Verus 37/39, rivet artifacts updated, Mathlib integration - #2
Merged
Conversation
Verus: expanded to 37/39 modules. Fixed userspace (replaced bitmask flags with bool fields, u64 perms with [bool;64], === for spec eq) and mem_domain (loop restructuring, preconditions, arithmetic fixes). Only poll and sched remain excluded (Verus language limitations). Rivet: updated 31 FV artifact statuses (draft→approved), added 7 new artifacts (FV-ERR/PRI/THR/WQ-001, FV-TM/EV/MS-002). No hardcoded counts in descriptions. Lean+Mathlib: wired Mathlib v4.27.0 via rules_lean. Scheduling.lean now uses ring/norm_num instead of manual commutativity chains. Added lake update timeout patch for initial Mathlib fetch. verus-strip --standalone: expanded stubs with full Thread/WaitQueue/ Priority method implementations. Fixed inner doc comment conversion and Verus assert-by-bit_vector stripping. All 9 Rocq translations now compile from standalone output. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Apr 30, 2026
Three correctness fixes from the Mythos audit (10 personas, 1 fresh-session validator). All three are confirmed by the partial CSV from run 25135494876 — none of them is hypothetical. B2 — actuator_done stale-token drain (P1 #1): ctrl_loop's K_MSEC(2) timeout path on actuator_done leaves the sem token uncollected if the actuator gives later. The next cycle's k_sem_take returns 0 immediately, reads a previous-cycle g_actuator_done_cyc, and computes t_round = old_done_cyc - new_t_post_out which underflows to ~2^32 cycles. Add a drain loop before each k_msgq_put to flush stale tokens. B3 — slot collision wrap (P1 #3): Bump SLOT_COUNT 512 → 1024 so the per-cell sensor-ISR budget (1000 in the trimmed long sweep) cannot wrap within a single cell. Cross-cell wrap remains harmless: sweep_driver stops the sensor timer and drains the reader between cells, so any in-flight controller stamps from cell X land in slots the reader has already consumed before cell X+1 starts. RAM cost: 5 arrays × 512 × 4 bytes = +10 KB. RAM use 41,488 B → 51,728 B (78.9 %); FLASH +52 B. B4 — emit_ring drops counter (P4 #2): ring_buf_put failures into emit_ring were silently dropped. gale's potentially-faster sem_give could mean the reader drains emit_ring better → fewer dropped emits → more rows in gale's CSV than baseline → biased comparison. Add g_emit_drops volatile, emit it in the === END === footer, and assert == 0 in the analyzer for both variants. Forces both onto the same denominator. Build clean for qemu_cortex_m3 baseline (16,444 B FLASH, 51,728 B RAM = 78.9 %). Audit cross-references: P1 (Cortex-M RTOS engineer) — B2, B3 P4 (counter-attacker) — B4 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5 tasks
avrabe
added a commit
that referenced
this pull request
May 1, 2026
…28) * experiment: add GALE_USE_SYNTH build mode (wasm → synth → Cortex-M) When GALE_USE_SYNTH=ON, the gale-ffi crate is compiled to wasm32 first, then run through the synth AOT compiler (pulseengine/synth) which emits a Cortex-M ET_REL relocatable object. The object is wrapped into the same libgale_ffi.a path the rest of the build expects via ar, so the per-module gale_sem.c / gale_mutex.c / etc. consumers need no changes. This is the build-system half of the 4th-variant experiment for the cross-language LTO blog post: same engine bench, three existing builds (GCC baseline / GCC + Gale / LLVM + LTO + Gale) plus a 4th data point where verified Rust reaches Cortex-M via Verus → rustc → wasm → synth's Rocq-proved i32 instruction selection. Requires synth with --relocatable flag (pulseengine/synth#83). Default behaviour (GALE_USE_SYNTH=OFF) is unchanged: rustc-direct-to-Cortex-M is still the production path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: add engine-bench-renode-synth workflow for the 4th-variant experiment Adds the gale-via-synth lane to the engine-bench Renode matrix as a follow-up to the cross-language LTO post. Builds the GCC baseline and the GALE_USE_SYNTH=ON variant (wasm32 -> synth -> Cortex-M ET_REL -> libgale_ffi.a) on the same CI run, then sweeps both through Renode at the long sample count. