theory Move_C

lemma cteDeleteOne_sch_act_wf:
  "\<lbrace>\<lambda>s. sch_act_wf (ksSchedulerAction s) s\<rbrace>
  cteDeleteOne slot
  \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s\<rbrace>" apply (simp add: cteDeleteOne_def unless_when split_def) apply (simp add: finaliseCapTrue_standin_def Let_def) apply (rule hoare_pre) apply (wp isFinalCapability_inv cancelAllSignals_sch_act_wf
            cancelAllIPC_sch_act_wf getCTE_wp' hoare_weak_lift_imp
         | wpc
         | simp add: Let_def split: if_split)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. sch_act_wf (ksSchedulerAction s) s\<rbrace> cteDeleteOne slot \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. sch_act_wf (ksSchedulerAction s) s\<rbrace> do cte <- getCTE slot;
when (cteCap cte \<noteq> capability.NullCap) (do final <- isFinalCapability cte;
p <- finaliseCapTrue_standin (cteCap cte) final;
y <- assert (capRemovable (fst p) slot \<and> snd p = capability.NullCap);
emptySlot slot capability.NullCap
od)
od \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. sch_act_wf (ksSchedulerAction s) s\<rbrace> do cte <- getCTE slot;
when (cteCap cte \<noteq> capability.NullCap) (do final <- isFinalCapability cte;
p <- if isEndpointCap (cteCap cte) then do y <- when final (cancelAllIPC (capEPPtr (cteCap cte)));
return (capability.NullCap, capability.NullCap)
od else if isNotificationCap (cteCap cte) then do y <- when final (do y <- unbindMaybeNotification (capNtfnPtr (cteCap cte));
cancelAllSignals (capNtfnPtr (cteCap cte))
od);
return (capability.NullCap, capability.NullCap)
od else if isReplyCap (cteCap cte) then return (capability.NullCap, capability.NullCap) else if cteCap cte = capability.NullCap then return (capability.NullCap, capability.NullCap) else if cteCap cte = capability.DomainCap then return (capability.NullCap, capability.NullCap) else fail;
y <- assert (capRemovable (fst p) slot \<and> snd p = capability.NullCap);
emptySlot slot capability.NullCap
od)
od \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q6\<rbrace> do cte <- getCTE slot;
when (cteCap cte \<noteq> capability.NullCap) (do final <- isFinalCapability cte;
p <- if isEndpointCap (cteCap cte) then do y <- when final (cancelAllIPC (capEPPtr (cteCap cte)));
return (capability.NullCap, capability.NullCap)
od else if isNotificationCap (cteCap cte) then do y <- when final (do y <- unbindMaybeNotification (capNtfnPtr (cteCap cte));
cancelAllSignals (capNtfnPtr (cteCap cte))
od);
return (capability.NullCap, capability.NullCap)
od else if isReplyCap (cteCap cte) then return (capability.NullCap, capability.NullCap) else if cteCap cte = capability.NullCap then return (capability.NullCap, capability.NullCap) else if cteCap cte = capability.DomainCap then return (capability.NullCap, capability.NullCap) else fail;
y <- assert (capRemovable (fst p) slot \<and> snd p = capability.NullCap);
emptySlot slot capability.NullCap
od)
od \<lbrace>\<lambda>rv s. sch_act_wf (ksSchedulerAction s) s\<rbrace>
 2. \<And>s. sch_act_wf (ksSchedulerAction s) s \<Longrightarrow> ?Q6 s proof (prove)
goal:
No subgoals!