theory RPCFrom

lemma RPCFrom_increment_64_nf:
  notes seL4_SetMR_wp[wp] seL4_GetMR_wp[wp]
  shows
  "\<lbrace>\<lambda>s5'. globals_frame_intact s5' \<and>
          is_valid_w64 s5' (ptr_coerce x) \<and>
          ipc_buffer_valid s5'\<rbrace>
   RPCFrom_increment_64' x
  \<lbrace>\<lambda>_ s5'. globals_frame_intact s5' \<and>
           is_valid_w64 s5' (ptr_coerce x) \<and>
           ipc_buffer_valid s5'\<rbrace>!" apply (simp add:RPCFrom_increment_64'_def) apply (wp seL4_Call_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp+ apply (simp add:globals_frame_intact_def ipc_buffer_valid_def
                  setMRs_def setMR_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s5'. globals_frame_intact s5' \<and> is_valid_w64 s5' (PTR_COERCE(64 word \<rightarrow> 64 word) x) \<and> ipc_buffer_valid s5'\<rbrace> RPCFrom_increment_64' x \<lbrace>\<lambda>_ s5'. globals_frame_intact s5' \<and> is_valid_w64 s5' (PTR_COERCE(64 word \<rightarrow> 64 word) x) \<and> ipc_buffer_valid s5'\<rbrace>! proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s5'. globals_frame_intact s5' \<and> is_valid_w64 s5' x \<and> ipc_buffer_valid s5'\<rbrace> do y <- exec_concrete lift_global_heap (seL4_SetMR' 0 5);
y <- guard (\<lambda>s. is_valid_w64 s x);
mr___unsigned'param <- gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x));
y <- exec_concrete lift_global_heap (seL4_SetMR' 1 mr___unsigned'param);
y <- guard (\<lambda>s. is_valid_w64 s x);
mr___unsigned'param <- gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x >> 32));
y <- exec_concrete lift_global_heap (seL4_SetMR' 2 mr___unsigned'param);
ret' <- seL4_MessageInfo_new' 0 0 0 3;
ret' <- seL4_Call' 6 ret';
ret' <- seL4_GetMR' 0;
y <- guard (\<lambda>s. is_valid_w64 s x);
y <- modify (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) ret')));
ret' <- seL4_GetMR' 1;
y <- guard (\<lambda>s. is_valid_w64 s x);
modify (\<lambda>s. heap_w64_update (\<lambda>a. a(x := heap_w64 s x || (UCAST(32 \<rightarrow> 64) ret' << 32))) s)
od \<lbrace>\<lambda>_ s5'. globals_frame_intact s5' \<and> is_valid_w64 s5' x \<and> ipc_buffer_valid s5'\<rbrace>! proof (prove)
goal (9 subgoals):
 1. \<And>xa y mr___unsigned'param ya yb mr___unsigned'parama yc. \<lbrace>?B10 xa y mr___unsigned'param ya yb mr___unsigned'parama yc\<rbrace> seL4_MessageInfo_new' 0 0 0 3 \<lbrace>\<lambda>ret' s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>xa v0 v1 v2 v3 xb. 0 \<le> 0 \<and> 0 < 120 \<and> globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> (\<forall>xa. 0 \<le> 1 \<and> 1 < 120 \<and> globals_frame_intact (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) \<and> ipc_buffer_valid (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) \<and> (globals_frame_intact (heap_w64_update (\<lambda>a. a(x := heap_w64 (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) x || (UCAST(32 \<rightarrow> 64) xa << 32))) (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3))) \<and> is_valid_w64 (heap_w64_update (\<lambda>a. a(x := heap_w64 (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) x || (UCAST(32 \<rightarrow> 64) xa << 32))) (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3))) x \<and> ipc_buffer_valid (heap_w64_update (\<lambda>a. a(x := heap_w64 (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) x || (UCAST(32 \<rightarrow> 64) xa << 32))) (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)))) \<and> is_valid_w64 (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xb)) (setMRs s v0 v1 v2 v3)) x) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) x)\<rbrace>!
 2. \<And>x y mr___unsigned'param ya yb mr___unsigned'parama. \<lbrace>?B9 x y mr___unsigned'param ya yb mr___unsigned'parama\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 2 mr___unsigned'parama) \<lbrace>?B10 x y mr___unsigned'param ya yb mr___unsigned'parama\<rbrace>!
 3. \<And>xa y mr___unsigned'param ya yb. \<lbrace>?B8 xa y mr___unsigned'param ya yb\<rbrace> gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x >> 32)) \<lbrace>?B9 xa y mr___unsigned'param ya yb\<rbrace>!
 4. \<And>xa y mr___unsigned'param ya. \<lbrace>?B7 xa y mr___unsigned'param ya\<rbrace> guard (\<lambda>s. is_valid_w64 s x) \<lbrace>?B8 xa y mr___unsigned'param ya\<rbrace>!
 5. \<And>x y mr___unsigned'param. \<lbrace>?B6 x y mr___unsigned'param\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 1 mr___unsigned'param) \<lbrace>?B7 x y mr___unsigned'param\<rbrace>!
 6. \<And>xa y. \<lbrace>?B5 xa y\<rbrace> gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x)) \<lbrace>?B6 xa y\<rbrace>!
 7. \<And>xa. \<lbrace>?B4 xa\<rbrace> guard (\<lambda>s. is_valid_w64 s x) \<lbrace>?B5 xa\<rbrace>!