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci+cmake: insert wasm-opt + loom optional passes before synth Adds two optional formally-verified-(or-not) wasm optimizers between rustc and synth in the GALE_USE_SYNTH pipeline: rustc -> [wasm-opt -Oz] -> [loom optimize] -> synth -> ar -> .a Both are detected via find_program() and only inserted into the pipeline if found. If neither is on the path the pipeline reduces to rustc -> synth (unchanged behaviour). Effect on engine bench (stm32f4_disco, prj-gale.conf, GCC C kernel): synth alone: text=22448, total=38533 synth + wasm-opt + loom: text=22420, total=38505 (-28 B) Wasm-level reduction is dramatic (-34% from wasm-opt -Oz), but the synth-emitted ARM code is dominated by per-function instruction selection overhead, so the final ELF only moves a few dozen bytes. The verification-chain story is the bigger win: loom proves each pass it applies preserves semantics; rejected passes are skipped rather than applied unsoundly. CI workflow installs both: binaryen apt package (wasm-opt) and loom-cli from pulseengine/loom main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: trigger engine-bench-renode-synth on push to experiment branch workflow_dispatch alone requires the workflow to exist on the default branch before it can be invoked, which we can't do without merging the whole experiment first. Adding a push trigger on experiment/gale-via-synth so the workflow auto-runs whenever the experiment branch advances. Strip this trigger before any merge to main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: fix cargo install syntax (--git takes package name positional, not --path) cargo install --git URL --path PATH is invalid — the two flags are mutually exclusive. When installing a sub-crate from a git workspace, pass the package name as a positional argument: cargo install --git URL [--branch B] PACKAGE_NAME --force Fixes the workflow's synth-cli install (was rejected with: 'the argument --git <URL> cannot be used with --path <PATH>') and the identical pattern used for loom-cli. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * workaround: synth --no-optimize (regalloc clobbers param registers in optimize mode) Diagnosed during local debugging: synth's optimized register-allocation path clobbers r0/r1 (input parameter registers) at function entry when the wasm body pushes i32 constants before the first local.get. The function's prologue ends up looking like: movs r0, #1 ← clobbers param 0 (count) movs r1, #0 ← clobbers param 1 (limit) ... cmp r0, r1 ← compares clobbered values, not the actual params This crashes the engine bench in Renode (HardFault on first gale call, infinite handler loop, never reaches the test's Zero Drops assertion). The CI run hit a 60-min step timeout without producing a single sample. Minimal repro saved at /tmp/match_gale.wat (3 i32 params, i64 local, push 3 i32 constants, then local.get 0). Worth filing as a synth issue once the experiment lands. Workaround: synth --no-optimize. Disables the offending pass and emits proper AAPCS prologue (push r4..r8/lr, locals on stack, params read from r0/r1/r2 unchanged). Verified locally: same gale_k_sem_give_decide function now starts with `stmdb sp!, {r4..r8, lr}` and reads r0/r1 correctly. Cost: ~68 bytes of additional flash (22624 → 22692) and unknown cycles. The --no-optimize path uses stack-based locals which is wasteful but correct. Stack frame size also goes up — synth reserves ~4KB per function for locals which may be excessive; will need to validate no stack overflow on the engine bench worker thread. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: install synth from fix/synth-i64-locals-and-frame to pick up i64+frame fixes The previous CI run booted Zephyr with the synth-built ELF but every RPM step reported count=0 [drain_timeout]. Diagnosed two synth bugs: 1. i64 local storage dropped the upper half (--no-optimize path) 2. Locals area aliased the saved-register spill (also --no-optimize) Both fixed in pulseengine/synth#85. This commit points the workflow at that branch so the next CI run uses the fixed synth. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: re-trigger with synth fix/synth-i64-locals-and-frame@b8da214 Pulls in: - explicit I64Or/And/Xor/ExtendI32U/ExtendI32S/Shl/ShrU/ShrS handlers in synth's select_with_stack (no more wildcard fallthrough to select_default's R0:R1/R2:R3 assumption) - alloc_consecutive_pair now reserves implicit pair_hi of every stack entry plus extra_avoid for popped operands Local build verified: gale_k_sem_give_decide ends with orr r0, r6, r8 orr r1, r7, ip matching the wasm i64.or semantics. 22644 B FLASH. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci(investigate): skip loom install to A/B test cycle delta source Tracing the −34.5% handoff cycle delta in the synth bench. Found that loom's optimizer hoists `local.set 3 = 0` from the fall-through arm of gale_k_sem_give_decide to BEFORE the dispatcher, dropping the WakeThread/Increment distinction at the wasm level — synth then emits ARM that always returns action=INCREMENT regardless of has_waiter. The bench passes (samples=7750, drops=0) because the engine_control worker is rarely actually blocked at sem_give time, so the WAKE path is rarely needed for correctness. But the cycle delta is then comparing a degenerate always-INCREMENT path to rustc's correct WAKE/INCREMENT discrimination — apples to oranges. This run skips loom in CI so we can A/B against the loom-on result and validate the hypothesis. CMakeLists' find_program(LOOM) fails when loom isn't on PATH, falling through to wasm-opt -> synth without loom. Filed for follow-up: pulseengine/loom optimizer bug. The hoisting is unsound for this control-flow pattern. