theory IsolatedThreadAction

lemma oblivious_getObject_ksPSpace_cte[simp]:
  "\<lbrakk> \<forall>s. ksPSpace (f s) = ksPSpace s \<rbrakk> \<Longrightarrow>
   oblivious f (getObject p :: cte kernel)" apply (simp add: getObject_def split_def loadObject_cte
                   projectKO_def2 alignCheck_assert magnitudeCheck_assert
                   typeError_def unless_when
             cong: Structures_H.kernel_object.case_cong) apply (intro oblivious_bind,
         simp_all split: Structures_H.kernel_object.split if_split) by (safe intro!: oblivious_bind, simp_all)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>s. ksPSpace (f s) = ksPSpace s \<Longrightarrow> oblivious f (getObject p) proof (prove)
goal (1 subgoal):
 1. \<forall>s. ksPSpace (f s) = ksPSpace s \<Longrightarrow> oblivious f (do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
case snd pa of KOTCB tcb \<Rightarrow> do y <- assert (is_aligned (fst pa) (objBits tcb));
y <- assert (case snd (lookupAround2 p map) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits tcb \<le> z - fst pa);
if p - fst pa = tcbVTableSlot << objBits undefined then return (tcbVTable tcb) else if p - fst pa = tcbCTableSlot << objBits undefined then return (tcbCTable tcb) else if p - fst pa = tcbReplySlot << objBits undefined then return (tcbReply tcb) else if p - fst pa = tcbCallerSlot << objBits undefined then return (tcbCaller tcb) else if p - fst pa = tcbIPCBufferSlot << objBits undefined then return (tcbIPCBufferFrame tcb) else fail
od | KOCTE cte \<Rightarrow> do y <- when (p \<noteq> fst pa) fail;
y <- assert (is_aligned p (objBits cte));
y <- assert (case snd (lookupAround2 p map) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits cte \<le> z - p);
return cte
od | _ \<Rightarrow> fail
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rva. \<forall>s. ksPSpace (f s) = ksPSpace s \<Longrightarrow> (\<forall>x6. (p - fst rva = tcbIPCBufferSlot << objBits undefined \<longrightarrow> (tcbIPCBufferSlot << objBits undefined = tcbCallerSlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbReplySlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbReply x6)
od)))) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbReplySlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCaller x6)
od))))) \<and> (tcbIPCBufferSlot << objBits undefined \<noteq> tcbCallerSlot << objBits undefined \<longrightarrow> (tcbIPCBufferSlot << objBits undefined = tcbReplySlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbReply x6)
od)))) \<and> (tcbIPCBufferSlot << objBits undefined \<noteq> tcbReplySlot << objBits undefined \<longrightarrow> (tcbIPCBufferSlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbIPCBufferSlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbIPCBufferSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbIPCBufferSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbIPCBufferFrame x6)
od)))))) \<and> (p - fst rva \<noteq> tcbIPCBufferSlot << objBits undefined \<longrightarrow> (p - fst rva = tcbCallerSlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbReplySlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbReply x6)
od)))) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbReplySlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCallerSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCallerSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCaller x6)
od))))) \<and> (p - fst rva \<noteq> tcbCallerSlot << objBits undefined \<longrightarrow> (p - fst rva = tcbReplySlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (tcbReplySlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbReplySlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbReply x6)
od)))) \<and> (p - fst rva \<noteq> tcbReplySlot << objBits undefined \<longrightarrow> (p - fst rva = tcbCTableSlot << objBits undefined \<longrightarrow> (tcbCTableSlot << objBits undefined = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (tcbCTableSlot << objBits undefined \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbCTable x6)
od))) \<and> (p - fst rva \<noteq> tcbCTableSlot << objBits undefined \<longrightarrow> (p - fst rva = tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
return (tcbVTable x6)
od)) \<and> (p - fst rva \<noteq> tcbVTableSlot << objBits undefined \<longrightarrow> snd rva = KOTCB x6 \<longrightarrow> oblivious f (do y <- assert (is_aligned (fst rva) (objBits x6));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x6 \<le> z - fst rva);
fail
od))))))) \<and> (\<forall>x7. snd rva = KOCTE x7 \<longrightarrow> oblivious f (do y <- when (p \<noteq> fst rva) fail;
y <- assert (is_aligned p (objBits x7));
y <- assert (case snd (lookupAround2 p rv) of None \<Rightarrow> True | Some z \<Rightarrow> 2 ^ objBits x7 \<le> z - p);
return x7
od))