 8. \<lbrace>?Q3\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 0 5) \<lbrace>?B4\<rbrace>!
 9. \<And>s. globals_frame_intact s \<and> is_valid_w64 s x \<and> ipc_buffer_valid s \<Longrightarrow> ?Q3 s proof (prove)
goal (9 subgoals):
 1. \<And>mr___unsigned'param mr___unsigned'parama. \<lbrace>?B10 () () mr___unsigned'param () () mr___unsigned'parama ()\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>x. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 3) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret' s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> (\<forall>xa. globals_frame_intact (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa)) (setMRs s v0 v1 v2 v3)) \<and> ipc_buffer_valid (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa)) (setMRs s v0 v1 v2 v3)) \<and> (\<forall>xb. globals_frame_intact (heap_w64_update ((\<lambda>a. a(x := ((heap_w64 (setMRs s v0 v1 v2 v3))(x := UCAST(32 \<rightarrow> 64) xa)) x || (UCAST(32 \<rightarrow> 64) xb << 32))) \<circ> (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa))) (setMRs s v0 v1 v2 v3)) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) x \<and> ipc_buffer_valid (heap_w64_update ((\<lambda>a. a(x := ((heap_w64 (setMRs s v0 v1 v2 v3))(x := UCAST(32 \<rightarrow> 64) xa)) x || (UCAST(32 \<rightarrow> 64) xb << 32))) \<circ> (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa))) (setMRs s v0 v1 v2 v3)) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) x) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) x))\<rbrace>!
 2. \<And>x y mr___unsigned'param ya yb mr___unsigned'parama. \<lbrace>?B9 x y mr___unsigned'param ya yb mr___unsigned'parama\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 2 mr___unsigned'parama) \<lbrace>?B10 x y mr___unsigned'param ya yb mr___unsigned'parama\<rbrace>!
 3. \<And>xa y mr___unsigned'param ya yb. \<lbrace>?B8 xa y mr___unsigned'param ya yb\<rbrace> gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x >> 32)) \<lbrace>?B9 xa y mr___unsigned'param ya yb\<rbrace>!
 4. \<And>xa y mr___unsigned'param ya. \<lbrace>?B7 xa y mr___unsigned'param ya\<rbrace> guard (\<lambda>s. is_valid_w64 s x) \<lbrace>?B8 xa y mr___unsigned'param ya\<rbrace>!
 5. \<And>x y mr___unsigned'param. \<lbrace>?B6 x y mr___unsigned'param\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 1 mr___unsigned'param) \<lbrace>?B7 x y mr___unsigned'param\<rbrace>!
 6. \<And>xa y. \<lbrace>?B5 xa y\<rbrace> gets (\<lambda>s. UCAST(64 \<rightarrow> 32) (heap_w64 s x)) \<lbrace>?B6 xa y\<rbrace>!
 7. \<And>xa. \<lbrace>?B4 xa\<rbrace> guard (\<lambda>s. is_valid_w64 s x) \<lbrace>?B5 xa\<rbrace>!
 8. \<lbrace>?Q3\<rbrace> exec_concrete lift_global_heap (seL4_SetMR' 0 5) \<lbrace>?B4\<rbrace>!
 9. \<And>s. globals_frame_intact s \<and> is_valid_w64 s x \<and> ipc_buffer_valid s \<Longrightarrow> ?Q3 s proof (prove)
goal (1 subgoal):
 1. \<And>s. globals_frame_intact s \<and> is_valid_w64 s x \<and> ipc_buffer_valid s \<Longrightarrow> globals_frame_intact s \<and> ipc_buffer_valid s \<and> 0 \<le> 0 \<and> 0 < 120 \<and> (\<forall>xa. (globals_frame_intact (setMR s (nat 0) 5) \<and> ipc_buffer_valid (setMR s (nat 0) 5) \<and> 0 \<le> 1 \<and> 1 < 120 \<and> (\<forall>xa. (globals_frame_intact (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) \<and> ipc_buffer_valid (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) \<and> 0 \<le> 2 \<and> 2 < 120 \<and> (\<forall>xa xb. globals_frame_intact (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) \<and> ipc_buffer_valid (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3) \<and> (\<forall>xa. globals_frame_intact (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa)) (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3)) \<and> ipc_buffer_valid (heap_w64_update (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa)) (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3)) \<and> (\<forall>xb. globals_frame_intact (heap_w64_update ((\<lambda>a. a(x := ((heap_w64 (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3))(x := UCAST(32 \<rightarrow> 64) xa)) x || (UCAST(32 \<rightarrow> 64) xb << 32))) \<circ> (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa))) (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3)) \<and> is_valid_w64 (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3) x \<and> ipc_buffer_valid (heap_w64_update ((\<lambda>a. a(x := ((heap_w64 (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3))(x := UCAST(32 \<rightarrow> 64) xa)) x || (UCAST(32 \<rightarrow> 64) xb << 32))) \<circ> (\<lambda>a. a(x := UCAST(32 \<rightarrow> 64) xa))) (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3)) \<and> is_valid_w64 (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3) x) \<and> is_valid_w64 (setMRs (setMR (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) (nat 2) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x >> 32))) v0 v1 v2 v3) x)))) \<and> is_valid_w64 (setMR (setMR s (nat 0) 5) (nat 1) (UCAST(64 \<rightarrow> 32) (heap_w64 (setMR s (nat 0) 5) x))) x)) \<and> is_valid_w64 (setMR s (nat 0) 5) x) proof (prove)
goal:
No subgoals!