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci(investigate): A/B same ELFs under Renode nightly to attribute -34.5% delta The container ships Renode 1.16.0 (ARG RENODE_VERSION=1.16.0 in zephyrproject-rtos/docker-image Dockerfile.base, unchanged across v0.28.x..v0.29.2). 1.16.1 (Feb 2026) touches several Cortex-M paths that could shift cycle accounting on the gale instruction stream: fixed ARMv8-M Thumb2 data-processing instructions, fixed Stack Pointer bits[1:0] handling, fixed wrong exception when FPU is disabled. None is labelled a cycle-counter fix in the changelog, but Thumb-2 dispatch changes shift cycle accounting whenever an instruction takes a different micro-op path. Adds nightly Renode (builds.renode.io) alongside 1.16.0 and runs the same two ELFs under both. Yields three controls: (a) baseline vs gale, both under nightly — does the gale delta change when the cycle model changes? (b) baseline_1.16.0 vs baseline_nightly (same ELF) — control: cycle-model drift on identical instructions. (c) gale_1.16.0 vs gale_nightly (same ELF) — does the model shift gale's instructions more than baseline's? If yes, the 1.16.0 model is mis-scoring gale-specific instructions and the delta is partly artifactual. Implementation: PATH override puts /opt/renode-nightly first for the two new run steps. Robot file unchanged (it reads ELF / BENCH_CSV_OUT from env). Existing 1.16.0 comparison is undisturbed; nightly outputs go to events-nightly.csv and a separate report section. Timeout bumped 120 -> 240 min to cover all four Renode runs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight_control: macro-bench skeleton (Phases 1-4) Add the six-thread / two-timer / five-primitive macro benchmark described in docs/research/macro-bench-design.md. Composes ring_buf + sem + mutex + msgq + condvar on a 100 Hz fixed-rate flight-control loop, capturing per-sensor-ISR algo + handoff (engine_control parity) plus per-controller-period t_lock, t_post, t_round, t_bcast. Single CSV row per sensor sample with -1 sentinels for the segments not measured on that row (~9-of-10 cycles have no t_bcast, ~9-of-10 sensor rows have no t_lock/t_post/t_round). 3-axis sweep (sensor_hz x contention x payload) totalling ~4500 events on the long sweep, matching engine_control's Renode lane density. Verified: - Builds clean for qemu_cortex_m3 (baseline + gale variants). - QEMU smoke run: 150/150 samples, drops=0, telemetry_emits=11 (priority inheritance keeps the lowest-priority telemetry thread alive under fusion/actuator contention). - All four new cycle-delta segments populate as expected. Two-ring split (sensor_ring -> fusion -> emit_ring -> reader) avoids the single-sem race where reader_loop and the fusion thread would otherwise compete for sensor_data_ready and steal samples from each other. Reader thread runs at priority 10 (below all workers) so its UART back-pressure never starves the measured chain. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight_control: analyzer + QEMU runner + Renode robot (Phase 5a) Add analyze.py extending engine_control's per-step + Mann-Whitney shape with four new metric columns (t_lock, t_post, t_round, t_bcast). Negative values in the new columns are the "not measured on this row" sentinel and are filtered out per metric. New asserts beyond the engine_control set: - telemetry_emits > 0 on both variants (design doc Section "Risks": priority-inheritance must keep the lowest-priority telemetry thread off the starvation floor) - gale p99 <= 2 * baseline p99 on each of t_lock, t_post, t_round, t_bcast (one regression guard per primitive segment) run_qemu_bench.sh + tag_events.py mirror engine_control's shape 1:1 (same env conventions, same per-run-id tagging). Renode robot file is engine_stm32f4.robot with the wait line updated to match the macro bench's startup banner. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * ci: add engine-bench-renode-flight workflow (Phase 5b) Modeled on engine-bench-renode-synth.yml, runs the new macro benchmark on stm32f4_disco under Renode for the long sweep (~4500 events). Same variant matrix (baseline + gale), same artifact upload shape, same MD report rendered into the job summary. Triggered on push to experiment/macro-bench-flight-control and manually via workflow_dispatch. Uses only safe GitHub contexts (github.workspace, github.ref) — no untrusted inputs flow into shell commands. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight: emit controller-rate rows only; trim long sweep to 9 cells Run 25135494876 timed out at step 13 of 27 (120-min budget) because the bench emitted one row per sensor ISR (~1 kHz) of which only ~5% carried t_lock/t_post/t_round/t_bcast — controller runs at 100 Hz, so the matching pair-tag covers 1 in ~10 sensor rows, and the partial CSV shows only 109 of 2012 emitted rows had a real measurement. The other 95% were near-empty rows starving Renode at the UART. Two changes, applied together: 1. emit_event returns bool. Rows whose slot has no controller-cycle pair-tag (t_lock == 0) are dropped. reader_count++ only when a row was actually emitted; reader_skipped tracks the dropped sensor-rate rows for visibility. UART traffic falls ~10x. 2. Long sweep trimmed from 27 cells (sensor_hz x contention x payload) to 9 cells (sensor_hz=1000 only x 3 contention x 3 payload). The sensor_hz=2000 axis was the timeout cause; sensor_hz=500 carries identical primitive signal at lower rate. Per-cell sensor budget bumped from 150–200 to 1000 so each cell yields ~100 controller- tagged rows (samples * 100 / sensor_hz). TOTAL_SAMPLES recomputed to 900. The drain loop is rewritten in controller-rate units: it now waits for `expected_ctrl = samples * 100 / sensor_hz` rows to land, with a short 5s drain timeout because the cell already waited budget_ms for sensor ISRs to retire. CI timeout bumped 120 -> 180 min. Workflow comment block updated to match. Per audit P3 #1 #5 (cycle-delta column names) and the partial-CSV diagnostic from run 25135494876. Local build clean for both qemu_cortex_m3 baseline (16,392 B FLASH, 41,488 B RAM) and gale variant (18,480 B FLASH, 41,488 B RAM). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight: audit fixes B2/B3/B4 (stale-token drain, slot wrap, emit_drops) Three correctness fixes from the Mythos audit (10 personas, 1 fresh-session validator). All three are confirmed by the partial CSV from run 25135494876 — none of them is hypothetical. B2 — actuator_done stale-token drain (P1 #1): ctrl_loop's K_MSEC(2) timeout path on actuator_done leaves the sem token uncollected if the actuator gives later. The next cycle's k_sem_take returns 0 immediately, reads a previous-cycle g_actuator_done_cyc, and computes t_round = old_done_cyc - new_t_post_out which underflows to ~2^32 cycles. Add a drain loop before each k_msgq_put to flush stale tokens. B3 — slot collision wrap (P1 #3): Bump SLOT_COUNT 512 → 1024 so the per-cell sensor-ISR budget (1000 in the trimmed long sweep) cannot wrap within a single cell. Cross-cell wrap remains harmless: sweep_driver stops the sensor timer and drains the reader between cells, so any in-flight controller stamps from cell X land in slots the reader has already consumed before cell X+1 starts. RAM cost: 5 arrays × 512 × 4 bytes = +10 KB. RAM use 41,488 B → 51,728 B (78.9 %); FLASH +52 B. B4 — emit_ring drops counter (P4 #2): ring_buf_put failures into emit_ring were silently dropped. gale's potentially-faster sem_give could mean the reader drains emit_ring better → fewer dropped emits → more rows in gale's CSV than baseline → biased comparison. Add g_emit_drops volatile, emit it in the === END === footer, and assert == 0 in the analyzer for both variants. Forces both onto the same denominator. Build clean for qemu_cortex_m3 baseline (16,444 B FLASH, 51,728 B RAM = 78.9 %). Audit cross-references: P1 (Cortex-M RTOS engineer) — B2, B3 P4 (counter-attacker) — B4 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight: B1 — column-semantics block in main.c + analyzer report The column names (t_round, t_bcast) are inherited from the design doc, but the actual measurement windows are narrower than the names suggest: - t_round is named "round-trip" but measures only controller_post_exit → actuator-0 stamp; it does NOT include the controller's post-wake sem_take. It also includes actuator 0's cycles_busy=100 busy-loop (same for both variants). - t_bcast is named "broadcast" but measures the broadcaster's own lock+broadcast+unlock window on the fusion thread; the telemetry wake is never sampled. Per audit P3 #1 #5: a reader who treats these names as stated will over-attribute the measurement scope. The cheapest fix that protects publication credibility is to define the columns precisely where the reader will look — at the top of the analyzer's markdown report and in main.c's file header. Numbers stay; honest scope-setting is appended. CSV column positions are unchanged so engine_control's analyzer docstring's "strict superset" claim remains true. Build clean; analyzer parses. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight CI: D6 — manifest.txt artifact (single point of provenance) Per audit P9: a reader downloading flight-bench-renode-long.zip six months from now should be able to identify exactly which Renode, Zephyr fork, rustc, SDK, and gale_sha produced the cycles. Without this, "I ran exactly this configuration" reduces to "trust the gale_sha and hope nothing else moved" — but every input below the gale repo (Zephyr fork at branch tip, container at mutable tag, rustc on stable channel) is a moving target. Adds one new step "Compose build manifest" right before the upload step. The manifest captures: rustc / cargo / west / robotframework / SDK versions, Renode 1.16.0 version, Zephyr fork + modules sha via `west list`, and sha256 + byte-size of every built ELF and emitted CSV. Output goes to /tmp/manifest.txt and is included in the artifact bundle. Both ELFs are also uploaded so binary-level reproducibility can be verified. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * flight: B5 — moving-block bootstrap CI on pooled p99 + multi-comparison note Per audit P4 #6 / P2 F1 / P2 F2: the flight bench reports per-step medians with naive-bootstrap CI and pooled p99 as a point estimate with no CI. Two related issues: 1. The bench's samples are consecutive 100 Hz controller cycles — autocorrelated. A slow noise burst contaminates 5–10 consecutive samples; naive bootstrap underestimates the CI by treating dependent samples as independent. Politis-Romano predict the correction factor is ~sqrt((1+ρ)/(1-ρ)) for first-order auto- correlation. 2. The Mann-Whitney p-values are reported uncorrected across 162 simultaneous tests (27 cells × 6 metrics). At α=0.05 under H0 that yields ~8 false-positive cells by chance; a reader scanning the per-step table for "where did gale win?" will pick those up as signal. Fixes: - New helper `block_bootstrap_percentile_ci` (block_size=10, iters=2000). Used for pooled p50/p75/p95/p99 in the per-metric pooled tables. Per-step medians keep the naive bootstrap (median is robust to autocorrelation; the issue is tails, not central tendency). - One-paragraph note above the pooled tables explains the bootstrap choice and points readers at Holm-Bonferroni / BH-FDR for the per-step MW-U cells. Smoke-tested against engine_control's events.csv (different schema so 0 rows, but the report header + column-semantics block render correctly). Block bootstrap on synthetic xs=range(100) gives p99 CI [66, 98] for point=98 — wider than naive, as expected. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
May 10, 2026
Pushed the wasm-cross-LTO experiment all the way to a buildable bench ELF integrated via wasm-ld+arm-ar+linker-substitute. Discovered an additional synth backend bug while attempting silicon measurement: synth's emitted memset/memcpy/memmove don't terminate correctly on Zephyr's startup `memset(bss, 0, sizeof(bss))` invocation. The chip hangs in memset+0x4c forever, bouncing between offsets 0x668 and 0x67e in a tight inner loop. The synth disassembly reveals i64 shift instructions (`subs.w r3, r2, #32; rsb r3, r2, #32; lsl.w r3, r1, r3`) lowered into what should be a byte-counter loop — same root cause as the u64-packed FFI return codegen issue documented earlier: synth's i64 codegen is incomplete. End-to-end status: - wasm-ld static-merging: WORKS. shim.wasm.o + libgale_ffi.a → 1MB merged.wasm with z_impl_k_sem_give and gale_k_sem_give_decide both present. - synth inlining at merged-module scope: STRUCTURALLY WORKS. The output `z_impl_k_sem_give` body has zero bl gale_k_sem_give_decide instructions. Verified by disassembly. 138 bytes vs LLVM-LTO's 82 bytes — 1.68x larger but inlined. - Bench integration: BUILDS. CMake bench builds with -DGALE_WASM_LTO_OVERRIDE_SEM_GIVE=1 + custom libgale_ffi.a + --allow-multiple-definition. Final ELF 219 KB FLASH, 66 KB RAM. - Chip boot: BLOCKED. PC stuck in synth-emitted memset. Workarounds via objcopy --weaken-symbol, --strip-symbol, --redefine-sym all failed to evict synth's broken memset bytes from the final ELF. Three synth backend issues filed against pulseengine/synth, ordered: 1. (blocker) memset/memcpy/memmove i64-codegen non-termination — prevents the merged-wasm bench from booting at all. 2. u64-packed FFI return unpacking — ~50% of the LTO-parity size delta. Same i64-codegen root cause as #1. 3. wasm linear-memory access lowering — ~20% of the size delta. Cosmetic compared to #1 and #2. Plus one issue against pulseengine/loom: - Z3 SortDiffers panic in inline_functions pass on i64-heavy wasm modules. Without loom, the verified-LTO claim doesn't hold. The structural claim — "wasm-cross-LTO via PulseEngine pipeline dissolves the C↔Rust seam at wasm IR level" — is **proven by disassembly**. The cyclical claim — "silicon timing matches LLVM-LTO" — is **blocked on synth's memset codegen**. Neither is a fundamental architectural barrier; both are well-scoped engineering work. This commit only updates the NOTES with the integration findings. The bench source is restored to clean state (the gale_sem.c #ifndef edit was transient) and verified building unchanged at 27 KB FLASH at the canonical rustc-direct path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Jun 3, 2026
