells), cells), append(singleton(pxNewListItem), drop(index_of(idx, cells), cells))) &*& + new_vals == append(take(index_of(idx, cells), vals), append(singleton(val), drop(index_of(idx, cells), vals))));@*/ { /*@xLIST_star_item(pxList, pxNewListItem);@*/ /*@assert mem(pxNewListItem, cells) == false;@*/ /*@open xLIST(pxList, len, idx, end, cells, vals);@*/ - #ifdef VERIFAST /*< const pointer declaration */ - ListItem_t * pxIndex = pxList->pxIndex; - #else - ListItem_t * const pxIndex = pxList->pxIndex; - - /* Only effective when configASSERT() is also defined, these tests may catch - * the list data structures being overwritten in memory. They will not catch - * data errors caused by incorrect configuration or use of FreeRTOS. */ - listTEST_LIST_INTEGRITY( pxList ); - listTEST_LIST_ITEM_INTEGRITY( pxNewListItem ); - #endif +#ifdef VERIFAST /*< const pointer declaration */ + ListItem_t * pxIndex = pxList->pxIndex; +#else + ListItem_t * const pxIndex = pxList->pxIndex; + + /* Only effective when configASSERT() is also defined, these tests may catch + * the list data structures being overwritten in memory. They will not catch + * data errors caused by incorrect configuration or use of FreeRTOS. */ + listTEST_LIST_INTEGRITY( pxList ); + listTEST_LIST_ITEM_INTEGRITY( pxNewListItem ); +#endif /*@open xLIST_ITEM(pxNewListItem, _, _, _, _);@*/ /*@assert DLS(end, ?endprev, end, _, cells, vals, pxList);@*/ /*@dls_first_mem(end, endprev, end, endprev, cells);@*/ /*@dls_last_mem(end, endprev, end, endprev, cells);@*/ - /*@ - * if (end == idx) - * { - * open DLS(end, endprev, end, endprev, cells, vals, pxList); - * open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, pxList); - * if (end == endprev) - * { - * // Case A (singleton): idx==end==endprev - * } - * else - * { - * assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); - * if (endnext == endprev) - * { - * // Case B (two): idx==end and endnext==endprev - * open DLS(endnext, end, end, endnext, _, _, _); - * open xLIST_ITEM(endnext, _, _, _, _); - * } - * else - * { - * // Case C: idx==end and DLS:endnext...endprev - * split(endnext, end, end, endprev, tail(cells), tail(vals), endprev, index_of(endprev, tail(cells))); - * open DLS(endprev, _, _, _, _, _, _); - * open xLIST_ITEM(endprev, _, _, _, _); - * } - * } - * } - * else - * { - * int i = index_of(idx, cells); - * split(end, endprev, end, endprev, cells, vals, idx, i); - * assert DLS(end, endprev, idx, ?idxprev, take(i, cells), take(i, vals), pxList); - * assert DLS(idx, idxprev, end, endprev, drop(i, cells), drop(i, vals), pxList); - * open DLS(idx, idxprev, end, endprev, _, _, _); - * open xLIST_ITEM(idx, _, _, _, _); - * if (end == idxprev) - * { - * // Case D: end==idxprev and DLS:idx...endprev - * take_take(1, i, vals); - * take_head(vals); - * open DLS(end, endprev, idx, idxprev, take(i, cells), take(i, vals), pxList); - * open xLIST_ITEM(end, portMAX_DELAY, _, _, _); - * assert length(take(i, cells)) == 1; - * } - * else - * { - * // Case E: DLS:end...idxprev and DLS:idx...endprev - * dls_last_mem(end, endprev, idx, idxprev, take(i, cells)); - * split(end, endprev, idx, idxprev, take(i, cells), take(i, vals), idxprev, index_of(idxprev, take(i, cells))); - * open DLS(idxprev, _, _, idxprev, _, _, _); - * length_take(i, cells); - * drop_take_singleton(i, vals); - * open xLIST_ITEM(idxprev, nth(i-1, vals), _, _, _); - * } - * } - * @*/ + if (end == idx) + { + open DLS(end, endprev, end, endprev, cells, vals, pxList); + open xLIST_ITEM(end, portMAX_DELAY, ?endnext, endprev, pxList); + if (end == endprev) + { + // Case A (singleton): idx==end==endprev + } + else + { + assert DLS(endnext, end, end, endprev, tail(cells), tail(vals), pxList); + if (endnext == endprev) + { + // Case B (two): idx==end and endnext==endprev + open DLS(endnext, end, end, endnext, _, _, _); + open xLIST_ITEM(endnext, _, _, _, _); + } + else + { + // Case C: idx==end and DLS:endnext...endprev + split(endnext, end, end, endprev, tail(cells), tail(vals), endprev, index_of(endprev, tail(cells))); + open DLS(endprev, _, _, _, _, _, _); + open xLIST_ITEM(endprev, _, _, _, _); + } + } + } + else + { + int i = index_of(idx, cells); + split(end, endprev, end, endprev, cells, vals, idx, i); + assert DLS(end, endprev, idx, ?idxprev, take(i, cells), take(i, vals), pxList); + assert DLS(idx, idxprev, end, endprev, drop(i, cells), drop(i, vals), pxList); + open DLS(idx, idxprev, end, endprev, _, _, _); + open xLIST_ITEM(idx, _, _, _, _); + if (end == idxprev) + { + // Case D: end==idxprev and DLS:idx...endprev + take_take(1, i, vals); + take_head(vals); + open DLS(end, endprev, idx, idxprev, take(i, cells), take(i, vals), pxList); + open xLIST_ITEM(end, portMAX_DELAY, _, _, _); + assert length(take(i, cells)) == 1; + } + else + { + // Case E: DLS:end...idxprev and DLS:idx...endprev + dls_last_mem(end, endprev, idx, idxprev, take(i, cells)); + split(end, endprev, idx, idxprev, take(i, cells), take(i, vals), idxprev, index_of(idxprev, take(i, cells))); + open DLS(idxprev, _, _, idxprev, _, _, _); + length_take(i, cells); + drop_take_singleton(i, vals); + open xLIST_ITEM(idxprev, nth(i-1, vals), _, _, _); + } + } + @*/ /* Insert a new list item into pxList, but rather than sort the list, * makes the new list item the last item to be removed by a call to @@ -134,111 +131,108 @@ void vListInsertEnd( List_t * const pxList, ( pxList->uxNumberOfItems )++; /*@ - * if (end == idx) - * { - * close xLIST_ITEM(pxNewListItem, val, end, endprev, pxList); - * close DLS(pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); - * close xLIST_ITEM(end, portMAX_DELAY, ?endnext, pxNewListItem, pxList); - * if (end == endprev) - * { - * // Case A (singleton): idx==end==endprev - * close DLS(end, pxNewListItem, endnext, end, cells, vals, pxList); - * join(end, pxNewListItem, endnext, end, cells, vals, - * pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * else - * { - * close xLIST_ITEM(endprev, ?endprevval, pxNewListItem, ?endprevprev, _); - * if (endnext == endprev) - * { - * // Case B (two): idx==end and endnext==endprev - * close DLS(endprev, end, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); - * close DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); - * join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, - * pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * else - * { - * // Case C: idx==end and DLS:endnext...endprev - * close DLS(endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); - * assert DLS(endnext, end, endprev, endprevprev, ?cells_endnext_to_endprevprev, ?vals_endnext_to_endprevprev, pxList); - * join(endnext, end, endprev, endprevprev, cells_endnext_to_endprevprev, vals_endnext_to_endprevprev, - * endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval)); - * close DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); - * join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, - * pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); - * close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); - * } - * } - * } - * else - * { - * // Case D: end==idxprev and DLS:idx...endprev - * // Case E: DLS:end...idxprev and DLS:idx...endprev - * int i = index_of(idx, cells); - * close xLIST_ITEM(pxNewListItem, val, idx, ?idxprev, pxList); - * close xLIST_ITEM(idx, ?idxval, ?idxnext, pxNewListItem, pxList); - * nth_drop2(vals, i); - * assert idxval == nth(i, vals); - * close xLIST_ITEM(idxprev, ?idxprevval, pxNewListItem, ?idxprevprev, pxList); - * - * if (end == idxprev) - * { - * close DLS(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), pxList); - * } - * else - * { - * length_take(i, cells); - * take_take(i-1, i, vals); - * take_singleton(i-1, vals); - * take_singleton(i, vals); - * assert DLS(end, endprev, idxprev, idxprevprev, ?cells_end_to_idxprevprev, take(i-1, vals), pxList); - * close DLS(idxprev, idxprevprev, pxNewListItem, idxprev, singleton(idxprev), singleton(idxprevval), pxList); - * join(end, endprev, idxprev, idxprevprev, cells_end_to_idxprevprev, take(i-1, vals), - * idxprev, idxprevprev, pxNewListItem, idxprev, singleton(idxprev), singleton(idxprevval)); - * } - * - * if (idx == endprev) - * { - * close DLS(idx, pxNewListItem, end, idx, singleton(idx), singleton(idxval), pxList); - * } - * else - * { - * assert DLS(end, endprev, pxNewListItem, idxprev, ?cells_end_to_idxprev, ?vals_end_to_idxprev, pxList); - * close DLS(idx, pxNewListItem, end, endprev, drop(i, cells), drop(i, vals), pxList); - * } - * - * assert DLS(end, endprev, pxNewListItem, idxprev, take(i, cells), take(i, vals), pxList); - * assert DLS(idx, pxNewListItem, end, endprev, drop(i, cells), drop(i, vals), pxList); - * assert xLIST_ITEM(pxNewListItem, val, idx, idxprev, pxList); - * dls_star_item(idx, endprev, pxNewListItem); - * close DLS(pxNewListItem, idxprev, end, endprev, cons(pxNewListItem, drop(i, cells)), cons(val, drop(i, vals)), pxList); - * join(end, endprev, pxNewListItem, idxprev, take(i, cells), take(i, vals), - * pxNewListItem, idxprev, end, endprev, cons(pxNewListItem, drop(i, cells)), cons(val, drop(i, vals))); - * assert DLS(end, endprev, end, endprev, ?cells_new, ?vals_new, pxList); - * assert cells_new == append(take(i, cells), append(singleton(pxNewListItem), drop(i, cells))); - * assert vals_new == append(take(i, vals) , append(singleton(val), drop(i, vals))); - * head_append(take(i, cells), append(singleton(pxNewListItem), drop(i, cells))); - * take_take(1, i, cells); - * head_append(take(i, vals), append(singleton(val), drop(i, vals))); - * take_take(1, i, vals); - * close xLIST(pxList, len+1, idx, end, cells_new, vals_new); - * } - * @*/ + if (end == idx) + { + close xLIST_ITEM(pxNewListItem, val, end, endprev, pxList); + close DLS(pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val), pxList); + close xLIST_ITEM(end, portMAX_DELAY, ?endnext, pxNewListItem, pxList); + if (end == endprev) + { + // Case A (singleton): idx==end==endprev + close DLS(end, pxNewListItem, endnext, end, cells, vals, pxList); + join(end, pxNewListItem, endnext, end, cells, vals, + pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + else + { + close xLIST_ITEM(endprev, ?endprevval, pxNewListItem, ?endprevprev, _); + if (endnext == endprev) + { + // Case B (two): idx==end and endnext==endprev + close DLS(endprev, end, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); + close DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); + join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, + pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + else + { + // Case C: idx==end and DLS:endnext...endprev + close DLS(endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval), pxList); + assert DLS(endnext, end, endprev, endprevprev, ?cells_endnext_to_endprevprev, ?vals_endnext_to_endprevprev, pxList); + join(endnext, end, endprev, endprevprev, cells_endnext_to_endprevprev, vals_endnext_to_endprevprev, + endprev, endprevprev, pxNewListItem, endprev, singleton(endprev), singleton(endprevval)); + close DLS(end, pxNewListItem, pxNewListItem, endprev, cells, vals, pxList); + join(end, pxNewListItem, pxNewListItem, endprev, cells, vals, + pxNewListItem, endprev, end, pxNewListItem, singleton(pxNewListItem), singleton(val)); + close xLIST(pxList, len+1, idx, end, append(cells, singleton(pxNewListItem)), append(vals, singleton(val))); + } + } + } + else + { + // Case D: end==idxprev and DLS:idx...endprev + // Case E: DLS:end...idxprev and DLS:idx...endprev + int i = index_of(idx, cells); + close xLIST_ITEM(pxNewListItem, val, idx, ?idxprev, pxList); + close xLIST_ITEM(idx, ?idxval, ?idxnext, pxNewListItem, pxList); + nth_drop2(vals, i); + assert idxval == nth(i, vals); + close xLIST_ITEM(idxprev, ?idxprevval, pxNewListItem, ?idxprevprev, pxList); + + if (end == idxprev) + { + close DLS(end, endprev, pxNewListItem, end, singleton(end), singleton(portMAX_DELAY), pxList); + } + else + { + length_take(i, cells); + take_take(i-1, i, vals); + take_singleton(i-1, vals); + take_singleton(i, vals); + assert DLS(end, endprev, idxprev, idxprevprev, ?cells_end_to_idxprevprev, take(i-1, vals), pxList); + close DLS(idxprev, idxprevprev, pxNewListItem, idxprev, singleton(idxprev), singleton(idxprevval), pxList); + join(end, endprev, idxprev, idxprevprev, cells_end_to_idxprevprev, take(i-1, vals), + idxprev, idxprevprev, pxNewListItem, idxprev, singleton(idxprev), singleton(idxprevval)); + } + + if (idx == endprev) + { + close DLS(idx, pxNewListItem, end, idx, singleton(idx), singleton(idxval), pxList); + } + else + { + assert DLS(end, endprev, pxNewListItem, idxprev, ?cells_end_to_idxprev, ?vals_end_to_idxprev, pxList); + close DLS(idx, pxNewListItem, end, endprev, drop(i, cells), drop(i, vals), pxList); + } + + assert DLS(end, endprev, pxNewListItem, idxprev, take(i, cells), take(i, vals), pxList); + assert DLS(idx, pxNewListItem, end, endprev, drop(i, cells), drop(i, vals), pxList); + assert xLIST_ITEM(pxNewListItem, val, idx, idxprev, pxList); + dls_star_item(idx, endprev, pxNewListItem); + close DLS(pxNewListItem, idxprev, end, endprev, cons(pxNewListItem, drop(i, cells)), cons(val, drop(i, vals)), pxList); + join(end, endprev, pxNewListItem, idxprev, take(i, cells), take(i, vals), + pxNewListItem, idxprev, end, endprev, cons(pxNewListItem, drop(i, cells)), cons(val, drop(i, vals))); + assert DLS(end, endprev, end, endprev, ?cells_new, ?vals_new, pxList); + assert cells_new == append(take(i, cells), append(singleton(pxNewListItem), drop(i, cells))); + assert vals_new == append(take(i, vals) , append(singleton(val), drop(i, vals))); + head_append(take(i, cells), append(singleton(pxNewListItem), drop(i, cells))); + take_take(1, i, cells); + head_append(take(i, vals), append(singleton(val), drop(i, vals))); + take_take(1, i, vals); + close xLIST(pxList, len+1, idx, end, cells_new, vals_new); + } + @*/ } -void client_example1( List_t * const l, - ListItem_t * const pxNewListItem ) - +void client_example1( List_t * const l, ListItem_t * const pxNewListItem ) /*@requires - * xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& - * xLIST_ITEM(pxNewListItem, ?val, _, _, _) &*& - * idx == end;@*/ - + xLIST(l, ?len, ?idx, ?end, ?cells, ?vals) &*& + xLIST_ITEM(pxNewListItem, ?val, _, _, _) &*& + idx == end;@*/ /*@ensures - * xLIST(l, len + 1, idx, end, _, append(vals, singleton(val)));@*/ + xLIST(l, len + 1, idx, end, _, append(vals, singleton(val)));@*/ { - vListInsertEnd( l, pxNewListItem ); + vListInsertEnd(l, pxNewListItem); } diff --git a/FreeRTOS/Test/VeriFast/queue/create.c b/FreeRTOS/Test/VeriFast/queue/create.c index 38e3274c73..ab82249cfe 100644 --- a/FreeRTOS/Test/VeriFast/queue/create.c +++ b/FreeRTOS/Test/VeriFast/queue/create.