theory ArchArch_IF

lemma find_pd_for_asid_assert_reads_respects:
  "reads_respects aag l (pas_refined aag and pspace_aligned and valid_vspace_objs
                                         and K (is_subject_asid aag asid))
                  (find_pd_for_asid_assert asid)" unfolding find_pd_for_asid_assert_def apply (wpsimp wp: get_pde_rev find_pd_for_asid_reads_respects hoare_vcg_all_lift) apply (rule_tac Q'="\<lambda>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits)"
                in hoare_post_imp_R) apply (rule find_pd_for_asid_pd_slot_authorised) apply (rename_tac rv s) apply (subgoal_tac "lookup_pd_slot rv 0 = rv") apply fastforce apply (simp add: lookup_pd_slot_def) apply fastforce done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. reads_respects aag l (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) (find_pd_for_asid_assert asid) proof (prove)
goal (1 subgoal):
 1. reads_respects aag l (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) (do pd <- find_pd_for_asid asid <catch> K fail;
get_pde pd;
return pd
od) proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'40\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>r s. is_subject aag (r && ~~ mask pd_bits)\<rbrace>, -
 2. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> ?P'40 x proof (prove)
goal (3 subgoals):
 1. \<lbrace>?P'40\<rbrace> find_pd_for_asid asid \<lbrace>\<lambda>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits)\<rbrace>, -
 2. \<And>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits) \<Longrightarrow> is_subject aag (rv && ~~ mask pd_bits)
 3. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> ?P'40 x proof (prove)
goal (2 subgoals):
 1. \<And>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits) \<Longrightarrow> is_subject aag (rv && ~~ mask pd_bits)
 2. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> (pas_refined aag and K (is_subject_asid aag asid) and pspace_aligned and valid_vspace_objs) x proof (prove)
goal (2 subgoals):
 1. \<And>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits) \<Longrightarrow> is_subject aag (rv && ~~ mask pd_bits)
 2. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> (pas_refined aag and K (is_subject_asid aag asid) and pspace_aligned and valid_vspace_objs) x proof (prove)
goal (3 subgoals):
 1. \<And>rv s. \<lbrakk>is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits); lookup_pd_slot rv 0 = rv\<rbrakk> \<Longrightarrow> is_subject aag (rv && ~~ mask pd_bits)
 2. \<And>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits) \<Longrightarrow> lookup_pd_slot rv 0 = rv
 3. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> (pas_refined aag and K (is_subject_asid aag asid) and pspace_aligned and valid_vspace_objs) x proof (prove)
goal (2 subgoals):
 1. \<And>rv s. is_subject aag (lookup_pd_slot rv 0 && ~~ mask pd_bits) \<Longrightarrow> lookup_pd_slot rv 0 = rv
 2. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> (pas_refined aag and K (is_subject_asid aag asid) and pspace_aligned and valid_vspace_objs) x proof (prove)
goal (1 subgoal):
 1. \<And>x. (pas_refined aag and pspace_aligned and valid_vspace_objs and K (is_subject_asid aag asid)) x \<Longrightarrow> (K (is_subject_asid aag asid) and (\<lambda>_. True)) x \<and> True \<and> (pas_refined aag and K (is_subject_asid aag asid) and pspace_aligned and valid_vspace_objs) x proof (prove)
goal:
No subgoals!