theory Invoke_C

lemma pspace_no_overlap_underlying_zero_update:
  "pspace_no_overlap' ptr sz s
    \<Longrightarrow> invs' s
    \<Longrightarrow> S \<subseteq> {ptr .. (ptr && ~~ mask sz) + 2 ^ sz - 1}
    \<Longrightarrow> s\<lparr>ksMachineState := underlying_memory_update
      (\<lambda>m x. if x \<in> S then 0 else m x) (ksMachineState s)\<rparr>
        = s" apply (subgoal_tac "\<forall>x \<in> S. underlying_memory (ksMachineState s) x = 0") apply (cases "ksMachineState s") apply (cases s, simp add: fun_eq_iff split: if_split) apply (clarsimp split: if_split_asm) apply (erule pspace_no_overlap_underlying_zero) apply (simp add: invs'_def valid_state'_def) apply blast done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> s\<lparr>ksMachineState := underlying_memory_update (\<lambda>m x. if x \<in> S then 0 else m x) (ksMachineState s)\<rparr> = s proof (prove)
goal (2 subgoals):
 1. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; \<forall>x\<in>S. underlying_memory (ksMachineState s) x = 0\<rbrakk> \<Longrightarrow> s\<lparr>ksMachineState := underlying_memory_update (\<lambda>m x. if x \<in> S then 0 else m x) (ksMachineState s)\<rparr> = s
 2. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> \<forall>x\<in>S. underlying_memory (ksMachineState s) x = 0 proof (prove)
goal (2 subgoals):
 1. \<And>irq_masks irq_state underlying_memorya device_state exclusive_state machine_state_rest. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; \<forall>x\<in>S. underlying_memory (ksMachineState s) x = 0; ksMachineState s = \<lparr>irq_masks = irq_masks, irq_state = irq_state, underlying_memory = underlying_memorya, device_state = device_state, exclusive_state = exclusive_state, machine_state_rest = machine_state_rest\<rparr>\<rbrakk> \<Longrightarrow> s\<lparr>ksMachineState := underlying_memory_update (\<lambda>m x. if x \<in> S then 0 else m x) (ksMachineState s)\<rparr> = s
 2. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> \<forall>x\<in>S. underlying_memory (ksMachineState s) x = 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> \<forall>x\<in>S. underlying_memory (ksMachineState s) x = 0 proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pspace_no_overlap' ptr sz s; invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; x \<in> S\<rbrakk> \<Longrightarrow> underlying_memory (ksMachineState s) x = 0 proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; x \<in> S\<rbrakk> \<Longrightarrow> valid_machine_state' s
 2. \<And>x. \<lbrakk>invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; x \<in> S\<rbrakk> \<Longrightarrow> x \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>invs' s; S \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; x \<in> S\<rbrakk> \<Longrightarrow> x \<in> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} proof (prove)
goal:
No subgoals!