theory IpcCancel_R

lemma cancelAllIPC_valid_objs'[wp]:
  "\<lbrace>valid_objs'\<rbrace> cancelAllIPC ep \<lbrace>\<lambda>rv. valid_objs'\<rbrace>" apply (simp add: cancelAllIPC_def ep'_Idle_case_helper  cong del: if_cong) apply (rule hoare_seq_ext [OF _ get_ep_sp']) apply (rule hoare_pre) apply (wp set_ep_valid_objs' setSchedulerAction_valid_objs') apply (rule_tac Q="\<lambda>rv s. valid_objs' s \<and> (\<forall>x\<in>set (epQueue ep). tcb_at' x s)"
                    in hoare_post_imp) apply simp apply (simp add: Ball_def) apply (wp mapM_x_wp' sts_valid_objs'
              hoare_vcg_all_lift hoare_vcg_const_imp_lift)+ apply simp apply (simp add: valid_tcb_state'_def) apply (wp set_ep_valid_objs' hoare_vcg_all_lift hoare_vcg_const_imp_lift) apply (clarsimp) apply (frule(1) ko_at_valid_objs') apply (simp add: projectKOs) apply (clarsimp simp: valid_obj'_def valid_ep'_def) apply (case_tac epa, simp_all) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs'\<rbrace> cancelAllIPC ep \<lbrace>\<lambda>rv. valid_objs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs'\<rbrace> do epa <- getEndpoint ep;
if epa = Structures_H.endpoint.IdleEP then return () else do y <- setEndpoint ep Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue epa);
rescheduleRequired
od
od \<lbrace>\<lambda>rv. valid_objs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>epa. \<lbrace>valid_objs' and ko_at' epa ep\<rbrace> if epa = Structures_H.endpoint.IdleEP then return () else do y <- setEndpoint ep Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue epa);
rescheduleRequired
od \<lbrace>\<lambda>rv. valid_objs'\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>epa. \<lbrace>?Q4 epa\<rbrace> if epa = Structures_H.endpoint.IdleEP then return () else do y <- setEndpoint ep Structures_H.endpoint.IdleEP;
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue epa);
rescheduleRequired
od \<lbrace>\<lambda>rv. valid_objs'\<rbrace>
 2. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> ?Q4 epa s proof (prove)
goal (3 subgoals):
 1. \<And>ep y. ep \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?B10 ep y\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue ep) \<lbrace>\<lambda>ya. valid_objs'\<rbrace>
 2. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>?B10 epa\<rbrace>
 3. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (4 subgoals):
 1. \<And>ep y rv s. \<lbrakk>ep \<noteq> Structures_H.endpoint.IdleEP; valid_objs' s \<and> (\<forall>x\<in>set (epQueue ep). tcb_at' x s)\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>ep y. ep \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?B10 ep y\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue ep) \<lbrace>\<lambda>rv s. valid_objs' s \<and> (\<forall>x\<in>set (epQueue ep). tcb_at' x s)\<rbrace>
 3. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>?B10 epa\<rbrace>
 4. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (3 subgoals):
 1. \<And>ep y. ep \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?B10 ep y\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue ep) \<lbrace>\<lambda>rv s. valid_objs' s \<and> (\<forall>x\<in>set (epQueue ep). tcb_at' x s)\<rbrace>
 2. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>?B10 epa\<rbrace>
 3. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (3 subgoals):
 1. \<And>ep. ep \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?B10 ep ()\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) (epQueue ep) \<lbrace>\<lambda>rv s. valid_objs' s \<and> (\<forall>x. x \<in> set (epQueue ep) \<longrightarrow> tcb_at' x s)\<rbrace>
 2. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>?B10 epa\<rbrace>
 3. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (3 subgoals):
 1. \<And>ep x s. \<lbrakk>ep \<noteq> Structures_H.endpoint.IdleEP; x \<in> set (epQueue ep); valid_objs' s \<and> (\<forall>x. x \<in> set (epQueue ep) \<longrightarrow> tcb_at' x s)\<rbrakk> \<Longrightarrow> (valid_objs' and valid_tcb_state' Structures_H.thread_state.Restart) s \<and> (\<forall>x. x \<in> set (epQueue ep) \<longrightarrow> tcb_at' x s)
 2. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a b. valid_objs' b \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x b)\<rbrace>
 3. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (3 subgoals):
 1. \<And>ep x s. \<lbrakk>ep \<noteq> Structures_H.endpoint.IdleEP; x \<in> set (epQueue ep); valid_objs' s \<and> (\<forall>x. x \<in> set (epQueue ep) \<longrightarrow> tcb_at' x s)\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s
 2. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a b. valid_objs' b \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x b)\<rbrace>
 3. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (2 subgoals):
 1. \<And>epa. epa \<noteq> Structures_H.endpoint.IdleEP \<Longrightarrow> \<lbrace>?R8 epa\<rbrace> setEndpoint ep Structures_H.endpoint.IdleEP \<lbrace>\<lambda>a b. valid_objs' b \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x b)\<rbrace>
 2. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> ?R8 epa s) proof (prove)
goal (1 subgoal):
 1. \<And>epa s. (valid_objs' and ko_at' epa ep) s \<Longrightarrow> (epa = Structures_H.endpoint.IdleEP \<longrightarrow> valid_objs' s) \<and> (epa \<noteq> Structures_H.endpoint.IdleEP \<longrightarrow> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) s \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x s)) proof (prove)
goal (1 subgoal):
 1. \<And>epa s. \<lbrakk>valid_objs' s; ko_at' epa ep s; epa \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> valid_ep' Structures_H.endpoint.IdleEP s \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x s) proof (prove)
goal (2 subgoals):
 1. \<And>epa s ko. \<lbrakk>valid_objs' s; ko_at' epa ep s; epa \<noteq> Structures_H.endpoint.IdleEP; projectKO_opt ko = Some epa\<rbrakk> \<Longrightarrow> injectKO epa = ko
 2. \<And>epa s. \<lbrakk>valid_objs' s; ko_at' epa ep s; epa \<noteq> Structures_H.endpoint.IdleEP; valid_obj' (injectKO epa) s\<rbrakk> \<Longrightarrow> valid_ep' Structures_H.endpoint.IdleEP s \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x s) proof (prove)
goal (1 subgoal):
 1. \<And>epa s. \<lbrakk>valid_objs' s; ko_at' epa ep s; epa \<noteq> Structures_H.endpoint.IdleEP; valid_obj' (injectKO epa) s\<rbrakk> \<Longrightarrow> valid_ep' Structures_H.endpoint.IdleEP s \<and> (\<forall>x. x \<in> set (epQueue epa) \<longrightarrow> tcb_at' x s) proof (prove)
goal (1 subgoal):
 1. \<And>epa s x. \<lbrakk>valid_objs' s; ko_at' epa ep s; epa \<noteq> Structures_H.endpoint.IdleEP; case epa of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts; x \<in> set (epQueue epa)\<rbrakk> \<Longrightarrow> tcb_at' x s proof (prove)
goal:
No subgoals!