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -37,37 +37,35 @@ /* The following intermediate queue predicates summarise states used by queue * initialization but not used elsewhere so we confine them to these proofs * locally. */ - /*@ - * predicate queue_init1(QueueHandle_t q;) = - * QUEUE_SHAPE(q, _, _, _, _) &*& - * queuelists(q) - * ; - * - * predicate queue_init2(QueueHandle_t q, int8_t *Storage, size_t N, size_t M;) = - * QUEUE_SHAPE(q, Storage, N, M, _) &*& - * queuelists(q) &*& - * 0 < N &*& - * chars(Storage, (N*M), _) &*& - * malloc_block(Storage, N*M) &*& - * Storage + N * M <= (int8_t *)UINTPTR_MAX &*& - * true - * ; - * @*/ +predicate queue_init1(QueueHandle_t q;) = + QUEUE_SHAPE(q, _, _, _, _) &*& + queuelists(q) + ; + +predicate queue_init2(QueueHandle_t q, int8_t *Storage, size_t N, size_t M;) = + QUEUE_SHAPE(q, Storage, N, M, _) &*& + queuelists(q) &*& + 0 < N &*& + chars(Storage, (N*M), _) &*& + malloc_block(Storage, N*M) &*& + Storage + N * M <= (int8_t *)UINTPTR_MAX &*& + true + ; +@*/ BaseType_t xQueueGenericReset( QueueHandle_t xQueue, BaseType_t xNewQueue ) /*@requires queue_init2(xQueue, ?Storage, ?N, ?M);@*/ - /*@ensures 0 == M - * ? freertos_mutex(xQueue, Storage, N, 0) - * : queue(xQueue, Storage, N, M, 0, (N-1), 0, false, nil) &*& queuelists(xQueue);@*/ + ? freertos_mutex(xQueue, Storage, N, 0) + : queue(xQueue, Storage, N, M, 0, (N-1), 0, false, nil) &*& queuelists(xQueue);@*/ { - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); @@ -127,20 +125,18 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, Queue_t * pxNewQueue ) /*@requires queue_init1(pxNewQueue) &*& - * 0 < uxQueueLength &*& 0 < uxItemSize &*& - * malloc_block(pucQueueStorage, uxQueueLength * uxItemSize) &*& - * pucQueueStorage + uxQueueLength * uxItemSize <= (uint8_t *)UINTPTR_MAX &*& - * uchars(pucQueueStorage, uxQueueLength * uxItemSize,_);@*/ - + 0 < uxQueueLength &*& 0 < uxItemSize &*& + malloc_block(pucQueueStorage, uxQueueLength * uxItemSize) &*& + pucQueueStorage + uxQueueLength * uxItemSize <= (uint8_t *)UINTPTR_MAX &*& + uchars(pucQueueStorage, uxQueueLength * uxItemSize,_);@*/ /*@ensures queue(pxNewQueue, ((int8_t *)(void *)pucQueueStorage), uxQueueLength, uxItemSize, 0, (uxQueueLength-1), 0, false, nil) &*& - * queuelists(pxNewQueue);@*/ + queuelists(pxNewQueue);@*/ { - #ifndef VERIFAST /*< void cast of unused var */ - - /* Remove compiler warnings about unused parameters should - * configUSE_TRACE_FACILITY not be set to 1. */ - ( void ) ucQueueType; - #endif +#ifndef VERIFAST /*< void cast of unused var */ + /* Remove compiler warnings about unused parameters should + * configUSE_TRACE_FACILITY not be set to 1. */ + ( void ) ucQueueType; +#endif if( uxItemSize == ( UBaseType_t ) 0 ) { @@ -148,20 +144,20 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, * be set to NULL because NULL is used as a key to say the queue is used as * a mutex. Therefore just set pcHead to point to the queue as a benign * value that is known to be within the memory map. */ - #ifdef VERIFAST /*< stricter casting */ - pxNewQueue->pcHead = ( int8_t * ) ( void * ) pxNewQueue; - #else - pxNewQueue->pcHead = ( int8_t * ) pxNewQueue; - #endif +#ifdef VERIFAST /*< stricter casting */ + pxNewQueue->pcHead = ( int8_t * ) ( void * ) pxNewQueue; +#else + pxNewQueue->pcHead = ( int8_t * ) pxNewQueue; +#endif } else { /* Set the head to the start of the queue storage area. */ - #ifdef VERIFAST /*< stricter casting */ - pxNewQueue->pcHead = ( int8_t * ) ( void * ) pucQueueStorage; - #else - pxNewQueue->pcHead = ( int8_t * ) pucQueueStorage; - #endif +#ifdef VERIFAST /*< stricter casting */ + pxNewQueue->pcHead = ( int8_t * ) ( void * ) pucQueueStorage; +#else + pxNewQueue->pcHead = ( int8_t * ) pucQueueStorage; +#endif } /* Initialise the queue members as described where the queue type is @@ -169,66 +165,63 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, pxNewQueue->uxLength = uxQueueLength; pxNewQueue->uxItemSize = uxItemSize; /*@close queue_init2(pxNewQueue, _, uxQueueLength, uxItemSize);@*/ - #ifdef VERIFAST /*< void cast of unused return value */ - xQueueGenericReset( pxNewQueue, pdTRUE ); - #else - ( void ) xQueueGenericReset( pxNewQueue, pdTRUE ); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + xQueueGenericReset( pxNewQueue, pdTRUE ); +#else + ( void ) xQueueGenericReset( pxNewQueue, pdTRUE ); +#endif #if ( configUSE_TRACE_FACILITY == 1 ) - { - pxNewQueue->ucQueueType = ucQueueType; - } + { + pxNewQueue->ucQueueType = ucQueueType; + } #endif /* configUSE_TRACE_FACILITY */ #if ( configUSE_QUEUE_SETS == 1 ) - { - pxNewQueue->pxQueueSetContainer = NULL; - } + { + pxNewQueue->pxQueueSetContainer = NULL; + } #endif /* configUSE_QUEUE_SETS */ traceQUEUE_CREATE( pxNewQueue ); } -QueueHandle_t xQueueGenericCreate( const UBaseType_t uxQueueLength, - const UBaseType_t uxItemSize, - const uint8_t ucQueueType ) - -/*@requires 0 < uxQueueLength &*& - * 0 < uxItemSize &*& - * 0 < uxQueueLength * uxItemSize &*& - * uxQueueLength * uxItemSize <= UINT_MAX;@*/ - -/*@ensures result == NULL - * ? true - * : queue(result, _, uxQueueLength, uxItemSize, 0, (uxQueueLength-1), 0, false, nil) &*& - * queuelists(result) &*& - * result->irqMask |-> _ &*& - * result->schedulerSuspend |-> _ &*& - * result->locked |-> _;@*/ -{ - Queue_t * pxNewQueue; - size_t xQueueSizeInBytes; - uint8_t * pucQueueStorage; + QueueHandle_t xQueueGenericCreate( const UBaseType_t uxQueueLength, + const UBaseType_t uxItemSize, + const uint8_t ucQueueType ) + /*@requires 0 < uxQueueLength &*& + 0 < uxItemSize &*& + 0 < uxQueueLength * uxItemSize &*& + uxQueueLength * uxItemSize <= UINT_MAX;@*/ + /*@ensures result == NULL + ? true + : queue(result, _, uxQueueLength, uxItemSize, 0, (uxQueueLength-1), 0, false, nil) &*& + queuelists(result) &*& + result->irqMask |-> _ &*& + result->schedulerSuspend |-> _ &*& + result->locked |-> _;@*/ + { + Queue_t * pxNewQueue; + size_t xQueueSizeInBytes; + uint8_t * pucQueueStorage; - configASSERT( uxQueueLength > ( UBaseType_t ) 0 ); + configASSERT( uxQueueLength > ( UBaseType_t ) 0 ); - /* Allocate enough space to hold the maximum number of items that - * can be in the queue at any time. It is valid for uxItemSize to be - * zero in the case the queue is used as a semaphore. */ - xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */ + /* Allocate enough space to hold the maximum number of items that + * can be in the queue at any time. It is valid for uxItemSize to be + * zero in the case the queue is used as a semaphore. */ + xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */ - /* Check for multiplication overflow. */ - configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) ); + /* Check for multiplication overflow. */ + configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) ); - /* Check for addition overflow. */ - configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) > xQueueSizeInBytes ); + /* Check for addition overflow. */ + configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) > xQueueSizeInBytes ); - #ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ +#ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) ); - #else - +#else /* Allocate the queue and storage area. Justification for MISRA * deviation as follows: pvPortMalloc() always ensures returned memory * blocks are aligned per the requirements of the MCU stack. In this case @@ -239,11 +232,11 @@ QueueHandle_t xQueueGenericCreate( const UBaseType_t uxQueueLength, * is safe. In other cases alignment requirements are not strict (one or * two bytes). */ pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) + xQueueSizeInBytes ); /*lint !e9087 !e9079 see comment above. */ - #endif +#endif - if( pxNewQueue != NULL ) - { - #ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ + if( pxNewQueue != NULL ) + { +#ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ pucQueueStorage = ( uint8_t * ) pvPortMalloc( xQueueSizeInBytes ); if( pucQueueStorage == NULL ) @@ -253,30 +246,29 @@ QueueHandle_t xQueueGenericCreate( const UBaseType_t uxQueueLength, } /*@malloc_block_limits(pucQueueStorage);@*/ - #else - +#else /* Jump past the queue structure to find the location of the queue * storage area. */ pucQueueStorage = ( uint8_t * ) pxNewQueue; pucQueueStorage += sizeof( Queue_t ); /*lint !e9016 Pointer arithmetic allowed on char types, especially when it assists conveying intent. */ - #endif /* ifdef VERIFAST */ +#endif - #if ( configSUPPORT_STATIC_ALLOCATION == 1 ) + #if ( configSUPPORT_STATIC_ALLOCATION == 1 ) + { + /* Queues can be created either statically or dynamically, so + * note this task was created dynamically in case it is later + * deleted. */ + pxNewQueue->ucStaticallyAllocated = pdFALSE; + } + #endif /* configSUPPORT_STATIC_ALLOCATION */ + + prvInitialiseNewQueue( uxQueueLength, uxItemSize, pucQueueStorage, ucQueueType, pxNewQueue ); + } + else { - /* Queues can be created either statically or dynamically, so - * note this task was created dynamically in case it is later - * deleted. */ - pxNewQueue->ucStaticallyAllocated = pdFALSE; + traceQUEUE_CREATE_FAILED( ucQueueType ); + mtCOVERAGE_TEST_MARKER(); } - #endif /* configSUPPORT_STATIC_ALLOCATION */ - prvInitialiseNewQueue( uxQueueLength, uxItemSize, pucQueueStorage, ucQueueType, pxNewQueue ); + return pxNewQueue; } - else - { - traceQUEUE_CREATE_FAILED( ucQueueType ); - mtCOVERAGE_TEST_MARKER(); - } - - return pxNewQueue; -} diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c index b373bd0a74..ce24654e37 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c @@ -29,9 +29,8 @@ static void prvCopyDataFromQueue( Queue_t * const pxQueue, void * const pvBuffer ) /*@requires queue(pxQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& 0 < K &*& chars(pvBuffer, M, _);@*/ - /*@ensures queue_after_prvCopyDataFromQueue(pxQueue, Storage, N, M, W, (R+1)%N, K, is_locked, abs) &*& - * chars(pvBuffer, M, head(abs));@*/ + chars(pvBuffer, M, head(abs));@*/ { if( pxQueue->uxItemSize != ( UBaseType_t ) 0 ) { @@ -47,48 +46,44 @@ static void prvCopyDataFromQueue( Queue_t * const pxQueue, else { /*@{ - * div_lt(R+1, N, M); // now we know R+1 < N - * mod_lt(R+1, N); // so, R+1 == (R+1)%N - * note(pxQueue->u.xQueue.pcReadFrom == Storage + ((R + 1) * M)); - * note( Storage + ((R + 1) * M) == Storage + (((R + 1) % N) * M)); - * }@*/ + div_lt(R+1, N, M); // now we know R+1 < N + mod_lt(R+1, N); // so, R+1 == (R+1)%N + note(pxQueue->u.xQueue.pcReadFrom == Storage + ((R + 1) * M)); + note( Storage + ((R + 1) * M) == Storage + (((R + 1) % N) * M)); + }@*/ mtCOVERAGE_TEST_MARKER(); } /*@mod_plus(R+1, K, N);@*/ /*@mod_mod(R+1, N);@*/ /*@split_element(Storage, N, M, (R+1)%N);@*/ - /*@assert - * buffer(Storage, (R+1)%N, M, ?prefix) &*& - * chars(Storage + ((R+1)%N) * M, M, ?element) &*& - * buffer(Storage + ((R+1)%N + 1) * M, (N-1-(R+1)%N), M, ?suffix);@*/ - #ifdef VERIFAST /*< void cast of unused return value */ - memcpy( ( void * ) pvBuffer, ( void * ) pxQueue->u.xQueue.pcReadFrom, ( size_t ) pxQueue->uxItemSize ); - #else - ( void ) memcpy( ( void * ) pvBuffer, ( void * ) pxQueue->u.xQueue.pcReadFrom, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e418 !e9087 MISRA exception as the casts are only redundant for some ports. Also previous logic ensures a null pointer can only be passed to memcpy() when the count is 0. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. */ - #endif - + buffer(Storage, (R+1)%N, M, ?prefix) &*& + chars(Storage + ((R+1)%N) * M, M, ?element) &*& + buffer(Storage + ((R+1)%N + 1) * M, (N-1-(R+1)%N), M, ?suffix);@*/ +#ifdef VERIFAST /*< void cast of unused return value */ + memcpy( ( void * ) pvBuffer, ( void * ) pxQueue->u.xQueue.pcReadFrom, ( size_t ) pxQueue->uxItemSize ); +#else + ( void ) memcpy( ( void * ) pvBuffer, ( void * ) pxQueue->u.xQueue.pcReadFrom, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e418 !e9087 MISRA exception as the casts are only redundant for some ports. Also previous logic ensures a null pointer can only be passed to memcpy() when the count is 0. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. */ +#endif /*@{ - * combine_list_no_change(prefix, element, suffix, (R+1)%N, contents); - * join_element(Storage, N, M, (R+1)%N); - * length_take(K, contents); - * take_length_eq(K, rotate_left((R+1)%N, contents), abs); - * deq_value_lemma(K, (R+1)%N, contents, abs); - * }@*/ + combine_list_no_change(prefix, element, suffix, (R+1)%N, contents); + join_element(Storage, N, M, (R+1)%N); + length_take(K, contents); + take_length_eq(K, rotate_left((R+1)%N, contents), abs); + deq_value_lemma(K, (R+1)%N, contents, abs); + }@*/ } } void caller_reinstates_queue_predicate( Queue_t * const pxQueue, void * const pvBuffer ) - /*@requires queue(pxQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * 0 < K &*& - * chars(pvBuffer, M, _);@*/ - + 0 < K &*& + chars(pvBuffer, M, _);@*/ /*@ensures - * queue(pxQueue, Storage, N, M, W, (R+1)%N, K-1, is_locked, tail(abs)) &*& - * chars(pvBuffer, M, head(abs));@*/ + queue(pxQueue, Storage, N, M, W, (R+1)%N, K-1, is_locked, tail(abs)) &*& + chars(pvBuffer, M, head(abs));@*/ { prvCopyDataFromQueue( pxQueue, pvBuffer ); /*@open queue_after_prvCopyDataFromQueue(pxQueue, Storage, N, M, W, (R+1)%N, K, is_locked, abs);@*/ diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c index b6155b4c83..1618b7e77a 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -29,22 +29,20 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, const void * pvItemToQueue, const BaseType_t xPosition ) - /*@requires queue(pxQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * (K < N || xPosition == queueOVERWRITE) &*& - * chars(pvItemToQueue, M, ?x) &*& - * (xPosition == queueSEND_TO_BACK || xPosition == queueSEND_TO_FRONT || (xPosition == queueOVERWRITE && N == 1));@*/ - + (K < N || xPosition == queueOVERWRITE) &*& + chars(pvItemToQueue, M, ?x) &*& + (xPosition == queueSEND_TO_BACK || xPosition == queueSEND_TO_FRONT || (xPosition == queueOVERWRITE && N == 1));@*/ /*@ensures - * (xPosition == queueSEND_TO_BACK - * ? queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))) - * : (xPosition == queueSEND_TO_FRONT - * ? (R == 0 - * ? queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)) - * : queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs))) - * : xPosition == queueOVERWRITE &*& queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x))) - * ) &*& - * chars(pvItemToQueue, M, x);@*/ + (xPosition == queueSEND_TO_BACK + ? queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))) + : (xPosition == queueSEND_TO_FRONT + ? (R == 0 + ? queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)) + : queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs))) + : xPosition == queueOVERWRITE &*& queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x))) + ) &*& + chars(pvItemToQueue, M, x);@*/ { BaseType_t xReturn = pdFALSE; UBaseType_t uxMessagesWaiting; @@ -60,45 +58,43 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, /* This case is unreachable for queues */ /*@assert false;@*/ #if ( configUSE_MUTEXES == 1 ) - { - if( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) - { - /* The mutex is no longer being held. */ - xReturn = xTaskPriorityDisinherit( pxQueue->u.xSemaphore.xMutexHolder ); - pxQueue->u.xSemaphore.xMutexHolder = NULL; - } - else { - mtCOVERAGE_TEST_MARKER(); + if( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) + { + /* The mutex is no longer being held. */ + xReturn = xTaskPriorityDisinherit( pxQueue->u.xSemaphore.xMutexHolder ); + pxQueue->u.xSemaphore.xMutexHolder = NULL; + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } - } #endif /* configUSE_MUTEXES */ } else if( xPosition == queueSEND_TO_BACK ) { - #ifdef VERIFAST /*< void cast of unused return value */ - - /* Now we focus the proof on the logical element of the buffer that - * will be updated using the following lemma to split the buffer into 3 - * parts: a prefix, the element we want to update, and the suffix. This - * enables the subsequent memcpy to verify. */ - /*@split_element(Storage, N, M, W);@*/ - - /*@assert - * buffer(Storage, W, M, ?prefix) &*& - * chars(Storage + W * M, M, _) &*& - * buffer(Storage + (W + 1) * M, (N-1-W), M, ?suffix);@*/ - memcpy( ( void * ) pxQueue->pcWriteTo, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); - /* After the update we stitch the buffer back together */ - /*@join_element(Storage, N, M, W);@*/ - /*@combine_list_update(prefix, x, suffix, W, contents);@*/ - #else - ( void ) memcpy( ( void * ) pxQueue->pcWriteTo, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e418 !e9087 MISRA exception as the casts are only redundant for some ports, plus previous logic ensures a null pointer can only be passed to memcpy() if the copy size is 0. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. */ - #endif /* ifdef VERIFAST */ +#ifdef VERIFAST /*< void cast of unused return value */ + /* Now we focus the proof on the logical element of the buffer that + * will be updated using the following lemma to split the buffer into 3 + * parts: a prefix, the element we want to update, and the suffix. This + * enables the subsequent memcpy to verify. */ + /*@split_element(Storage, N, M, W);@*/ + /*@assert + buffer(Storage, W, M, ?prefix) &*& + chars(Storage + W * M, M, _) &*& + buffer(Storage + (W + 1) * M, (N-1-W), M, ?suffix);@*/ + memcpy( ( void * ) pxQueue->pcWriteTo, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); + /* After the update we stitch the buffer back together */ + /*@join_element(Storage, N, M, W);@*/ + /*@combine_list_update(prefix, x, suffix, W, contents);@*/ +#else + ( void ) memcpy( ( void * ) pxQueue->pcWriteTo, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e418 !e9087 MISRA exception as the casts are only redundant for some ports, plus previous logic ensures a null pointer can only be passed to memcpy() if the copy size is 0. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. */ +#endif /*@mul_mono_l(W, N-1, M);@*/ - pxQueue->pcWriteTo += pxQueue->uxItemSize; /*lint !e9016 Pointer arithmetic on char types ok, especially in this use case where it is the clearest way of conveying intent. */ + pxQueue->pcWriteTo += pxQueue->uxItemSize; /*lint !e9016 Pointer arithmetic on char types ok, especially in this use case where it is the clearest way of conveying intent. */ - if( pxQueue->pcWriteTo >= pxQueue->u.xQueue.pcTail ) /*lint !e946 MISRA exception justified as comparison of pointers is the cleanest solution. */ + if( pxQueue->pcWriteTo >= pxQueue->u.xQueue.pcTail ) /*lint !e946 MISRA exception justified as comparison of pointers is the cleanest solution. */ { /*@div_leq(N, W+1, M);@*/ /* now we know W == N-1 so (W+1)%N == 0 */ pxQueue->pcWriteTo = pxQueue->pcHead; @@ -106,29 +102,28 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, else { /*@{ - * div_lt(W+1, N, M); // now we know W+1 < N - * mod_lt(W+1, N); // so, W+1 == (W+1)%N - * note(pxQueue->pcWriteTo == Storage + ((W + 1) * M)); - * note( Storage + ((W + 1) * M) == Storage + (((W + 1) % N) * M)); - * }@*/ + div_lt(W+1, N, M); // now we know W+1 < N + mod_lt(W+1, N); // so, W+1 == (W+1)%N + note(pxQueue->pcWriteTo == Storage + ((W + 1) * M)); + note( Storage + ((W + 1) * M) == Storage + (((W + 1) % N) * M)); + }@*/ mtCOVERAGE_TEST_MARKER(); } } else { - #ifdef VERIFAST /*< void cast of unused return value */ - /*@split_element(Storage, N, M, R);@*/ - - /*@assert - * buffer(Storage, R, M, ?prefix) &*& - * chars(Storage + R * M, M, _) &*& - * buffer(Storage + (R + 1) * M, (N-1-R), M, ?suffix);@*/ - memcpy( ( void * ) pxQueue->u.xQueue.pcReadFrom, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); - /*@join_element(Storage, N, M, R);@*/ - /*@combine_list_update(prefix, x, suffix, R, contents);@*/ - #else - ( void ) memcpy( ( void * ) pxQueue->u.xQueue.pcReadFrom, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e9087 !e418 MISRA exception as the casts are only redundant for some ports. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. Assert checks null pointer only used when length is 0. */ - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@split_element(Storage, N, M, R);@*/ + /*@assert + buffer(Storage, R, M, ?prefix) &*& + chars(Storage + R * M, M, _) &*& + buffer(Storage + (R + 1) * M, (N-1-R), M, ?suffix);@*/ + memcpy( ( void * ) pxQueue->u.xQueue.pcReadFrom, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); + /*@join_element(Storage, N, M, R);@*/ + /*@combine_list_update(prefix, x, suffix, R, contents);@*/ +#else + ( void ) memcpy( ( void * ) pxQueue->u.xQueue.pcReadFrom, pvItemToQueue, ( size_t ) pxQueue->uxItemSize ); /*lint !e961 !e9087 !e418 MISRA exception as the casts are only redundant for some ports. Cast to void required by function signature and safe as no alignment requirement and copy length specified in bytes. Assert checks null pointer only used when length is 0. */ +#endif pxQueue->u.xQueue.pcReadFrom -= pxQueue->uxItemSize; if( pxQueue->u.xQueue.pcReadFrom < pxQueue->pcHead ) /*lint !e946 MISRA exception justified as comparison of pointers is the cleanest solution. */ @@ -146,12 +141,12 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, } /*@ - * if (R == 0) - * { - * mod_plus(N, (K+1), N); mod_same(N); mod_mod(K+1, N); - * assert W == ((N-1) + 1 + (K+1)) % N; - * } - * @*/ + if (R == 0) + { + mod_plus(N, (K+1), N); mod_same(N); mod_mod(K+1, N); + assert W == ((N-1) + 1 + (K+1)) % N; + } + @*/ if( xPosition == queueOVERWRITE ) { if( uxMessagesWaiting > ( UBaseType_t ) 0 ) @@ -176,20 +171,20 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, pxQueue->uxMessagesWaiting = uxMessagesWaiting + ( UBaseType_t ) 1; /*@ - * if (xPosition == queueSEND_TO_BACK) - * { - * enq_lemma(K, (R+1)%N, contents, abs, x); - * mod_plus_one(W, R + 1 + K, N); - * mod_plus_distr(R+1, K, N); - * } - * else if (xPosition == queueSEND_TO_FRONT) - * { - * front_enq_lemma(K, R, contents, abs, x); - * if (0 < R) - * { - * mod_lt(R, N); - * } - * } - * @*/ + if (xPosition == queueSEND_TO_BACK) + { + enq_lemma(K, (R+1)%N, contents, abs, x); + mod_plus_one(W, R + 1 + K, N); + mod_plus_distr(R+1, K, N); + } + else if (xPosition == queueSEND_TO_FRONT) + { + front_enq_lemma(K, R, contents, abs, x); + if (0 < R) + { + mod_lt(R, N); + } + } + @*/ return xReturn; } diff --git a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c index c153ebacaf..b22318b1d3 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c @@ -46,12 +46,11 @@ void wrapper_prvLockQueue( QueueHandle_t xQueue ) /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]queuelock(xQueue);@*/ - + [1/2]queuelock(xQueue);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]xQueue->locked |-> ?m &*& - * mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& - * queue_locked_invariant(xQueue)();@*/ + [1/2]xQueue->locked |-> ?m &*& + mutex_held(m, queue_locked_invariant(xQueue), currentThread, 1/2) &*& + queue_locked_invariant(xQueue)();@*/ { taskENTER_CRITICAL(); /*@open queue(xQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ @@ -68,7 +67,7 @@ void wrapper_prvLockQueue( QueueHandle_t xQueue ) } /*@close queue(xQueue, Storage, N, M, W, R, K, true, abs);@*/ taskEXIT_CRITICAL(); - #ifdef VERIFAST /*< ghost action */ - mutex_acquire( xQueue->locked ); - #endif +#ifdef VERIFAST /*< ghost action */ + mutex_acquire( xQueue->locked ); +#endif } diff --git a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c index 1771e342d5..b5e0c3c991 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -32,14 +32,12 @@ * decrementing `cTxLock` and `cRxLock`. */ static void prvUnlockQueue( Queue_t * const pxQueue ) - /*@requires [1/2]queuehandle(pxQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]pxQueue->locked |-> ?m &*& - * mutex_held(m, queue_locked_invariant(pxQueue), currentThread, 1/2) &*& - * queue_locked_invariant(pxQueue)();@*/ - + [1/2]pxQueue->locked |-> ?m &*& + mutex_held(m, queue_locked_invariant(pxQueue), currentThread, 1/2) &*& + queue_locked_invariant(pxQueue)();@*/ /*@ensures [1/2]queuehandle(pxQueue, N, M, is_isr) &*& - * [1/2]queuelock(pxQueue);@*/ + [1/2]queuelock(pxQueue);@*/ { /* THIS FUNCTION MUST BE CALLED WITH THE SCHEDULER SUSPENDED. */ @@ -59,32 +57,55 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) /* Data was posted while the queue was locked. Are any tasks * blocked waiting for data to become available? */ #if ( configUSE_QUEUE_SETS == 1 ) - { - if( pxQueue->pxQueueSetContainer != NULL ) { - if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) + if( pxQueue->pxQueueSetContainer != NULL ) { - /* The queue is a member of a queue set, and posting to - * the queue set caused a higher priority task to unblock. - * A context switch is required. */ - vTaskMissedYield(); + if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) + { + /* The queue is a member of a queue set, and posting to + * the queue set caused a higher priority task to unblock. + * A context switch is required. */ + vTaskMissedYield(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } else { - mtCOVERAGE_TEST_MARKER(); + /* Tasks that are removed from the event list will get + * added to the pending ready list as the scheduler is still + * suspended. */ + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + { + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + { + /* The task waiting has a higher priority so record that a + * context switch is required. */ + vTaskMissedYield(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } + } + else + { + break; + } } } - else + #else /* configUSE_QUEUE_SETS */ { - /* Tasks that are removed from the event list will get - * added to the pending ready list as the scheduler is still - * suspended. */ + /* Tasks that are removed from the event list will get added to + * the pending ready list as the scheduler is still suspended. */ if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - /* The task waiting has a higher priority so record that a - * context switch is required. */ + /* The task waiting has a higher priority so record that + * a context switch is required. */ vTaskMissedYield(); } else @@ -97,29 +118,6 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) break; } } - } - #else /* configUSE_QUEUE_SETS */ - { - /* Tasks that are removed from the event list will get added to - * the pending ready list as the scheduler is still suspended. */ - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) - { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) - { - /* The task waiting has a higher priority so record that - * a context switch is required. */ - vTaskMissedYield(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - } - else - { - break; - } - } #endif /* configUSE_QUEUE_SETS */ --cTxLock; @@ -127,12 +125,12 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) pxQueue->cTxLock = queueUNLOCKED; } - #ifndef VERIFAST /*< ***merge cTxLock and cRxLock critical regions*** */ - taskEXIT_CRITICAL(); +#ifndef VERIFAST /*< ***merge cTxLock and cRxLock critical regions*** */ + taskEXIT_CRITICAL(); - /* Do the same for the Rx lock. */ - taskENTER_CRITICAL(); - #endif + /* Do the same for the Rx lock. */ + taskENTER_CRITICAL(); +#endif { int8_t cRxLock = pxQueue->cRxLock; @@ -162,7 +160,7 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) } /*@close queue(pxQueue, Storage, N, M, W, R, K, false, abs);@*/ taskEXIT_CRITICAL(); - #ifdef VERIFAST /*< ghost action */ - mutex_release( pxQueue->locked ); - #endif +#ifdef VERIFAST /*< ghost action */ + mutex_release( pxQueue->locked ); +#endif } diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c index 0f2dce32ac..d61310bb49 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c @@ -41,11 +41,11 @@ UBaseType_t uxQueueMessagesWaitingFromISR( const QueueHandle_t xQueue ) { UBaseType_t uxReturn; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); uxReturn = pxQueue->uxMessagesWaiting; diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c index 1f5d060e7c..5210f35536 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c @@ -32,11 +32,11 @@ UBaseType_t uxQueueSpacesAvailable( const QueueHandle_t xQueue ) { UBaseType_t uxReturn; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); diff --git a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c index bab0ca5367..cb6d22eab6 100644 --- a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c +++ b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -29,57 +29,56 @@ #define configSUPPORT_STATIC_ALLOCATION 0 void vQueueDelete( QueueHandle_t xQueue ) - /*@requires queue(xQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs) &*& - * queuelists(xQueue) &*& - * xQueue->irqMask |-> _ &*& - * xQueue->schedulerSuspend |-> _ &*& - * xQueue->locked |-> _;@*/ + queuelists(xQueue) &*& + xQueue->irqMask |-> _ &*& + xQueue->schedulerSuspend |-> _ &*& + xQueue->locked |-> _;@*/ /*@ensures true;@*/ { - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); traceQUEUE_DELETE( pxQueue ); #if ( configQUEUE_REGISTRY_SIZE > 0 ) - { - vQueueUnregisterQueue( pxQueue ); - } + { + vQueueUnregisterQueue( pxQueue ); + } #endif #if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) - { - /* The queue can only have been allocated dynamically - free it - * again. */ - vPortFree( pxQueue ); - #ifdef VERIFAST /*< leak ghost state on deletion */ + { + /* The queue can only have been allocated dynamically - free it + * again. */ + vPortFree( pxQueue ); +#ifdef VERIFAST /*< leak ghost state on deletion */ /*@leak buffer(_, _, _, _);@*/ /*@leak malloc_block(_, _);@*/ - #endif - } +#endif + } #elif ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 1 ) ) - { - /* The queue could have been allocated statically or dynamically, so - * check before attempting to free the memory. */ - if( pxQueue->ucStaticallyAllocated == ( uint8_t ) pdFALSE ) { - vPortFree( pxQueue ); + /* The queue could have been allocated statically or dynamically, so + * check before attempting to free the memory. */ + if( pxQueue->ucStaticallyAllocated == ( uint8_t ) pdFALSE ) + { + vPortFree( pxQueue ); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } - else + #else /* if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) */ { - mtCOVERAGE_TEST_MARKER(); + /* The queue must have been statically allocated, so is not going to be + * deleted. Avoid compiler warnings about the unused parameter. */ + ( void ) pxQueue; } - } - #else /* if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) */ - { - /* The queue must have been statically allocated, so is not going to be - * deleted. Avoid compiler warnings about the unused parameter. */ - ( void ) pxQueue; - } #endif /* configSUPPORT_DYNAMIC_ALLOCATION */ } diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c index 54d49e7491..c0fcd5d4b3 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -31,50 +31,45 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, const void * const pvItemToQueue, TickType_t xTicksToWait, const BaseType_t xCopyPosition ) - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvItemToQueue, M, ?x) &*& - * (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1));@*/ - + [1/2]queuesuspend(xQueue) &*& + chars(pvItemToQueue, M, ?x) &*& + (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1));@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvItemToQueue, M, x);@*/ + [1/2]queuesuspend(xQueue) &*& + chars(pvItemToQueue, M, x);@*/ { BaseType_t xEntryTimeSet = pdFALSE, xYieldRequired; TimeOut_t xTimeOut; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - - configASSERT( pxQueue ); - configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); - configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) ); + configASSERT( pxQueue ); + configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); + configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) ); #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) { configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); } - #endif - #endif /* ifdef VERIFAST */ + #endif +#endif /*lint -save -e904 This function relaxes the coding standard somewhat to * allow return statements within the function itself. This is done in the * interest of execution time efficiency. */ for( ; ; ) - /*@invariant [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvItemToQueue, M, x) &*& - * u_integer(&xTicksToWait, _) &*& - * (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1)) &*& - * xTIME_OUT(&xTimeOut);@*/ + [1/2]queuesuspend(xQueue) &*& + chars(pvItemToQueue, M, x) &*& + u_integer(&xTicksToWait, _) &*& + (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1)) &*& + xTIME_OUT(&xTimeOut);@*/ { taskENTER_CRITICAL(); { /*@assert queue(pxQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ - /* Is there room on the queue now? The running task must be the * highest priority task wanting to access the queue. If the head item * in the queue is to be overwritten then it does not matter if the @@ -85,34 +80,70 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, /* VeriFast: we do not verify this configuration option */ #if ( configUSE_QUEUE_SETS == 1 ) - { - const UBaseType_t uxPreviousMessagesWaiting = pxQueue->uxMessagesWaiting; + { + const UBaseType_t uxPreviousMessagesWaiting = pxQueue->uxMessagesWaiting; - xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); + xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - if( pxQueue->pxQueueSetContainer != NULL ) - { - if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) + if( pxQueue->pxQueueSetContainer != NULL ) { - /* Do not notify the queue set as an existing item - * was overwritten in the queue so the number of items - * in the queue has not changed. */ - mtCOVERAGE_TEST_MARKER(); - } - else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) - { - /* The queue is a member of a queue set, and posting - * to the queue set caused a higher priority task to - * unblock. A context switch is required. */ - queueYIELD_IF_USING_PREEMPTION(); + if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) + { + /* Do not notify the queue set as an existing item + * was overwritten in the queue so the number of items + * in the queue has not changed. */ + mtCOVERAGE_TEST_MARKER(); + } + else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) + { + /* The queue is a member of a queue set, and posting + * to the queue set caused a higher priority task to + * unblock. A context switch is required. */ + queueYIELD_IF_USING_PREEMPTION(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } else { - mtCOVERAGE_TEST_MARKER(); + /* If there was a task waiting for data to arrive on the + * queue then unblock it now. */ + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + { + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + { + /* The unblocked task has a priority higher than + * our own so yield immediately. Yes it is ok to + * do this from within the critical section - the + * kernel takes care of that. */ + queueYIELD_IF_USING_PREEMPTION(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } + } + else if( xYieldRequired != pdFALSE ) + { + /* This path is a special case that will only get + * executed if the task was holding multiple mutexes + * and the mutexes were given back in an order that is + * different to that in which they were taken. */ + queueYIELD_IF_USING_PREEMPTION(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } } - else + #else /* configUSE_QUEUE_SETS */ { + /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ + xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); + /* If there was a task waiting for data to arrive on the * queue then unblock it now. */ if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) @@ -120,9 +151,9 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { /* The unblocked task has a priority higher than - * our own so yield immediately. Yes it is ok to - * do this from within the critical section - the - * kernel takes care of that. */ + * our own so yield immediately. Yes it is ok to do + * this from within the critical section - the kernel + * takes care of that. */ queueYIELD_IF_USING_PREEMPTION(); } else @@ -133,8 +164,8 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, else if( xYieldRequired != pdFALSE ) { /* This path is a special case that will only get - * executed if the task was holding multiple mutexes - * and the mutexes were given back in an order that is + * executed if the task was holding multiple mutexes and + * the mutexes were given back in an order that is * different to that in which they were taken. */ queueYIELD_IF_USING_PREEMPTION(); } @@ -143,58 +174,22 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, mtCOVERAGE_TEST_MARKER(); } } - } - #else /* configUSE_QUEUE_SETS */ - { - /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ - xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - - /* If there was a task waiting for data to arrive on the - * queue then unblock it now. */ - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) - { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) - { - /* The unblocked task has a priority higher than - * our own so yield immediately. Yes it is ok to do - * this from within the critical section - the kernel - * takes care of that. */ - queueYIELD_IF_USING_PREEMPTION(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - } - else if( xYieldRequired != pdFALSE ) - { - /* This path is a special case that will only get - * executed if the task was holding multiple mutexes and - * the mutexes were given back in an order that is - * different to that in which they were taken. */ - queueYIELD_IF_USING_PREEMPTION(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - } #endif /* configUSE_QUEUE_SETS */ /*@ - * if (xCopyPosition == queueSEND_TO_BACK) - * { - * close queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))); - * } - * else if (xCopyPosition == queueSEND_TO_FRONT) - * { - * close queue(pxQueue, Storage, N, M, W, (R == 0 ? (N-1) : (R-1)), (K+1), is_locked, cons(x, abs)); - * } - * else if (xCopyPosition == queueOVERWRITE) - * { - * close queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x)); - * } - * @*/ + if (xCopyPosition == queueSEND_TO_BACK) + { + close queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))); + } + else if (xCopyPosition == queueSEND_TO_FRONT) + { + close queue(pxQueue, Storage, N, M, W, (R == 0 ? (N-1) : (R-1)), (K+1), is_locked, cons(x, abs)); + } + else if (xCopyPosition == queueOVERWRITE) + { + close queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x)); + } + @*/ taskEXIT_CRITICAL(); return pdPASS; } @@ -203,7 +198,6 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, if( xTicksToWait == ( TickType_t ) 0 ) { /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ - /* The queue was full and no block time is specified (or * the block time has expired) so leave now. */ taskEXIT_CRITICAL(); @@ -226,7 +220,6 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, mtCOVERAGE_TEST_MARKER(); } } - /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ } taskEXIT_CRITICAL(); @@ -270,24 +263,24 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, { /* Try again. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif } } else { /* The timeout has expired. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif traceQUEUE_SEND_FAILED( pxQueue ); return errQUEUE_FULL; diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c index ce91c277db..7a026e1ff8 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -31,30 +31,28 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, const void * const pvItemToQueue, BaseType_t * const pxHigherPriorityTaskWoken, const BaseType_t xCopyPosition ) - /*@requires - * [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == true &*& - * chars(pvItemToQueue, M, ?x) &*& - * integer(pxHigherPriorityTaskWoken, _) &*& - * (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1));@*/ - + [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == true &*& + chars(pvItemToQueue, M, ?x) &*& + integer(pxHigherPriorityTaskWoken, _) &*& + (xCopyPosition == queueSEND_TO_BACK || xCopyPosition == queueSEND_TO_FRONT || (xCopyPosition == queueOVERWRITE && N == 1));@*/ /*@ensures - * [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * chars(pvItemToQueue, M, x) &*& - * integer(pxHigherPriorityTaskWoken, _);@*/ + [1/2]queuehandle(xQueue, N, M, is_isr) &*& + chars(pvItemToQueue, M, x) &*& + integer(pxHigherPriorityTaskWoken, _);@*/ { BaseType_t xReturn; UBaseType_t uxSavedInterruptStatus; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - configASSERT( pxQueue ); - configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); - configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) ); - #endif + configASSERT( pxQueue ); + configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); + configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) ); +#endif /* RTOS ports that support interrupt nesting have the concept of a maximum * system call (or maximum API call) interrupt priority. Interrupts that are @@ -92,12 +90,12 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, * in a task disinheriting a priority and prvCopyDataToQueue() can be * called here even though the disinherit function does not check if * the scheduler is suspended before accessing the ready lists. */ - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ - prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - #else - ( void ) prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ + prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); +#else + ( void ) prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); +#endif /*@open queue(pxQueue, _, N, M, _, _, _, _, _);@*/ /* The event list is not altered if the queue is locked. This will @@ -106,24 +104,29 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, { /* VeriFast: we do not verify this configuration option */ #if ( configUSE_QUEUE_SETS == 1 ) - { - if( pxQueue->pxQueueSetContainer != NULL ) { - if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) + if( pxQueue->pxQueueSetContainer != NULL ) { - /* Do not notify the queue set as an existing item - * was overwritten in the queue so the number of items - * in the queue has not changed. */ - mtCOVERAGE_TEST_MARKER(); - } - else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) - { - /* The queue is a member of a queue set, and posting - * to the queue set caused a higher priority task to - * unblock. A context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) + if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) { - *pxHigherPriorityTaskWoken = pdTRUE; + /* Do not notify the queue set as an existing item + * was overwritten in the queue so the number of items + * in the queue has not changed. */ + mtCOVERAGE_TEST_MARKER(); + } + else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) + { + /* The queue is a member of a queue set, and posting + * to the queue set caused a higher priority task to + * unblock. A context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) + { + *pxHigherPriorityTaskWoken = pdTRUE; + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } else { @@ -132,20 +135,20 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, } else { - mtCOVERAGE_TEST_MARKER(); - } - } - else - { - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) - { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { - /* The task waiting has a higher priority so - * record that a context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - *pxHigherPriorityTaskWoken = pdTRUE; + /* The task waiting has a higher priority so + * record that a context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) + { + *pxHigherPriorityTaskWoken = pdTRUE; + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } else { @@ -157,23 +160,23 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, mtCOVERAGE_TEST_MARKER(); } } - else - { - mtCOVERAGE_TEST_MARKER(); - } } - } #else /* configUSE_QUEUE_SETS */ - { - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { - /* The task waiting has a higher priority so record that a - * context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - *pxHigherPriorityTaskWoken = pdTRUE; + /* The task waiting has a higher priority so record that a + * context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) + { + *pxHigherPriorityTaskWoken = pdTRUE; + } + else + { + mtCOVERAGE_TEST_MARKER(); + } } else { @@ -184,17 +187,12 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, { mtCOVERAGE_TEST_MARKER(); } - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - /* Not used in this path. */ - #ifndef VERIFAST /*< void cast of unused var */ + /* Not used in this path. */ +#ifndef VERIFAST /*< void cast of unused var */ ( void ) uxPreviousMessagesWaiting; - #endif - } +#endif + } #endif /* configUSE_QUEUE_SETS */ } else @@ -207,27 +205,26 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, } xReturn = pdPASS; - /*@ - * if (xCopyPosition == queueSEND_TO_BACK) - * { - * close queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))); - * } - * else if (xCopyPosition == queueSEND_TO_FRONT) - * { - * if (R == 0) - * { - * close queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)); - * } - * else - * { - * close queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs)); - * } - * } else if (xCopyPosition == queueOVERWRITE) - * { - * close queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x)); - * } - * @*/ + if (xCopyPosition == queueSEND_TO_BACK) + { + close queue(pxQueue, Storage, N, M, (W+1)%N, R, (K+1), is_locked, append(abs, singleton(x))); + } + else if (xCopyPosition == queueSEND_TO_FRONT) + { + if (R == 0) + { + close queue(pxQueue, Storage, N, M, W, (N-1), (K+1), is_locked, cons(x, abs)); + } + else + { + close queue(pxQueue, Storage, N, M, W, (R-1), (K+1), is_locked, cons(x, abs)); + } + } else if (xCopyPosition == queueOVERWRITE) + { + close queue(pxQueue, Storage, N, M, W, R, 1, is_locked, singleton(x)); + } + @*/ } else { diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c index bf727c1bc1..8dd9f6dc30 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c @@ -28,17 +28,16 @@ BaseType_t xQueueIsQueueEmptyFromISR( const QueueHandle_t xQueue ) /*@requires queue(xQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ - /*@ensures