theory CSpaceInv_AI

lemma delete_duplicate_ifunsafe:
  "\<lbrace>\<lambda>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s
      \<and> if_unsafe_then_cap s \<and> valid_objs s \<and> zombies_final s\<rbrace>
     set_cap cap.NullCap p \<lbrace>\<lambda>rv s. if_unsafe_then_cap s\<rbrace>" apply (clarsimp simp: if_unsafe_then_cap_def ex_cte_cap_wp_to_def) apply (simp only: imp_conv_disj) apply (rule hoare_pre,
         wp hoare_vcg_all_lift hoare_vcg_disj_lift
            hoare_vcg_ex_lift) apply (rule hoare_use_eq [where f=interrupt_irq_node]) apply (wp set_cap_cte_wp_at)+ apply simp apply (elim conjE allEI) apply (clarsimp del: disjCI intro!: disjCI2) apply (case_tac "(a, b) = p") apply (simp cong: conj_cong add: cte_wp_at_weakenE [OF _ TrueI]) apply (simp add: cte_wp_at_def | elim exE conjE)+ apply (frule(4) not_final_another_cte) apply (simp, elim exEI, clarsimp) apply (fastforce elim!: cte_wp_at_weakenE) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> if_unsafe_then_cap s \<and> valid_objs s \<and> zombies_final s\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv. if_unsafe_then_cap\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv s. \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) \<noteq> Some cap \<or> \<not> cap \<noteq> NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv s. \<forall>a b cap. caps_of_state s (a, b) \<noteq> Some cap \<or> \<not> cap \<noteq> NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>a b cap aa ba. \<lbrace>?P18 a b cap aa ba\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s\<rbrace>
 2. \<And>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) \<noteq> Some cap \<or> \<not> cap \<noteq> NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s \<Longrightarrow> \<forall>x xa xb. ((caps_of_state s)(p \<mapsto> NullCap)) (x, xa) \<noteq> Some xb \<or> \<not> xb \<noteq> NullCap \<or> (\<exists>xc xd. ?P18 x xa xb xc xd s) proof (prove)
goal (3 subgoals):
 1. \<And>a b cap aa ba P. \<lbrace>\<lambda>s. P (interrupt_irq_node s)\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv s. P (interrupt_irq_node s)\<rbrace>
 2. \<And>a b cap aa ba f. \<lbrace>?P20 a b cap aa ba f\<rbrace> set_cap NullCap p \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c f) (aa, ba)\<rbrace>
 3. \<And>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) \<noteq> Some cap \<or> \<not> cap \<noteq> NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s \<Longrightarrow> \<forall>x xa xb. ((caps_of_state s)(p \<mapsto> NullCap)) (x, xa) \<noteq> Some xb \<or> \<not> xb \<noteq> NullCap \<or> (\<exists>xc xd. ?P20 x xa xb xc xd (interrupt_irq_node s) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) \<noteq> Some cap \<or> \<not> cap \<noteq> NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s \<Longrightarrow> \<forall>x xa xb. ((caps_of_state s)(p \<mapsto> NullCap)) (x, xa) \<noteq> Some xb \<or> \<not> xb \<noteq> NullCap \<or> (\<exists>xc xd. ((\<lambda>sa. if (xc, xd) = p then appropriate_cte_cap xb NullCap \<and> (x, xa) \<in> cte_refs NullCap (interrupt_irq_node s) else cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) sa) and cte_wp_at (\<lambda>_. True) p) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s \<and> (\<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> cap = NullCap \<or> (\<exists>aa ba. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (a, b) \<in> cte_refs c (interrupt_irq_node s)) (aa, ba) s)) \<and> valid_objs s \<and> zombies_final s \<Longrightarrow> \<forall>x xa. (x, xa) \<noteq> p \<longrightarrow> (\<forall>xb. caps_of_state s (x, xa) = Some xb \<longrightarrow> xb = NullCap \<or> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s) proof (prove)
goal (1 subgoal):
 1. \<And>s x xa. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; \<forall>cap. caps_of_state s (x, xa) = Some cap \<longrightarrow> cap = NullCap \<or> (\<exists>a b. cte_wp_at (\<lambda>c. appropriate_cte_cap cap c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s)\<rbrakk> \<Longrightarrow> (x, xa) \<noteq> p \<longrightarrow> (\<forall>xb. caps_of_state s (x, xa) = Some xb \<longrightarrow> xb = NullCap \<or> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s) proof (prove)
goal (1 subgoal):
 1. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) = p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s
 2. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) p s; (a, b) = p\<rbrakk> \<Longrightarrow> \<exists>xc xd. (xc, xd) \<noteq> p \<and> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s
 2. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb a b cap capa. \<lbrakk>valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; (a, b) = p; capa = cap; \<not> is_final_cap' cap s; fst (get_cap p s) = {(cap, s)}; appropriate_cte_cap xb cap; (x, xa) \<in> cte_refs cap (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> \<exists>xc xd. (xc, xd) \<noteq> p \<and> (\<exists>cap. fst (get_cap (xc, xd) s) = {(cap, s)} \<and> appropriate_cte_cap xb cap \<and> (x, xa) \<in> cte_refs cap (interrupt_irq_node s))
 2. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb a b cap capa. \<lbrakk>valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; (a, b) = p; capa = cap; \<not> is_final_cap' cap s; fst (get_cap p s) = {(cap, s)}; appropriate_cte_cap xb cap; (x, xa) \<in> cte_refs cap (interrupt_irq_node s); \<exists>p' cap'. p' \<noteq> p \<and> fst (get_cap p' s) = {(cap', s)} \<and> (\<forall>y. cte_refs cap' y = cte_refs cap y) \<and> (\<forall>cp. appropriate_cte_cap cp cap' = appropriate_cte_cap cp cap) \<and> \<not> is_final_cap' cap' s\<rbrakk> \<Longrightarrow> \<exists>xc xd. (xc, xd) \<noteq> p \<and> (\<exists>cap. fst (get_cap (xc, xd) s) = {(cap, s)} \<and> appropriate_cte_cap xb cap \<and> (x, xa) \<in> cte_refs cap (interrupt_irq_node s))
 2. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal (1 subgoal):
 1. \<And>s x xa xb a b. \<lbrakk>cte_wp_at (\<lambda>cap. \<not> is_final_cap' cap s) p s; valid_objs s; zombies_final s; (x, xa) \<noteq> p; caps_of_state s (x, xa) = Some xb; xb \<noteq> NullCap; cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (a, b) s; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> (\<exists>xc xd. (xc, xd) \<noteq> p \<and> ((xc, xd) \<noteq> p \<longrightarrow> cte_wp_at (\<lambda>c. appropriate_cte_cap xb c \<and> (x, xa) \<in> cte_refs c (interrupt_irq_node s)) (xc, xd) s)) \<and> cte_wp_at (\<lambda>_. True) p s proof (prove)
goal:
No subgoals!