…lidated) synth v0.11.27 = #231 (RV32 caller-saved-preference allocator) + #233 (signed-div overflow-guard fix for #232). Re-measured all four wasm-cross-LTO leaves on qemu_riscv32 -icount: all functionally correct, all now 0 callee-saved spills. filter_axis 37->23 (2.18x->1.35x) control_step 141->129 (2.27x->2.08x) controller_step 114->100 (2.33x->2.04x) flat_flight 193->181 (2.57x->2.41x, composed - benefits least) filter_axis + flat_flight (embeds it) were broken on v0.11.26 by #232 and are restored here; the new RV32 funccheck lane caught it. Next lever for the composed path: const-CSE + cross-statement local promotion (Opt3 increment #2). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Jun 3, 2026
…rgets) Disassembled flat_flight's v0.11.27 RV32 output to localize why the composed path barely moved (2.57x->2.41x) while leaves nearly halved. Three measured levers, posted to synth #209: const-CSE (37 const-loads, 16 distinct = 57% redundant), pressure-aware s-reg spilling (flat_flight spills 17 instr to a 32B stack frame because caller-saved t-pool is exhausted), mv-coalescing (38 mv = 20%). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Jun 24, 2026
…TM32F100 (M3) (#103) * feat(gust): on-silicon DWT cycle TCB for two boards — NUCLEO-G474RE (M4) + STM32F100 (M3) silicon_bench: one bare-metal TCB measuring true hardware cycles (DWT CYCCNT, not qemu -icount) for native (LLVM) vs dissolved (synth) gust_mix, on BOTH PulseEngine silicon targets. The board only changes the memory map, target triple, and the dissolved object; the DWT counter is identical on M3/M4 so the numbers compare directly. - src/bin/silicon_bench.rs — enables DWT, correctness-gates [0,2047], times native vs dissolved, semihosting output. Runs on M3 + M4 (and qemu as a self-check; qemu's lm3s model reports 0 cycles — DWT unimplemented there). - silicon/{memory-g474re.x,memory-f100.x} — per-board maps (G474RE: flash 0x08000000/512K, RAM 96K; F100: 128K/8K). - silicon/run.sh {g474re|f100} — swaps the map, builds the right target, flashes + captures via probe-rs. GUST_MIX_O overrides the object for the fusion comparison. - silicon/README.md — the two-board table + the run/compare recipe. Two gotchas found + fixed (both silently produced an empty ELF): 1. a synth --target cortex-m3 .o does NOT link into a thumbv7em (M4) image — ARMv7-M attributes; the G474RE needs a --target cortex-m4 object (gust_mix-cm4.o, added). build.rs selects by cargo TARGET. (The cortex-m4 object is also the right artifact for the M4-vs-LLVM comparison, synth#428.) 2. .cargo/config.toml had -Tlink.x only for thumbv7m; added the thumbv7em target. Gives the synth#428 precondition-#2 (G474RE DWT) path now and the F100 number when the board arrives. Existing qemu benches unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gust): real G474RE DWT results — cmp→select fusion 2.21×→2.00× on M4 silicon, correctness identical (synth#428 precond-2) Flashed silicon_bench on the physical NUCLEO-G474RE via probe-rs (STLink V3). gust_mix native (LLVM thumbv7em) vs dissolved (synth cortex-m4), real DWT cycles, correctness bit-identical [0,2047] in both states: flag-off : native 29.0 / dissolved 64.0 cyc → 2.21× SYNTH_CMP_SELECT_FUSE: native 29.0 / dissolved 58.0 cyc → 2.00× The cmp→select fusion is a measured -6 cyc (-9%) on-M4 win, correctness preserved → synth#428 precondition-2 (G474RE DWT no-regression) satisfied. F100 pending board. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
avrabe
added a commit
that referenced
this pull request
Jun 25, 2026