queue(xQueue, Storage, N, M, W, R, K, is_locked, abs) &*& - * result == ((K == 0) ? pdTRUE : pdFALSE);@*/ + result == ((K == 0) ? pdTRUE : pdFALSE);@*/ { BaseType_t xReturn; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c index ec8e5f0cd3..8326d1fb23 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c @@ -28,17 +28,16 @@ BaseType_t xQueueIsQueueFullFromISR( const QueueHandle_t xQueue ) /*@requires queue(xQueue, ?Storage, ?N, ?M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ - /*@ensures queue(xQueue, Storage, N, M, W, R, K, is_locked, abs) &*& - * result == ((K == N) ? pdTRUE : pdFALSE);@*/ + result == ((K == N) ? pdTRUE : pdFALSE);@*/ { BaseType_t xReturn; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - #endif +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; +#endif configASSERT( pxQueue ); diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c index 18862b36a0..efdfe54f2d 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -30,49 +30,45 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, void * const pvBuffer, TickType_t xTicksToWait ) - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvBuffer, M, ?x);@*/ - + [1/2]queuesuspend(xQueue) &*& + chars(pvBuffer, M, ?x);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ + [1/2]queuesuspend(xQueue) &*& + (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ { BaseType_t xEntryTimeSet = pdFALSE; TimeOut_t xTimeOut; int8_t * pcOriginalReadPosition; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - - /* Check the pointer is not NULL. */ - configASSERT( ( pxQueue ) ); + /* Check the pointer is not NULL. */ + configASSERT( ( pxQueue ) ); - /* The buffer into which data is received can only be NULL if the data size - * is zero (so no data is copied into the buffer. */ - configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) ); + /* The buffer into which data is received can only be NULL if the data size + * is zero (so no data is copied into the buffer. */ + configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) ); - /* Cannot block if the scheduler is suspended. */ + /* Cannot block if the scheduler is suspended. */ #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) { configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); } - #endif - #endif /* ifdef VERIFAST */ + #endif +#endif /*lint -save -e904 This function relaxes the coding standard somewhat to * allow return statements within the function itself. This is done in the * interest of execution time efficiency. */ for( ; ; ) - /*@invariant [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvBuffer, M, x) &*& - * u_integer(&xTicksToWait, _) &*& - * xTIME_OUT(&xTimeOut);@*/ + [1/2]queuesuspend(xQueue) &*& + chars(pvBuffer, M, x) &*& + u_integer(&xTicksToWait, _) &*& + xTIME_OUT(&xTimeOut);@*/ { taskENTER_CRITICAL(); /*@assert queue(pxQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ @@ -182,12 +178,12 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, /* There is data in the queue now, so don't enter the blocked * state, instead return to try and obtain the data. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif } } else @@ -195,12 +191,12 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, /* The timeout has expired. If there is still no data in the queue * exit, otherwise go back and try to read the data again. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif if( prvIsQueueEmpty( pxQueue ) != pdFALSE ) { diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c index 559a2deabe..eb47e2f578 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c @@ -29,26 +29,23 @@ BaseType_t xQueuePeekFromISR( QueueHandle_t xQueue, void * const pvBuffer ) - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == true &*& - * chars(pvBuffer, M, ?x);@*/ - + chars(pvBuffer, M, ?x);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ + (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ { BaseType_t xReturn; UBaseType_t uxSavedInterruptStatus; int8_t * pcOriginalReadPosition; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - - configASSERT( pxQueue ); - configASSERT( !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); - configASSERT( pxQueue->uxItemSize != 0 ); /* Can't peek a semaphore. */ - #endif + configASSERT( pxQueue ); + configASSERT( !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); + configASSERT( pxQueue->uxItemSize != 0 ); /* Can't peek a semaphore. */ +#endif /* RTOS ports that support interrupt nesting have the concept of a maximum * system call (or maximum API call) interrupt priority. Interrupts that are diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c index c78cbc070c..83c5439e25 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in @@ -30,48 +30,44 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, void * const pvBuffer, TickType_t xTicksToWait ) - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == false &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvBuffer, M, ?x);@*/ - + [1/2]queuesuspend(xQueue) &*& + chars(pvBuffer, M, ?x);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ + [1/2]queuesuspend(xQueue) &*& + (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x));@*/ { BaseType_t xEntryTimeSet = pdFALSE; TimeOut_t xTimeOut; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - - /* Check the pointer is not NULL. */ - configASSERT( ( pxQueue ) ); + /* Check the pointer is not NULL. */ + configASSERT( ( pxQueue ) ); - /* The buffer into which data is received can only be NULL if the data size - * is zero (so no data is copied into the buffer). */ - configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) ); + /* The buffer into which data is received can only be NULL if the data size + * is zero (so no data is copied into the buffer). */ + configASSERT( !( ( ( pvBuffer ) == NULL ) && ( ( pxQueue )->uxItemSize != ( UBaseType_t ) 0U ) ) ); - /* Cannot block if the scheduler is suspended. */ + /* Cannot block if the scheduler is suspended. */ #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) { configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); } - #endif - #endif /* ifdef VERIFAST */ + #endif +#endif /*lint -save -e904 This function relaxes the coding standard somewhat to * allow return statements within the function itself. This is done in the * interest of execution time efficiency. */ for( ; ; ) - /*@invariant [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * [1/2]queuesuspend(xQueue) &*& - * chars(pvBuffer, M, x) &*& - * u_integer(&xTicksToWait, _) &*& - * xTIME_OUT(&xTimeOut);@*/ + [1/2]queuesuspend(xQueue) &*& + chars(pvBuffer, M, x) &*& + u_integer(&xTicksToWait, _) &*& + xTIME_OUT(&xTimeOut);@*/ { taskENTER_CRITICAL(); /*@assert queue(pxQueue, ?Storage, N, M, ?W, ?R, ?K, ?is_locked, ?abs);@*/ @@ -90,10 +86,9 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, pxQueue->uxMessagesWaiting = uxMessagesWaiting - ( UBaseType_t ) 1; /*@assert - * pxQueue->pcHead |-> ?buffer &*& - * buffer(buffer, N, M, ?contents);@*/ + pxQueue->pcHead |-> ?buffer &*& + buffer(buffer, N, M, ?contents);@*/ /*@deq_lemma(K, (R+1)%N, contents, abs, head(abs));@*/ - /* There is now space in the queue, were any tasks waiting to * post to the queue? If so, unblock the highest priority waiting * task. */ @@ -123,7 +118,6 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, if( xTicksToWait == ( TickType_t ) 0 ) { /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ - /* The queue was empty and no block time is specified (or * the block time has expired) so leave now. */ taskEXIT_CRITICAL(); @@ -182,12 +176,12 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, /* The queue contains data again. Loop back to try and read the * data. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif } } else @@ -195,12 +189,12 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, /* Timed out. If there is no data in the queue exit, otherwise loop * back and attempt to read the data. */ prvUnlockQueue( pxQueue ); - #ifdef VERIFAST /*< void cast of unused return value */ - /*@close exists(pxQueue);@*/ - xTaskResumeAll(); - #else - ( void ) xTaskResumeAll(); - #endif +#ifdef VERIFAST /*< void cast of unused return value */ + /*@close exists(pxQueue);@*/ + xTaskResumeAll(); +#else + ( void ) xTaskResumeAll(); +#endif if( prvIsQueueEmpty( pxQueue ) != pdFALSE ) { diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c index a8e0b2cf81..6e731c78f9 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c @@ -30,26 +30,23 @@ BaseType_t xQueueReceiveFromISR( QueueHandle_t xQueue, void * const pvBuffer, BaseType_t * const pxHigherPriorityTaskWoken ) - /*@requires [1/2]queuehandle(xQueue, ?N, ?M, ?is_isr) &*& is_isr == true &*& - * chars(pvBuffer, M, ?x) &*& - * pxHigherPriorityTaskWoken == NULL ? true : integer(pxHigherPriorityTaskWoken, _);@*/ - + chars(pvBuffer, M, ?x) &*& + pxHigherPriorityTaskWoken == NULL ? true : integer(pxHigherPriorityTaskWoken, _);@*/ /*@ensures [1/2]queuehandle(xQueue, N, M, is_isr) &*& - * (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x)) &*& - * (pxHigherPriorityTaskWoken == NULL ? true : integer(pxHigherPriorityTaskWoken, _));@*/ + (result == pdPASS ? chars(pvBuffer, M, _) : chars(pvBuffer, M, x)) &*& + (pxHigherPriorityTaskWoken == NULL ? true : integer(pxHigherPriorityTaskWoken, _));@*/ { BaseType_t xReturn; UBaseType_t uxSavedInterruptStatus; +#ifdef VERIFAST /*< const pointer declaration */ + Queue_t * pxQueue = xQueue; +#else + Queue_t * const pxQueue = xQueue; - #ifdef VERIFAST /*< const pointer declaration */ - Queue_t * pxQueue = xQueue; - #else - Queue_t * const pxQueue = xQueue; - - configASSERT( pxQueue ); - configASSERT( !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); - #endif + configASSERT( pxQueue ); + configASSERT( !( ( pvBuffer == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); +#endif /* RTOS ports that support interrupt nesting have the concept of a maximum * system call (or maximum API call) interrupt priority. Interrupts that are From 73459ec6a463927acd8e19b0e1e30887e5ceeeb8 Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Thu, 4 Aug 2022 14:52:20 -0400 Subject: [PATCH 2/7] Update proofs inline with source changes Outstanding: - xQueueGenericReset return code - Not using prvIncrementQueueTxLock or prvIncrementQueueRxLock macros --- FreeRTOS/Test/VeriFast/Makefile | 4 +- FreeRTOS/Test/VeriFast/list/vListInitialise.c | 11 ++ FreeRTOS/Test/VeriFast/list/vListInsert.c | 3 + FreeRTOS/Test/VeriFast/queue/create.c | 101 ++++++++------ .../Test/VeriFast/queue/prvCopyDataToQueue.c | 20 +-- FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c | 74 +++++----- FreeRTOS/Test/VeriFast/queue/vQueueDelete.c | 48 +++---- .../Test/VeriFast/queue/xQueueGenericSend.c | 132 +++++++++--------- .../VeriFast/queue/xQueueGenericSendFromISR.c | 94 ++++++------- FreeRTOS/Test/VeriFast/queue/xQueuePeek.c | 8 +- FreeRTOS/Test/VeriFast/queue/xQueueReceive.c | 6 +- 11 files changed, 262 insertions(+), 239 deletions(-) diff --git a/FreeRTOS/Test/VeriFast/Makefile b/FreeRTOS/Test/VeriFast/Makefile index bbbb541c37..4fa652d255 100644 --- a/FreeRTOS/Test/VeriFast/Makefile +++ b/FreeRTOS/Test/VeriFast/Makefile @@ -18,7 +18,7 @@ all: queue list .PHONY: queue queue: - @$(VERIFAST) $(VERIFAST_ARGS) queue/create.c | $(call check_coverage,325) + @$(VERIFAST) $(VERIFAST_ARGS) -disable_overflow_check queue/create.c | $(call check_coverage,315) @$(VERIFAST) $(VERIFAST_ARGS) queue/prvCopyDataFromQueue.c | $(call check_coverage,308) @$(VERIFAST) $(VERIFAST_ARGS) -disable_overflow_check queue/prvCopyDataToQueue.c | $(call check_coverage,336) @$(VERIFAST) $(VERIFAST_ARGS) queue/prvIsQueueEmpty.c | $(call check_coverage,289) @@ -41,7 +41,7 @@ queue: list: @$(VERIFAST) $(VERIFAST_ARGS) list/listLIST_IS_EMPTY.c | $(call check_coverage,314) @$(VERIFAST) $(VERIFAST_ARGS) list/uxListRemove.c | $(call check_coverage,440) - @$(VERIFAST) $(VERIFAST_ARGS) list/vListInitialise.c | $(call check_coverage,325) + @$(VERIFAST) $(VERIFAST_ARGS) list/vListInitialise.c | $(call check_coverage,329) @$(VERIFAST) $(VERIFAST_ARGS) list/vListInitialiseItem.c | $(call check_coverage,316) @$(VERIFAST) $(VERIFAST_ARGS) -disable_overflow_check list/vListInsertEnd.c | $(call check_coverage,410) @$(VERIFAST) $(VERIFAST_ARGS) -disable_overflow_check list/vListInsert.c | $(call check_coverage,456) diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialise.c b/FreeRTOS/Test/VeriFast/list/vListInitialise.c index 4da7bd356d..128f8b8273 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialise.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialise.c @@ -49,6 +49,8 @@ void vListInitialise( List_t * const pxList ) * as the only list entry. */ pxList->pxIndex = ( ListItem_t * ) &( pxList->xListEnd ); /*lint !e826 !e740 !e9087 The mini list structure is used as the list end to save RAM. This is checked and valid. */ + listSET_FIRST_LIST_ITEM_INTEGRITY_CHECK_VALUE( &( pxList->xListEnd ) ); + /* The list end value is the highest possible value in the list to * ensure it remains at the end of the list. */ pxList->xListEnd.xItemValue = portMAX_DELAY; @@ -58,6 +60,15 @@ void vListInitialise( List_t * const pxList ) pxList->xListEnd.pxNext = ( ListItem_t * ) &( pxList->xListEnd ); /*lint !e826 !e740 !e9087 The mini list structure is used as the list end to save RAM. This is checked and valid. */ pxList->xListEnd.pxPrevious = ( ListItem_t * ) &( pxList->xListEnd ); /*lint !e826 !e740 !e9087 The mini list structure is used as the list end to save RAM. This is checked and valid. */ + /* Initialize the remaining fields of xListEnd when it is a proper ListItem_t */ + #if ( configUSE_MINI_LIST_ITEM == 0 ) + { + pxList->xListEnd.pvOwner = NULL; + pxList->xListEnd.pxContainer = NULL; + listSET_SECOND_LIST_ITEM_INTEGRITY_CHECK_VALUE( &( pxList->xListEnd ) ); + } + #endif + pxList->uxNumberOfItems = ( UBaseType_t ) 0U; /* Write known values into the list if diff --git a/FreeRTOS/Test/VeriFast/list/vListInsert.c b/FreeRTOS/Test/VeriFast/list/vListInsert.c index 367161a34a..3eb79d0bfb 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsert.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsert.c @@ -106,6 +106,9 @@ void vListInsert( List_t * const pxList, * 4) Using a queue or semaphore before it has been initialised or * before the scheduler has been started (are interrupts firing * before vTaskStartScheduler() has been called?). + * 5) If the FreeRTOS port supports interrupt nesting then ensure that + * the priority of the tick interrupt is at or below + * configMAX_SYSCALL_INTERRUPT_PRIORITY. **********************************************************************/ #ifdef VERIFAST /*< ***over-approximate list insert loop*** */ diff --git a/FreeRTOS/Test/VeriFast/queue/create.c b/FreeRTOS/Test/VeriFast/queue/create.c index ab82249cfe..16d88a5a38 100644 --- a/FreeRTOS/Test/VeriFast/queue/create.c +++ b/FreeRTOS/Test/VeriFast/queue/create.c @@ -172,20 +172,21 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, #endif #if ( configUSE_TRACE_FACILITY == 1 ) - { - pxNewQueue->ucQueueType = ucQueueType; - } + { + pxNewQueue->ucQueueType = ucQueueType; + } #endif /* configUSE_TRACE_FACILITY */ #if ( configUSE_QUEUE_SETS == 1 ) - { - pxNewQueue->pxQueueSetContainer = NULL; - } + { + pxNewQueue->pxQueueSetContainer = NULL; + } #endif /* configUSE_QUEUE_SETS */ traceQUEUE_CREATE( pxNewQueue ); } +#define SIZE_MAX ( ( size_t ) -1 ) QueueHandle_t xQueueGenericCreate( const UBaseType_t uxQueueLength, const UBaseType_t uxItemSize, @@ -202,71 +203,79 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, result->schedulerSuspend |-> _ &*& result->locked |-> _;@*/ { +#ifdef VERIFAST /*< ***model static initialization*** */ + Queue_t * pxNewQueue = NULL; +#else Queue_t * pxNewQueue; +#endif size_t xQueueSizeInBytes; uint8_t * pucQueueStorage; - configASSERT( uxQueueLength > ( UBaseType_t ) 0 ); - - /* Allocate enough space to hold the maximum number of items that - * can be in the queue at any time. It is valid for uxItemSize to be - * zero in the case the queue is used as a semaphore. */ - xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */ - - /* Check for multiplication overflow. */ - configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) ); - - /* Check for addition overflow. */ - configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) > xQueueSizeInBytes ); + if( ( uxQueueLength > ( UBaseType_t ) 0 ) && + /* Check for multiplication overflow. */ + ( ( SIZE_MAX / uxQueueLength ) >= uxItemSize ) && + /* Check for addition overflow. */ + ( ( SIZE_MAX - sizeof( Queue_t ) ) >= ( uxQueueLength * uxItemSize ) ) ) + { + /* Allocate enough space to hold the maximum number of items that + * can be in the queue at any time. It is valid for uxItemSize to be + * zero in the case the queue is used as a semaphore. */ + xQueueSizeInBytes = ( size_t ) ( uxQueueLength * uxItemSize ); /*lint !e961 MISRA exception as the casts are only redundant for some ports. */ #ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ - pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) ); + pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) ); #else - /* Allocate the queue and storage area. Justification for MISRA - * deviation as follows: pvPortMalloc() always ensures returned memory - * blocks are aligned per the requirements of the MCU stack. In this case - * pvPortMalloc() must return a pointer that is guaranteed to meet the - * alignment requirements of the Queue_t structure - which in this case - * is an int8_t *. Therefore, whenever the stack alignment requirements - * are greater than or equal to the pointer to char requirements the cast - * is safe. In other cases alignment requirements are not strict (one or - * two bytes). */ - pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) + xQueueSizeInBytes ); /*lint !e9087 !e9079 see comment above. */ + /* Allocate the queue and storage area. Justification for MISRA + * deviation as follows: pvPortMalloc() always ensures returned memory + * blocks are aligned per the requirements of the MCU stack. In this case + * pvPortMalloc() must return a pointer that is guaranteed to meet the + * alignment requirements of the Queue_t structure - which in this case + * is an int8_t *. Therefore, whenever the stack alignment requirements + * are greater than or equal to the pointer to char requirements the cast + * is safe. In other cases alignment requirements are not strict (one or + * two bytes). */ + pxNewQueue = ( Queue_t * ) pvPortMalloc( sizeof( Queue_t ) + xQueueSizeInBytes ); /*lint !e9087 !e9079 see comment above. */ #endif - if( pxNewQueue != NULL ) - { + if( pxNewQueue != NULL ) + { #ifdef VERIFAST /*< ***model single malloc of struct and buffer*** */ - pucQueueStorage = ( uint8_t * ) pvPortMalloc( xQueueSizeInBytes ); + pucQueueStorage = ( uint8_t * ) pvPortMalloc( xQueueSizeInBytes ); - if( pucQueueStorage == NULL ) - { - vPortFree( pxNewQueue ); - return NULL; - } + if( pucQueueStorage == NULL ) + { + vPortFree( pxNewQueue ); + return NULL; + } - /*@malloc_block_limits(pucQueueStorage);@*/ + /*@malloc_block_limits(pucQueueStorage);@*/ #else - /* Jump past the queue structure to find the location of the queue - * storage area. */ - pucQueueStorage = ( uint8_t * ) pxNewQueue; - pucQueueStorage += sizeof( Queue_t ); /*lint !e9016 Pointer arithmetic allowed on char types, especially when it assists conveying intent. */ + /* Jump past the queue structure to find the location of the queue + * storage area. */ + pucQueueStorage = ( uint8_t * ) pxNewQueue; + pucQueueStorage += sizeof( Queue_t ); /*lint !e9016 Pointer arithmetic allowed on char types, especially when it assists conveying intent. */ #endif - #if ( configSUPPORT_STATIC_ALLOCATION == 1 ) + #if ( configSUPPORT_STATIC_ALLOCATION == 1 ) { /* Queues can be created either statically or dynamically, so * note this task was created dynamically in case it is later * deleted. */ pxNewQueue->ucStaticallyAllocated = pdFALSE; } - #endif /* configSUPPORT_STATIC_ALLOCATION */ + #endif /* configSUPPORT_STATIC_ALLOCATION */ - prvInitialiseNewQueue( uxQueueLength, uxItemSize, pucQueueStorage, ucQueueType, pxNewQueue ); + prvInitialiseNewQueue( uxQueueLength, uxItemSize, pucQueueStorage, ucQueueType, pxNewQueue ); + } + else + { + traceQUEUE_CREATE_FAILED( ucQueueType ); + mtCOVERAGE_TEST_MARKER(); + } } else { - traceQUEUE_CREATE_FAILED( ucQueueType ); + configASSERT( pxNewQueue ); mtCOVERAGE_TEST_MARKER(); } diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c index 1618b7e77a..6f17a8684d 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c @@ -58,18 +58,18 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, /* This case is unreachable for queues */ /*@assert false;@*/ #if ( configUSE_MUTEXES == 1 ) + { + if( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) + { + /* The mutex is no longer being held. */ + xReturn = xTaskPriorityDisinherit( pxQueue->u.xSemaphore.xMutexHolder ); + pxQueue->u.xSemaphore.xMutexHolder = NULL; + } + else { - if( pxQueue->uxQueueType == queueQUEUE_IS_MUTEX ) - { - /* The mutex is no longer being held. */ - xReturn = xTaskPriorityDisinherit( pxQueue->u.xSemaphore.xMutexHolder ); - pxQueue->u.xSemaphore.xMutexHolder = NULL; - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + mtCOVERAGE_TEST_MARKER(); } + } #endif /* configUSE_MUTEXES */ } else if( xPosition == queueSEND_TO_BACK ) diff --git a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c index b5e0c3c991..ef2dc20533 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c @@ -57,55 +57,32 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) /* Data was posted while the queue was locked. Are any tasks * blocked waiting for data to become available? */ #if ( configUSE_QUEUE_SETS == 1 ) + { + if( pxQueue->pxQueueSetContainer != NULL ) { - if( pxQueue->pxQueueSetContainer != NULL ) + if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) { - if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) - { - /* The queue is a member of a queue set, and posting to - * the queue set caused a higher priority task to unblock. - * A context switch is required. */ - vTaskMissedYield(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + /* The queue is a member of a queue set, and posting to + * the queue set caused a higher priority task to unblock. + * A context switch is required. */ + vTaskMissedYield(); } else { - /* Tasks that are removed from the event list will get - * added to the pending ready list as the scheduler is still - * suspended. */ - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) - { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) - { - /* The task waiting has a higher priority so record that a - * context switch is required. */ - vTaskMissedYield(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - } - else - { - break; - } + mtCOVERAGE_TEST_MARKER(); } } - #else /* configUSE_QUEUE_SETS */ + else { - /* Tasks that are removed from the event list will get added to - * the pending ready list as the scheduler is still suspended. */ + /* Tasks that are removed from the event list will get + * added to the pending ready list as the scheduler is still + * suspended. */ if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - /* The task waiting has a higher priority so record that - * a context switch is required. */ + /* The task waiting has a higher priority so record that a + * context switch is required. */ vTaskMissedYield(); } else @@ -118,6 +95,29 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) break; } } + } + #else /* configUSE_QUEUE_SETS */ + { + /* Tasks that are removed from the event list will get added to + * the pending ready list as the scheduler is still suspended. */ + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + { + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + { + /* The task waiting has a higher priority so record that + * a context switch is required. */ + vTaskMissedYield(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } + } + else + { + break; + } + } #endif /* configUSE_QUEUE_SETS */ --cTxLock; diff --git a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c index cb6d22eab6..44de077b78 100644 --- a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c +++ b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c @@ -46,39 +46,39 @@ void vQueueDelete( QueueHandle_t xQueue ) traceQUEUE_DELETE( pxQueue ); #if ( configQUEUE_REGISTRY_SIZE > 0 ) - { - vQueueUnregisterQueue( pxQueue ); - } + { + vQueueUnregisterQueue( pxQueue ); + } #endif #if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) - { - /* The queue can only have been allocated dynamically - free it - * again. */ - vPortFree( pxQueue ); + { + /* The queue can only have been allocated dynamically - free it + * again. */ + vPortFree( pxQueue ); #ifdef VERIFAST /*< leak ghost state on deletion */ - /*@leak buffer(_, _, _, _);@*/ - /*@leak malloc_block(_, _);@*/ + /*@leak buffer(_, _, _, _);@*/ + /*@leak malloc_block(_, _);@*/ #endif - } + } #elif ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 1 ) ) + { + /* The queue could have been allocated statically or dynamically, so + * check before attempting to free the memory. */ + if( pxQueue->ucStaticallyAllocated == ( uint8_t ) pdFALSE ) { - /* The queue could have been allocated statically or dynamically, so - * check before attempting to free the memory. */ - if( pxQueue->ucStaticallyAllocated == ( uint8_t ) pdFALSE ) - { - vPortFree( pxQueue ); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + vPortFree( pxQueue ); } - #else /* if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) */ + else { - /* The queue must have been statically allocated, so is not going to be - * deleted. Avoid compiler warnings about the unused parameter. */ - ( void ) pxQueue; + mtCOVERAGE_TEST_MARKER(); } + } + #else /* if ( ( configSUPPORT_DYNAMIC_ALLOCATION == 1 ) && ( configSUPPORT_STATIC_ALLOCATION == 0 ) ) */ + { + /* The queue must have been statically allocated, so is not going to be + * deleted. Avoid compiler warnings about the unused parameter. */ + ( void ) pxQueue; + } #endif /* configSUPPORT_DYNAMIC_ALLOCATION */ } diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c index c0fcd5d4b3..c624629d72 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c @@ -50,9 +50,9 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, configASSERT( !( ( pvItemToQueue == NULL ) && ( pxQueue->uxItemSize != ( UBaseType_t ) 0U ) ) ); configASSERT( !( ( xCopyPosition == queueOVERWRITE ) && ( pxQueue->uxLength != 1 ) ) ); #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) - { - configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); - } + { + configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); + } #endif #endif @@ -80,70 +80,34 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, /* VeriFast: we do not verify this configuration option */ #if ( configUSE_QUEUE_SETS == 1 ) - { - const UBaseType_t uxPreviousMessagesWaiting = pxQueue->uxMessagesWaiting; + { + const UBaseType_t uxPreviousMessagesWaiting = pxQueue->uxMessagesWaiting; - xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); + xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - if( pxQueue->pxQueueSetContainer != NULL ) + if( pxQueue->pxQueueSetContainer != NULL ) + { + if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) { - if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) - { - /* Do not notify the queue set as an existing item - * was overwritten in the queue so the number of items - * in the queue has not changed. */ - mtCOVERAGE_TEST_MARKER(); - } - else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) - { - /* The queue is a member of a queue set, and posting - * to the queue set caused a higher priority task to - * unblock. A context switch is required. */ - queueYIELD_IF_USING_PREEMPTION(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + /* Do not notify the queue set as an existing item + * was overwritten in the queue so the number of items + * in the queue has not changed. */ + mtCOVERAGE_TEST_MARKER(); + } + else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) + { + /* The queue is a member of a queue set, and posting + * to the queue set caused a higher priority task to + * unblock. A context switch is required. */ + queueYIELD_IF_USING_PREEMPTION(); } else { - /* If there was a task waiting for data to arrive on the - * queue then unblock it now. */ - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) - { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) - { - /* The unblocked task has a priority higher than - * our own so yield immediately. Yes it is ok to - * do this from within the critical section - the - * kernel takes care of that. */ - queueYIELD_IF_USING_PREEMPTION(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } - } - else if( xYieldRequired != pdFALSE ) - { - /* This path is a special case that will only get - * executed if the task was holding multiple mutexes - * and the mutexes were given back in an order that is - * different to that in which they were taken. */ - queueYIELD_IF_USING_PREEMPTION(); - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + mtCOVERAGE_TEST_MARKER(); } } - #else /* configUSE_QUEUE_SETS */ + else { - /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ - xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); - /* If there was a task waiting for data to arrive on the * queue then unblock it now. */ if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) @@ -151,9 +115,9 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { /* The unblocked task has a priority higher than - * our own so yield immediately. Yes it is ok to do - * this from within the critical section - the kernel - * takes care of that. */ + * our own so yield immediately. Yes it is ok to + * do this from within the critical section - the + * kernel takes care of that. */ queueYIELD_IF_USING_PREEMPTION(); } else @@ -164,8 +128,8 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, else if( xYieldRequired != pdFALSE ) { /* This path is a special case that will only get - * executed if the task was holding multiple mutexes and - * the mutexes were given back in an order that is + * executed if the task was holding multiple mutexes + * and the mutexes were given back in an order that is * different to that in which they were taken. */ queueYIELD_IF_USING_PREEMPTION(); } @@ -174,6 +138,42 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, mtCOVERAGE_TEST_MARKER(); } } + } + #else /* configUSE_QUEUE_SETS */ + { + /*@close queue(pxQueue, Storage, N, M, W, R, K, is_locked, abs);@*/ + xYieldRequired = prvCopyDataToQueue( pxQueue, pvItemToQueue, xCopyPosition ); + + /* If there was a task waiting for data to arrive on the + * queue then unblock it now. */ + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + { + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + { + /* The unblocked task has a priority higher than + * our own so yield immediately. Yes it is ok to do + * this from within the critical section - the kernel + * takes care of that. */ + queueYIELD_IF_USING_PREEMPTION(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } + } + else if( xYieldRequired != pdFALSE ) + { + /* This path is a special case that will only get + * executed if the task was holding multiple mutexes and + * the mutexes were given back in an order that is + * different to that in which they were taken. */ + queueYIELD_IF_USING_PREEMPTION(); + } + else + { + mtCOVERAGE_TEST_MARKER(); + } + } #endif /* configUSE_QUEUE_SETS */ /*@ @@ -241,16 +241,16 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, vTaskPlaceOnEventList( &( pxQueue->xTasksWaitingToSend ), xTicksToWait ); /* Unlocking the queue means queue events can effect the - * event list. It is possible that interrupts occurring now + * event list. It is possible that interrupts occurring now * remove this task from the event list again - but as the * scheduler is suspended the task will go onto the pending - * ready last instead of the actual ready list. */ + * ready list instead of the actual ready list. */ /*@close queue_locked_invariant(xQueue)();@*/ prvUnlockQueue( pxQueue ); /* Resuming the scheduler will move tasks from the pending * ready list into the ready list - so it is feasible that this - * task is already in a ready list before it yields - in which + * task is already in the ready list before it yields - in which * case the yield will not cause a context switch unless there * is also a higher priority task in the pending ready list. */ /*@close exists(pxQueue);@*/ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c index 7a026e1ff8..01abf5409c 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c @@ -104,29 +104,24 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, { /* VeriFast: we do not verify this configuration option */ #if ( configUSE_QUEUE_SETS == 1 ) + { + if( pxQueue->pxQueueSetContainer != NULL ) { - if( pxQueue->pxQueueSetContainer != NULL ) + if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) + { + /* Do not notify the queue set as an existing item + * was overwritten in the queue so the number of items + * in the queue has not changed. */ + mtCOVERAGE_TEST_MARKER(); + } + else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) { - if( ( xCopyPosition == queueOVERWRITE ) && ( uxPreviousMessagesWaiting != ( UBaseType_t ) 0 ) ) + /* The queue is a member of a queue set, and posting + * to the queue set caused a higher priority task to + * unblock. A context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) { - /* Do not notify the queue set as an existing item - * was overwritten in the queue so the number of items - * in the queue has not changed. */ - mtCOVERAGE_TEST_MARKER(); - } - else if( prvNotifyQueueSetContainer( pxQueue ) != pdFALSE ) - { - /* The queue is a member of a queue set, and posting - * to the queue set caused a higher priority task to - * unblock. A context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) - { - *pxHigherPriorityTaskWoken = pdTRUE; - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + *pxHigherPriorityTaskWoken = pdTRUE; } else { @@ -135,20 +130,20 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, } else { - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + mtCOVERAGE_TEST_MARKER(); + } + } + else + { + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + { + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + /* The task waiting has a higher priority so + * record that a context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) { - /* The task waiting has a higher priority so - * record that a context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) - { - *pxHigherPriorityTaskWoken = pdTRUE; - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + *pxHigherPriorityTaskWoken = pdTRUE; } else { @@ -160,23 +155,23 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, mtCOVERAGE_TEST_MARKER(); } } + else + { + mtCOVERAGE_TEST_MARKER(); + } } + } #else /* configUSE_QUEUE_SETS */ + { + if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) { - if( listLIST_IS_EMPTY( &( pxQueue->xTasksWaitingToReceive ) ) == pdFALSE ) + if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) { - if( xTaskRemoveFromEventList( &( pxQueue->xTasksWaitingToReceive ) ) != pdFALSE ) + /* The task waiting has a higher priority so record that a + * context switch is required. */ + if( pxHigherPriorityTaskWoken != NULL ) { - /* The task waiting has a higher priority so record that a - * context switch is required. */ - if( pxHigherPriorityTaskWoken != NULL ) - { - *pxHigherPriorityTaskWoken = pdTRUE; - } - else - { - mtCOVERAGE_TEST_MARKER(); - } + *pxHigherPriorityTaskWoken = pdTRUE; } else { @@ -187,12 +182,17 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, { mtCOVERAGE_TEST_MARKER(); } + } + else + { + mtCOVERAGE_TEST_MARKER(); + } - /* Not used in this path. */ + /* Not used in this path. */ #ifndef VERIFAST /*< void cast of unused var */ - ( void ) uxPreviousMessagesWaiting; + ( void ) uxPreviousMessagesWaiting; #endif - } + } #endif /* configUSE_QUEUE_SETS */ } else diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c index efdfe54f2d..596d1ec43a 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c @@ -54,9 +54,9 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, /* Cannot block if the scheduler is suspended. */ #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) - { - configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); - } + { + configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); + } #endif #endif @@ -144,7 +144,7 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, taskEXIT_CRITICAL(); /* Interrupts and other tasks can send to and receive from the queue - * now the critical section has been exited. */ + * now that the critical section has been exited. */ /*@close exists(pxQueue);@*/ vTaskSuspendAll(); diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c index 83c5439e25..2f16e095ef 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c @@ -53,9 +53,9 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, /* Cannot block if the scheduler is suspended. */ #if ( ( INCLUDE_xTaskGetSchedulerState == 1 ) || ( configUSE_TIMERS == 1 ) ) - { - configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); - } + { + configASSERT( !( ( xTaskGetSchedulerState() == taskSCHEDULER_SUSPENDED ) && ( xTicksToWait != 0 ) ) ); + } #endif #endif From e9689c28ae7ff7321009b92eedba50838396e94f Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Thu, 4 Aug 2022 15:57:45 -0400 Subject: [PATCH 3/7] Remove git hash check --- FreeRTOS/Test/VeriFast/Makefile | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/FreeRTOS/Test/VeriFast/Makefile b/FreeRTOS/Test/VeriFast/Makefile index 4fa652d255..476a6721c1 100644 --- a/FreeRTOS/Test/VeriFast/Makefile +++ b/FreeRTOS/Test/VeriFast/Makefile @@ -49,18 +49,3 @@ list: .PHONY: proof_changes proof_changes: @git grep "if[n]*def VERIFAST" | cut -f 3- -d ' ' | sort | uniq - -GIT?=git -NO_CHANGE_CHECKOUT_DIR=no-change-check-freertos-kernel -NO_CHANGE_EXPECTED_HASH_QUEUE = ec62f69dab7 -NO_CHANGE_EXPECTED_HASH_QUEUE_HEADER = ec62f69dab7 -NO_CHANGE_EXPECTED_HASH_LIST = ec62f69dab7 -NO_CHANGE_EXPECTED_HASH_LIST_HEADER = ec62f69dab7 -.PHONY: synced_with_source_check -synced_with_source_check: - @rm -rf $(NO_CHANGE_CHECKOUT_DIR) - @$(GIT) clone https://github.com/FreeRTOS/FreeRTOS-Kernel.git $(NO_CHANGE_CHECKOUT_DIR) - @cd $(NO_CHANGE_CHECKOUT_DIR) && $(GIT) diff --quiet $(NO_CHANGE_EXPECTED_HASH_QUEUE) queue.c - @cd $(NO_CHANGE_CHECKOUT_DIR) && $(GIT) diff --quiet $(NO_CHANGE_EXPECTED_HASH_QUEUE_HEADER) include/queue.h - @cd $(NO_CHANGE_CHECKOUT_DIR) && $(GIT) diff --quiet $(NO_CHANGE_EXPECTED_HASH_LIST) list.c - @cd $(NO_CHANGE_CHECKOUT_DIR) && $(GIT) diff --quiet $(NO_CHANGE_EXPECTED_HASH_LIST_HEADER) include/list.h From 69b9f9746f8a4402d0edf00c6bd8e745cbb200be Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Thu, 4 Aug 2022 15:58:22 -0400 Subject: [PATCH 4/7] Document new changes between proven code and implementation --- FreeRTOS/Test/VeriFast/README.md | 1 + FreeRTOS/Test/VeriFast/docs/signoff.md | 9 ++++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/FreeRTOS/Test/VeriFast/README.md b/FreeRTOS/Test/VeriFast/README.md index 5d472692f0..fe26be2c80 100644 --- a/FreeRTOS/Test/VeriFast/README.md +++ b/FreeRTOS/Test/VeriFast/README.md @@ -56,6 +56,7 @@ Then click `Verify` and `Verify Program` (or press F5). Note that the following proofs require arithmetic overflow checking to be turned off (click `Verify` and uncheck `Check arithmetic overflow`). + - `queue/create.c` - `queue/prvCopyDataToQueue.c` - `queue/xQueueGenericSendFromISR.c` - `queue/xQueueReceiveFromISR.c` diff --git a/FreeRTOS/Test/VeriFast/docs/signoff.md b/FreeRTOS/Test/VeriFast/docs/signoff.md index 71af7ddbf7..8a3dbd4758 100644 --- a/FreeRTOS/Test/VeriFast/docs/signoff.md +++ b/FreeRTOS/Test/VeriFast/docs/signoff.md @@ -71,16 +71,19 @@ A side-by-side diff with respect to the source code can be generated. See The main queue changes are: - merge cTxLock and cRxLock critical regions: under approximate queue - unlock behavior to atomically set `cTxLock` and `cRxLock` to unlocked in a + unlock behavior to atomically set `cTxLock` and `cRxLock` to unlocked in a single critical region instead of two separate critical regions. In - practice, this is not an issue since no ISR function reads-from both + practice, this is not an issue since no ISR function reads-from both cTxLock and cRxLock. - model single malloc of struct and buffer: split the single malloc of the queue struct and storage into two separate mallocs. - xQueueGenericReset happens-before concurrent behavior: assume that queue initialisation is not concurrent. - do not model pxIndex and xListEnd of xLIST struct: ignore these fields in - the list structs of the queue implementation + the list structs of the queue implementation. + - we do not use the prvIncrementQueueTxLock or prvIncrementQueueRxLock macros + in xQueueGenericSendFromISR and xQueueReceiveFromISR functions. + - we prove an older version of xQueueGenericReset that always resets a queue The main list changes are: From dce0315f8b9697359c1595a77a6571b155c880eb Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Thu, 4 Aug 2022 17:53:16 -0400 Subject: [PATCH 5/7] Update copyright header --- FreeRTOS/Test/VeriFast/include/proof/common.gh | 2 +- FreeRTOS/Test/VeriFast/include/proof/list.h | 2 +- FreeRTOS/Test/VeriFast/include/proof/queue.h | 2 +- FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h | 2 +- FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c | 2 +- FreeRTOS/Test/VeriFast/list/uxListRemove.c | 2 +- FreeRTOS/Test/VeriFast/list/vListInitialise.c | 2 +- FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c | 2 +- FreeRTOS/Test/VeriFast/list/vListInsert.c | 2 +- FreeRTOS/Test/VeriFast/list/vListInsertEnd.c | 2 +- FreeRTOS/Test/VeriFast/queue/create.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvLockQueue.c | 2 +- FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c | 2 +- FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c | 2 +- FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c | 2 +- FreeRTOS/Test/VeriFast/queue/vQueueDelete.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueuePeek.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueReceive.c | 2 +- FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c | 2 +- 28 files changed, 28 insertions(+), 28 deletions(-) diff --git a/FreeRTOS/Test/VeriFast/include/proof/common.gh b/FreeRTOS/Test/VeriFast/include/proof/common.gh index 3dc140a5f3..0e9351b3fe 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/common.gh +++ b/FreeRTOS/Test/VeriFast/include/proof/common.gh @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/include/proof/list.h b/FreeRTOS/Test/VeriFast/include/proof/list.h index 3800114434..f7211814a3 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/list.h +++ b/FreeRTOS/Test/VeriFast/include/proof/list.h @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/include/proof/queue.h b/FreeRTOS/Test/VeriFast/include/proof/queue.h index df28e78624..72c67bf9a1 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queue.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queue.h @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h index 1c1282831a..f600f93355 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c index 6003bdcbea..d331207766 100644 --- a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c +++ b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/uxListRemove.c b/FreeRTOS/Test/VeriFast/list/uxListRemove.c index 2fc1af6223..2599979f13 100644 --- a/FreeRTOS/Test/VeriFast/list/uxListRemove.c +++ b/FreeRTOS/Test/VeriFast/list/uxListRemove.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialise.c b/FreeRTOS/Test/VeriFast/list/vListInitialise.c index 128f8b8273..13ff10996f 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialise.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialise.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c b/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c index e26f751b19..82cb91f360 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/vListInsert.c b/FreeRTOS/Test/VeriFast/list/vListInsert.c index 3eb79d0bfb..9df644cf1d 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsert.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsert.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c index e7d327f3a6..4e28cb8fb3 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/create.c b/FreeRTOS/Test/VeriFast/queue/create.c index 16d88a5a38..f498996556 100644 --- a/FreeRTOS/Test/VeriFast/queue/create.c +++ b/FreeRTOS/Test/VeriFast/queue/create.