theory Ipc_R

lemma lookupCapAndSlot_corres:
  "cptr = to_bl cptr' \<Longrightarrow>
  corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a)))
    (valid_objs and pspace_aligned and tcb_at thread)
    (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread)
    (lookup_cap_and_slot thread cptr) (lookupCapAndSlot thread cptr')" unfolding lookup_cap_and_slot_def lookupCapAndSlot_def apply (simp add: liftE_bindE split_def) apply (rule corres_guard_imp) apply (rule_tac r'="\<lambda>rv rv'. rv' = cte_map (fst rv)"
                 in corres_splitEE) apply (rule corres_rel_imp, rule lookupSlotForThread_corres) apply (simp add: split_def) apply (rule corres_split[OF getSlotCap_corres]) apply simp apply (rule corres_returnOkTT, simp) apply wp+ apply (wp | simp add: liftE_bindE[symmetric])+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cptr = to_bl cptr' \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (valid_objs and pspace_aligned and tcb_at thread) (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) (lookup_cap_and_slot thread cptr) (lookupCapAndSlot thread cptr') proof (prove)
goal (1 subgoal):
 1. cptr = to_bl cptr' \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (valid_objs and pspace_aligned and tcb_at thread) (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) (doE (slot, cr) <- lookup_slot_for_thread thread cptr;
cap <- liftE $ get_cap slot;
returnOk (cap, slot)
odE) (doE slot <- lookupSlotForThread thread cptr';
cap <- withoutFailure $ getSlotCap slot;
returnOk (cap, slot)
odE) proof (prove)
goal (1 subgoal):
 1. cptr = to_bl cptr' \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (valid_objs and pspace_aligned and tcb_at thread) (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) (doE p <- lookup_slot_for_thread thread (to_bl cptr');
do cap <- get_cap (fst p);
returnOk (cap, fst p)
od
odE) (doE slot <- lookupSlotForThread thread cptr';
do cap <- getSlotCap slot;
returnOk (cap, slot)
od
odE) proof (prove)
goal (3 subgoals):
 1. cptr = to_bl cptr' \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) ?Q1 ?Q'1 (doE p <- lookup_slot_for_thread thread (to_bl cptr');
do cap <- get_cap (fst p);
returnOk (cap, fst p)
od
odE) (doE slot <- lookupSlotForThread thread cptr';
do cap <- getSlotCap slot;
returnOk (cap, slot)
od
odE)
 2. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> ?Q1 s
 3. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> ?Q'1 s proof (prove)
goal (6 subgoals):
 1. cptr = to_bl cptr' \<Longrightarrow> corres (lfr \<oplus> (\<lambda>rv rv'. rv' = cte_map (fst rv))) ?P5 ?P'5 (lookup_slot_for_thread thread (to_bl cptr')) (lookupSlotForThread thread cptr')
 2. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (?R5 rv) (?R'5 rv') (do cap <- get_cap (fst rv);
returnOk (cap, fst rv)
od) (do cap <- getSlotCap rv';
returnOk (cap, rv')
od)
 3. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (?P5 and ?Q5) s
 6. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (?P'5 and ?Q'5) s proof (prove)
goal (6 subgoals):
 1. \<And>x y. \<lbrakk>cptr = to_bl cptr'; (lfr \<oplus> (\<lambda>(cref, bits) cref'. cref' = cte_map cref)) x y\<rbrakk> \<Longrightarrow> (lfr \<oplus> (\<lambda>rv rv'. rv' = cte_map (fst rv))) x y
 2. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (?R5 rv) (?R'5 rv') (do cap <- get_cap (fst rv);
returnOk (cap, fst rv)
od) (do cap <- getSlotCap rv';
returnOk (cap, rv')
od)
 3. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and ?Q5) s
 6. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'5) s proof (prove)
goal (5 subgoals):
 1. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (?R5 rv) (?R'5 rv') (do cap <- get_cap (fst rv);
returnOk (cap, fst rv)
od) (do cap <- getSlotCap rv';
returnOk (cap, rv')
od)
 2. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>?R5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>?R'5\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and ?Q5) s
 5. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'5) s proof (prove)
goal (8 subgoals):
 1. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> rv' = cte_map (fst rv)
 2. \<And>rv rv' cap capa. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv); cap_relation cap capa\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (?R11 rv rv' cap) (?R'11 rv rv' capa) (returnOk (cap, fst rv)) (returnOk (capa, rv'))
 3. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 rv\<rbrace> get_cap (fst rv) \<lbrace>?R11 rv rv'\<rbrace>
 4. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 rv'\<rbrace> getSlotCap rv' \<lbrace>?R'11 rv rv'\<rbrace>
 5. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) (fst rv) and ?Q14 rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and ?Q'15 rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and ?Q5) s
 8. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'5) s proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' cap capa. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv); cap_relation cap capa\<rbrakk> \<Longrightarrow> corres (lfr \<oplus> (\<lambda>a b. cap_relation (fst a) (fst b) \<and> snd b = cte_map (snd a))) (?R11 rv rv' cap) (?R'11 rv rv' capa) (returnOk (cap, fst rv)) (returnOk (capa, rv'))
 2. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 rv\<rbrace> get_cap (fst rv) \<lbrace>?R11 rv rv'\<rbrace>
 3. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 rv'\<rbrace> getSlotCap rv' \<lbrace>?R'11 rv rv'\<rbrace>
 4. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) (fst rv) and ?Q14 rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and ?Q'15 rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and ?Q5) s
 7. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'5) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q14 rv\<rbrace> get_cap (fst rv) \<lbrace>\<lambda>cap _. True\<rbrace>
 2. \<And>rv rv'. \<lbrakk>cptr = to_bl cptr'; rv' = cte_map (fst rv)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'15 rv'\<rbrace> getSlotCap rv' \<lbrace>\<lambda>capa _. True\<rbrace>
 3. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q5\<rbrace> lookup_slot_for_thread thread (to_bl cptr') \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>_. True) (fst rv) and ?Q14 rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. cptr = to_bl cptr' \<Longrightarrow> \<lbrace>?Q'5\<rbrace> lookupSlotForThread thread cptr' \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and ?Q'15 rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and ?Q5) s
 6. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and ?Q'5) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs and pspace_aligned and tcb_at thread) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and tcb_at thread and (\<lambda>s. True \<and> valid_objs s \<and> True)) s
 2. \<And>s. \<lbrakk>cptr = to_bl cptr'; (valid_objs' and pspace_distinct' and pspace_aligned' and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (valid_objs' and pspace_aligned' and pspace_distinct' and tcb_at' thread and (\<lambda>s. True \<and> (pspace_distinct' and pspace_aligned' and (\<lambda>_. True)) s)) s proof (prove)
goal:
No subgoals!