… UART driver (gale#65) (#113) * docs(gust): design spec — generic driver model via gust:hal seam (UART spike) Right-sized first bite for a generic driver-extension model: define the gust:hal WIT capability seam (dissolved driver imports, TCB bridge implements) and prove it with ONE UART driver end-to-end, protocol in verified wasm, built at three seam granularities (thin MMIO-prim / mid byte-caps / fat embassy) to MEASURE the TCB bytes each costs — the empirical answer to "how much of a driver can move into verified wasm." Pinned to the STM32VLDISCOVERY (STM32F100) Renode target (real UART.STM32_UART model, content-based Wait-For-Line correctness gate, 4th renode_test target) — the constrained device we need anyway; the fat/embassy seam is expected to NOT fit 8 KB SRAM, which is itself the proof the tiny node requires the thin seam. embassy HAL-only (kiln stays the one executor); manifest+generator deferred until Jess's ask makes driver #2 (extract from real duplication, not guess). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(gust): revise driver-model spec — F100-only, SRAM-bound, per-node composition Incorporate review feedback: - Target is the STM32F100 (Jess's device class) THROUGHOUT — no larger-device arm. Fat/embassy is the on-F100 overflow check (quantify why it can't fit 8 KB), not a path on a bigger part. - SRAM (.bss/.data) vs the 8 KB budget is the HEADLINE metric (the binding constraint), alongside TCB bytes. Flash is cheap (dissolved .text runs from 128 KB flash); SRAM = wasm linear memory / buffers / shadow stack is what binds. - Per-node bespoke composition is the core extension model: each node's image is one wasm composed with exactly the specific drivers it needs, fused + dissolved — the composition (not a fixed firmware) is the product; minimal SRAM, maximal verified surface. - XIP recorded as a follow-on lever that addresses flash/code (a library of per-node images in external flash), NOT the SRAM/buffer pressure — scoped out. - Risk: embassy-stm32 may not support F100 → fat-seam footprint taken on nearest supported F1 (F103) as proxy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(rivet): typed artifacts for the gust driver model (gust:hal seam) Traceability leads the feature loop. 15 artifacts under SYSREQ-BYOOS-001: - REQ-DRV-{SEAM,WASM,SRAM,COMPOSE,ASYNC}-001 — the seam, the verified-wasm/TCB split, the F100 8 KiB SRAM budget, per-node bespoke composition, sync+split-phase. - DD-DRV-{EMBASSY,GRAN,XIP}-001 — embassy-HAL-only/kiln-executor, granularity-by- measurement, XIP-as-flash-lever-not-SRAM. - SAC-DRV-{HAL,UART} — the gust:hal WIT seam + the UART driver (3-seam bridges). - VER-DRV-{UART-RENODE,SRAM} — the Renode content-based TX/RX gate + the SRAM budget oracle. - FIND-DRV-MEASURE-001 (the per-seam SRAM/TCB spike, results pending; feeds the perf bench) + FIND-DRV-SPAR-001 (gust:hal hand-authored, spar->WIT not wired for the wasm-component layer — friction logged). rivet validate: PASS. Design spec: docs/superpowers/specs/2026-06-25-... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gust): gust:hal seam + thin-seam UART driver in verified wasm (gale#65) The thin-seam maximal-wasm extreme, realising gale#65's "only registers/MMIO are native, everything above is wasm" on the STM32F100 px4io failsafe class. - benches/gust/drivers/wit/gust-hal.wit — the capability seam: mmio (read32/ write32/read8/write8), irq (poll, split-phase), uart-byte (mid), uart-block (fat); driver-thin/mid/fat worlds. Hand-authored (FIND-DRV-SPAR-001); Jess co-designs per gale#65. - benches/gust/drivers/uart-thin — the ENTIRE STM32 USART protocol (init, baud, TXE/RXNE poll, RX drain) in verified wasm, importing only mmio + irq. Dissolved (loom 1.1.16 + synth 0.15.0, --native-pointer-abi): **326 B flash .text, 0 B .data, 0 B .bss — ZERO SRAM** (poll-drain form), TCB = 3 import relocations (mmio_read32/write32, irq_poll), exports driver_step. The whole driver is verified; the trusted surface is the ~10-line generic bridge. Honest caveat: a buffered CCSDS-stream RX (the gale#65 real target — USART @ 1.5 Mbaud carrying relay-sec-wrapped CCSDS, which can itself dissolve to wasm) puts its ring buffer in SRAM; the protocol logic stays SRAM-free. mid/fat seam measurements + the buffered variant + the Renode F100 USART gate are next. rivet: PASS (FIND-DRV-MEASURE-001 records the thin result). Spec updated with the gale#65 requirements source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gust): verify the driver — Kani-proven RX decision (earn "verified wasm") Correcting an overclaim: the thin driver was "in wasm", not verified. gale's bar is Verus + Rocq + Kani (CLAUDE.md), and a DAL-A px4io driver (gale#65) must meet it. So the driver's pure decision now carries a real proof: - usart_rx_decide (gale _decide style): errors take priority over data-ready, so the driver provably never reads DR on an overrun/framing error (stream desync). Wired into rx_poll. **Kani: VERIFICATION SUCCESSFUL** over all 2^32 SR values (cargo kani --harness rx_decide_error_priority, 0/14 checks failed). - Re-dissolved (synth 0.15.0): 382 B flash, still 0 SRAM (was 326 B; +56 B for the verified RX gate). Design corrected accordingly: - REQ-DRV-VERIFY-001 + VER-DRV-KANI in rivet — driver logic carries Verus+Rocq+ Kani like the kernel primitives; "verified" is earned by proofs. - Verus + Rocq tracks attach on promoting the decision into the gale verified crate (src/ -> verus-strip -> plain/ -> wasm; proofs/*.v). - Buffering will REUSE the already-proven gale::msgq ring (Verus+Rocq+Kani) rather than an unverified buffer — maximal-wasm AND maximal-verified. - Only the irreducible MMIO poke stays unverified I/O (the whole TCB). rivet: PASS. Spec gains a Verification section. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(gust): gust_uart demonstrator + Renode USART wiring + synth 0.15.0 perf test The driver driven bare-metal on the M3, and the perf test the loop asked for. - gust_uart bin: the whole TRUSTED side — a ~10-line gust:hal thin bridge (mmio_read32/write32 + irq_poll) + the r11=0 trampoline (driver_step_body) + boot. Links the dissolved thin driver. build.rs wires it. - renode-test: usart1 = UART.STM32_UART @ 0x40013800 (-> nvic@37) added to stm32f100.repl + m3_64k.repl — the real STM32 USART register model. synth 0.15.0 perf test (new version), levers ON vs OFF on the UART driver: **0% delta** (382 B both, cm3==cm4) — the driver is I/O-bound (register loads/stores + poll via meld-dispatched imports), not the arithmetic the levers target (which gave gust_mix -31%). Finding for the perf loop: the optimisation opportunity for driver code is the MELD-DISPATCH import-call overhead, not the ARM peephole levers → a meld/synth recommendation. Honest status: gust_uart RUNS on the M3 (762 instr, no fault; USART SR TXE set, no TX spin). The content-based TX gate is PENDING a data-placement detail — native-pointer-abi places the TX string in the 1 MB wasm linmem at a VMA the gust linker doesn't map (control_step avoided this via its reserved-linmem .bss; this 0-bss driver's string doesn't). Resolution = the synth#383/native-pointer-abi linmem placement (or drop the string constant). Driver LOGIC is Kani-proven and dissolves clean; only the demo's string placement is pending. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(gust): UART driver works end-to-end on Renode — emits "gust-uart-thin" Resolves the data-placement blocker by the cleaner design: a driver provides PROTOCOL PRIMITIVES (uart_init/uart_tx_byte/uart_rx/uart_rx_fired) and the APP owns the payload. The driver now carries NO data segment (the earlier failure was an embedded TX string landing in the wasm 1MB linmem at a VMA the linker didn't map under native-pointer-abi). 254 B flash, 0 SRAM, no r11 trampoline needed. End-to-end on a hermetic Renode Cortex-M3 with a REAL STM32 USART model: the dissolved driver TXes over MMIO and the USART emits — captured "gust-uart-thin" (614 instr, no fault). Bonus: a real USART file-backend IS capturable headless on the macOS portable (unlike SemihostingUart), so the content gate works locally + CI. Verification intact: usart_rx_decide still Kani-proven (error-priority over all 2^32 SR values). The driver logic is verified; the app's string is plain flash. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(gust): CI content gate for the UART driver — Wait For Line on a real USART 4th renode_test target (gust-uart-renode): boots the gust_uart demonstrator on the hermetic Cortex-M3 + real STM32 USART model and asserts the dissolved driver's emitted bytes via `Wait For Line On Uart gust-uart-thin` — content on the wire, not just no-fault. Uses the terminal-tester mechanism the stm32f4 sem robots already prove in CI; a real USART captures headless (unlike the SemihostingUart, so this is a true content gate). Verified locally: the USART emits "gust-uart-thin". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(gust): run the gust-uart-renode content gate in CI Add //:gust-uart-renode to the gust-renode workflow so the UART driver's content-based TX gate (Wait For Line on a real STM32 USART) runs in CI alongside the three M3 device-class targets. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
===for spec eq) and mem_domain.rs (loop restructuring, preconditions). Only poll (mutable array indexing) and sched (fn pointers) remain excluded — both are Verus language limitations.ring/norm_numreplace manual arithmetic chains.--standalonestubs with full Thread/WaitQueue/Priority methods. All 9 Rocq translations compile from standalone output. Fixed inner doc comment and assert-by-bit_vector stripping.Test plan
bazel test //:verus_test— 37 modules verifiedbazel test //:cargo_test //:clippy_test //:fmt_test— all passbazel test //proofs:*_proofs_test— 9/9 Rocqbazel test //proofs/lean:*_test— 3/3 Lean (with Mathlib)rivet validate— artifacts consistent🤖 Generated with Claude Code