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c index ce24654e37..63797a507c 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c index 6f17a8684d..2749d07d4f 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c b/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c index 21101f6c95..c7e1f0ba3b 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c +++ b/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c b/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c index 200fe8ee9c..ed08f291b7 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c +++ b/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c index b22318b1d3..82ef8152d1 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c index ef2dc20533..30bca0e0fd 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c index d61310bb49..34f8a5814f 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c index 5210f35536..c55d5257ab 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c index 44de077b78..15c699f5dd 100644 --- a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c +++ b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c index c624629d72..6863a52487 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c index 01abf5409c..1968b29ae4 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c index 8dd9f6dc30..5bf01aac90 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c index 8326d1fb23..62f75ca750 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c index 596d1ec43a..e395d4b14b 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c index eb47e2f578..cd42c34a12 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c index 2f16e095ef..c5f94f3ffa 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c index 6e731c78f9..b1246b257b 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c @@ -1,6 +1,6 @@ /* * FreeRTOS V202112.00 - * Copyright (C) Amazon.com, Inc. or its affiliates. All Rights Reserved. + * Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Permission is hereby granted, free of charge, to any person obtaining a copy of * this software and associated documentation files (the "Software"), to deal in From f78878e4cf3da49690ef82cedc94d5ad38d32e0e Mon Sep 17 00:00:00 2001 From: Nathan Chong Date: Fri, 5 Aug 2022 21:29:51 -0400 Subject: [PATCH 6/7] VeriFast proofs: turn off uncrustify checks Uncrustify requires formatting of comments that is at odds with VeriFast's proof annotations, which are contained within comments. --- FreeRTOS/Test/VeriFast/include/proof/list.h | 4 ++++ FreeRTOS/Test/VeriFast/include/proof/queue.h | 4 ++++ FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h | 4 ++++ FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c | 4 ++++ FreeRTOS/Test/VeriFast/list/uxListRemove.c | 4 ++++ FreeRTOS/Test/VeriFast/list/vListInitialise.c | 4 ++++ FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c | 4 ++++ FreeRTOS/Test/VeriFast/list/vListInsert.c | 4 ++++ FreeRTOS/Test/VeriFast/list/vListInsertEnd.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/create.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvLockQueue.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/vQueueDelete.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueuePeek.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueReceive.c | 4 ++++ FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c | 4 ++++ 27 files changed, 108 insertions(+) diff --git a/FreeRTOS/Test/VeriFast/include/proof/list.h b/FreeRTOS/Test/VeriFast/include/proof/list.h index f7211814a3..ef70811b14 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/list.h +++ b/FreeRTOS/Test/VeriFast/include/proof/list.h @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #ifndef LIST_H #define LIST_H @@ -370,3 +372,5 @@ lemma void remove_append(t x, list l1, list l2) @*/ #endif /* LIST_H */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/include/proof/queue.h b/FreeRTOS/Test/VeriFast/include/proof/queue.h index 72c67bf9a1..543e49dbec 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queue.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queue.h @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #ifndef QUEUE_H #define QUEUE_H @@ -551,3 +553,5 @@ void clearInterruptMaskFromISR(QueueHandle_t xQueue, UBaseType_t uxSavedInterrup #define portCLEAR_INTERRUPT_MASK_FROM_ISR(uxSavedInterruptStatus) clearInterruptMaskFromISR(xQueue, uxSavedInterruptStatus) #endif /* QUEUE_H */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h index f600f93355..4794be76b0 100644 --- a/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h +++ b/FreeRTOS/Test/VeriFast/include/proof/queuecontracts.h @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #ifndef QUEUECONTRACTS_H #define QUEUECONTRACTS_H @@ -59,3 +61,5 @@ BaseType_t prvIsQueueFull( Queue_t * pxQueue ); /*@ensures [1/2]queuehandle(pxQueue, N, M, is_isr);@*/ #endif /* QUEUECONTRACTS_H */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c index d331207766..88dd1a831d 100644 --- a/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c +++ b/FreeRTOS/Test/VeriFast/list/listLIST_IS_EMPTY.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" /* Wrap the macro in a function call so we can give a function contract */ @@ -38,3 +40,5 @@ BaseType_t wrapper_listLIST_IS_EMPTY( List_t * pxList ) return listLIST_IS_EMPTY( pxList ); /*@close xLIST(pxList, len, _, _, cells, vals);@*/ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/uxListRemove.c b/FreeRTOS/Test/VeriFast/list/uxListRemove.c index 2599979f13..b72cb0b725 100644 --- a/FreeRTOS/Test/VeriFast/list/uxListRemove.c +++ b/FreeRTOS/Test/VeriFast/list/uxListRemove.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" UBaseType_t uxListRemove( ListItem_t * const pxItemToRemove ) @@ -308,3 +310,5 @@ void client_example2( List_t * l ) /*@close exists(l);@*/ uxListRemove( index ); } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialise.c b/FreeRTOS/Test/VeriFast/list/vListInitialise.c index 13ff10996f..5c22953f2f 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialise.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialise.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" /*@ @@ -84,3 +86,5 @@ void vListInitialise( List_t * const pxList ) /*@close DLS(end, end, end, end, singleton(end), singleton(portMAX_DELAY), pxList);@*/ /*@close xLIST(pxList, 0, end, end, singleton(end), singleton(portMAX_DELAY));@*/ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c b/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c index 82cb91f360..0eb802e4d0 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c +++ b/FreeRTOS/Test/VeriFast/list/vListInitialiseItem.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" void vListInitialiseItem( ListItem_t * const pxItem ) @@ -39,3 +41,5 @@ void vListInitialiseItem( ListItem_t * const pxItem ) listSET_SECOND_LIST_ITEM_INTEGRITY_CHECK_VALUE( pxItem ); /*@close xLIST_ITEM(pxItem, _, _, _, NULL);@*/ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/vListInsert.c b/FreeRTOS/Test/VeriFast/list/vListInsert.c index 9df644cf1d..9a0278a841 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsert.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsert.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" @@ -321,3 +323,5 @@ void vListInsert( List_t * const pxList, } }@*/ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c index 4e28cb8fb3..fb1b14d995 100644 --- a/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c +++ b/FreeRTOS/Test/VeriFast/list/vListInsertEnd.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/list.h" void vListInsertEnd( List_t * const pxList, @@ -236,3 +238,5 @@ void client_example1( List_t * const l, ListItem_t * const pxNewListItem ) { vListInsertEnd(l, pxNewListItem); } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/create.c b/FreeRTOS/Test/VeriFast/queue/create.c index f498996556..3db29e6e8a 100644 --- a/FreeRTOS/Test/VeriFast/queue/create.c +++ b/FreeRTOS/Test/VeriFast/queue/create.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" /* Simplifying assumption: we do not verify queue initialisation in a @@ -281,3 +283,5 @@ static void prvInitialiseNewQueue( const UBaseType_t uxQueueLength, return pxNewQueue; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c index 63797a507c..2aba73c1a1 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataFromQueue.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" static void prvCopyDataFromQueue( Queue_t * const pxQueue, @@ -91,3 +93,5 @@ void caller_reinstates_queue_predicate( Queue_t * const pxQueue, pxQueue->uxMessagesWaiting = pxQueue->uxMessagesWaiting - 1; /*@deq_lemma(K, (R+1)%N, contents, abs, head(abs));@*/ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c index 2749d07d4f..0cc1c48610 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvCopyDataToQueue.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, @@ -188,3 +190,5 @@ static BaseType_t prvCopyDataToQueue( Queue_t * const pxQueue, @*/ return xReturn; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c b/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c index c7e1f0ba3b..6bd8fdb5a4 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c +++ b/FreeRTOS/Test/VeriFast/queue/prvIsQueueEmpty.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #define taskENTER_CRITICAL() setInterruptMask( pxQueue ) #define taskEXIT_CRITICAL() clearInterruptMask( pxQueue ) @@ -51,3 +53,5 @@ static BaseType_t prvIsQueueEmpty( const Queue_t * pxQueue ) return xReturn; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c b/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c index ed08f291b7..ec2b841287 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c +++ b/FreeRTOS/Test/VeriFast/queue/prvIsQueueFull.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #define taskENTER_CRITICAL() setInterruptMask( pxQueue ) #define taskEXIT_CRITICAL() clearInterruptMask( pxQueue ) @@ -51,3 +53,5 @@ static BaseType_t prvIsQueueFull( const Queue_t * pxQueue ) return xReturn; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c index 82ef8152d1..490c30457e 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvLockQueue.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" /* In this case we cannot wrap the macro in a function call to give a function @@ -71,3 +73,5 @@ void wrapper_prvLockQueue( QueueHandle_t xQueue ) mutex_acquire( xQueue->locked ); #endif } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c index 30bca0e0fd..e9fa8318dd 100644 --- a/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c +++ b/FreeRTOS/Test/VeriFast/queue/prvUnlockQueue.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #define taskENTER_CRITICAL() setInterruptMask( pxQueue ) #define taskEXIT_CRITICAL() clearInterruptMask( pxQueue ) @@ -164,3 +166,5 @@ static void prvUnlockQueue( Queue_t * const pxQueue ) mutex_release( pxQueue->locked ); #endif } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c index 34f8a5814f..22132b935a 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueMessagesWaiting.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" /* It may seem that the read of `pxQueue->uxMessagesWaiting` is required to be @@ -71,3 +73,5 @@ UBaseType_t uxQueueMessagesWaiting( const QueueHandle_t xQueue ) return uxReturn; } /*lint !e818 Pointer cannot be declared const as xQueue is a typedef not pointer. */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c index c55d5257ab..5188e004b9 100644 --- a/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c +++ b/FreeRTOS/Test/VeriFast/queue/uxQueueSpacesAvailable.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" UBaseType_t uxQueueSpacesAvailable( const QueueHandle_t xQueue ) @@ -51,3 +53,5 @@ UBaseType_t uxQueueSpacesAvailable( const QueueHandle_t xQueue ) return uxReturn; } /*lint !e818 Pointer cannot be declared const as xQueue is a typedef not pointer. */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c index 15c699f5dd..22d2a7d144 100644 --- a/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c +++ b/FreeRTOS/Test/VeriFast/queue/vQueueDelete.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #define configSUPPORT_DYNAMIC_ALLOCATION 1 #define configSUPPORT_STATIC_ALLOCATION 0 @@ -82,3 +84,5 @@ void vQueueDelete( QueueHandle_t xQueue ) } #endif /* configSUPPORT_DYNAMIC_ALLOCATION */ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c index 6863a52487..68f1f57f95 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSend.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -287,3 +289,5 @@ BaseType_t xQueueGenericSend( QueueHandle_t xQueue, } } /*lint -restore */ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c index 1968b29ae4..a99d46cd4a 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueGenericSendFromISR.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -237,3 +239,5 @@ BaseType_t xQueueGenericSendFromISR( QueueHandle_t xQueue, return xReturn; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c index 5bf01aac90..3946a89d09 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueEmptyFromISR.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" BaseType_t xQueueIsQueueEmptyFromISR( const QueueHandle_t xQueue ) @@ -52,3 +54,5 @@ BaseType_t xQueueIsQueueEmptyFromISR( const QueueHandle_t xQueue ) return xReturn; } /*lint !e818 xQueue could not be pointer to const because it is a typedef. */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c index 62f75ca750..9ad48cd732 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueIsQueueFullFromISR.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" BaseType_t xQueueIsQueueFullFromISR( const QueueHandle_t xQueue ) @@ -52,3 +54,5 @@ BaseType_t xQueueIsQueueFullFromISR( const QueueHandle_t xQueue ) return xReturn; } /*lint !e818 xQueue could not be pointer to const because it is a typedef. */ + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c index e395d4b14b..cded678802 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeek.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -210,3 +212,5 @@ BaseType_t xQueuePeek( QueueHandle_t xQueue, } } /*lint -restore */ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c index cd42c34a12..30fe8ced85 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueuePeekFromISR.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -92,3 +94,5 @@ BaseType_t xQueuePeekFromISR( QueueHandle_t xQueue, return xReturn; } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c index c5f94f3ffa..d741b861d2 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceive.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -208,3 +210,5 @@ BaseType_t xQueueReceive( QueueHandle_t xQueue, } } /*lint -restore */ } + +/* *INDENT-ON* */ diff --git a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c index b1246b257b..2d5a7f36aa 100644 --- a/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c +++ b/FreeRTOS/Test/VeriFast/queue/xQueueReceiveFromISR.c @@ -24,6 +24,8 @@ * */ +/* *INDENT-OFF* */ + #include "proof/queue.h" #include "proof/queuecontracts.h" @@ -138,3 +140,5 @@ BaseType_t xQueueReceiveFromISR( QueueHandle_t xQueue, return xReturn; } + +/* *INDENT-ON* */ From 8aa216a9c4f51ac142cc22168cc2e2b40e94535e Mon Sep 17 00:00:00 2001 From: Aniruddha Kanhere <60444055+AniruddhaKanhere@users.noreply.github.com> Date: Thu, 27 Oct 2022 13:59:23 -0700 Subject: [PATCH 7/7] Update ci.yml --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc72f56394..89e4097b03 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -114,7 +114,7 @@ jobs: # Add path to the tool to the environment variable. PATH=$PATH:commonCI/spellings/tools # Make sure that only Amazon licenced files are checked. - sed -i 's/`find $DIRNAME \\( -iname \\\*\.\[ch\] -o -iname \\\*\.dox \\) -type f`/`grep -ril "copyright \(c\) \[0-9\]\[0-9\]\[0-9\]\[0-9\] amazon.com" | grep "\\.\[ch\]"`/g' commonCI/spellings/tools/find-unknown-comment-words + sed -i 's/`find $DIRNAME \\( -iname \\\*\.\[ch\] -o -iname \\\*\.dox \\) -type f`/`grep -ril "copyright \(c\) \[0-9\]\[0-9\]\[0-9\]\[0-9\] amazon.com" | grep "\\.\[ch\]" | grep -v "FreeRTOS\/FreeRTOS\/Test\/VeriFast"`/g' commonCI/spellings/tools/find-unknown-comment-words # Run the spell check script. find-unknown-comment-words --directory FreeRTOS/ --lexicon FreeRTOS/lexicon.txt # Check the exit status.